remove!(gitlab): unused
This commit is contained in:
parent
14e358c5fe
commit
aa576bf5bc
GPG key ID:
67585F0065E261D5
7 changed files with 0 additions and 719 deletions
|
|
@ -1,25 +0,0 @@
|
||||||
---
|
|
||||||
# Infrastructure
|
|
||||||
# Ansible instructions to deploy the infrastructure
|
|
||||||
# Copyright (C) 2019-2020 Christoph (Sheogorath) Kern
|
|
||||||
# Copyright (C) 2020 Saibotk
|
|
||||||
#
|
|
||||||
# This program is free software: you can redistribute it and/or modify
|
|
||||||
# it under the terms of the GNU General Public License as published by
|
|
||||||
# the Free Software Foundation, version 3 of the License.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
|
|
||||||
- name: Install & configure GitLab
|
|
||||||
hosts: gitlab
|
|
||||||
roles:
|
|
||||||
- docker
|
|
||||||
- docker_cleanup
|
|
||||||
- traefik
|
|
||||||
- gitlab
|
|
||||||
|
|
@ -1,35 +0,0 @@
|
||||||
Gitlab
|
|
||||||
=========
|
|
||||||
|
|
||||||
This will setup a Gitlab instance using their official docker container and traefik as a reverse proxy.
|
|
||||||
|
|
||||||
Requirements
|
|
||||||
------------
|
|
||||||
|
|
||||||
You will need to have docker, docker-compose and traefik installed or declared as dependencies with their respective roles.
|
|
||||||
|
|
||||||
**This role assumes that you have setup traefik with an endpoint called `websecure`.**
|
|
||||||
|
|
||||||
Role Variables
|
|
||||||
--------------
|
|
||||||
|
|
||||||
**Please look at the [defaults/main.yml](defaults/main.yml) for all available variables and their description.**
|
|
||||||
|
|
||||||
**Note: Lines that are commented out via `#` are usually still valid/used variables, but they are not defined by default, so they might enable a feature, when uncommenting/defining them!**
|
|
||||||
|
|
||||||
### Global variables, that are used:
|
|
||||||
|
|
||||||
- `proxy_network`: Defined by the local traefik installation, this is the shared proxy network used by traefik to reach the containers. (optional)
|
|
||||||
- `proxy_hiddenservice`: Defined by the local traefik installation, this is used to generate the alt-svc header for the alternative Tor domain. (optional)
|
|
||||||
|
|
||||||
Dependencies
|
|
||||||
------------
|
|
||||||
|
|
||||||
- docker
|
|
||||||
- docker-compose
|
|
||||||
- traefik
|
|
||||||
|
|
||||||
License
|
|
||||||
-------
|
|
||||||
|
|
||||||
GPL-3.0-only
|
|
||||||
|
|
@ -1,167 +0,0 @@
|
||||||
---
|
|
||||||
# Default variables for the gitlab role
|
|
||||||
|
|
||||||
# Infrastructure
|
|
||||||
# Ansible instructions to deploy the infrastructure
|
|
||||||
# Copyright (C) 2019-2020 Christoph (Sheogorath) Kern
|
|
||||||
# Copyright (C) 2020 Saibotk
|
|
||||||
#
|
|
||||||
# This program is free software: you can redistribute it and/or modify
|
|
||||||
# it under the terms of the GNU General Public License as published by
|
|
||||||
# the Free Software Foundation, version 3 of the License.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
|
|
||||||
# Install location settings
|
|
||||||
gitlab_install_location: /srv/gitlab
|
|
||||||
gitlab_data_location: "{{ gitlab_install_location }}/data"
|
|
||||||
gitlab_config_location: "{{ gitlab_install_location }}/config"
|
|
||||||
gitlab_log_location: "{{ gitlab_install_location }}/log"
|
|
||||||
gitlab_telegraf_location: "{{ gitlab_install_location }}/telegraf"
|
|
||||||
|
|
||||||
# Put GitLab's logs in a tempfs instead to save headache with diskspace
|
|
||||||
gitlab_log_tmpfs: false
|
|
||||||
|
|
||||||
# Set the certresolver to your desired traefik certresolver.
|
|
||||||
# Note: This is `letsencrypt_cf` by default for backwards compatibility, you might want to use `letsencrypt_http` instead, depending on your setup
