Skip to content

Add Puma config support for SSL

Stan Hu requested to merge sh-add-puma-ssl-support into master

What does this MR do?

To encrypt communication between Workhorse and Puma, some environments may want to enable encryption on Puma.

To enable SSL for the server, set the following environment variables:

  1. SSL_INTERNAL_PORT: Port number to listen
  2. PUMA_SSL_CERT: Filename of the SSL certificate
  3. PUMA_SSL_KEY: Filename of the private key

To enable mutual TLS, set:

  1. PUMA_SSL_VERIFY_MODE: force_peer (or peer if client TLS is optional)
  2. PUMA_SSL_CLIENT_CERT: Filename of the client certificate authority

Note that the user MUST have permission to read the certificate and keys or Puma will quietly not accept an SSL connection. https://github.com/puma/puma/pull/2848 would make this a hard failure.

Omnibus MR: gitlab-org/omnibus-gitlab!6004 (merged)

Related issues

Part of gitlab-org/gitlab#353013 (closed)

Checklist

See Definition of done.

For anything in this list which will not be completed, please provide a reason in the MR discussion

Required

  • Merge Request Title, and Description are up to date, accurate, and descriptive
  • MR targeting the appropriate branch
  • MR has a green pipeline on GitLab.com

Expected (please provide an explanation if not completing)

  • Test plan indicating conditions for success has been posted and passes
  • Documentation created/updated
  • Integration tests added to GitLab QA
  • The impact any change in container size has should be evaluated
Edited by Stan Hu

Merge request reports