An Ansible role for installing GitLab, a Ruby-based front-end to Git, on any RedHat/CentOS or Debian/Ubuntu linux system.
GitLab’s default administrator account details are below; be sure to login immediately after installation and change these credentials!
root 5iveL!fe
|
Note
|
DISCLAIMER
This role is a fork of geerlingguy/ansible-role-gitlab v3.2.0 (26 November, 2021) (MIT License, Copyright 2017 Jeff Geerling), which is no longer being maintained and has been archived with the following very understandable disclaimer: Deprecated: In September 2023, I deprecated this role as I am no longer maintaining any GitLab instances, and use Gitea instead for my personal work. Please consider forking this role or use someone else’s GitLab role. The role itself is still good and working as can be seen by its
constant star rise (currently 700)
even though there’s been no commit since 2 years. |
Below you can find information on…
-
the role’s required Ansible version
-
the role’s supported platforms
-
the role’s role dependencies
---
galaxy_info:
role_name: "gitlab"
description: "An ansible role for GitLab Git web interface. Fork of geerlingguy.gitlab"
author: "jonaspammer"
license: "MIT"
min_ansible_version: "2.13"
platforms:
# note: text after "actively tested: " represent the docker image name
- name: EL # (Enterprise Linux)
versions:
- "9" # actively tested: rockylinux9
- name: Debian
versions:
- bullseye # actively tested: debian11
- bookworm # actively tested: debian12
- name: Ubuntu
versions:
- focal # actively tested: ubuntu2004
- jammy # actively tested: ubuntu2204
galaxy_tags: []
dependencies: []The Ansible User needs to be able to become.
The community.general collection
must be installed on the Ansible controller.
gitlab_domain: gitlab
gitlab_external_url: "https://{{ gitlab_domain }}/"The domain and URL at which the GitLab instance will be accessible.
This is set as the external_url configuration setting in gitlab.rb,
and if you want to run GitLab on a different port (besides 80/443), you
can specify the port here (e.g. https://gitlab:8443/ for port 8443).
gitlab_git_data_dir: "/var/opt/gitlab/git-data"The gitlab_git_data_dir is the location where all the Git
repositories will be stored. You can use a shared drive or any path on
the system.
gitlab_backup_path: "/var/opt/gitlab/backups"The gitlab_backup_path is the location where Gitlab backups will be
stored.
gitlab_edition: "gitlab-ce"The edition of GitLab to install. Usually either gitlab-ce
(Community Edition) or gitlab-ee (Enterprise Edition).
gitlab_version: ''If you’d like to install a specific version, set the version here
(e.g. 11.4.0-ce.0 for Debian/Ubuntu, or 11.4.0-ce.0.el7 for RedHat/CentOS).
gitlab_install_async_timeout: 600
gitlab_install_async_poll: 5How long you want Ansible to hold ssh connection during GitLab installation task. More Information: https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_async.html
gitlab_config_template: "gitlab.rb.j2"The gitlab.rb.j2 template packaged with this role is meant to be
very generic and serve a variety of use cases. However, many people
would like to have a much more customized version, and so you can
override this role’s default template with your own, adding any
additional customizations you need. To do this:
-
Create a
templatesdirectory at the same level as your playbook. -
Create a
templates\mygitlab.rb.j2file (just choose a different name from the default template). -
Set the variable like:
gitlab_config_template: mygitlab.rb.j2(with the name of your custom template).
gitlab_redirect_http_to_https: true
gitlab_ssl_certificate: "/etc/gitlab/ssl/{{ gitlab_domain }}.crt"
gitlab_ssl_certificate_key: "/etc/gitlab/ssl/{{ gitlab_domain }}.key"GitLab SSL configuration; tells GitLab to redirect normal http requests
to https, and the path to the certificate and key (the default values
will work for automatic self-signed certificate creation, if set to
true in the variable below).
# SSL Self-signed Certificate Configuration.
gitlab_create_self_signed_cert: true
gitlab_self_signed_cert_subj: "/C=US/ST=Missouri/L=Saint Louis/O=IT/CN={{ gitlab_domain }}"Whether to create a self-signed certificate for serving GitLab over a
secure connection. Set gitlab_self_signed_cert_subj according to
your locality and organization.
gitlab_letsencrypt_enable: false
gitlab_letsencrypt_contact_emails: ["[email protected]"]
gitlab_letsencrypt_auto_renew_hour: 1
gitlab_letsencrypt_auto_renew_minute: 30
gitlab_letsencrypt_auto_renew_day_of_month: "*/7"
gitlab_letsencrypt_auto_renew: trueGitLab LetsEncrypt configuration; tells GitLab whether to request and
use a certificate from LetsEncrypt, if gitlab_letsencrypt_enable is
set to true. Multiple contact emails can be configured under
gitlab_letsencrypt_contact_emails as a list.
