Serve /uploads/ via X-Sendfile

This is based on Kamil's work in
https://gitlab.com/gitlab-org/gitlab-workhorse/merge_requests/5 .

Makefile

 PREFIX=/usr/local
 VERSION=$(shell git describe)-$(shell date -u +%Y%m%d.%H%M%S)
 
-gitlab-workhorse: main.go upstream.go archive.go git-http.go helpers.go upload.go
+gitlab-workhorse: main.go upstream.go archive.go git-http.go helpers.go xsendfile.go
 	go build -ldflags "-X main.Version ${VERSION}" -o gitlab-workhorse
 
 install: gitlab-workhorse

helpers.go

@@ -10,20 +10,9 @@ import (
 	"net/http"
 	"os"
 	"os/exec"
-	"path"
 	"syscall"
 )
 
-func looksLikeRepo(p string) bool {
-	// If /path/to/foo.git/objects exists then let's assume it is a valid Git
-	// repository.
-	if _, err := os.Stat(path.Join(p, "objects")); err != nil {
-		log.Print(err)
-		return false
-	}
-	return true
-}
-
 func fail500(w http.ResponseWriter, context string, err error) {
 	http.Error(w, "Internal server error", 500)
 	logContext(context, err)

main_test.go

@@ -269,7 +269,7 @@ func testAuthServer(code int, body string) *httptest.Server {
 }
 
 func startServerOrFail(t *testing.T, ts *httptest.Server) *exec.Cmd {
-	cmd := exec.Command("go", "run", "main.go", "upstream.go", "archive.go", "git-http.go", "helpers.go", fmt.Sprintf("-authBackend=%s", ts.URL), fmt.Sprintf("-listenAddr=%s", servAddr))
+	cmd := exec.Command("go", "run", "main.go", "upstream.go", "archive.go", "git-http.go", "helpers.go", "xsendfile.go", fmt.Sprintf("-authBackend=%s", ts.URL), fmt.Sprintf("-listenAddr=%s", servAddr))
 	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr

upload.go

-package main
-
-import (
-	"fmt"
-	"net/http"
-	"os"
-	"path"
-)
-
-func handleGetUpload(w http.ResponseWriter, r *gitRequest, _ string) {
-	if r.ContentDisposition == "attachment" {
-		w.Header().Add("Content-Disposition", fmt.Sprintf(`attachment; filename="%s"`, path.Base(r.ContentPath)))
-	} else {
-		w.Header().Add("Content-Disposition", r.ContentDisposition)
-	}
-
-	f, err := os.Open(r.ContentPath)
-	if err != nil {
-		logContext("handleGetUpload open file", err)
-		http.Error(w, "Not Found", 404)
-		return
-	}
-	defer f.Close()
-
-	fi, err := f.Stat()
-	if err != nil {
-		fail500(w, "handleGetUpload get mtime", err)
-		return
-	}
-	http.ServeContent(w, r.Request, "", fi.ModTime(), f)
-}

upstream.go

@@ -61,6 +61,7 @@ var gitServices = [...]gitService{
 	gitService{"GET", regexp.MustCompile(`/repository/archive.tar\z`), repoPreAuth, handleGetArchive, "tar"},
 	gitService{"GET", regexp.MustCompile(`/repository/archive.tar.gz\z`), repoPreAuth, handleGetArchive, "tar.gz"},
 	gitService{"GET", regexp.MustCompile(`/repository/archive.tar.bz2\z`), repoPreAuth, handleGetArchive, "tar.bz2"},
+	gitService{"GET", regexp.MustCompile(`/uploads/`), xSendFile, nil, ""},
 }
 
 func newUpstream(authBackend string, authTransport http.RoundTripper) *upstream {
@@ -91,27 +92,13 @@ func (u *upstream) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 }
 
