How to run go get off a Geo secondary

Problem to solve

As go get uses Git repos to create packages, it should be possible to go get off a Geo secondary, and so reduce load on the primary.

Purpose of this issue is to flesh out how to do this, with a view to documenting it.

Bug issues should be raised if, in the progress, we reproduce it not working.

GitLab team members can read more about potential challenges in a customer's ticket.

Further details

Workaround for top-level namespaces, or public subgroup-level namespaces

Git over SSH

To retrieve the go module contents through git+ssh, add the following to ~/.gitconfig:

[url "git@secondary.example.com:"]
          insteadOf = https://primary.example.com

Or use the git config command directly: git config --global url.git@secondary.example.com:.insteadOf https://primary.example.com

You will need a valid SSH key added to GitLab, which will be used to fetch the contents from the secondary GitLab Geo site when you run go get primary.example.com/top-level/package.

Git over HTTP(s)

To retrieve the go module contents through git over HTTP(s), you need a valid access token configured in your ~/.netrc for the secondary Geo site (as it will be used to retrieve the package):

machine secondary.example.com login USERNAME password PAT

You will then need the following in your ~/.gitconfig:

[url "https://secondary.example.com"]
          insteadOf = https://primary.example.com

Or using the git config command directly: git config --global url.https://secondary.example.com.insteadOf https://primary.example.com

Workaround for private subgroup-level namespaces

Since subgroup-level (nested) namespaces can come in different forms, you need to be authenticated on the primary to "confirm" the exact project location (to avoid leaking project existence information).

This means, in addition to the configuration above, you will need to have the following in your ~/.netrc:

machine primary.example.com login USERNAME password PAT

If using HTTP(s) to clone from the secondary as well, you need to configure the PAT for both Geo sites, so your ~/.netrc will look like:

machine primary.example.com login USERNAME password PAT
machine secondary.example.com login USERNAME password PAT

Proposal

In this issue, we need to document the workarounds necessary before &1528 is released.

After &1528, things should work better. We'll just want to test go get usage, and then simplify the docs.