2024-09-03 18:36:35 +02:00 · 2021-03-01 10:47:59 +01:00 · 2021-03-01 10:47:59 +01:00 · aefb71a294
commit aefb71a294
parent a4e3ce638d 273fae501f
10 changed files with 138 additions and 69 deletions
--- a/README.md
+++ b/README.md
@ -12,7 +12,7 @@ If you don't have YunoHost, please see [here](https://yunohost.org/#/install) to

 GitLab is a web-based Git-repository manager providing wiki, issue-tracking and CI/CD pipeline features, using an open-source license, developed by GitLab Inc.

-**Shipped version:** 13.8.4
+**Shipped version:** 13.9.0

 ## Screenshots

--- a/README_fr.md
+++ b/README_fr.md
@ -12,7 +12,7 @@ Si vous n'avez pas YunoHost, regardez [ici](https://yunohost.org/#/install) pour

 GitLab est un gestionnaire Web de dépôt Git fournissant des fonctionnalités de wiki, de rapports de bugs et de pipeline CI/CD. GitLab est une application open source développée par GitLab Inc.

-**Version incluse :** 13.8.4
+**Version incluse :** 13.9.0

 ## Captures d'écran

--- a/conf/gitlab.rb
+++ b/conf/gitlab.rb
@ -435,6 +435,9 @@ external_url '__GENERATED_EXTERNAL_URL__'
 ### Impersonation settings
 # gitlab_rails['impersonation_enabled'] = true

+### Application settings cache expiry in seconds. (default: 60)
+# gitlab_rails['application_settings_cache_seconds'] = 60
+
 ### Usage Statistics
 # gitlab_rails['usage_ping_enabled'] = true

@ -655,6 +658,7 @@ gitlab_rails['gitlab_shell_ssh_port'] = __SSH_PORT__
 # gitlab_rails['extra_google_tag_manager_id'] = '_your_tracking_id'
 # gitlab_rails['extra_matomo_url'] = '_your_matomo_url'
 # gitlab_rails['extra_matomo_site_id'] = '_your_matomo_site_id'
+# gitlab_rails['extra_matomo_disable_cookies'] = false

 ##! Docs: https://docs.gitlab.com/omnibus/settings/environment-variables.html
 # gitlab_rails['env'] = {
@ -1299,6 +1303,11 @@ sidekiq['listen_port'] = __SIDEKIQ_PORT__
 # redis['lazyfree_lazy_server_del'] = true
 # redis['replica_lazy_flush'] = true

+#####! Redis threaded I/O
+#####! Defaults to disabled
+# redis['io_threads'] = 4
+# redis['io_threads_do_reads'] = true
+
 ################################################################################
 ## GitLab Web server
 ##! Docs: https://docs.gitlab.com/omnibus/settings/nginx.html#using-a-non-bundled-web-server
@ -1591,8 +1600,9 @@ nginx['listen_https'] = false
 # gitlab_pages['gitlab_secret'] = nil # Generated if not present
 # gitlab_pages['auth_redirect_uri'] = nil # Defaults to projects subdomain of pages_external_url and + '/auth'
 # gitlab_pages['gitlab_server'] = nil # Defaults to external_url
-# gitlab_pages['internal_gitlab_server'] = nil # defaults to gitlab_server, can be changed to internal load balancer
+# gitlab_pages['internal_gitlab_server'] = nil # Defaults to gitlab_server, can be changed to internal load balancer
 # gitlab_pages['auth_secret'] = nil # Generated if not present
+# gitlab_pages['auth_scope'] = nil # Defaults to api, can be changed to read_api to increase security

