From 7e325c2251cd9d21f5d7010add19c14f6b7badae Mon Sep 17 00:00:00 2001
From: talyz <kim.lindberger@gmail.com>
Date: Fri, 20 Sep 2019 18:00:36 +0200
Subject: nixos/gitlab: Mention secret option transition in release notes

Document the breaking secret option transition from literal secrets to
file-based ones.
---
 nixos/doc/manual/release-notes/rl-1909.xml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

(limited to 'nixos/doc')

diff --git a/nixos/doc/manual/release-notes/rl-1909.xml b/nixos/doc/manual/release-notes/rl-1909.xml
index 58ab7207f533..19062bbc9d80 100644
--- a/nixos/doc/manual/release-notes/rl-1909.xml
+++ b/nixos/doc/manual/release-notes/rl-1909.xml
@@ -484,6 +484,28 @@
        (<literal>citrix_workspace</literal>).
      </para>
    </listitem>
+   <listitem>
+     <para>
+       The <literal>services.gitlab</literal> module has had its literal secret options (<option>services.gitlab.smtp.password</option>,
+       <option>services.gitlab.databasePassword</option>,
+       <option>services.gitlab.initialRootPassword</option>,
+       <option>services.gitlab.secrets.secret</option>,
+       <option>services.gitlab.secrets.db</option>,
+       <option>services.gitlab.secrets.otp</option> and
+       <option>services.gitlab.secrets.jws</option>) replaced by file-based versions (<option>services.gitlab.smtp.passwordFile</option>,
+       <option>services.gitlab.databasePasswordFile</option>,
+       <option>services.gitlab.initialRootPasswordFile</option>,
+       <option>services.gitlab.secrets.secretFile</option>,
+       <option>services.gitlab.secrets.dbFile</option>,
+       <option>services.gitlab.secrets.otpFile</option> and
+       <option>services.gitlab.secrets.jwsFile</option>). This was done so that secrets aren't stored
+       in the world-readable nix store, but means that for each option you'll have to create a file with
+       the same exact string, add "File" to the end of the option name, and change the definition to a
+       string pointing to the corresponding file; e.g. <literal>services.gitlab.databasePassword = "supersecurepassword"</literal>
+       becomes <literal>services.gitlab.databasePasswordFile = "/path/to/secret_file"</literal> where the
+       file <literal>secret_file</literal> contains the string <literal>supersecurepassword</literal>.
+     </para>
+   </listitem>
   </itemizedlist>
  </section>
 
-- 
cgit 1.4.1


From dfc43f7d0a6c22417b4522f42d9c4e196fdbe7f7 Mon Sep 17 00:00:00 2001
From: talyz <kim.lindberger@gmail.com>
Date: Fri, 20 Sep 2019 18:04:03 +0200
Subject: nixos/gitlab: Document the restriction introduced on statePath

The state path now, since the transition from initialization in
preStart to using systemd-tmpfiles, has the following restriction: no
parent directory can be owned by any other user than root or the user
specified in services.gitlab.user. This is a potentially breaking
change and the cause of the error isn't immediately obvious, so
document it both in the release notes and statePath description.
---
 nixos/doc/manual/release-notes/rl-1909.xml |  7 +++++++
 nixos/modules/services/misc/gitlab.nix     | 10 +++++++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

(limited to 'nixos/doc')

diff --git a/nixos/doc/manual/release-notes/rl-1909.xml b/nixos/doc/manual/release-notes/rl-1909.xml
index 19062bbc9d80..e4dcc90cdd30 100644
--- a/nixos/doc/manual/release-notes/rl-1909.xml
+++ b/nixos/doc/manual/release-notes/rl-1909.xml
@@ -505,6 +505,13 @@
        becomes <literal>services.gitlab.databasePasswordFile = "/path/to/secret_file"</literal> where the
        file <literal>secret_file</literal> contains the string <literal>supersecurepassword</literal>.
      </para>
+     <para>
+       The state path (<option>services.gitlab.statePath</option>) now has the following restriction:
+       no parent directory can be owned by any other user than <literal>root</literal> or the user
+       specified in <option>services.gitlab.user</option>; i.e. if <option>services.gitlab.statePath</option>
+       is set to <literal>/var/lib/gitlab/state</literal>, <literal>gitlab</literal> and all parent directories
+       must be owned by either <literal>root</literal> or the user specified in <option>services.gitlab.user</option>.
+     </para>
    </listitem>
   </itemizedlist>
  </section>
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index 1e1eb0fd9a11..4c1ffead00c8 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -223,7 +223,15 @@ in {
       statePath = mkOption {
         type = types.str;
         default = "/var/gitlab/state";
-        description = "Gitlab state directory, logs are stored here.";
+        description = ''
+          Gitlab state directory. Configuration, repositories and
+          logs, among other things, are stored here.
+
+          The directory will be created automatically if it doesn't
+          exist already. Its parent directories must be owned by
+          either <literal>root</literal> or the user set in
+          <option>services.gitlab.user</option>.
+        '';
       };
 
       backupPath = mkOption {
-- 
cgit 1.4.1