From 73b5b6fbf8a2b54a6cfe5d5a6a021afa9d291b3e Mon Sep 17 00:00:00 2001
From: ngala <ngala@gitlab.com>
Date: Wed, 7 May 2025 16:49:46 +0530
Subject: [PATCH 1/7] Support custom domains when pages run on separate server

Related: https://gitlab.com/gitlab-org/gitlab/-/issues/285089

Changelog: fixed
---
 app/helpers/projects/pages_helper.rb          |  4 +-
 app/models/project.rb                         |  4 +-
 .../projects/pages/_pages_settings.html.haml  |  4 +-
 app/views/projects/pages/show.html.haml       |  2 +-
 .../projects/pages_domains/_form.html.haml    |  2 +-
 config/gitlab.yml.example                     |  1 +
 config/initializers/1_settings.rb             |  3 +
 spec/helpers/projects/pages_helper_spec.rb    | 19 +++--
 spec/support/pages.rb                         |  8 +-
 .../pages/_pages_settings.html.haml_spec.rb   | 83 ++++++++++++-------
 .../pages_domains/show.html.haml_spec.rb      | 50 +++++++----
 11 files changed, 116 insertions(+), 64 deletions(-)

diff --git a/app/helpers/projects/pages_helper.rb b/app/helpers/projects/pages_helper.rb
index eef43eb87d1b60..6fdf74512f9af5 100644
--- a/app/helpers/projects/pages_helper.rb
+++ b/app/helpers/projects/pages_helper.rb
@@ -4,7 +4,9 @@ module Projects
   module PagesHelper
     def can_create_pages_custom_domains?(current_user, project)
       current_user.can?(:update_pages, project) &&
-        (Gitlab.config.pages.external_http || Gitlab.config.pages.external_https) &&
+        (Gitlab.config.pages.external_http ||
+          Gitlab.config.pages.external_https ||
+          Gitlab.config.pages.custom_domains) &&
         project.can_create_custom_domains?
     end
 
diff --git a/app/models/project.rb b/app/models/project.rb
index 86e4a6506f92fa..af6255ecebbbfd 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -1780,13 +1780,13 @@ def visibility_level_allowed_as_fork
   end
 
   def pages_https_only
-    return false unless Gitlab.config.pages.external_https
+    return false unless Gitlab.config.pages.external_https || Gitlab.config.pages.custom_domains == 'https'
 
     super
   end
 
   def pages_https_only?
-    return false unless Gitlab.config.pages.external_https
+    return false unless Gitlab.config.pages.external_https || Gitlab.config.pages.custom_domains == 'https'
 
     super
   end
diff --git a/app/views/projects/pages/_pages_settings.html.haml b/app/views/projects/pages/_pages_settings.html.haml
index 00a60376a15f81..7021a6b4b18bb3 100644
--- a/app/views/projects/pages/_pages_settings.html.haml
+++ b/app/views/projects/pages/_pages_settings.html.haml
@@ -1,7 +1,7 @@
 = gitlab_ui_form_for @project, url: project_pages_path(@project, anchor: 'domains-settings'), html: { class: 'gl-inline-block', title: pages_https_only_title } do |f|
   = render_if_exists 'shared/pages/max_pages_size_input', form: f
 
-  - if Gitlab.config.pages.external_http || Gitlab.config.pages.external_https
+  - if Gitlab.config.pages.custom_domains || Gitlab.config.pages.external_http || Gitlab.config.pages.external_https
     .form-group
       = f.gitlab_ui_checkbox_component :pages_https_only,
         s_('GitLabPages|Force HTTPS (requires valid certificates)'),
@@ -20,7 +20,7 @@
       %p.gl-pl-6
         = s_("GitLabPages|When enabled, a unique domain is generated to access pages.").html_safe
 
-  - if Gitlab.config.pages.external_http || Gitlab.config.pages.external_https
+  - if Gitlab.config.pages.custom_domains || Gitlab.config.pages.external_http || Gitlab.config.pages.external_https
     - if @project.pages_domains.present?
       .form-group
         = f.fields_for :project_setting do |settings|
diff --git a/app/views/projects/pages/show.html.haml b/app/views/projects/pages/show.html.haml
index 45ec16bec99453..e38f80750b22cc 100644
--- a/app/views/projects/pages/show.html.haml
+++ b/app/views/projects/pages/show.html.haml
@@ -18,7 +18,7 @@
     .tab-pane#domains-settings
       .gl-flex.gl-flex-col.gl-gap-5
         = render 'ssl_limitations_warning' if pages_subdomain(@project).include?(".")
-        - if Gitlab.config.pages.external_http || Gitlab.config.pages.external_https
+        - if Gitlab.config.pages.custom_domains || Gitlab.config.pages.external_http || Gitlab.config.pages.external_https
           = render 'list'
         - else
           = render 'no_domains'
diff --git a/app/views/projects/pages_domains/_form.html.haml b/app/views/projects/pages_domains/_form.html.haml
index f2a343b1a91812..0551a286e7d7e7 100644
--- a/app/views/projects/pages_domains/_form.html.haml
+++ b/app/views/projects/pages_domains/_form.html.haml
@@ -19,7 +19,7 @@
 - if domain_presenter.persisted?
   = render 'dns'
 
