From 21ecc7096ebac6f45575c7acd2c8efe0f529df8c Mon Sep 17 00:00:00 2001 From: Mike VanDenburgh Date: Wed, 12 Aug 2026 16:28:01 -0400 Subject: [PATCH 1/7] Encode prod GitLab application settings in Terraform Adds a gitlab_application_settings resource to the spack_gitlab module with all instance settings captured from production GitLab (237 attributes supported by provider 17.6.1). --- .../spack_gitlab/application_settings.tf | 246 ++++++++++++++++++ 1 file changed, 246 insertions(+) create mode 100644 terraform/modules/spack_gitlab/application_settings.tf diff --git a/terraform/modules/spack_gitlab/application_settings.tf b/terraform/modules/spack_gitlab/application_settings.tf new file mode 100644 index 000000000..f126e567c --- /dev/null +++ b/terraform/modules/spack_gitlab/application_settings.tf @@ -0,0 +1,246 @@ +# Instance-wide GitLab application settings. +# +# Values were captured from the production GitLab instance on 2026-08-12. +resource "gitlab_application_settings" "this" { + admin_mode = false + after_sign_out_path = "" + after_sign_up_text = "" + akismet_enabled = false + allow_account_deletion = true + allow_group_owners_to_manage_ldap = true + allow_local_requests_from_system_hooks = true + allow_local_requests_from_web_hooks_and_services = false + allow_project_creation_for_guest_and_below = true + allow_runner_registration_token = true + asciidoc_max_includes = 32 + asset_proxy_enabled = false + authorized_keys_enabled = false + auto_ban_user_on_excessive_projects_download = false + auto_devops_domain = "" + auto_devops_enabled = false + automatic_purchased_storage_allocation = false + bulk_import_concurrent_pipeline_batch_limit = 25 + bulk_import_enabled = true + bulk_import_max_download_file_size = 5120 + can_create_group = true + check_namespace_plan = false + ci_max_includes = 150 + ci_max_total_yaml_size_bytes = 2147483647 + commit_email_hostname = "users.noreply.gitlab.next.spack.io" + concurrent_bitbucket_import_jobs_limit = 100 + concurrent_bitbucket_server_import_jobs_limit = 100 + concurrent_github_import_jobs_limit = 1000 + container_expiration_policies_enable_historic_entries = false + container_registry_cleanup_tags_service_max_list_size = 200 + container_registry_delete_tags_service_timeout = 250 + container_registry_expiration_policies_caching = true + container_registry_expiration_policies_worker_capacity = 4 + container_registry_token_expire_delay = 5 + deactivate_dormant_users = false + deactivate_dormant_users_period = 90 + decompress_archive_file_timeout = 210 + default_artifacts_expire_in = "90 days" + default_ci_config_path = "" + default_group_visibility = "private" + default_preferred_language = "en" + default_project_creation = 2 + default_project_visibility = "private" + default_projects_limit = 100000 + default_snippet_visibility = "private" + default_syntax_highlighting_theme = 1 + delete_inactive_projects = false + delete_unconfirmed_users = false + deletion_adjourned_period = 7 + diagramsnet_enabled = true + diagramsnet_url = "https://embed.diagrams.net" + diff_max_files = 1000 + diff_max_lines = 50000 + diff_max_patch_bytes = 204800 + disable_admin_oauth_scopes = false + disable_feed_token = false + disable_personal_access_tokens = false + dns_rebinding_protection_enabled = true + domain_denylist_enabled = false + downstream_pipeline_trigger_limit_per_project_user_sha = 0 + dsa_key_restriction = 0 + duo_features_enabled = true + ecdsa_key_restriction = 0 + ecdsa_sk_key_restriction = 0 + ed25519_key_restriction = 0 + ed25519_sk_key_restriction = 0 + eks_integration_enabled = false + elasticsearch_aws = false + elasticsearch_aws_region = "us-east-1" + elasticsearch_indexed_field_length_limit = 0 + elasticsearch_indexed_file_size_limit_kb = 1024 + elasticsearch_indexing = false + elasticsearch_limit_indexing = false + elasticsearch_max_bulk_concurrency = 10 + elasticsearch_max_bulk_size_mb = 10 + elasticsearch_max_code_indexing_concurrency = 30 + elasticsearch_requeue_workers = false + elasticsearch_search = false + elasticsearch_url = ["http://localhost:9200"] + elasticsearch_worker_number_of_shards = 2 + email_author_in_body = false + email_confirmation_setting = "hard" + enable_artifact_external_redirect_warning_page = true + enabled_git_access_protocol = "nil" + enforce_namespace_storage_limit = false + enforce_terms = false + external_authorization_service_enabled = false + external_authorization_service_timeout = 0.5 + first_day_of_week = 0 + geo_node_allowed_ips = "0.0.0.0/0, ::/0" + geo_status_timeout = 10 + git_rate_limit_users_alertlist = [] + git_rate_limit_users_allowlist = [] + git_two_factor_session_expiry = 15 + gitaly_timeout_default = 55 + gitaly_timeout_fast = 10 + gitaly_timeout_medium = 30 + gitlab_shell_operation_limit = 600 + gitpod_enabled = false + gitpod_url = "https://gitpod.io/" + globally_allowed_ips = "" + grafana_enabled = false + grafana_url = "/-/grafana" + gravatar_enabled = true + group_owners_can_manage_default_branch_protection = true + help_page_hide_commercial_content = false + hide_third_party_offers = false + home_page_url = "" + housekeeping_enabled = true + housekeeping_optimize_repository_period = 10 + html_emails_enabled = true + import_sources = ["github", "bitbucket", "bitbucket_server", "fogbugz", "git", "gitlab_project", "gitea", "manifest"] + inactive_projects_delete_after_months = 2 + inactive_projects_min_size_mb = 0 + inactive_projects_send_warning_email_after_months = 1 + include_optional_metrics_in_service_ping = true + invisible_captcha_enabled = false + issues_create_limit = 300 + jira_connect_public_key_storage_enabled = false + keep_latest_artifact = false + local_markdown_version = 0 + lock_duo_features_enabled = false + mailgun_events_enabled = false + maintenance_mode = false + maven_package_requests_forwarding = true + max_artifacts_size = 10000 + max_attachment_size = 10 + max_decompressed_archive_size = 25600 + max_export_size = 0 + max_import_remote_file_size = 10240 + max_import_size = 0 + max_number_of_repository_downloads = 0 + max_number_of_repository_downloads_within_time_period = 0 + max_pages_size = 100 + max_terraform_state_size_bytes = 0 + metrics_method_call_threshold = 10 + minimum_password_length = 8 + mirror_available = true + mirror_capacity_threshold = 15 + mirror_max_capacity = 30 + mirror_max_delay = 300 + npm_package_requests_forwarding = true + outbound_local_requests_whitelist = ["pipeline-webhook-service.custom.svc.cluster.local", "webhook-handler.custom.svc.cluster.local", "spack-gantry.spack.svc.cluster.local"] + package_metadata_purl_types = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 17] + package_registry_allow_anyone_to_pull_option = true + package_registry_cleanup_policies_worker_capacity = 2 + pages_domain_verification_enabled = true + password_authentication_enabled_for_git = true + password_authentication_enabled_for_web = true + password_lowercase_required = false + password_number_required = false + password_symbol_required = false + password_uppercase_required = false + personal_access_token_prefix = "glpat-" + pipeline_limit_per_project_user_sha = 0 + plantuml_enabled = false + polling_interval_multiplier = 1 + project_export_enabled = true + project_jobs_api_rate_limit = 600 + projects_api_rate_limit_unauthenticated = 400 + prometheus_metrics_enabled = true + protected_ci_variables = true + push_event_activities_limit = 3 + push_event_hooks_limit = 3 + pypi_package_requests_forwarding = true + raw_blob_request_limit = 300 + recaptcha_enabled = false + remember_me_enabled = true + repository_checks_enabled = true + repository_size_limit = 0 + repository_storages_weighted = { default = 100 } + require_admin_approval_after_user_signup = true + require_admin_two_factor_authentication = true + require_personal_access_token_expiry = true + require_two_factor_authentication = true + restricted_visibility_levels = [] + rsa_key_restriction = 0 + search_rate_limit = 300 + search_rate_limit_unauthenticated = 100 + security_approval_policies_limit = 5 + security_policy_global_group_approvers_enabled = true + service_access_tokens_expiration_enforced = true + session_expire_delay = 10080 + shared_runners_enabled = true + shared_runners_minutes = 0 + shared_runners_text = "" + sidekiq_job_limiter_compression_threshold_bytes = 100000 + sidekiq_job_limiter_limit_bytes = 0 + sidekiq_job_limiter_mode = "compress" + signup_enabled = false + silent_admin_exports_enabled = false + silent_mode_enabled = false + slack_app_enabled = false + snippet_size_limit = 52428800 + snowplow_enabled = false + sourcegraph_enabled = false + sourcegraph_public_only = true + spam_check_endpoint_enabled = false + suggest_pipeline_enabled = true + terminal_max_session_time = 0 + throttle_authenticated_api_enabled = false + throttle_authenticated_api_period_in_seconds = 3600 + throttle_authenticated_api_requests_per_period = 7200 + throttle_authenticated_packages_api_enabled = false + throttle_authenticated_packages_api_period_in_seconds = 15 + throttle_authenticated_packages_api_requests_per_period = 1000 + throttle_authenticated_web_enabled = false + throttle_authenticated_web_period_in_seconds = 3600 + throttle_authenticated_web_requests_per_period = 7200 + throttle_unauthenticated_api_enabled = false + throttle_unauthenticated_api_period_in_seconds = 3600 + throttle_unauthenticated_api_requests_per_period = 3600 + throttle_unauthenticated_packages_api_enabled = false + throttle_unauthenticated_packages_api_period_in_seconds = 15 + throttle_unauthenticated_packages_api_requests_per_period = 800 + throttle_unauthenticated_web_enabled = false + throttle_unauthenticated_web_period_in_seconds = 3600 + throttle_unauthenticated_web_requests_per_period = 3600 + time_tracking_limit_to_hours = false + two_factor_grace_period = 0 + unconfirmed_users_delete_after_days = 7 + unique_ips_limit_enabled = false + unique_ips_limit_per_user = 10 + unique_ips_limit_time_window = 3600 + update_runner_versions_enabled = true + usage_ping_enabled = true + user_deactivation_emails_enabled = true + user_default_external = false + user_defaults_to_private_profile = false + user_oauth_applications = true + user_show_add_ssh_key_message = true + valid_runner_registrars = ["project", "group"] + version_check_enabled = true + whats_new_variant = "all_tiers" + wiki_page_max_content_bytes = 5242880 + + default_branch_protection_defaults { + allow_force_push = false + allowed_to_merge = [40] + allowed_to_push = [40] + } +} From 11c9b54e67917bd6923156f371a9dd1782469386 Mon Sep 17 00:00:00 2001 From: Mike VanDenburgh Date: Wed, 12 Aug 2026 17:21:32 -0400 Subject: [PATCH 2/7] Add a descriptive comment to each GitLab application setting One-sentence descriptions taken from the gitlab provider 17.6.1 documentation for the gitlab_application_settings resource. Co-Authored-By: Claude Fable 5 --- .../spack_gitlab/application_settings.tf | 