GitLab Pages | Hacker News Reader

GitLab Pages

pages.gitlab.io

812 pointswebiad291 comments

Dear lord these guys are putting in work. I'm not exactly a huge supporter of Github (the company not the product) so I'm very glad to see it. I look forward to their continued growth.

Yeah, but I wish they'd give more credit where due.

On their markdown page they claim "For GitLab we developed something we call "GitLab Flavored Markdown" (GFM)." while that is obviously a ripoff of GitHub Flavoured Markdown.

GitHub Flavored Markdown is itself a rip of the markdown standard. Is it giving enough credit to markdown for GitHub to include the word "markdown" in the name? If so, then by extension it should be sufficient for GitLab to include "flavored markdown" in the name. ;)

Thats a good point! I did not see it that way.

The many "standards" of Markdown also now include CommonMark [1]. There is also some interesting history as to why it is not named "Standard Markdown".

[1] http://commonmark.org/ [2] https://blog.codinghorror.com/standard-markdown-is-now-commo...

Man, as much as I admire and respect his intelligence, sometimes Gruber can be quite unreasonable.

Yeah, after reading that I came away with a really REALLY sour taste in my mouth. What got stuck in his craw and died?

It's also especially annoying when you consider that Gruber seems opposed to the idea of anyone else fleshing out Markdown properly, but he's not doing anything himself. At some point what he did with Markdown was basically just squatting on it himself, making any improving of it at the source impossible.

I think phrasing it as "also now include CommonMark" is a little misleading, it has been around for a few years now and the entire goal is to take the quotes off of the "standards" to actually have a Markdown specification. The drivers behind it also include (IIRC) GitHub and StackExchange.

That said, I did not notice the "GitLab Flavored Markdown" in the story link but I'll be fairly disappointed if it is actually "yet another Markdown pseudo-standard" and not CommonMark.

I agree we should give attribution here and created https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/3546 to do so. Edit: this was merged.

This is why I like GitLab! Thanks for doing this :)

You're not only productive at shipping quality features but also listening to people using your product! This makes me even happier to be using it at work :)

Thank you for your kind words. Two funny things:

1. We're now at Git Merge http://git-merge.com/ and I'm looking forward to presenting at 4pm Eastern.

2. I said it was merged but Douwe used our Merge when build succeeds. A HN reader commented about a mistake and I was able to fix it in https://gitlab.com/gitlab-org/gitlab-ce/commit/79d6513f360d7... Thanks Greg!

@dang I'm sorry for this. Please understand I was inebriated when I posted this comment, but I will always appreciate your work and if you ban me for the following comment, I understand.

-------------------------------------------------

syste - I love you man. You are an amazing CEO. Your company does great work and has a great product. I always become so happy when I see you actively responding to the comments here. You are a role model CEO.

Something so many companies overlook is actually listening to their users and taking their feedback seriously. I love you man, if you wrote an autobiography I would buy it. Congratulations to you and your team.

Thanks! Glad to know if I write something about myself it will have a minimum of two buyers (my mom is very supportive too).

I like to write about business stuff most. Any merge requests on our handbook https://about.gitlab.com/handbook and strategy https://about.gitlab.com/strategy are appreciated.

styse, you are a great motivation for the product company I run. I checked your strategy page and you are planning to integrate with NetSuite. Why not something open source for finance? ERPNext?

disclaimer: I am the founder of erpnext

Thanks for your kind words. ERPNext looks cool. We try to use open source where we can although we also try to use boring solutions. In this case we already completed the NetSuite implementation so we're not in the market at the moment. BTW I'm not sure ERPNext is ideal for our use case, we would need multi-company consolidation.

The lines with soft line breaks (double spaces at the end) appear to have had their trailing whitespace trimmed, which ends up looking like:

    Roses are red Violets are blue
    
    Sugar is sweet

rather than:

    Roses are red
    Violets are blue
    
    Sugar is sweet

Sorry, I'm committing from The Git Merge conference and didn't have the time. It should render OK. Feel free to submit a merge request to fix it.

You know what's even better to me than GitHub-Flavoured Markdown? Markdeep:

https://casual-effects.com/markdeep/

Demo:

https://casual-effects.com/markdeep/features.md.html

Yes, I know they likely provided it for compatibility, but markdeep is just too cool to not mention.

I do hate the fact that they use yet-another-markdown-flavour.

I wish they'd move over to CommonMark, which actually attempts to standardize Markdown once and for all.

>Dear lord these guys are putting in work.

man I wish they would bring something new, cool and innovative to the space, instead being bent on doing feature-by-feature copy of github.

They have an amazing opportunity now to take advantage of github fatigue. But they are throwing it all away by trying to become an inferior clone of github.

It has integrated CI whereas GitHub requires using a third-party CI system, it's had Reaction Emoji (called Award Emoji for GitLab) for a while now, it has "Merge when build succeeds", CE is entirely FOSS, etc.

Thanks! People also seem to like our new todo's https://about.gitlab.com/2016/03/02/gitlab-todos-feature-hig... that allow you to respond to what's important even if your mailbox is a mess.

I'd honestly be really surprised if Github didn't end up acquiring one of those CI systems which they already integrate with.

I'd be surprised if they did. I really don't see a business reason for them doing so. They are clearly laser focused on enterprise, which means massively bespoked internal build systems and work flow. And they'll be competing against a lot of entrenched internal solutions.

GitLab and Atlassian have a pricing model for displacing existing systems and encouraging adoption, but I can't see GitHub following suit. GitHub looks to like they want to be the Apple in the Apple vs Android. Android has the largest user base but due to Apple's premium pricing, they have the largest profit.

There seems to be a healthy competition between various ci software that works with github. Why would github try to kill that and take on such a high touch area.

Its quite puzzling why gitlab went that route, they are basically discouraging ci systems from integrating with them. I think this is would turn out to be a bad decision for gitlab.

Well, their CI is pretty good for starters... compared to self hosting jenkins, or paying for Travis CI. Self hosting gitlab integrated CI runners is a big plus for me.

As a third party service provider you could still host and/or modify those CI runners for specific tasks like node, go, etc.

Thanks tiplus!

