gitlab.yml.example 20.3 KB
Newer Older
1
# # # # # # # # # # # # # # # # # #
2
# GitLab application config file  #
3
# # # # # # # # # # # # # # # # # #
4
#
5 6
###########################  NOTE  #####################################
# This file should not receive new settings. All configuration options #
Sytse Sijbrandij's avatar
Sytse Sijbrandij committed
7
# that do not require an application restart are being moved to        #
8 9 10
# ApplicationSetting model!                                            #
# If you change this file in a Merge Request, please also create       #
# a MR on https://gitlab.com/gitlab-org/omnibus-gitlab/merge_requests  #
11 12
########################################################################
#
13
#
14
# How to use:
15 16 17 18
# 1. Copy file as gitlab.yml
# 2. Update gitlab -> host with your fully qualified domain name
# 3. Update gitlab -> email_from
# 4. If you installed Git from source, change git -> bin_path to /usr/local/bin/git
19 20 21
#    IMPORTANT: If Git was installed in a different location use that instead.
#    You can check with `which git`. If a wrong path of Git is specified, it will
#     result in various issues such as failures of GitLab CI builds.
22
# 5. Review this configuration file for other settings you may want to adjust
23

24 25 26 27 28 29 30
production: &base
  #
  # 1. GitLab app settings
  # ==========================

  ## GitLab settings
  gitlab:
31
    ## Web server settings (note: host is the FQDN, do not include http://)
32
    host: localhost
33 34
    port: 80 # Set to 443 if using HTTPS, see installation.md#using-https for additional HTTPS configuration details
    https: false # Set to true if using HTTPS, see installation.md#using-https for additional HTTPS configuration details
35

36 37 38 39 40
    # Uncommment this line below if your ssh host is different from HTTP/HTTPS one
    # (you'd obviously need to replace ssh.host_example.com with your own host).
    # Otherwise, ssh host will be set to the `host:` value above
    # ssh_host: ssh.host_example.com

41 42
    # WARNING: See config/application.rb under "Relative url support" for the list of
    # other files that need to be changed for relative url support
43 44 45 46 47
    # relative_url_root: /gitlab

    # Uncomment and customize if you can't use the default user to run GitLab (default: 'git')
    # user: git

48 49
    ## Date & Time settings
    # Uncomment and customize if you want to change the default time zone of GitLab application.
50
    # To see all available zones, run `bundle exec rake time:zones:all RAILS_ENV=production`
51 52
    # time_zone: 'UTC'

53
    ## Email settings
54 55
    # Uncomment and set to false if you need to disable email sending from GitLab (default: true)
    # email_enabled: true
56
    # Email address used in the "From" field in mails sent by GitLab
57
    email_from: example@example.com
58
    email_display_name: GitLab
59
    email_reply_to: noreply@example.com
60

61
    # Email server smtp settings are in config/initializers/smtp_settings.rb.sample
62

63
    # default_can_create_group: false  # default: true
64
    # username_changing_enabled: false # default: true - User can change her username/namespace
65 66 67 68 69 70 71
    ## Default theme ID
    ##   1 - Graphite
    ##   2 - Charcoal
    ##   3 - Green
    ##   4 - Gray
    ##   5 - Violet
    ##   6 - Blue
Izaak Alpert's avatar
Izaak Alpert committed
72
    # default_theme: 2 # default: 2
Izaak Alpert's avatar
Izaak Alpert committed
73

74
    ## Automatic issue closing
Sytse Sijbrandij's avatar
Sytse Sijbrandij committed
75
    # If a commit message matches this regular expression, all issues referenced from the matched text will be closed.
Julien Kirch's avatar
Julien Kirch committed
76
    # This happens when the commit is pushed or merged into the default branch of a project.
Sytse Sijbrandij's avatar
Sytse Sijbrandij committed
77
    # When not specified the default issue_closing_pattern as specified below will be used.
Achilleas Pipinellis's avatar
Achilleas Pipinellis committed
78
    # Tip: you can test your closing pattern at http://rubular.com.
79
    # issue_closing_pattern: '((?:[Cc]los(?:e[sd]?|ing)|[Ff]ix(?:e[sd]|ing)?) +(?:(?:issues? +)?#\d+(?:(?:, *| +and +)?))+)'
80