 ##! GitLab API HTTP client connection timeout
 # gitlab_pages['gitlab_client_http_timeout'] = "10s"
@ -2131,23 +2141,28 @@ nginx['listen_https'] = false
 # praefect['logging_format'] = "json"
 # praefect['virtual_storages'] = {
 #   'default' => {
-#     'praefect-internal-0' => {
-#       'address' => 'tcp://10.23.56.78:8075',
-#       'token' => 'abc123'
-#     },
-#     'praefect-internal-1' => {
-#       'address' => 'tcp://10.76.23.31:8075',
-#       'token' => 'xyz456'
+#     'default_replication_factor' => 3,
+#     'nodes' => {
+#       'praefect-internal-0' => {
+#         'address' => 'tcp://10.23.56.78:8075',
+#         'token' => 'abc123'
+#       },
+#       'praefect-internal-1' => {
+#         'address' => 'tcp://10.76.23.31:8075',
+#         'token' => 'xyz456'
+#       }
 #     }
 #   },
 #   'alternative' => {
-#     'praefect-internal-2' => {
-#       'address' => 'tcp://10.34.1.16:8075',
-#       'token' => 'abc321'
-#     },
-#     'praefect-internal-3' => {
-#       'address' => 'tcp://10.23.18.6:8075',
-#       'token' => 'xyz890'
+#     'nodes' => {
+#       'praefect-internal-2' => {
+#         'address' => 'tcp://10.34.1.16:8075',
+#         'token' => 'abc321'
+#       },
+#       'praefect-internal-3' => {
+#         'address' => 'tcp://10.23.18.6:8075',
+#         'token' => 'xyz890'
+#       }
 #     }
 #   }
 # }
@ -2195,6 +2210,10 @@ nginx['listen_https'] = false
 ##! non-docker containers. Recommended not to change.
 # package['detect_init'] = true

+##! Attempt to modify kernel paramaters. To skip this in containers where the
+##! relevant file system is read-only, set the value to false.
+package['modify_kernel_parameters'] = __MODIFY_KERNEL_PARAMETERS__
+
 ##! Specify maximum number of tasks that can be created by the systemd unit
 ##! Will be populated as TasksMax value to the unit file if user is on a systemd
 ##! version that supports it (>= 227). Will be a no-op if user is not on systemd.
--- a/manifest.json
+++ b/manifest.json
@ -2,7 +2,7 @@
    "name": "GitLab",
    "id": "gitlab",
    "packaging_format": 1,
-    "version": "13.8.4~ynh1",
+    "version": "13.9.0~ynh1",
    "description": {
        "en": "Git-repository manager.",
        "fr": "Gestionnaire de dépôts Git."
--- a/scripts/change_url
+++ b/scripts/change_url
@ -31,7 +31,7 @@ config_path=$(ynh_app_setting_get --app=$app --key=config_path)
 port=$(ynh_app_setting_get --app="$app" --key=web_port)
 portPuma=$(ynh_app_setting_get --app="$app" --key=puma_port)
 portSidekiq=$(ynh_app_setting_get --app="$app" --key=sidekiq_port)
-puma_worker_processes=$(ynh_app_setting_get --app="$app" --key=puma_worker_processes)
+puma_worker_processes=$(ynh_app_setting_get --app="$app" --key=puma_workers)
 puma_min_threads=$(ynh_app_setting_get --app="$app" --key=puma_min_threads)
 puma_max_threads=$(ynh_app_setting_get --app="$app" --key=puma_max_threads)
 client_max_body_size=$(ynh_app_setting_get --app="$app" --key=client_max_body_size)
@ -89,6 +89,20 @@ fi

 #=================================================
 # SPECIFIC MODIFICATIONS
+#=================================================
+# CHECK IF KERNEL IS READ-ONLY
+#=================================================
+
+modify_kernel_parameters="true"
+
+for value_to_check in "kernel.shmall" "kernel.shmmax" "kernel.sem" "net.core.somaxconn"
+do
+	if ! ynh_exec_fully_quiet sysctl --write $value_to_check="$(sysctl --value $value_to_check)"; then
+		modify_kernel_parameters="false"
+		break
+	fi
+done
+
 #=================================================
 # CONFIGURE GITLAB
 #=================================================
@ -113,6 +127,7 @@ ynh_replace_string --match_string="__PUMA_MAX_THREADS__" --replace_string="$puma
 ynh_replace_string --match_string="__CLIENT_MAX_BODY_SIZE__" --replace_string="$client_max_body_size" --target_file="$config_path/gitlab.rb"
 ynh_replace_string --match_string="__SSH_PORT__" --replace_string="$ssh_port" --target_file="$config_path/gitlab.rb"
 ynh_replace_string --match_string="__SIDEKIQ_PORT__" --replace_string="$portSidekiq" --target_file="$config_path/gitlab.rb"
+ynh_replace_string --match_string="__MODIFY_KERNEL_PARAMETERS__" --replace_string="$modify_kernel_parameters" --target_file="$config_path/gitlab.rb"

 ynh_store_file_checksum --file="$config_path/gitlab.rb"

--- a/scripts/install
+++ b/scripts/install
@ -104,11 +104,18 @@ ynh_install_app_dependencies $pkg_dependencies
 # DEFINE THE NUMBER OF WORKERS USED
 #=================================================

