生成 GitLab EE 许可证

一、前言

• 在之前的 GitLab 文章上操作

二、生成证书

2.1、创建 ruby docker 镜像

• 创建镜像并进入

docker run -it -d --name ruby ruby /bin/bash

2.2、生成许可证

gem install gitlab-license

2.3、创建生成证书脚本

• 内容复制黏贴即可
• 可以添加参数

cat <<'EOF'> license.rb
require "openssl"
require "gitlab/license"

key_pair = OpenSSL::PKey::RSA.generate(2048)
File.open("license_key", "w") { |f| f.write(key_pair.to_pem) }

public_key = key_pair.public_key
File.open("license_key.pub", "w") { |f| f.write(public_key.to_pem) }

private_key = OpenSSL::PKey::RSA.new File.read("license_key")
Gitlab::License.encryption_key = private_key

license = Gitlab::License.new
license.licensee = {
  "Name" => "GitLab",
  "Company" => "none",
  "Email" => "example@test.com",
}
license.starts_at = Date.new(2020, 1, 1) # 开始时间
license.expires_at = Date.new(2050, 1, 1) # 结束时间
license.notify_admins_at = Date.new(2049, 12, 1)
license.notify_users_at = Date.new(2049, 12, 1)
license.block_changes_at = Date.new(2050, 1, 1)
license.restrictions = {
  active_user_count: 10000,
}

puts "License:"
puts license

data = license.export
puts "Exported license:"
puts data
File.open("GitLabBV.gitlab-license", "w") { |f| f.write(data) }

public_key = OpenSSL::PKey::RSA.new File.read("license_key.pub")
Gitlab::License.encryption_key = public_key

data = File.read("GitLabBV.gitlab-license")
$license = Gitlab::License.import(data)

puts "Imported license:"
puts $license

unless $license
  raise "The license is invalid."
end

if $license.restricted?(:active_user_count)
  active_user_count = 10000
  if active_user_count > $license.restrictions[:active_user_count]
    raise "The active user count exceeds the allowed amount!"
  end
end

if $license.notify_admins?
  puts "The license is due to expire on #{$license.expires_at}."
end

if $license.notify_users?
  puts "The license is due to expire on #{$license.expires_at}."
end

module Gitlab
  class GitAccess
    def check(cmd, changes = nil)
      if $license.block_changes?
        return build_status_object(false, "License expired")
      end
    end
  end
end

puts "This instance of GitLab Enterprise Edition is licensed to:"
$license.licensee.each do |key, value|
  puts "#{key}: #{value}"
end

if $license.expired?
  puts "The license expired on #{$license.expires_at}"
elsif $license.will_expire?
  puts "The license will expire on #{$license.expires_at}"
else
  puts "The license will never expire."
end
EOF

2.3、生成证书

ruby license.rb

2.4、查看生成文件

• 会生成以下几个文件

root@2548d89ccadd:/# ls | grep license
GitLabBV.gitlab-license
license.rb
license_key
license_key.pub

2.5、将证书拷贝出去

• GitLabBV.gitlab-license 是需要导入 GitLab 证书

# 退出当前容器
exit

# 将文件拷贝出来
docker cp ruby:/license_key .
docker cp ruby:/license_key.pub .
docker cp ruby:/GitLabBV.gitlab-license .

三、使用许可证

3.1、参考容器配置

cat <<'EOF'> docker-compose.yml
version: '2'
services:
  gitlab:
    image: gitlab/gitlab-ee:10.4.0-ee.0
    #image: gitlab/gitlab-ee:11.11.0-ee.0
    #image: gitlab/gitlab-ee:12.10.14-ee.0
    mem_limit: 8192m
    container_name: gitlab
    environment:
      TZ: 'Asia/Shanghai'
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'http://gitlab.akiraka.net'
        gitlab_rails['time_zone'] = 'Asia/Shanghai'
        # 需要配置到 gitlab.rb 中的配置可以在这里配置，每个配置一行，注意缩进。
        # 比如下面的电子邮件的配置：
        gitlab_rails['smtp_enable'] = true
        gitlab_rails['smtp_address'] = "smtp.sina.net"
        gitlab_rails['smtp_port'] = "578"
        gitlab_rails['smtp_user_name'] = "devops@aka.net"
        gitlab_rails['smtp_password'] = "password"
        gitlab_rails['smtp_authentication'] = "login"
        gitlab_rails['smtp_enable_starttls_auto'] = true
        # gitlab_rails['smtp_tls'] = true
        gitlab_rails['gitlab_email_from'] = 'devops@aka.net'
    ports:
      - 80:80
    volumes:
      - /etc/localtime:/etc/localtime
      - /data/gitlab/config:/etc/gitlab
      - /data/gitlab/data:/var/opt/gitlab
      - /data/gitlab/logs:/var/log/gitlab
      - /data/gitlab/backup:/var/opt/gitlab/backups
      # 证书文件,拷贝容器里面的文件出来
      - /data/gitlab/license/license.rb:/opt/gitlab/embedded/service/gitlab-rails/ee/app/models/license.rb
      # 修改等级
      - /data/gitlab/license/license_key.pub:/opt/gitlab/embedded/service/gitlab-rails/.license_encryption_key.pub
networks:
  default:
    external:
      name:  aka-network
EOF

3.2、替换证书

• 我这里是容器部署，用license_key.pub 替换 /opt/gitlab/embedded/service/gitlab-rails/.license_encryption_key.pub 即可
• 将证书挂载到容器中即可

3.3、修改证书等级

• 将容器中文件那出来做持久化
• 在将修改后的文件持久化到容器中

1） 拷贝出 GitLab 容器内容到宿主机

docker cp gitlab:/opt/gitlab/embedded/service/gitlab-rails/ee/app/models/license.rb .

2) 编辑文件

vim license.rb

3) 找到 restricted_attr(:plan).presence

# 原配置
restricted_attr(:plan).presence || STARTER_PLAN
# 修改为
restricted_attr(:plan).presence || ULTIMATE_PLAN

4) 关闭容器

docker-compose down

5) 启动容器

docker-compose up -d

3.4、导入证书

• 打开浏览器到 许可证位置导入证书
• 将 GitLabBV.gitlab-license 文件内容贴到许可证位置即可
• 注意 14.x 版本许可证位置放到订阅里面，点击上传许可证把证书内容贴进去即可

1) gitlab 14.x 以下版本

2) gitlab 14.x 以上版本