From 474fe9f17b962b142173b0627e2d3d247d3fc0cd Mon Sep 17 00:00:00 2001 From: Sven Dowideit Date: Fri, 9 Mar 2018 12:21:51 +1000 Subject: [PATCH] Add Docker Swarm config file, and Swar&compose config file support Signed-off-by: Sven Dowideit --- .gitignore | 1 - README.md | 14 +- assets/runtime/functions | 8 ++ contrib/docker-swarm/docker-compose.yml | 162 ++++++++++++++++++++++++ contrib/docker-swarm/gitlab.config | 3 + contrib/docker-swarm/gitlab.secret | 13 ++ 6 files changed, 199 insertions(+), 2 deletions(-) create mode 100644 contrib/docker-swarm/docker-compose.yml create mode 100644 contrib/docker-swarm/gitlab.config create mode 100644 contrib/docker-swarm/gitlab.secret diff --git a/.gitignore b/.gitignore index eb6011963..23a34d320 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,3 @@ *.gem *.tar.gz -docker-compose.yml diff --git a/README.md b/README.md index 644765c80..f32eb685a 100644 --- a/README.md +++ b/README.md @@ -803,7 +803,8 @@ These options should contain something like: ### Available Configuration Parameters -*Please refer the docker run command options for the `--env-file` flag where you can specify all required environment variables in a single file. This will save you from writing a potentially long docker run command. Alternatively you can use docker-compose.* +*Please refer the docker run command options for the `--env-file` flag where you can specify all required environment variables in a single file. This will save you from writing a potentially long docker run command. Alternatively you can use docker-compose. docker-compose users and Docker Swarm mode users can also use the [secrets and config file options](#docker-secrets-and-configs)* + Below is the complete list of available options that can be used to customize your gitlab installation. @@ -1078,6 +1079,17 @@ Below is the complete list of available options that can be used to customize yo | `RACK_ATTACK_BANTIME` | Number of seconds an IP should be banned after too many auth attempts. Defaults to `3600`. | | `GITLAB_WORKHORSE_TIMEOUT` | Timeout for gitlab workhorse http proxy. Defaults to `5m0s`. | +### Docker secrets and configs + +All the above environment variables can be put into a [secrets](https://docs.docker.com/compose/compose-file/#secrets) or [config](https://docs.docker.com/compose/compose-file/#configs) file +and then both docker-compose and Docker Swarm can import them into your gitlab container. + +On startup, the gitlab container will source env vars from a config file labeled `gitlab-config`, and then a secrets file labeled `gitlab-secrets` (both mounted in the default locations). + +See the exmample `config/docker-swarm/docker-compose.yml` file, and the example `gitlab.config` and `gitlab.secrets` file. + +If you're not using one of these files, then don't include its entry in the docker-compose file. + # Maintenance ## Creating backups diff --git a/assets/runtime/functions b/assets/runtime/functions index 30d8f3075..4797588dc 100644 --- a/assets/runtime/functions +++ b/assets/runtime/functions @@ -1,5 +1,13 @@ #!