-#https://docs.gitlab.com/ce/install/requirements.html#puma-workers
-puma_worker_processes=$(( $(nproc) > 2 ? $(nproc) : 2 ))
+total_memory=$(ynh_get_ram --total)
+
+if [ $total_memory -lt 4096 ]; then
+	#https://docs.gitlab.com/omnibus/settings/puma.html#running-in-memory-constrained-environments
+	puma_worker_processes=0
+else
+	#https://docs.gitlab.com/ce/install/requirements.html#puma-workers
+	puma_worker_processes=$(( $(nproc) > 2 ? $(($(nproc) - 1)) : 2 ))
+fi

 # If the server has less than 2GB of RAM
-if [ $(ynh_get_ram --total --ignore_swap) -lt 2000 ]; then
+if [ $(ynh_get_ram --total --ignore_swap) -lt 2048 ]; then
 	puma_min_threads=1
 	puma_max_threads=1
 else
@ -124,19 +131,13 @@ ynh_app_setting_set --app=$app --key=puma_min_threads --value=$puma_min_threads
 # ADD SWAP IF NEEDED
 #=================================================

-total_memory=$(ynh_get_ram --total)
 total_swap=$(ynh_get_ram --total --only_swap)
 swap_needed=0

 # https://docs.gitlab.com/ce/install/requirements.html#memory
-if [ $total_memory -lt 8192 ]; then
-	# Need a minimum of 8Go of memory
-	swap_needed=$((8192 - $total_memory))
-fi
-
 # Need at least 2Go of swap
-if [ $(($total_swap + $swap_needed)) -lt 2048 ]; then
-	swap_needed=$((2048 - $total_swap))
+if [ $total_swap -lt 2048 ]; then
+	swap_needed=$((2048 - total_swap))
 fi

 if [ $swap_needed -gt 0 ]; then
@ -144,6 +145,20 @@ if [ $swap_needed -gt 0 ]; then
 	ynh_add_swap --size=$swap_needed
 fi

+#=================================================
+# CHECK IF KERNEL IS READ-ONLY
+#=================================================
+
+modify_kernel_parameters="true"
+
+for value_to_check in "kernel.shmall" "kernel.shmmax" "kernel.sem" "net.core.somaxconn"
+do
+	if ! ynh_exec_fully_quiet sysctl --write $value_to_check="$(sysctl --value $value_to_check)"; then
+		modify_kernel_parameters="false"
+		break
+	fi
+done
+
 #=================================================
 # PRECONFIGURE GITLAB
 #=================================================
@ -166,6 +181,7 @@ ynh_replace_string --match_string="__PUMA_MAX_THREADS__" --replace_string="$puma
 ynh_replace_string --match_string="__CLIENT_MAX_BODY_SIZE__" --replace_string="$client_max_body_size" --target_file="$config_path/gitlab.rb"
 ynh_replace_string --match_string="__SSH_PORT__" --replace_string="$ssh_port" --target_file="$config_path/gitlab.rb"
 ynh_replace_string --match_string="__SIDEKIQ_PORT__" --replace_string="$portSidekiq" --target_file="$config_path/gitlab.rb"
+ynh_replace_string --match_string="__MODIFY_KERNEL_PARAMETERS__" --replace_string="$modify_kernel_parameters" --target_file="$config_path/gitlab.rb"

 #=================================================
 # STORE THE CONFIG FILE CHECKSUM
@ -189,11 +205,7 @@ tempdir="$(mktemp -d)"

 ynh_setup_source --dest_dir=$tempdir --source_id=$architecture

-if ! ynh_exec_warn_less dpkg -i $tempdir/$gitlab_filename ; 
-then # This command will fail in lxc env
-	package_check_action # defined in upgrade.d/upgrade.last.sh
-	ynh_exec_warn_less dpkg --configure gitlab-ce
-fi
+ynh_exec_warn_less dpkg -i $tempdir/$gitlab_filename

 #=================================================
 # NGINX CONFIGURATION
--- a/scripts/restore
+++ b/scripts/restore
@ -66,23 +66,19 @@ ynh_install_app_dependencies $pkg_dependencies
 # ADD SWAP IF NEEDED
 #=================================================

-total_memory=$(ynh_get_ram --total)
 total_swap=$(ynh_get_ram --total --only_swap)
 swap_needed=0

 # https://docs.gitlab.com/ce/install/requirements.html#memory
-if [ $total_memory -lt 8192 ]; then
-	# Need a minimum of 8Go of memory
-	swap_needed=$((8192 - $total_memory))
-fi
-
 # Need at least 2Go of swap
-if [ $(($total_swap + $swap_needed)) -lt 2048 ]; then
-	swap_needed=$((2048 - $total_swap))
+if [ $total_swap -lt 2048 ]; then
+	swap_needed=$((2048 - total_swap))
 fi

