Add Puma config support for SSL
What does this MR do?
To encrypt communication between Workhorse and Puma, some environments may want to enable encryption on Puma.
To enable SSL for the server, set the following environment variables:
-
SSL_INTERNAL_PORT
: Port number to listen -
PUMA_SSL_CERT
: Filename of the SSL certificate -
PUMA_SSL_KEY
: Filename of the private key
To enable mutual TLS, set:
-
PUMA_SSL_VERIFY_MODE
:force_peer
(orpeer
if client TLS is optional) -
PUMA_SSL_CLIENT_CERT
: Filename of the client certificate authority
Note that the user MUST have permission to read the certificate and keys or Puma will quietly not accept an SSL connection. https://github.com/puma/puma/pull/2848 would make this a hard failure.
Omnibus MR: gitlab-org/omnibus-gitlab!6004 (merged)
Related issues
Part of gitlab-org/gitlab#353013 (closed)
Checklist
See Definition of done.
For anything in this list which will not be completed, please provide a reason in the MR discussion
Required
-
Merge Request Title, and Description are up to date, accurate, and descriptive -
MR targeting the appropriate branch -
MR has a green pipeline on GitLab.com
Expected (please provide an explanation if not completing)
-
Test plan indicating conditions for success has been posted and passes -
Documentation created/updated -
Integration tests added to GitLab QA -
The impact any change in container size has should be evaluated
Edited by Stan Hu