-- if Gitlab.config.pages.external_https
+- if Gitlab.config.pages.external_https || Gitlab.config.pages.custom_domains == 'https'
   = render 'certificate', f: f
 - else
   .gl-text-subtle.gl-my-5
diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example
index 0f0cd22d7839d7..1038f7a42cbf33 100644
--- a/config/gitlab.yml.example
+++ b/config/gitlab.yml.example
@@ -502,6 +502,7 @@ production: &base
     artifacts_server: true # Set to false if you want to disable online view of HTML artifacts
     # external_http: ["1.1.1.1:80", "[2001::1]:80"] # If defined, enables custom domain support in GitLab Pages
     # external_https: ["1.1.1.1:443", "[2001::1]:443"] # If defined, enables custom domain and certificate support in GitLab Pages
+    # custom_domains: http # Configure Pages to enable custom domain: `http`, `https` or `false`
 
     # File that contains the shared secret key for verifying access for gitlab-pages.
     # Default is '.gitlab_pages_secret' relative to Rails.root (i.e. root of the GitLab app).
diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb
index 9def8e5e1bdf35..357425da404b71 100644
--- a/config/initializers/1_settings.rb
+++ b/config/initializers/1_settings.rb
@@ -357,6 +357,9 @@
 Settings.pages['url'] ||= Settings.__send__(:build_pages_url)
 Settings.pages['external_http'] ||= false unless Settings.pages['external_http'].present?
 Settings.pages['external_https'] ||= false unless Settings.pages['external_https'].present?
+Settings.pages['custom_domains'] = 'http' if Settings.pages['external_http'].present?
+Settings.pages['custom_domains'] = 'https' if Settings.pages['external_https'].present?
+Settings.pages['custom_domains'] = false unless Settings.pages['custom_domains'].present?
 Settings.pages['artifacts_server'] ||= Settings.pages['enabled'] if Settings.pages['artifacts_server'].nil?
 Settings.pages['secret_file'] ||= Rails.root.join('.gitlab_pages_secret')
 # We want pages zip archives to be stored on the same directory as old pages hierarchical structure
diff --git a/spec/helpers/projects/pages_helper_spec.rb b/spec/helpers/projects/pages_helper_spec.rb
index 0972b4595b569b..e802cc1e70ccff 100644
--- a/spec/helpers/projects/pages_helper_spec.rb
+++ b/spec/helpers/projects/pages_helper_spec.rb
@@ -11,6 +11,7 @@
       access_control: true,
       external_http: true,
       external_https: true,
+      custom_domains: 'http',
       host: "new.domain.com"
     })
   end
@@ -23,16 +24,22 @@
     context 'on custom domain' do
       using RSpec::Parameterized::TableSyntax
 
-      where(:external_http, :external_https, :can_create) do
-        false | false | false
-        false | true  | true
-        true  | false | true
-        true  | true  | true
+      where(:external_http, :external_https, :custom_domains, :can_create) do
+        false | false | false | false
+        false | true  | false | true
+        true  | false | false | true
+        true  | true  | false | true
+        false | false | 'http' | true
+        false | false | 'https' | true
       end
 
       with_them do
         it do
-          stub_config(pages: { external_http: external_http, external_https: external_https })
+          stub_config(pages: {
+            external_http: external_http,
+            external_https: external_https,
+            custom_domains: custom_domains
+          })
 
           expect(can_create_pages_custom_domains?(user, project)).to be can_create
         end
diff --git a/spec/support/pages.rb b/spec/support/pages.rb
index ad73d5b9ef5233..3c97d00678f7b7 100644
--- a/spec/support/pages.rb
+++ b/spec/support/pages.rb
@@ -2,18 +2,18 @@
 
 RSpec.configure do |config|
   config.before(:each, :http_pages_enabled) do |_|
-    allow(Gitlab.config.pages).to receive(:external_http).and_return(['1.1.1.1:80'])
+    allow(Gitlab.config.pages).to receive_messages(external_http: ['1.1.1.1:80'], custom_domains: "http")
   end
 
   config.before(:each, :https_pages_enabled) do |_|
-    allow(Gitlab.config.pages).to receive(:external_https).and_return(['1.1.1.1:443'])
+    allow(Gitlab.config.pages).to receive_messages(external_https: ['1.1.1.1:443'], custom_domains: "https")
   end
 
   config.before(:each, :http_pages_disabled) do |_|
-    allow(Gitlab.config.pages).to receive(:external_http).and_return(false)
+    allow(Gitlab.config.pages).to receive_messages(external_http: false, custom_domains: false)
   end
 
   config.before(:each, :https_pages_disabled) do |_|
-    allow(Gitlab.config.pages).to receive(:external_https).and_return(false)
+    allow(Gitlab.config.pages).to receive_messages(external_https: false, custom_domains: false)
   end
 end
diff --git a/spec/views/projects/pages/_pages_settings.html.haml_spec.rb b/spec/views/projects/pages/_pages_settings.html.haml_spec.rb
index 2be20dc07d48a7..53abb1245b5ec7 100644
--- a/spec/views/projects/pages/_pages_settings.html.haml_spec.rb
+++ b/spec/views/projects/pages/_pages_settings.html.haml_spec.rb
@@ -6,49 +6,72 @@
   let_it_be(:project) { build_stubbed(:project) }
   let_it_be(:user) { build_stubbed(:user) }
 