# LDAP Configuration.
gitlab_ldap_enabled: false
gitlab_ldap_host: "example.com"
gitlab_ldap_port: "389"
gitlab_ldap_uid: "sAMAccountName"
gitlab_ldap_method: "plain"
gitlab_ldap_bind_dn: "CN=Username,CN=Users,DC=example,DC=com"
gitlab_ldap_password: "password"
gitlab_ldap_base: "DC=example,DC=com"GitLab LDAP configuration; if gitlab_ldap_enabled is true, the
rest of the configuration will tell GitLab how to connect to an LDAP
server for centralized authentication.
gitlab_dependencies:
- openssh-server
- postfix
- curl # (Removed for RedHat_9: https://github.com/ansible/ansible/issues/82461)
- openssl
- tzdataDependencies required by GitLab for certain functionality, like timezone
support or email. You may change this list in your own playbook if, for
example, you would like to install exim instead of postfix.
gitlab_time_zone: "UTC"Gitlab timezone.
gitlab_backup_keep_time: "604800"How long to keep local backups (useful if you don’t want backups to fill up your drive!).
gitlab_download_validate_certs: trueControls whether to validate certificates when downloading the GitLab installation repository install script.
# Email configuration.
gitlab_email_enabled: false
gitlab_email_from: "[email protected]"
gitlab_email_display_name: "Gitlab"
gitlab_email_reply_to: "[email protected]"Gitlab system mail configuration. Disabled by default; set
gitlab_email_enabled to true to enable, and make sure you enter
valid from/reply-to values.
# SMTP Configuration
gitlab_smtp_enable: false
gitlab_smtp_address: "smtp.server"
gitlab_smtp_port: "465"
gitlab_smtp_user_name: "smtp user"
gitlab_smtp_password: "smtp password"
gitlab_smtp_domain: "example.com"
gitlab_smtp_authentication: "login"
gitlab_smtp_enable_starttls_auto: true
gitlab_smtp_tls: false
gitlab_smtp_openssl_verify_mode: "none"
gitlab_smtp_ca_path: "/etc/ssl/certs"
gitlab_smtp_ca_file: "/etc/ssl/certs/ca-certificates.crt"Gitlab SMTP configuration; of gitlab_smtp_enable is true, the
rest of the configuration will tell GitLab how to send mails using an
smtp server.
gitlab_nginx_listen_port: 8080If you are running GitLab behind a reverse proxy, you may want to override the listen port to something else.
gitlab_nginx_listen_https: falseIf you are running GitLab behind a reverse proxy, you may wish to terminate SSL at another proxy server or load balancer.
gitlab_nginx_ssl_verify_client: ""
gitlab_nginx_ssl_client_certificate: ""If you want to enable
2-way
SSL Client Authentication, set gitlab_nginx_ssl_verify_client and
add a path to the client certificate in
gitlab_nginx_ssl_client_certificate.
gitlab_default_theme: 2GitLab includes a number of themes, and you can set the default for all users with this variable. See the included GitLab themes to choose a default.
gitlab_extra_settings:
- gitlab_rails:
- key: "trusted_proxies"
value: "['foo', 'bar']"
- key: "env"
type: "plain"
value: |
{
"http_proxy" => "https://my_http_proxy.company.com:3128",
"https_proxy" => "https://my_http_proxy.company.com:3128",
"no_proxy" => "localhost, 127.0.0.1, company.com"
}
- unicorn:
- key: "worker_processes"
value: 5
- key: "pidfile"
value: "/opt/gitlab/var/unicorn/unicorn.pid"Gitlab have many other settings
(see
official documentation), and you can add them with this special
variable gitlab_extra_settings with the concerned setting and the
key and value keywords.
Each variable listed in this section
is dynamically defined when executing this role (and can only be overwritten using ansible.builtin.set_facts) and
is meant to be used not just internally.
Tasks are tagged with the following tags:
| Tag | Purpose |
|---|---|
This role does not have officially documented tags yet. |
|
You can use Ansible to skip tasks, or only run certain tasks by using these tags. By default, all tasks are run when no tags are specified.
|
Note
|
This role is part of many compatible purpose-specific roles of mine. The machine needs to be prepared.
