mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.8
0bf1e8ef8c
Deploy GitLab from the official CNG CE images as six services: webservice (puma) and sidekiq scale to the topology default, workhorse is the sole HTTP entry, gitaly and a one-shot migrations job are pinned singletons, shell runs gitlab-sshd. The Omnibus container, its Dockerfile and the GITLAB_OMNIBUS_* config groups are removed. All rails/workhorse/shell/gitaly configs and shared secrets are pre-rendered by Ansible and mounted read-only; eleven credentials land in meta/schema.yml including an rsa_pem_2048 OIDC signing key (new value_generator algorithm). Postgres, redis and S3 object storage ride the existing lookups; OIDC, SMTP, the public SSH port and the root password are preserved. compose_volumes gains a per-volume nfs:false opt-out so the gitaly repositories volume stays node-local in swarm (upstream forbids git repositories on NFS); nfs_prep skips volumes without driver_opts accordingly. The Nextcloud gitlab integration execs the CNG rails runner. ruby_single_line dies with its only consumer; ruby_dq keeps test coverage. Ports (8181/8080/2222/8075/3808/9122) and service names resolve from single SPOT declarations in meta/services.yml via vars constants; the version pin sits on the webservice image pair so the updater can bump it. Live-validated in compose up to all six services healthy and migrations completed; fresh-install-only semantics for existing Omnibus data are documented. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
118 lines
3.5 KiB
Django/Jinja
118 lines
3.5 KiB
Django/Jinja
---
|
|
production:
|
|
gitlab:
|
|
host: {{ GITLAB_HOSTNAME | to_json }}
|
|
port: {{ GITLAB_WEB_PORT }}
|
|
https: {{ GITLAB_TLS_ENABLED | bool | string | lower }}
|
|
email_enabled: {{ GITLAB_EMAIL_ENABLED | bool | string | lower }}
|
|
{% if GITLAB_EMAIL_ENABLED %}
|
|
email_from: {{ GITLAB_EMAIL['from'] | to_json }}
|
|
email_display_name: "GitLab"
|
|
email_reply_to: {{ GITLAB_EMAIL['from'] | to_json }}
|
|
{% endif %}
|
|
{% if GITLAB_OBJSTORE_ENABLED %}
|
|
object_store:
|
|
enabled: true
|
|
proxy_download: true
|
|
connection:
|
|
provider: "AWS"
|
|
aws_access_key_id: {{ GITLAB_OBJSTORE_ACCESS_KEY | to_json }}
|
|
aws_secret_access_key: {{ GITLAB_OBJSTORE_SECRET_KEY | to_json }}
|
|
region: {{ GITLAB_OBJSTORE_REGION | to_json }}
|
|
endpoint: {{ GITLAB_OBJSTORE_ENDPOINT | to_json }}
|
|
path_style: true
|
|
objects:
|
|
artifacts:
|
|
bucket: {{ (GITLAB_OBJSTORE_BUCKET ~ '/artifacts') | to_json }}
|
|
external_diffs:
|
|
bucket: {{ (GITLAB_OBJSTORE_BUCKET ~ '/external-diffs') | to_json }}
|
|
lfs:
|
|
bucket: {{ (GITLAB_OBJSTORE_BUCKET ~ '/lfs') | to_json }}
|
|
uploads:
|
|
bucket: {{ (GITLAB_OBJSTORE_BUCKET ~ '/uploads') | to_json }}
|
|
packages:
|
|
bucket: {{ (GITLAB_OBJSTORE_BUCKET ~ '/packages') | to_json }}
|
|
dependency_proxy:
|
|
bucket: {{ (GITLAB_OBJSTORE_BUCKET ~ '/dependency-proxy') | to_json }}
|
|
terraform_state:
|
|
bucket: {{ (GITLAB_OBJSTORE_BUCKET ~ '/terraform-state') | to_json }}
|
|
ci_secure_files:
|
|
bucket: {{ (GITLAB_OBJSTORE_BUCKET ~ '/ci-secure-files') | to_json }}
|
|
pages:
|
|
bucket: {{ (GITLAB_OBJSTORE_BUCKET ~ '/pages') | to_json }}
|
|
{% else %}
|
|
object_store:
|
|
enabled: false
|
|
{% endif %}
|
|
incoming_email:
|
|
enabled: false
|
|
artifacts:
|
|
enabled: true
|
|
lfs:
|
|
enabled: true
|
|
pages:
|
|
enabled: false
|
|
mattermost:
|
|
enabled: false
|
|
registry:
|
|
enabled: false
|
|
ldap:
|
|
enabled: false
|
|
kerberos:
|
|
enabled: false
|
|
{% if GITLAB_OIDC_ENABLED %}
|
|
omniauth:
|
|
enabled: true
|
|
allow_single_sign_on: ["openid_connect"]
|
|
block_auto_created_users: false
|
|
auto_link_user: ["openid_connect"]
|
|
providers:
|
|
- name: "openid_connect"
|
|
label: {{ GITLAB_OIDC_LABEL | to_json }}
|
|
args:
|
|
name: "openid_connect"
|
|
scope:
|
|
- "openid"
|
|
- "profile"
|
|
- "email"
|
|
response_type: "code"
|
|
issuer: {{ GITLAB_OIDC_ISSUER | to_json }}
|
|
discovery: true
|
|
uid_field: {{ GITLAB_OIDC_UID_FIELD | to_json }}
|
|
pkce: true
|
|
client_options:
|
|
identifier: {{ GITLAB_OIDC_CLIENT_ID | to_json }}
|
|
secret: {{ GITLAB_OIDC_CLIENT_SECRET | to_json }}
|
|
redirect_uri: {{ GITLAB_OIDC_REDIRECT_URI | to_json }}
|
|
{% else %}
|
|
omniauth:
|
|
enabled: false
|
|
{% endif %}
|
|
gitaly:
|
|
token: {{ GITLAB_GITALY_TOKEN | to_json }}
|
|
repositories:
|
|
storages:
|
|
default:
|
|
path: /var/opt/gitlab/repo
|
|
gitaly_address: "tcp://{{ GITLAB_GITALY_SERVICE_NAME }}:{{ GITLAB_GITALY_PORT }}"
|
|
backup:
|
|
path: "tmp/backups"
|
|
gitlab_shell:
|
|
path: /home/git/gitlab-shell/
|
|
hooks_path: /home/git/gitlab-shell/hooks/
|
|
secret_file: /var/opt/gitlab/config/secrets/.gitlab_shell_secret
|
|
upload_pack: true
|
|
receive_pack: true
|
|
ssh_host: {{ GITLAB_HOSTNAME | to_json }}
|
|
ssh_port: {{ GITLAB_SSH_PORT }}
|
|
git:
|
|
bin_path: /usr/bin/git
|
|
monitoring:
|
|
ip_whitelist:
|
|
- 127.0.0.0/8
|
|
- ::1/128
|
|
sidekiq_health_checks:
|
|
enabled: true
|
|
address: 0.0.0.0
|
|
port: {{ GITLAB_SIDEKIQ_HEALTH_PORT }}
|