GitLab Community Edition (CE)

This project serves as a template to run gitlab-ce in a docker container using docker compose.
ℹ️ For GitLab on a cloud k8s environment, see GitLab's Cloud Native Hybrid reference architectures.

The docker image is a monolithic image of GitLab running all the necessary services in a single container. Mattermost has been deprecated from the GitLab Omnibus package with v19.0.

If you currently use Mattermost bundled with GitLab, refer to Migrating from GitLab Omnibus to Mattermost Standalone in the Mattermost documentation for migration instructions and available Mattermost editions.

– Deprecations and removals by version | GitLab Docs

Features:

• GitLab CE with Container Registry enabled.
  • Disabled: LDAP, Reply by email and Gitlab Pages
  • Includes gitlab-runner to register shared runners.
• Pre-configured to run at subdomains of your own domain:
  • GitLab: gitlab.mydomain.com
  • Container Registry: glcr.mydomain.com
• Exposes GitLab shell on port 10022 by default.
• Sends emails through an exim-relay container by default.
• Use of an .env file for variable substitution in the Compose file.

About GitLab:

• Homepage: https://about.gitlab.com
• Documentation: https://docs.gitlab.com/omnibus/docker/

Table of Contents

• Prerequisites
• Install
• Usage
• Further reading
• Contributing
• Support
• License

Prerequisites

The following is required:

• DNS records for all subdomains pointing to this host.
• Allowing connections on port 10022 to access GitLab shell (Git over SSH).

Hardware requirements:

• Storage: As a rule of thumb you should have at least as much free space as all your repositories combined take up
• CPU: 4 cores is the recommended minimum number of cores and supports up to 500 users
• Memory: 4 GB RAM is the required minimum memory size and supports up to 500 users

Install

This project depends on the following Docker Deployment:

• Træfik: TLS termination, reverse proxy

Usage

1. Create an external docker network named "vcs":

   docker network create vcs
   

2. Make a copy of all sample. files:

   for file in sample.*; do cp "$file" "${file#sample.}"; done;
   

3. Update at least environment variables GL_DOMAIN and GL_CERTRESOLVER_NAME in '.env':

   • Replace mydomain.com with your own domain that serves the subdomains.
   • Replace mydomain-com with a valid certificate resolvers name of Træfik.

4. Optional: Set these environment variables in '.env':

   • GL_TZ: A valid tz database time zone (default: Etc/UTC)

   • GITLAB_SHELL_SSH_PORT: GitLab Shell SSH port (default: 10022)

   • GL_INITIAL_ROOT_PASSWORD: Initial default admin password (default: password)

   • GL_INITIAL_SHARED_RUNNERS_REGISTRATION_TOKEN: Initial shared runners registration token (default: set by GitLab)
     Generate random registration token:

     LC_ALL=C tr -cd 'A-Za-z0-9' < /dev/urandom | fold -w 20 | head -n 1
     

   • GL_SMTP_PASSWORD: SMTP server password (disabled)

   • GL_SMTP_ADDRESS: SMTP server address (default: smtp)

   • GL_SMTP_PORT: SMTP server port (default: 8025)

5. Optional: Set these environment variables in 'docker-compose.yml':

   • Uncomment line 65 if you have set GL_INITIAL_SHARED_RUNNERS_REGISTRATION_TOKEN in step 4.

6. Start the container in detached mode:

   docker compose up -d
   

GitLab

Open https://gitlab.mydomain.com, log in as user root and check the following settings:

• Admin Area > Settings > General > Visibility and access controls:
  • Default project visibility
  • Default snippet visibility
  • Default group visibility
  • Restricted visibility levels
• Admin Area > Settings > General > Sign-up restrictions:
  • Sign-up enabled
• Admin Area > Settings > General > Sign-in restrictions > Email notification for unknown sign-ins:
  • Notify users by email when sign-in location is not recognized
• Admin Area > Settings > Preferences > Localization:
  • Default first day of the week

Change the following settings:

• Admin Area > Settings > General > Third party offers:
  • Tick "Do not display offers from third parties within GitLab"
• Admin Area > Settings > Metrics and profiling > Usage statistics:
  • Untick "Enable usage ping"
• Admin Area > Settings > Network > Outbound requests:
  • Tick "Allow requests to the local network from web hooks and services"
• Admin Area > Settings > Preferences > Email:
  • Untick "Enable in-product marketing emails"

Register shared runners

docker exec -ti vcs-gitlab-runner-1 bash -c "gitlab-runner register"

1. Enter your GitLab instance URL:

   Please enter the gitlab-ci coordinator URL (e.g. https://gitlab.com )
   https://gitlab.mydomain.com
   

2. Enter the token you obtained to register the Runner:

   Please enter the gitlab-ci token for this runner
   <registration token>
   

3. Enter a description for the Runner, you can change this later in GitLab’s UI:

   Please enter the gitlab-ci description for this runner
   Shared Runner
   

4. Enter the tags associated with the Runner, you can change this later in GitLab’s UI:

   Please enter the gitlab-ci tags for this runner (comma separated):
   <Enter>
   

5. Enter the Runner executor:

   Please enter the executor: ssh, docker+machine, docker-ssh+machine, kubernetes, docker, parallels, virtualbox, docker-ssh, shell:
   docker
   

6. If you chose Docker as your executor, you’ll be asked for the default image to be used for projects that do not define one in .gitlab-ci.yml:

   Please enter the Docker image (eg. ruby:2.1):
   alpine:latest
   

See also Configuring GitLab Runner.

Further reading

GitLab:

• Omnibus GitLab Docs
  • Setting up LDAP sign-in
  • SMTP settings
    → As long as you are using the exim-relay, emails will likely end up in your spam folder!
  • Reply by email
  • GitLab Pages administration
• GitLab Runner Docs
  • Advanced configuration

Contributing

PRs accepted. Please submit to the GitLab repository.

This project follows the Contributor Covenant Code of Conduct.

Support

Community support: Open a new discussion here.

Commercial support: Contact b-data by email.

License

Copyright © 2019 b-data GmbH

Distributed under the terms of the MIT License.