945 +++++++++++++----- 1 file changed, 710 insertions(+), 235 deletions(-) diff --git a/terraform/modules/spack_gitlab/application_settings.tf b/terraform/modules/spack_gitlab/application_settings.tf index f126e567c..436e04aa4 100644 --- a/terraform/modules/spack_gitlab/application_settings.tf +++ b/terraform/modules/spack_gitlab/application_settings.tf @@ -2,245 +2,720 @@ # # Values were captured from the production GitLab instance on 2026-08-12. resource "gitlab_application_settings" "this" { - admin_mode = false - after_sign_out_path = "" - after_sign_up_text = "" - akismet_enabled = false - allow_account_deletion = true - allow_group_owners_to_manage_ldap = true - allow_local_requests_from_system_hooks = true - allow_local_requests_from_web_hooks_and_services = false - allow_project_creation_for_guest_and_below = true - allow_runner_registration_token = true - asciidoc_max_includes = 32 - asset_proxy_enabled = false - authorized_keys_enabled = false - auto_ban_user_on_excessive_projects_download = false - auto_devops_domain = "" - auto_devops_enabled = false - automatic_purchased_storage_allocation = false - bulk_import_concurrent_pipeline_batch_limit = 25 - bulk_import_enabled = true - bulk_import_max_download_file_size = 5120 - can_create_group = true - check_namespace_plan = false - ci_max_includes = 150 - ci_max_total_yaml_size_bytes = 2147483647 - commit_email_hostname = "users.noreply.gitlab.next.spack.io" - concurrent_bitbucket_import_jobs_limit = 100 - concurrent_bitbucket_server_import_jobs_limit = 100 - concurrent_github_import_jobs_limit = 1000 - container_expiration_policies_enable_historic_entries = false - container_registry_cleanup_tags_service_max_list_size = 200 - container_registry_delete_tags_service_timeout = 250 - container_registry_expiration_policies_caching = true - container_registry_expiration_policies_worker_capacity = 4 - container_registry_token_expire_delay = 5 - deactivate_dormant_users = false - deactivate_dormant_users_period = 90 - decompress_archive_file_timeout = 210 - default_artifacts_expire_in = "90 days" - default_ci_config_path = "" - default_group_visibility = "private" - default_preferred_language = "en" - default_project_creation = 2 - default_project_visibility = "private" - default_projects_limit = 100000 - default_snippet_visibility = "private" - default_syntax_highlighting_theme = 1 - delete_inactive_projects = false - delete_unconfirmed_users = false - deletion_adjourned_period = 7 - diagramsnet_enabled = true - diagramsnet_url = "https://embed.diagrams.net" - diff_max_files = 1000 - diff_max_lines = 50000 - diff_max_patch_bytes = 204800 - disable_admin_oauth_scopes = false - disable_feed_token = false - disable_personal_access_tokens = false - dns_rebinding_protection_enabled = true - domain_denylist_enabled = false - downstream_pipeline_trigger_limit_per_project_user_sha = 0 - dsa_key_restriction = 0 - duo_features_enabled = true - ecdsa_key_restriction = 0 - ecdsa_sk_key_restriction = 0 - ed25519_key_restriction = 0 - ed25519_sk_key_restriction = 0 - eks_integration_enabled = false - elasticsearch_aws = false - elasticsearch_aws_region = "us-east-1" - elasticsearch_indexed_field_length_limit = 0 - elasticsearch_indexed_file_size_limit_kb = 1024 - elasticsearch_indexing = false - elasticsearch_limit_indexing = false - elasticsearch_max_bulk_concurrency = 10 - elasticsearch_max_bulk_size_mb = 10 - elasticsearch_max_code_indexing_concurrency = 30 - elasticsearch_requeue_workers = false - elasticsearch_search = false - elasticsearch_url = ["http://localhost:9200"] - elasticsearch_worker_number_of_shards = 2 - email_author_in_body = false - email_confirmation_setting = "hard" - enable_artifact_external_redirect_warning_page = true - enabled_git_access_protocol = "nil" - enforce_namespace_storage_limit = false - enforce_terms = false - external_authorization_service_enabled = false - external_authorization_service_timeout = 0.5 - first_day_of_week = 0 - geo_node_allowed_ips = "0.0.0.0/0, ::/0" - geo_status_timeout = 10 - git_rate_limit_users_alertlist = [] - git_rate_limit_users_allowlist = [] - git_two_factor_session_expiry = 15 - gitaly_timeout_default = 55 - gitaly_timeout_fast = 10 - gitaly_timeout_medium = 30 - gitlab_shell_operation_limit = 600 - gitpod_enabled = false - gitpod_url = "https://gitpod.io/" - globally_allowed_ips = "" - grafana_enabled = false - grafana_url = "/-/grafana" - gravatar_enabled = true - group_owners_can_manage_default_branch_protection = true - help_page_hide_commercial_content = false - hide_third_party_offers = false - home_page_url = "" - housekeeping_enabled = true - housekeeping_optimize_repository_period = 10 - html_emails_enabled = true - import_sources = ["github", "bitbucket", "bitbucket_server", "fogbugz", "git", "gitlab_project", "gitea", "manifest"] - inactive_projects_delete_after_months = 2 - inactive_projects_min_size_mb = 0 - inactive_projects_send_warning_email_after_months = 1 - include_optional_metrics_in_service_ping = true - invisible_captcha_enabled = false - issues_create_limit = 300 - jira_connect_public_key_storage_enabled = false - keep_latest_artifact = false - local_markdown_version = 0 - lock_duo_features_enabled = false - mailgun_events_enabled = false - maintenance_mode = false - maven_package_requests_forwarding = true - max_artifacts_size = 10000 - max_attachment_size = 10 - max_decompressed_archive_size = 25600 - max_export_size = 0 - max_import_remote_file_size = 10240 - max_import_size = 0 - max_number_of_repository_downloads = 0 - max_number_of_repository_downloads_within_time_period = 0 - max_pages_size = 100 - max_terraform_state_size_bytes = 0 - metrics_method_call_threshold = 10 - minimum_password_length = 8 - mirror_available = true - mirror_capacity_threshold = 15 - mirror_max_capacity = 30 - mirror_max_delay = 300 - npm_package_requests_forwarding = true - outbound_local_requests_whitelist = ["pipeline-webhook-service.custom.svc.cluster.local", "webhook-handler.custom.svc.cluster.local", "spack-gantry.spack.svc.cluster.local"] - package_metadata_purl_types = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 17] - package_registry_allow_anyone_to_pull_option = true - package_registry_cleanup_policies_worker_capacity = 2 - pages_domain_verification_enabled = true - password_authentication_enabled_for_git = true - password_authentication_enabled_for_web = true - password_lowercase_required = false - password_number_required = false - password_symbol_required = false - password_uppercase_required = false - personal_access_token_prefix = "glpat-" - pipeline_limit_per_project_user_sha = 0 - plantuml_enabled = false - polling_interval_multiplier = 1 - project_export_enabled = true - project_jobs_api_rate_limit = 600 - projects_api_rate_limit_unauthenticated = 400 - prometheus_metrics_enabled = true - protected_ci_variables = true - push_event_activities_limit = 3 - push_event_hooks_limit = 3 - pypi_package_requests_forwarding = true - raw_blob_request_limit = 300 - recaptcha_enabled = false - remember_me_enabled = true - repository_checks_enabled = true - repository_size_limit = 0 - repository_storages_weighted = { default = 100 } - require_admin_approval_after_user_signup = true - require_admin_two_factor_authentication = true - require_personal_access_token_expiry = true - require_two_factor_authentication = true - restricted_visibility_levels = [] - rsa_key_restriction = 0 - search_rate_limit = 300 - search_rate_limit_unauthenticated = 100 - security_approval_policies_limit = 5 - security_policy_global_group_approvers_enabled = true - service_access_tokens_expiration_enforced = true - session_expire_delay = 10080 - shared_runners_enabled = true - shared_runners_minutes = 0 - shared_runners_text = "" - sidekiq_job_limiter_compression_threshold_bytes = 100000 - sidekiq_job_limiter_limit_bytes = 0 - sidekiq_job_limiter_mode = "compress" - signup_enabled = false - silent_admin_exports_enabled = false - silent_mode_enabled = false - slack_app_enabled = false - snippet_size_limit = 52428800 - snowplow_enabled = false - sourcegraph_enabled = false - sourcegraph_public_only = true - spam_check_endpoint_enabled = false - suggest_pipeline_enabled = true - terminal_max_session_time = 0 - throttle_authenticated_api_enabled = false - throttle_authenticated_api_period_in_seconds = 3600 - throttle_authenticated_api_requests_per_period = 7200 - throttle_authenticated_packages_api_enabled = false - throttle_authenticated_packages_api_period_in_seconds = 15 - throttle_authenticated_packages_api_requests_per_period = 1000 - throttle_authenticated_web_enabled = false - throttle_authenticated_web_period_in_seconds = 3600 - throttle_authenticated_web_requests_per_period = 7200 - throttle_unauthenticated_api_enabled = false - throttle_unauthenticated_api_period_in_seconds = 3600 - throttle_unauthenticated_api_requests_per_period = 3600 - throttle_unauthenticated_packages_api_enabled = false - throttle_unauthenticated_packages_api_period_in_seconds = 15 + # Require administrators to enable Admin Mode by re-authenticating for administrative tasks. + admin_mode = false + + # Where to redirect users after logout. + after_sign_out_path = "" + + # Text shown to the user after signing up. + after_sign_up_text = "" + + # Enable or disable Akismet spam protection. + akismet_enabled = false + + # Set to true to allow users to delete their accounts. + allow_account_deletion = true + + # Set to true to allow group owners to manage LDAP. + allow_group_owners_to_manage_ldap = true + + # Allow requests to the local network from system hooks. + allow_local_requests_from_system_hooks = true + + # Allow requests to the local network from web hooks and services. + allow_local_requests_from_web_hooks_and_services = false + + # Indicates whether users assigned up to the Guest role can create groups and personal projects. + allow_project_creation_for_guest_and_below = true + + # Allow using a registration token to create a runner. + allow_runner_registration_token = true + + # Maximum limit of AsciiDoc include directives being processed in any one document. + asciidoc_max_includes = 32 + + # Enable proxying of assets. + asset_proxy_enabled = false + + # By default, we write to the authorized_keys file to support Git over SSH without additional configuration. + authorized_keys_enabled = false + + # Automatically ban users who download more than max_number_of_repository_downloads unique projects in the configured time period. + auto_ban_user_on_excessive_projects_download = false + + # Specify a domain to use by default for every project’s Auto Review Apps and Auto Deploy stages. + auto_devops_domain = "" + + # Enable Auto DevOps for projects by default. + auto_devops_enabled = false + + # Enabling this permits automatic allocation of purchased storage in a namespace. + automatic_purchased_storage_allocation = false + + # Maximum