-ynh_script_progression --message="Adding $swap_needed Mo to swap..." --weight=1
-ynh_add_swap --size=$swap_needed
+if [ $swap_needed -gt 0 ]; then
+	ynh_script_progression --message="Adding $swap_needed Mo to swap..."
+	ynh_add_swap --size=$swap_needed
+fi

 #=================================================
 # RESTORE CONF FILES
--- a/scripts/upgrade
+++ b/scripts/upgrade
@ -25,7 +25,7 @@ port=$(ynh_app_setting_get --app="$app" --key=web_port)
 portPuma=$(ynh_app_setting_get --app="$app" --key=puma_port)
 portSidekiq=$(ynh_app_setting_get --app="$app" --key=sidekiq_port)
 architecture=$(ynh_app_setting_get --app="$app" --key=architecture)
-puma_worker_processes=$(ynh_app_setting_get --app="$app" --key=puma_worker_processes)
+puma_worker_processes=$(ynh_app_setting_get --app="$app" --key=puma_workers)
 puma_min_threads=$(ynh_app_setting_get --app="$app" --key=puma_min_threads)
 puma_max_threads=$(ynh_app_setting_get --app="$app" --key=puma_max_threads)
 client_max_body_size=$(ynh_app_setting_get --app="$app" --key=client_max_body_size)
@ -58,10 +58,7 @@ if [ -z "$config_path" ]; then
 	ynh_app_setting_set --app=$app --key=config_path --value=$config_path
 fi

-if [ -z "$puma_worker_processes" ]; then
-	#https://docs.gitlab.com/ce/install/requirements.html#puma-workers
-	puma_worker_processes=$(( $(nproc) > 2 ? $(nproc) : 2 ))
-
+if [ -z "$puma_max_threads" ] || [ -z "$puma_min_threads" ]; then
 	# If the server has less than 2GB of RAM
 	if [ $(ynh_get_ram --total --ignore_swap) -lt 2000 ]; then
 		puma_min_threads=1
@ -71,7 +68,6 @@ if [ -z "$puma_worker_processes" ]; then
 		puma_max_threads=4
 	fi

-	ynh_app_setting_set --app=$app --key=puma_workers --value=$puma_worker_processes
 	ynh_app_setting_set --app=$app --key=puma_max_threads --value=$puma_max_threads
 	ynh_app_setting_set --app=$app --key=puma_min_threads --value=$puma_min_threads

@ -178,26 +174,38 @@ ynh_script_progression --message="Installing dependencies..." --weight=5
 ynh_install_app_dependencies $pkg_dependencies

 #=================================================
-# ADD SWAP IF NEEDED
+# DEFINE THE NUMBER OF WORKERS USED
 #=================================================

 total_memory=$(ynh_get_ram --total)
+
+if [ $total_memory -lt 4096 ]; then
+	#https://docs.gitlab.com/omnibus/settings/puma.html#running-in-memory-constrained-environments
+	puma_worker_processes=0
+else
+	#https://docs.gitlab.com/ce/install/requirements.html#puma-workers
+	puma_worker_processes=$(( $(nproc) > 2 ? $(($(nproc) - 1)) : 2 ))
+fi
+
+ynh_app_setting_set --app=$app --key=puma_workers --value=$puma_worker_processes
+
+#=================================================
+# ADD SWAP IF NEEDED
+#=================================================
+
 total_swap=$(ynh_get_ram --total --only_swap)
 swap_needed=0

 # https://docs.gitlab.com/ce/install/requirements.html#memory
-if [ $total_memory -lt 8192 ]; then
-	# Need a minimum of 8Go of memory
-	swap_needed=$((8192 - $total_memory))
-fi
-
 # Need at least 2Go of swap
-if [ $(($total_swap + $swap_needed)) -lt 2048 ]; then
-	swap_needed=$((2048 - $total_swap))
+if [ $total_swap -lt 2048 ]; then
+	swap_needed=$((2048 - total_swap))
 fi

-ynh_script_progression --message="Adding $swap_needed Mo to swap..." --weight=1
-ynh_add_swap --size=$swap_needed
+if [ $swap_needed -gt 0 ]; then
+	ynh_script_progression --message="Adding $swap_needed Mo to swap..."
+	ynh_add_swap --size=$swap_needed
+fi

