Merge pull request #117 from yakara-ltd/ssl-attributes

Configure the SSL protocols and ciphers via attributes

Author: epcim

attributes/default.rb

@@ -107,6 +107,10 @@
 default['gitlab']['ssl_certificate'] = "/etc/nginx/ssl/certs/#{node['fqdn']}.pem"
 default['gitlab']['ssl_certificate_key'] = "/etc/nginx/ssl/private/#{node['fqdn']}.key"
 
+# Backwards compatible ciphers needed for Java IDEs
+default['gitlab']['ssl_ciphers'] = 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4'
+default['gitlab']['ssl_protocols'] = 'TLSv1 TLSv1.1 TLSv1.2'
+
 default['gitlab']['backup_path'] = node['gitlab']['app_home'] + '/backups'
 default['gitlab']['backup_keep_time'] = 604_800
 

recipes/default.rb

@@ -478,6 +478,8 @@ class unix_stream_socket connectto;
     https_boolean: node['gitlab']['https'],
     ssl_certificate: node['gitlab']['ssl_certificate'],
     ssl_certificate_key: node['gitlab']['ssl_certificate_key'],
+    ssl_ciphers: node['gitlab']['ssl_ciphers'],
+    ssl_protocols: node['gitlab']['ssl_protocols'],
     listen: "#{node['gitlab']['listen_ip']}:#{listen_port}"
   )
 end

templates/default/nginx.gitlab.erb

@@ -83,9 +83,8 @@ server {
   ssl_certificate <%= @ssl_certificate %>;
   ssl_certificate_key <%= @ssl_certificate_key %>;
 
-  # GitLab needs backwards compatible ciphers to retain compatibility with Java IDEs
-  ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
-  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+  ssl_ciphers <%= @ssl_ciphers %>;
+  ssl_protocols <%= @ssl_protocols %>;
   ssl_prefer_server_ciphers on;
   ssl_session_cache shared:SSL:10m;
   ssl_session_timeout 5m;