···43434444 secretsYml = ''
4545 production:
4646- db_key_base: ${cfg.secrets.db_key_base}
4646+ secret_key_base: ${cfg.secrets.secret}
4747+ otp_key_base: ${cfg.secrets.otp}
4848+ db_key_base: ${cfg.secrets.db}
4749 '';
48504951 gitlabConfig = {
···121123 makeWrapper ${cfg.packages.gitlab.env}/bin/bundle $out/bin/gitlab-bundle \
122124 ${concatStrings (mapAttrsToList (name: value: "--set ${name} '${value}' ") gitlabEnv)} \
123125 --set GITLAB_CONFIG_PATH '${cfg.statePath}/config' \
124124- --set PATH '${stdenv.lib.makeBinPath [ pkgs.nodejs pkgs.gzip config.services.postgresql.package ]}:$PATH' \
126126+ --set PATH '${lib.makeBinPath [ pkgs.nodejs pkgs.gzip config.services.postgresql.package ]}:$PATH' \
125127 --set RAKEOPT '-f ${cfg.packages.gitlab}/share/gitlab/Rakefile' \
126128 --run 'cd ${cfg.packages.gitlab}/share/gitlab'
127129 makeWrapper $out/bin/gitlab-bundle $out/bin/gitlab-rake \
···318320 };
319321 };
320322321321- secrets.db_key_base = mkOption {
323323+ secrets.secret = mkOption {
322324 type = types.str;
323323- example = "";
324325 description = ''
325325- The db_key_base secrets is used to encrypt variables in the DB. If
326326+ The secret is used to encrypt variables in the DB. If
326327 you change or lose this key you will be unable to access variables
327328 stored in database.
328329···331332 '';
332333 };
333334335335+ secrets.db = mkOption {
336336+ type = types.str;
337337+ description = ''
338338+ The secret is used to encrypt variables in the DB. If
339339+ you change or lose this key you will be unable to access variables
340340+ stored in database.
341341+342342+ Make sure the secret is at least 30 characters and all random,
343343+ no regular words or you'll be exposed to dictionary attacks.
344344+ '';
345345+ };
346346+347347+ secrets.otp = mkOption {
348348+ type = types.str;
349349+ description = ''
350350+ The secret is used to encrypt secrets for OTP tokens. If
351351+ you change or lose this key, users which have 2FA enabled for login
352352+ won't be able to login anymore.
353353+354354+ Make sure the secret is at least 30 characters and all random,
355355+ no regular words or you'll be exposed to dictionary attacks.
356356+ '';
357357+ };
358358+334359 extraConfig = mkOption {
335360 type = types.attrs;
336361 default = {};
···458483 rm -rf ${cfg.statePath}/config ${cfg.statePath}/shell/hooks
459484 mkdir -p ${cfg.statePath}/config ${cfg.statePath}/shell
460485461461- # TODO: What exactly is gitlab-shell doing with the secret?
462462- tr -dc _A-Z-a-z-0-9 < /dev/urandom | head -c 20 > ${cfg.statePath}/config/gitlab_shell_secret
486486+ tr -dc A-Za-z0-9 < /dev/urandom | head -c 32 > ${cfg.statePath}/config/gitlab_shell_secret
463487464488 # The uploads directory is hardcoded somewhere deep in rails. It is
465489 # symlinked in the gitlab package to /run/gitlab/uploads to make it
+11-6
nixos/modules/services/misc/gitlab.xml
···6262 address = "localhost";
6363 port = 25;
6464 };
6565- secrets.db_key_base = "ei3eeP1ohsh0uu3ad4YeeMeeheengah3AiZee2ohl4Ooj5mie4Ohl0vishoghaes";
6565+ secrets = {
6666+ db = "uPgq1gtwwHiatiuE0YHqbGa5lEIXH7fMsvuTNgdzJi8P0Dg12gibTzBQbq5LT7PNzcc3BP9P1snHVnduqtGF43PgrQtU7XL93ts6gqe9CBNhjtaqUwutQUDkygP5NrV6";
6767+ secret = "devzJ0Tz0POiDBlrpWmcsjjrLaltyiAdS8TtgT9YNBOoUcDsfppiY3IXZjMVtKgXrFImIennFGOpPN8IkP8ATXpRgDD5rxVnKuTTwYQaci2NtaV1XxOQGjdIE50VGsR3";
6868+ otp = "e1GATJVuS2sUh7jxiPzZPre4qtzGGaS22FR50Xs1TerRVdgI3CBVUi5XYtQ38W4xFeS4mDqi5cQjExE838iViSzCdcG19XSL6qNsfokQP9JugwiftmhmCadtsnHErBMI";
6969+ };
6670 extraConfig = {
6771 gitlab = {
6872 email_from = "gitlab-no-reply@example.com";
···7579</programlisting>
7680</para>
77817878-<para>If you're setting up a new Gitlab instance, generate a new
7979-<literal>db_key_base</literal> secret to encrypt sensible data in the
8080-database. If you're restoring an existing Gitlab instance, you must
8181-specify the <literal>db_key_base</literal> secret from
8282-<literal>config/secrets.yml</literal> in your Gitlab state folder.</para>
8282+<para>If you're setting up a new Gitlab instance, generate new secrets. You
8383+for instance use <literal>tr -dc A-Za-z0-9 < /dev/urandom | head -c 128</literal>
8484+to generate a new secret. Gitlab encrypts sensitive data stored in the database.
8585+If you're restoring an existing Gitlab instance, you must specify the secrets
8686+secret from <literal>config/secrets.yml</literal> located in your Gitlab state
8787+folder.</para>
83888489<para>Refer to <xref linkend="ch-options" /> for all available configuration
8590options for the <literal>services.gitlab</literal> module.</para>