GitLab Self-Managed
Your GitLab server, connected in five minutes.
One application on your instance, three values in Busfactor, one click to approve.
GitLab 15.0+Free · Premium · Ultimatescope read_apino code stored
RightsAdministrator, or Owner of the group
NetworkHTTPS from the internet, publicly trusted certificate
- 1
Choose where the application lives
Instance-wideAdmin → Applications → Add new application
AdministratorServes every groupCan be Trusted (no consent screen)GroupGroup → Settings → Applications
Group OwnerNo administrator neededStart todayGitLab 17 and earlier: Admin Area, in the left sidebar.
- 2
Fill in the form
NameBusfactorRedirect URIhttps://busfactor.tech/api/connectors/gitlab/oauth/callbackTrustedoptionalInstance-wide only.ConfidentialonDevice authorization grantoffScopesread_apiOnly this one.Select Save application. GitLab shows the Application ID and the Secret.
- 3
Paste three values into Busfactor
Settings → Connectors → GitLab
GitLab URLApplication IDSecretSave and connect - 4
Approve on your GitLab
Select Authorize. Approve with an account that has Reporter or above on the projects you want read.
- 5
The first read starts
Projects listedRead, up to your repository capFirst verdictArchived, empty and forked projects stay off. Turn any project on or off in Settings.
Troubleshooting
| You see | Fix |
|---|---|
| GitLab: “The redirect URI included is not valid.” | Redirect URI mismatch. Paste it again from step 2. |
| GitLab: “The requested scope is invalid, unknown, or malformed.” | The application does not have read_api. Tick it, save, connect again. |
| GitLab: “Client authentication failed due to unknown client…” | Wrong Application ID. Copy it again from the application page in GitLab. |
| Busfactor: “does not recognise that Application ID and Secret” | Copy both again. After Renew secret, paste the new Secret. |
| Busfactor: “cannot reach <host> from the internet” | Open HTTPS (443) to your GitLab from the internet. |
| Busfactor: “TLS certificate the internet does not trust” | Serve GitLab with a publicly trusted certificate. Let’s Encrypt works; a private CA does not. |
| Busfactor: “points at a private network address” | Enter the public address. Hosts that resolve to 10.x, 172.16-31.x or 192.168.x are refused. |
| Connected, no projects listed | The approving account needs Reporter or above on the projects. Connect again with one that has it. |
| Busfactor: “removed from GitLab” | The grant was revoked, the application deleted or the user blocked. Press Connect GitLab again. |
What Busfactor reads, and never does
- Projects you are a member of
- Merge requests and their approvals
- Merge request comments
- Diffs, as line counts per file
- Who approved the connection
- Write, comment, approve or merge
- Clone a repository
- Store file contents
- Touch runners, registry or settings
- Read projects outside your membership
Disconnect in Settings revokes the token. Delete the application in GitLab and every grant ends.