···4344 secretsYml = ''
45 production:
46- db_key_base: ${cfg.secrets.db_key_base}
0047 '';
4849 gitlabConfig = {
···121 makeWrapper ${cfg.packages.gitlab.env}/bin/bundle $out/bin/gitlab-bundle \
122 ${concatStrings (mapAttrsToList (name: value: "--set ${name} '${value}' ") gitlabEnv)} \
123 --set GITLAB_CONFIG_PATH '${cfg.statePath}/config' \
124- --set PATH '${stdenv.lib.makeBinPath [ pkgs.nodejs pkgs.gzip config.services.postgresql.package ]}:$PATH' \
125 --set RAKEOPT '-f ${cfg.packages.gitlab}/share/gitlab/Rakefile' \
126 --run 'cd ${cfg.packages.gitlab}/share/gitlab'
127 makeWrapper $out/bin/gitlab-bundle $out/bin/gitlab-rake \
···318 };
319 };
320321- secrets.db_key_base = mkOption {
322 type = types.str;
323- example = "";
324 description = ''
325- The db_key_base secrets is used to encrypt variables in the DB. If
326 you change or lose this key you will be unable to access variables
327 stored in database.
328···331 '';
332 };
333000000000000000000000000334 extraConfig = mkOption {
335 type = types.attrs;
336 default = {};
···458 rm -rf ${cfg.statePath}/config ${cfg.statePath}/shell/hooks
459 mkdir -p ${cfg.statePath}/config ${cfg.statePath}/shell
460461- # TODO: What exactly is gitlab-shell doing with the secret?
462- tr -dc _A-Z-a-z-0-9 < /dev/urandom | head -c 20 > ${cfg.statePath}/config/gitlab_shell_secret
463464 # The uploads directory is hardcoded somewhere deep in rails. It is
465 # symlinked in the gitlab package to /run/gitlab/uploads to make it
···4344 secretsYml = ''
45 production:
46+ secret_key_base: ${cfg.secrets.secret}
47+ otp_key_base: ${cfg.secrets.otp}
48+ db_key_base: ${cfg.secrets.db}
49 '';
5051 gitlabConfig = {
···123 makeWrapper ${cfg.packages.gitlab.env}/bin/bundle $out/bin/gitlab-bundle \
124 ${concatStrings (mapAttrsToList (name: value: "--set ${name} '${value}' ") gitlabEnv)} \
125 --set GITLAB_CONFIG_PATH '${cfg.statePath}/config' \
126+ --set PATH '${lib.makeBinPath [ pkgs.nodejs pkgs.gzip config.services.postgresql.package ]}:$PATH' \
127 --set RAKEOPT '-f ${cfg.packages.gitlab}/share/gitlab/Rakefile' \
128 --run 'cd ${cfg.packages.gitlab}/share/gitlab'
129 makeWrapper $out/bin/gitlab-bundle $out/bin/gitlab-rake \
···320 };
321 };
322323+ secrets.secret = mkOption {
324 type = types.str;
0325 description = ''
326+ The secret is used to encrypt variables in the DB. If
327 you change or lose this key you will be unable to access variables
328 stored in database.
329···332 '';
333 };
334335+ secrets.db = mkOption {
336+ type = types.str;
337+ description = ''
338+ The secret is used to encrypt variables in the DB. If
339+ you change or lose this key you will be unable to access variables
340+ stored in database.
341+342+ Make sure the secret is at least 30 characters and all random,
343+ no regular words or you'll be exposed to dictionary attacks.
344+ '';
345+ };
346+347+ secrets.otp = mkOption {
348+ type = types.str;
349+ description = ''
350+ The secret is used to encrypt secrets for OTP tokens. If
351+ you change or lose this key, users which have 2FA enabled for login
352+ won't be able to login anymore.
353+354+ Make sure the secret is at least 30 characters and all random,
355+ no regular words or you'll be exposed to dictionary attacks.
356+ '';
357+ };
358+359 extraConfig = mkOption {
360 type = types.attrs;
361 default = {};
···483 rm -rf ${cfg.statePath}/config ${cfg.statePath}/shell/hooks
484 mkdir -p ${cfg.statePath}/config ${cfg.statePath}/shell
485486+ tr -dc A-Za-z0-9 < /dev/urandom | head -c 32 > ${cfg.statePath}/config/gitlab_shell_secret
0487488 # The uploads directory is hardcoded somewhere deep in rails. It is
489 # symlinked in the gitlab package to /run/gitlab/uploads to make it
+11-6
nixos/modules/services/misc/gitlab.xml
···62 address = "localhost";
63 port = 25;
64 };
65- secrets.db_key_base = "ei3eeP1ohsh0uu3ad4YeeMeeheengah3AiZee2ohl4Ooj5mie4Ohl0vishoghaes";
000066 extraConfig = {
67 gitlab = {
68 email_from = "gitlab-no-reply@example.com";
···75</programlisting>
76</para>
7778-<para>If you're setting up a new Gitlab instance, generate a new
79-<literal>db_key_base</literal> secret to encrypt sensible data in the
80-database. If you're restoring an existing Gitlab instance, you must
81-specify the <literal>db_key_base</literal> secret from
82-<literal>config/secrets.yml</literal> in your Gitlab state folder.</para>
08384<para>Refer to <xref linkend="ch-options" /> for all available configuration
85options for the <literal>services.gitlab</literal> module.</para>
···62 address = "localhost";
63 port = 25;
64 };
65+ secrets = {
66+ db = "uPgq1gtwwHiatiuE0YHqbGa5lEIXH7fMsvuTNgdzJi8P0Dg12gibTzBQbq5LT7PNzcc3BP9P1snHVnduqtGF43PgrQtU7XL93ts6gqe9CBNhjtaqUwutQUDkygP5NrV6";
67+ secret = "devzJ0Tz0POiDBlrpWmcsjjrLaltyiAdS8TtgT9YNBOoUcDsfppiY3IXZjMVtKgXrFImIennFGOpPN8IkP8ATXpRgDD5rxVnKuTTwYQaci2NtaV1XxOQGjdIE50VGsR3";
68+ otp = "e1GATJVuS2sUh7jxiPzZPre4qtzGGaS22FR50Xs1TerRVdgI3CBVUi5XYtQ38W4xFeS4mDqi5cQjExE838iViSzCdcG19XSL6qNsfokQP9JugwiftmhmCadtsnHErBMI";
69+ };
70 extraConfig = {
71 gitlab = {
72 email_from = "gitlab-no-reply@example.com";
···79</programlisting>
80</para>
8182+<para>If you're setting up a new Gitlab instance, generate new secrets. You
83+for instance use <literal>tr -dc A-Za-z0-9 < /dev/urandom | head -c 128</literal>
84+to generate a new secret. Gitlab encrypts sensitive data stored in the database.
85+If you're restoring an existing Gitlab instance, you must specify the secrets
86+secret from <literal>config/secrets.yml</literal> located in your Gitlab state
87+folder.</para>
8889<para>Refer to <xref linkend="ch-options" /> for all available configuration
90options for the <literal>services.gitlab</literal> module.</para>