Merge branch 'master' of gitlab.com:gitlab-org/gitlab-ce

14 files changed, 231 insertions, 47 deletions

diff --git a/config/boot.rb b/config/boot.rb
index 2811f0e6188..b76b26a5e75 100644
--- a/config/boot.rb
+++ b/config/boot.rb
@@ -3,7 +3,7 @@ ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../Gemfile', __dir__)
 # Set up gems listed in the Gemfile.
 require 'bundler/setup' if File.exist?(ENV['BUNDLE_GEMFILE'])
 begin
-  require 'bootsnap/setup'
+  require 'bootsnap/setup' unless ENV['DISABLE_BOOTSNAP']
 rescue LoadError
   # bootsnap is an optional dependency, so if we don't have it, it's fine
 end
diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example
index dddc5ec3540..c82d9b5ceef 100644
--- a/config/gitlab.yml.example
+++ b/config/gitlab.yml.example
@@ -1078,7 +1078,7 @@ test:
       issues_url: "http://redmine/:project_id/:issues_tracker_id/:id"
       new_issue_url: "http://redmine/projects/:issues_tracker_id/issues/new"
     jira:
-      title: "JIRA"
+      title: "Jira"
       url: https://sample_company.atlassian.net
       project_key: PROJECT
 
diff --git a/config/initializers/0_thread_cache.rb b/config/initializers/0_thread_cache.rb
new file mode 100644
index 00000000000..feb8057132e
--- /dev/null
+++ b/config/initializers/0_thread_cache.rb
@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+Gitlab::ThreadMemoryCache.cache_backend
diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb
index 9e74a67b73f..bf187e9a282 100644
--- a/config/initializers/1_settings.rb
+++ b/config/initializers/1_settings.rb
@@ -5,6 +5,13 @@ require_relative '../object_store_settings'
 Settings['ldap'] ||= Settingslogic.new({})
 Settings.ldap['enabled'] = false if Settings.ldap['enabled'].nil?
 
+Gitlab.ee do
+  Settings.ldap['sync_time'] = 3600 if Settings.ldap['sync_time'].nil?
+  Settings.ldap['schedule_sync_daily'] = 1 if Settings.ldap['schedule_sync_daily'].nil?
+  Settings.ldap['schedule_sync_hour'] = 1 if Settings.ldap['schedule_sync_hour'].nil?
+  Settings.ldap['schedule_sync_minute'] = 30 if Settings.ldap['schedule_sync_minute'].nil?
+end
+
 # backwards compatibility, we only have one host
 if Settings.ldap['enabled'] || Rails.env.test?
   if Settings.ldap['host'].present?
@@ -23,11 +30,14 @@ if Settings.ldap['enabled'] || Rails.env.test?
     server['timeout'] ||= 10.seconds
     server['block_auto_created_users'] = false if server['block_auto_created_users'].nil?
     server['allow_username_or_email_login'] = false if server['allow_username_or_email_login'].nil?
+    server['smartcard_auth'] = false unless %w[optional required].include?(server['smartcard_auth'])
     server['active_directory'] = true if server['active_directory'].nil?
     server['attributes'] = {} if server['attributes'].nil?
     server['lowercase_usernames'] = false if server['lowercase_usernames'].nil?
     server['provider_name'] ||= "ldap#{key}".downcase
     server['provider_class'] = OmniAuth::Utils.camelize(server['provider_name'])
+    server['external_groups'] = [] if server['external_groups'].nil?
+    server['sync_ssh_keys'] = 'sshPublicKey' if server['sync_ssh_keys'].to_s == 'true'
 
     # For backwards compatibility
     server['encryption'] ||= server['method']
@@ -62,6 +72,12 @@ if Settings.ldap['enabled'] || Rails.env.test?
   end
 end
 
