1
postgresql['enable'] = false
2
redis['enable'] = false
3
nginx['enable'] = false
4
puma['enable'] = false
5
unicorn['enable'] = false
6
sidekiq['enable'] = false
7
gitlab_workhorse['enable'] = false
8
grafana['enable'] = false
9

10
# If you run a separate monitoring node you can disable these services
11
alertmanager['enable'] = false
12
prometheus['enable'] = false
13

14
# Prevent database migrations from running on upgrade automatically
15
gitlab_rails['auto_migrate'] = false
16

17
# Enable only the Gitaly service
18
gitaly['enable'] = true
19

20
# Configure the gitlab-shell API callback URL. Without this, `git push` will
21
# fail. This can be your 'front door' GitLab URL or an internal load
22
# balancer.
23
# Don't forget to copy `/etc/gitlab/gitlab-secrets.json` from web server to Gitaly server
24
gitlab_rails['internal_api_url'] = '' # gitlab对外域名
25

26
# Make Gitaly accept connections on all network interfaces. You must use
27
# firewalls to restrict access to this address/port.
28
# Comment out following line if you only want to support TLS connections
29
gitaly['tls_listen_addr'] = "0.0.0.0:9999"
30
gitaly['certificate_path'] = "/etc/gitlab/ssl/server-1.pem"
31
gitaly['key_path'] = "/etc/gitlab/ssl/server.key"
32

33
# Enable service discovery for Prometheus
34
consul['enable'] = false
35
consul['monitoring_service_discovery'] =  false
36

37
# Set the network addresses that the exporters will listen on for monitoring
38
gitaly['prometheus_listen_addr'] = "0.0.0.0:9236"
39

40
# Gitaly Auth Token
41
# Should be the same as praefect_internal_token
42
gitaly['auth_token'] = 'LYIddgqhn91vykzAxxxxxxxDtLSTnO'
43
gitlab_shell['secret_token'] = 'vIH3gfTSXbxxxxxxx3ZH7DDVX17YJ'
44

45
git_data_dirs({
46
  'default' => {'gitaly_address' => 'tls://gitaly-1.ccops.cc:9999','path' => '/mnt/gitlab/git-data'},
47
})

1
version: '2.0'
2
services:
3
  gitaly:
4
    restart: always
5
    image: gitlab-ce:14.8.5
6
    hostname: gitaly-1.ccops.cc
7
    extra_hosts:
8
      - "gitlab-tst.ccops.cc:10.1.1.1"
9
    shm_size: '256m'
10
    ports:
11
     - "9999:9999"
12
     - "9236:9236"
13
    volumes:
14
     - "/data/gitlab/config:/etc/gitlab"
15
     - "/data/gitlab/logs:/var/log/gitlab"
16
     - "/data/gitlab/data:/var/opt/gitlab"
17
     - "/data/gitlab/git-data:/mnt/gitlab/git-data"
18
     - /etc/localtime:/etc/localtime:ro
19
    cap_add:
20
      - SYS_TIME
21
    restart: unless-stopped

1
external_url 'https://gitlab-tst.ccops.cc'
2
self_signed_cert = 'true'
3
gitlab_rails['time_zone'] = 'Beijing'
4
runtime_dir = '/dev/shm'
5
# Enable Prometheus metrics access to Praefect. You must use firewalls
6
# to restrict access to this address/port.
7

8
### Email Settings
9
gitlab_rails['gitlab_email_enabled'] = false
10
gitlab_rails['gitlab_email_from'] = ''
11
gitlab_rails['gitlab_email_display_name'] = ''
12

13
### Gravatar Settings
14
# gitlab_rails['initial_root_password'] = 'qweasd123' # 配置root密码,不建议添加,部署完使用gitlab-rake "gitlab:password:reset[root]"修改密码
15
gitlab_rails['gravatar_plain_url'] = 'http://gravatar.duoshuo.com/avatar/%{hash}?s=%{size}&d=identicon'
16

17
### Webhook Settings
18
###! Number of seconds to wait for HTTP response after sending webhook HTTP POST
19
###! request (default: 10)
20
gitlab_rails['webhook_timeout'] = 20
21

22
### LDAP Settings
23
###! Docs: https://docs.gitlab.com/omnibus/settings/ldap.html
24
###! **Be careful not to break the indentation in the ldap_servers block. It is
25
###!   in yaml format and the spaces must be retained. Using tabs will not work.**
26
gitlab_rails['ldap_enabled'] = false
27

28
gitlab_rails['ldap_servers'] = YAML.load <<-'EOS' # remember to close this block with 'EOS' below
29
   main:
30
     label: 'LDAP'
31
     host: ''
32
     port: 389
33
     uid: ''
34
     method: 'plain' # "tls" or "ssl" or "plain"
35
     bind_dn: ''
36
     password: ''
37
     active_directory: true
38
     allow_username_or_email_login: false
39
     base: ''
40
     active_directory: true
41
     allow_username_or_email_login: false
42
     base: ''
43
     user_filter: ''
44
     group_base: ''
45
     admin_group: ''
46
     sync_ssh_keys: false
47
EOS
48