|
|
||||||
gitlab_traefik_certresolver: letsencrypt_http
|
|
||||||
|
|
||||||
# The domain under which traefik should make gitlab (and, if enabled, the registry) reachable
|
|
||||||
gitlab_domain: gitlab.example.com
|
|
||||||
gitlab_registry_domain: registry.gitlab.example.com
|
|
||||||
|
|
||||||
# The Gitlab version, usually you don't need to adjust this for a host.
|
|
||||||
# renovate: depName=gitlab/gitlab-ce
|
|
||||||
gitlab_version: 17.5.1-ce.0
|
|
||||||
|
|
||||||
# renovate: depName=docker.io/library/telegraf
|
|
||||||
gitlab_telegraf_version: "1.26"
|
|
||||||
|
|
||||||
# The port you want Gitlab to listen on for SSH connections
|
|
||||||
gitlab_ssh_port: 22
|
|
||||||
|
|
||||||
# The memory limits for the GitLab container
|
|
||||||
#
|
|
||||||
# Notice the gitlab_memoryswap_limit must be equal
|
|
||||||
# or higher than the gitlab_memory_limit
|
|
||||||
gitlab_memory_limit: "6096mb"
|
|
||||||
gitlab_memoryswap_limit: "6352mb"
|
|
||||||
|
|
||||||
# Enable or disable selinux handling
|
|
||||||
gitlab_selinux_enabled: true
|
|
||||||
|
|
||||||
# Email/SMTP settings
|
|
||||||
gitlab_smtp_address: smtp.example.com
|
|
||||||
gitlab_smtp_port: 465
|
|
||||||
gitlab_smtp_user_name: "gitlab@example.com"
|
|
||||||
gitlab_smtp_password: "{{ lookup('passwordstore', gitlab_domain + '/' + gitlab_smtp_user_name + ' create=true length=42') }}"
|
|
||||||
gitlab_smtp_tls: "{{ gitlab_snmp_tls | default('true') }}" # There was a typo in the config option name, this makes sure it's falling back properly
|
|
||||||
gitlab_email_from: "{{ gitlab_smtp_user_name }}"
|
|
||||||
gitlab_email_reply_to: "{{ gitlab_smtp_user_name }}"
|
|
||||||
gitlab_smtp_starttls_auto: false
|
|
||||||
gitlab_smtp_openssl_verify_mode: "peer"
|
|
||||||
|
|
||||||
# Libravatar / Gravatar URLs
|
|
||||||
gitlab_libravatar_plain: "cdn.libravatar.org"
|
|
||||||
gitlab_libravatar_ssl: "seccdn.libravatar.org"
|
|
||||||
|
|
||||||
# CSP settings
|
|
||||||
gitlab_csp:
|
|
||||||
enabled: true
|
|
||||||
img_src: "https:"
|
|
||||||
# yamllint disable-line rule:line-length
|
|
||||||
# frame_src: "https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://content.googleapis.com https://content-compute.googleapis.com https://content-cloudbilling.googleapis.com https://content-cloudresourcemanager.googleapis.com"
|
|
||||||
# script_src: "https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.gstatic.com/recaptcha/ https://apis.google.com"
|
|
||||||
|
|
||||||
# SAML settings
|
|
||||||
gitlab_saml:
|
|
||||||
enabled: false
|
|
||||||
label: "SAML"
|
|
||||||
groups_attribute: "roles"
|
|
||||||
external_groups: "{{ gitlab_domain }}:external"
|
|
||||||
idp_cert_fingerprint: "<to be set>"
|
|
||||||
idp_sso_target_url: "https://sso.example.com"
|
|
||||||
idp_slo_target_url: "https://sso.example.com"
|
|
||||||
issuer: "{{ gitlab_domain }}"
|
|
||||||
certificate: "<cert without '----BEGIN CERTIFICATE----' (can be omited)>"
|
|
||||||
private_key: "<private key without '----BEGIN RSA PRIVATE KEY----' (can be omited)>"
|
|
||||||
attribute_statements:
|
|
||||||
first_name: "first_name"
|
|
||||||
last_name: "last_name"
|
|
||||||
name: "name"
|
|
||||||
username: "username"
|
|
||||||
email: "email"
|
|
||||||
name_identifier_format: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
|
|
||||||
autologin: false
|
|
||||||
|
|
||||||
# LDAP settings
|
|
||||||
gitlab_ldap:
|
|
||||||
enabled: false
|
|
||||||
label: "LDAP"
|
|
||||||
host: "ldap.example.com"
|
|
||||||
port: 389
|
|
||||||
bind_dn: "_the_full_dn_of_the_user_you_will_bind_with"
|
|
||||||
password: "_the_password_of_the_bind_user"
|
|
||||||
encryption: "simple_tls"
|
|
||||||
verify_certificates: true
|
|
||||||
uid: "sAMAccountName"
|
|
||||||
active_directory: true
|
|
||||||
user_filter: ""
|
|
||||||
base: "dc=example,dc=com"