And to give some additional background to dominotw's question. We didn't like the options for CI on-premises. And by integrating it directly into GitLab it is very easy set up a new project, encouraging people to use CI on more projects.

Having people use GitLab CI will mean GitLab is a less attractive platform for other CI products. We do have a good commit status API since GitLab 8.1 and there is a great Jenkins plugin that supports that http://doc.gitlab.com/ee/integration/jenkins.html

Requirements likely driven by sales/marketing team: either they see the gap or they hear it from potential customers.

They do have some differences if you look close enough.

I’m a juuuuge GitHub supporter, but let me provide a different perspective: In business, there is product innovation and there is also business innovation.

Sometimes, you provide exactly the same product, but the way in which you do business around that product is the innovation. For example, a 100% open-source implementation of the JVM needn’t provide any technical innovation whatsoever: The innovations are in how it’s developed and how it’s licensed.

I won’t speak to whether GitLab is providing any business innovation or not, I’m just pointing out that if they are, that’s something of value in its own right.

They were getting a lot of heat when they refused to copy GitHub, because a lot (most?) of GitHub's features are just obvious and helpful. So... being a clone shouldn't be your whole strategy, but you should still learn from the competition.

I especially like that they have added configuration options to the .gitlab-ci.yml. If I am not mistaken, this means your project can auto-deploy using an arbitrary build process. Here's what an example .gitlab-ci.yml looks like with a GitLab Pages build configuration: https://gitlab.com/pages/pages.gitlab.io/blob/master/.gitlab...

A couple friends and I made something similar for GitHub Pages using Travis CI as our static deployment build-and-deploy host. For example, here's what our .travis.yml looks like: https://github.com/L33T-KR3W/soundcasts-web/blob/master/.tra... and here is the actual deploy command that is being run to `git push` to GitHub Pages: https://github.com/L33T-KR3W/soundcasts-web/blob/master/pack...

The GitLab approach is cleaner and requires less tooling. Nice work!

Thanks!

You can indeed have a fully automated deployment. You could already do this with GitLab CI on an external server (S3 or anything else), but now you don't have to worry about hosting anymore.

We took inspiration from .travis.yml when designing the .gitlab-ci.yml file, but are continuing to add features and configurations that make it possible to work together with other GitLab features such as build artifacts and now Pages.

One of the big limitations of Jekyll + Github pages is you cannot use plugins..any plugins at all. If Gitlab's build process allowed for Jekyll plugins and custom domains, I may consider moving my pages there as well.

You can totally use Jekyll plugins since you can define any command in .gitlab-ci.yml. It's like running Jekyll locally.

And custom domain are supported as well. See the bottom of https://pages.gitlab.io

In fact, you don't even need to use Jekyll. You can use literally anything you want.

jekyll plugins are disabled for a good reason, otherwise you could basically execute anything you want on their server.

With the GitLab runner, you actually can execute anything you want on their server. It's sandboxed like any other CI service.

ICYI, you can run Jekyll + plugins on Bitbucket / Aerobatic:

https://www.aerobatic.com/blog/automated-continuous-deployme...

You can also provision a free wildcard SSL cert.

Disclaimer: co-founder of Aerobatic.

This is awesome. One question I have in comparison to GitHub Pages is if a global CDN is used and if there is effective DDOS protection built in. GitHub has to deal with regular DDOS attacks, and I imagine GitLab will have a few too. GitHub does a pretty good job with it, but before I move to GitLab Pages I'd like to understand that better but didn't see that info anywhere.

GitLab's hosted on Azure. I don't think Azure will fall over to a DDOS, you'll just wake up to a hefty bandwidth bill.

Not all DDoS is volumetric, and even in volumetric attacks it can be complex to differentiate legitimate traffic from the noise being generated by the botnet.

Effective mitigation is about far more than "How big is your pipe?" so this comment reads as somewhat uninformed.

tl;dr - Azure does not have a magic <SOLVE DDOS> button which someone pushes, fixes all kinds of attacks, and just charges you for this at $1175/hr whilst you sleep peacefully.

Right now, GitLab Pages is hosted on the same servers as GitLab.com, so it gets the same attention from our engineers in terms of reliability and uptime.

We're not using a global CDN, but this is something we will explore.

We're working on adding Cloudflare in front of GitLab Pages in https://gitlab.com/gitlab-com/operations/issues/75

We don't have a lot of experience yet with DDOS protection so there might be downtime as we learn that. As you can see in the issue we're working to implement protection before we need it but it might not be ready in time nor can it protect against everything.

Please do not use Cloudflare. Their 'protection' against privacy aware Tor users makes accessing sites through incredibly painful.

GitLab can just disable that...

Good idea, I made a note in https://gitlab.com/gitlab-com/operations/issues/75#note_4599...

For what it's worth Cloudflare does not do anything different for Tor than for regular IPs. Since those are static pages with most likely not exactly questionable content the use of Tor is probably not all that important anyways that the total number of users that might be affected would be miniscule.

>the use of Tor is probably not all that important anyways

Who are you to decide that my use of Tor is not important enough?

A site operator. It isn't censorship for someone to decide who they want to talk to.

CF is simply giving site owners levers to use if they so choose. While I am a strong supporter of Tor, privacy, and anonymity, CF has done nothing wrong here by allowing site operators to selectively choose who they wish to serve to.

Sounds a lot like censorship to me. It's discrimination at the very least.

Spam filters are discrimination, but I don't see anyone suggesting we stop using those.

Then go after the site owners who choose to enable this.

Isn't the problem along the line of so many different people using effectively the same IP addresses (exit points) and looking somewhat similar to each other?

I'd imagine if there was a major ISP network out there that was doing NATing or similar for their customers so everyone came from a small set of IP addresses they'd get the same treatment. More users on the same IP means more abuse from that IP. If anything Cloudflare isn't discriminating. To handle Tor users better you'd have to discriminate (technical definition, not the negative form) to handle Tor users better

I'm not sure what they are supposed to do if exit node ips have bad reputation.

I'll second this to amplify the message to please not add CloudFlare for all custom domains and if you feel you must add it then at least make it optional.