+Gitlab.ee do
+  Settings['smartcard'] ||= Settingslogic.new({})
+  Settings.smartcard['enabled'] = false if Settings.smartcard['enabled'].nil?
+  Settings.smartcard['client_certificate_required_port'] = 3444 if Settings.smartcard['client_certificate_required_port'].nil?
+end
+
 Settings['omniauth'] ||= Settingslogic.new({})
 Settings.omniauth['enabled'] = true if Settings.omniauth['enabled'].nil?
 Settings.omniauth['auto_sign_in_with_provider'] = false if Settings.omniauth['auto_sign_in_with_provider'].nil?
@@ -136,6 +152,7 @@ Settings['issues_tracker'] ||= {}
 #
 Settings['gitlab'] ||= Settingslogic.new({})
 Settings.gitlab['default_project_creation'] ||= ::Gitlab::Access::DEVELOPER_MAINTAINER_PROJECT_ACCESS
+Settings.gitlab['default_project_deletion_protection'] ||= false
 Settings.gitlab['default_projects_limit'] ||= 100000
 Settings.gitlab['default_branch_protection'] ||= 2
 Settings.gitlab['default_can_create_group'] = true if Settings.gitlab['default_can_create_group'].nil?
@@ -186,6 +203,21 @@ Settings.gitlab['no_todos_messages'] ||= YAML.load_file(Rails.root.join('config'
 Settings.gitlab['impersonation_enabled'] ||= true if Settings.gitlab['impersonation_enabled'].nil?
 Settings.gitlab['usage_ping_enabled'] = true if Settings.gitlab['usage_ping_enabled'].nil?
 
+Gitlab.ee do
+  Settings.gitlab['mirror_max_delay'] ||= 300
+  Settings.gitlab['mirror_max_capacity'] ||= 30
+  Settings.gitlab['mirror_capacity_threshold'] ||= 15
+end
+
+#
+# Elasticseacrh
+#
+Gitlab.ee do
+  Settings['elasticsearch'] ||= Settingslogic.new({})
+  Settings.elasticsearch['enabled'] = false if Settings.elasticsearch['enabled'].nil?
+  Settings.elasticsearch['url'] = ENV['ELASTIC_URL'] || "http://localhost:9200"
+end
+
 #
 # CI
 #
@@ -255,6 +287,15 @@ Settings.pages['admin'] ||= Settingslogic.new({})
 Settings.pages.admin['certificate'] ||= ''
 
 #
+# Geo
+#
+Gitlab.ee do
+  Settings['geo'] ||= Settingslogic.new({})
+  # For backwards compatibility, default to gitlab_url and if so, ensure it ends with "/"
+  Settings.geo['node_name'] = Settings.geo['node_name'].presence || Settings.gitlab['url'].chomp('/').concat('/')
+end
+
+#
 # External merge request diffs
 #
 Settings['external_diffs'] ||= Settingslogic.new({})
@@ -281,6 +322,32 @@ Settings.uploads['object_store'] = ObjectStoreSettings.parse(Settings.uploads['o
 Settings.uploads['object_store']['remote_directory'] ||= 'uploads'
 