81 82 83 84 85
    ## Default project features settings
    default_projects_features:
      issues: true
      merge_requests: true
      wiki: true
86
      snippets: false
87
      builds: true
88

89 90 91 92
    ## Webhook settings
    # Number of seconds to wait for HTTP response after sending webhook HTTP POST request (default: 10)
    # webhook_timeout: 10

93 94
    ## Repository downloads directory
    # When a user clicks e.g. 'Download zip' on a project, a temporary zip file is created in the following directory.
95
    # The default is 'tmp/repositories' relative to the root of the Rails app.
96 97
    # repository_downloads_path: tmp/repositories

Douwe Maan's avatar
Douwe Maan committed
98
  ## Reply by email
Douwe Maan's avatar
Douwe Maan committed
99
  # Allow users to comment on issues and merge requests by replying to notification emails.
100 101
  # For documentation on how to set this up, see http://doc.gitlab.com/ce/incoming_email/README.html
  incoming_email:
Douwe Maan's avatar
Douwe Maan committed
102
    enabled: false
103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125

    # The email address including the `%{key}` placeholder that will be replaced to reference the item being replied to.
    # The `%{key}` placeholder is added after the user part, after a `+` character, before the `@`.
    address: "gitlab-incoming+%{key}@gmail.com"

    # Email account username
    # With third party providers, this is usually the full email address.
    # With self-hosted email servers, this is usually the user part of the email address.
    user: "gitlab-incoming@gmail.com"
    # Email account password
    password: "[REDACTED]"

    # IMAP server host
    host: "imap.gmail.com"
    # IMAP server port
    port: 993
    # Whether the IMAP server uses SSL
    ssl: true
    # Whether the IMAP server uses StartTLS
    start_tls: false

    # The mailbox where incoming mail will end up. Usually "inbox".
    mailbox: "inbox"
Douwe Maan's avatar
Douwe Maan committed
126

Kamil Trzcinski's avatar
Kamil Trzcinski committed
127 128 129 130 131 132
  ## Build Artifacts
  artifacts:
    enabled: true
    # The location where build artifacts are stored (default: shared/artifacts).
    # path: shared/artifacts

Marin Jankovski's avatar
Marin Jankovski committed
133 134
  ## Git LFS
  lfs:
Marin Jankovski's avatar
Marin Jankovski committed
135
    enabled: true
Marin Jankovski's avatar
Marin Jankovski committed
136 137 138
    # The location where LFS objects are stored (default: shared/lfs-objects).
    # storage_path: shared/lfs-objects

139
  ## Gravatar
140
  ## For Libravatar see: http://doc.gitlab.com/ce/customization/libravatar.html
141
  gravatar:
142
    enabled: true                 # Use user avatar image from Gravatar.com (default: true)
143
    # gravatar urls: possible placeholders: %{hash} %{size} %{email}
144 145
    # plain_url: "http://..."     # default: http://www.gravatar.com/avatar/%{hash}?s=%{size}&d=identicon
    # ssl_url:   "https://..."    # default: https://secure.gravatar.com/avatar/%{hash}?s=%{size}&d=identicon
146 147

  #
148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164
  # 2. GitLab CI settings
  # ==========================

  gitlab_ci:
    # Default project notifications settings:
    #
    # Send emails only on broken builds (default: true)
    # all_broken_builds: true
    #
    # Add pusher to recipients list (default: false)
    # add_pusher: true

    # The location where build traces are stored (default: builds/). Relative paths are relative to Rails.root
    # builds_path: builds/

  #
  # 3. Auth settings
165 166 167
  # ==========================

  ## LDAP settings
168 169
  # You can inspect a sample of the LDAP users with login access by running:
  #   bundle exec rake gitlab:ldap:check RAILS_ENV=production
170 171
  ldap:
    enabled: false
172 173

    # GitLab EE only.
174 175
    # In addition to refreshing users when they log in,
    # enabling this setting will refresh LDAP user membership once a day.
176 177 178 179
    # Default time of the day when this will happen is at 1:30am server time.
    schedule_sync_hour: 1 # Hour of the day. Value from 0-23.
    schedule_sync_minute: 30 # Minute of the hour. Value from 0-59.