|
|
||||||
|
|
||||||
# IMAP settings (for email replies to comments etc.)
|
|
||||||
gitlab_imap:
|
|
||||||
enabled: false
|
|
||||||
username: "{{ gitlab_smtp_user_name }}"
|
|
||||||
password: "{{ gitlab_smtp_password }}"
|
|
||||||
server_address: imap.example.com
|
|
||||||
email_address: "incoming+%{key}@gitlab.example.com"
|
|
||||||
|
|
||||||
# Gitlab docker registry settings
|
|
||||||
gitlab_registry:
|
|
||||||
enabled: false
|
|
||||||
# Defines the port that is appended to the registry domain used by gitlab.
|
|
||||||
# This can be omitted, when no port is needed (eg. registry on its own domain)
|
|
||||||
external_port: 5050
|
|
||||||
# Defines the entrypoint that traefik should use for the registry.
|
|
||||||
# Can be useful to use another port while still using the certificate of the main domain.
|
|
||||||
# This can be omitted to use "websecure" by default
|
|
||||||
traefik_entrypoint: "websecure"
|
|
||||||
|
|
||||||
# Gitlab telegraf configuration, allows to configure a monitoring setup for Gitlab
|
|
||||||
gitlab_telegraf:
|
|
||||||
enabled: false
|
|
||||||
# Your influxDB hosts
|
|
||||||
influxdb_endpoints:
|
|
||||||
- "influxdb.example.com"
|
|
||||||
influxdb_username: telegraf
|
|
||||||
influxdb_password: ""
|
|
||||||
influxdb_retention_policy: "gitlab"
|
|
||||||
influxdb_retention_policy_tag: ""
|
|
||||||
# Token provided by Gitlab on the admin page
|
|
||||||
# See https://docs.gitlab.com/ee/administration/monitoring/prometheus/gitlab_metrics.html
|
|
||||||
metrics_token: ""
|
|
||||||
|
|
||||||
# Gitlab dependency proxy feature (see https://docs.gitlab.com/ee/administration/packages/dependency_proxy.html)
|
|
||||||
gitlab_dependency_proxy:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
# Enable the packages feature (see https://docs.gitlab.com/ee/administration/packages/index.html)
|
|
||||||
gitlab_packages:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
# IPv6 ULA config for the bridge network used by docker-ipv6-nat
|
|
||||||
gitlab_ipv6:
|
|
||||||
enabled: false
|
|
||||||
subnet: "fd9e:21a7:a92c:2326::/64"
|
|
||||||
|
|
||||||
# Gitlab bundled Mattermost instance settings
|
|
||||||
gitlab_mattermost:
|
|
||||||
enabled: false
|
|
||||||
domain: chat.gitlab.com
|
|
||||||
|
|
@ -1,44 +0,0 @@
|
||||||
galaxy_info:
|
|
||||||
author: saibotk
|
|
||||||
description: "Installs and configures GitLab via Docker."
|
|
||||||
license: GPL-3.0-only
|
|
||||||
min_ansible_version: "2.9"
|
|
||||||
standalone: true
|
|
||||||
|
|
||||||
platforms:
|
|
||||||
- name: EL
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
- name: GenericUNIX
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
- name: Fedora
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
- name: opensuse
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
- name: GenericBSD
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
- name: FreeBSD
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
- name: Ubuntu
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
- name: SLES
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
- name: GenericLinux
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
- name: Debian
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
|
|
||||||
galaxy_tags: []
|
|
||||||
|
|
||||||
dependencies:
|
|
||||||
- role: docker
|
|
||||||
- role: traefik
|
|
||||||
|
|
@ -1,101 +0,0 @@
|
||||||
---
|
|
||||||
# Tasks file for the gitlab role
|
|
||||||
|
|
||||||
# Infrastructure
|
|
||||||
# Ansible instructions to deploy the infrastructure
|
|
||||||
# Copyright (C) 2019-2020 Christoph (Sheogorath) Kern
|
|
||||||
# Copyright (C) 2020 Saibotk
|
|
||||||
#
|
|
||||||
# This program is free software: you can redistribute it and/or modify
|
|
||||||
# it under the terms of the GNU General Public License as published by
|
|
||||||
# the Free Software Foundation, version 3 of the License.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
|
|
||||||
- name: Update default SELinux contexts
|
|
||||||
community.general.sefcontext:
|
|
||||||
target: "{{ item }}(/.*)?"
