gitlab service: add option for db_key_base secret

nixos/modules/services/misc/gitlab.nix

@@ -41,6 +41,11 @@ let
       namespace: resque:gitlab
   '';
 
+  secretsYml = ''
+    production:
+      db_key_base: ${cfg.secrets.db_key_base}
+  '';
+
   gitlabConfig = {
     # These are the default settings from config/gitlab.example.yml
     production = flip recursiveUpdate cfg.extraConfig {
@@ -313,6 +318,19 @@ in {
         };
       };
 
+      secrets.db_key_base = mkOption {
+        type = types.str;
+        example = "";
+        description = ''
+          The db_key_base secrets is used to encrypt variables in the DB. If
+          you change or lose this key you will be unable to access variables
+          stored in database.
+
+          Make sure the secret is at least 30 characters and all random,
+          no regular words or you'll be exposed to dictionary attacks.
+        '';
+      };
+
       extraConfig = mkOption {
         type = types.attrs;
         default = {};
@@ -467,6 +485,7 @@ in {
         # JSON is a subset of YAML
         ln -fs ${pkgs.writeText "gitlab.yml" (builtins.toJSON gitlabConfig)} ${cfg.statePath}/config/gitlab.yml
         ln -fs ${pkgs.writeText "database.yml" databaseYml} ${cfg.statePath}/config/database.yml
+        ln -fs ${pkgs.writeText "secrets.yml" secretsYml} ${cfg.statePath}/config/secrets.yml
         ln -fs ${pkgs.writeText "unicorn.rb" unicornConfig} ${cfg.statePath}/config/unicorn.rb
 
         chown -R ${cfg.user}:${cfg.group} ${cfg.statePath}/