diff options
Diffstat (limited to 'nixpkgs/nixos/modules/services/misc/gitlab.nix')
| -rw-r--r-- | nixpkgs/nixos/modules/services/misc/gitlab.nix | 223 |
1 files changed, 128 insertions, 95 deletions
diff --git a/nixpkgs/nixos/modules/services/misc/gitlab.nix b/nixpkgs/nixos/modules/services/misc/gitlab.nix index e95ab0a112bc..7b96a182f0d9 100644 --- a/nixpkgs/nixos/modules/services/misc/gitlab.nix +++ b/nixpkgs/nixos/modules/services/misc/gitlab.nix @@ -18,6 +18,8 @@ let gitalySocket = "${cfg.statePath}/tmp/sockets/gitaly.socket"; pathUrlQuote = url: replaceStrings ["/"] ["%2F"] url; + gitlabVersionAtLeast = version: lib.versionAtLeast (lib.getVersion cfg.packages.gitlab) version; + databaseConfig = let val = { adapter = "postgresql"; @@ -27,10 +29,16 @@ let encoding = "utf8"; pool = cfg.databasePool; } // cfg.extraDatabaseConfig; - in if lib.versionAtLeast (lib.getVersion cfg.packages.gitlab) "15.0" then { - production.main = val; - } else { - production = val; + in { + production = ( + if (gitlabVersionAtLeast "15.0") + then { main = val; } + else val + ) // lib.optionalAttrs (gitlabVersionAtLeast "15.9") { + ci = val // { + database_tasks = false; + }; + }; }; # We only want to create a database if we're actually going to connect to it. @@ -253,7 +261,7 @@ in { enable = mkOption { type = types.bool; default = false; - description = lib.mdDoc '' + description = '' Enable the gitlab service. ''; }; @@ -273,7 +281,7 @@ in { statePath = mkOption { type = types.str; default = "/var/gitlab/state"; - description = lib.mdDoc '' + description = '' GitLab state directory. Configuration, repositories and logs, among other things, are stored here. @@ -287,7 +295,7 @@ in { extraEnv = mkOption { type = types.attrsOf types.str; default = {}; - description = lib.mdDoc '' + description = '' Additional environment variables for the GitLab environment. ''; }; @@ -296,7 +304,7 @@ in { type = with types; either str (listOf str); default = []; example = "03:00"; - description = lib.mdDoc '' + description = '' The time(s) to run automatic backup of GitLab state. Specified in systemd's time format; see {manpage}`systemd.time(7)`. @@ -307,7 +315,7 @@ in { type = types.str; default = cfg.statePath + "/backup"; defaultText = literalExpression ''config.${opt.statePath} + "/backup"''; - description = lib.mdDoc "GitLab path for backups."; + description = "GitLab path for backups."; }; backup.keepTime = mkOption { @@ -315,7 +323,7 @@ in { default = 0; example = 48; apply = x: x * 60 * 60; - description = lib.mdDoc '' + description = '' How long to keep the backups around, in hours. `0` means “keep forever”. ''; @@ -339,7 +347,7 @@ in { default = []; example = [ "artifacts" "lfs" ]; apply = x: if isString x then x else concatStringsSep "," x; - description = lib.mdDoc '' + description = '' Directories to exclude from the backup. The example excludes CI artifacts and LFS objects from the backups. The `tar` option skips the creation of a tar @@ -378,7 +386,7 @@ in { storage_class = "STANDARD"; }; ''; - description = lib.mdDoc '' + description = '' GitLab automatic upload specification. Tells GitLab to upload the backup to a remote location when done. @@ -391,7 +399,7 @@ in { databaseHost = mkOption { type = types.str; default = ""; - description = lib.mdDoc '' + description = '' GitLab database hostname. An empty string means “use local unix socket connection”. ''; @@ -400,7 +408,7 @@ in { databasePasswordFile = mkOption { type = with types; nullOr path; default = null; - description = lib.mdDoc '' + description = '' File containing the GitLab database user password. This should be a string, not a nix path, since nix paths are @@ -411,7 +419,7 @@ in { databaseCreateLocally = mkOption { type = types.bool; default = true; - description = lib.mdDoc '' + description = '' Whether a database should be automatically created on the local host. Set this to `false` if you plan on provisioning a local database yourself. This has no effect @@ -422,32 +430,32 @@ in { databaseName = mkOption { type = types.str; default = "gitlab"; - description = lib.mdDoc "GitLab database name."; + description = "GitLab database name."; }; databaseUsername = mkOption { type = types.str; default = "gitlab"; - description = lib.mdDoc "GitLab database