main.yml

---

- name: install docker dependencies
  pacman: name=docker,python-docker state=present

- name: start docker
  service: name=docker enabled=yes state=started

- name: copy sshd_config into place to change the port to 222
  copy: src=sshd_config dest=/srv/gitlab/sshd_config owner=root group=root mode=640

- name: start docker gitlab image
  docker_container:
    name: gitlab
    image: gitlab/gitlab-ee:latest
    domainname: "{{ gitlab_domain }}"
    hostname: "{{ gitlab_domain }}"
    container_default_behavior: compatibility
    network_mode: host
    pull: yes
    restart_policy: always
    env:
      # See https://gitlab.com/gitlab-org/omnibus-gitlab/blob/master/files/gitlab-config-template/gitlab.rb.template
      # 1. In order to figure out what needs to go into 'idp_cert_fingerprint', run
      # one-shots/keycloak-keyfetcher/get_fingerprint.sh and copy the resulting SHA1 fingerprint into that field.
      # 2. In order to logout properly we need to configure the "After sign out path" and set it to
      # https://accounts.archlinux.org/auth/realms/archlinux/protocol/openid-connect/logout?redirect_uri=https%3A//gitlab.archlinux.org
      # https://gitlab.com/gitlab-org/gitlab/issues/14414
      #
      # In addition, see https://docs.gitlab.com/ee/administration/pages/ for the GitLab Pages trickery done below.
      # Basically, we only allow specific GitLab Pages with custom domains to work. We don't want to enable everyone
      # to be able to have a GitLab Page on purpose (for security and legal safety reasons).
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://{{ gitlab_domain }}'
        nginx['client_max_body_size'] = '2g'
        nginx['listen_addresses'] = {{ gitlab_primary_addresses }}
        registry_nginx['listen_addresses'] = ['*', '[::]']
        gitlab_pages['inplace_chroot'] = true
        pages_external_url "http://{{ gitlab_domain }}"
        pages_nginx['enable'] = false
        gitlab_pages['external_http'] = {{ gitlab_pages_http_addresses }}
        gitlab_pages['external_https'] = {{ gitlab_pages_https_addresses }}
        letsencrypt['enable'] = true
        letsencrypt['contact_emails'] = ['webmaster@archlinux.org']
        gitlab_rails['lfs_enabled'] = true
        gitlab_rails['gitlab_shell_ssh_port'] = 222
        gitlab_rails['gitlab_default_can_create_group'] = false
        gitlab_rails['initial_root_password'] = "{{ vault_gitlab_root_password }}"
        gitlab_rails['smtp_enable'] = true
        gitlab_rails['smtp_address'] = 'mail.archlinux.org'
        gitlab_rails['smtp_port'] = 587
        gitlab_rails['smtp_user_name'] = 'gitlab'
        gitlab_rails['smtp_password'] = "{{ vault_gitlab_root_password }}"
        gitlab_rails['smtp_domain'] = 'gitlab.archlinux.org'
        gitlab_rails['smtp_enable_starttls_auto'] = true
        gitlab_rails['gitlab_email_enabled'] = true
        gitlab_rails['gitlab_email_from'] = 'gitlab@archlinux.org'
        gitlab_rails['gitlab_email_display_name'] = 'GitLab'
        gitlab_rails['gitlab_email_reply_to'] = 'noreply@archlinux.org'
        gitlab_rails['gitlab_default_theme'] = 2
        gitlab_rails['incoming_email_enabled'] = true
        gitlab_rails['incoming_email_address'] = "gitlab+%{key}@archlinux.org"
        gitlab_rails['incoming_email_email'] = "gitlab@archlinux.org"
        gitlab_rails['incoming_email_password'] = "{{ vault_gitlab_root_password }}"
        gitlab_rails['incoming_email_host'] = "mail.archlinux.org"
        gitlab_rails['incoming_email_port'] = 993
        gitlab_rails['incoming_email_ssl'] = true
        gitlab_rails['omniauth_allow_single_sign_on'] = ['saml']
        gitlab_rails['omniauth_block_auto_created_users'] = false
        gitlab_rails['omniauth_auto_link_saml_user'] = true