simultaneous Direct Transfer batches to process. + bulk_import_concurrent_pipeline_batch_limit = 25 + + # Enable migrating GitLab groups by direct transfer. + bulk_import_enabled = true + + # Maximum download file size when importing from source GitLab instances by direct transfer. + bulk_import_max_download_file_size = 5120 + + # Indicates whether users can create top-level groups. + can_create_group = true + + # Enabling this makes only licensed EE features available to projects if the project namespace’s plan includes the feature or if the project is public. + check_namespace_plan = false + + # The maximum number of includes per pipeline. + ci_max_includes = 150 + + # The maximum amount of memory, in bytes, that can be allocated for the pipeline configuration, with all included YAML configuration files. + ci_max_total_yaml_size_bytes = 2147483647 + + # Custom hostname (for private commit emails). + commit_email_hostname = "users.noreply.gitlab.next.spack.io" + + # Maximum number of simultaneous import jobs for the Bitbucket Cloud importer. + concurrent_bitbucket_import_jobs_limit = 100 + + # Maximum number of simultaneous import jobs for the Bitbucket Server importer. + concurrent_bitbucket_server_import_jobs_limit = 100 + + # Maximum number of simultaneous import jobs for the GitHub importer. + concurrent_github_import_jobs_limit = 1000 + + # Enable cleanup policies for all projects. + container_expiration_policies_enable_historic_entries = false + + # The maximum number of tags that can be deleted in a single execution of cleanup policies. + container_registry_cleanup_tags_service_max_list_size = 200 + + # The maximum time, in seconds, that the cleanup process can take to delete a batch of tags for cleanup policies. + container_registry_delete_tags_service_timeout = 250 + + # Caching during the execution of cleanup policies. + container_registry_expiration_policies_caching = true + + # Number of workers for cleanup policies. + container_registry_expiration_policies_worker_capacity = 4 + + # Container Registry token duration in minutes. + container_registry_token_expire_delay = 5 + + # Enable automatic deactivation of dormant users. + deactivate_dormant_users = false + + # Length of time (in days) after which a user is considered dormant. + deactivate_dormant_users_period = 90 + + # Default timeout for decompressing archived files, in seconds. + decompress_archive_file_timeout = 210 + + # Set the default expiration time for each job’s artifacts. + default_artifacts_expire_in = "90 days" + + # Default CI/CD configuration file and path for new projects (.gitlab-ci.yml if not set). + default_ci_config_path = "" + + # What visibility level new groups receive. + default_group_visibility = "private" + + # Default preferred language for users who are not logged in. + default_preferred_language = "en" + + # Default project creation protection. + default_project_creation = 2 + + # What visibility level new projects receive. + default_project_visibility = "private" + + # Project limit per user. + default_projects_limit = 100000 + + # What visibility level new snippets receive. + default_snippet_visibility = "private" + + # Default syntax highlighting theme for users who are new or not signed in. + default_syntax_highlighting_theme = 1 + + # Enable inactive project deletion feature. + delete_inactive_projects = false + + # Specifies whether users who have not confirmed their email should be deleted. + delete_unconfirmed_users = false + + # The number of days to wait before deleting a project or group that is marked for deletion. + deletion_adjourned_period = 7 + + # Enable Diagrams.net integration. + diagramsnet_enabled = true + + # The Diagrams.net instance URL for integration. + diagramsnet_url = "https://embed.diagrams.net" + + # Maximum files in a diff. + diff_max_files = 1000 + + # Maximum lines in a diff. + diff_max_lines = 50000 + + # Maximum diff patch size, in bytes. + diff_max_patch_bytes = 204800 + + # Stops administrators from connecting their GitLab accounts to non-trusted OAuth 2.0 applications that have the api, read_api, read_repository, write_repository, read_registry, write_registry, or sudo scopes. + disable_admin_oauth_scopes = false + + # Disable display of RSS/Atom and calendar feed tokens (introduced in GitLab 13.7). + disable_feed_token = false + + # Disable personal access tokens. + disable_personal_access_tokens = false + + # Enforce DNS rebinding attack protection. + dns_rebinding_protection_enabled = true + + # Allows blocking sign-ups from emails from specific domains. + domain_denylist_enabled = false + + # Maximum downstream pipeline trigger rate. + downstream_pipeline_trigger_limit_per_project_user_sha = 0 + + # The minimum allowed bit length of an uploaded DSA key. + dsa_key_restriction = 0 + + # Indicates whether GitLab Duo features are enabled for this instance. + duo_features_enabled = true + + # The minimum allowed curve size (in bits) of an uploaded ECDSA key. + ecdsa_key_restriction = 0 + + # The minimum allowed curve size (in bits) of an uploaded ECDSA_SK key. + ecdsa_sk_key_restriction = 0 + + # The minimum allowed curve size (in bits) of an uploaded ED25519 key. + ed25519_key_restriction = 0 + + # The minimum allowed curve size (in bits) of an uploaded ED25519_SK key. + ed25519_sk_key_restriction = 0 + + # Enable integration with Amazon EKS. + eks_integration_enabled = false + + # Enable the use of AWS hosted Elasticsearch. + elasticsearch_aws = false + + # The AWS region the Elasticsearch domain is configured. + elasticsearch_aws_region = "us-east-1" + + # Maximum size of text fields to index by Elasticsearch. + elasticsearch_indexed_field_length_limit = 0 + + # Maximum size of repository and wiki files that are indexed by Elasticsearch. + elasticsearch_indexed_file_size_limit_kb = 1024 + + # Enable Elasticsearch indexing. + elasticsearch_indexing = false + + # Limit Elasticsearch to index certain namespaces and projects. + elasticsearch_limit_indexing = false + + # Maximum concurrency of Elasticsearch bulk requests per indexing operation. + elasticsearch_max_bulk_concurrency = 10 + + # Maximum size of Elasticsearch bulk indexing requests in MB. + elasticsearch_max_bulk_size_mb = 10 + + # Maximum concurrency of Elasticsearch code indexing background jobs. + elasticsearch_max_code_indexing_concurrency = 30 + + # Enable automatic requeuing of indexing workers. + elasticsearch_requeue_workers = false + + # Enable Elasticsearch search. + elasticsearch_search = false + + # The URL to use for connecting to Elasticsearch. + elasticsearch_url = ["http://localhost:9200"] + + # Number of indexing worker shards. + elasticsearch_worker_number_of_shards = 2 + + # Some email servers do not support overriding the email sender name. + email_author_in_body = false + + # Specifies whether users must confirm their email before sign in. + email_confirmation_setting = "hard" + + # Show the external redirect page that warns you about user-generated content in GitLab Pages. + enable_artifact_external_redirect_warning_page = true + + # Enabled protocols for Git access. + enabled_git_access_protocol = "nil" + + # Enabling this permits enforcement of namespace storage limits. + enforce_namespace_storage_limit = false + + # Enforce application ToS to all users. + enforce_terms = false + + # Enable using an external authorization service for accessing projects. + external_authorization_service_enabled = false + + # The timeout after which an authorization request is aborted, in seconds. + external_authorization_service_timeout = 0.5 + + # Start day of the week for calendar views and date pickers. + first_day_of_week = 0 + + # Comma-separated list of IPs and CIDRs of allowed secondary nodes. + geo_node_allowed_ips = "0.0.0.0/0, ::/0" + + # The amount of seconds after which a request to get a secondary node status times out. + geo_status_timeout = 10 + + # List of user IDs that are emailed when the Git abuse rate limit is exceeded. + git_rate_limit_users_alertlist = [] + + # List of usernames excluded from Git anti-abuse rate limits. + git_rate_limit_users_allowlist = [] + + # Maximum duration (in minutes) of a session for Git operations when 2FA is enabled. + git_two_factor_session_expiry = 15 + + # Default Gitaly timeout, in seconds. + gitaly_timeout_default = 55 + + # Gitaly fast operation timeout, in seconds. + gitaly_timeout_fast = 10 + + # Medium Gitaly timeout, in seconds. + gitaly_timeout_medium = 30 + + # Maximum number of Git operations per minute a user can perform. + gitlab_shell_operation_limit = 600 + + # Enable Gitpod integration. + gitpod_enabled = false + + # The Gitpod instance URL for integration. + gitpod_url = "https://gitpod.io/" + + # Comma-separated list of IP addresses and CIDRs always allowed for inbound traffic. + globally_allowed_ips = "" + + # Enable Grafana. + grafana_enabled = false + + # Grafana URL. + grafana_url = "/-/grafana" + + # Enable Gravatar. + gravatar_enabled = true + + # Prevent overrides of default branch protection. + group_owners_can_manage_default_branch_protection = true + + # Hide marketing-related entries from help. + help_page_hide_commercial_content = false + + # Do not display offers from third parties in GitLab. + hide_third_party_offers = false + + # Redirect to this URL when not logged in. + home_page_url = "" + + # Enable or disable Git housekeeping. + housekeeping_enabled = true + + # Number of Git pushes after which an incremental git repack is run. + housekeeping_optimize_repository_period = 10 + + # Enable HTML emails. + html_emails_enabled = true + + # Sources to allow project import from. + import_sources = ["github", "bitbucket", "bitbucket_server", "fogbugz", "git", "gitlab_project", "gitea", "manifest"] + + # If delete_inactive_projects is true, the time (in months) to wait before deleting inactive projects. + inactive_projects_delete_after_months = 2 + + # If delete_inactive_projects is true, the minimum repository size for projects to be checked for inactivity. + inactive_projects_min_size_mb = 0 + + # If delete_inactive_projects is true, sets the time (in months) to wait before emailing maintainers that the project is scheduled be deleted because it is inactive. + inactive_projects_send_warning_email_after_months = 1 + + # Whether or not optional metrics are enabled in Service Ping. + include_optional_metrics_in_service_ping = true + + # Enable Invisible CAPTCHA spam detection during sign-up. + invisible_captcha_enabled = false + + # Max number of issue creation requests per minute per user. + issues_create_limit = 300 + + # Enable public key storage for the GitLab for Jira Cloud app. + jira_connect_public_key_storage_enabled = false + + # Prevent the deletion of the artifacts from the most recent successful jobs, regardless of the expiry time. + keep_latest_artifact = false + + # Increase this value when any cached Markdown should be