This would be an absolute showstopper bug which would prevent some of us from using GitLab Pages if it became a requirement. Definitely do not want.

In all fairness, Tor is something of a cesspool and cloudflare is doing the best they can[1].

[1] https://blog.cloudflare.com/the-trouble-with-tor/

Please consider https://blog.torproject.org/blog/trouble-cloudflare

Better to ask about their minimum availability guarantee. Knowing that the servers can handle a DDOS attack is of little value if the service goes down for maintenance every day (just to give an example).

GitLab.com runs the same GitLab as our users and some upgrades require downtime. Other operations should not require downtime, we have multiple application servers and load balancers. The backend services are HA except the file storage until we complete the move to CephFS.

Why did you guys choose Ceph instead of OpenStack Swift? Just curious.

I'm not sure whether we've seriously considered Swift, but high bandwidth is important to improving our performance, one area in which Ceph seems to be the better choice [0].

[0]: http://www.sparkmycloud.com/blog/a-performance-review-of-swi...

IIRC there was an issue (in Ceph) with performance in the case of many small files. Is that solved now?

Swift only provides object storage and we need block storage.

This is great -- it has a killer feature that I think GitHub Pages is sorely missing (unless it exists and I'm just ignorant to the fact). Custom domains WITH SSL.

Right now I have my custom domain set up on GitHub, but it's not SSL. I would love to be able to do that.

Just for reference—you can achieve this if you run your site behind CloudFlare. I run my own blog this way.

That's not truly end-to-end encrypted though, right? The server -> CloudFlare goes over HTTP.

When using GitHub Pages, the server -> CloudFlare goes over unauthenticated HTTPS (using the HTTPS "not strict" option), which means it is resistant to passive attackers but vulnerable to active MITM attackers.

Do you have to hand over your private keys for that?

You do but you would likely make a new key for this specific domain so you don't have to hand over any important keys.

How would you do that without handing over your private keys? Otherwise gitlab couldn't serve your site. Also, as soon as you point an A record of your domain to somebodies server, they're able to get valid certificates through acme (which is probably what they do). If you don't trust somebody, don't point your domain to them.

> How would you do that without handing over your private keys?

CloudFlare has that figured out https://www.cloudflare.com/keyless-ssl/

It depends on your goals.

If your goal is to tick a compliance box saying "no third-party has access to our private key" or "our private key never leaves our DC", then they have it figured out. If you want an additional barrier between your web server and your private key for Heartbleed-like vulnerabilities, this is also viable solution.

If your goal is to have end-to-end encryption between your server and a visitor, or hope this is going to protect you in case CloudFlare or GitLab are owned, then this isn't a real solution. CloudFlare has access to your session keys, and if they're owned, those can be logged and used to decrypt traffic. Even with a leaked private key, older sessions would be safe thanks to PFS ciphers, so Keyless SSL doesn't really change anything here.

It's entirely possible that GitLab could integrate Let's Encrypt and generate their own private keys. Some large shared hosting providers already do this (e.g. DreamHost).

Keys are cheap and plentiful, just regenerate & reissue however often you like. The paid CAs I've used do free reissues with new CSRs no problem. You are already trusting them to serve your site so adding a private TLS key isn't a big deal.

The only downside I could think of is if you are using HPKP with a long duration, you could have issues with rapidly changing keys. But I wouldn't expect GitLab Pages to support setting those headers so probably another non-issue.

We are already considering that and given past experience it is a quite simple process: https://gitlab.com/gitlab-org/gitlab-ce/issues/14926

GitLab CI Lead

Clourfare provides free SSL - just proxy through them.

edit: disregard, I was wrong.

If I'm not mistaken, you have to change the DNS of the domain to something *.cloudflare.com to be able to use their service, so it won't work in this scenario.

It will. There is no need to change the nameservers of the domain for Github/Gitlab.

But the traffic after cloudflare's proxy is plaintext right?

I know CloudFlare has better thing to do than sniffing websites but I don't see the point of installing an SSL certification using clouflare or any other third-party which will handle traffic the way they do. You don't own the certificate, they do.

That's one option; they also offer strict SSL on both sides of the connection: https://www.cloudflare.com/ssl/

How would that work if Github pages don't support SSL?

GitHub supports SSL for *.github.io so you can have your custom domain with SSL on CloudFlare, and CloudFlare can proxy https://example.github.io/... on the other side.

eg: End User <--> https://example.com <--> CloudFlare <--> https://example.github.io

Rewriting the Host header in this way requires a non-free CloudFlare plan.

It won't. http://stackoverflow.com/a/28457335/239657

(1) Last I checked, cloudflare's "Strict SSL" mode only accepts from the backend a cert for the custom domain you're trying to serve, not accepting the github.io cert. A pity they don't let me configure what cert(s) to accept from the backend...

(2) In addition, Github have indicated their current github.io SSL is not actually end-to-end secure — it's only secure from their CDN (Fastly) but their link to the CDN is unsecure. So there is absolutely zero you can do — Cloudflare or anything else — to make GH Pages end-to-end secure on custom domains.

There are several problems with it:

1. the certificate is not generated by you (in the Free or the Pro plan) but by them and these certificates are for multiple domain names. So you end up sharing your certificate with other domains / websites of dubious nature that are also on CloudFlare's network.

2. CloudFlare only secures the connection between users and the CloudFlare network. It does not secure the connection between CloudFlare and your hosting service, unless your hosting service also supports TLS/SSL connections and you activate their Strict SSL option.

For the purposes of hosting a project website, secure connections are more important than ever due to the potential of external attackers, which could very well be a government institution, to infect distributed binaries or source code. Instances like XcodeGhost will become more common imho. And a secure connection between your user's browser and your hosting server is not 100% secure, but it's a good start. And towards that purpose CloudFlare Free in front of GitHub Pages isn't very good ;-)

Why is #1 an issue?

If a domain that you share your certificate with has their certificate revoked or is blacklisted for any reason this could have a negative impact on you.

It's a single certificate that never leaves CloudFlare's hands so revocation seems unlikely and they'd manage it for you if anything came up.

I've been wondering about this. I share mine with several shops that appear to be selling low-schedule drugs on the clearnet.