180
    servers:
181 182 183 184 185 186 187 188 189
      ##########################################################################
      #
      # Since GitLab 7.4, LDAP servers get ID's (below the ID is 'main'). GitLab
      # Enterprise Edition now supports connecting to multiple LDAP servers.
      #
      # If you are updating from the old (pre-7.4) syntax, you MUST give your
      # old server the ID 'main'.
      #
      ##########################################################################
190
      main: # 'main' is the GitLab 'provider ID' of this LDAP server
191 192 193 194 195 196 197 198 199
        ## label
        #
        # A human-friendly name for your LDAP server. It is OK to change the label later,
        # for instance if you find out it is too large to fit on the web page.
        #
        # Example: 'Paris' or 'Acme, Ltd.'
        label: 'LDAP'

        host: '_your_ldap_server'
200
        port: 389
201
        uid: 'sAMAccountName'
202
        method: 'plain' # "tls" or "ssl" or "plain"
203 204
        bind_dn: '_the_full_dn_of_the_user_you_will_bind_with'
        password: '_the_password_of_the_bind_user'
205

206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221
        # This setting specifies if LDAP server is Active Directory LDAP server.
        # For non AD servers it skips the AD specific queries.
        # If your LDAP server is not AD, set this to false.
        active_directory: true

        # If allow_username_or_email_login is enabled, GitLab will ignore everything
        # after the first '@' in the LDAP username submitted by the user on login.
        #
        # Example:
        # - the user enters 'jane.doe@example.com' and 'p@ssw0rd' as LDAP credentials;
        # - GitLab queries the LDAP server with 'jane.doe' and 'p@ssw0rd'.
        #
        # If you are using "uid: 'userPrincipalName'" on ActiveDirectory you need to
        # disable this setting, because the userPrincipalName contains an '@'.
        allow_username_or_email_login: false

222
        # To maintain tight control over the number of active users on your GitLab installation,
223
        # enable this setting to keep new users blocked until they have been cleared by the admin
224
        # (default: false).
225 226
        block_auto_created_users: false

227 228 229 230 231 232 233 234 235 236 237 238 239 240
        # Base where we can search for users
        #
        #   Ex. ou=People,dc=gitlab,dc=example
        #
        base: ''

        # Filter LDAP users
        #
        #   Format: RFC 4515 http://tools.ietf.org/search/rfc4515
        #   Ex. (employeeType=developer)
        #
        #   Note: GitLab does not support omniauth-ldap's custom filter syntax.
        #
        user_filter: ''
241

242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268
        # This setting controls the amount of time between LDAP permission checks for each user.
        # After this time has expired for a given user, their next interaction with GitLab (a click in the web UI, a git pull etc.) will be slower because the LDAP permission check is being performed.
        # How much slower depends on your LDAP setup, but it is not uncommon for this check to add seconds of waiting time.
        # The default value is to have a 'slow click' once every 3600 seconds, i.e. once per hour.
        #
        # Warning: if you set this value too low, every click in GitLab will be a 'slow click' for all of your LDAP users.
        # sync_time: 3600

        # Base where we can search for groups
        #
        #   Ex. ou=Groups,dc=gitlab,dc=example
        #
        group_base: ''

        # LDAP group of users who should be admins in GitLab
        #
        #   Ex. GLAdmins
        #
        admin_group: ''

