add gitlab yml

2026-05-10 22:21:54 -04:00
parent a99cdbe1e6
commit 37f12a8d99
2 changed files with 115 additions and 1 deletions
@@ -0,0 +1,28 @@
+stages:
+  - build
+  - deploy
+
+variables:
+  DOCKER_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
+
+build:
+  stage: build
+  image: docker:24
+  services:
+    - docker:dind
+  script:
+    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
+    - docker build -t $DOCKER_IMAGE .
+    - docker push $DOCKER_IMAGE
+  only:
+    - main
+
+deploy:
+  stage: deploy
+  before_script:
+    - apk add --no-cache openssh-client
+  script:
+    - ssh $VPS_USER@$VPS_IP "docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY"
+    - ssh $VPS_USER@$VPS_IP "docker pull $DOCKER_IMAGE"
+    - ssh $VPS_USER@$VPS_IP "docker stop myapp || true"
+    - ssh $VPS_USER@$VPS_IP "docker run -d --name myapp -p 80:3000 $DOCKER_IMAGE"
@@ -43,4 +43,90 @@ cp .env.docker.production.example .env.docker.production

 # Deploy
 docker compose -f traefik.yaml up -d
-docker compose -f docker-compose.production.yml up --build -d
+docker compose -f docker-compose.production.yml up --build -d
+
+
+
+services:
+  gitlab:
+    image: gitlab/gitlab-ce:latest
+    restart: unless-stopped
+    hostname: ${DOMAIN_NAME}
+
+    # Traefik will handle 80/443 on the host.
+    # Keep SSH exposed separately (pick a fixed port on the host).
+    ports:
+      - "2222:22"
+
+    environment:
+      GITLAB_OMNIBUS_CONFIG: |
+        # Public URL should be HTTPS (Traefik terminates TLS)
+        external_url 'https://${DOMAIN_NAME}'
+
+        # GitLab listens internally on HTTP; Traefik provides HTTPS
+        nginx['listen_port'] = 80
+        nginx['listen_https'] = false
+
+        # Help GitLab understand it's behind a TLS-terminating proxy
+        nginx['proxy_set_headers'] = {
+          "X-Forwarded-Proto" => "https",
+          "X-Forwarded-Ssl" => "on"
+        }
+
+        gitlab_rails['initial_root_password'] = '${ROOT_PASSWORD}'
+
+        # -------------------------
+        # SMTP (required for invites)
+        # -------------------------
+        gitlab_rails['smtp_enable'] = true
+        gitlab_rails['smtp_address'] = "${SMTP_HOST}"
+        gitlab_rails['smtp_port'] = ${SMTP_PORT}
+        gitlab_rails['smtp_user_name'] = "${SMTP_USER}"
+        gitlab_rails['smtp_password'] = "${SMTP_PASS}"
+        gitlab_rails['smtp_domain'] = "${SMTP_DOMAIN}"
+        gitlab_rails['smtp_authentication'] = "login"
+        gitlab_rails['smtp_enable_starttls_auto'] = true
+
+        # Optional: if you use port 465 (implicit TLS), set:
+        # gitlab_rails['smtp_tls'] = true
+
+        gitlab_rails['gitlab_email_from'] = "${SMTP_FROM}"
+        gitlab_rails['gitlab_email_reply_to'] = "${SMTP_REPLY_TO}"
+
+      GITLAB_ROOT_EMAIL: ${ROOT_EMAIL}
+
+    volumes:
+      - gitlab-config:/etc/gitlab
+      - gitlab-logs:/var/log/gitlab
+      - gitlab-data:/var/opt/gitlab
+
+    shm_size: '256m'
+    sysctls:
+      - net.ipv6.conf.all.disable_ipv6=1
+      - net.ipv6.conf.default.disable_ipv6=1
+
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.gitlab.rule=Host(`${DOMAIN_NAME}`)
+      - traefik.http.routers.gitlab.tls=true
+      - traefik.http.routers.gitlab.tls.certresolver=letsencrypt
+      - traefik.http.services.gitlab.loadbalancer.server.port=80
+
+    networks:
+      - traefik-proxy
+
+    # ✅ Fixed logging configuration (moved inside the service)
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+volumes:
+  gitlab-config:
+  gitlab-logs:
+  gitlab-data:
+
+networks:
+  traefik-proxy:
+    external: true