1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
|
package config
import (
"errors"
"io/ioutil"
"net/url"
"os"
"path"
"path/filepath"
"sync"
"gitlab.com/gitlab-org/gitlab-shell/client"
yaml "gopkg.in/yaml.v2"
)
const (
configFile = "config.yml"
defaultSecretFileName = ".gitlab_shell_secret"
)
type ServerConfig struct {
Listen string `yaml:"listen,omitempty"`
ProxyProtocol bool `yaml:"proxy_protocol,omitempty"`
WebListen string `yaml:"web_listen,omitempty"`
ConcurrentSessionsLimit int64 `yaml:"concurrent_sessions_limit,omitempty"`
HostKeyFiles []string `yaml:"host_key_files,omitempty"`
}
type HttpSettingsConfig struct {
User string `yaml:"user"`
Password string `yaml:"password"`
ReadTimeoutSeconds uint64 `yaml:"read_timeout"`
CaFile string `yaml:"ca_file"`
CaPath string `yaml:"ca_path"`
SelfSignedCert bool `yaml:"self_signed_cert"`
}
type Config struct {
User string `yaml:"user,omitempty"`
RootDir string
LogFile string `yaml:"log_file,omitempty"`
LogFormat string `yaml:"log_format,omitempty"`
GitlabUrl string `yaml:"gitlab_url"`
GitlabRelativeURLRoot string `yaml:"gitlab_relative_url_root"`
GitlabTracing string `yaml:"gitlab_tracing"`
// SecretFilePath is only for parsing. Application code should always use Secret.
SecretFilePath string `yaml:"secret_file"`
Secret string `yaml:"secret"`
SslCertDir string `yaml:"ssl_cert_dir"`
HttpSettings HttpSettingsConfig `yaml:"http_settings"`
Server ServerConfig `yaml:"sshd"`
httpClient *client.HttpClient
httpClientOnce sync.Once
}
// The defaults to apply before parsing the config file(s).
var (
DefaultConfig = Config{
LogFile: "gitlab-shell.log",
LogFormat: "text",
Server: DefaultServerConfig,
User: "git",
}
DefaultServerConfig = ServerConfig{
Listen: "[::]:22",
WebListen: "localhost:9122",
ConcurrentSessionsLimit: 10,
HostKeyFiles: []string{
"/run/secrets/ssh-hostkeys/ssh_host_rsa_key",
"/run/secrets/ssh-hostkeys/ssh_host_ecdsa_key",
"/run/secrets/ssh-hostkeys/ssh_host_ed25519_key",
},
}
)
func (c *Config) ApplyGlobalState() {
if c.SslCertDir != "" {
os.Setenv("SSL_CERT_DIR", c.SslCertDir)
}
}
func (c *Config) HttpClient() *client.HttpClient {
c.httpClientOnce.Do(func() {
c.httpClient = client.NewHTTPClient(
c.GitlabUrl,
c.GitlabRelativeURLRoot,
c.HttpSettings.CaFile,
c.HttpSettings.CaPath,
c.HttpSettings.SelfSignedCert,
c.HttpSettings.ReadTimeoutSeconds,
)
})
return c.httpClient
}
// NewFromDirExternal returns a new config from a given root dir. It also applies defaults appropriate for
// gitlab-shell running in an external SSH server.
func NewFromDirExternal(dir string) (*Config, error) {
cfg, err := newFromFile(filepath.Join(dir, configFile))
if err != nil {
return nil, err
}
cfg.ApplyGlobalState()
return cfg, nil
}
// NewFromDir returns a new config given a root directory. It looks for the config file name in the
// given directory and reads the config from it. It doesn't apply any defaults. New code should prefer
// this over NewFromDirIntegrated and apply the right default via one of the Apply... functions.
func NewFromDir(dir string) (*Config, error) {
return newFromFile(filepath.Join(dir, configFile))
}
// newFromFile reads a new Config instance from the given file path. It doesn't apply any defaults.
func newFromFile(path string) (*Config, error) {
cfg := &Config{}
*cfg = DefaultConfig
cfg.RootDir = filepath.Dir(path)
configBytes, err := ioutil.ReadFile(path)
if err != nil {
return nil, err
}
if err := yaml.Unmarshal(configBytes, cfg); err != nil {
return nil, err
}
if cfg.GitlabUrl != "" {
// This is only done for historic reasons, don't implement it for new config sources.
unescapedUrl, err := url.PathUnescape(cfg.GitlabUrl)
if err != nil {
return nil, err
}
cfg.GitlabUrl = unescapedUrl
}
if err := parseSecret(cfg); err != nil {
return nil, err
}
if len(cfg.LogFile) > 0 && cfg.LogFile[0] != '/' && cfg.RootDir != "" {
cfg.LogFile = filepath.Join(cfg.RootDir, cfg.LogFile)
}
return cfg, nil
}
func parseSecret(cfg *Config) error {
// The secret was parsed from yaml no need to read another file
if cfg.Secret != "" {
return nil
}
if cfg.SecretFilePath == "" {
cfg.SecretFilePath = defaultSecretFileName
}
if !filepath.IsAbs(cfg.SecretFilePath) {
cfg.SecretFilePath = path.Join(cfg.RootDir, cfg.SecretFilePath)
}
secretFileContent, err := ioutil.ReadFile(cfg.SecretFilePath)
if err != nil {
return err
}
cfg.Secret = string(secretFileContent)
return nil
}
// IsSane checks if the given config fulfills the minimum requirements to be able to run.
// Any error returned by this function should be a startup error. On the other hand
// if this function returns nil, this doesn't guarantee the config will work, but it's
// at least worth a try.
func (cfg *Config) IsSane() error {
if cfg.GitlabUrl == "" {
return errors.New("gitlab_url is required")
}
if cfg.Secret == "" {
return errors.New("secret or secret_file_path is required")
}
return nil
}
|