        # Name of attribute which holds a ssh public key of the user object.
        # If false or nil, SSH key syncronisation will be disabled.
        #
        #   Ex. sshpublickey
        #
        sync_ssh_keys: false

269
        # LDAP attributes that GitLab will use to create an account for the LDAP user.
Douwe Maan's avatar
Douwe Maan committed
270 271
        # The specified attribute can either be the attribute name as a string (e.g. 'mail'),
        # or an array of attribute names to try in order (e.g. ['mail', 'email']).
272 273 274 275 276
        # Note that the user's LDAP login will always be the attribute specified as `uid` above.
        attributes:
          # The username will be used in paths for the user's own projects
          # (like `gitlab.example.com/username/project`) and when mentioning
          # them in issues, merge request and comments (like `@username`).
277
          # If the attribute specified for `username` contains an email address,
278 279 280 281 282
          # the GitLab username will be the part of the email address before the '@'.
          username: ['uid', 'userid', 'sAMAccountName']
          email:    ['mail', 'email', 'userPrincipalName']

          # If no full name could be found at the attribute specified for `name`,
283
          # the full name is determined using the attributes specified for
284 285 286 287 288
          # `first_name` and `last_name`.
          name:       'cn'
          first_name: 'givenName'
          last_name:  'sn'

289 290 291 292 293 294 295
      # GitLab EE only: add more LDAP servers
      # Choose an ID made of a-z and 0-9 . This ID will be stored in the database
      # so that GitLab can remember which LDAP server a user belongs to.
      # uswest2:
      #   label:
      #   host:
      #   ....
296

297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318
  ## Kerberos settings
  kerberos:
    # Allow the HTTP Negotiate authentication method for Git clients
    enabled: false

    # Kerberos 5 keytab file. The keytab file must be readable by the GitLab user,
    # and should be different from other keytabs in the system.
    # (default: use default keytab from Krb5 config)
    # keytab: /etc/http.keytab

    # The Kerberos service name to be used by GitLab.
    # (default: accept any service name in keytab file)
    # service_principal_name: HTTP/gitlab.example.com@EXAMPLE.COM

    # Dedicated port: Git before 2.4 does not fall back to Basic authentication if Negotiate fails.
    # To support both Basic and Negotiate methods with older versions of Git, configure
    # nginx to proxy GitLab on an extra port (e.g. 8443) and uncomment the following lines
    # to dedicate this port to Kerberos authentication. (default: false)
    # use_dedicated_port: true
    # port: 8443
    # https: true

319
  ## OmniAuth settings
320
  omniauth:
321
    # Allow login via Twitter, Google, etc. using OmniAuth providers
322 323
    enabled: false

324 325 326 327
    # Uncomment this to automatically sign in with a specific omniauth provider's without
    # showing GitLab's sign-in page (default: show the GitLab sign-in page)
    # auto_sign_in_with_provider: saml

328
    # CAUTION!
329
    # This allows users to login without having a user account first (default: false).
330 331
    # User accounts will be created automatically when authentication was successful.
    allow_single_sign_on: false
332
    # Locks down those users until they have been cleared by the admin (default: true).
333
    block_auto_created_users: true
334 335 336
    # Look up new users in LDAP servers. If a match is found (same uid), automatically
    # link the omniauth identity with the LDAP account. (default: false)
    auto_link_ldap_user: false
337 338