 #
+# Packages
+#
+Gitlab.ee do
+  Settings['packages'] ||= Settingslogic.new({})
+  Settings.packages['enabled']      = true if Settings.packages['enabled'].nil?
+  Settings.packages['storage_path'] = Settings.absolute(Settings.packages['storage_path'] || File.join(Settings.shared['path'], "packages"))
+  Settings.packages['object_store'] = ObjectStoreSettings.parse(Settings.packages['object_store'])
+end
+
+#
+# Dependency Proxy
+#
+Gitlab.ee do
+  Settings['dependency_proxy'] ||= Settingslogic.new({})
+  Settings.dependency_proxy['enabled']      = true if Settings.dependency_proxy['enabled'].nil?
+  Settings.dependency_proxy['storage_path'] = Settings.absolute(Settings.dependency_proxy['storage_path'] || File.join(Settings.shared['path'], "dependency_proxy"))
+  Settings.dependency_proxy['object_store'] = ObjectStoreSettings.parse(Settings.dependency_proxy['object_store'])
+
+  # For first iteration dependency proxy uses Rails server to download blobs.
+  # To ensure acceptable performance we only allow feature to be used with
+  # multithreaded web-server Puma. This will be removed once download logic is moved
+  # to GitLab workhorse
+  Settings.dependency_proxy['enabled'] = false unless defined?(::Puma)
+end
+
+#
 # Mattermost
 #
 Settings['mattermost'] ||= Settingslogic.new({})
@@ -341,7 +408,6 @@ Settings.cron_jobs['remove_expired_group_links_worker']['job_class'] = 'RemoveEx
 Settings.cron_jobs['prune_old_events_worker'] ||= Settingslogic.new({})
 Settings.cron_jobs['prune_old_events_worker']['cron'] ||= '0 */6 * * *'
 Settings.cron_jobs['prune_old_events_worker']['job_class'] = 'PruneOldEventsWorker'
-
 Settings.cron_jobs['trending_projects_worker'] ||= Settingslogic.new({})
 Settings.cron_jobs['trending_projects_worker']['cron'] = '0 1 * * *'
 Settings.cron_jobs['trending_projects_worker']['job_class'] = 'TrendingProjectsWorker'
@@ -354,34 +420,72 @@ Settings.cron_jobs['stuck_import_jobs_worker']['job_class'] = 'StuckImportJobsWo
 Settings.cron_jobs['gitlab_usage_ping_worker'] ||= Settingslogic.new({})
 Settings.cron_jobs['gitlab_usage_ping_worker']['cron'] ||= Settings.__send__(:cron_for_usage_ping)
 Settings.cron_jobs['gitlab_usage_ping_worker']['job_class'] = 'GitlabUsagePingWorker'
-
 Settings.cron_jobs['stuck_merge_jobs_worker'] ||= Settingslogic.new({})
 Settings.cron_jobs['stuck_merge_jobs_worker']['cron'] ||= '0 */2 * * *'
 Settings.cron_jobs['stuck_merge_jobs_worker']['job_class'] = 'StuckMergeJobsWorker'
-
 Settings.cron_jobs['pages_domain_verification_cron_worker'] ||= Settingslogic.new({})
 Settings.cron_jobs['pages_domain_verification_cron_worker']['cron'] ||= '*/15 * * * *'
 Settings.cron_jobs['pages_domain_verification_cron_worker']['job_class'] = 'PagesDomainVerificationCronWorker'
-
 Settings.cron_jobs['pages_domain_removal_cron_worker'] ||= Settingslogic.new({})
 Settings.cron_jobs['pages_domain_removal_cron_worker']['cron'] ||= '47 0 * * *'
 Settings.cron_jobs['pages_domain_removal_cron_worker']['job_class'] = 'PagesDomainRemovalCronWorker'
-
 Settings.cron_jobs['pages_domain_ssl_renewal_cron_worker'] ||= Settingslogic.new({})
 Settings.cron_jobs['pages_domain_ssl_renewal_cron_worker']['cron'] ||= '*/10 * * * *'
 Settings.cron_jobs['pages_domain_ssl_renewal_cron_worker']['job_class'] = 'PagesDomainSslRenewalCronWorker'
-
 Settings.cron_jobs['issue_due_scheduler_worker'] ||= Settingslogic.new({})
 Settings.cron_jobs['issue_due_scheduler_worker']['cron'] ||= '50 00 * * *'
 Settings.cron_jobs['issue_due_scheduler_worker']['job_class'] = 'IssueDueSchedulerWorker'
-
 Settings.cron_jobs['prune_web_hook_logs_worker'] ||= Settingslogic.new({})
 Settings.cron_jobs['prune_web_hook_logs_worker']['cron'] ||= '0 */1 * * *'
 Settings.cron_jobs['prune_web_hook_logs_worker']['job_class'] = 'PruneWebHookLogsWorker'
-
 Settings.cron_jobs['schedule_migrate_external_diffs_worker'] ||= Settingslogic.new({})
 Settings.cron_jobs['schedule_migrate_external_diffs_worker']['cron'] ||= '15 * * * *'