In CI, this is done in ---
- name: prepare
hosts: all
become: true
gather_facts: false
roles:
- role: jonaspammer.bootstrap
# - name: jonaspammer.core_dependenciesThe following diagram is a compilation of the "soft dependencies" of this role as well as the recursive tree of their soft dependencies.
|
roles:
- role: jonaspammer.gitlab
vars:
gitlab_external_url: "https://gitlab.example.com/"A role may work on different distributions, like Red Hat Enterprise Linux (RHEL), even though there is no test for this exact distribution.
| OS Family | Distribution | Distribution Release Date | Distribution End of Life | Accompanying Docker Image |
|---|---|---|---|---|
Rocky |
Rocky Linux 8 (RHEL/CentOS 8 in disguise) |
2021-06 |
2029-05 |
|
Rocky |
Rocky Linux 9 |
2022-07 |
2032-05 |
|
Debian |
Ubuntu 20.04 LTS |
2021-04 |
2025-04 |
|
Debian |
Ubuntu 22.04 LTS |
2022-04 |
2027-04 |
|
Debian |
Debian 11 |
2021-08 |
2024-06 (2026-06 LTS) |
|
Debian |
Debian 12 |
2023-06 |
2026-06 (2028-06 LTS) |
|
The tested ansible versions try to stay equivalent with the
support pattern of Ansible’s community.general collection.
As of writing this is:
-
2.16 (Ansible 9)
Development Dependencies are defined in a
pip requirements file
named requirements-dev.txt.
Example Installation Instructions for Linux are shown below:
# "optional": create a python virtualenv and activate it for the current shell session $ python3 -m venv venv $ source venv/bin/activate $ python3 -m pip install -r requirements-dev.txt
Please take a look at my Ansible Role Development Guidelines.
If interested, I’ve also written down some General Ansible Role Development (Best) Practices.
Versions are defined using Tags, which in turn are recognized and used by Ansible Galaxy.
Versions must not start with v.
When a new tag is pushed,
a GitHub CI workflow
(
)
takes care of importing the role to my Ansible Galaxy Account.
Automatic Tests are run on each Contribution using GitHub Workflows.
The Tests primarily resolve around running Molecule on a varying set of linux distributions and using various ansible versions.
The molecule test also includes a step which lints all ansible playbooks using
ansible-lint
to check for best practices and behaviour that could potentially be improved.
To run the tests, simply run tox on the command line.
You can pass an optional environment variable to define the distribution of the
Docker container that will be spun up by molecule:
$ MOLECULE_DISTRO=ubuntu2204 tox
For a list of possible values fed to MOLECULE_DISTRO,
take a look at the matrix defined in .github/workflows/ci.yml.
-
Run your molecule tests with the option
MOLECULE_DESTROY=never, e.g.:$ MOLECULE_DESTROY=never MOLECULE_DISTRO=ubuntu1604 tox -e py3-ansible-5 ... TASK [ansible-role-pip : (redacted).] ************************ failed: [instance-py3-ansible-9] => changed=false ... ___________________________________ summary ____________________________________ pre-commit: commands succeeded ERROR: py3-ansible-9: commands failed
-
Find out the name of the molecule-provisioned docker container:
$ docker ps 30e9b8d59cdf geerlingguy/docker-debian12-ansible:latest "/lib/systemd/systemd" 8 minutes ago Up 8 minutes instance-py3-ansible-9
-
Get into a bash Shell of the container, and do your debugging:
$ docker exec -it 30e9b8d59cdf /bin/bash root@instance-py3-ansible-2:/#
TipIf the failure you try to debug is part of your
verify.ymlstep and not the actualconverge.yml, you may want to know that the output of ansible’s modules (vars), hosts (hostvars) and environment variables have been stored into files on both the provisioner and inside the docker machine under: */var/tmp/vars.yml(contains host variables under thehostvarskey) */var/tmp/environment.ymlgrep,cator transfer these as you wish!TipYou may also want to know that the files mentioned in the admonition above are attached to the GitHub CI Artifacts of a given Workflow run.
This allows one to check the difference between runs and thus help in debugging what caused the bit-rot or failure in general.
-
After you finished your debugging, exit it and destroy the container:
root@instance-py3-ansible-2:/# exit $ docker stop 30e9b8d59cdf $ docker container rm 30e9b8d59cdf or $ docker container prune
Although a standard feature in tox 3, this now only happens when tox recognizes the presence of a CI variable. For example:
$ CI=true tox
This Project offers a definition for a "1-Click Containerized Development Environment".