    ## Auth providers
339 340
    # Uncomment the following lines and fill in the data of the auth provider you want to use
    # If your favorite auth provider is not listed you can use others:
Drew Blessing's avatar
Drew Blessing committed
341
    # see https://github.com/gitlabhq/gitlab-public-wiki/wiki/Custom-omniauth-provider-configurations
342 343
    # The 'app_id' and 'app_secret' parameters are always passed as the first two
    # arguments, followed by optional 'args' which can be either a hash or an array.
dosire's avatar
dosire committed
344
    # Documentation for this is available at http://doc.gitlab.com/ce/integration/omniauth.html
345
    providers:
346 347
      # - { name: 'github',
      #     app_id: 'YOUR_APP_ID',
Douwe Maan's avatar
Douwe Maan committed
348
      #     app_secret: 'YOUR_APP_SECRET',
349
      #     url: "https://github.com/",
350
      #     args: { scope: 'user:email' } }
Douwe Maan's avatar
Douwe Maan committed
351 352 353
      # - { name: 'bitbucket',
      #     app_id: 'YOUR_APP_ID',
      #     app_secret: 'YOUR_APP_SECRET' }
354 355
      # - { name: 'gitlab',
      #     app_id: 'YOUR_APP_ID',
Douwe Maan's avatar
Douwe Maan committed
356
      #     app_secret: 'YOUR_APP_SECRET',
357
      #     args: { scope: 'api' } }
Douwe Maan's avatar
Douwe Maan committed
358 359 360 361 362
      # - { name: 'google_oauth2',
      #     app_id: 'YOUR_APP_ID',
      #     app_secret: 'YOUR_APP_SECRET',
      #     args: { access_type: 'offline', approval_prompt: '' } }
      # - { name: 'facebook',
363
      #     app_id: 'YOUR_APP_ID',
364
      #     app_secret: 'YOUR_APP_SECRET' }
Douwe Maan's avatar
Douwe Maan committed
365
      # - { name: 'twitter',
366
      #     app_id: 'YOUR_APP_ID',
367
      #     app_secret: 'YOUR_APP_SECRET' }
Douwe Maan's avatar
Douwe Maan committed
368
      #
369
      # - { name: 'saml',
370
      #     label: 'Our SAML Provider',
371 372 373 374 375 376 377
      #     args: {
      #             assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback',
      #             idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8',
      #             idp_sso_target_url: 'https://login.example.com/idp',
      #             issuer: 'https://gitlab.example.com',
      #             name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'
      #           } }
Valery Sizov's avatar
Valery Sizov committed
378 379 380 381 382
      # - { name: 'crowd',
      #     args: {
      #       crowd_server_url: 'CROWD SERVER URL',
      #       application_name: 'YOUR_APP_NAME',
      #       application_password: 'YOUR_APP_PASSWORD' } }
383

384 385 386 387
  # Shared file storage settings
  shared:
    # path: /mnt/gitlab # Default: shared

388 389

  #
390
  # 4. Advanced settings
391 392 393
  # ==========================

  # GitLab Satellites
394 395 396 397
  #
  # Note for maintainers: keep the satellites.path setting until GitLab 9.0 at
  # least. This setting is fed to 'rm -rf' in
  # db/migrate/20151023144219_remove_satellites.rb
398 399 400 401 402 403
  satellites:
    path: /home/git/gitlab-satellites/

  ## Backup settings
  backup:
    path: "tmp/backups"   # Relative paths are relative to Rails.root (default: tmp/backups/)
404
    # archive_permissions: 0640 # Permissions for the resulting backup.tar file (default: 0600)
405
    # keep_time: 604800   # default: 0 (forever) (in seconds)
406
    # pg_schema: public     # default: nil, it means that all schemas will be backed up
407 408 409 410
    # upload:
    #   # Fog storage connection settings, see http://fog.io/storage/ .
    #   connection:
    #     provider: AWS
411
    #     region: eu-west-1
412 413 414 415
    #     aws_access_key_id: AKIAKIAKI
    #     aws_secret_access_key: 'secret123'
    #   # The remote 'directory' to store your backups. For S3, this would be the bucket name.
    #   remote_directory: 'my.s3.bucket'
416 417 418
    #   # Use multipart uploads when file size reaches 100MB, see
    #   #  http://docs.aws.amazon.com/AmazonS3/latest/dev/uploadobjusingmpu.html
    #   multipart_chunk_size: 104857600
419 420
    #   # Turns on AWS Server-Side Encryption with Amazon S3-Managed Keys for backups, this is optional
    #   # encryption: 'AES256'
421 422 423