 Settings.cron_jobs['schedule_migrate_external_diffs_worker']['job_class'] = 'ScheduleMigrateExternalDiffsWorker'
+Settings.cron_jobs['namespaces_prune_aggregation_schedules_worker'] ||= Settingslogic.new({})
+Settings.cron_jobs['namespaces_prune_aggregation_schedules_worker']['cron'] ||= '5 1 * * *'
+Settings.cron_jobs['namespaces_prune_aggregation_schedules_worker']['job_class'] = 'Namespaces::PruneAggregationSchedulesWorker'
+
+Gitlab.ee do
+  Settings.cron_jobs['clear_shared_runners_minutes_worker'] ||= Settingslogic.new({})
+  Settings.cron_jobs['clear_shared_runners_minutes_worker']['cron'] ||= '0 0 1 * *'
+  Settings.cron_jobs['clear_shared_runners_minutes_worker']['job_class'] = 'ClearSharedRunnersMinutesWorker'
+  Settings.cron_jobs['geo_file_download_dispatch_worker'] ||= Settingslogic.new({})
+  Settings.cron_jobs['geo_file_download_dispatch_worker']['cron'] ||= '*/1 * * * *'
+  Settings.cron_jobs['geo_file_download_dispatch_worker']['job_class'] ||= 'Geo::FileDownloadDispatchWorker'
+  Settings.cron_jobs['geo_metrics_update_worker'] ||= Settingslogic.new({})
+  Settings.cron_jobs['geo_metrics_update_worker']['cron'] ||= '*/1 * * * *'
+  Settings.cron_jobs['geo_metrics_update_worker']['job_class'] ||= 'Geo::MetricsUpdateWorker'
+  Settings.cron_jobs['geo_migrated_local_files_clean_up_worker'] ||= Settingslogic.new({})
+  Settings.cron_jobs['geo_migrated_local_files_clean_up_worker']['cron'] ||= '15 */6 * * *'
+  Settings.cron_jobs['geo_migrated_local_files_clean_up_worker']['job_class'] ||= 'Geo::MigratedLocalFilesCleanUpWorker'
+  Settings.cron_jobs['geo_prune_event_log_worker'] ||= Settingslogic.new({})
+  Settings.cron_jobs['geo_prune_event_log_worker']['cron'] ||= '*/5 * * * *'
+  Settings.cron_jobs['geo_prune_event_log_worker']['job_class'] ||= 'Geo::PruneEventLogWorker'
+  Settings.cron_jobs['geo_repository_sync_worker'] ||= Settingslogic.new({})
+  Settings.cron_jobs['geo_repository_sync_worker']['cron'] ||= '*/1 * * * *'
+  Settings.cron_jobs['geo_repository_sync_worker']['job_class'] ||= 'Geo::RepositorySyncWorker'
+  Settings.cron_jobs['geo_repository_verification_primary_batch_worker'] ||= Settingslogic.new({})
+  Settings.cron_jobs['geo_repository_verification_primary_batch_worker']['cron'] ||= '*/1 * * * *'
+  Settings.cron_jobs['geo_repository_verification_primary_batch_worker']['job_class'] ||= 'Geo::RepositoryVerification::Primary::BatchWorker'
+  Settings.cron_jobs['geo_repository_verification_secondary_scheduler_worker'] ||= Settingslogic.new({})
+  Settings.cron_jobs['geo_repository_verification_secondary_scheduler_worker']['cron'] ||= '*/1 * * * *'
+  Settings.cron_jobs['geo_repository_verification_secondary_scheduler_worker']['job_class'] ||= 'Geo::RepositoryVerification::Secondary::SchedulerWorker'
+  Settings.cron_jobs['historical_data_worker'] ||= Settingslogic.new({})
+  Settings.cron_jobs['historical_data_worker']['cron'] ||= '0 12 * * *'
+  Settings.cron_jobs['historical_data_worker']['job_class'] = 'HistoricalDataWorker'
+  Settings.cron_jobs['ldap_group_sync_worker'] ||= Settingslogic.new({})
+  Settings.cron_jobs['ldap_group_sync_worker']['cron'] ||= '0 * * * *'
+  Settings.cron_jobs['ldap_group_sync_worker']['job_class'] = 'LdapAllGroupsSyncWorker'
+  Settings.cron_jobs['ldap_sync_worker'] ||= Settingslogic.new({})
+  Settings.cron_jobs['ldap_sync_worker']['cron'] ||= '30 1 * * *'
+  Settings.cron_jobs['ldap_sync_worker']['job_class'] = 'LdapSyncWorker'
+  Settings.cron_jobs['pseudonymizer_worker'] ||= Settingslogic.new({})
+  Settings.cron_jobs['pseudonymizer_worker']['cron'] ||= '0 23 * * *'
+  Settings.cron_jobs['pseudonymizer_worker']['job_class'] ||= 'PseudonymizerWorker'
+  Settings.cron_jobs['update_max_seats_used_for_gitlab_com_subscriptions_worker'] ||= Settingslogic.new({})
+  Settings.cron_jobs['update_max_seats_used_for_gitlab_com_subscriptions_worker']['cron'] ||= '0 12 * * *'
+  Settings.cron_jobs['update_max_seats_used_for_gitlab_com_subscriptions_worker']['job_class'] = 'UpdateMaxSeatsUsedForGitlabComSubscriptionsWorker'
+end
 