Don't know what the implications for that are, except that someone poking around the validity of my SSL certificate will establish that mine is a free tier Cloudflare one.

> https://konklone.com/post/github-pages-now-sorta-supports-ht... > https://sheharyar.me/blog/free-ssl-for-github-pages-with-cus...

Looks like you can, ("sorta")

Gitlab is still super slow even compared to young projects like gogs. I know many ppl who shied away for gitlab due to its slowness.

If I was them, I would stop all copycat 'me too' features like ci/pages ect and put the resources to making it faster. This is a sign that their features are pritorized by business ppl who want to put features on their slides .

What is the latest version you have tried?

We've made a lot of changes to GitLab in the last number of releases that make GitLab a whole lot faster [0], but we recognize that the performance of GitLab.com can still improve quite a bit.

For low-memory machines, we do recommend people to use Gogs.

[0]: https://about.gitlab.com/2016/02/22/gitlab-8-5-released/

Wow nice improvements, i hadn't noticed this. Gitlab.com seems a lot snappier.

Good to hear! Let us know what we can improve.

gogs was designed from the start to be fast. Nothing but a rewrite would make GitLab as fast as gogs for basic stuff on small self-hosted servers. For basic uses, the resources required for the platform of GitLab (rails) is greater than the resources required to use all of gogs.

Gogs will always use less memory and cpu. We are working to make GitLab page loads very fast.

I fear in most cases an impressive feature list wins over speed.

Speed is an impressive feature and we're working hard to improve it.

Same experience here. I use Gitlab for my personal projects and Github for my open-source projects. Hopefully the speed improves soon.

We're on it in https://gitlab.com/gitlab-com/operations/issues/42

Sorry that we're not there yet.

This is the trouble for me using Gitlab.com. Feels like there is a lot of 'n+1' going on in the background. I'm sure there aren't, but it feels like a Rails app that is suffering from that.

Other than that it's great. I've moved nearly everything over from GitHub

There are certainly a lot of queries we have and will optimize, to see the work see https://gitlab.com/gitlab-com/operations/issues/42

BTW to prevent simple N+1 queries we use the Bullet gem https://gitlab.com/gitlab-org/gitlab-ce/blob/7ff974e38e24a9b...

Really interesting, thanks. I will look through the work you're doing

One of the nice things about Phabricator is its performance. It originated at Facebook, and they are using massive, monolithic monorepos.

I just tried browsing some of the online repos, and I was impressed with how bad the loading delays were.

I really like GitLab, we use it and they follow the business model I wish GitHub had. But as they become bigger and bigger I have to wonder how much longer until they start antagonizing GitHub with these feature clones, and who should have my support when that day comes.

I'd say that it's a pretty easy choice. Pick the open source one.

Only Gitlab CE is OSS, GitLab EE is "publicly viewable" but neither FOSS/OSS [1].

It's really a shame because I would pay good money to have GitLab EE under a FOSS license.

[1] https://about.gitlab.com/license-faq/

Out of curiousity, would you consider GPL Affero sufficiently FOSS?

> Out of curiousity, would you consider GPL Affero sufficiently FOSS?

Of course it's a free software license (although I have my doubts about the enforceability of the Affero sections in the AGPL). GitLab EE is proprietary (even though you can read the source).

As long as we're talking about the GNU AGPL then absolutely! I would say that the original AGPL is sufficiently FOSS but it's GNU GPL incompatible which might be annoying. It's not necessarily a deal breaker though if it's handled well.

> As long as we're talking about the GNU AGPL then absolutely! I would say that the original AGPL is sufficiently FOSS but it's GNU GPL incompatible which might be annoying. It's not necessarily a deal breaker though if it's handled well.

It's GPLv2 incompatible. GPLv3 has a special exception for the AGPL.

We initially had GitLab EE under the MIT expat license. But this proved to be a problem for potential customers, their purchasing department didn't understand. We also like that now we can store the EE source in a public repository that accepts merge requests.

I am usually in the Open Source camp, but I don't think the choice is so easy here. Not only does GitLab copy GitHub, it does so by relying on a lot of Open Source sofware written by GitHub and/or GitHub employees.

You may like GitHub or not, but you cannot deny they contribute a lot to Open Source. I am not entirely sure how much that has changed since his resignation, but here is Tom Preston-Werner's position on Open Source: http://tom.preston-werner.com/2011/11/22/open-source-everyth...

>Not only does GitLab copy GitHub, it does so by relying on a lot of Open Source sofware written by GitHub and/or GitHub employees.

That seems like a bizarre complaint, considering git itself is FOSS, initially written by Linus, and that GitHub's entire business is effectively built around hosting git repositories.

GitHub contributes back a lot to git itself.

You could support both of them. Support GitHub in defending their product from blatantly being copied, and support GitLab in preserving their momentum while making changes to their product so it doesn't look and behave quite so much like GitHub.

I was wondering if GitLab provides a Markdown editor that could be used by non-technical users directly from the web interface? Something like Prose[1], Dillinger[2] or StackEdit[3].

Of course you could argue if it's in scope for a project like GitLab, but it means that I could use static site generators for projects where non-technical users need to edit the content without ever thinking about a CMS.

Would be nice:

- if it would also provide an easy upload/commit of images to some configurable directory from that Markdown editor;

- configure a content-editor user that's restricted to a subset of directories;

- allow the user to preview the full website without pushing to the live environment;

- use a tag or branch to mark the version that can be pushed to the live environment.

It would probably be the most flexible CMS that's available right now.

[1] https://prose.io/ [2] http://dillinger.io/ [3] https://stackedit.io/

I'd like to have that too!

FYI for the GitLab guys: 404 pages are being served without a Content-Type header (e.g. http://pages.gitlab.io/404/ -- shows HTML in plain text).

Great start. The obvious missing feature is Let's Encrypt support. I would like to see hosting companies like GitLab implement HTTPS for 100% of their served pages, and Let's Encrypt is a key enabling technology to do so.

This is a great idea.

I believe we've looked into this before, but I couldn't find anything, so I've created an issue[0].