user."; + description = "GitLab database user."; }; databasePool = mkOption { type = types.int; default = 5; - description = lib.mdDoc "Database connection pool size."; + description = "Database connection pool size."; }; extraDatabaseConfig = mkOption { type = types.attrs; default = {}; - description = lib.mdDoc "Extra configuration in config/database.yml."; + description = "Extra configuration in config/database.yml."; }; redisUrl = mkOption { type = types.str; default = "unix:/run/gitlab/redis.sock"; example = "redis://localhost:6379/"; - description = lib.mdDoc "Redis URL for all GitLab services."; + description = "Redis URL for all GitLab services."; }; extraGitlabRb = mkOption { @@ -463,7 +471,7 @@ in { } end ''; - description = lib.mdDoc '' + description = '' Extra configuration to be placed in config/extra-gitlab.rb. This can be used to add configuration not otherwise exposed through this module's options. @@ -474,13 +482,13 @@ in { type = types.str; default = config.networking.hostName; defaultText = literalExpression "config.networking.hostName"; - description = lib.mdDoc "GitLab host name. Used e.g. for copy-paste URLs."; + description = "GitLab host name. Used e.g. for copy-paste URLs."; }; port = mkOption { type = types.port; default = 8080; - description = lib.mdDoc '' + description = '' GitLab server port for copy-paste URLs, e.g. 80 or 443 if you're service over https. ''; @@ -489,25 +497,25 @@ in { https = mkOption { type = types.bool; default = false; - description = lib.mdDoc "Whether gitlab prints URLs with https as scheme."; + description = "Whether gitlab prints URLs with https as scheme."; }; user = mkOption { type = types.str; default = "gitlab"; - description = lib.mdDoc "User to run gitlab and all related services."; + description = "User to run gitlab and all related services."; }; group = mkOption { type = types.str; default = "gitlab"; - description = lib.mdDoc "Group to run gitlab and all related services."; + description = "Group to run gitlab and all related services."; }; initialRootEmail = mkOption { type = types.str; default = "admin@local.host"; - description = lib.mdDoc '' + description = '' Initial email address of the root account if this is a new install. ''; }; @@ -515,7 +523,7 @@ in { initialRootPasswordFile = mkOption { type = with types; nullOr path; default = null; - description = lib.mdDoc '' + description = '' File containing the initial password of the root account if this is a new install. @@ -528,7 +536,7 @@ in { enable = mkOption { type = types.bool; default = false; - description = lib.mdDoc "Enable GitLab container registry."; + description = "Enable GitLab container registry."; }; package = mkOption { type = types.package; @@ -537,7 +545,7 @@ in { then pkgs.gitlab-container-registry else pkgs.docker-distribution; defaultText = literalExpression "pkgs.docker-distribution"; - description = lib.mdDoc '' + description = '' Container registry package to use. External container registries such as `pkgs.docker-distribution` are not supported @@ -548,45 +556,45 @@ in { type = types.str; default = config.services.gitlab.host; defaultText = literalExpression "config.services.gitlab.host"; - description = lib.mdDoc "GitLab container registry host name."; + description = "GitLab container registry host name."; }; port = mkOption { type = types.port; default = 4567; - description = lib.mdDoc "GitLab container registry port."; + description = "GitLab container registry port."; }; certFile = mkOption { type = types.path; - description = lib.mdDoc "Path to GitLab container registry certificate."; + description = "Path to GitLab container registry certificate."; }; keyFile = mkOption { type = types.path; - description = lib.mdDoc "Path to GitLab container registry certificate-key."; + description = "Path to GitLab container registry certificate-key."; }; defaultForProjects = mkOption { type = types.bool; default = cfg.registry.enable; defaultText = literalExpression "config.