Skip to content

Allow configuring GitLab secret directly

Gitaly needs to present a secret when connecting to GitLab's internal API. This secret is configured via the GitLab.SecretFile configuration, but cannot be configured directly. This is an issue in the context of FIPS as secrets must not be stored on disk directly.

We should add a new field that allows users to configure the secret diretcly. Together with https://gitlab.com/gitlab-org/gitaly/-/issues/4828+, this would allow us to derive the secret via an external executable on startup.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information