-  before do
-    stub_config(pages: {
-      enabled: true,
-      external_http: true,
-      external_https: true,
-      access_control: false
-    })
-    assign(:project, project)
-    allow(view).to receive(:current_user).and_return(user)
-  end
-
-  context 'for pages unique domain' do
-    it 'shows the unique domain toggle' do
-      render
+  shared_examples 'page settings tests' do
+    context 'for pages unique domain' do
+      it 'shows the unique domain toggle' do
+        render
 
-      expect(rendered).to have_content('Use unique domain')
+        expect(rendered).to have_content('Use unique domain')
+      end
     end
-  end
 
-  context 'when pages_domains is empty' do
-    before do
-      allow(project).to receive(:pages_domains).and_return([])
+    context 'when pages_domains is empty' do
+      before do
+        allow(project).to receive(:pages_domains).and_return([])
+      end
+
+      it 'does not render the redirect domains section' do
+        render
+
+        expect(rendered).not_to have_selector('.form-group', text: 'Primary domain')
+      end
     end
 
-    it 'does not render the redirect domains section' do
-      render
+    context 'when pages_domains is not empty' do
+      before do
+        allow(project).to receive(:pages_domains).and_return([build_stubbed(:pages_domain)])
+        allow(view).to receive(:project_pages_domain_choices).and_return(
+          options_for_select([['new.domain.com', 'new.domain.com']])
+        )
+      end
+
+      it 'renders the redirect domains section' do
+        render
 
-      expect(rendered).not_to have_selector('.form-group', text: 'Primary domain')
+        expect(rendered).to have_content('Primary domain')
+      end
     end
   end
 
-  context 'when pages_domains is not empty' do
+  context 'when external_http and external_https are both true and custom_domains is https' do
     before do
-      allow(project).to receive(:pages_domains).and_return([build_stubbed(:pages_domain)])
-      allow(view).to receive(:project_pages_domain_choices).and_return(
-        options_for_select([['new.domain.com', 'new.domain.com']])
-      )
+      stub_config(pages: {
+        enabled: true,
+        external_http: true,
+        external_https: true,
+        custom_domains: "https",
+        access_control: false
+      })
+      assign(:project, project)
+      allow(view).to receive(:current_user).and_return(user)
     end
 
-    it 'renders the redirect domains section' do
-      render
+    include_examples 'page settings tests'
+  end
 
-      expect(rendered).to have_content('Primary domain')
+  context 'when external_http and external_https are both false and custom_domains is https' do
+    before do
+      stub_config(pages: {
+        enabled: true,
+        external_http: false,
+        external_https: false,
+        custom_domains: "https",
+        access_control: false
+      })
+      assign(:project, project)
+      allow(view).to receive(:current_user).and_return(user)
     end
+
+    include_examples 'page settings tests'
   end
 end
diff --git a/spec/views/projects/pages_domains/show.html.haml_spec.rb b/spec/views/projects/pages_domains/show.html.haml_spec.rb
index d2abe3dfa56cfc..1c762451f21b8d 100644
--- a/spec/views/projects/pages_domains/show.html.haml_spec.rb
+++ b/spec/views/projects/pages_domains/show.html.haml_spec.rb
@@ -5,31 +5,47 @@
 RSpec.describe 'projects/pages_domains/show' do
   let(:project) { create(:project, :repository) }
 
-  before do
-    assign(:project, project)
-    allow(view).to receive(:domain_presenter).and_return(domain.present)
-    stub_pages_setting(external_https: true)
-  end
+  shared_examples 'pages domain tests' do
+    context 'when auto_ssl is enabled' do
+      context 'when domain is disabled' do
+        let(:domain) { create(:pages_domain, :disabled, project: project, auto_ssl_enabled: true) }
+
+        it 'shows verification warning' do
+          render
 
-  context 'when auto_ssl is enabled' do
-    context 'when domain is disabled' do
-      let(:domain) { create(:pages_domain, :disabled, project: project, auto_ssl_enabled: true) }
+          expect(rendered).to have_content("A Let's Encrypt SSL certificate can not be obtained until your domain is verified.")
+        end
+      end
 
-      it 'shows verification warning' do
-        render
+      context 'when certificate is absent' do
+        let(:domain) { create(:pages_domain, :without_key, :without_certificate, project: project, auto_ssl_enabled: true) }
 