|
|
||||||
setype: "container_file_t"
|
|
||||||
state: present
|
|
||||||
with_items:
|
|
||||||
- "{{ gitlab_data_location }}"
|
|
||||||
- "{{ gitlab_config_location }}"
|
|
||||||
- "{{ gitlab_log_location }}"
|
|
||||||
- "{{ gitlab_telegraf_location }}"
|
|
||||||
tags:
|
|
||||||
- gitlab
|
|
||||||
when:
|
|
||||||
- gitlab_selinux_enabled
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: Create install directory
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ item }}"
|
|
||||||
state: directory
|
|
||||||
mode: "0700"
|
|
||||||
owner: "root"
|
|
||||||
group: "root"
|
|
||||||
with_items:
|
|
||||||
- "{{ gitlab_install_location }}"
|
|
||||||
tags:
|
|
||||||
- gitlab
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: Create data directory
|
|
||||||
ansible.builtin.file: # noqa risky-file-permissions # Container manages permissions on its own
|
|
||||||
path: "{{ item }}"
|
|
||||||
state: directory
|
|
||||||
owner: "root"
|
|
||||||
group: "root"
|
|
||||||
setype: "container_file_t"
|
|
||||||
with_items:
|
|
||||||
- "{{ gitlab_data_location }}"
|
|
||||||
- "{{ gitlab_config_location }}"
|
|
||||||
- "{{ gitlab_log_location }}"
|
|
||||||
- "{{ gitlab_telegraf_location }}"
|
|
||||||
tags:
|
|
||||||
- gitlab
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: Deploy telegraf.conf
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: telegraf.conf
|
|
||||||
dest: "{{ gitlab_telegraf_location }}/telegraf.conf"
|
|
||||||
mode: "0600"
|
|
||||||
owner: "root"
|
|
||||||
group: "root"
|
|
||||||
tags:
|
|
||||||
- telegraf
|
|
||||||
- gitlab
|
|
||||||
become: true
|
|
||||||
when:
|
|
||||||
- gitlab_telegraf.enabled
|
|
||||||
|
|
||||||
- name: Deploy docker-compose.yml
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: docker-compose.yml
|
|
||||||
dest: "{{ gitlab_install_location }}/docker-compose.yml"
|
|
||||||
mode: "0600"
|
|
||||||
owner: "root"
|
|
||||||
group: "root"
|
|
||||||
validate: docker compose -f %s config -q
|
|
||||||
tags:
|
|
||||||
- docker
|
|
||||||
- gitlab
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: Compose GitLab
|
|
||||||
community.docker.docker_compose_v2:
|
|
||||||
state: present
|
|
||||||
project_src: "{{ gitlab_install_location }}"
|
|
||||||
pull: always
|
|
||||||
remove_orphans: true
|
|
||||||
tags:
|
|
||||||
- gitlab
|
|
||||||
become: true
|
|
||||||
|
|
@ -1,321 +0,0 @@
|
||||||
{{ ansible_managed | comment }}
|
|
||||||
|
|
||||||
# Infrastructure
|
|
||||||
# Ansible instructions to deploy the infrastructure
|
|
||||||
# Copyright (C) 2019-2020 Christoph (Sheogorath) Kern
|
|
||||||
# Copyright (C) 2020 Saibotk
|
|
||||||
#
|
|
||||||
# This program is free software: you can redistribute it and/or modify
|
|
||||||
# it under the terms of the GNU General Public License as published by
|
|
||||||
# the Free Software Foundation, version 3 of the License.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
|
|
||||||
version: '2.1'
|
|
||||||
services:
|
|
||||||
web:
|
|
||||||
image: docker.io/gitlab/gitlab-ce:{{ gitlab_version }}
|
|
||||||
hostname: '{{ gitlab_domain }}'
|
|
||||||
mem_limit: {{ gitlab_memory_limit }}
|
|
||||||
memswap_limit: {{ gitlab_memoryswap_limit }}
|
|
||||||
environment:
|
|
||||||
GITLAB_OMNIBUS_CONFIG: |
|
|
||||||
external_url 'https://{{ gitlab_domain }}'
|
|
||||||
gitlab_rails['gitlab_shell_ssh_port'] = {{ gitlab_ssh_port }}
|
|
||||||
letsencrypt['enable'] = false
|
|
||||||
nginx['listen_https'] = false
|
|
||||||
nginx['listen_port'] = 80
|
|
||||||
nginx['real_ip_trusted_addresses'] = [ '172.16.0.0/12' ]
|
|
||||||
nginx['gzip_enabled'] = false
