Commit bf059d7f authored by Stan Hu's avatar Stan Hu
Browse files

Enable GZIP by default 

After a discussion in https://gitlab.com/gitlab-org/gitlab-ce/issues/33719#note_67995336, we
agreed to enable it in light of performance and security concerns. Users may disable this
if they choose.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/33719
parent b15320e3

CHANGELOG.md

+1 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ omnibus-gitlab repository. 
- Keep gitaly service running during package upgrades 034992fbc

- Geo: Error when primary promotion fails

- Add option to disable healthcheck for storagedriver in registry

- Enable gzip by default

- Restart runsv when log directory is changed 0a784647b

- Bump rsync to 3.1.3 f539aa946

- Patch bzip2 against CVE-2016-3189 552730bfa

doc/settings/nginx.md

+9 −0
Original line number Diff line number Diff line
@@ -346,6 +346,15 @@ Setting `max_age` to 0 will disable this feature. For more information see: 


* https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/



## Disabling GZIP compression



By default, GitLab enables GZIP compression for text data over 10240 bytes. To

disable this behavior:



```ruby

nginx['gzip_enabled'] = false

```



## Using custom SSL ciphers



By default GitLab is using SSL ciphers that are combination of testing on gitlab.com and various best practices contributed by the GitLab community.

files/gitlab-config-template/gitlab.rb.template

+3 −0
Original line number Diff line number Diff line
@@ -913,6 +913,9 @@ external_url 'GENERATED_EXTERNAL_URL' 
# nginx['hsts_max_age'] = 31536000

# nginx['hsts_include_subdomains'] = false



##! **Docs: http://nginx.org/en/docs/http/ngx_http_gzip_module.html**

# nginx['gzip_enabled'] = true



##! **Override only if you use a reverse proxy**

##! Docs: https://docs.gitlab.com/omnibus/settings/nginx.html#setting-the-nginx-listen-port

# nginx['listen_port'] = nil

files/gitlab-cookbooks/gitlab/attributes/default.rb

+2 −0
Original line number Diff line number Diff line
@@ -641,6 +641,8 @@ default['gitlab']['nginx']['server_names_hash_bucket_size'] = 64 
# HSTS

default['gitlab']['nginx']['hsts_max_age'] = 31536000

default['gitlab']['nginx']['hsts_include_subdomains'] = false

# Compression

default['gitlab']['nginx']['gzip_enabled'] = true



###

# Nginx status

files/gitlab-cookbooks/gitlab/templates/default/nginx-gitlab-http.conf.erb

+11 −3
Original line number Diff line number Diff line
@@ -133,9 +133,17 @@ server { 
    set $http_host_with_default $http_host;

  }



  ## If you use HTTPS make sure you disable gzip compression

  ## to be safe against BREACH attack.

  <%= 'gzip off;' if @https %>

<% if @gzip_enabled %>

  gzip on;

  gzip_static on;

  gzip_comp_level 2;

  gzip_http_version 1.1;

  gzip_vary on;

  gzip_disable "msie6";

  gzip_min_length 10240;

  gzip_proxied no-cache no-store private expired auth;

  gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/json application/xml application/rss+xml;

<% end %>



  ## https://github.com/gitlabhq/gitlabhq/issues/694

  ## Some requests take more than 30 seconds.