Skip to content

Store Let's Encrypt private_key in `application_settings` instead of `secrets.yml`

What does this MR do?

This MR is marked as WIP only to indicate that EE part should be merged first

EE counterpart: https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/13391/diffs

Fixes discussion https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/27581#note_170769958

Storing this key in secrets.yml was a bad idea, it would require users using HA setups to manually replicate secrets across nodes during update, it also needed support from omnibus package

This MR generates private_key when it's being used for the first time and stores it as encrypted column in application_settings

Does this MR meet the acceptance criteria?

Conformity

Performance and testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team
Edited by Stan Hu

Merge request reports