 #=================================================
 # DOWNLOAD, CHECK AND UNPACK SOURCE
@ -277,6 +285,20 @@ then
 	done
 fi

+#=================================================
+# CHECK IF KERNEL IS READ-ONLY
+#=================================================
+
+modify_kernel_parameters="true"
+
+for value_to_check in "kernel.shmall" "kernel.shmmax" "kernel.sem" "net.core.somaxconn"
+do
+	if ! ynh_exec_fully_quiet sysctl --write $value_to_check="$(sysctl --value $value_to_check)"; then
+		modify_kernel_parameters="false"
+		break
+	fi
+done
+
 #=================================================
 # RECONFIGURE GITLAB
 #=================================================
@ -298,6 +320,7 @@ ynh_replace_string --match_string="__PUMA_MAX_THREADS__" --replace_string="$puma
 ynh_replace_string --match_string="__CLIENT_MAX_BODY_SIZE__" --replace_string="$client_max_body_size" --target_file="$config_path/gitlab.rb"
 ynh_replace_string --match_string="__SSH_PORT__" --replace_string="$ssh_port" --target_file="$config_path/gitlab.rb"
 ynh_replace_string --match_string="__SIDEKIQ_PORT__" --replace_string="$portSidekiq" --target_file="$config_path/gitlab.rb"
+ynh_replace_string --match_string="__MODIFY_KERNEL_PARAMETERS__" --replace_string="$modify_kernel_parameters" --target_file="$config_path/gitlab.rb"

 ynh_store_file_checksum --file="$config_path/gitlab.rb"

--- a/scripts/upgrade.d/upgrade.last.sh
+++ b/scripts/upgrade.d/upgrade.last.sh
@ -1,13 +1,13 @@
 #!/bin/bash

-gitlab_version="13.8.4"
+gitlab_version="13.9.0"

 # sha256sum found here: https://packages.gitlab.com/gitlab
 gitlab_debian_version="buster"

-gitlab_x86_64_buster_source_sha256="571297ac5765ee2cbd513d7cb083b81a69a077c8db61fee4bd266f79815692b8"
+gitlab_x86_64_buster_source_sha256="5642866110f64ce3a424d312b0779e249595acbcfcb1edff81e6d6c0345db3ce"

-gitlab_arm_buster_source_sha256="849d0de1857618e19d6fca1f7a24be18cb09d14c4a163c5af71b06477cab2f29"
+gitlab_arm_buster_source_sha256="4bb579c84a854c0759d2b67f123d1a0ffb96743edf8fce6cbbef5d40147bbde4"

 architecture=$(ynh_app_setting_get --app="$app" --key=architecture)

@ -21,9 +21,10 @@ gitlab_filename="gitlab-ce-${gitlab_version}.deb"

 # Action to do in case of failure of the package_check
 package_check_action() {
-	local sysctl_file="$final_path/embedded/cookbooks/package/resources/gitlab_sysctl.rb"
-	ynh_replace_string --match_string="command \"sysctl -e \(.*\)\"" --replace_string="command \"sysctl -e \1 || true\"" --target_file=$sysctl_file
-	
-	sysctl_file="/opt/gitlab/embedded/cookbooks/package/recipes/sysctl.rb"
-	ynh_replace_string --match_string="command \"sysctl -e \(.*\)\"" --replace_string="command \"sysctl -e \1 || true\"" --target_file=$sysctl_file
+	ynh_backup_if_checksum_is_different --file="$config_path/gitlab.rb"
+	cat <<EOF >> "$config_path/gitlab.rb"
+# Last chance to fix Gitlab
+package['modify_kernel_parameters'] = false
+EOF
+	ynh_store_file_checksum --file="$config_path/gitlab.rb"
 }
--- a/upgrade-versions.sh
+++ b/upgrade-versions.sh
@ -122,4 +122,7 @@ EOS"
    sed -i "s/# nginx\['client_max_body_size'\] = .*/nginx['client_max_body_size'] = '__CLIENT_MAX_BODY_SIZE__'/" $conf_file
    sed -i "s/# nginx\['listen_port'\] = .*/nginx['listen_port'] = __PORT__/" $conf_file
    sed -i "s/# nginx\['listen_https'\] = .*/nginx['listen_https'] = false/" $conf_file
+
+    # Change modify kernel parameters settings
+    sed -i "s/# package\['modify_kernel_parameters'\] = .*/package['modify_kernel_parameters'] = __MODIFY_KERNEL_PARAMETERS__/" $conf_file
 fi