include:
  - role.common.nginx

nginx:
  servers:
    managed:
      gitlab.infra.opensuse.org.conf:
        config:
          - upstream gitlab:
              - server: unix:/srv/www/vhosts/gitlab-ce/tmp/sockets/gitlab.socket fail_timeout=0
          - upstream gitlab-workhorse:
              - server: unix:/srv/www/vhosts/gitlab-ce/tmp/sockets/gitlab-workhorse.socket fail_timeout=0
          - map $http_upgrade $connection_upgrade_gitlab_ssl:
              - default: upgrade
              - "''": close
          ## NGINX 'combined' log format with filtered query strings
          - log_format: >-
              gitlab_ssl_access
              '$remote_addr - $remote_user [$time_local] "$request_method $gitlab_ssl_filtered_request_uri
              $server_protocol" $status $body_bytes_sent "$gitlab_ssl_filtered_http_referer" "$http_user_agent"'
          ## Remove private_token from the request URI
          # In:  /foo?private_token=unfiltered&authenticity_token=unfiltered&rss_token=unfiltered&...
          # Out: /foo?private_token=[FILTERED]&authenticity_token=unfiltered&rss_token=unfiltered&...
          - map $request_uri $gitlab_ssl_temp_request_uri_1:
              - default: $request_uri
              - ~(?i)^(?<start>.*)(?<temp>[\?&]private[\-_]token)=[^&]*(?<rest>.*)$: '"$start$temp=[FILTERED]$rest"'
          ## Remove authenticity_token from the request URI
          # In:  /foo?private_token=[FILTERED]&authenticity_token=unfiltered&rss_token=unfiltered&...
          # Out: /foo?private_token=[FILTERED]&authenticity_token=[FILTERED]&rss_token=unfiltered&...
          - map $gitlab_ssl_temp_request_uri_1 $gitlab_ssl_temp_request_uri_2:
              - default: $gitlab_ssl_temp_request_uri_1
              - ~(?i)^(?<start>.*)(?<temp>[\?&]authenticity[\-_]token)=[^&]*(?<rest>.*)$: '"$start$temp=[FILTERED]$rest"'
          ## Remove rss_token from the request URI
          # In:  /foo?private_token=[FILTERED]&authenticity_token=[FILTERED]&rss_token=unfiltered&...
          # Out: /foo?private_token=[FILTERED]&authenticity_token=[FILTERED]&rss_token=[FILTERED]&...
          - map $gitlab_ssl_temp_request_uri_2 $gitlab_ssl_filtered_request_uri:
              - default: $gitlab_ssl_temp_request_uri_2
              - ~(?i)^(?<start>.*)(?<temp>[\?&]feed[\-_]token)=[^&]*(?<rest>.*)$: '"$start$temp=[FILTERED]$rest"'
          ## A version of the referer without the query string
          - map $http_referer $gitlab_ssl_filtered_http_referer:
              - default: $http_referer
              - ~^(?<temp>.*)\?: $temp
          ## Redirects all HTTP traffic to the HTTPS host
          - server:
              - listen: '[::]:80 ipv6only=on default_server'
              - server_name: gitlab.infra.opensuse.org
              - server_tokens: 'off'
              - include: acme-challenge
              - location /:
                  - return 301: https://$http_host$request_uri
              - access_log: /var/log/nginx/gitlab_access.log gitlab_ssl_access
              - error_log: /var/log/nginx/gitlab_error.log
          - server:
              - listen: '[::]:443 ipv6only=on ssl default_server'
              - server_name: gitlab.infra.opensuse.org
              - server_tokens: 'off'
              ## Strong SSL Security
              ## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html & https://cipherli.st/
              - ssl_certificate: /etc/ssl/services/git.infra.opensuse.org/fullchain.pem
              - ssl_certificate_key: /etc/ssl/services/git.infra.opensuse.org/privkey.pem
              # GitLab needs backwards compatible ciphers to retain compatibility with Java IDEs
              - ssl_ciphers: >-  # noqa 204
                  'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384'
              - ssl_protocols:
                  - TLSv1.3
              - ssl_prefer_server_ciphers: 'off'
              - ssl_session_cache: shared:SSL:10m
              - ssl_session_timeout: 1d
              ## [Optional] Enable HTTP Strict Transport Security
              - add_header: Strict-Transport-Security "max-age=31536000; includeSubDomains"
              - access_log: /var/log/nginx/gitlab_access.log gitlab_ssl_access
              - error_log: /var/log/nginx/gitlab_error.log
              - location /:
                  - client_max_body_size: 0
                  - gzip: 'off'
                  ## https://github.com/gitlabhq/gitlabhq/issues/694
                  ## Some requests take more than 30 seconds.
                  - proxy_read_timeout: 300
                  - proxy_connect_timeout: 300
                  - proxy_redirect: 'off'
                  - proxy_http_version: 1.1
                  - proxy_set_header: Host $http_host
                  - proxy_set_header: X-Real-IP $remote_addr
                  - proxy_set_header: X-Forwarded-Ssl on
                  - proxy_set_header: X-Forwarded-For $proxy_add_x_forwarded_for
                  - proxy_set_header: X-Forwarded-Proto $scheme
                  - proxy_set_header: Upgrade $http_upgrade
                  - proxy_set_header: Connection $connection_upgrade_gitlab_ssl
                  - proxy_pass: http://gitlab-workhorse
                  # display .txt job artifacts in the browser instead of downloading them
                  # without the need for GitLab pages
                  - location ~ .*\/raw\/(.*\.txt)$:
                      - proxy_hide_header: Content-Disposition
                      - proxy_hide_header: Content-Type
                      - access_log: /var/log/nginx/gitlab_txt_access.log
                      - add_header: >-
                          Content-Disposition 'inline; "filename=$1"'
                      - add_header: Content-Type text/plain
                      - proxy_pass: http://gitlab-workhorse
                  # display said artifacts immediately instead of having the user go through the "download instead" page
                  - location ~ .*\/file\/(.*\.txt)$:
                      - rewrite: ^(.*)/file/(.*)$ $1/raw/$2
              - error_page: 404 /404.html
              - error_page: 422 /422.html
              - error_page: 500 /500.html
              - error_page: 502 /502.html
              - error_page: 503 /503.html
              - location ~ ^/(404|422|500|502|503)\.html$:
                  - root: /srv/www/vhosts/gitlab-ce/public
                  - internal
        enabled: True

sshd_config:
  matches:
    gitlab:
      type:
        User: git
      options:
        AuthorizedKeysCommand: /usr/lib/gitlab/shell/bin/gitlab-shell-authorized-keys-check gitlab %u %k
        AuthorizedKeysCommandUser: gitlab