From 9e2aa3548cb5cc023dd2442ed9a418696f87a89b Mon Sep 17 00:00:00 2001 From: Nick Fawbert Date: Mon, 30 Jun 2025 12:05:40 +0100 Subject: [PATCH 1/4] sync-disabled-ldap-users-gitlab systemd timer --- roles/debian/gitlab/defaults/main.yml | 1 + roles/debian/gitlab/tasks/main.yml | 9 +++++++++ 2 files changed, 10 insertions(+) diff --git a/roles/debian/gitlab/defaults/main.yml b/roles/debian/gitlab/defaults/main.yml index 225d7a2cf..d4c2243e3 100644 --- a/roles/debian/gitlab/defaults/main.yml +++ b/roles/debian/gitlab/defaults/main.yml @@ -96,3 +96,4 @@ gitlab: redirect_http_to_https: "true" # must be enabled if you're using LetsEncrypt above redirect_http_to_https_port: 80 # must be 80 if you're using LetsEncrypt above custom_nginx_config: "" # include extra config, for example "include /etc/nginx/conf.d/example.conf;" + block_removed_ldap_users_on_calendar: "*-*-* 02:30:00" diff --git a/roles/debian/gitlab/tasks/main.yml b/roles/debian/gitlab/tasks/main.yml index ce93c19b6..28f5d41bb 100644 --- a/roles/debian/gitlab/tasks/main.yml +++ b/roles/debian/gitlab/tasks/main.yml @@ -128,6 +128,15 @@ ansible.builtin.command: /opt/gitlab/bin/gitlab-ctl start when: gitlab.force_stop +- name: Create systemd timer to sync removed LDAP users. + ansible.builtin.include_role: + name: contrib/systemd_timers + vars: + timers: + block_removed_ldap_users: + timer_command: "gitlab-rake gitlab:cleanup:block_removed_ldap_users" + timer_OnCalendar: "{{ gitlab.block_removed_ldap_users_on_calendar }}" + # @TODO - this task fails in CI with GitHub Actions because PostGreSQL isn't running - name: Run the GitLab configuration script for config that cannot be set in gitlab.rb. ansible.builtin.command: /opt/gitlab/bin/gitlab-rails runner /etc/gitlab/gitlab-config.rb From 80648ee470c1ce1db4ede6924bb9cce945a9cec8 Mon Sep 17 00:00:00 2001 From: Nick Fawbert Date: Mon, 30 Jun 2025 12:09:49 +0100 Subject: [PATCH 2/4] add when clause --- roles/debian/gitlab/tasks/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/debian/gitlab/tasks/main.yml b/roles/debian/gitlab/tasks/main.yml index 28f5d41bb..ed7c51239 100644 --- a/roles/debian/gitlab/tasks/main.yml +++ b/roles/debian/gitlab/tasks/main.yml @@ -136,6 +136,7 @@ block_removed_ldap_users: timer_command: "gitlab-rake gitlab:cleanup:block_removed_ldap_users" timer_OnCalendar: "{{ gitlab.block_removed_ldap_users_on_calendar }}" + when: gitlab.ldap.enable # @TODO - this task fails in CI with GitHub Actions because PostGreSQL isn't running - name: Run the GitLab configuration script for config that cannot be set in gitlab.rb. From 7da0568409e6fc01d751178cc1abd48fa872756e Mon Sep 17 00:00:00 2001 From: Nick Fawbert Date: Mon, 30 Jun 2025 12:12:05 +0100 Subject: [PATCH 3/4] full path to binary --- roles/debian/gitlab/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/debian/gitlab/tasks/main.yml b/roles/debian/gitlab/tasks/main.yml index ed7c51239..6bf4ee9f2 100644 --- a/roles/debian/gitlab/tasks/main.yml +++ b/roles/debian/gitlab/tasks/main.yml @@ -134,7 +134,7 @@ vars: timers: block_removed_ldap_users: - timer_command: "gitlab-rake gitlab:cleanup:block_removed_ldap_users" + timer_command: "/usr/bin/gitlab-rake gitlab:cleanup:block_removed_ldap_users" timer_OnCalendar: "{{ gitlab.block_removed_ldap_users_on_calendar }}" when: gitlab.ldap.enable From 7e27a1083aa71514e4df4ae30dade538277c0062 Mon Sep 17 00:00:00 2001 From: Nick Fawbert Date: Mon, 30 Jun 2025 12:23:23 +0100 Subject: [PATCH 4/4] add arg to gitlab-rake --- roles/debian/gitlab/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/debian/gitlab/tasks/main.yml b/roles/debian/gitlab/tasks/main.yml index 6bf4ee9f2..762c26ba8 100644 --- a/roles/debian/gitlab/tasks/main.yml +++ b/roles/debian/gitlab/tasks/main.yml @@ -134,7 +134,7 @@ vars: timers: block_removed_ldap_users: - timer_command: "/usr/bin/gitlab-rake gitlab:cleanup:block_removed_ldap_users" + timer_command: "/usr/bin/gitlab-rake gitlab:cleanup:block_removed_ldap_users BLOCK=true" timer_OnCalendar: "{{ gitlab.block_removed_ldap_users_on_calendar }}" when: gitlab.ldap.enable