119 lines
4.2 KiB
YAML
119 lines
4.2 KiB
YAML
#cloud-config
|
|
|
|
# Copyright 2024 Google LLC
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# https://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
# https://hub.docker.com/r/nginx/nginx/
|
|
# https://nginx.io/manual/toc/#installation
|
|
|
|
write_files:
|
|
- path: /var/lib/docker/daemon.json
|
|
permissions: '0644'
|
|
owner: root
|
|
content: |
|
|
{
|
|
"live-restore": true,
|
|
"storage-driver": "overlay2",
|
|
"log-driver": "gcplogs",
|
|
"log-opts": {
|
|
"gcp-meta-name": "gitlab-0",
|
|
"max-size": "1024m"
|
|
}
|
|
}
|
|
- path: /tmp/gitlab/config/gitlab.rb
|
|
permissions: '0600'
|
|
owner: root
|
|
content: |
|
|
${gitlab_rb}
|
|
- path: /tmp/gitlab/ssl/${gitlab_cert_name}.key
|
|
permissions: '0600'
|
|
owner: root
|
|
content: |
|
|
${gitlab_ssl_key}
|
|
- path: /tmp/gitlab/ssl/${gitlab_cert_name}.crt
|
|
permissions: '0600'
|
|
owner: root
|
|
content: |
|
|
${gitlab_ssl_crt}
|
|
- path: /tmp/gitlab/sshd_config
|
|
permissions: '0644'
|
|
owner: root
|
|
content: |
|
|
${gitlab_sshd_config}
|
|
|
|
- path: /etc/systemd/system/gitlab-data.service
|
|
permissions: '0644'
|
|
owner: root
|
|
content: |
|
|
[Unit]
|
|
Description=Gitlab data disk
|
|
ConditionPathExists=/dev/disk/by-id/google-data
|
|
Before=gitlab.service
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/bin/mkdir -p /run/gitlab
|
|
ExecStart=/bin/bash -c \
|
|
"/bin/lsblk -fn -o FSTYPE \
|
|
/dev/disk/by-id/google-data |grep ext4 \
|
|
|| mkfs.ext4 -m 0 -F -E lazy_itable_init=0,lazy_journal_init=0,discard \
|
|
/dev/disk/by-id/google-data"
|
|
ExecStart=/bin/bash -c \
|
|
"mount |grep /run/gitlab \
|
|
|| mount -t ext4 /dev/disk/by-id/google-data /run/gitlab"
|
|
ExecStart=/sbin/resize2fs /dev/disk/by-id/google-data
|
|
ExecStart=/bin/mkdir -p /run/gitlab/config
|
|
ExecStart=/bin/mkdir -p /run/gitlab/ssl
|
|
ExecStart=/bin/mv /tmp/gitlab/config/gitlab.rb /run/gitlab/config/gitlab.rb
|
|
ExecStart=/bin/mv /tmp/gitlab/sshd_config /run/gitlab/sshd_config
|
|
ExecStart=/bin/bash -c "base64 -d -i /tmp/gitlab/ssl/${gitlab_cert_name}.key > /run/gitlab/ssl/${gitlab_cert_name}.key"
|
|
ExecStart=/bin/bash -c "base64 -d -i /tmp/gitlab/ssl/${gitlab_cert_name}.crt > /run/gitlab/ssl/${gitlab_cert_name}.crt"
|
|
RemainAfterExit=true
|
|
|
|
# https://docs.gitlab.com/ee/install/docker.html#pre-configure-docker-container
|
|
|
|
- path: /etc/systemd/system/gitlab.service
|
|
permissions: '0644'
|
|
owner: root
|
|
content: |
|
|
[Unit]
|
|
Description=Start gitlab container
|
|
After=gitlab-data.service gcr-online.target docker.socket
|
|
Wants=gitlab-data.service gcr-online.target docker.socket docker-events-collector.service
|
|
[Service]
|
|
Environment="HOME=/home/gitlab"
|
|
ExecStartPre=/usr/bin/docker-credential-gcr configure-docker
|
|
ExecStartPre=mkdir -p /run/gitlab
|
|
ExecStart=/usr/bin/docker run --rm --name=gitlab \
|
|
--hostname ${gitlab_config.hostname} \
|
|
--shm-size 256m \
|
|
--env GITLAB_OMNIBUS_CONFIG="" \
|
|
--publish 443:443 \
|
|
--publish 80:80 \
|
|
--publish 2222:2222 \
|
|
-v /run/gitlab/config:/etc/gitlab \
|
|
-v /run/gitlab/ssl:/etc/gitlab/ssl \
|
|
-v /run/gitlab/logs:/var/log/gitlab \
|
|
-v /run/gitlab/data:/var/opt/gitlab \
|
|
-v /run/gitlab/sshd_config:/assets/sshd_config \
|
|
gitlab/gitlab-ce
|
|
ExecStop=/usr/bin/docker stop gitlab
|
|
|
|
runcmd:
|
|
- systemctl start node-problem-detector
|
|
- iptables -I INPUT 1 -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
- iptables -I INPUT 1 -p tcp -m tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
- iptables -I INPUT 1 -p tcp -m tcp --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
- systemctl daemon-reload
|
|
- systemctl start gitlab
|