|
|
||||||
|
|
||||||
prometheus_monitoring['enable'] = false
|
|
||||||
|
|
||||||
# CSP config
|
|
||||||
gitlab_rails['content_security_policy'] = {
|
|
||||||
enabled: {{ gitlab_csp.enabled | default(true) | bool | lower }},
|
|
||||||
report_only: false,
|
|
||||||
directives: {
|
|
||||||
default_src: "'self' {{ gitlab_csp.default_src | default("") }}",
|
|
||||||
script_src: "'self' {{ gitlab_csp.script_src | default("") }} 'unsafe-eval'",
|
|
||||||
frame_ancestor: "'self'",
|
|
||||||
frame_src: "'self' {{ gitlab_csp.frame_src | default("") }}",
|
|
||||||
img_src: "'self' https://{{ gitlab_libravatar_ssl }} {{ gitlab_csp.img_src | default("") }} data: blob:",
|
|
||||||
style_src: "'self' 'unsafe-inline'",
|
|
||||||
worker_src: "'self' blob:",
|
|
||||||
object_src: "'none'"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
# Mail settings
|
|
||||||
gitlab_rails['smtp_enable'] = true
|
|
||||||
gitlab_rails['smtp_address'] = "{{ gitlab_smtp_address }}"
|
|
||||||
gitlab_rails['smtp_port'] = {{ gitlab_smtp_port }}
|
|
||||||
gitlab_rails['smtp_user_name'] = "{{ gitlab_smtp_user_name }}"
|
|
||||||
gitlab_rails['smtp_password'] = "{{ gitlab_smtp_password }}"
|
|
||||||
gitlab_rails['smtp_authentication'] = "login"
|
|
||||||
gitlab_rails['smtp_domain'] = "{{ gitlab_smtp_address }}"
|
|
||||||
gitlab_rails['smtp_tls'] = {{ gitlab_smtp_tls | bool | lower }}
|
|
||||||
gitlab_rails['smtp_enable_starttls_auto'] = {{ gitlab_smtp_starttls_auto | bool | lower }}
|
|
||||||
gitlab_rails['smtp_openssl_verify_mode'] = '{{ gitlab_smtp_openssl_verify_mode }}'
|
|
||||||
|
|
||||||
gitlab_rails['gitlab_email_from'] = '{{ gitlab_email_from }}'
|
|
||||||
gitlab_rails['gitlab_email_reply_to'] = '{{ gitlab_email_reply_to }}'
|
|
||||||
|
|
||||||
# Use Libravatar
|
|
||||||
gitlab_rails['gravatar_enabled'] = true
|
|
||||||
gitlab_rails['gravatar_plain_url'] = "http://{{ gitlab_libravatar_plain }}/avatar/%{hash}?s=%{size}&d=identicon"
|
|
||||||
gitlab_rails['gravatar_ssl_url'] = "https://{{ gitlab_libravatar_ssl }}/avatar/%{hash}?s=%{size}&d=identicon"
|
|
||||||
|
|
||||||
{% if gitlab_imap.enabled %}
|
|
||||||
gitlab_rails['incoming_email_enabled'] = true
|
|
||||||
|
|
||||||
# The email address including the `%{key}` placeholder that will be replaced to reference the item being replied to.
|
|
||||||
# The placeholder can be omitted but if present, it must appear in the "user" part of the address (before the `@`).
|
|
||||||
#gitlab_rails['incoming_email_address'] = "incoming+%{key}@gitlab.example.com"
|
|
||||||
gitlab_rails['incoming_email_address'] = "{{ gitlab_imap.email_address }}"
|
|
||||||
|
|
||||||
# Email account username
|
|
||||||
# With third party providers, this is usually the full email address.
|
|
||||||
# With self-hosted email servers, this is usually the user part of the email address.
|
|
||||||
gitlab_rails['incoming_email_email'] = "{{ gitlab_imap.username }}"
|
|
||||||
# Email account password
|
|
||||||
gitlab_rails['incoming_email_password'] = "{{ gitlab_imap.password }}"
|
|
||||||
|
|
||||||
# IMAP server host
|
|
||||||
gitlab_rails['incoming_email_host'] = "{{ gitlab_imap.server_address }}"
|
|
||||||
# IMAP server port
|
|
||||||
gitlab_rails['incoming_email_port'] = 993
|
|
||||||
# Whether the IMAP server uses SSL
|
|
||||||
gitlab_rails['incoming_email_ssl'] = true
|
|
||||||
# Whether the IMAP server uses StartTLS
|
|
||||||
gitlab_rails['incoming_email_start_tls'] = false
|
|
||||||
|
|
||||||
# The mailbox where incoming mail will end up. Usually "inbox".
|
|
||||||
gitlab_rails['incoming_email_mailbox_name'] = "inbox"
