gitlab-org--gitlab-foss/app/models/instance_configuration.rb

164 lines
6.6 KiB
Ruby

# frozen_string_literal: true
require 'resolv'
class InstanceConfiguration
SSH_ALGORITHMS = %w(DSA ECDSA ED25519 RSA).freeze
SSH_ALGORITHMS_PATH = '/etc/ssh/'
CACHE_KEY = 'instance_configuration'
EXPIRATION_TIME = 24.hours
def settings
@configuration ||= Rails.cache.fetch(CACHE_KEY, expires_in: EXPIRATION_TIME) do
{ ssh_algorithms_hashes: ssh_algorithms_hashes,
host: host,
gitlab_pages: gitlab_pages,
size_limits: size_limits,
package_file_size_limits: package_file_size_limits,
rate_limits: rate_limits }.deep_symbolize_keys
end
end
private
def ssh_algorithms_hashes
SSH_ALGORITHMS.select { |algo| ssh_algorithm_enabled?(algo) }.map { |algo| ssh_algorithm_hashes(algo) }.compact
end
def ssh_algorithm_enabled?(algorithm)
algorithm_key_restriction = application_settings["#{algorithm.downcase}_key_restriction"]
algorithm_key_restriction.nil? || algorithm_key_restriction != ApplicationSetting::FORBIDDEN_KEY_VALUE
end
def host
Settings.gitlab.host
end
def gitlab_pages
Settings.pages.to_h.merge(ip_address: resolv_dns(Settings.pages.host))
end
def resolv_dns(dns)
Resolv.getaddress(dns)
rescue Resolv::ResolvError
end
def size_limits
{
max_attachment_size: application_settings[:max_attachment_size].megabytes,
receive_max_input_size: application_settings[:receive_max_input_size]&.megabytes,
max_import_size: application_settings[:max_import_size] > 0 ? application_settings[:max_import_size].megabytes : nil,
diff_max_patch_bytes: application_settings[:diff_max_patch_bytes].bytes,
max_artifacts_size: application_settings[:max_artifacts_size].megabytes,
max_pages_size: application_settings[:max_pages_size] > 0 ? application_settings[:max_pages_size].megabytes : nil,
snippet_size_limit: application_settings[:snippet_size_limit]&.bytes
}
end
def package_file_size_limits
Plan.all.to_h { |plan| [plan.name.capitalize, plan_file_size_limits(plan)] }
end
def plan_file_size_limits(plan)
{
conan: plan.actual_limits[:conan_max_file_size],
helm: plan.actual_limits[:helm_max_file_size],
maven: plan.actual_limits[:maven_max_file_size],
npm: plan.actual_limits[:npm_max_file_size],
nuget: plan.actual_limits[:nuget_max_file_size],
pypi: plan.actual_limits[:pypi_max_file_size],
terraform_module: plan.actual_limits[:terraform_module_max_file_size],
generic: plan.actual_limits[:generic_packages_max_file_size]
}
end
def rate_limits
{
unauthenticated: {
enabled: application_settings[:throttle_unauthenticated_enabled],
requests_per_period: application_settings[:throttle_unauthenticated_requests_per_period],
period_in_seconds: application_settings[:throttle_unauthenticated_period_in_seconds]
},
authenticated_api: {
enabled: application_settings[:throttle_authenticated_api_enabled],
requests_per_period: application_settings[:throttle_authenticated_api_requests_per_period],
period_in_seconds: application_settings[:throttle_authenticated_api_period_in_seconds]
},
authenticated_web: {
enabled: application_settings[:throttle_authenticated_web_enabled],
requests_per_period: application_settings[:throttle_authenticated_web_requests_per_period],
period_in_seconds: application_settings[:throttle_authenticated_web_period_in_seconds]
},
protected_paths: {
enabled: application_settings[:throttle_protected_paths_enabled],
requests_per_period: application_settings[:throttle_protected_paths_requests_per_period],
period_in_seconds: application_settings[:throttle_protected_paths_period_in_seconds]
},
unauthenticated_packages_api: {
enabled: application_settings[:throttle_unauthenticated_packages_api_enabled],
requests_per_period: application_settings[:throttle_unauthenticated_packages_api_requests_per_period],
period_in_seconds: application_settings[:throttle_unauthenticated_packages_api_period_in_seconds]
},
authenticated_packages_api: {
enabled: application_settings[:throttle_authenticated_packages_api_enabled],
requests_per_period: application_settings[:throttle_authenticated_packages_api_requests_per_period],
period_in_seconds: application_settings[:throttle_authenticated_packages_api_period_in_seconds]
},
authenticated_git_lfs_api: {
enabled: application_settings[:throttle_authenticated_git_lfs_enabled],
requests_per_period: application_settings[:throttle_authenticated_git_lfs_requests_per_period],
period_in_seconds: application_settings[:throttle_authenticated_git_lfs_period_in_seconds]
},
issue_creation: application_setting_limit_per_minute(:issues_create_limit),
note_creation: application_setting_limit_per_minute(:notes_create_limit),
project_export: application_setting_limit_per_minute(:project_export_limit),
project_export_download: application_setting_limit_per_minute(:project_download_export_limit),
project_import: application_setting_limit_per_minute(:project_import_limit),
group_export: application_setting_limit_per_minute(:group_export_limit),
group_export_download: application_setting_limit_per_minute(:group_download_export_limit),
group_import: application_setting_limit_per_minute(:group_import_limit),
raw_blob: application_setting_limit_per_minute(:raw_blob_request_limit),
user_email_lookup: application_setting_limit_per_minute(:user_email_lookup_limit)
}
end
def ssh_algorithm_file(algorithm)
File.join(SSH_ALGORITHMS_PATH, "ssh_host_#{algorithm.downcase}_key.pub")
end
def ssh_algorithm_hashes(algorithm)
content = ssh_algorithm_file_content(algorithm)
return unless content.present?
{ name: algorithm,
md5: ssh_algorithm_md5(content),
sha256: ssh_algorithm_sha256(content) }
end
def ssh_algorithm_file_content(algorithm)
file = ssh_algorithm_file(algorithm)
return unless File.exist?(file)
File.read(file)
end
def ssh_algorithm_md5(ssh_file_content)
Gitlab::SSHPublicKey.new(ssh_file_content).fingerprint
end
def ssh_algorithm_sha256(ssh_file_content)
Gitlab::SSHPublicKey.new(ssh_file_content).fingerprint('SHA256')
end
def application_settings
Gitlab::CurrentSettings.current_application_settings
end
def application_setting_limit_per_minute(setting)
{
enabled: application_settings[setting] > 0,
requests_per_period: application_settings[setting],
period_in_seconds: 1.minute
}
end
end