[0]: https://gitlab.com/gitlab-org/gitlab-ce/issues/14926

edit:

Found the original issue:

https://gitlab.com/gitlab-org/omnibus-gitlab/issues/1096

For this sort of thing, I've had great success sticking arbitrary services behind an nginx reverse proxy on the same network and terminating the SSL at the proxy.

This is great news, Gitlab really is coming along very, very fast. Does it say anything about where the sites are going to be hosted? Are they using AWS underneath or something? It's curious timing since literally just the other day I moved my Hugo site to Bitbucket + Aerobatics. But since I have all my other stuff on Gitlab already, it'd be kinda convenient.

I believe they are using Azure underneath, but someone from the gitlab team should probably confirm.

GitLab.com is running on Azure, so are GitLab Pages.

Link to https://www.aerobatic.com/ which now supports Node. I'm too lazy to switch from GitHub Pages though.

The custom runners and the ability to view the results of a build are killer features. I really hate GitHub's cryptic "something went wrong" emails.

Glad to hear you like this model!

We want you to be able to run anything. Any static site generator, any kind of script. Using our own CI seemed to make sense.

Just want to shout out that you can actually get HTTPS on your custom domained Github Page now with Kloudsec[1]. We actually built a dedicated onboarding tool for this: https://kloudsec.com/github-pages

[1] Kloudsec is a CDN for programmers

Is the connection between your servers and the GitHub Pages servers unencrypted?

Yeah, Kloudsec is being disingenuous here.

Two questions: 1. Does this work with private repos? 2. Are there traffic limits? (use case e.g. when I reach a HN Top 10 ;)

According to their documentation [1] it does work with private repos.

[1] http://doc.gitlab.com/ee/pages/README.html

1. Yes, you can use Pages with private projects

2. No, there are no traffic limits.

thanks for your reply jobvandervoort! Are not you afraid that people will use gitlab as cheap hosting service? So what are the limitations on content I can host there? Policy? Can I use it for commercial usage?

We hope people will use it to host their websites.

You can host almost anything there, excluding illegal content.

Commercial content is fine.

Very nice!

Suggestion: if you use a CDN or other methods to improve the performance make sure to point it out in the landing page.

Keep up the good job.

Thanks, we're trying to do a better job communicating everything we have and can do and will definitely do so in this case!

FYI: I've tried it out (it seemed too good to be true) but it worked: I've created a website and the repo itself is private. How cool ist that? :)

My only issue with Gitlab is that the entire product initially started off as a completely ripoff of Github.

Considering what Github does for the open source community in general, that somewhat bothers me.

One of the founding principles of open source is that you can take a copy of someone's work and make changes to it (as long as you continue to make the changes public).

Github isn't open source so the analogy doesn't quite hold, but they're creating something and giving it to the community (as well as building a business).

> One of the founding principles of open source is that you can take a copy of someone's work and make changes to it (as long as you continue to make the changes public)

Also as long as you acknowledge it. It’s acceptable to copy a FOSS project and make a new one on top of it but you have to mention it; you can’t just create a copycat and claim you invented everything by yourself, especially if you start making money off it (well some licences let you do that but that’s not ethical).

The guys at GitLab are usually quite open about this sort of thing (having copied this and that, etc). I don't think they've ever claimed to have invented anything they have not.

We indeed try to be open about it. Let us know if we should improve the attribution somewhere, in this thread we already made a fix in https://news.ycombinator.com/item?id=11432400

Poor privately held, closed-source, for-profit corporation :(

Congrats on new major feature. One thing I'd like to see developed further is support for per-branch pages. Right now it looks like you could jerryrig a build script that builds each branch in its own subdirectory, but that sounds bit suboptimal considering that any commit will trigger full rebuild of all branches.

Can you elaborate a bit more? Because you are able to restrict builds to certain branches.

Why not have multiple projects in your case?

For example if you have version branches like v1.3 and v1.4 etc, you'd want to have docs built for each branch and publish them like myproject.gitlab.com/v1.3/... etc

I think GitLab overtook GitHub about UI.

Sad to see it's only available self-hosted on GitLab EE. I would _love_ to see this on CE.

Nice! Finally a good documentation for GitLab pages. This was literally the only missing feature() that made me keep a GitHub account.

() and by missing feature I mean "I never thought it was as good as GH product."

Glad you're able to completely move to GitLab now.

Still looks like GitLab EE only :(

>If you are using GitLab.com to host your website, then:

>The general domain name for GitLab Pages on GitLab.com is gitlab.io.

>Custom domains and TLS support are enabled.

>Shared runners are enabled by default, provided for free and can be used to build your website. If you want you can still bring your own Runner.

GitLab.com runs GitLab EE, which you can use for free.

We considered bringing it to CE. But we still think this is more useful if you run a server with a lot of developers, our criteria for EE features as listed on https://about.gitlab.com/about/#stewardship

Our thesis is that if you have less users you likely have less sites and you can set up a normal CI jobs to deploy it.

This is a moot point to anyone running GitLab CE though.

I was a little short in my reply, my apologies.

Sytse explained our vision below [0]. We're always open to discuss this further.

[0]: https://news.ycombinator.com/item?id=11432614

(Disclaimer: I wrote b3cmd)

We have a wildcard DNS entry pointed at our server and we use b3cmd[1][2] for static servers. It also handles docker-compose projects. SSL everywhere, CORS supported, branches / namespaces supported. Pretty great so far.

[1]: https://github.com/mikew/b3cmd [2]: https://github.com/mikew/b3cmd-server

I thought that, too. But on the other hand if you're running your own private instance what's really the point of serving up statically generated pages from GitLab instead of just directly off your own HTTP server of choice?

There's less stuff to manage if you're serving up pages from a selfhosted Gitlab instance than actually serving up the repo directly.

> GitLab Runners do not offer secure isolation between projects that they do builds for. You are TRUSTING all GitLab users who can push code to project A, B or C to run shell scripts on the machine hosting runner X.

Not sure this sounds like the best idea.

This can easily be avoided by provisioning your own runner. In that case, it'll be isolated for the projects of your choosing.

It's important that we note this, as we do provide free runners for anyone to use on GitLab.com.