 func repoPreAuth(u *upstream, w http.ResponseWriter, r *http.Request, handleFunc func(w http.ResponseWriter, r *gitRequest, rpc string), rpc string) {
-	url := u.authBackend + r.URL.RequestURI()
-	authReq, err := http.NewRequest(r.Method, url, nil)
+	authReq, err := u.newUpstreamRequest(r)
 	if err != nil {
-		fail500(w, "doAuthRequest", err)
+		fail500(w, "newUpstreamRequest", err)
 		return
 	}
-	// Forward all headers from our client to the auth backend. This includes
-	// HTTP Basic authentication credentials (the 'Authorization' header).
-	for k, v := range r.Header {
-		authReq.Header[k] = v
-	}
-	// Also forward the Host header, which is excluded from the Header map by the http libary.
-	// This allows the Host header received by the backend to be consistent with other
-	// requests not going through gitlab-workhorse.
-	authReq.Host = r.Host
-	// Set a custom header for the request. This can be used in some
-	// configurations (Passenger) to solve auth request routing problems.
-	authReq.Header.Set("GitLab-Git-HTTP-Server", Version)
 
 	authResponse, err := u.httpClient.Do(authReq)
-
 	if err != nil {
 		fail500(w, "doAuthRequest", err)
 		return
@@ -174,3 +161,25 @@ func looksLikeRepo(p string) bool {
 	}
 	return true
 }
+
+func (u *upstream) newUpstreamRequest(r *http.Request) (*http.Request, error) {
+	url := u.authBackend + r.URL.RequestURI()
+	authReq, err := http.NewRequest(r.Method, url, nil)
+	if err != nil {
+		return nil, err
+	}
+	// Forward all headers from our client to the auth backend. This includes
+	// HTTP Basic authentication credentials (the 'Authorization' header).
+	for k, v := range r.Header {
+		authReq.Header[k] = v
+	}
+	// Also forward the Host header, which is excluded from the Header map by the http libary.
+	// This allows the Host header received by the backend to be consistent with other
+	// requests not going through gitlab-workhorse.
+	authReq.Host = r.Host
+	// Set a custom header for the request. This can be used in some
+	// configurations (Passenger) to solve auth request routing problems.
+	authReq.Header.Set("GitLab-Git-HTTP-Server", Version)
+
+	return authReq, nil
+}

xsendfile.go

+/*
+The xSendFile middleware transparently sends static files in HTTP responses
+via the X-Sendfile mechanism. All that is needed in the Rails code is the
+'send_file' method.
+*/
+
+package main
+
+import (
+	"io"
+	"log"
+	"net/http"
+	"os"
+)
+
+func xSendFile(u *upstream, w http.ResponseWriter, r *http.Request, _ func(http.ResponseWriter, *gitRequest, string), _ string) {
+	upRequest, err := u.newUpstreamRequest(r)
+	if err != nil {
+		fail500(w, "newUpstreamRequest", err)
+		return
+	}
+
+	upRequest.Header.Set("X-Sendfile-Type", "X-Sendfile")
+	upResponse, err := u.httpClient.Do(upRequest)
+	if err != nil {
+		fail500(w, "do upstream request", err)
+		return
+	}
+
+	defer upResponse.Body.Close()
+	// Get X-Sendfile
+	sendfile := upResponse.Header.Get("X-Sendfile")
+	upResponse.Header.Del("X-Sendfile")
+
+	// Copy headers from Rails upResponse
+	for k, v := range upResponse.Header {
+		w.Header()[k] = v
+	}
+
+	// Use accelerated file serving
+	if sendfile == "" && upResponse.StatusCode/100 != 2 {
+		// Copy request body otherwise
+		w.WriteHeader(upResponse.StatusCode)
+
+		// Copy body from Rails upResponse
+		if _, err := io.Copy(w, upResponse.Body); err != nil {
+			fail500(w, "Couldn't finalize X-File download request.", err)
+		}
+		return
+	}
+
+	log.Printf("Serving file %q", sendfile)
+	upResponse.Body.Close()
+	content, err := os.Open(sendfile)
+	if err != nil {
+		fail500(w, "open sendfile", err)
+		return
+	}
+	defer content.Close()
+
+	fi, err := content.Stat()
+	if err != nil {
+		fail500(w, "handleGetUpload get mtime", err)
+		return
+	}
+	http.ServeContent(w, r, "", fi.ModTime(), content)
+}