|
|
||||||
# The IDLE command timeout.
|
|
||||||
gitlab_rails['incoming_email_idle_timeout'] = 60
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if gitlab_packages.enabled %}
|
|
||||||
# Gitlab packages
|
|
||||||
gitlab_rails['packages_enabled'] = true
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if gitlab_dependency_proxy.enabled %}
|
|
||||||
# Gitlab dependency proxy
|
|
||||||
gitlab_rails['dependency_proxy_enabled'] = true
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if gitlab_registry.enabled %}
|
|
||||||
# Gitlab registry
|
|
||||||
gitlab_rails['registry_enabled'] = true
|
|
||||||
gitlab_rails['registry_host'] = "{{ gitlab_registry_domain }}"
|
|
||||||
registry_external_url "https://{{ gitlab_registry_domain }}{% if gitlab_registry.external_port is defined %}:{{ gitlab_registry.external_port }}{% endif %}"
|
|
||||||
registry_nginx['listen_port'] = 5040
|
|
||||||
registry_nginx['listen_https'] = false
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if gitlab_mattermost.enabled %}
|
|
||||||
# Mattermost
|
|
||||||
mattermost_external_url 'https://{{ gitlab_mattermost.domain }}'
|
|
||||||
mattermost_nginx['listen_port'] = 8050
|
|
||||||
mattermost_nginx['listen_https'] = false
|
|
||||||
mattermost['gitlab_auth_endpoint'] = "http://{{ gitlab_domain }}/oauth/authorize"
|
|
||||||
mattermost['gitlab_token_endpoint'] = "http://{{ gitlab_domain }}/oauth/token"
|
|
||||||
mattermost['gitlab_user_api_endpoint'] = "http://{{ gitlab_domain }}/api/v4/user"
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if gitlab_ldap.enabled %}
|
|
||||||
gitlab_rails['ldap_enabled'] = true
|
|
||||||
gitlab_rails['prevent_ldap_sign_in'] = false
|
|
||||||
gitlab_rails['ldap_servers'] = {
|
|
||||||
'main' => {
|
|
||||||
'label' => '{{ gitlab_ldap.label }}',
|
|
||||||
'host' => '{{ gitlab_ldap.host }}',
|
|
||||||
'port' => {{ gitlab_ldap.port }},
|
|
||||||
'uid' => '{{ gitlab_ldap.uid }}',
|
|
||||||
'encryption' => '{{ gitlab_ldap.encryption }}',
|
|
||||||
'verify_certificates' => {{ gitlab_ldap.verify_certificates | bool | lower }},
|
|
||||||
'bind_dn' => '{{ gitlab_ldap.bind_dn }}',
|
|
||||||
'password' => '{{ gitlab_ldap.password }}',
|
|
||||||
'timeout' => 10,
|
|
||||||
'active_directory' => {{ gitlab_ldap.active_directory | bool | lower }},
|
|
||||||
'allow_username_or_email_login' => false,
|
|
||||||
'block_auto_created_users' => false,
|
|
||||||
'base' => '{{ gitlab_ldap.base }}',
|
|
||||||
'attributes' => {
|
|
||||||
'username' => ['uid', 'userid', 'sAMAccountName'],
|
|
||||||
'email' => ['mail', 'email', 'userPrincipalName'],
|
|
||||||
'name' => 'cn',
|
|
||||||
'first_name' => 'givenName',
|
|
||||||
'last_name' => 'sn'
|
|
||||||
},
|
|
||||||
'lowercase_usernames' => false
|
|
||||||
}
|
|
||||||
}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if gitlab_saml.enabled %}
|
|
||||||
# SAML settings
|
|
||||||
gitlab_rails['omniauth_enabled'] = true
|
|
||||||
gitlab_rails['omniauth_allow_single_sign_on'] = ['saml']
|
|
||||||
gitlab_rails['omniauth_block_auto_created_users'] = false
|
|
||||||
gitlab_rails['omniauth_auto_link_ldap_user'] = false
|
|
||||||
gitlab_rails['omniauth_auto_link_saml_user'] = false
|
|
||||||
gitlab_rails['omniauth_external_providers'] = []
|
|
||||||
gitlab_rails['omniauth_providers'] = [
|
|
||||||
{
|
|
||||||
name: 'saml',
|
|
||||||
label: '{{ gitlab_saml.label }}',
|
|
||||||
groups_attribute: '{{ gitlab_saml.groups_attribute }}',
|
|
||||||
external_groups: ['{{ gitlab_saml.external_groups }}'],
|
|
||||||
args: {
|
|
||||||
assertion_consumer_service_url: 'https://{{ gitlab_domain }}/users/auth/saml/callback',
|
|
||||||
idp_cert_fingerprint: '{{ gitlab_saml.idp_cert_fingerprint }}',
|
|
||||||
idp_sso_target_url: '{{ gitlab_saml.idp_sso_target_url }}',
|
|
||||||
idp_slo_target_url: '{{ gitlab_saml.idp_slo_target_url }}',