This Container even enables one to run docker containers inside of it (Docker-In-Docker, dind), allowing for molecule execution.
To use it:
-
Ensure you fullfill the the System requirements of Visual Studio Code Development Containers, optionally following the Installation-Section of the linked page section.
This includes: Installing Docker, Installing Visual Studio Code itself, and Installing the necessary Extension. -
Clone the project to your machine
-
Open the folder of the repo in Visual Studio Code (File - Open Folder…).
-
If you get a prompt at the lower right corner informing you about the presence of the devcontainer definition, you can press the accompanying button to enter it. Otherwise, you can also execute the Visual Studio Command
Remote-Containers: Open Folder in Containeryourself (View - Command Palette → type in the mentioned command).
|
Tip
|
I recommend using |
|
Note
|
You may need to configure your host system to enable the container to use your SSH/GPG Keys. The procedure is described in the official devcontainer docs under "Sharing Git credentials with your container". |
This Project shall be kept in sync with the CookieCutter it was originally templated from using cruft (if possible) or manual alteration (if needed) to the best extend possible.
cruft update
General Linting and Styling Conventions are
automatically held up to Standards
by various pre-commit hooks, at least to some extend.
Automatic Execution of pre-commit is done on each Contribution using
pre-commit.ci*.
Pull Requests even automatically get fixed by the same tool,
at least by hooks that automatically alter files.
|
Note
|
Not to confuse: Although some pre-commit hooks may be able to warn you about script-analyzed flaws in syntax or even code to some extend (for which reason pre-commit’s hooks are part of the test suite), pre-commit itself does not run any real Test Suites. For Information on Testing, see 🧪 Testing. |
|
Tip
|
Nevertheless, I recommend you to integrate pre-commit into your local development workflow yourself. This can be done by cd’ing into the directory of your cloned project and running You can also, for example, execute pre-commit’s hooks at any time by running |
The following sections are generic in nature and are used to help new contributors. The actual "Development Documentation" of this project is found under 📝 Development.
First off, thank you for considering contributing to this Project.
Following these guidelines helps to communicate that you respect the time of the developers managing and developing this open source project. In return, they should reciprocate that respect in addressing your issue, assessing changes, and helping you finalize your pull requests.
This Project owns many of its files to the CookieCutter it was originally templated from.
Please check if the edit you have in mind is actually applicable to the template and if so make an appropriate change there instead. Your change may also be applicable partly to the template as well as partly to something specific to this project, in which case you would be creating multiple PRs.
A casual contributor does not have to worry about following the spec by definition, as pull requests are being squash merged into one commit in the project. Only core contributors, i.e. those with rights to push to this project’s branches, must follow it (e.g. to allow for automatic version determination and changelog generation to work).
Contributions are made to this repo via Issues and Pull Requests (PRs). A few general guidelines that cover both:
-
Search for existing Issues and PRs before creating your own.
-
If you’ve never contributed before, see the first timer’s guide on Auth0’s blog for resources and tips on how to get started.
Issues should be used to report problems, request a new feature, or to discuss potential changes before a PR is created. When you create a new Issue, a template will be loaded that will guide you through collecting and providing the information we need to investigate.
If you find an Issue that addresses the problem you’re having, please add your own reproduction information to the existing issue rather than creating a new one. Adding a reaction can also help be indicating to our maintainers that a particular problem is affecting more than just the reporter.
PRs to this Project are always welcome and can be a quick way to get your fix or improvement slated for the next release. In general, PRs should:
-
Only fix/add the functionality in question OR address wide-spread whitespace/style issues, not both.
-
Add unit or integration tests for fixed or changed functionality (if a test suite already exists).
-
Address a single concern
-
Include documentation in the repo
-
Be accompanied by a complete Pull Request template (loaded automatically when a PR is created).
For changes that address core functionality or would require breaking changes (e.g. a major release), it’s best to open an Issue to discuss your proposal first.
In general, we follow the "fork-and-pull" Git workflow
-
Fork the repository to your own Github account
-
Clone the project to your machine
-
Create a branch locally with a succinct but descriptive name
-
Commit changes to the branch
-
Following any formatting and testing guidelines specific to this repo
-
Push changes to your fork
-
Open a PR in our repository and follow the PR template so that we can efficiently review the changes.
Please refer to the Release Page of this Repository for a human changelog of the corresponding Tags (Versions) of this Project.
Note that this Project adheres to Semantic Versioning. Please report any accidental breaking changes of a minor version update.
MIT License Copyright (c) 2024, Jonas Pammer Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.