 #
 # Sidekiq
@@ -462,6 +566,16 @@ Settings.backup['upload']['encryption_key'] ||= ENV['GITLAB_BACKUP_ENCRYPTION_KE
 Settings.backup['upload']['storage_class'] ||= nil
 
 #
+# Pseudonymizer
+#
+Gitlab.ee do
+  Settings['pseudonymizer'] ||= Settingslogic.new({})
+  Settings.pseudonymizer['manifest'] = Settings.absolute(Settings.pseudonymizer['manifest'] || Rails.root.join("config/pseudonymizer.yml"))
+  Settings.pseudonymizer['upload'] ||= Settingslogic.new({ 'remote_directory' => nil, 'connection' => nil })
+  # Settings.pseudonymizer['upload']['multipart_chunk_size'] ||= 104857600
+end
+
+#
 # Git
 #
 Settings['git'] ||= Settingslogic.new({})
@@ -474,6 +588,23 @@ Settings['satellites'] ||= Settingslogic.new({})
 Settings.satellites['path'] = Settings.absolute(Settings.satellites['path'] || "tmp/repo_satellites/")
 
 #
+# Kerberos
+#
+Gitlab.ee do
+  Settings['kerberos'] ||= Settingslogic.new({})
+  Settings.kerberos['enabled'] = false if Settings.kerberos['enabled'].nil?
+  Settings.kerberos['keytab'] = nil if Settings.kerberos['keytab'].blank? # nil means use default keytab
+  Settings.kerberos['service_principal_name'] = nil if Settings.kerberos['service_principal_name'].blank? # nil means any SPN in keytab
+  Settings.kerberos['use_dedicated_port'] = false if Settings.kerberos['use_dedicated_port'].nil?
+  Settings.kerberos['https'] = Settings.gitlab.https if Settings.kerberos['https'].nil?
+  Settings.kerberos['port'] ||= Settings.kerberos.https ? 8443 : 8088
+
+  if Settings.kerberos['enabled'] && !Settings.omniauth.providers.map(&:name).include?('kerberos_spnego')
+    Settings.omniauth.providers << Settingslogic.new({ 'name' => 'kerberos_spnego' })
+  end
+end
+
+#
 # Extra customization
 #
 Settings['extra'] ||= Settingslogic.new({})
diff --git a/config/initializers/6_validations.rb b/config/initializers/6_validations.rb
index bf9e5a50382..827b15e5c8d 100644
--- a/config/initializers/6_validations.rb
+++ b/config/initializers/6_validations.rb
@@ -1,24 +1,15 @@
-def storage_name_valid?(name)
-  !!(name =~ /\A[a-zA-Z0-9\-_]+\z/)
-end
-
 def storage_validation_error(message)
   raise "#{message}. Please fix this in your gitlab.yml before starting GitLab."
 end
 