Well, there is an issue for that[0]. Also, as of today[1], all shared Runners on GitLab.com are each on their own VM inside Docker containers, so that message does not apply for sure.

[0] https://gitlab.com/gitlab-org/gitlab-ce/issues/14732 [1] https://about.gitlab.com/2016/04/05/shared-runners/

Exactly what I thought, so that message should probably be updated?

I a huge fan of Gitlab and have seen them grow since when I started using them. This is a great new set of features. Looking forward to trying this out!

Great to hear! Let us know how it worked out for you.

Nice! I love Gitlab, use it for all my personal stuff currently and wish I could use it for more! sytse and team, thanks for the great product.

Great to hear! What else would you like to use it for that GitLab can't do now?

Thanks! Please let us know what we can do to have you use it for work too.

Nice! Very happy to see the ability to integrate with Doxygen for automatic documentation generation from source code :)

Git + Gitlab CI + gerrit. Working awesome for us.

Awesome. Gitlab is following Github well.

I really love using gitlab.

Must be nice that your entire roadmap is written for you =) no shame in straight up copies.

Yes. I lobbied several companies to terminate their enterpise contracts with github because of their racist attitudes. All switched within 2 weeks. Some to VS Team Services, some to Gitlab. My work projects went to MSFT, but I think I will transfer my side projects to gitlab from bitbucket, since they have pages now.

Racist attitudes? Interesting - not sure what you're talking about. Could you link a source?

TheLogothete is probably talking about http://www.businessinsider.com/diversity-guru-discusses-whit...

http://static4.businessinsider.com/image/56b3d2f12e526555008...

http://static2.businessinsider.com/image/56b3d2462e526543008...

Their new 'social impact team' isn't a fan of white people

https://twitter.com/_danilo/status/690601512813367297

http://www.breitbart.com/tech/2016/02/08/report-anti-white-a...

Wow, that tweet is blatantly racist. I'm somewhat surprised that this wasn't made into a bigger deal. Or, if it was, that I somehow missed it.

Holy shit. That's some of the most egregiously racist things I've seen and I'm not white! No business from me, ever!

Elaboration : I feel like apologising for the knee jerk reaction. A tweet I would forgive, but that corporate slide in a corporation that aggressively claims to be social, inclusive, community etc. is simply terrible hypocrisy.

But anyway I checked with my PM and my team uses self hosted gitlab and the decision was purely technical :)

geez. i hadn't seen that tweet. crazy. i would love to consider gitlab as an alternative. need to plan on migrating my repos and gists over first. i can't support that type of culture. not today. not ever.

Gitlab has migration tools for most of your github thingies (wikis, issues, prs, etc).

You should be able to migrate quite easily without losing too much history.

http://doc.gitlab.com/ee/workflow/importing/import_projects_...

Well granted, they are making an impact.

It might not be the impact they wanted.

It reminds me of how ardent fans of <anything> (programing language, framework, brand, etc) are usually its worst enemies. But doing what they are doing, they are working for the opposition in fact.

Ironically, if white people were in charge, history suggests we'dve definitely done a better job of subtly excluding the "wrong" people without being explicit about it.

It hasn't stopped them from hiring white men, don't worry

> racist attitudes

Do you mind explaining this a little bit?

Here is a whole thread about it. https://news.ycombinator.com/item?id=11049067

Do you have a link to anything I could read up on regards to the "racist attitudes" you mention? Genuinly interested. I have heard some negative things about their environment, but nothing regards to racism.

EDIT : I see the links below now.

Im still amazed how people actually have time for this SJW stuff in the actual real world.

Thought I'd leave it here given that I just googled the term: https://www.urbandictionary.com/define.php?term=SJW

How have you managed to escape it for this long? Seriously, what's your secret please for the love of God let me know

Not the person you replied to, but I personally avoided it for a long time by avoiding the comments on [political/news/gender]-focused forums and subreddits. It isn't exactly a mainstream term.

yes, sometimes stuff happens to "ordinary people" and their life is ruined. They have no choice but become participants rather than mere by standers that is how social change happens. ( edited for grammar)

Does that extend to how you actually had time to comment just for the sake of casting some pejorative insult at another random stranger on the internet?

Yes, how do you do it?

It's gotten to the point where the use of SJW is just shorthand for "I know I'm wrong, I just preferred it when people knew their place"

In my experience, SJW is a term for people who are not actually working to improve the state of affairs of the world in terms of 'social justice', but rather people who have bought into a very specific, irrational, and blatantly hypocritical ideology.

This distasteful subculture really exists, and - as with anti-vaxxers, birthers, the chemtrail people, white supremacists and other irrational movements - it poses a fundamental threat to the values on which reasonable discourse is built. People who are immersed in SJW culture (as with those other subcultures just mentioned) become increasing comfortable rejecting reason and facts. Imo all thinking people ought to be at least as concerned about today's SJWs as they are about those other movements.

SJW is a pejorative, plain and simple. It means "shut up and stay in your place". In this particular case, the post I was replying to[0] was referring to a post[1] that I'm pretty sure was referring to racism against white people. Take that as you will.

[0]https://news.ycombinator.com/item?id=11431762

[1]https://news.ycombinator.com/item?id=11431107

> SJW is a pejorative

So? 'Racist' is also pejorative. Racists exist and we ought to be able to discuss their existence and harms. SJWs exists and we ought to discuss their existence and their harms as well.

> It means "shut up and stay in your place"

I literally laughed out loud on reading this. Of course SJW doesn't mean anyone should stay in their place. Where do you get this outrageous idea? And what is that place, to you?

> In this particular case, the post I was replying t

I can't speak to the motives and thoughts of this particular speaker, but it seemed to me you were making a generalization about what 'SJW' really means, and making unwarranted claims about what we should be able to reliably infer from the mere use of the term.

> So? 'Racist' is also pejorative. Racists exist and we ought to be able to discuss their existence and harms. SJWs exists and we ought to discuss their existence and their harms as well.

What is a SJW?

> I literally laughed out loud on reading this. Of course SJW doesn't mean anyone should stay in their place. Where do you get this outrageous idea? And what is that place, to you?

