Move an omnibus simulation to https behind a private CA

Andrew Dunnrequested to merge
feature/omnibus-https-private-ca into main

A self-managed GitLab behind an internal certificate authority is a common customer shape, and each component trusts that CA by a different mechanism. Seven commits:

  • The gateway stays on https. aigw start and every real-model arm read the URL from the rendered gitlab.yml and, on https, mount the image's CA bundle with /etc/gitlab/trusted-certs appended, by the method the AI gateway install doc gives.
  • just https-private-ca. Mints a CA and a server certificate on the VM, trusts the CA in the OS store and trusted-certs, moves external_url to https with Let's Encrypt off, reconfigures, proves each client, and restarts the gateway. --dry-run changes nothing.
  • just runner-tls-ca NAME_MATCH. Gives a named runner and its jobs the CA, as the Duo Agent Platform troubleshooting doc describes, with the SELinux label a job container can read.
  • A real-model gateway on an instance already on https is left alone.
  • --registry. The registry on 5050 behind the same certificate, with <instance>-deny-registry created before anything on the VM changes; down deletes it. The verb ran clean on omnibus 19.4.1, and the engine's usage text now lists --registry and no longer calls the verb unproven.
  • The URL reader works on a Ruby without YAML.unsafe_load_file. The engine self-test runs it with the host's ruby, and on Ruby 2.6 it failed 45 checks; a new check hides the method and fails on the old reader under any Ruby.

Merge request reports