Originally branch 'mk-toggle-writing-to-auth-keys-1631'
See merge request !2004
Squashed commits:
Add authorized_keys_enabled to Application Settings
Ensure default settings are exposed in UI
Without this change, `authorized_keys_enabled` is unchecked when it is nil, even if it should be checked by default.
Add “Speed up SSH operations” documentation
Clarify the reasons for disabling writes
Add "How to go back" section
Tweak copy
Update Application Setting screenshot
Moving the check out of the general requests, makes sure we don't have
any slowdown in the regular requests.
To keep the process performing this checks small, the check is still
performed inside a unicorn. But that is called from a process running
on the same server.
Because the checks are now done outside normal request, we can have a
simpler failure strategy:
The check is now performed in the background every
`circuitbreaker_check_interval`. Failures are logged in redis. The
failures are reset when the check succeeds. Per check we will try
`circuitbreaker_access_retries` times within
`circuitbreaker_storage_timeout` seconds.
When the number of failures exceeds
`circuitbreaker_failure_count_threshold`, we will block access to the
storage.
After `failure_reset_time` of no checks, we will clear the stored
failures. This could happen when the process that performs the checks
is not running.
This enables skipping a lesser housekeeping task
(incremental or full repack) by consistently
scheduling a higher task (respectively full repack or gc)
with the same period.
Cf. #34981
`allowed_key_types` is removed and the `minimum_<type>_bits` fields are
renamed to `<tech>_key_restriction`. A special sentinel value (`-1`) signifies
that the key type is disabled.
This also feeds through to the UI - checkboxes per key type are out, inline
selection of "forbidden" and "allowed" (i.e., no restrictions) are in.
As with the previous model, unknown key types are disallowed, even if the
underlying ssh daemon happens to support them. The defaults have also been
changed from the lowest known bit size to "no restriction". So if someone
does happen to have a 768-bit RSA key, it will continue to work on upgrade, at
least until the administrator restricts them.
This is an amalgamation of:
* Cory Hinshaw: Initial implementation !5552
* Rémy Coutable: Updates !9350
* Nick Thomas: Resolve conflicts and add ED25519 support !13712
When sign-in is disabled:
- skip password expiration checks
- prevent password reset requests
- don’t show Password tab in User Settings
- don’t allow login with username/password for Git over HTTP requests
- render 404 on requests to Profiles::PasswordsController
Setting `usage_ping_enabled` to false in `gitlab.yml`:
1. Disables the usage ping, regardless of the value stored in the database.
2. Prevents the usage ping from being enabled through the admin panel. It can
only be enabled by either removing the line from `gitlab.yml` and configuring
through the admin panel, or setting it to true in `gitlab.yml`.
Due to a Rails bug, fetching the application settings from Redis
may prevent the attribute methods from being loaded for the `ApplicationSetting`
model. More details here: https://github.com/rails/rails/issues/27348
There was also a secondary problem introduced by overriding these
association methods which caused all default visibility levels to be
set to `nil`. Before, the previous implementation allowed the string
"20" to be saved as an integer, while now a table lookup happens
before that. We fix this by enforcing the integer value in the
controller and default to PRIVATE.
Closes#29674
Use strings for the ApplicationSetting properties:
- restricted_visibility_levels
- default_project_visibility
- default_snippet_visibility
- default_group_visibility
* upstream/master: (247 commits)
Switched CONTRIBUTING.md style guide recommendation for method chaining
Fix new offenses
Stylistic tweaks
Fix OAuth/SAML user blocking behavior
Revert "Enable Style/DotPosition"
Revert "Prefer leading style for Style/DotPosition"
Revert "Enable Style/BarePercentLiterals"
Manually correct autocorrect
Move up delegate calls
Exclude migrations from Style/MutableConstant
ActiveSupport delegation is preferred over Forwardable
Update haml_lint to work with newest rubocop
Add explanations to cops
Update rubocop and rubocop-rspec and regenerate .rubocop_todo.yml
Update rubocop and rubocop-rspec and regenerate .rubocop_todo.yml
Order cops alphabetically
Don’t exclude some file in lib from rubocop
Fix new offenses
Enable Rails/Delegate
Enable Style/WordArray
...
Douwe Maan
Stan Hu
Matija Čupić
🙈 jacopo beschi 🙉
Michael Kozono
Bob Van Landuyt
Andrew Newdigate
Markus Koller
Rémy Coutable
Kamil Trzcinski
Yorick Peterse
Alex Lossent
Visay Keo
Nick Thomas
Robin Bobbitt
Sean McGivern
Paul Charlton
Tiago Botelho
Luke "Jared" Bennett
Douglas Barbosa Alexandre
Adam Niedzielski
Pawel Chojnacki
Toon Claes
Lin Jen-Shin