• GitLab introduced 3 new secrets for ActiveRecord encryption. If the secrets are not available in /etc/webapps/gitlab/secrets.yml the gitlab-puma.service is not able to start.

    Due to the security settings in the gitlab-puma.service it can’t generate the secrets, because the process cannot write files.

    The secrets need to be generated manually and inserted in the secrets.yml. This command creates eligible keys:

    LC_ALL=C < /dev/urandom tr -dc 'a-zA-Z0-9' | head -c 32

    These are the 3 secret keys:

    active_record_encryption_primary_key
    active_record_encryption_deterministic_key
    active_record_encryption_key_derivation_salt

    Afterwards restart GitLab:

    systemctl restart gitlab.target

    If a proxy server is in front of GitLab, it should be restarted as well.

  • I faced the problem that I was using a zsh with my normal user and changed into root, suddenly all escape sequences didn’t work anymore and tools like mc wece unusable.

    I found out my locale settings didn’t match, root used en_US.utf8, my normal user did not have anything set and used POSIX.

    To set the LANG variable I put it in .zshenv, this way I did not need to edit my .zshrc, which I copy from grml.org.

    Put this line into $HOME/.zshenv for it to work:

    export LANG=en_US.utf8

  • To be able to keep processes running which were started from a service unit after the service is stopped, you need to configure the following option in the .service file under the [Service] section:

    KillMode=process

    This keeps started processes from the service unit running after the service is stopped. This is not a recommended behavior, but my use cases involves a timer which calls a python script to run processes if needed, which needs to be running after the script has terminated. In the default behavior systemd kills all child process started from the service unit.

    Here is the documentation: https://www.freedesktop.org/software/systemd/man/latest/systemd.kill.html