I literally hope you enjoyed laughing out loud. What does SJW mean to you?

> I can't speak to the motives and thoughts of this particular speaker, but it seemed to me you were making a generalization about what 'SJW' really means, and making unwarranted claims about what we should be able to reliably infer from the mere use of the term.

You can't speak to this particular speaker's motives, but you can to mine? What does SJW mean to you?

I've already stated what SJW means to me, namely, the person using it is stating "I know I'm wrong, I just preferred it when people knew their place"

If you'd like me to expand upon that, I'd be glad to. I just don't understand where you're coming from.

Sensitive people enjoy being outraged.

Don't confuse being sensitive with being wronged.

No matter one's ethnicity, one should be against discrimination.

I don't think I should be hired to run gender initiatives. Guess I'm a sexist.

Would you want to work at a company which has a bullet point "some of the biggest barriers to progress are white women"? That one struck me as particularly egregious. If you said that completely out of context, the average person is going to picture this coming out of some chauvinist white male. Ironically, it's coming out of people aiming for "diversity".

Even in context, apparently the background is an article called the "Trouble With White Women" (http://www.racismreview.com/blog/2014/01/28/trouble-white-wo...). It's hard to take seriously this article when it pretty much begins with the well known "friend argument" used by racists everywhere (http://rationalwiki.org/wiki/Friend_argument).

While these people may be discussing some legitimate biases, countering racism / sexism with reverse racism / reverse sexism is completely wrongheaded.

I suggest you read the criticisms of 1st and 2nd wave feminism. Historically, mainstream feminism has not been supportive of women of color.

I remember when github adopted the Code of Conduct, it was a clear sign for me that it was time to switch. All they need now is the equivalent of Twitter's "Safety Council" to complete the SJW combo.

They should have just had the Code of Conduct from day 1 and not waited until they had an incident to overreact to. I've worked for many places with Codes of Conduct and diversity programs and they are usually run pretty well and are not heavy-handed or staffed with exuberant amateurs. There are proven benefits and established best practices to get it done.

The problem isn't with codes of conduct in the abstract, but with the specific code of conduct that GitHub used. It explicitly permits racism, sexism, and cisphobia as long as they aren't against the wrong groups:

> Our open source community prioritizes marginalized people’s safety over privileged people’s comfort. We will not act on complaints regarding:

> ‘Reverse’ -isms, including ‘reverse racism,’ ‘reverse sexism,’ and ‘cisphobia’

This reads like a parody. An actual successful company thought this deserved codifying?

What are the proven benefits?

Summary of research http://www.forbes.com/sites/ekaterinawalter/2014/01/14/reapi...

Since you turned this into a discussion about race, I am inclined to speak up. Racism and discrimination is about who has power. Caucasians in America have all the power and hence the struggle of the minorities for equality. I admire github for taking a stance in the diversity debate( although I have yet to fully familiarize with the details). I know that people from all demographics desire equality and a more fair world. I'll work towards that world and keep build things.

Racism and discrimination have nothing to do with power. You're redefining the word so that it allows a particular group to engage in discriminatory behavior while avoiding accountability.

The previous speaker, who is definitely involved in an agenda driven redefinition of a word, probably has no conscious desire to engage in discriminatory behavior while avoiding accountability. S/he is almost certainly a well intentioned enabler of those who do wish to engage in discriminatory behavior while avoiding accountability

I'm having difficulty understanding the distinction. Does rewording it make it something it isn't?

Apologies if I misunderstood, but I think you are asking me to clarify that I'm making a distinction between (a) one person allegedly having dishonest intentions and a conscious motive to do X and (b) that same person having better intentions, and doing X by accident.

The phrasing of the parent was "You are doing A so that B can happen.", which I thought was presumptive and unfair towards the other party.

I've known a lot of people who participate in the subculture of SJWs, and I'm confident that many of them have no conscious desire to be enablers of hatred and bigotry, not even hatred and bigotry towards white males. They simply don't understand the consequences of their beliefs.

Racism and discrimination are not exclusively about 'who has power', unless you abandon the existing and widely accepted usages of those words in favor of an agenda driven re-definition of the terms.

> Caucasians in America have all the power

This does not excuse anti-white racism, and is often mostly irrelevant to situations involving individuals.

Many people, sadly, will use this observation to justify their personal bigotry against white people.

And now HN, my bastion somewhat free of SJW, has fallen down. Aren't there rules here to prevent that?

We detached this subthread from https://news.ycombinator.com/item?id=11431003 and marked it off-topic.

I'm sad to see that. The subject was arguably right on topic. I get the feeling that it was taken down only because it was inconvenient for someone.

> I get the feeling that it was taken down only because it was inconvenient for someone

It's a tempting feeling to get, and a contagious one, but no—the only inconvenience we care about is that of HN readers who don't want to read tedious flamewars tacked like burning barnacles onto the top comment. I'm kind of glad you said that, though, because usually the sinister implication goes the other way, Gitlab being a YC-funded startup and all.

Speaking of convenience, it's not that inconvenient to scroll down to find the flamewar. Seems like a reasonable balance to me.

How many up votes does that comment have? I want to know how many HNers are so offended by diversity initiatives that they will lobby companies to boycott github.

> The subject was arguably right on topic.

Definitely not, it was two steps further from the topic.

1) It was talking about a competitor's company, which is fine

2) It was talking about a non-technical aspect of the competitor's company

However I would love to see this topic come up more, just not on gitlab's stuff.

Thank you! Definitely offtopic.

A remarkably versatile word this has become, 'racism'. It seems to apply to gender, to sexual orientation, sometimes even to unexpected things like taste in music...

What happened in the world the last 2-3 years? It feels like someone took a shovel, dug up some old corpses from the graveyard of political culture and set them loose on the world again. Suddenly...

...people who call themselves 'feminist' start calling for what can only be described as a war between the sexes, given that they spout the opinion that males - preferably heterosexual, middle-aged 'white' males - are the cause of anything bad in the world. They obviously did not listen to Joe Jackson when, in 'Real Men', he sang 'and if there is war between the sexes then there will be no people left'.

