Re: gitlab package (was Re: Opt out style recommends)
]] Michael Lustfield
> In this particular case, I would suggest first making letsencrypt a
> Suggests. Then, I would suggest considering snakeoil for the https or
> just installing with http-only and providing a documented tool for
> moving to using letsencrypt. You and I both know that we're only
> talking about a web server configuration... shouldn't the web server
> be the one suggesting it? ... it doesn't because the web server
> packages consider SSL/TLS to be its own thing entirely that shouldn't
> be mixed in with other package deployments.
The web app might well need to know whether it's being accessed over TLS
or not. If it is, any cookies it sets should be marked with «secure» so
they're never sent in plaintext.
An option that might satisfy everyone is to have a gitlab package and a
gitlab-bells-and-whistles package (or gitlab-minimal and gitlab) where
the latter includes full integration with nginx and letsencrypt and
whatnot, while the former is a more limited package that does the bare
minimum.
--
Tollef Fog Heen
UNIX is user friendly, it's just picky about who its friends are
Reply to: