Static objects external storage · Gitlab 中文文檔

# Static objects external storage > 原文：[https://docs.gitlab.com/ee/administration/static_objects_external_storage.html](https://docs.gitlab.com/ee/administration/static_objects_external_storage.html) * [Configuring](#configuring) * [Serving private static objects](#serving-private-static-objects) * [Requests flow example](#requests-flow-example) * [Set up external storage](#set-up-external-storage) # Static objects external storage[](#static-objects-external-storage "Permalink") 在 GitLab 12.3 中[引入](https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/31025) . 可以將 GitLab 配置為從外部存儲（例如內容交付網絡（CDN））為存儲庫靜態對象（例如，存檔或原始 Blob）提供服務. ## Configuring[](#configuring "Permalink") 要為靜態對象配置外部存儲，請執行以下操作： 1. 導航到" **管理區域">"設置">"存儲庫"** . 2. 展開" **存儲庫靜態對象"**部分. 3. 輸入基本 URL 和任意令牌. [設置外部存儲時](#set-up-external-storage) ，您將使用一個腳本，將這些值用作`ORIGIN_HOSTNAME`和`STORAGE_TOKEN` . 需要使用令牌來區分來自外部存儲的請求，因此用戶無需繞過外部存儲就可以直接前往應用程序. 令牌應在來自外部存儲的請求中的`X-Gitlab-External-Storage-Token`標頭中設置. ## Serving private static objects[](#serving-private-static-objects "Permalink") GitLab 將為屬于私有項目的靜態對象 URL 附加一個用戶特定的令牌，因此可以代表用戶對外部存儲進行身份驗證. 當處理來自外部存儲的請求時，GitLab 將在`token`查詢參數或`X-Gitlab-Static-Object-Token`標頭中查找`X-Gitlab-Static-Object-Token`以檢查用戶訪問所請求對象的能力. ## Requests flow example[](#requests-flow-example "Permalink") 以下示例顯示了用戶，GitLab 和 CDN 之間的一系列請求和響應： sequenceDiagram User->> GitLab：GET /project/-/archive/master.zip GitLab->>用戶：302 找到有關 User，GitLab 的注釋：位置：https://cdn.com/project/-/archive/master. zip？token =安全用戶令牌用戶->> CDN：GET /project/-/archive/master.zip?token=安全用戶令牌替代對象不在緩存 CDN->> GitLab：GET / project /- /archive/master.zip 關于 CDN，GitLab 的說明：X-Gitlab-External-Storage-Token：secure-cdn-token X-Gitlab-Static-Object-Token：安全用戶令牌 GitLab->> CDN：200 OK CDN->>用戶：master.zip 其他對象在緩存 CDN->> GitLab：GET / project /-/ a??rchive / master.zip 關于 CDN，GitLab 的說明：X-Gitlab-External-Storage-Token：secure-cdn-token X-Gitlab-Static-Object-Token：安全用戶令牌如果不匹配：etag 值 GitLab->> CDN：304 未修改 CDN->>用戶：master.zip 結束 ## Set up external storage[](#set-up-external-storage "Permalink") 盡管此過程使用[CloudFlare Workers](https://workers.cloudflare.com)進行外部存儲，但其他 CDN 或功能即服務（FaaS）系統應使用相同的原理工作. 1. 如果還沒有，請選擇一個 CloudFlare Worker 域. 2. 在以下腳本中，為前兩個常量設置以下值： * `ORIGIN_HOSTNAME` ：GitLab 安裝的主機名. * `STORAGE_TOKEN` ：任何任意的安全令牌（例如，您可以通過在 UNIX 計算機上運行`pwgen -cn1 64`來獲得一個）. 按照[配置](#configuring)部分中的說明將此令牌保存到管理面板. ``` const ORIGIN_HOSTNAME = 'gitlab.installation.com' // FIXME: SET CORRECT VALUE const STORAGE_TOKEN = 'very-secure-token' // FIXME: SET CORRECT VALUE const CACHE_PRIVATE_OBJECTS = false const CORS_HEADERS = { 'Access-Control-Allow-Origin': '*', 'Access-Control-Allow-Methods': 'GET, HEAD, OPTIONS', 'Access-Control-Allow-Headers': 'X-Csrf-Token, X-Requested-With', } self.addEventListener('fetch', event => event.respondWith(handle(event))) async function handle(event) { try { let response = await verifyAndHandle(event); // responses returned from cache are immutable, so we recreate them // to set CORS headers response = new Response(response.body, response) response.headers.set('Access-Control-Allow-Origin', '*') return response } catch (e) { return new Response('An error occurred!', {status: e.statusCode || 500}) } } async function verifyAndHandle(event) { if (!validRequest(event.request)) { return new Response(null, {status: 400}) } if (event.request.method === 'OPTIONS') { return handleOptions(event.request) } return handleRequest(event) } function handleOptions(request) { // Make sure the necessary headers are present // for this to be a valid pre-flight request if ( request.headers.get('Origin') !== null && request.headers.get('Access-Control-Request-Method') !== null && request.headers.get('Access-Control-Request-Headers') !== null ) { // Handle CORS pre-flight request return new Response(null, { headers: CORS_HEADERS, }) } else { // Handle standard OPTIONS request return new Response(null, { headers: { Allow: 'GET, HEAD, OPTIONS', }, }) } } async function handleRequest(event) { let cache = caches.default let url = new URL(event.request.url) let static_object_token = url.searchParams.get('token') let headers = new Headers(event.request.headers) url.host = ORIGIN_HOSTNAME url = normalizeQuery(url) headers.set('X-Gitlab-External-Storage-Token', STORAGE_TOKEN) if (static_object_token !== null) { headers.set('X-Gitlab-Static-Object-Token', static_object_token) } let request = new Request(url, { headers: headers }) let cached_response = await cache.match(request) let is_conditional_header_set = headers.has('If-None-Match') if (cached_response) { return cached_response } // We don't want to override If-None-Match that is set on the original request if (cached_response && !is_conditional_header_set) { headers.set('If-None-Match', cached_response.headers.get('ETag')) } let response = await fetch(request, { headers: headers, redirect: 'manual' }) if (response.status == 304) { if (is_conditional_header_set) { return response } else { return cached_response } } else if (response.ok) { response = new Response(response.body, response) // cache.put will never cache any response with a Set-Cookie header response.headers.delete('Set-Cookie') if (CACHE_PRIVATE_OBJECTS) { response.headers.delete('Cache-Control') } event.waitUntil(cache.put(request, response.clone())) } return response } function normalizeQuery(url) { let searchParams = url.searchParams url = new URL(url.toString().split('?')[0]) if (url.pathname.includes('/raw/')) { let inline = searchParams.get('inline') if (inline == 'false' || inline == 'true') { url.searchParams.set('inline', inline) } } else if (url.pathname.includes('/-/archive/')) { let append_sha = searchParams.get('append_sha') let path = searchParams.get('path') if (append_sha == 'false' || append_sha == 'true') { url.searchParams.set('append_sha', append_sha) } if (path) { url.searchParams.set('path', path) } } return url } function validRequest(request) { let url = new URL(request.url) let path = url.pathname if (/^(.+)(\/raw\/|\/-\/archive\/)/.test(path)) { return true } return false } ``` 3. 使用此腳本創建一個新的工作程序. 4. 復制`ORIGIN_HOSTNAME`和`STORAGE_TOKEN`值. 使用這些值為[靜態對象配置外部存儲](#configuring) .