-        expect(rendered).to have_content("A Let's Encrypt SSL certificate can not be obtained until your domain is verified.")
+        it 'shows alert about time of obtaining certificate' do
+          render
+
+          expect(rendered).to have_content("GitLab is obtaining a Let's Encrypt SSL certificate for this domain. This process can take some time. Please try again later.")
+        end
       end
     end
+  end
 
-    context 'when certificate is absent' do
-      let(:domain) { create(:pages_domain, :without_key, :without_certificate, project: project, auto_ssl_enabled: true) }
+  context 'when external_https is true' do
+    before do
+      assign(:project, project)
+      allow(view).to receive(:domain_presenter).and_return(domain.present)
+      stub_pages_setting(external_https: true, custom_domains: 'https')
+    end
 
-      it 'shows alert about time of obtaining certificate' do
-        render
+    include_examples 'pages domain tests'
+  end
 
-        expect(rendered).to have_content("GitLab is obtaining a Let's Encrypt SSL certificate for this domain. This process can take some time. Please try again later.")
-      end
+  context 'when external_https is false' do
+    before do
+      assign(:project, project)
+      allow(view).to receive(:domain_presenter).and_return(domain.present)
+      stub_pages_setting(external_https: false, custom_domains: 'https')
     end
+
+    include_examples 'pages domain tests'
   end
 end
-- 
GitLab


From a162394d5663295ea75d26af0cbaad5d8fe0b690 Mon Sep 17 00:00:00 2001
From: ngala <ngala@gitlab.com>
Date: Thu, 15 May 2025 16:01:03 +0530
Subject: [PATCH 2/7] Address review comment

---
 app/helpers/projects/pages_helper.rb            |  9 ++++++++-
 app/models/project.rb                           |  4 ++--
 .../projects/pages/_pages_settings.html.haml    |  4 ++--
 .../projects/pages_domains/_form.html.haml      |  2 +-
 config/gitlab.yml.example                       |  2 +-
 config/initializers/1_settings.rb               |  6 +++---
 spec/helpers/projects/pages_helper_spec.rb      | 17 +++++++++--------
 spec/support/pages.rb                           |  8 ++++----
 .../pages/_pages_settings.html.haml_spec.rb     |  8 ++++----
 .../pages_domains/show.html.haml_spec.rb        |  4 ++--
 10 files changed, 36 insertions(+), 28 deletions(-)

diff --git a/app/helpers/projects/pages_helper.rb b/app/helpers/projects/pages_helper.rb
index 6fdf74512f9af5..0171f8a5ab91a5 100644
--- a/app/helpers/projects/pages_helper.rb
+++ b/app/helpers/projects/pages_helper.rb
@@ -6,10 +6,17 @@ def can_create_pages_custom_domains?(current_user, project)
       current_user.can?(:update_pages, project) &&
         (Gitlab.config.pages.external_http ||
           Gitlab.config.pages.external_https ||
-          Gitlab.config.pages.custom_domains) &&
+          pages_custom_domain_enabled?) &&
         project.can_create_custom_domains?
     end
 
+    def pages_custom_domain_enabled?
+      custom_domain_mode = Gitlab.config.pages.custom_domain_mode
+      allowed_values = %w[http https]
+
+      allowed_values.include?(custom_domain_mode.to_s.downcase)
+    end
+
     def pages_subdomain(project)
       Gitlab::Pages::UrlBuilder
         .new(project)
diff --git a/app/models/project.rb b/app/models/project.rb
index af6255ecebbbfd..b0481f3954e7d2 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -1780,13 +1780,13 @@ def visibility_level_allowed_as_fork
   end
 
   def pages_https_only
-    return false unless Gitlab.config.pages.external_https || Gitlab.config.pages.custom_domains == 'https'
+    return false unless Gitlab.config.pages.external_https || Gitlab.config.pages.custom_domain_mode == 'https'
 
     super
   end
 
   def pages_https_only?
-    return false unless Gitlab.config.pages.external_https || Gitlab.config.pages.custom_domains == 'https'
+    return false unless Gitlab.config.pages.external_https || Gitlab.config.pages.custom_domain_mode == 'https'
 
     super
   end
diff --git a/app/views/projects/pages/_pages_settings.html.haml b/app/views/projects/pages/_pages_settings.html.haml
index 7021a6b4b18bb3..0d3a4224e6f8d1 100644
--- a/app/views/projects/pages/_pages_settings.html.haml
+++ b/app/views/projects/pages/_pages_settings.html.haml
@@ -1,7 +1,7 @@
 = gitlab_ui_form_for @project, url: project_pages_path(@project, anchor: 'domains-settings'), html: { class: 'gl-inline-block', title: pages_https_only_title } do |f|
   = render_if_exists 'shared/pages/max_pages_size_input', form: f
 