${opt.registry.enable}"; - description = lib.mdDoc "If GitLab container registry should be enabled by default for projects."; + description = "If GitLab container registry should be enabled by default for projects."; }; issuer = mkOption { type = types.str; default = "gitlab-issuer"; - description = lib.mdDoc "GitLab container registry issuer."; + description = "GitLab container registry issuer."; }; serviceName = mkOption { type = types.str; default = "container_registry"; - description = lib.mdDoc "GitLab container registry service name."; + description = "GitLab container registry service name."; }; externalAddress = mkOption { type = types.str; default = ""; - description = lib.mdDoc "External address used to access registry from the internet"; + description = "External address used to access registry from the internet"; }; externalPort = mkOption { type = types.int; - description = lib.mdDoc "External port used to access registry from the internet"; + description = "External port used to access registry from the internet"; }; }; @@ -594,31 +602,31 @@ in { enable = mkOption { type = types.bool; default = false; - description = lib.mdDoc "Enable gitlab mail delivery over SMTP."; + description = "Enable gitlab mail delivery over SMTP."; }; address = mkOption { type = types.str; default = "localhost"; - description = lib.mdDoc "Address of the SMTP server for GitLab."; + description = "Address of the SMTP server for GitLab."; }; port = mkOption { type = types.port; default = 25; - description = lib.mdDoc "Port of the SMTP server for GitLab."; + description = "Port of the SMTP server for GitLab."; }; username = mkOption { type = with types; nullOr str; default = null; - description = lib.mdDoc "Username of the SMTP server for GitLab."; + description = "Username of the SMTP server for GitLab."; }; passwordFile = mkOption { type = types.nullOr types.path; default = null; - description = lib.mdDoc '' + description = '' File containing the password of the SMTP server for GitLab. This should be a string, not a nix path, since nix paths @@ -629,35 +637,35 @@ in { domain = mkOption { type = types.str; default = "localhost"; - description = lib.mdDoc "HELO domain to use for outgoing mail."; + description = "HELO domain to use for outgoing mail."; }; authentication = mkOption { type = with types; nullOr str; default = null; - description = lib.mdDoc "Authentication type to use, see http://api.rubyonrails.org/classes/ActionMailer/Base.html"; + description = "Authentication type to use, see http://api.rubyonrails.org/classes/ActionMailer/Base.html"; }; enableStartTLSAuto = mkOption { type = types.bool; default = true; - description = lib.mdDoc "Whether to try to use StartTLS."; + description = "Whether to try to use StartTLS."; }; tls = mkOption { type = types.bool; default = false; - description = lib.mdDoc "Whether to use TLS wrapper-mode."; + description = "Whether to use TLS wrapper-mode."; }; opensslVerifyMode = mkOption { type = types.str; default = "peer"; - description = lib.mdDoc "How OpenSSL checks the certificate, see http://api.rubyonrails.org/classes/ActionMailer/Base.html"; + description = "How OpenSSL checks the certificate, see http://api.rubyonrails.org/classes/ActionMailer/Base.html"; }; }; - pages.enable = mkEnableOption (lib.mdDoc "the GitLab Pages service"); + pages.enable = mkEnableOption "the GitLab Pages service"; pages.settings = mkOption { example = literalExpression '' @@ -671,7 +679,7 @@ in { } ''; - description = lib.mdDoc '' + description = '' Configuration options to set in the GitLab Pages config file. @@ -693,7 +701,7 @@ in { type = with types; listOf str; apply = x: if x == [] then null else lib.concatStringsSep "," x; default = []; - description = lib.mdDoc '' + description = '' The address(es) to listen on for HTTP requests. ''; }; @@ -702,7 +710,7 @@ in { type = with types; listOf str; apply = x: if x == [] then null else lib.concatStringsSep "," x; default = []; - description = lib.mdDoc '' + description = '' The address(es) to listen on for HTTPS requests. ''; }; @@ -711,7 +719,7 @@ in { type = with types; listOf str; apply = x: if x == [] then null else lib.concatStringsSep "," x; default = [ "127.0.0.1:8090" ]; - description = lib.mdDoc '' + description = '' The address(es) to listen on for proxy requests. ''; }; @@ -721,7 +729,7 @@ in { default = "http${optionalString cfg.https "s"}://${cfg.host}/api/v4"; defaultText = "http(s)://<services.gitlab.host>/api/v4"; example = "https://gitlab.example.com/api/v4"; - description = lib.mdDoc '' + description = '' API URL to proxy artifact requests to. ''; }; @@ -731,7 +739,7 @@ in { default = "http${optionalString cfg.https "s"}://${cfg.host}"; defaultText = "http(s)://<services.gitlab.host>"; example = "https://gitlab.example.com"; - description = lib.mdDoc '' + description = '' Public GitLab server URL. ''; }; @@ -741,7 +749,7 @@ in { default = null; defaultText = "http(s)://<services.gitlab.host>"; example = "https://gitlab.example.internal"; - description = lib.mdDoc '' + description = '' Internal GitLab server used for API requests, useful if you want to send that traffic over an internal load balancer. By default, the value of @@ -754,7 +762,7 @@ in { type = with types; nullOr str; default = "${cfg.statePath}/gitlab_pages_secret"; internal = true; - description = lib.mdDoc '' + description = '' File with secret key used to authenticate with the GitLab API. ''; @@ -763,7 +771,7 @@ in { pages-domain = mkOption { type = with types; nullOr str; example = "example.com"; - description = lib.mdDoc '' + description = '' The domain to serve static pages on. ''; }; @@ -772,7 +780,7 @@ in { type = types.str; default = "${gitlabConfig.production.shared.path}/pages"; defaultText = literalExpression ''config.${opt.extraConfig}.production.shared.path + "/pages"''; - description = lib.mdDoc '' + description = '' The directory where pages are stored. ''; }; @@ -783,7 +791,7 @@ in { secrets.secretFile = mkOption { type = with types; nullOr path; default = null; - description = lib.mdDoc '' + description = '' A file containing the secret used to encrypt variables in the DB. If you change or lose this key you will be unable to access variables stored in database. @@ -799,7 +807,7 @@ in { secrets.dbFile = mkOption { type = with types; nullOr path; default = null; - description = lib.mdDoc '' + description = '' A file containing the secret used to encrypt variables in the DB. If you change or lose this key you will be unable to access variables stored in database. @@ -815,7 +823,7 @@ in { secrets.otpFile = mkOption { type = with types; nullOr path; default = null; - description = lib.mdDoc '' + description = '' A file containing the secret used to encrypt secrets for OTP tokens. If you change or lose this key, users which have 2FA enabled for login won't be able to login anymore. @@ -831,7 +839,7 @@ in { secrets.jwsFile = mkOption { type = with types; nullOr path; default = null; - description = lib.mdDoc '' + description = '' A file containing the secret used to encrypt session keys. If you change or lose this key, users will be disconnected. @@ -849,14 +857,14 @@ in { extraShellConfig = mkOption { type = types.attrs; default = {}; - description = lib.mdDoc "Extra configuration to merge into shell-config.yml"; + description = "Extra configuration to merge into shell-config.yml"; }; puma.workers = mkOption { type = types.int; default = 2; apply = x: builtins.toString x; - description = lib.mdDoc '' + description = '' The number of worker processes Puma should spawn. This controls the amount of parallel Ruby code can be executed. GitLab recommends `Number of CPU cores - 1`, but at least two. @@ -872,7 +880,7 @@ in { type = types.int; default = 0; apply = x: builtins.toString x; - description = lib.mdDoc '' + description = '' The minimum number of threads Puma should use per worker. @@ -887,7 +895,7 @@ in { type = types.int; default = 4; apply = x: builtins.toString x; - description = lib.mdDoc '' + description = '' The maximum number of threads Puma should use per worker. This limits how many threads Puma will automatically spawn in response to requests. In contrast to workers, @@ -901,10 +909,20 @@ in { ''; }; + sidekiq.concurrency = mkOption { + type = with types; nullOr int; + default = null; + description = '' + How many processor threads to use for processing sidekiq background job queues. When null, the GitLab default is used. + + See <https://docs.gitlab.com/ee/administration/sidekiq/extra_sidekiq_processes.html#manage-thread-counts-explicitly> for details. + ''; + }; + sidekiq.memoryKiller.enable = mkOption { type = types.bool; default = true; - description = lib.mdDoc '' + description = '' Whether the Sidekiq MemoryKiller should be turned on. MemoryKiller kills Sidekiq when its memory consumption exceeds