|
|
||||||
{% if gitlab_saml.certificate is defined and gitlab_saml.private_key is defined %}
|
|
||||||
certificate: '-----BEGIN CERTIFICATE-----
|
|
||||||
{{ gitlab_saml.certificate }}
|
|
||||||
-----END CERTIFICATE-----',
|
|
||||||
private_key: '-----BEGIN RSA PRIVATE KEY-----
|
|
||||||
{{ gitlab_saml.private_key }}
|
|
||||||
-----END RSA PRIVATE KEY-----',
|
|
||||||
security: {
|
|
||||||
authn_requests_signed: true,
|
|
||||||
want_assertions_signed: true,
|
|
||||||
embed_sign: true,
|
|
||||||
signature_method: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
|
|
||||||
digest_method: 'http://www.w3.org/2001/04/xmlenc#sha256',
|
|
||||||
},
|
|
||||||
{% endif %}
|
|
||||||
issuer: '{{ gitlab_saml.issuer }}',
|
|
||||||
attribute_statements: {
|
|
||||||
first_name: ['{{ gitlab_saml.attribute_statements.first_name }}'],
|
|
||||||
last_name: ['{{ gitlab_saml.attribute_statements.last_name }}'],
|
|
||||||
name: ['{{ gitlab_saml.attribute_statements.name }}'],
|
|
||||||
username: ['{{ gitlab_saml.attribute_statements.username }}'],
|
|
||||||
email: ['{{ gitlab_saml.attribute_statements.email }}'] },
|
|
||||||
name_identifier_format: '{{ gitlab_saml.name_identifier_format }}',
|
|
||||||
upstream_two_factor_authn_contexts:
|
|
||||||
%w(
|
|
||||||
urn:oasis:names:tc:SAML:2.0:ac:classes:CertificateProtectedTransport
|
|
||||||
urn:oasis:names:tc:SAML:2.0:ac:classes:SecondFactorOTPSMS
|
|
||||||
urn:oasis:names:tc:SAML:2.0:ac:classes:SecondFactorIGTOKEN
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
]
|
|
||||||
{% if gitlab_saml.autologin %}
|
|
||||||
gitlab_rails['omniauth_auto_sign_in_with_provider'] = 'saml'
|
|
||||||
{% endif %}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if gitlab_log_tmpfs %}
|
|
||||||
# Configure logging to only retain 10 log files, of 10MiB each
|
|
||||||
# This should prevent the tmpfs from overflowing
|
|
||||||
logging['svlogd_size'] = 10 * 1024 * 1024
|
|
||||||
logging['svlogd_num'] = 5
|
|
||||||
logging['logrotate_maxsize'] = 10 * 1024 * 1024
|
|
||||||
logging['logrotate_rotate'] = 5
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
labels:
|
|
||||||
- "traefik.http.routers.gitlab.rule=Host(`{{ gitlab_domain }}`) && PathPrefix(`/`)"
|
|
||||||
- "traefik.http.routers.gitlab.entrypoints=websecure"
|
|
||||||
- "traefik.http.routers.gitlab.tls=true"
|
|
||||||
- "traefik.http.routers.gitlab.tls.certresolver={{ gitlab_traefik_certresolver }}"
|
|
||||||
- "traefik.http.routers.gitlab.middlewares=gitlab,compress"
|
|
||||||
- "traefik.http.routers.gitlab.service=gitlab"
|
|
||||||
- "traefik.http.services.gitlab.loadbalancer.server.port=80"
|
|
||||||
|
|
||||||
{% if gitlab_registry.enabled %}
|
|
||||||
- "traefik.http.routers.gitlab-registry.rule=Host(`{{ gitlab_registry_domain }}`) && PathPrefix(`/`)"
|
|
||||||
- "traefik.http.routers.gitlab-registry.entrypoints={{ gitlab_registry.traefik_entrypoint | default('websecure') }}"
|
|
||||||
- "traefik.http.routers.gitlab-registry.tls=true"
|
|
||||||
- "traefik.http.routers.gitlab-registry.tls.certresolver={{ gitlab_traefik_certresolver }}"
|
|
||||||
- "traefik.http.routers.gitlab-registry.middlewares=gitlab,compress"
|
|
||||||
- "traefik.http.routers.gitlab-registry.service=gitlab-registry"
|
|
||||||
- "traefik.http.services.gitlab-registry.loadbalancer.server.port=5040"
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if gitlab_mattermost.enabled %}
|
|
||||||
- "traefik.http.routers.gitlab-mattermost.rule=Host(`{{ gitlab_mattermost.domain }}`) && PathPrefix(`/`)"
|
|
||||||
- "traefik.http.routers.gitlab-mattermost.entrypoints=websecure"
|
|
||||||
- "traefik.http.routers.gitlab-mattermost.tls=true"
|
|
||||||
- "traefik.http.routers.gitlab-mattermost.tls.certresolver={{ gitlab_traefik_certresolver }}"
|
|
||||||
- "traefik.http.routers.gitlab-mattermost.middlewares=gitlab,compress"