-  - if Gitlab.config.pages.custom_domains || Gitlab.config.pages.external_http || Gitlab.config.pages.external_https
+  - if Gitlab.config.pages.custom_domain_mode || Gitlab.config.pages.external_http || Gitlab.config.pages.external_https
     .form-group
       = f.gitlab_ui_checkbox_component :pages_https_only,
         s_('GitLabPages|Force HTTPS (requires valid certificates)'),
@@ -20,7 +20,7 @@
       %p.gl-pl-6
         = s_("GitLabPages|When enabled, a unique domain is generated to access pages.").html_safe
 
-  - if Gitlab.config.pages.custom_domains || Gitlab.config.pages.external_http || Gitlab.config.pages.external_https
+  - if Gitlab.config.pages.custom_domain_mode || Gitlab.config.pages.external_http || Gitlab.config.pages.external_https
     - if @project.pages_domains.present?
       .form-group
         = f.fields_for :project_setting do |settings|
diff --git a/app/views/projects/pages_domains/_form.html.haml b/app/views/projects/pages_domains/_form.html.haml
index 0551a286e7d7e7..18f02df2a87cd9 100644
--- a/app/views/projects/pages_domains/_form.html.haml
+++ b/app/views/projects/pages_domains/_form.html.haml
@@ -19,7 +19,7 @@
 - if domain_presenter.persisted?
   = render 'dns'
 
-- if Gitlab.config.pages.external_https || Gitlab.config.pages.custom_domains == 'https'
+- if Gitlab.config.pages.external_https || Gitlab.config.pages.custom_domain_mode == 'https'
   = render 'certificate', f: f
 - else
   .gl-text-subtle.gl-my-5
diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example
index 1038f7a42cbf33..2eb11ab17be9d3 100644
--- a/config/gitlab.yml.example
+++ b/config/gitlab.yml.example
@@ -502,7 +502,7 @@ production: &base
     artifacts_server: true # Set to false if you want to disable online view of HTML artifacts
     # external_http: ["1.1.1.1:80", "[2001::1]:80"] # If defined, enables custom domain support in GitLab Pages
     # external_https: ["1.1.1.1:443", "[2001::1]:443"] # If defined, enables custom domain and certificate support in GitLab Pages
-    # custom_domains: http # Configure Pages to enable custom domain: `http`, `https` or `false`
+    # custom_domain_mode: http # Configure Pages to enable custom domain: `http` or `https`
 
     # File that contains the shared secret key for verifying access for gitlab-pages.
     # Default is '.gitlab_pages_secret' relative to Rails.root (i.e. root of the GitLab app).
diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb
index 357425da404b71..d23d184286bf75 100644
--- a/config/initializers/1_settings.rb
+++ b/config/initializers/1_settings.rb
@@ -357,9 +357,9 @@
 Settings.pages['url'] ||= Settings.__send__(:build_pages_url)
 Settings.pages['external_http'] ||= false unless Settings.pages['external_http'].present?
 Settings.pages['external_https'] ||= false unless Settings.pages['external_https'].present?
-Settings.pages['custom_domains'] = 'http' if Settings.pages['external_http'].present?
-Settings.pages['custom_domains'] = 'https' if Settings.pages['external_https'].present?
-Settings.pages['custom_domains'] = false unless Settings.pages['custom_domains'].present?
+Settings.pages['custom_domain_mode'] = 'http' if Settings.pages['external_http'].present?
+Settings.pages['custom_domain_mode'] = 'https' if Settings.pages['external_https'].present?
+Settings.pages['custom_domain_mode'] = nil unless Settings.pages['custom_domain_mode'].present?
 Settings.pages['artifacts_server'] ||= Settings.pages['enabled'] if Settings.pages['artifacts_server'].nil?
 Settings.pages['secret_file'] ||= Rails.root.join('.gitlab_pages_secret')
 # We want pages zip archives to be stored on the same directory as old pages hierarchical structure
diff --git a/spec/helpers/projects/pages_helper_spec.rb b/spec/helpers/projects/pages_helper_spec.rb
index e802cc1e70ccff..7611bf6beea07a 100644
--- a/spec/helpers/projects/pages_helper_spec.rb
+++ b/spec/helpers/projects/pages_helper_spec.rb
@@ -11,7 +11,7 @@
       access_control: true,
       external_http: true,
       external_https: true,
-      custom_domains: 'http',
+      custom_domain_mode: 'http',
       host: "new.domain.com"
     })
   end
@@ -24,13 +24,14 @@
     context 'on custom domain' do
       using RSpec::Parameterized::TableSyntax
 
-      where(:external_http, :external_https, :custom_domains, :can_create) do
-        false | false | false | false
-        false | true  | false | true
-        true  | false | false | true
-        true  | true  | false | true
-        false | false | 'http' | true
+      where(:external_http, :external_https, :custom_domain_mode, :can_create) do
+        false | false | nil     | false
+        false | true  | nil     | true
+        true  | false | nil     | true
+        true  | true  | nil     | true
+        false | false | 'http'  | true
         false | false | 'https' | true
+        false | false | false   | false
       end
 
       with_them do
@@ -38,7 +39,7 @@
           stub_config(pages: {
             external_http: external_http,
             external_https: external_https,
-            custom_domains: custom_domains
+            custom_domain_mode: custom_domain_mode
           })
 
           expect(can_create_pages_custom_domains?(user, project)).to be can_create
diff --git a/spec/support/pages.rb b/spec/support/pages.rb
index 3c97d00678f7b7..526c64af2b249c 100644
--- a/spec/support/pages.rb
+++ b/spec/support/pages.rb
@@ -2,18 +2,18 @@
 
