[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: gitlab's new secret.yml generation needs write access to /etc/gitlab



On 4/7/25 3:19 PM, Jérémy Lal wrote:
Le lun. 7 avr. 2025 à 11:17, Pirate Praveen <praveen@onenetbeyond.org <mailto:praveen@onenetbeyond.org>> a écrit : 

    Hi,

    gitlab generally needs to be able to write to some some files and
    directories.

    So far we managed to handle this via symblic links to /var/lib/gitlab.

    But now it needs to create backup files which we cannot know in advance.

    Creating a backup of secrets file: /usr/share/gitlab/config/sec
    rets.yml: /usr/share/gitlab/config/secrets.yml.orig.1744015985
    rake aborted!
    Errno::EACCES: Permission denied @ rb_file_s_rename - (/usr/sha
    re/gitlab/config/secrets.yml, /usr/share/gitlab/config/secrets.
    yml.orig.1744015985) (Errno::EACCES)

    /usr/share/gitlab/config is symbolic link to /etc/gitlab

    and /etc/gitlab/secret.yml is symbolic link to
    /var/lib/gitlab/secrets.yml (update is handled via ucf).


    Ideas?


Try the SECRET_KEY_BASE environment variable ?
https://salsa.debian.org/ruby-team/gitlab/-/blob/master/config/ initializers/01_secret_token.rb#L59 <https://salsa.debian.org/ruby-team/ gitlab/-/blob/master/config/initializers/01_secret_token.rb#L59>
I tried, it did not help, same error is there. It checks in the secrets.yml and sees it has the template values and try to set backup the file before modifying it.
I have opened an upstream issue https://gitlab.com/gitlab-org/gitlab/-/issues/534645

Attachment: OpenPGP_0x8F53E0193B294B75.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature

Reply to: