GitLab introduced 3 new secrets for ActiveRecord encryption. If the secrets are not available in /etc/webapps/gitlab/secrets.yml
the gitlab-puma.service is not able to start.
Due to the security settings in the gitlab-puma.service it can’t generate the secrets, because the process cannot write files.
The secrets need to be generated manually and inserted in the secrets.yml. This command creates eligible keys:
LC_ALL=C < /dev/urandom tr -dc 'a-zA-Z0-9' | head -c 32
These are the 3 secret keys:
active_record_encryption_primary_key
active_record_encryption_deterministic_key
active_record_encryption_key_derivation_salt
Afterwards restart GitLab:
systemctl restart gitlab.target
If a proxy server is in front of GitLab, it should be restarted as well.