a certain limit. @@ -918,7 +936,7 @@ in { type = types.int; default = 2000; apply = x: builtins.toString (x * 1024); - description = lib.mdDoc '' + description = '' The maximum amount of memory, in MiB, a Sidekiq worker is allowed to consume before being killed. ''; @@ -928,7 +946,7 @@ in { type = types.int; default = 900; apply = x: builtins.toString x; - description = lib.mdDoc '' + description = '' The time MemoryKiller waits after noticing excessive memory consumption before killing Sidekiq. ''; @@ -938,7 +956,7 @@ in { type = types.int; default = 30; apply = x: builtins.toString x; - description = lib.mdDoc '' + description = '' The time allowed for all jobs to finish before Sidekiq is killed forcefully. ''; @@ -948,7 +966,7 @@ in { enable = mkOption { type = types.bool; default = true; - description = lib.mdDoc '' + description = '' Enable rotation of log files. ''; }; @@ -956,13 +974,13 @@ in { frequency = mkOption { type = types.str; default = "daily"; - description = lib.mdDoc "How often to rotate the logs."; + description = "How often to rotate the logs."; }; keep = mkOption { type = types.int; default = 30; - description = lib.mdDoc "How many rotations to keep."; + description = "How many rotations to keep."; }; }; @@ -978,7 +996,7 @@ in { }; }; ''; - description = lib.mdDoc '' + description = '' Configuration options to add to Workhorse's configuration file. @@ -1037,7 +1055,7 @@ in { }; }; ''; - description = lib.mdDoc '' + description = '' Extra options to be added under `production` in {file}`config/gitlab.yml`, as a nix attribute @@ -1158,7 +1176,7 @@ in { set -eu PSQL() { - psql --port=${toString pgsql.port} "$@" + psql --port=${toString pgsql.settings.port} "$@" } PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${cfg.databaseName}'" | grep -q 1 || PSQL -tAc 'CREATE DATABASE "${cfg.databaseName}" OWNER "${cfg.databaseUsername}"' @@ -1338,7 +1356,7 @@ in { rm -f '${cfg.statePath}/config/database.yml' - ${if cfg.databasePasswordFile != null then '' + ${lib.optionalString (cfg.databasePasswordFile != null) '' db_password="$(<'${cfg.databasePasswordFile}')" export db_password @@ -1346,16 +1364,24 @@ in { >&2 echo "Database password was an empty string!" exit 1 fi + ''} - jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \ - '.${if lib.versionAtLeast (lib.getVersion cfg.packages.gitlab) "15.0" then "production.main" else "production"}.password = $ENV.db_password' \ - >'${cfg.statePath}/config/database.yml' - '' - else '' - jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \ - >'${cfg.statePath}/config/database.yml' - '' - } + # GitLab expects the `production.main` section to be the first entry in the file. + jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} '{ + production: [ + ${lib.optionalString (cfg.databasePasswordFile != null) ( + builtins.concatStringsSep "\n " ( + [ ".production${lib.optionalString (gitlabVersionAtLeast "15.0") ".main"}.password = $ENV.db_password" ] + ++ lib.optional (gitlabVersionAtLeast "15.9") "| .production.ci.password = $ENV.db_password" + ++ [ "|" ] + ) + )} .production + | to_entries[] + ] + | sort_by(.key) + | reverse + | from_entries + }' >'${cfg.statePath}/config/database.yml' ${utils.genJqSecretsReplacementSnippet gitlabConfig @@ -1454,12 +1480,17 @@ in { TimeoutSec = "infinity"; Restart = "always"; WorkingDirectory = "${cfg.packages.gitlab}/share/gitlab"; - ExecStart = utils.escapeSystemdExecArgs [ - "${cfg.packages.gitlab}/share/gitlab/bin/sidekiq-cluster" - "-e" "production" - "-r" "." - "*" # all queue groups - ]; + ExecStart = utils.escapeSystemdExecArgs ( + [ + "${cfg.packages.gitlab}/share/gitlab/bin/sidekiq-cluster" + "*" # all queue groups + ] ++ lib.optionals (cfg.sidekiq.concurrency != null) [ + "--concurrency" (toString cfg.sidekiq.concurrency) + ] ++ [ + "--environment" "production" + "--require" "." + ] + ); }; }; @@ -1578,7 +1609,9 @@ in { rm "${cfg.statePath}/config/gitlab-workhorse.json" ''; ExecStart = - "${cfg.packages.gitlab-workhorse}/bin/workhorse " + "${cfg.packages.gitlab-workhorse}/bin/${ + optionalString (lib.versionAtLeast (lib.getVersion cfg.packages.gitlab-workhorse) "16.10") "gitlab-" + }workhorse " + "-listenUmask 0 " + "-listenNetwork unix " + "-listenAddr /run/gitlab/gitlab-workhorse.socket " |