GitBlixt
Docs Navigation

Audit Log

GitBlixt records security-relevant changes in an append-only audit log: who made each change, when, from which IP address, and what changed. Open it under Admin → Audit log. It needs the audit:read permission, which admins hold unless it is denied them.

What Is Recorded

  • Env vars (env_var.created, .updated, .deleted, .imported): the key, and whether it is shared, belongs to one environment or is saved on a merge request for its previews. Never the value.
  • Environments (environment.created, .updated, .deleted): each changed setting with its old and new value, deployment protection, stops and database provisioning included; enabling or removing a managed database's extension is environment.extension_enabled or environment.extension_disabled, with its name, and turning its Track I/O timing setting on or off is environment.io_timing_enabled or environment.io_timing_disabled. Enabling or disabling an app is app.updated.
  • Instance settings (setting.updated, setting.cleared): the old and new value, or only the key for secrets such as passwords and API keys.
  • Permissions (permission.granted, .denied, .revoked) and admin and root status (user.admin_granted, user.admin_revoked, user.root_granted, user.root_revoked).
  • User accounts: user.created, user.updated (admin edits), user.email_changed, user.deleted, user.banned, user.unbanned, user.password_changed, user.password_reset, user.totp_enabled, user.totp_disabled, user.backup_codes_regenerated and user.two_factor_reset (an admin reset someone's 2FA).
  • Credentials: personal access and impersonation tokens (token.created, token.revoked) with their name and scopes, and SSH keys (ssh_key.added, ssh_key.removed) with their fingerprint, passkeys (passkey.created, passkey.deleted) with their name, and OAuth applications (oauth_app.created, oauth_app.deleted).
  • Organizations and federation: quota overrides (organization.updated), the two-factor requirement (organization.require_two_factor_updated), and peers added, trusted or blocked and their public keys re-read (federation_peer.added, .updated, .key_changed).
  • Backups: backup.created, backup.deleted, and backup.restored once a restore finishes.

Changes GitBlixt makes on its own, such as a deploy stopping an environment, the DATABASE_URL of a provisioned database or a scheduled backup, are not recorded. A restore and an admin or root promotion from the command line are, as system. Saving a setting without changing it records nothing. In the web UI, the IP is the one the page was loaded from.

Filtering and Export

Filter by the actor's username (in any case), by an action (user.banned) or a whole category (env_var), and by date. Export CSV downloads every entry the filters match. The REST API serves the log as GET /api/v4/audit_events in GitLab's audit event shape; created_after and created_before take an ISO 8601 date or a datetime with its offset.

Retention

Entries are kept forever and can't be edited or deleted from the UI or the API, and a database trigger refuses updates and deletes. Deleting a user keeps their entries, under the username they had.

The DB editor's own log of the statements it ran (db_editor_audit) isn't part of the audit log above, but has the same trigger and keeps the username of whoever ran each statement. On GitBlixt's own database the DB editor runs reads in a transaction it rolls back, and refuses statements that name either log, DO blocks, new functions or procedures, EXECUTE, trigger or replication-role changes, DROP SCHEMA ... CASCADE and DROP OWNED. Anyone with direct access to the database as GitBlixt's own user can still drop the triggers.