Skip to content

Support for TLS config on Workhorse

Igor Drozdov requested to merge id-workhorse-tls into master

What does this MR do and why?

Related issue: #353010 (closed)

Currently, Workhorse listens on an unencrypted HTTP port or UNIX socket from NGINX. As part of a requirement to use end-to-end encryption, Workhorse needs to be able to run HTTPS server.

It allows specifying [tls] config in config.toml. The config must contain paths to the certificate and private key. After that, the server will be accessible via HTTPS.

How to set up and validate locally

  1. Generate a certificate and private key (for example, via mkcert)
  2. Modify config.toml and add [tls] section as:
[tls]
certificate = "/path/to/certificate"
key = "/path/to/key"
  1. gdk restart gitlab-workhorse
  2. Go to https instead of http

Next steps

Enable configuring HTTPS via GDK (currently possible only with NGINX)

Merge request reports