49
### Backup Settings
50
###! Docs: https://docs.gitlab.com/omnibus/settings/backups.html
51
gitlab_rails['manage_backup_path'] = true
52
gitlab_rails['backup_path'] = "/var/opt/gitlab/backups"
53

54
# Gitaly and GitLab use two shared secrets for authentication, one to authenticate gRPC requests
55
# # to Gitaly, and a second for authentication callbacks from GitLab-Shell to the GitLab internal API.
56
# # The following two values must be the same as their respective values
57
# # of the Gitaly setup
58
gitaly['auth_token'] = 'LYIddgqhn91vykzA8O908MQ7GDtLSTnO'
59
gitlab_shell['secret_token'] = 'vIH3gfTSXbb4XNR3LznY3ZH7DDVX17YJ'
60

61
# git_data_dirs get configured for the Praefect virtual storage
62
# Address is Interal Load Balancer for Praefect
63
# Token is praefect_external_token
64
git_data_dirs({
65
  'default'  => { 'gitaly_address' => 'tls://gitaly-1.ccops.cc:9999', 'gitaly_token' => 'LYIddgqhn91vykzA8O908MQ7GDtLSTnO' },
66
  'storage1' => { 'gitaly_address' => 'tls://gitaly-2.ccops.cc:9999', 'gitaly_token' => 'LYIddgqhn91vykzA8O908MQ7GDtLSTnO' },
67
  'storage2' => { 'gitaly_address' => 'tls://gitaly-3.ccops.cc:9999', 'gitaly_token' => 'LYIddgqhn91vykzA8O908MQ7GDtLSTnO' },
68
})
69
## Disable components that will not be on the GitLab application server
70
roles ['application_role']
71
gitaly['enable'] = false
72
nginx['enable'] = true
73
nginx['ssl_certificate'] = "/etc/gitlab/ssl/gitlab-tst.ccops.ccm.crt"
74
nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/gitlab-tst.ccops.cc.key"
75
nginx['ssl_protocols'] = "TLSv1 TLSv1.1 TLSv1.2 TLSv1.3"
76
nginx['ssl_ciphers'] = "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-S
77
HA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4"
78
nginx['listen_addresses'] = ['0.0.0.0']
79
nginx['redirect_http_to_https'] = true
80
web_server['external_users'] = ['nginx']
81
nginx['client_max_body_size'] = '5000m'
82
nginx['real_ip_trusted_addresses'] = [ '0.0.0.0/0' ]
83
nginx['real_ip_header'] = 'X-Forwarded-For'
84
nginx['real_ip_recursive'] = 'on'
85

86
gitlab_pages['enable'] = true
87
gitlab_pages['external_http'] = ['0.0.0.0:8087']
88
gitlab_pages['inplace_chroot'] = true
89
gitlab_exporter['enable'] = true
90
gitlab_exporter['listen_address'] = '0.0.0.0'
91
gitlab_exporter['listen_port'] = '9168'
92

93
# PostgreSQL connection details
94
postgresql['enable'] = false
95
gitlab_rails['db_adapter'] = "postgresql"
96
gitlab_rails['db_host'] = '10.1.1.1'
97
gitlab_rails['db_port'] = 5432
98
gitlab_rails['db_username'] = "user"
99
gitlab_rails['db_password'] = "passwd"
100
gitlab_rails['db_database'] = "gitlab"
101
# Prevent database migrations from running on upgrade automatically
102
#gitlab_rails['auto_migrate'] = false
103

104
# Redis connection details
105
redis['enable'] = false
106
gitlab_rails['redis_host'] = "10.1.1.1"
107
gitlab_rails['redis_port'] = 6379
108
gitlab_rails['redis_password'] = "passwd"
109
gitlab_rails['redis_database'] = 0
110

111
# Set the network addresses that the exporters used for monitoring will listen on
112
gitlab_workhorse['prometheus_listen_addr'] = '0.0.0.0:9229'
113
sidekiq['listen_address'] = "0.0.0.0"
114
puma['listen'] = '0.0.0.0'
115
puma['exporter_enabled'] = true
116
puma['exporter_address'] = "0.0.0.0"
117
puma['worker_timeout'] = 600
118
gitlab_rails['env'] = {
119
   'GITLAB_RAILS_RACK_TIMEOUT' => 600
120
 }
121
# Set number of Sidekiq threads per queue process to the recommend number of 10
122
sidekiq['max_concurrency'] = 25
123

124
# Add the monitoring node's IP address to the monitoring whitelist and allow it to
125
# scrape the NGINX metrics. Replace placeholder `monitoring.gitlab.example.com` with
126
# the address and/or subnets gathered from the monitoring node
127
gitlab_rails['monitoring_whitelist'] = ['10.0.0.0/8','127.0.0.0/8','172.0.0.0/8']
128
#nginx['status']['options']['allow'] = ['10.0.0.0/8', '127.0.0.0/8','172.0.0.0/8']
129