...people who call themselves 'anti-racist' are trying to pull just about any public debate in a racial direction by claiming that it is all caused by the colour of the skin of whomever they're focusing on. Again, if that skin colour happens to be 'white' the person generally did something heinously wrong, while the same deed performed by someone who saw a bit more sun is either 'understandable' or 'justified' or 'caused by society being mean to (person)'...

...people who call themselves something between 'male' and 'female' start claiming that gender is nothing but a social construct and that there are really more than 50 'genders' and with that is it 'racist' to call someone 'he' or 'she' as it could be that person does not consider him/herself as either of those...

Meanwhile the real world is still full of REAL racism - just go and visit any middle-eastern country while being 'black' and you'll soon find out. For some reason the 'anti-racists' don't want to touch this subject, and other who do are quickly labelled 'racist' by them.

Meanwhile the real world is still full of REAL gender discrimination - just go and visit most middle-eastern countries (amongst others) while being female and you'll soon find out. The 'feminists' don't seem to want to speak up about this, instead they label those who do as, you guessed it, 'racist'.

Meanwhile the real world is still full of REAL discrimination against those with non-mainline sexual orientations. Again, just go to one of those middle-eastern countries I mentioned while being openly homosexual and you'll soon find out. For some reason the 'gender-denialists' are quiet about this, instead labelling those who do speak up as, again, 'racist'....

Meanwhile the position of women in the 'western' world is generally on a level with that of men, give or take a few cases of institutional gender preference. This does not mean that all professions have a 50/50 share of both (yes, both, male and female... not 'all 50') genders, eg. where I live (Sweden) nearly all veterinarians are women, nearly all lumberjacks are men, women are under-represented in IT but overrepresented in social functions, etc. Is this bad? Not necessarily, it depends on WHY there is a discrepancy. Is it because men are not allowed in veterinary college? Are women not allowed near computers? Of course not, this seems to be a case of personal choice. Are women incapable of handling chainsaws? No, they are not, but they are generally less strong than men and they don't feel at home in a group of men who talk about their favourite subjects of hunting, fishing and riding snow scooters (to take an example from our local - Swedish - culture). Does that mean those lumberjacks need to go to some re-education camp to learn to talk about more gender-neutral subjects? Of course not. Should women go to re-education camps to learn to talk about hunting, fishing and snow-scooter riding? No! Should there be male quota for vet schools to combat their under-representation in this field? No, if men want to become vets they can go to vet school. Something seems to keep them from doing that, maybe the fact that the field is female-dominated?

Fortunately there is no war between the sexes and men and women still get together to create more men and women. They create 'white' ones, brown ones, 'black' ones, 'yellow' ones, 'red' ones, etc. New humans who come to this world without prejudice about the colour of their skin, and - if they are lucky enough to live in one of those western countries which are largely free of REAL racism - should be able to live their lives to the fullest - unless the 'feminists', 'anti-racists', 'gender-denialists' (for lack of a better word) and other similarly befuddled people are successful in derailing the progress of the last few hundred years and throw us back into struggle and strife.

It is almost as if all these 'isms' (feminism, anti-racism, etc) are worried of becoming irrelevant due to the progress made on these fronts in the 'west' and started looking around for new 'causes'...

Well, now if only I can change the max-age of some resources (images, css, js) it'll get better than github.

Good job!

Can you elaborate and / or create an issue here [0]?

[0]: https://gitlab.com/gitlab-org/gitlab-ce/issues/new

Cache headers are set to expire after 10 minutes at GitHub pages.

Which is a bit too restrictive on js, images or css files.

It would be nice if these cache headers could be set to a larger period (1 year, or something similar). I'm not certain if any engineering hurdles or dangers exist in doing so, and I'm not implying this is something that can easily be done - since obviously GitHub didn't do it for their Pages.

FYI, that 404's if you aren't logged in.

That first headline should really read "What ARE gitlab pages", rather than "What is gitlab pages". Surely?

It's referring to the feature, so it should be singular.

Notably, the name is capitalized, as a proper name should be: “What is GitLab Pages?”.

I would so switch to using Gitlab if my username was available. I'm `echelon` here, on Twitter, on Gmail, on Github... I was so disappointed to be `echelon1`.

Is there any means to claim a username if it isn't in use?

Same. I'm @kel on github and twitter but that's taken on here and gitlab. I emailed to ask since it was just being squatted on but gitlab told me no.

Wow. Well, if that's the case I'll never be using Gitlab then. :(

I'd pay money to have my username, too.

Unfortunately, you won't be able to claim a username that is already taken. That would be unfair to other users.

GitLab.com is growing fast, but most people should be able to still claim their username.

Of course, you always have the option to run your own instance relatively easily [0].

[0]: https://about.gitlab.com/downloads/

GitHub has a policy of releasing dormant usernames, will GitLab do that?

We have currently no plans, but happy to discuss it [0].

[0]: https://gitlab.com/gitlab-org/gitlab-ce/issues/14932

Would love to be able to use my GitHub username on GitLab as well. Currently occupied by a dormant user with zero activity over the last 10 months, no repos except a fork of GitLab CE and no added commits to it. Of course I don't know if he has private repos or not.

We're considering adopting the same policy, see the issue linked above.

That would be amazing.

(I'm not sure why I got downvoted into oblivion. I stated my honest opinion--I haven't signed up for a lot of services where I can't use the username I want.)

I can't speak for anyone else, but it seems exceptionally ridiculous to me that you'd make a choice of which technology to use based on whether or not your username is available. I don't know if I'd downvote anyone for that, but it did inspire a laugh out loud moment.

Dude, I can't even use my preferred username here (it's too long).

Worse things happen at sea.

If you are doing a FOSS project not hosted on GitLab, you could also host your project website on http://statichosting.co/ for $5 a month.

Static hosting for $5 a month seems too high. If it would be $1 I might use it. But for $10 a month you can get a good VPS that you can use for any hosting needs (including a gitlab/gogs/whatever instance and a demo of your project (if it's on the web)).

I agree, perhaps the price isn't perfect, but $5/month buys you not having to manage the server, configure nginx for your domain, easy site upload, etc.

Reply on news.ycombinator.com