main.yml

---

- name: install docker dependencies
  pacman: name=docker,python-docker state=present

- name: start docker
  service: name=docker enabled=yes state=started

- name: start docker gitlab image
  docker_container:
    name: gitlab
    image: gitlab/gitlab-ee:latest
    domainname: "{{ gitlab_domain }}"
    published_ports:
      - "80:80"
      - "443:443"
      - "222:22"
    pull: yes
    restart_policy: always
    env:
      # See https://gitlab.com/gitlab-org/omnibus-gitlab/blob/master/files/gitlab-config-template/gitlab.rb.template
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://{{ gitlab_domain }}'
        letsencrypt['enable'] = true
        letsencrypt['contact_emails'] = ['webmaster@archlinux.org']
        gitlab_rails['lfs_enabled'] = true
        gitlab_rails['gitlab_shell_ssh_port'] = 222
        gitlab_rails['initial_root_password'] = "{{ vault_gitlab_root_password }}"
        gitlab_rails['smtp_enable'] = true
        gitlab_rails['smtp_address'] = 'mail.archlinux.org'
        gitlab_rails['smtp_port'] = 587
        gitlab_rails['smtp_user_name'] = 'gitlab'
        gitlab_rails['smtp_password'] = "{{ vault_gitlab_root_password }}"
        gitlab_rails['smtp_domain'] = 'gitlab.archlinux.org'
        gitlab_rails['smtp_enable_starttls_auto'] = true
        gitlab_rails['gitlab_email_enabled'] = true
        gitlab_rails['gitlab_email_from'] = 'gitlab@archlinux.org'
        gitlab_rails['gitlab_email_display_name'] = 'GitLab'
        gitlab_rails['gitlab_email_reply_to'] = 'noreply@archlinux.org'
        gitlab_rails['gitlab_default_theme'] = 2
    volumes:
      - "/srv/gitlab/config:/etc/gitlab"
      - "/srv/gitlab/logs:/var/log/gitlab"
      - "/srv/gitlab/data:/var/opt/gitlab"

- name: open firewall holes
  firewalld: port={{ item }} permanent=true state=enabled immediate=yes
  when: configure_firewall
  with_items:
    - "80/tcp"
    - "443/tcp"
    - "222/tcp"
  tags:
    - firewall

- name: make docker0 interface trusted
  firewalld: interface=docker0 zone=trusted permanent=true state=enabled immediate=yes
  when: configure_firewall
  tags:
    - firewall