130
# note the 'https' below
131
#external_url "https://gitlab.xpaas.ccops.com"
132
letsencrypt['enable'] = false
133

134
### GitLab Shell settings for GitLab
135
# gitlab_rails['gitlab_shell_ssh_port'] = 22
136
gitlab_rails['git_max_size'] = 209715200
137
gitlab_rails['git_timeout'] = 30
138

139
### GitLab email server settings
140
###! Docs: https://docs.gitlab.com/omnibus/settings/smtp.html
141
###! **Use smtp instead of sendmail/postfix.**
142

143
gitlab_rails['smtp_enable'] = true
144
gitlab_rails['smtp_address'] = ""
145
gitlab_rails['smtp_port'] = 25
146
# gitlab_rails['smtp_user_name'] = "smtp user"
147
# gitlab_rails['smtp_password'] = "smtp password"
148
# gitlab_rails['smtp_domain'] = "example.com"
149
gitlab_rails['smtp_authentication'] = "plain"
150
gitlab_rails['smtp_enable_starttls_auto'] = true
151
gitlab_rails['smtp_tls'] = false
152
###! **Can be: 'none', 'peer', 'client_once', 'fail_if_no_peer_cert'**
153
###! Docs: http://api.rubyonrails.org/classes/ActionMailer/Base.html
154
gitlab_rails['smtp_openssl_verify_mode'] = 'none'
155

156
# user['git_user_name'] = "GitLab"
157
user['git_user_email'] = ""
158

159
################################################################################
160
## GitLab Logging
161
###! Docs: https://docs.gitlab.com/omnibus/settings/logs.html
162
################################################################################
163
logging['svlogd_size'] = 200 * 1024 * 1024 # rotate after 200 MB of log data
164
logging['svlogd_num'] = 30 # keep 30 rotated log files
165
logging['svlogd_timeout'] = 24 * 60 * 60 # rotate after 24 hours
166
logging['svlogd_filter'] = "gzip" # compress logs with gzip
167
logging['svlogd_udp'] = nil # transmit log messages via UDP
168
logging['svlogd_prefix'] = nil # custom prefix for log messages
169
#logging['logrotate_frequency'] = "daily" # rotate logs daily
170
logging['logrotate_size'] = "500M" # do not rotate by size by default
171
logging['logrotate_rotate'] = 30 # keep 30 rotated logs
172
logging['logrotate_compress'] = "compress" # see 'man logrotate'
173
logging['logrotate_method'] = "copytruncate" # see 'man logrotate'
174
#logging['logrotate_postrotate'] = nil # no postrotate command by default
175
# logging['logrotate_dateformat'] = nil # use date extensions for rotated files rather than numbers e.g. a value of "-%Y-%m-%d" would give rotated files like production.log-2016-03-09.gz
176
################################################################################
177
## Logrotate
178
##! Docs: https://docs.gitlab.com/omnibus/settings/logs.html#logrotate
179
##! You can disable built in logrotate feature.
180
################################################################################
181
logrotate['enable'] = true
182

183
gitlab_ci['gitlab_ci_email_from'] = ''
184
gitlab_ci['gitlab_ci_support_email'] = ''
185
gitlab_ci['gravatar_enabled'] = false

1
version: '2.0'
2
services:
3
  gitlab-rails:
4
    restart: always
5
    image: registry-sy.ccops.cc/agile_tools/gitlab-ce:14.8.5
6
    extra_hosts:
7
      - "gitlab-tst.ccops.cc:10.1.1.4"
8
      - "gitaly-1.ccops.cc:10.1.1.1"
9
      - "gitaly-2.ccops.cc:10.1.1.2"
10
      - "gitaly-3.ccops.cc:10.1.1.3"
11
    ports:
12
     - "443:443"
13
     - "80:80"
14
     - "2222:22"
15
     - "8080:8080"
16
     - "9168:9168"
17
     - "9229:9229"
18
     - "8082:8082"
19
     - "8060:8060"
20
     - "8083:8083"
21
     - "8087:8087"
22
    volumes:
23
     - "/gitlab-data/config:/etc/gitlab"
24
     - "/data/gitlab/logs:/var/log/gitlab"
25
     - "/data/gitlab/data:/var/opt/gitlab"
26
     - "/gitlab-data/.ssh:/var/opt/gitlab/.ssh"
27
     - "/gitlab-data/gitlab-rails/uploads:/var/opt/gitlab/gitlab-rails/uploads"
28
     - "/gitlab-data/gitlab-rails/shared:/var/opt/gitlab/gitlab-rails/shared"
29
     - "/gitlab-data/gitlab-ci/builds:/var/opt/gitlab/gitlab-ci/builds"
30
     - "/etc/localtime:/etc/localtime:ro"