 RSpec.configure do |config|
   config.before(:each, :http_pages_enabled) do |_|
-    allow(Gitlab.config.pages).to receive_messages(external_http: ['1.1.1.1:80'], custom_domains: "http")
+    allow(Gitlab.config.pages).to receive_messages(external_http: ['1.1.1.1:80'], custom_domain_mode: "http")
   end
 
   config.before(:each, :https_pages_enabled) do |_|
-    allow(Gitlab.config.pages).to receive_messages(external_https: ['1.1.1.1:443'], custom_domains: "https")
+    allow(Gitlab.config.pages).to receive_messages(external_https: ['1.1.1.1:443'], custom_domain_mode: "https")
   end
 
   config.before(:each, :http_pages_disabled) do |_|
-    allow(Gitlab.config.pages).to receive_messages(external_http: false, custom_domains: false)
+    allow(Gitlab.config.pages).to receive_messages(external_http: false)
   end
 
   config.before(:each, :https_pages_disabled) do |_|
-    allow(Gitlab.config.pages).to receive_messages(external_https: false, custom_domains: false)
+    allow(Gitlab.config.pages).to receive_messages(external_https: false)
   end
 end
diff --git a/spec/views/projects/pages/_pages_settings.html.haml_spec.rb b/spec/views/projects/pages/_pages_settings.html.haml_spec.rb
index 53abb1245b5ec7..85f6bef6972918 100644
--- a/spec/views/projects/pages/_pages_settings.html.haml_spec.rb
+++ b/spec/views/projects/pages/_pages_settings.html.haml_spec.rb
@@ -43,13 +43,13 @@
     end
   end
 
-  context 'when external_http and external_https are both true and custom_domains is https' do
+  context 'when external_http and external_https are both true and custom_domain_mode is https' do
     before do
       stub_config(pages: {
         enabled: true,
         external_http: true,
         external_https: true,
-        custom_domains: "https",
+        custom_domain_mode: "https",
         access_control: false
       })
       assign(:project, project)
@@ -59,13 +59,13 @@
     include_examples 'page settings tests'
   end
 
-  context 'when external_http and external_https are both false and custom_domains is https' do
+  context 'when external_http and external_https are both false and custom_domain_mode is https' do
     before do
       stub_config(pages: {
         enabled: true,
         external_http: false,
         external_https: false,
-        custom_domains: "https",
+        custom_domain_mode: "https",
         access_control: false
       })
       assign(:project, project)
diff --git a/spec/views/projects/pages_domains/show.html.haml_spec.rb b/spec/views/projects/pages_domains/show.html.haml_spec.rb
index 1c762451f21b8d..d356596460b979 100644
--- a/spec/views/projects/pages_domains/show.html.haml_spec.rb
+++ b/spec/views/projects/pages_domains/show.html.haml_spec.rb
@@ -33,7 +33,7 @@
     before do
       assign(:project, project)
       allow(view).to receive(:domain_presenter).and_return(domain.present)
-      stub_pages_setting(external_https: true, custom_domains: 'https')
+      stub_pages_setting(external_https: true, custom_domain_mode: 'https')
     end
 
     include_examples 'pages domain tests'
@@ -43,7 +43,7 @@
     before do
       assign(:project, project)
       allow(view).to receive(:domain_presenter).and_return(domain.present)
-      stub_pages_setting(external_https: false, custom_domains: 'https')
+      stub_pages_setting(external_https: false, custom_domain_mode: 'https')
     end
 
     include_examples 'pages domain tests'
-- 
GitLab


From 3216e1e9488cdd1b6c3670afda204db3037dfe54 Mon Sep 17 00:00:00 2001
From: ngala <ngala@gitlab.com>
Date: Fri, 16 May 2025 16:24:55 +0530
Subject: [PATCH 3/7] Fix failing test and address review comment

---
 spec/support/pages.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/spec/support/pages.rb b/spec/support/pages.rb
index 526c64af2b249c..c2909376746e41 100644
--- a/spec/support/pages.rb
+++ b/spec/support/pages.rb
@@ -10,10 +10,10 @@
   end
 
   config.before(:each, :http_pages_disabled) do |_|
-    allow(Gitlab.config.pages).to receive_messages(external_http: false)
+    allow(Gitlab.config.pages).to receive_messages(external_http: false, custom_domain_mode: nil)
   end
 
   config.before(:each, :https_pages_disabled) do |_|
-    allow(Gitlab.config.pages).to receive_messages(external_https: false)
+    allow(Gitlab.config.pages).to receive_messages(external_https: false, custom_domain_mode: nil)
   end
 end
-- 
GitLab