 def validate_storages_config
-  storage_validation_error('No repository storage path defined') if Gitlab.config.repositories.storages.empty?
-
-  Gitlab.config.repositories.storages.each do |name, repository_storage|
-    storage_validation_error("\"#{name}\" is not a valid storage name") unless storage_name_valid?(name)
-
-    %w(failure_count_threshold failure_reset_time storage_timeout).each do |setting|
-      # Falling back to the defaults is fine!
-      next if repository_storage[setting].nil?
+  if Gitlab.config.repositories.storages.empty?
+    storage_validation_error('No repository storage path defined')
+  end
 
-      unless repository_storage[setting].to_f > 0
-        storage_validation_error("`#{setting}` for storage `#{name}` needs to be greater than 0")
-      end
+  Gitlab.config.repositories.storages.keys.each do |name|
+    unless /\A[a-zA-Z0-9\-_]+\z/.match?(name)
+      storage_validation_error("\"#{name}\" is not a valid storage name")
     end
   end
 end
diff --git a/config/initializers/7_prometheus_metrics.rb b/config/initializers/7_prometheus_metrics.rb
index 68f8487d377..741c8ef1ca0 100644
--- a/config/initializers/7_prometheus_metrics.rb
+++ b/config/initializers/7_prometheus_metrics.rb
@@ -1,15 +1,27 @@
 require 'prometheus/client'
 require 'prometheus/client/support/unicorn'
 
+# Keep separate directories for separate processes
+def prometheus_default_multiproc_dir
+  return unless Rails.env.development? || Rails.env.test?
+
+  if Sidekiq.server?
+    Rails.root.join('tmp/prometheus_multiproc_dir/sidekiq')
+  elsif defined?(Unicorn::Worker)
+    Rails.root.join('tmp/prometheus_multiproc_dir/unicorn')
+  elsif defined?(::Puma)
+    Rails.root.join('tmp/prometheus_multiproc_dir/puma')
+  else
+    Rails.root.join('tmp/prometheus_multiproc_dir')
+  end
+end
+
 Prometheus::Client.configure do |config|
   config.logger = Rails.logger
 
   config.initial_mmap_file_size = 4 * 1024
-  config.multiprocess_files_dir = ENV['prometheus_multiproc_dir']
 
-  if Rails.env.development? || Rails.env.test?
-    config.multiprocess_files_dir ||= Rails.root.join('tmp/prometheus_multiproc_dir')
-  end
+  config.multiprocess_files_dir = ENV['prometheus_multiproc_dir'] || prometheus_default_multiproc_dir
 
   config.pid_provider = Prometheus::Client::Support::Unicorn.method(:worker_pid_provider)
 end
@@ -29,28 +41,33 @@ if !Rails.env.test? && Gitlab::Metrics.prometheus_metrics_enabled?
   Gitlab::Cluster::LifecycleEvents.on_worker_start do
     defined?(::Prometheus::Client.reinitialize_on_pid_change) && Prometheus::Client.reinitialize_on_pid_change
 
-    if defined?(::Unicorn)
-      Gitlab::Metrics::Samplers::UnicornSampler.initialize_instance(Settings.monitoring.unicorn_sampler_interval).start
-    end
-
     Gitlab::Metrics::Samplers::RubySampler.initialize_instance(Settings.monitoring.ruby_sampler_interval).start
   end
 