|
|
||||||
- "traefik.http.routers.gitlab-mattermost.service=gitlab-mattermost"
|
|
||||||
- "traefik.http.services.gitlab-mattermost.loadbalancer.server.port=8050"
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
- "traefik.http.middlewares.gitlab.headers.sslredirect=true"
|
|
||||||
- "traefik.http.middlewares.gitlab.headers.stsSeconds=63072000"
|
|
||||||
|
|
||||||
- "traefik.enable=true"
|
|
||||||
{% if proxy_network is defined %}
|
|
||||||
- "traefik.docker.network={{ proxy_network }}"
|
|
||||||
{% endif %}
|
|
||||||
{% if proxy_hiddenservice is defined and proxy_hiddenservice.content is defined %}
|
|
||||||
- "traefik.http.middlewares.gitlab.headers.customresponseheaders.alt-svc=h2={{ proxy_hiddenservice['content'] | b64decode | trim }}:443; ma=2592000"
|
|
||||||
{% endif %}
|
|
||||||
volumes:
|
|
||||||
- "{{ gitlab_data_location }}:/var/opt/gitlab"
|
|
||||||
- "{{ gitlab_config_location }}:/etc/gitlab"
|
|
||||||
{% if not gitlab_log_tmpfs %}
|
|
||||||
- "{{ gitlab_log_location }}:/var/log/gitlab"
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
|
|
||||||
{% if gitlab_log_tmpfs %}
|
|
||||||
tmpfs:
|
|
||||||
- "/var/log/gitlab:size=256M,noexec,nodev,nosuid,rw"
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
restart: always
|
|
||||||
ports:
|
|
||||||
- "{{ gitlab_ssh_port }}:22"
|
|
||||||
{% if proxy_network is defined or gitlab_ipv6 is defined and gitlab_ipv6.enabled %}
|
|
||||||
networks:
|
|
||||||
{% if proxy_network is defined %}
|
|
||||||
{{ proxy_network }}:
|
|
||||||
{% endif %}
|
|
||||||
{% if gitlab_ipv6 is defined and gitlab_ipv6.enabled %}
|
|
||||||
gitlab-ipv6:
|
|
||||||
{% endif %}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
|
|
||||||
{% if gitlab_telegraf.enabled %}
|
|
||||||
telegraf:
|
|
||||||
image: docker.io/library/telegraf:{{ gitlab_telegraf_version }}
|
|
||||||
restart: always
|
|
||||||
mem_limit: 256mb
|
|
||||||
memswap_limit: 384mb
|
|
||||||
read_only: false # TODO: Switch to self-made container
|
|
||||||
volumes:
|
|
||||||
- {{ gitlab_telegraf_location }}:/etc/telegraf/:ro
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if proxy_network is defined or gitlab_ipv6 is defined and gitlab_ipv6.enabled %}
|
|
||||||
networks:
|
|
||||||
{% if proxy_network is defined %}
|
|
||||||
{{ proxy_network }}:
|
|
||||||
external: true
|
|
||||||
{% endif %}
|
|
||||||
{% if gitlab_ipv6 is defined and gitlab_ipv6.enabled %}
|
|
||||||
gitlab-ipv6:
|
|
||||||
driver: bridge
|
|
||||||
ipam:
|
|
||||||
driver: default
|
|
||||||
config:
|
|
||||||
- subnet: {{ gitlab_ipv6.subnet }}
|
|
||||||
enable_ipv6: true
|
|
||||||
{% endif %}
|
|
||||||
{% endif %}
|
|
||||||
|
|
@ -1,26 +0,0 @@
|
||||||
{{ ansible_managed | comment }}
|
|
||||||
[global_tags]
|
|
||||||
|
|
||||||
[agent]
|
|
||||||
interval = "10s"
|
|
||||||
round_interval = true
|
|
||||||
metric_batch_size = 1000
|
|
||||||
metric_buffer_limit = 1000000
|
|
||||||
collection_jitter = "5s"
|
|
||||||
flush_interval = "10s"
|
|
||||||
flush_jitter = "5s"
|
|
||||||
precision = ""
|
|
||||||
hostname = "{{ ansible_fqdn }}"
|
|
||||||
omit_hostname = false
|
|
||||||
|
|
||||||
[[outputs.influxdb]]
|
|
||||||
urls = ["https://{{ gitlab_telegraf.influxdb_endpoints | join('","https://') }}"]
|
|
||||||
database = "telegraf"
|
|
||||||
timeout = "5s"
|
|
||||||
retention_policy = "{{ gitlab_telegraf.influxdb_retention_policy }}"
|
|
||||||
retention_policy_tag = "{{ gitlab_telegraf.influxdb_retention_policy_tag }}"
|
|
||||||
username = "{{ gitlab_telegraf.influxdb_username }}"
|
|
||||||
password = "{{ gitlab_telegraf.influxdb_password }}"
|
|
||||||
|
|
||||||
[[inputs.prometheus]]
|
|
||||||
urls = ["http://{{ gitlab_domain }}/-/metrics?token={{ gitlab_telegraf.metrics_token }}"]
|
|
||||||
Loading…
Add table
Reference in a new issue