From 25ac9793f0356579d80af57b9cff13dbcde2db6a Mon Sep 17 00:00:00 2001
From: ngala <ngala@gitlab.com>
Date: Mon, 19 May 2025 15:06:59 +0530
Subject: [PATCH 4/7] Add tests in 1_settings_spec.rb

---
 spec/initializers/1_settings_spec.rb | 50 ++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)

diff --git a/spec/initializers/1_settings_spec.rb b/spec/initializers/1_settings_spec.rb
index 503667067dd69f..58dd27a1e741a7 100644
--- a/spec/initializers/1_settings_spec.rb
+++ b/spec/initializers/1_settings_spec.rb
@@ -97,4 +97,54 @@
       it { expect(Settings.cell.topology_service_client.private_key_file).to eq(config[:private_key_file]) }
     end
   end
+
+  RSpec.shared_examples 'sets correct pages custom_domain_mode' do |external_http, external_https,
+    initial_custom_domain_mode, expected_custom_domain_mode|
+    before do
+      stub_config(pages: {
+        enabled: true,
+        external_http: external_http,
+        external_https: external_https,
+        custom_domain_mode: initial_custom_domain_mode
+      })
+
+      allow(Settings.pages).to receive(:__getobj__).and_return(Settings.pages)
+    end
+
+    it 'sets the expected custom_domain_mode value' do
+      load_settings
+
+      expect(Settings.pages['custom_domain_mode']).to eq(expected_custom_domain_mode)
+    end
+  end
+
+  describe 'Pages custom domains settings' do
+    context 'when only HTTPS is enabled' do
+      it_behaves_like 'sets correct pages custom_domain_mode', nil, true, nil, 'https'
+    end
+
+    context 'when only HTTP is enabled' do
+      it_behaves_like 'sets correct pages custom_domain_mode', true, nil, nil, 'http'
+    end
+
+    context 'when both HTTP and HTTPS are enabled' do
+      it_behaves_like 'sets correct pages custom_domain_mode', true, true, nil, 'https'
+    end
+
+    context 'when custom_domain_mode is already set' do
+      it_behaves_like 'sets correct pages custom_domain_mode', nil, nil, 'https', 'https'
+    end
+
+    context 'when custom_domain_mode is already set and both HTTP and HTTPS are disabled' do
+      it_behaves_like 'sets correct pages custom_domain_mode', false, false, 'http', 'http'
+    end
+
+    context 'when custom_domain_mode is set to http and HTTPS is enabled' do
+      it_behaves_like 'sets correct pages custom_domain_mode', nil, true, 'http', 'https'
+    end
+
+    context 'when nothing is enabled' do
+      it_behaves_like 'sets correct pages custom_domain_mode', nil, nil, nil, nil
+    end
+  end
 end
-- 
GitLab


From bdbb269e93e2611b854e53bd78a933542d166b0d Mon Sep 17 00:00:00 2001
From: Naman Jagdish Gala <ngala@gitlab.com>
Date: Tue, 20 May 2025 11:24:22 +0530
Subject: [PATCH 5/7] Apply suggestion

---
 spec/initializers/1_settings_spec.rb | 65 ++++++++++------------------
 1 file changed, 24 insertions(+), 41 deletions(-)

diff --git a/spec/initializers/1_settings_spec.rb b/spec/initializers/1_settings_spec.rb
index 58dd27a1e741a7..004de417aa41eb 100644
--- a/spec/initializers/1_settings_spec.rb
+++ b/spec/initializers/1_settings_spec.rb
@@ -98,53 +98,36 @@
     end
   end
 
-  RSpec.shared_examples 'sets correct pages custom_domain_mode' do |external_http, external_https,
-    initial_custom_domain_mode, expected_custom_domain_mode|
-    before do
-      stub_config(pages: {
-        enabled: true,
-        external_http: external_http,
-        external_https: external_https,
-        custom_domain_mode: initial_custom_domain_mode
-      })
-
-      allow(Settings.pages).to receive(:__getobj__).and_return(Settings.pages)
-    end
-
-    it 'sets the expected custom_domain_mode value' do
-      load_settings
-
-      expect(Settings.pages['custom_domain_mode']).to eq(expected_custom_domain_mode)
-    end
-  end
-
   describe 'Pages custom domains settings' do
-    context 'when only HTTPS is enabled' do
-      it_behaves_like 'sets correct pages custom_domain_mode', nil, true, nil, 'https'
-    end
+    using RSpec::Parameterized::TableSyntax
 
-    context 'when only HTTP is enabled' do
-      it_behaves_like 'sets correct pages custom_domain_mode', true, nil, nil, 'http'
+    where(:external_http, :external_https, :initial_custom_domain_mode, :expected_custom_domain_mode) do
+      nil   | true  | nil     | 'https'
+      true  | nil   | nil     | 'http'
+      true  | true  | nil     | 'https'
+      nil   | nil   | 'https' | 'https'
+      false | false | 'http'  | 'http'
+      nil   | true  | 'http'  | 'https'
+      nil   | nil   | nil     | nil
     end
 