-  if defined?(::Puma)
-    Gitlab::Cluster::LifecycleEvents.on_master_start do
+  Gitlab::Cluster::LifecycleEvents.on_master_start do
+    if defined?(::Unicorn)
+      Gitlab::Metrics::Samplers::UnicornSampler.initialize_instance(Settings.monitoring.unicorn_sampler_interval).start
+    elsif defined?(::Puma)
       Gitlab::Metrics::Samplers::PumaSampler.initialize_instance(Settings.monitoring.puma_sampler_interval).start
     end
   end
 end
 
-Gitlab::Cluster::LifecycleEvents.on_master_restart do
+def cleanup_prometheus_multiproc_dir
   # The following is necessary to ensure stale Prometheus metrics don't
   # accumulate over time. It needs to be done in this hook as opposed to
   # inside an init script to ensure metrics files aren't deleted after new
   # unicorn workers start after a SIGUSR2 is received.
-  prometheus_multiproc_dir = ENV['prometheus_multiproc_dir']
-  if prometheus_multiproc_dir
-    old_metrics = Dir[File.join(prometheus_multiproc_dir, '*.db')]
+  if dir = ::Prometheus::Client.configuration.multiprocess_files_dir
+    old_metrics = Dir[File.join(dir, '*.db')]
     FileUtils.rm_rf(old_metrics)
   end
 end
+
+Gitlab::Cluster::LifecycleEvents.on_master_start do
+  cleanup_prometheus_multiproc_dir
+end
+
+Gitlab::Cluster::LifecycleEvents.on_master_restart do
+  cleanup_prometheus_multiproc_dir
+end
diff --git a/config/initializers/jira.rb b/config/initializers/jira.rb
index 05f784a6a2a..664f9c87808 100644
--- a/config/initializers/jira.rb
+++ b/config/initializers/jira.rb
@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-# Changes JIRA DVCS user agent requests in order to be successfully handled
+# Changes Jira DVCS user agent requests in order to be successfully handled
 # by our API.
 #
 # Gitlab::Jira::Middleware is only defined on EE
diff --git a/config/initializers/rack_attack_logging.rb b/config/initializers/rack_attack_logging.rb
index 2a3fdc8de5f..338e968cc6c 100644
--- a/config/initializers/rack_attack_logging.rb
+++ b/config/initializers/rack_attack_logging.rb
@@ -4,12 +4,22 @@
 
 ActiveSupport::Notifications.subscribe('rack.attack') do |name, start, finish, request_id, req|
   if [:throttle, :blacklist].include? req.env['rack.attack.match_type']
-    Gitlab::AuthLogger.error(
+    rack_attack_info = {
       message: 'Rack_Attack',
       env: req.env['rack.attack.match_type'],
       ip: req.ip,
       request_method: req.request_method,
       fullpath: req.fullpath
-    )
+    }
+
+    if req.env['rack.attack.matched'] != 'throttle_unauthenticated'
+      user_id = req.env['rack.attack.match_discriminator']
+      user = User.find_by(id: user_id)
+
+      rack_attack_info[:user_id] = user_id
+      rack_attack_info[:username] = user.username unless user.nil?
+    end
+
+    Gitlab::AuthLogger.error(rack_attack_info)
   end
 end
diff --git a/config/initializers/transaction_metrics.rb b/config/initializers/transaction_metrics.rb
new file mode 100644
index 00000000000..0175d487e66
--- /dev/null
+++ b/config/initializers/transaction_metrics.rb
@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+Gitlab::Database.install_monkey_patches
diff --git a/config/routes/project.rb b/config/routes/project.rb
index 0e72e8631cf..c202463dadb 100644
--- a/config/routes/project.rb
+++ b/config/routes/project.rb
@@ -264,6 +264,7 @@ constraints(::Constraints::ProjectUrlConstrainer.new) do
             get :commits
             get :pipelines
             get :diffs, to: 'merge_requests/diffs#show'
+            get :widget, to: 'merge_requests/content#widget'
           end
 