  ## GitLab Shell settings
  gitlab_shell:
424 425
    path: /home/git/gitlab-shell/

426 427 428 429
    # REPOS_PATH MUST NOT BE A SYMLINK!!!
    repos_path: /home/git/repositories/
    hooks_path: /home/git/gitlab-shell/hooks/

430 431 432 433
    # File that contains the secret key for verifying access for gitlab-shell.
    # Default is '.gitlab_shell_secret' relative to Rails.root (i.e. root of the GitLab app).
    # secret_file: /home/git/gitlab/.gitlab_shell_secret

434 435 436 437
    # Git over HTTP
    upload_pack: true
    receive_pack: true

438
    # If you use non-standard ssh port you need to specify it
439 440 441
    # ssh_port: 22

  ## Git settings
Riyad Preukschas's avatar
Riyad Preukschas committed
442
  # CAUTION!
443 444 445
  # Use the default values unless you really know what you are doing
  git:
    bin_path: /usr/bin/git
dosire's avatar
dosire committed
446 447 448
    # The next value is the maximum memory size grit can use
    # Given in number of bytes per git object (e.g. a commit)
    # This value can be increased if you have very large commits
449
    max_size: 20971520 # 20.megabytes
450
    # Git timeout to read a commit, in seconds
451 452
    timeout: 10

453
  #
454
  # 5. Extra customization
455 456
  # ==========================

457
  extra:
458 459 460
    ## Google analytics. Uncomment if you want it
    # google_analytics_id: '_your_tracking_id'

Sebastian Winkler's avatar
Sebastian Winkler committed
461 462 463 464
    ## Piwik analytics.
    # piwik_url: '_your_piwik_url'
    # piwik_site_id: '_your_piwik_site_id'

465 466
  rack_attack:
    git_basic_auth:
467 468 469
      # Rack Attack IP banning enabled
      # enabled: true
      #
470 471 472
      # Whitelist requests from 127.0.0.1 for web proxies (NGINX/Apache) with incorrect headers
      # ip_whitelist: ["127.0.0.1"]
      #
473 474 475 476 477 478 479 480 481
      # Limit the number of Git HTTP authentication attempts per IP
      # maxretry: 10
      #
      # Reset the auth attempt counter per IP after 60 seconds
      # findtime: 60
      #
      # Ban an IP for one hour (3600s) after too many auth attempts
      # bantime: 3600

482
development:
483
  <<: *base
484 485

test:
486
  <<: *base
487 488
  gravatar:
    enabled: true
Marin Jankovski's avatar
Marin Jankovski committed
489 490
  lfs:
    enabled: false
491 492
  gitlab:
    host: localhost
493
    port: 80
494 495

    # When you run tests we clone and setup gitlab-shell
496
    # In order to setup it correctly you need to specify
497
    # your system username you use to run GitLab
498
    # user: YOUR_USERNAME
499 500
  satellites:
    path: tmp/tests/gitlab-satellites/
501
  backup:
502
    path: tmp/tests/backups
503 504 505 506
  gitlab_shell:
    path: tmp/tests/gitlab-shell/
    repos_path: tmp/tests/repositories/
    hooks_path: tmp/tests/gitlab-shell/hooks/
507 508
  issues_tracker:
    redmine:
509
      title: "Redmine"
510
      project_url: "http://redmine/projects/:issues_tracker_id"
511
      issues_url: "http://redmine/:project_id/:issues_tracker_id/:id"
512
      new_issue_url: "http://redmine/projects/:issues_tracker_id/issues/new"
513 514 515
  ldap:
    enabled: false
    servers:
516
      main:
517 518 519 520 521 522 523 524 525
        label: ldap
        host: 127.0.0.1
        port: 3890
        uid: 'uid'
        method: 'plain' # "tls" or "ssl" or "plain"
        base: 'dc=example,dc=com'
        user_filter: ''
        group_base: 'ou=groups,dc=example,dc=com'
        admin_group: ''
526 527

staging:
528
  <<: *base