-    context 'when both HTTP and HTTPS are enabled' do
-      it_behaves_like 'sets correct pages custom_domain_mode', true, true, nil, 'https'
-    end
-
-    context 'when custom_domain_mode is already set' do
-      it_behaves_like 'sets correct pages custom_domain_mode', nil, nil, 'https', 'https'
-    end
-
-    context 'when custom_domain_mode is already set and both HTTP and HTTPS are disabled' do
-      it_behaves_like 'sets correct pages custom_domain_mode', false, false, 'http', 'http'
-    end
+    with_them do
+      before do
+        stub_config(pages: {
+          enabled: true,
+          external_http: external_http,
+          external_https: external_https,
+          custom_domain_mode: initial_custom_domain_mode
+        })
+
+        allow(Settings.pages).to receive(:__getobj__).and_return(Settings.pages)
+      end
 
-    context 'when custom_domain_mode is set to http and HTTPS is enabled' do
-      it_behaves_like 'sets correct pages custom_domain_mode', nil, true, 'http', 'https'
-    end
+      it 'sets the expected custom_domain_mode value' do
+        load_settings
 
-    context 'when nothing is enabled' do
-      it_behaves_like 'sets correct pages custom_domain_mode', nil, nil, nil, nil
+        expect(Settings.pages['custom_domain_mode']).to eq(expected_custom_domain_mode)
+      end
     end
   end
 end
-- 
GitLab


From 0cac56775c7c20512489d71b8c35cfc2af3eff0f Mon Sep 17 00:00:00 2001
From: ngala <ngala@gitlab.com>
Date: Tue, 20 May 2025 13:46:13 +0530
Subject: [PATCH 6/7] Add tests _form.html.haml_spec.rb

---
 .../pages_domains/_form.html.haml_spec.rb     | 47 +++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 spec/views/projects/pages_domains/_form.html.haml_spec.rb

diff --git a/spec/views/projects/pages_domains/_form.html.haml_spec.rb b/spec/views/projects/pages_domains/_form.html.haml_spec.rb
new file mode 100644
index 00000000000000..9ff664e8edac88
--- /dev/null
+++ b/spec/views/projects/pages_domains/_form.html.haml_spec.rb
@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'projects/pages_domains/_form', feature_category: :pages do
+  let(:project) { build(:project, :repository) }
+  let(:domain) { build(:pages_domain, project: project) }
+  let(:form) { instance_double(Gitlab::FormBuilders::GitlabUiFormBuilder, text_field: nil, label: nil) }
+  let(:domain_presenter) { domain.present }
+
+  before do
+    assign(:project, project)
+    allow(view).to receive_messages(domain_presenter: domain_presenter, f: form)
+    allow(view).to receive(:render).and_call_original
+    allow(view).to receive(:render).with('certificate', f: form).and_return('')
+  end
+
+  describe 'certificate section rendering' do
+    where(:external_https, :custom_domain_mode, :renders_certificate) do
+      [
+        [true,  'https', true],
+        [true,  'http',  true],
+        [false, 'https', true],
+        [false, 'http',  false]
+      ]
+    end
+
+    with_them do
+      it "when external_https=#{params[:external_https]} and custom_domain_mode=#{params[:custom_domain_mode]}" do
+        stub_pages_setting(external_https: external_https, custom_domain_mode: custom_domain_mode)
+
+        if renders_certificate
+          expect(view).to receive(:render).with('certificate', f: form)
+        else
+          expect(view).not_to receive(:render).with('certificate', f: form)
+        end
+
+        render partial: 'projects/pages_domains/form'
+
+        unless renders_certificate
+          expect(rendered).to have_content(
+            "Support for custom certificates is disabled. Ask your system's administrator to enable it.")
+        end
+      end
+    end
+  end
+end
-- 
GitLab


From 66cbd145f7068363a8697110a5c676a5a8b64d66 Mon Sep 17 00:00:00 2001
From: Naman Jagdish Gala <ngala@gitlab.com>
Date: Wed, 21 May 2025 13:13:05 +0530
Subject: [PATCH 7/7] fix conflict introduced during rebase

---
 app/views/projects/pages/show.html.haml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/projects/pages/show.html.haml b/app/views/projects/pages/show.html.haml
index e38f80750b22cc..9750edef259c8e 100644
--- a/app/views/projects/pages/show.html.haml
+++ b/app/views/projects/pages/show.html.haml
@@ -18,7 +18,7 @@
     .tab-pane#domains-settings
       .gl-flex.gl-flex-col.gl-gap-5
         = render 'ssl_limitations_warning' if pages_subdomain(@project).include?(".")
-        - if Gitlab.config.pages.custom_domains || Gitlab.config.pages.external_http || Gitlab.config.pages.external_https
+        - if Gitlab.config.pages.custom_domain_mode || Gitlab.config.pages.external_http || Gitlab.config.pages.external_https
           = render 'list'
         - else
           = render 'no_domains'
-- 
GitLab