           get :diff_for_path, controller: 'merge_requests/diffs'
diff --git a/config/routes/repository.rb b/config/routes/repository.rb
index 1ea0ae72614..b89e1c7f9af 100644
--- a/config/routes/repository.rb
+++ b/config/routes/repository.rb
@@ -52,7 +52,10 @@ scope format: false do
     end
 
     get '/branches/:state', to: 'branches#index', as: :branches_filtered, constraints: { state: /active|stale|all/ }
-    resources :branches, only: [:index, :new, :create, :destroy]
+    resources :branches, only: [:index, :new, :create, :destroy] do
+      get :diverging_commit_counts, on: :collection
+    end
+
     delete :merged_branches, controller: 'branches', action: :destroy_all_merged
     resources :tags, only: [:index, :show, :new, :create, :destroy] do
       resource :release, controller: 'tags/releases', only: [:edit, :update]
diff --git a/config/sidekiq_queues.yml b/config/sidekiq_queues.yml
index 25fd65d8644..80791795390 100644
--- a/config/sidekiq_queues.yml
+++ b/config/sidekiq_queues.yml
@@ -94,6 +94,7 @@
   - [migrate_external_diffs, 1]
   - [update_project_statistics, 1]
   - [phabricator_import_import_tasks, 1]
+  - [update_namespace_statistics, 1]
 
   # EE-specific queues
   - [ldap_group_sync, 2]
diff --git a/config/unicorn.rb.example b/config/unicorn.rb.example
index 4637eb8bc6e..581fde84c95 100644
--- a/config/unicorn.rb.example
+++ b/config/unicorn.rb.example
@@ -88,9 +88,21 @@ before_exec do |server|
   Gitlab::Cluster::LifecycleEvents.do_master_restart
 end
 
+run_once = true
+
 before_fork do |server, worker|
-  # Signal application hooks that we're about to fork
-  Gitlab::Cluster::LifecycleEvents.do_before_fork
+  if run_once
+    # There is a difference between Puma and Unicorn:
+    # - Puma calls before_fork once when booting up master process
+    # - Unicorn runs before_fork whenever new work is spawned
+    # To unify this behavior we call before_fork only once (we use
+    # this callback for deleting Prometheus files so for our purposes
+    # it makes sense to align behavior with Puma)
+    run_once = false
+
+    # Signal application hooks that we're about to fork
+    Gitlab::Cluster::LifecycleEvents.do_before_fork
+  end
 
   # The following is only recommended for memory/DB-constrained
   # installations.  It is not needed if your system can house
diff --git a/config/unicorn.rb.example.development b/config/unicorn.rb.example.development
index ae3dc2e37e1..9a02d5f1007 100644
--- a/config/unicorn.rb.example.development
+++ b/config/unicorn.rb.example.development
@@ -21,9 +21,21 @@ before_exec do |server|
   Gitlab::Cluster::LifecycleEvents.do_master_restart
 end
 
+run_once = true
+
 before_fork do |server, worker|
-  # Signal application hooks that we're about to fork
-  Gitlab::Cluster::LifecycleEvents.do_before_fork
+  if run_once
+    # There is a difference between Puma and Unicorn:
+    # - Puma calls before_fork once when booting up master process
+    # - Unicorn runs before_fork whenever new work is spawned
+    # To unify this behavior we call before_fork only once (we use
+    # this callback for deleting Prometheus files so for our purposes
+    # it makes sense to align behavior with Puma)
+    run_once = false
+
+    # Signal application hooks that we're about to fork
+    Gitlab::Cluster::LifecycleEvents.do_before_fork
+  end
 
   # The following is only recommended for memory/DB-constrained
   # installations.  It is not needed if your system can house