invalidated. + local_markdown_version = 0 + + # Indicates whether the GitLab Duo features enabled setting is enforced for all subgroups. + lock_duo_features_enabled = false + + # Enable Mailgun event receiver. + mailgun_events_enabled = false + + # When instance is in maintenance mode, non-administrative users can sign in with read-only access and make read-only API requests. + maintenance_mode = false + + # Use repo.maven.apache.org as a default remote repository when the package is not found in the GitLab Package Registry for Maven. + maven_package_requests_forwarding = true + + # Maximum artifacts size in MB. + max_artifacts_size = 10000 + + # Limit attachment size in MB. + max_attachment_size = 10 + + # Maximum decompressed archive size in bytes. + max_decompressed_archive_size = 25600 + + # Maximum export size in MB. + max_export_size = 0 + + # Maximum remote file size for imports from external object storages. + max_import_remote_file_size = 10240 + + # Maximum import size in MB. + max_import_size = 0 + + # Maximum number of unique repositories a user can download in the specified time period before they are banned. + max_number_of_repository_downloads = 0 + + # Reporting time period (in seconds). + max_number_of_repository_downloads_within_time_period = 0 + + # Maximum size of pages repositories in MB. + max_pages_size = 100 + + # Maximum size in bytes of the Terraform state files. + max_terraform_state_size_bytes = 0 + + # A method call is only tracked when it takes longer than the given amount of milliseconds. + metrics_method_call_threshold = 10 + + # Indicates whether passwords require a minimum length. + minimum_password_length = 8 + + # Allow repository mirroring to configured by project Maintainers. + mirror_available = true + + # Minimum capacity to be available before scheduling more mirrors preemptively. + mirror_capacity_threshold = 15 + + # Maximum number of mirrors that can be synchronizing at the same time. + mirror_max_capacity = 30 + + # Maximum time (in minutes) between updates that a mirror can have when scheduled to synchronize. + mirror_max_delay = 300 + + # Use npmjs.org as a default remote repository when the package is not found in the GitLab Package Registry for npm. + npm_package_requests_forwarding = true + + # Define a list of trusted domains or IP addresses to which local requests are allowed when local requests for hooks and services are disabled. + outbound_local_requests_whitelist = ["pipeline-webhook-service.custom.svc.cluster.local", "webhook-handler.custom.svc.cluster.local", "spack-gantry.spack.svc.cluster.local"] + + # List of package registry metadata to sync. + package_metadata_purl_types = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 17] + + # Enable to allow anyone to pull from Package Registry visible and changeable. + package_registry_allow_anyone_to_pull_option = true + + # Number of workers assigned to the packages cleanup policies. + package_registry_cleanup_policies_worker_capacity = 2 + + # Require users to prove ownership of custom domains. + pages_domain_verification_enabled = true + + # Enable authentication for Git over HTTP(S) via a GitLab account password. + password_authentication_enabled_for_git = true + + # Enable authentication for the web interface via a GitLab account password. + password_authentication_enabled_for_web = true + + # Indicates whether passwords require at least one lowercase letter. + password_lowercase_required = false + + # Indicates whether passwords require at least one number. + password_number_required = false + + # Indicates whether passwords require at least one symbol character. + password_symbol_required = false + + # Indicates whether passwords require at least one uppercase letter. + password_uppercase_required = false + + # Prefix for all generated personal access tokens. + personal_access_token_prefix = "glpat-" + + # Maximum number of pipeline creation requests per minute per user and commit. + pipeline_limit_per_project_user_sha = 0 + + # Enable PlantUML integration. + plantuml_enabled = false + + # Interval multiplier used by endpoints that perform polling. + polling_interval_multiplier = 1 + + # Enable project export. + project_export_enabled = true + + # Maximum authenticated requests to /project/:id/jobs per minute. + project_jobs_api_rate_limit = 600 + + # Introduced in GitLab 15.10. + projects_api_rate_limit_unauthenticated = 400 + + # Enable Prometheus metrics. + prometheus_metrics_enabled = true + + # CI/CD variables are protected by default. + protected_ci_variables = true + + # Number of changes (branches or tags) in a single push to determine whether individual push events or bulk push events are created. + push_event_activities_limit = 3 + + # Number of changes (branches or tags) in a single push to determine whether webhooks and services fire or not. + push_event_hooks_limit = 3 + + # Use pypi.org as a default remote repository when the package is not found in the GitLab Package Registry for PyPI. + pypi_package_requests_forwarding = true + + # Max number of requests per minute for each raw path. + raw_blob_request_limit = 300 + + # Enable reCAPTCHA. + recaptcha_enabled = false + + # Enable Remember me setting. + remember_me_enabled = true + + # GitLab periodically runs git fsck in all project and wiki repositories to look for silent disk corruption issues. + repository_checks_enabled = true + + # Size limit per repository (MB). + repository_size_limit = 0 + + # Hash of names of taken from gitlab.yml to weights. + repository_storages_weighted = { default = 100 } + + # When enabled, any user that signs up for an account using the registration form is placed under a Pending approval state and has to be explicitly approved by an administrator. + require_admin_approval_after_user_signup = true + + # Allow administrators to require 2FA for all administrators on the instance. + require_admin_two_factor_authentication = true + + # When enabled, users must set an expiration date when creating a group or project access token, or a personal access token owned by a non-service account. + require_personal_access_token_expiry = true + + # Require all users to set up Two-factor authentication. + require_two_factor_authentication = true + + # Selected levels cannot be used by non-Administrator users for groups, projects or snippets. + restricted_visibility_levels = [] + + # The minimum allowed bit length of an uploaded RSA key. + rsa_key_restriction = 0 + + # Max number of requests per minute for performing a search while authenticated. + search_rate_limit = 300 + + # Max number of requests per minute for performing a search while unauthenticated. + search_rate_limit_unauthenticated = 100 + + # Maximum number of active merge request approval policies per security policy project. + security_approval_policies_limit = 5 + + # Whether to look up merge request approval policy approval groups globally or within project hierarchies. + security_policy_global_group_approvers_enabled = true + + # Flag to indicate if token expiry date can be optional for service account users. + service_access_tokens_expiration_enforced = true + + # Session duration in minutes. + session_expire_delay = 10080 + + # Enable shared runners for new projects. + shared_runners_enabled = true + + # Set the maximum number of CI/CD minutes that a group can use on shared runners per month. + shared_runners_minutes = 0 + + # Shared runners text. + shared_runners_text = "" + + # The threshold in bytes at which Sidekiq jobs are compressed before being stored in Redis. + sidekiq_job_limiter_compression_threshold_bytes = 100000 + + # The threshold in bytes at which Sidekiq jobs are rejected. + sidekiq_job_limiter_limit_bytes = 0 + + # Behavior for Sidekiq job size limits: track or compress. + sidekiq_job_limiter_mode = "compress" + + # Enable registration. + signup_enabled = false + + # Enable Silent admin exports. + silent_admin_exports_enabled = false + + # Enable Silent mode. + silent_mode_enabled = false + + # Enable Slack app. + slack_app_enabled = false + + # Max snippet content size in bytes. + snippet_size_limit = 52428800 + + # Enable snowplow tracking. + snowplow_enabled = false + + # Enables Sourcegraph integration. + sourcegraph_enabled = false + + # Blocks Sourcegraph from being loaded on private and internal projects. + sourcegraph_public_only = true + + # Enables spam checking using external Spam Check API endpoint. + spam_check_endpoint_enabled = false + + # Enable pipeline suggestion banner. + suggest_pipeline_enabled = true + + # Maximum time for web terminal websocket connection (in seconds). + terminal_max_session_time = 0 + + # Enable authenticated API request rate limit. + throttle_authenticated_api_enabled = false + + # Rate limit period (in seconds). + throttle_authenticated_api_period_in_seconds = 3600 + + # Maximum requests per period per user. + throttle_authenticated_api_requests_per_period = 7200 + + # Enable authenticated API request rate limit. + throttle_authenticated_packages_api_enabled = false + + # Rate limit period (in seconds). + throttle_authenticated_packages_api_period_in_seconds = 15 + + # Maximum requests per period per user. + throttle_authenticated_packages_api_requests_per_period = 1000 + + # Enable authenticated web request rate limit. + throttle_authenticated_web_enabled = false + + # Rate limit period (in seconds). + throttle_authenticated_web_period_in_seconds = 3600 + + # Maximum requests per period per user. + throttle_authenticated_web_requests_per_period = 7200 + + # Enable unauthenticated API request rate limit. + throttle_unauthenticated_api_enabled = false + + # Rate limit period in seconds. + throttle_unauthenticated_api_period_in_seconds = 3600 + + # Max requests per period per IP. + throttle_unauthenticated_api_requests_per_period = 3600 + + # Enable authenticated API request rate limit. + throttle_unauthenticated_packages_api_enabled = false + + # Rate limit period (in seconds). + throttle_unauthenticated_packages_api_period_in_seconds = 15 + + # Maximum requests per period per user. throttle_unauthenticated_packages_api_requests_per_period = 800 - throttle_unauthenticated_web_enabled = false - throttle_unauthenticated_web_period_in_seconds = 3600 - throttle_unauthenticated_web_requests_per_period = 3600 - time_tracking_limit_to_hours = false - two_factor_grace_period = 0 - unconfirmed_users_delete_after_days = 7 - unique_ips_limit_enabled = false - unique_ips_limit_per_user = 10 - unique_ips_limit_time_window = 3600 - update_runner_versions_enabled = true - usage_ping_enabled = true - user_deactivation_emails_enabled = true - user_default_external = false - user_defaults_to_private_profile = false - user_oauth_applications = true - user_show_add_ssh_key_message = true - valid_runner_registrars = ["project", "group"] - version_check_enabled = true - whats_new_variant = "all_tiers" - wiki_page_max_content_bytes = 5242880 + # Enable unauthenticated web request rate limit. + throttle_unauthenticated_web_enabled = false + + # Rate limit period in seconds. + throttle_unauthenticated_web_period_in_seconds = 3600 + + # Max requests per period per IP. + throttle_unauthenticated_web_requests_per_period = 3600 + + # Limit display of time tracking units to hours. + time_tracking_limit_to_hours = false + + # Amount of time (in hours) that users are allowed to skip forced configuration of two-factor authentication. + two_factor_grace_period = 0 + + # Specifies how many days after sign-up to delete users who have not confirmed their email. + unconfirmed_users_delete_after_days = 7 + + # Limit sign in from multiple IPs. + unique_ips_limit_enabled = false + + # Maximum number of IPs per user. + unique_ips_limit_per_user = 10 + + # How many seconds an IP is counted towards the limit. + unique_ips_limit_time_window = 3600 + + # Fetch GitLab Runner release version data from GitLab.com. + update_runner_versions_enabled = true + + # Every week GitLab reports license usage back to GitLab, Inc. + usage_ping_enabled = true + + # Send an email to users upon account deactivation. + user_deactivation_emails_enabled = true + + # Newly registered users are external by default. + user_default_external = false + + # Newly created users have private profile by default. + user_defaults_to_private_profile = false + + # Allow users to register any application to use GitLab as an OAuth provider. + user_oauth_applications = true + + # When set to false disable the You won't be able to pull or push project code via SSH warning shown to users with no uploaded SSH key. + user_show_add_ssh_key_message = true + + # List of types which are allowed to register a GitLab Runner. + valid_runner_registrars = ["project", "group"] + + # Let GitLab inform you when an update is available. + version_check_enabled = true + + # What's new variant, possible values: all_tiers, current_tier, and disabled. + whats_new_variant = "all_tiers" + + # Maximum wiki page content size in bytes. + wiki_page_max_content_bytes = 5242880 + + # The default_branch_protection_defaults attribute describes the default branch protection defaults. default_branch_protection_defaults { + # Allow force push for all users with push access. allow_force_push = false + + # An array of access levels allowed to merge. allowed_to_merge = [40] - allowed_to_push = [40] + + # An array of access levels allowed to push. + allowed_to_push = [40] } } From 1675af43d0ab010d3a8a00165adc8782df8ca0eb Mon Sep 17 00:00:00 2001 From: Jacob Nesbitt Date: Mon, 17 Aug 2026 16:22:16 -0400 Subject: [PATCH 3/7] Upgrade gitlab provider to 19.2.1 --- terraform/production/.terraform.lock.hcl | 196 ++++++++++++----------- terraform/production/versions.tf | 2 +- terraform/staging/.terraform.lock.hcl | 196 ++++++++++++----------- terraform/staging/versions.tf | 2 +- 4 files changed, 204 insertions(+), 192 deletions(-) diff --git a/terraform/production/.terraform.lock.hcl b/terraform/production/.terraform.lock.hcl index 99f5c0e80..24a85f67a 100644 --- a/terraform/production/.terraform.lock.hcl +++ b/terraform/production/.terraform.lock.hcl @@ -45,23 +45,23 @@ provider "registry.terraform.io/fluxcd/flux" { } provider "registry.terraform.io/gitlabhq/gitlab" { - version = "17.6.1" + version = "19.2.1" + constraints = "19.2.1" hashes = [ - "h1:bKnsDu1PpzB3uiSyHGQo+Tfa8TB+aDM2Cbxz3j6YdO8=", - "zh:0cfa09eebd86db00820628db6b714cc2bba12fa2609d4202bf7487a476649a81", - "zh:20926b7157d1eab9f27c459b18bb1277d9d64a1cdc5120ccc200cf41e014138c", - "zh:3c211e04ab79c40369ecb2e1618617eccd6f6908b40c97ee2770f6b5dbba099d", - "zh:41f0445308f68396a811baf083906fccb81fedeb618141c3f85c8ac5b3fabc8a", - "zh:52bb58bda614af54943a63647d785ad47da27a2989fb6a82d9b23ff5dc86e534", - "zh:5f85e99d44ea8359f0d6ce36a5402d23d5d27897a16b019ac07e23e05b6435ce", - "zh:6c387f8621f09049a5768087a029a870a4aa00a924b04f2794c770f2578e7978", - "zh:7c73065e421df8b303f25fb8d7181be7ee0fc0440c770f13b96409be8d9e0f39", - "zh:7e848a539aa63d41567c1b8bf4140d7583a66a1c0bfcaaecf84fea4d1ca5508d", - "zh:81acbed59221bd44144935615045c495dfdf658c0849db111b09acdb92c85d20", - "zh:99e5f796446de91bf7988da4836600778c24f0dd3f9230108f72af85082e7665", - "zh:b65b2e91dce8db63d2d1f19729885e7dd95f1eabcb19a3a73bd481639ea47910", - "zh:bdd32ea764d15087aac1a13d3169f0ea7b16e1eb2d6ea601c3fb2b8c63c537a1", - "zh:ed1a1ea0790b255f4222af6570d2e4c5b946b6cec34ba4a5d478bc98e5047a46", + "h1:Dc2fiVjSBgKMGQ2ALI6cYio644K+X4IDrCIf9jF4ja8=", + "zh:0240c6e58b50340d20f4f080741200043a37bd981f81d9888f84b19a5d049ac2", + "zh:0a3d49d9f1e8aa8e8ff631875bbbf8cadc14f0bdc0f6916056c1683ba3858863", + "zh:11ed6055ac876a3c26b6a3d29fd0de382b382e9abe5000957e76a0b8392e02b1", + "zh:15757db367b391d1baf0f61ecdc06e4d74da3af155cbc01e0b280a1d744d53d8", + "zh:214bc637912b1374e796ff8d76e2e88f598eef1ba663bdb5db563773643a3db8", + "zh:2c815c7b99bdb80d6f71ef0022bd2b6e4c1136ad0c211c9099058cafafdfa5bb", + "zh:5b0f2b42a22798e8dc6379aea0175d0f7a70e51cfb0c4131df15e6a449ab74aa", + "zh:5fa2738968050016cd95f37e2d56a0d2f40e9f1b28ab0dfc8f8548c11891f974", + "zh:6615c576f881845115f371d52cec601b32ee191b00131be77e557df49c4def3a", + "zh:6ef97c08ee31f91e5416485848ebfebeadbec568997978ad9fe579570619ed1c", + "zh:78aa0a3da3b00849772afb493d7eb32f46606a9844fe1115d70d203910330c00", + "zh:c3f9ec03c097d5d3b13ade61d58de17b0fdabe8931a1a5557bc3d9a9a029c054", + "zh:e2c41cc5b22f0c328e36a19747172a7a21f6f16ce1288c47a445f9341101bc7f", "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32", ] } @@ -90,22 +90,23 @@ provider "registry.terraform.io/hashicorp/aws" { } provider "registry.terraform.io/hashicorp/cloudinit" { - version = "2.3.7" + version = "2.4.0" constraints = ">= 2.0.0" hashes = [ - "h1:iZ27qylcH/2bs685LJTKOKcQ+g7cF3VwN3kHMrzm4Ow=", - "zh:06f1c54e919425c3139f8aeb8fcf9bceca7e560d48c9f0c1e3bb0a8ad9d9da1e", - "zh:0e1e4cf6fd98b019e764c28586a386dc136129fef50af8c7165a067e7e4a31d5", - "zh:1871f4337c7c57287d4d67396f633d224b8938708b772abfc664d1f80bd67edd", - "zh:2b9269d91b742a71b2248439d5e9824f0447e6d261bfb86a8a88528609b136d1", - "zh:3d8ae039af21426072c66d6a59a467d51f2d9189b8198616888c1b7fc42addc7", - "zh:3ef4e2db5bcf3e2d915921adced43929214e0946a6fb11793085d9a48995ae01", - "zh:42ae54381147437c83cbb8790cc68935d71b6357728a154109d3220b1beb4dc9", - "zh:4496b362605ae4cbc9ef7995d102351e2fe311897586ffc7a4a262ccca0c782a", - "zh:652a2401257a12706d32842f66dac05a735693abcb3e6517d6b5e2573729ba13", - "zh:7406c30806f5979eaed5f50c548eced2ea18ea121e01801d2f0d4d87a04f6a14", - "zh:7848429fd5a5bcf35f6fee8487df0fb64b09ec071330f3ff240c0343fe2a5224", + "h1:Bx3XQkBSY3RAGwLZb8hyi8AhvahPNlt4mlyZhW9guOI=", + "zh:1b0fe71b8e87a068f7cd9faaa733100ab72ab61ce812b8bd2b8e3e6ea3907b2d", + "zh:2aa9631ad64cfda1eb58f147619b631dadedfaf9453b422aa5ada2d3861183c1", + "zh:2c5f35463bdfb2f87d3576b81e62c30f8109e67bb6f21ffcbc46a855811455c0", + "zh:5970bcad151ea236bd262ada1a5a23bfbc1716f94a4e8b16ab2bcdda91d6a671", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:79a0676909732b6ec0441a733af6383513cde3bd2cef5c1ad0a74131e1286a04", + "zh:818f16141481a1202b3977becd19a12d4d46cd2e3f5753f5d0d0049adacf8f8c", + "zh:948d98716831087e69eca99f91ed7964cc537f3aca279f7494645ee56c9dc4ec", + "zh:a75e78889565a51df3e8e3af207e36e5ddb25e47ce1780a784c82dc3c3109b67", + "zh:a9c6e455d52b1bba5272bd87a35cfabcfd6d903dcbe42e2de926228dbb1e39b2", + "zh:b846805d8c2f5d1d6c2ffeeaf32109d9af7db7fa3c56929bfc1dcfaadf9c8bd8", + "zh:c3e5279756b46c4f49a6f4c81347fbe2fffebb2bf18a5c24664830304a1f6a8e", + "zh:c8be7b31893163d0046b0137a6100533f07e8efd192a1903b6bb4c42be12dceb", ] } @@ -129,100 +130,105 @@ provider "registry.terraform.io/hashicorp/helm" { } provider "registry.terraform.io/hashicorp/http" { - version = "3.5.0" + version = "3.6.1" hashes = [ - "h1:8bUoPwS4hahOvzCBj6b04ObLVFXCEmEN8T/5eOHmWOM=", - "zh:047c5b4920751b13425efe0d011b3a23a3be97d02d9c0e3c60985521c9c456b7", - "zh:157866f700470207561f6d032d344916b82268ecd0cf8174fb11c0674c8d0736", - "zh:1973eb9383b0d83dd4fd5e662f0f16de837d072b64a6b7cd703410d730499476", - "zh:212f833a4e6d020840672f6f88273d62a564f44acb0c857b5961cdb3bbc14c90", - "zh:2c8034bc039fffaa1d4965ca02a8c6d57301e5fa9fff4773e684b46e3f78e76a", - "zh:5df353fc5b2dd31577def9cc1a4ebf0c9a9c2699d223c6b02087a3089c74a1c6", - "zh:672083810d4185076c81b16ad13d1224b9e6ea7f4850951d2ab8d30fa6e41f08", + "h1:i0gHhh36WVucbTkIXA8qtyXnH3BFwT8+MrWEApfKgBg=", + "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", + "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:7b4200f18abdbe39904b03537e1a78f21ebafe60f1c861a44387d314fda69da6", - "zh:843feacacd86baed820f81a6c9f7bd32cf302db3d7a0f39e87976ebc7a7cc2ee", - "zh:a9ea5096ab91aab260b22e4251c05f08dad2ed77e43e5e4fadcdfd87f2c78926", - "zh:d02b288922811739059e90184c7f76d45d07d3a77cc48d0b15fd3db14e928623", + "zh:9c86821e99fcf1c9184087d73dd4940f14d10318d7229694fa61512c1216c279", + "zh:a0e08baf98384f7f20fe9beb2ca1acbbfb8bf71caaa33e49e35b584618648d46", + "zh:aaf767f5bf28a887c9c8f82a58b08275709642306b77c6b82c41c09aaa116390", + "zh:b0d189d11dbea1e2d2a31ee0c5cc215182e0448999bb5c1df0ef0e64e8aa3e74", + "zh:bdde65bcb27ba3f24a5ab7f455245709e8ae3dce2bcd8dbcb208ef4dc7f17a43", + "zh:c998032f00bb0cacc7f87e277f699ea3582ed86aee696a81af2eef8d5963b66b", + "zh:e40143fe7a2e8c4970190c77f82682a140a30de0340f0c8c57291ac22994d217", + "zh:e49ba3ff6244cbb30baa7a0e455d5652e4b650bf2a5459f9e6d349ef4503edeb", + "zh:e4ae6b4af472f90cd08a267f7120ac0f6e95af46486c3031564dd2a065aeda48", + "zh:f832598bbf437ea9d1dcfeeb527ca55c23137c724bb5400ff196a10e3bb3e53b", ] } provider "registry.terraform.io/hashicorp/null" { - version = "3.2.4" + version = "3.3.1" constraints = ">= 3.0.0" hashes = [ - "h1:hkf5w5B6q8e2A42ND2CjAvgvSN3puAosDmOJb3zCVQM=", - "zh:59f6b52ab4ff35739647f9509ee6d93d7c032985d9f8c6237d1f8a59471bbbe2", + "h1:TuxJq10DVnRP7c5HBZPyyvQGcckNVfijyU1eXEu5e4M=", + "zh:08c59776542ea16e5a8545752787b17ff412922182b4cfabe16139197be8ac44", + "zh:123109cc7e5ed6d515787fbc212f2a3fd5e75647bb24ab7c801ccd4d4ed42451", + "zh:14b3fa4372754b54844b41d5dbd4671a292d8d6828b90169061feb4d7b15dd05", + "zh:56a4daaa3212f57b764bf3d1f333141c6610c5f21abb240e0111221f7c7fa4d4", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:795c897119ff082133150121d39ff26cb5f89a730a2c8c26f3a9c1abf81a9c43", - "zh:7b9c7b16f118fbc2b05a983817b8ce2f86df125857966ad356353baf4bff5c0a", - "zh:85e33ab43e0e1726e5f97a874b8e24820b6565ff8076523cc2922ba671492991", - "zh:9d32ac3619cfc93eb3c4f423492a8e0f79db05fec58e449dee9b2d5873d5f69f", - "zh:9e15c3c9dd8e0d1e3731841d44c34571b6c97f5b95e8296a45318b94e5287a6e", - "zh:b4c2ab35d1b7696c30b64bf2c0f3a62329107bd1a9121ce70683dec58af19615", - "zh:c43723e8cc65bcdf5e0c92581dcbbdcbdcf18b8d2037406a5f2033b1e22de442", - "zh:ceb5495d9c31bfb299d246ab333f08c7fb0d67a4f82681fbf47f2a21c3e11ab5", - "zh:e171026b3659305c558d9804062762d168f50ba02b88b231d20ec99578a6233f", - "zh:ed0fe2acdb61330b01841fa790be00ec6beaac91d41f311fb8254f74eb6a711f", + "zh:7e888a026dbacd2474a42264227ae35f639780f0f0c613529d10a95cd61988b3", + "zh:85a53646267e87d600df7124e4767ffde9bba3b6356d45d961618bdd68131cc7", + "zh:8ffa0e9c7c39b2ab0905b472465d6e35ef0b776b3f6273bb34c150340b61bff1", + "zh:9846510a1841530d4403f4818e233f91e3b3bade7441047599fbf800742f65be", + "zh:afa98d44860875f037c6def0a7e6ff208e042712ba771f620482b143cd336891", + "zh:bdca130d9ef27488ae0b13bc8fd8019e8bbdd4f2ceff29da066bd333165d68c5", + "zh:cb3b94cbca88210dd0d1f11e2b8a89333f48c3857faf8f70f589072ce7c28610", + "zh:f0c0ba87925fe32f84b80f7513b1efb1b0866f51f899ba825e95ad59ff09b018", ] } provider "registry.terraform.io/hashicorp/random" { - version = "3.7.2" + version = "3.9.0" constraints = ">= 3.1.0" hashes = [ - "h1:356j/3XnXEKr9nyicLUufzoF4Yr6hRy481KIxRVpK0c=", - "zh:14829603a32e4bc4d05062f059e545a91e27ff033756b48afbae6b3c835f508f", - "zh:1527fb07d9fea400d70e9e6eb4a2b918d5060d604749b6f1c361518e7da546dc", - "zh:1e86bcd7ebec85ba336b423ba1db046aeaa3c0e5f921039b3f1a6fc2f978feab", - "zh:24536dec8bde66753f4b4030b8f3ef43c196d69cccbea1c382d01b222478c7a3", - "zh:29f1786486759fad9b0ce4fdfbbfece9343ad47cd50119045075e05afe49d212", - "zh:4d701e978c2dd8604ba1ce962b047607701e65c078cb22e97171513e9e57491f", + "h1:UlBuNVuCGJ39tTv2c5gz2NRZnQbXfbIWbTzWcth5o74=", + "zh:161ad0bd9a75768c82f53fb6e7172a9d8be2d4889b012645a34795031aaf1bf1", + "zh:19dc9a5b17729725ccfc4f45b0500af0ee5bc6b6b160c7adb8f2bf617d2c80ea", + "zh:269eda8fe42daa7974d5a34d166c3ba9defe80cde86c01e4dadcfdf2e1f05e5f", + "zh:373f7c65566f8f2cc7f45d698654feb9d988996957e1266a69ca00c52d6d16d0", + "zh:5599d16804c41c83009ec621b6d6b6f74e102f5827678a4750f8809055546b61", + "zh:583be0440469a22bff70dcfa56593b01566860b29607437264adb51060cf46fc", + "zh:5f211d8ec3f2e1f414870d9584bfe26e6995560ef81c748f8447a48164767398", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:7b8434212eef0f8c83f5a90c6d76feaf850f6502b61b53c329e85b3b281cba34", - "zh:ac8a23c212258b7976e1621275e3af7099e7e4a3d4478cf8d5d2a27f3bc3e967", - "zh:b516ca74431f3df4c6cf90ddcdb4042c626e026317a33c53f0b445a3d93b720d", - "zh:dc76e4326aec2490c1600d6871a95e78f9050f9ce427c71707ea412a2f2f1a62", - "zh:eac7b63e86c749c7d48f527671c7aee5b4e26c10be6ad7232d6860167f99dbb0", + "zh:7b547fd16216761ef86efc3ed516ac5ac0c5c42b7c7eb24a08cef2d93f69ed5e", + "zh:7e7c0679daf2a382151d05068c8c3f0dae6b7b7dccf818827b73dd08638df2ef", + "zh:8089dec888a8038b9b4fb23b3df7e1057293dbc5b60b42cc47ff690d69d4b61b", + "zh:c51f15a031edfd6f23ce8ced3446ca7f8d8d647e2499890d7d5d10d5016d7257", + "zh:c94784f005708890dc6895afd53636ec00ec1e430b15d41e5aebfb1d4b39bd04", ] } provider "registry.terraform.io/hashicorp/time" { - version = "0.13.1" + version = "0.14.1" constraints = ">= 0.9.0" hashes = [ - "h1:+W+DMrVoVnoXo3f3M4W+OpZbkCrUn6PnqDF33D2Cuf0=", - "zh:02cb9aab1002f0f2a94a4f85acec8893297dc75915f7404c165983f720a54b74", - "zh:04429b2b31a492d19e5ecf999b116d396dac0b24bba0d0fb19ecaefe193fdb8f", - "zh:26f8e51bb7c275c404ba6028c1b530312066009194db721a8427a7bc5cdbc83a", - "zh:772ff8dbdbef968651ab3ae76d04afd355c32f8a868d03244db3f8496e462690", + "h1:GJig5pIwiKDsiF73KLs7vWvDs76/x6DeNSxKrfqlA40=", + "zh:0837ca5b057e5cff94dff7de2fcccafb4abaa33c45de193fe2853e684818a267", + "zh:15a122f72d9e0f34fc5384cc7ec089319641fee5c319748a3aa02fc42f459969", + "zh:342fb83093a280ea7ee0654feae1f5867c62eb8eebc1ab46f9a7ab0b4c878a62", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:898db5d2b6bd6ca5457dccb52eedbc7c5b1a71e4a4658381bcbb38cedbbda328", - "zh:8de913bf09a3fa7bedc29fec18c47c571d0c7a3d0644322c46f3aa648cf30cd8", - "zh:9402102c86a87bdfe7e501ffbb9c685c32bbcefcfcf897fd7d53df414c36877b", - "zh:b18b9bb1726bb8cfbefc0a29cf3657c82578001f514bcf4c079839b6776c47f0", - "zh:b9d31fdc4faecb909d7c5ce41d2479dd0536862a963df434be4b16e8e4edc94d", - "zh:c951e9f39cca3446c060bd63933ebb89cedde9523904813973fbc3d11863ba75", - "zh:e5b773c0d07e962291be0e9b413c7a22c044b8c7b58c76e8aa91d1659990dfb5", + "zh:99f169834d3370b8341381c6a9c7a8b01fb26027531faa38e6fb49cc23916f68", + "zh:9f482917c7a28cf2436578be7aa9f04f8c811aba8b5949e0223ea987a2757a91", + "zh:ac6b5b8732826f2d1129a8a4a038ac7a7a9ca7b77d2a4608e5703be1a1e2bff0", + "zh:c54782a27d58ce04f6696c6fc0b2cf1e2fba6bed239fb520521a7bce7d7193cb", + "zh:c8d0ddc8f575ecb44f025d54edbfe118e26397fe328a67be62325766f31eb6e7", + "zh:d043b96f204edd2353bf6b2a34e645ffdee2e9634d9bb747331320444810a538", + "zh:e32c288501ca9a6c9d22b52e839dd391fc7083d54ee6b8dc296ce0e6bd3e57ef", + "zh:e47fcc7bb4e9ab5cc522c3b06e4fa9c0bf94b84be8210bc6b1655c44acb2addc", + "zh:f61bf218322bcbe0bd2d56bba738e7fa485e9b54244e13aa12de741b37d450c0", ] } provider "registry.terraform.io/hashicorp/tls" { - version = "4.1.0" - constraints = ">= 3.0.0" + version = "4.3.0" + constraints = ">= 4.0.0" hashes = [ - "h1:Ka8mEwRFXBabR33iN/WTIEW6RP0z13vFsDlwn11Pf2I=", - "zh:14c35d89307988c835a7f8e26f1b83ce771e5f9b41e407f86a644c0152089ac2", - "zh:2fb9fe7a8b5afdbd3e903acb6776ef1be3f2e587fb236a8c60f11a9fa165faa8", - "zh:35808142ef850c0c60dd93dc06b95c747720ed2c40c89031781165f0c2baa2fc", - "zh:35b5dc95bc75f0b3b9c5ce54d4d7600c1ebc96fbb8dfca174536e8bf103c8cdc", - "zh:38aa27c6a6c98f1712aa5cc30011884dc4b128b4073a4a27883374bfa3ec9fac", - "zh:51fb247e3a2e88f0047cb97bb9df7c228254a3b3021c5534e4563b4007e6f882", - "zh:62b981ce491e38d892ba6364d1d0cdaadcee37cc218590e07b310b1dfa34be2d", - "zh:bc8e47efc611924a79f947ce072a9ad698f311d4a60d0b4dfff6758c912b7298", - "zh:c149508bd131765d1bc085c75a870abb314ff5a6d7f5ac1035a8892d686b6297", - "zh:d38d40783503d278b63858978d40e07ac48123a2925e1a6b47e62179c046f87a", + "h1:j/BqLS2N2AScZyotd9nZpHdieJ7e5S8y+A+ZfIu8kL8=", + "zh:0ab58d6f8991d436c7d2dbd89ed814709b949b07ac5a54ee53b0aec1fa772a8b", + "zh:60b347abcb56f45d97c56f14d895069cd15a83993f199777f571b79fea3642ee", + "zh:6889be32640349230de3f23856e6f04e0e9ced4a84a27d3f552fa54684448218", + "zh:73f8e1ecf7135033165fb14b7e8bf4d656f3ce13065ec35762ea0481975328c7", + "zh:94ce25ee253eca0b42cae9c856b36bca8103b6453012d1b279c3623c805f2d42", + "zh:96bc6de9fd67bc446fd11257872e1ffb1029a996ed1d65a3f6b43f6d408ad9ab", + "zh:97c609a310a51bfd504d704e036d72064a84bf0bdb36cc08cd4cc66098212b41", + "zh:a12c16e94533c5bd123f75032576b9dc91dd5d5ccd5f7cf331d0f2e1adc55cf8", + "zh:c4f014f876adf7af57188795050bda5b0029d8c7d7773031102b6c36dcf1fc21", + "zh:d9b0a21583aaa3df3a95394fb949a3c515ff71c2ff5a1fc4a73d364aa90bfca5", + "zh:da510d22f0c6d71ad19a76406f106b782448f512375787ecfabb338ed1e311a7", + "zh:f0e9447a9ce3a24cdaa113089e65663c836d8b9bfdb915a1c0284e0112cab5c0", "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", - "zh:fb07f708e3316615f6d218cec198504984c0ce7000b9f1eebff7516e384f4b54", ] } diff --git a/terraform/production/versions.tf b/terraform/production/versions.tf index fd43eca08..5382d871c 100644 --- a/terraform/production/versions.tf +++ b/terraform/production/versions.tf @@ -20,7 +20,7 @@ terraform { } gitlab = { source = "gitlabhq/gitlab" - version = "17.6.1" + version = "19.2.1" } } diff --git a/terraform/staging/.terraform.lock.hcl b/terraform/staging/.terraform.lock.hcl index 1988ce633..57c98cbb8 100644 --- a/terraform/staging/.terraform.lock.hcl +++ b/terraform/staging/.terraform.lock.hcl @@ -45,23 +45,23 @@ provider "registry.terraform.io/fluxcd/flux" { } provider "registry.terraform.io/gitlabhq/gitlab" { - version = "17.6.1" + version = "19.2.1" + constraints = "19.2.1" hashes = [ - "h1:bKnsDu1PpzB3uiSyHGQo+Tfa8TB+aDM2Cbxz3j6YdO8=", - "zh:0cfa09eebd86db00820628db6b714cc2bba12fa2609d4202bf7487a476649a81", - "zh:20926b7157d1eab9f27c459b18bb1277d9d64a1cdc5120ccc200cf41e014138c", - "zh:3c211e04ab79c40369ecb2e1618617eccd6f6908b40c97ee2770f6b5dbba099d", - "zh:41f0445308f68396a811baf083906fccb81fedeb618141c3f85c8ac5b3fabc8a", - "zh:52bb58bda614af54943a63647d785ad47da27a2989fb6a82d9b23ff5dc86e534", - "zh:5f85e99d44ea8359f0d6ce36a5402d23d5d27897a16b019ac07e23e05b6435ce", - "zh:6c387f8621f09049a5768087a029a870a4aa00a924b04f2794c770f2578e7978", - "zh:7c73065e421df8b303f25fb8d7181be7ee0fc0440c770f13b96409be8d9e0f39", - "zh:7e848a539aa63d41567c1b8bf4140d7583a66a1c0bfcaaecf84fea4d1ca5508d", - "zh:81acbed59221bd44144935615045c495dfdf658c0849db111b09acdb92c85d20", - "zh:99e5f796446de91bf7988da4836600778c24f0dd3f9230108f72af85082e7665", - "zh:b65b2e91dce8db63d2d1f19729885e7dd95f1eabcb19a3a73bd481639ea47910", - "zh:bdd32ea764d15087aac1a13d3169f0ea7b16e1eb2d6ea601c3fb2b8c63c537a1", - "zh:ed1a1ea0790b255f4222af6570d2e4c5b946b6cec34ba4a5d478bc98e5047a46", + "h1:Dc2fiVjSBgKMGQ2ALI6cYio644K+X4IDrCIf9jF4ja8=", + "zh:0240c6e58b50340d20f4f080741200043a37bd981f81d9888f84b19a5d049ac2", + "zh:0a3d49d9f1e8aa8e8ff631875bbbf8cadc14f0bdc0f6916056c1683ba3858863", + "zh:11ed6055ac876a3c26b6a3d29fd0de382b382e9abe5000957e76a0b8392e02b1", + "zh:15757db367b391d1baf0f61ecdc06e4d74da3af155cbc01e0b280a1d744d53d8", + "zh:214bc637912b1374e796ff8d76e2e88f598eef1ba663bdb5db563773643a3db8", + "zh:2c815c7b99bdb80d6f71ef0022bd2b6e4c1136ad0c211c9099058cafafdfa5bb", + "zh:5b0f2b42a22798e8dc6379aea0175d0f7a70e51cfb0c4131df15e6a449ab74aa", + "zh:5fa2738968050016cd95f37e2d56a0d2f40e9f1b28ab0dfc8f8548c11891f974", + "zh:6615c576f881845115f371d52cec601b32ee191b00131be77e557df49c4def3a", + "zh:6ef97c08ee31f91e5416485848ebfebeadbec568997978ad9fe579570619ed1c", + "zh:78aa0a3da3b00849772afb493d7eb32f46606a9844fe1115d70d203910330c00", + "zh:c3f9ec03c097d5d3b13ade61d58de17b0fdabe8931a1a5557bc3d9a9a029c054", + "zh:e2c41cc5b22f0c328e36a19747172a7a21f6f16ce1288c47a445f9341101bc7f", "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32", ] } @@ -90,22 +90,23 @@ provider "registry.terraform.io/hashicorp/aws" { } provider "registry.terraform.io/hashicorp/cloudinit" { - version = "2.3.7" + version = "2.4.0" constraints = ">= 2.0.0" hashes = [ - "h1:iZ27qylcH/2bs685LJTKOKcQ+g7cF3VwN3kHMrzm4Ow=", - "zh:06f1c54e919425c3139f8aeb8fcf9bceca7e560d48c9f0c1e3bb0a8ad9d9da1e", - "zh:0e1e4cf6fd98b019e764c28586a386dc136129fef50af8c7165a067e7e4a31d5", - "zh:1871f4337c7c57287d4d67396f633d224b8938708b772abfc664d1f80bd67edd", - "zh:2b9269d91b742a71b2248439d5e9824f0447e6d261bfb86a8a88528609b136d1", - "zh:3d8ae039af21426072c66d6a59a467d51f2d9189b8198616888c1b7fc42addc7", - "zh:3ef4e2db5bcf3e2d915921adced43929214e0946a6fb11793085d9a48995ae01", - "zh:42ae54381147437c83cbb8790cc68935d71b6357728a154109d3220b1beb4dc9", - "zh:4496b362605ae4cbc9ef7995d102351e2fe311897586ffc7a4a262ccca0c782a", - "zh:652a2401257a12706d32842f66dac05a735693abcb3e6517d6b5e2573729ba13", - "zh:7406c30806f5979eaed5f50c548eced2ea18ea121e01801d2f0d4d87a04f6a14", - "zh:7848429fd5a5bcf35f6fee8487df0fb64b09ec071330f3ff240c0343fe2a5224", + "h1:Bx3XQkBSY3RAGwLZb8hyi8AhvahPNlt4mlyZhW9guOI=", + "zh:1b0fe71b8e87a068f7cd9faaa733100ab72ab61ce812b8bd2b8e3e6ea3907b2d", + "zh:2aa9631ad64cfda1eb58f147619b631dadedfaf9453b422aa5ada2d3861183c1", + "zh:2c5f35463bdfb2f87d3576b81e62c30f8109e67bb6f21ffcbc46a855811455c0", + "zh:5970bcad151ea236bd262ada1a5a23bfbc1716f94a4e8b16ab2bcdda91d6a671", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:79a0676909732b6ec0441a733af6383513cde3bd2cef5c1ad0a74131e1286a04", + "zh:818f16141481a1202b3977becd19a12d4d46cd2e3f5753f5d0d0049adacf8f8c", + "zh:948d98716831087e69eca99f91ed7964cc537f3aca279f7494645ee56c9dc4ec", + "zh:a75e78889565a51df3e8e3af207e36e5ddb25e47ce1780a784c82dc3c3109b67", + "zh:a9c6e455d52b1bba5272bd87a35cfabcfd6d903dcbe42e2de926228dbb1e39b2", + "zh:b846805d8c2f5d1d6c2ffeeaf32109d9af7db7fa3c56929bfc1dcfaadf9c8bd8", + "zh:c3e5279756b46c4f49a6f4c81347fbe2fffebb2bf18a5c24664830304a1f6a8e", + "zh:c8be7b31893163d0046b0137a6100533f07e8efd192a1903b6bb4c42be12dceb", ] } @@ -129,100 +130,105 @@ provider "registry.terraform.io/hashicorp/helm" { } provider "registry.terraform.io/hashicorp/http" { - version = "3.5.0" + version = "3.6.1" hashes = [ - "h1:8bUoPwS4hahOvzCBj6b04ObLVFXCEmEN8T/5eOHmWOM=", - "zh:047c5b4920751b13425efe0d011b3a23a3be97d02d9c0e3c60985521c9c456b7", - "zh:157866f700470207561f6d032d344916b82268ecd0cf8174fb11c0674c8d0736", - "zh:1973eb9383b0d83dd4fd5e662f0f16de837d072b64a6b7cd703410d730499476", - "zh:212f833a4e6d020840672f6f88273d62a564f44acb0c857b5961cdb3bbc14c90", - "zh:2c8034bc039fffaa1d4965ca02a8c6d57301e5fa9fff4773e684b46e3f78e76a", - "zh:5df353fc5b2dd31577def9cc1a4ebf0c9a9c2699d223c6b02087a3089c74a1c6", - "zh:672083810d4185076c81b16ad13d1224b9e6ea7f4850951d2ab8d30fa6e41f08", + "h1:i0gHhh36WVucbTkIXA8qtyXnH3BFwT8+MrWEApfKgBg=", + "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", + "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:7b4200f18abdbe39904b03537e1a78f21ebafe60f1c861a44387d314fda69da6", - "zh:843feacacd86baed820f81a6c9f7bd32cf302db3d7a0f39e87976ebc7a7cc2ee", - "zh:a9ea5096ab91aab260b22e4251c05f08dad2ed77e43e5e4fadcdfd87f2c78926", - "zh:d02b288922811739059e90184c7f76d45d07d3a77cc48d0b15fd3db14e928623", + "zh:9c86821e99fcf1c9184087d73dd4940f14d10318d7229694fa61512c1216c279", + "zh:a0e08baf98384f7f20fe9beb2ca1acbbfb8bf71caaa33e49e35b584618648d46", + "zh:aaf767f5bf28a887c9c8f82a58b08275709642306b77c6b82c41c09aaa116390", + "zh:b0d189d11dbea1e2d2a31ee0c5cc215182e0448999bb5c1df0ef0e64e8aa3e74", + "zh:bdde65bcb27ba3f24a5ab7f455245709e8ae3dce2bcd8dbcb208ef4dc7f17a43", + "zh:c998032f00bb0cacc7f87e277f699ea3582ed86aee696a81af2eef8d5963b66b", + "zh:e40143fe7a2e8c4970190c77f82682a140a30de0340f0c8c57291ac22994d217", + "zh:e49ba3ff6244cbb30baa7a0e455d5652e4b650bf2a5459f9e6d349ef4503edeb", + "zh:e4ae6b4af472f90cd08a267f7120ac0f6e95af46486c3031564dd2a065aeda48", + "zh:f832598bbf437ea9d1dcfeeb527ca55c23137c724bb5400ff196a10e3bb3e53b", ] } provider "registry.terraform.io/hashicorp/null" { - version = "3.2.4" + version = "3.3.1" constraints = ">= 3.0.0" hashes = [ - "h1:hkf5w5B6q8e2A42ND2CjAvgvSN3puAosDmOJb3zCVQM=", - "zh:59f6b52ab4ff35739647f9509ee6d93d7c032985d9f8c6237d1f8a59471bbbe2", + "h1:TuxJq10DVnRP7c5HBZPyyvQGcckNVfijyU1eXEu5e4M=", + "zh:08c59776542ea16e5a8545752787b17ff412922182b4cfabe16139197be8ac44", + "zh:123109cc7e5ed6d515787fbc212f2a3fd5e75647bb24ab7c801ccd4d4ed42451", + "zh:14b3fa4372754b54844b41d5dbd4671a292d8d6828b90169061feb4d7b15dd05", + "zh:56a4daaa3212f57b764bf3d1f333141c6610c5f21abb240e0111221f7c7fa4d4", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:795c897119ff082133150121d39ff26cb5f89a730a2c8c26f3a9c1abf81a9c43", - "zh:7b9c7b16f118fbc2b05a983817b8ce2f86df125857966ad356353baf4bff5c0a", - "zh:85e33ab43e0e1726e5f97a874b8e24820b6565ff8076523cc2922ba671492991", - "zh:9d32ac3619cfc93eb3c4f423492a8e0f79db05fec58e449dee9b2d5873d5f69f", - "zh:9e15c3c9dd8e0d1e3731841d44c34571b6c97f5b95e8296a45318b94e5287a6e", - "zh:b4c2ab35d1b7696c30b64bf2c0f3a62329107bd1a9121ce70683dec58af19615", - "zh:c43723e8cc65bcdf5e0c92581dcbbdcbdcf18b8d2037406a5f2033b1e22de442", - "zh:ceb5495d9c31bfb299d246ab333f08c7fb0d67a4f82681fbf47f2a21c3e11ab5", - "zh:e171026b3659305c558d9804062762d168f50ba02b88b231d20ec99578a6233f", - "zh:ed0fe2acdb61330b01841fa790be00ec6beaac91d41f311fb8254f74eb6a711f", + "zh:7e888a026dbacd2474a42264227ae35f639780f0f0c613529d10a95cd61988b3", + "zh:85a53646267e87d600df7124e4767ffde9bba3b6356d45d961618bdd68131cc7", + "zh:8ffa0e9c7c39b2ab0905b472465d6e35ef0b776b3f6273bb34c150340b61bff1", + "zh:9846510a1841530d4403f4818e233f91e3b3bade7441047599fbf800742f65be", + "zh:afa98d44860875f037c6def0a7e6ff208e042712ba771f620482b143cd336891", + "zh:bdca130d9ef27488ae0b13bc8fd8019e8bbdd4f2ceff29da066bd333165d68c5", + "zh:cb3b94cbca88210dd0d1f11e2b8a89333f48c3857faf8f70f589072ce7c28610", + "zh:f0c0ba87925fe32f84b80f7513b1efb1b0866f51f899ba825e95ad59ff09b018", ] } provider "registry.terraform.io/hashicorp/random" { - version = "3.7.2" + version = "3.9.0" constraints = ">= 3.1.0" hashes = [ - "h1:356j/3XnXEKr9nyicLUufzoF4Yr6hRy481KIxRVpK0c=", - "zh:14829603a32e4bc4d05062f059e545a91e27ff033756b48afbae6b3c835f508f", - "zh:1527fb07d9fea400d70e9e6eb4a2b918d5060d604749b6f1c361518e7da546dc", - "zh:1e86bcd7ebec85ba336b423ba1db046aeaa3c0e5f921039b3f1a6fc2f978feab", - "zh:24536dec8bde66753f4b4030b8f3ef43c196d69cccbea1c382d01b222478c7a3", - "zh:29f1786486759fad9b0ce4fdfbbfece9343ad47cd50119045075e05afe49d212", - "zh:4d701e978c2dd8604ba1ce962b047607701e65c078cb22e97171513e9e57491f", + "h1:UlBuNVuCGJ39tTv2c5gz2NRZnQbXfbIWbTzWcth5o74=", + "zh:161ad0bd9a75768c82f53fb6e7172a9d8be2d4889b012645a34795031aaf1bf1", + "zh:19dc9a5b17729725ccfc4f45b0500af0ee5bc6b6b160c7adb8f2bf617d2c80ea", + "zh:269eda8fe42daa7974d5a34d166c3ba9defe80cde86c01e4dadcfdf2e1f05e5f", + "zh:373f7c65566f8f2cc7f45d698654feb9d988996957e1266a69ca00c52d6d16d0", + "zh:5599d16804c41c83009ec621b6d6b6f74e102f5827678a4750f8809055546b61", + "zh:583be0440469a22bff70dcfa56593b01566860b29607437264adb51060cf46fc", + "zh:5f211d8ec3f2e1f414870d9584bfe26e6995560ef81c748f8447a48164767398", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:7b8434212eef0f8c83f5a90c6d76feaf850f6502b61b53c329e85b3b281cba34", - "zh:ac8a23c212258b7976e1621275e3af7099e7e4a3d4478cf8d5d2a27f3bc3e967", - "zh:b516ca74431f3df4c6cf90ddcdb4042c626e026317a33c53f0b445a3d93b720d", - "zh:dc76e4326aec2490c1600d6871a95e78f9050f9ce427c71707ea412a2f2f1a62", - "zh:eac7b63e86c749c7d48f527671c7aee5b4e26c10be6ad7232d6860167f99dbb0", + "zh:7b547fd16216761ef86efc3ed516ac5ac0c5c42b7c7eb24a08cef2d93f69ed5e", + "zh:7e7c0679daf2a382151d05068c8c3f0dae6b7b7dccf818827b73dd08638df2ef", + "zh:8089dec888a8038b9b4fb23b3df7e1057293dbc5b60b42cc47ff690d69d4b61b", + "zh:c51f15a031edfd6f23ce8ced3446ca7f8d8d647e2499890d7d5d10d5016d7257", + "zh:c94784f005708890dc6895afd53636ec00ec1e430b15d41e5aebfb1d4b39bd04", ] } provider "registry.terraform.io/hashicorp/time" { - version = "0.13.1" + version = "0.14.1" constraints = ">= 0.9.0" hashes = [ - "h1:+W+DMrVoVnoXo3f3M4W+OpZbkCrUn6PnqDF33D2Cuf0=", - "zh:02cb9aab1002f0f2a94a4f85acec8893297dc75915f7404c165983f720a54b74", - "zh:04429b2b31a492d19e5ecf999b116d396dac0b24bba0d0fb19ecaefe193fdb8f", - "zh:26f8e51bb7c275c404ba6028c1b530312066009194db721a8427a7bc5cdbc83a", - "zh:772ff8dbdbef968651ab3ae76d04afd355c32f8a868d03244db3f8496e462690", + "h1:GJig5pIwiKDsiF73KLs7vWvDs76/x6DeNSxKrfqlA40=", + "zh:0837ca5b057e5cff94dff7de2fcccafb4abaa33c45de193fe2853e684818a267", + "zh:15a122f72d9e0f34fc5384cc7ec089319641fee5c319748a3aa02fc42f459969", + "zh:342fb83093a280ea7ee0654feae1f5867c62eb8eebc1ab46f9a7ab0b4c878a62", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:898db5d2b6bd6ca5457dccb52eedbc7c5b1a71e4a4658381bcbb38cedbbda328", - "zh:8de913bf09a3fa7bedc29fec18c47c571d0c7a3d0644322c46f3aa648cf30cd8", - "zh:9402102c86a87bdfe7e501ffbb9c685c32bbcefcfcf897fd7d53df414c36877b", - "zh:b18b9bb1726bb8cfbefc0a29cf3657c82578001f514bcf4c079839b6776c47f0", - "zh:b9d31fdc4faecb909d7c5ce41d2479dd0536862a963df434be4b16e8e4edc94d", - "zh:c951e9f39cca3446c060bd63933ebb89cedde9523904813973fbc3d11863ba75", - "zh:e5b773c0d07e962291be0e9b413c7a22c044b8c7b58c76e8aa91d1659990dfb5", + "zh:99f169834d3370b8341381c6a9c7a8b01fb26027531faa38e6fb49cc23916f68", + "zh:9f482917c7a28cf2436578be7aa9f04f8c811aba8b5949e0223ea987a2757a91", + "zh:ac6b5b8732826f2d1129a8a4a038ac7a7a9ca7b77d2a4608e5703be1a1e2bff0", + "zh:c54782a27d58ce04f6696c6fc0b2cf1e2fba6bed239fb520521a7bce7d7193cb", + "zh:c8d0ddc8f575ecb44f025d54edbfe118e26397fe328a67be62325766f31eb6e7", + "zh:d043b96f204edd2353bf6b2a34e645ffdee2e9634d9bb747331320444810a538", + "zh:e32c288501ca9a6c9d22b52e839dd391fc7083d54ee6b8dc296ce0e6bd3e57ef", + "zh:e47fcc7bb4e9ab5cc522c3b06e4fa9c0bf94b84be8210bc6b1655c44acb2addc", + "zh:f61bf218322bcbe0bd2d56bba738e7fa485e9b54244e13aa12de741b37d450c0", ] } provider "registry.terraform.io/hashicorp/tls" { - version = "4.1.0" - constraints = ">= 3.0.0" + version = "4.3.0" + constraints = ">= 4.0.0" hashes = [ - "h1:Ka8mEwRFXBabR33iN/WTIEW6RP0z13vFsDlwn11Pf2I=", - "zh:14c35d89307988c835a7f8e26f1b83ce771e5f9b41e407f86a644c0152089ac2", - "zh:2fb9fe7a8b5afdbd3e903acb6776ef1be3f2e587fb236a8c60f11a9fa165faa8", - "zh:35808142ef850c0c60dd93dc06b95c747720ed2c40c89031781165f0c2baa2fc", - "zh:35b5dc95bc75f0b3b9c5ce54d4d7600c1ebc96fbb8dfca174536e8bf103c8cdc", - "zh:38aa27c6a6c98f1712aa5cc30011884dc4b128b4073a4a27883374bfa3ec9fac", - "zh:51fb247e3a2e88f0047cb97bb9df7c228254a3b3021c5534e4563b4007e6f882", - "zh:62b981ce491e38d892ba6364d1d0cdaadcee37cc218590e07b310b1dfa34be2d", - "zh:bc8e47efc611924a79f947ce072a9ad698f311d4a60d0b4dfff6758c912b7298", - "zh:c149508bd131765d1bc085c75a870abb314ff5a6d7f5ac1035a8892d686b6297", - "zh:d38d40783503d278b63858978d40e07ac48123a2925e1a6b47e62179c046f87a", + "h1:j/BqLS2N2AScZyotd9nZpHdieJ7e5S8y+A+ZfIu8kL8=", + "zh:0ab58d6f8991d436c7d2dbd89ed814709b949b07ac5a54ee53b0aec1fa772a8b", + "zh:60b347abcb56f45d97c56f14d895069cd15a83993f199777f571b79fea3642ee", + "zh:6889be32640349230de3f23856e6f04e0e9ced4a84a27d3f552fa54684448218", + "zh:73f8e1ecf7135033165fb14b7e8bf4d656f3ce13065ec35762ea0481975328c7", + "zh:94ce25ee253eca0b42cae9c856b36bca8103b6453012d1b279c3623c805f2d42", + "zh:96bc6de9fd67bc446fd11257872e1ffb1029a996ed1d65a3f6b43f6d408ad9ab", + "zh:97c609a310a51bfd504d704e036d72064a84bf0bdb36cc08cd4cc66098212b41", + "zh:a12c16e94533c5bd123f75032576b9dc91dd5d5ccd5f7cf331d0f2e1adc55cf8", + "zh:c4f014f876adf7af57188795050bda5b0029d8c7d7773031102b6c36dcf1fc21", + "zh:d9b0a21583aaa3df3a95394fb949a3c515ff71c2ff5a1fc4a73d364aa90bfca5", + "zh:da510d22f0c6d71ad19a76406f106b782448f512375787ecfabb338ed1e311a7", + "zh:f0e9447a9ce3a24cdaa113089e65663c836d8b9bfdb915a1c0284e0112cab5c0", "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", - "zh:fb07f708e3316615f6d218cec198504984c0ce7000b9f1eebff7516e384f4b54", ] } diff --git a/terraform/staging/versions.tf b/terraform/staging/versions.tf index d017269aa..d5d233447 100644 --- a/terraform/staging/versions.tf +++ b/terraform/staging/versions.tf @@ -20,7 +20,7 @@ terraform { } gitlab = { source = "gitlabhq/gitlab" - version = "17.6.1" + version = "19.2.1" } } From 9844d39e57ec53817ee3e75128d96050a2d794da Mon Sep 17 00:00:00 2001 From: Jacob Nesbitt Date: Wed, 26 Aug 2026 11:51:55 -0400 Subject: [PATCH 4/7] Upgrade gitlab provider to 19.3.0 --- terraform/modules/spack_gitlab/gitlab.tf | 22 +++++++++------- terraform/production/.terraform.lock.hcl | 32 ++++++++++++------------ terraform/production/versions.tf | 2 +- terraform/staging/.terraform.lock.hcl | 32 ++++++++++++------------ terraform/staging/versions.tf | 2 +- 5 files changed, 47 insertions(+), 43 deletions(-) diff --git a/terraform/modules/spack_gitlab/gitlab.tf b/terraform/modules/spack_gitlab/gitlab.tf index 08f8a77dc..35e2185e6 100644 --- a/terraform/modules/spack_gitlab/gitlab.tf +++ b/terraform/modules/spack_gitlab/gitlab.tf @@ -23,16 +23,20 @@ resource "gitlab_project" "spack_packages" { visibility_level = "public" default_branch = "develop" ci_config_path = ".ci/gitlab/.gitlab-ci.yml" +} + +# On staging, keep the protected branches (develop, releases/v*) in sync with GitHub. +# Production does this with the gh-gl-sync CronJob instead. Staging has no +# such job. +# Restricted to protected branches so that pulls never touch testing-branch, +# and with build triggers off so that a sync of thousands of upstream commits +# doesn't kick off a protected-branch pipeline. +resource "gitlab_project_pull_mirror" "github_spack_packages" { + count = var.deployment_name != "prod" ? 1 : 0 - # On staging, keep the protected branches (develop, releases/v*) in sync with GitHub. - # Production does this with the gh-gl-sync CronJob instead. Staging has no - # such job. - # Restricted to protected branches so that pulls never touch testing-branch, - # and with build triggers off so that a sync of thousands of upstream commits - # doesn't kick off a protected-branch pipeline. - import_url = var.deployment_name == "prod" ? "" : "https://github.com/spack/spack-packages.git" - mirror = var.deployment_name == "prod" ? false : true - only_mirror_protected_branches = var.deployment_name == "prod" ? false : true + project = gitlab_project.spack_packages.id + url = "https://github.com/spack/spack-packages.git" + only_mirror_protected_branches = true mirror_trigger_builds = false } diff --git a/terraform/production/.terraform.lock.hcl b/terraform/production/.terraform.lock.hcl index 24a85f67a..4b150e604 100644 --- a/terraform/production/.terraform.lock.hcl +++ b/terraform/production/.terraform.lock.hcl @@ -45,23 +45,23 @@ provider "registry.terraform.io/fluxcd/flux" { } provider "registry.terraform.io/gitlabhq/gitlab" { - version = "19.2.1" - constraints = "19.2.1" + version = "19.3.0" + constraints = "19.3.0" hashes = [ - "h1:Dc2fiVjSBgKMGQ2ALI6cYio644K+X4IDrCIf9jF4ja8=", - "zh:0240c6e58b50340d20f4f080741200043a37bd981f81d9888f84b19a5d049ac2", - "zh:0a3d49d9f1e8aa8e8ff631875bbbf8cadc14f0bdc0f6916056c1683ba3858863", - "zh:11ed6055ac876a3c26b6a3d29fd0de382b382e9abe5000957e76a0b8392e02b1", - "zh:15757db367b391d1baf0f61ecdc06e4d74da3af155cbc01e0b280a1d744d53d8", - "zh:214bc637912b1374e796ff8d76e2e88f598eef1ba663bdb5db563773643a3db8", - "zh:2c815c7b99bdb80d6f71ef0022bd2b6e4c1136ad0c211c9099058cafafdfa5bb", - "zh:5b0f2b42a22798e8dc6379aea0175d0f7a70e51cfb0c4131df15e6a449ab74aa", - "zh:5fa2738968050016cd95f37e2d56a0d2f40e9f1b28ab0dfc8f8548c11891f974", - "zh:6615c576f881845115f371d52cec601b32ee191b00131be77e557df49c4def3a", - "zh:6ef97c08ee31f91e5416485848ebfebeadbec568997978ad9fe579570619ed1c", - "zh:78aa0a3da3b00849772afb493d7eb32f46606a9844fe1115d70d203910330c00", - "zh:c3f9ec03c097d5d3b13ade61d58de17b0fdabe8931a1a5557bc3d9a9a029c054", - "zh:e2c41cc5b22f0c328e36a19747172a7a21f6f16ce1288c47a445f9341101bc7f", + "h1:Qnf+vva+ZYc9BexTvLfJffeSymX2d/KZ0E6U91DcagY=", + "zh:0f4a5c63b67b961c028966a69db1c3837d993c2b016a0f36fe4f3d29206b9fca", + "zh:15f6a11066615e6427e082566b8db3c5bbbc6b9320c37883de43cb6014fc344b", + "zh:3202e0811a26a7f06a4d7d7debd2f4bed8814ccfcd690b25ac62889869e077bb", + "zh:373dd742ce43f3f17f3c705f9ba493b797203531b7e1885e03938526995ddfe8", + "zh:43d35660642229e67800f6485be5ed1e1cd2468d156dad5d340b3fe77984afc9", + "zh:4b7ee081c7c3bf3d54ea8028f196b17aecfa3cfeabcac1f05c41721303f5e874", + "zh:4dd581d9f6e10ee1c65050c84a6dec5292da9eda6ffb1cea53c15e8f192b4fcf", + "zh:5662eb79f82266d5f6578685136f0e4f325ff66e3c1cbf9dea5407d2ea5fb630", + "zh:5a31593b1f093b19979bfa8c835701f47d3040eec3c458740b09b9bfbe496405", + "zh:7e49897c85e5d3c979b1d678d12c36730e39a6b0aee9df46ecf1e7bc4d504d40", + "zh:89470f411e9aa936c36f4463f323aaeb1eaf7471685252433e3261fa53644537", + "zh:96c1480f8c6eb0291316364c0787aaac9f297a3a736fe4e7dd54d58c05b1fd4a", + "zh:ea2834578fe9f335a02563e302e9b9dcf5809fe7d08ea1b8f736b76da6bcde99", "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32", ] } diff --git a/terraform/production/versions.tf b/terraform/production/versions.tf index 5382d871c..f1882feae 100644 --- a/terraform/production/versions.tf +++ b/terraform/production/versions.tf @@ -20,7 +20,7 @@ terraform { } gitlab = { source = "gitlabhq/gitlab" - version = "19.2.1" + version = "19.3.0" } } diff --git a/terraform/staging/.terraform.lock.hcl b/terraform/staging/.terraform.lock.hcl index 57c98cbb8..59aff9db3 100644 --- a/terraform/staging/.terraform.lock.hcl +++ b/terraform/staging/.terraform.lock.hcl @@ -45,23 +45,23 @@ provider "registry.terraform.io/fluxcd/flux" { } provider "registry.terraform.io/gitlabhq/gitlab" { - version = "19.2.1" - constraints = "19.2.1" + version = "19.3.0" + constraints = "19.3.0" hashes = [ - "h1:Dc2fiVjSBgKMGQ2ALI6cYio644K+X4IDrCIf9jF4ja8=", - "zh:0240c6e58b50340d20f4f080741200043a37bd981f81d9888f84b19a5d049ac2", - "zh:0a3d49d9f1e8aa8e8ff631875bbbf8cadc14f0bdc0f6916056c1683ba3858863", - "zh:11ed6055ac876a3c26b6a3d29fd0de382b382e9abe5000957e76a0b8392e02b1", - "zh:15757db367b391d1baf0f61ecdc06e4d74da3af155cbc01e0b280a1d744d53d8", - "zh:214bc637912b1374e796ff8d76e2e88f598eef1ba663bdb5db563773643a3db8", - "zh:2c815c7b99bdb80d6f71ef0022bd2b6e4c1136ad0c211c9099058cafafdfa5bb", - "zh:5b0f2b42a22798e8dc6379aea0175d0f7a70e51cfb0c4131df15e6a449ab74aa", - "zh:5fa2738968050016cd95f37e2d56a0d2f40e9f1b28ab0dfc8f8548c11891f974", - "zh:6615c576f881845115f371d52cec601b32ee191b00131be77e557df49c4def3a", - "zh:6ef97c08ee31f91e5416485848ebfebeadbec568997978ad9fe579570619ed1c", - "zh:78aa0a3da3b00849772afb493d7eb32f46606a9844fe1115d70d203910330c00", - "zh:c3f9ec03c097d5d3b13ade61d58de17b0fdabe8931a1a5557bc3d9a9a029c054", - "zh:e2c41cc5b22f0c328e36a19747172a7a21f6f16ce1288c47a445f9341101bc7f", + "h1:Qnf+vva+ZYc9BexTvLfJffeSymX2d/KZ0E6U91DcagY=", + "zh:0f4a5c63b67b961c028966a69db1c3837d993c2b016a0f36fe4f3d29206b9fca", + "zh:15f6a11066615e6427e082566b8db3c5bbbc6b9320c37883de43cb6014fc344b", + "zh:3202e0811a26a7f06a4d7d7debd2f4bed8814ccfcd690b25ac62889869e077bb", + "zh:373dd742ce43f3f17f3c705f9ba493b797203531b7e1885e03938526995ddfe8", + "zh:43d35660642229e67800f6485be5ed1e1cd2468d156dad5d340b3fe77984afc9", + "zh:4b7ee081c7c3bf3d54ea8028f196b17aecfa3cfeabcac1f05c41721303f5e874", + "zh:4dd581d9f6e10ee1c65050c84a6dec5292da9eda6ffb1cea53c15e8f192b4fcf", + "zh:5662eb79f82266d5f6578685136f0e4f325ff66e3c1cbf9dea5407d2ea5fb630", + "zh:5a31593b1f093b19979bfa8c835701f47d3040eec3c458740b09b9bfbe496405", + "zh:7e49897c85e5d3c979b1d678d12c36730e39a6b0aee9df46ecf1e7bc4d504d40", + "zh:89470f411e9aa936c36f4463f323aaeb1eaf7471685252433e3261fa53644537", + "zh:96c1480f8c6eb0291316364c0787aaac9f297a3a736fe4e7dd54d58c05b1fd4a", + "zh:ea2834578fe9f335a02563e302e9b9dcf5809fe7d08ea1b8f736b76da6bcde99", "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32", ] } diff --git a/terraform/staging/versions.tf b/terraform/staging/versions.tf index d5d233447..5d695fa6c 100644 --- a/terraform/staging/versions.tf +++ b/terraform/staging/versions.tf @@ -20,7 +20,7 @@ terraform { } gitlab = { source = "gitlabhq/gitlab" - version = "19.2.1" + version = "19.3.0" } } From 1b4c8deb6f647277a2c3ab1bf9d95667f0c34712 Mon Sep 17 00:00:00 2001 From: Jacob Nesbitt Date: Wed, 26 Aug 2026 12:14:50 -0400 Subject: [PATCH 5/7] Add max_yaml_size_bytes and max_yaml_depth settings --- terraform/modules/spack_gitlab/application_settings.tf | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/terraform/modules/spack_gitlab/application_settings.tf b/terraform/modules/spack_gitlab/application_settings.tf index 436e04aa4..858e80935 100644 --- a/terraform/modules/spack_gitlab/application_settings.tf +++ b/terraform/modules/spack_gitlab/application_settings.tf @@ -407,6 +407,12 @@ resource "gitlab_application_settings" "this" { # Maximum size in bytes of the Terraform state files. max_terraform_state_size_bytes = 0 + # Maximum size in bytes of a CI/CD configuration YAML file. + max_yaml_size_bytes = 52428800 + + # Maximum depth of nested CI/CD configuration added with the 'include' keyword. + max_yaml_depth = 100 + # A method call is only tracked when it takes longer than the given amount of milliseconds. metrics_method_call_threshold = 10 From 37b2b5d908f6dd2b4f0f1b712098700e211df738 Mon Sep 17 00:00:00 2001 From: Jacob Nesbitt Date: Wed, 26 Aug 2026 12:21:23 -0400 Subject: [PATCH 6/7] Set maintenance mode message --- terraform/modules/spack_gitlab/application_settings.tf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/terraform/modules/spack_gitlab/application_settings.tf b/terraform/modules/spack_gitlab/application_settings.tf index 858e80935..1d70b2e7d 100644 --- a/terraform/modules/spack_gitlab/application_settings.tf +++ b/terraform/modules/spack_gitlab/application_settings.tf @@ -374,6 +374,9 @@ resource "gitlab_application_settings" "this" { # When instance is in maintenance mode, non-administrative users can sign in with read-only access and make read-only API requests. maintenance_mode = false + # Set the maintenance mode message explicity. + maintenance_mode_message = "Gitlab is undergoing scheduled maintenance. If you are experiencing issues, please try again later." + # Use repo.maven.apache.org as a default remote repository when the package is not found in the GitLab Package Registry for Maven. maven_package_requests_forwarding = true From b95b5e1fc5d21427040e820f3493a9a0d69b62ab Mon Sep 17 00:00:00 2001 From: Mike VanDenburgh Date: Fri, 28 Aug 2026 14:15:59 -0400 Subject: [PATCH 7/7] Remove unused service from outbound whitelist --- terraform/modules/spack_gitlab/application_settings.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/terraform/modules/spack_gitlab/application_settings.tf b/terraform/modules/spack_gitlab/application_settings.tf index 1d70b2e7d..b03822bd9 100644 --- a/terraform/modules/spack_gitlab/application_settings.tf +++ b/terraform/modules/spack_gitlab/application_settings.tf @@ -438,7 +438,7 @@ resource "gitlab_application_settings" "this" { npm_package_requests_forwarding = true # Define a list of trusted domains or IP addresses to which local requests are allowed when local requests for hooks and services are disabled. - outbound_local_requests_whitelist = ["pipeline-webhook-service.custom.svc.cluster.local", "webhook-handler.custom.svc.cluster.local", "spack-gantry.spack.svc.cluster.local"] + outbound_local_requests_whitelist = ["webhook-handler.custom.svc.cluster.local", "spack-gantry.spack.svc.cluster.local"] # List of package registry metadata to sync. package_metadata_purl_types = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 17]