/bin/bash set -e + +for file in /gitlab-configs /run/secrets/gitlab-secrets; do + if [[ -e "$file" ]]; then + echo "Loading $file" + source "$file" + fi +done +echo "Loading ${GITLAB_RUNTIME_DIR}/env-defaults" source ${GITLAB_RUNTIME_DIR}/env-defaults SYSCONF_TEMPLATES_DIR="${GITLAB_RUNTIME_DIR}/config" diff --git a/contrib/docker-swarm/docker-compose.yml b/contrib/docker-swarm/docker-compose.yml new file mode 100644 index 000000000..30d52f903 --- /dev/null +++ b/contrib/docker-swarm/docker-compose.yml @@ -0,0 +1,162 @@ +version: '3.4' + +services: + redis: + restart: always + image: sameersbn/redis:latest + command: + - --loglevel warning + volumes: + - /srv/docker/gitlab/redis:/var/lib/redis:Z + + postgresql: + restart: always + image: sameersbn/postgresql:9.6-2 + volumes: + - /srv/docker/gitlab/postgresql:/var/lib/postgresql:Z + environment: + - DB_USER=gitlab + - DB_PASS=password + - DB_NAME=gitlabhq_production + - DB_EXTENSION=pg_trgm + + gitlab: + restart: always + image: sameersbn/gitlab:10.7.2 + depends_on: + - redis + - postgresql + ports: + - "10080:80" + - "10022:22" + volumes: + - /srv/docker/gitlab/gitlab:/home/git/data:Z + configs: + - gitlab-configs + secrets: + - gitlab-secrets + environment: + - DEBUG=false + + - DB_ADAPTER=postgresql + - DB_HOST=postgresql + - DB_PORT=5432 + - DB_USER=gitlab + - DB_PASS=password + - DB_NAME=gitlabhq_production + + - REDIS_HOST=redis + - REDIS_PORT=6379 + + - TZ=Asia/Kolkata + - GITLAB_TIMEZONE=Kolkata + + - GITLAB_HTTPS=false + - SSL_SELF_SIGNED=false + + - GITLAB_HOST=localhost + - GITLAB_PORT=10080 + - GITLAB_SSH_PORT=10022 + - GITLAB_RELATIVE_URL_ROOT= + - GITLAB_SECRETS_DB_KEY_BASE=long-and-random-alphanumeric-string + - GITLAB_SECRETS_SECRET_KEY_BASE=long-and-random-alphanumeric-string + - GITLAB_SECRETS_OTP_KEY_BASE=long-and-random-alphanumeric-string + + - GITLAB_ROOT_PASSWORD= + - GITLAB_ROOT_EMAIL= + + - GITLAB_NOTIFY_ON_BROKEN_BUILDS=true + - GITLAB_NOTIFY_PUSHER=false + + - GITLAB_EMAIL=notifications@example.com + - GITLAB_EMAIL_REPLY_TO=noreply@example.com + - GITLAB_INCOMING_EMAIL_ADDRESS=reply@example.com + + - GITLAB_BACKUP_SCHEDULE=daily + - GITLAB_BACKUP_TIME=01:00 + + - SMTP_ENABLED=false + - SMTP_DOMAIN=www.example.com + - SMTP_HOST=smtp.gmail.com + - SMTP_PORT=587 + - SMTP_USER=mailer@example.com + - SMTP_PASS=password + - SMTP_STARTTLS=true + - SMTP_AUTHENTICATION=login + + - IMAP_ENABLED=false + - IMAP_HOST=imap.gmail.com + - IMAP_PORT=993 + - IMAP_USER=mailer@example.com + - IMAP_PASS=password + - IMAP_SSL=true + - IMAP_STARTTLS=false + + - OAUTH_ENABLED=false + - OAUTH_AUTO_SIGN_IN_WITH_PROVIDER= + - OAUTH_ALLOW_SSO= + - OAUTH_BLOCK_AUTO_CREATED_USERS=true + - OAUTH_AUTO_LINK_LDAP_USER=false + - OAUTH_AUTO_LINK_SAML_USER=false + - OAUTH_EXTERNAL_PROVIDERS= + + - OAUTH_CAS3_LABEL=cas3 + - OAUTH_CAS3_SERVER= + - OAUTH_CAS3_DISABLE_SSL_VERIFICATION=false + - OAUTH_CAS3_LOGIN_URL=/cas/login + - OAUTH_CAS3_VALIDATE_URL=/cas/p3/serviceValidate + - OAUTH_CAS3_LOGOUT_URL=/cas/logout + + - OAUTH_GOOGLE_API_KEY= + - OAUTH_GOOGLE_APP_SECRET= + - OAUTH_GOOGLE_RESTRICT_DOMAIN= + + - OAUTH_FACEBOOK_API_KEY= + - OAUTH_FACEBOOK_APP_SECRET= + + - OAUTH_TWITTER_API_KEY= + - OAUTH_TWITTER_APP_SECRET= + + - OAUTH_GITHUB_API_KEY= + - OAUTH_GITHUB_APP_SECRET= + - OAUTH_GITHUB_URL= + - OAUTH_GITHUB_VERIFY_SSL= + + - OAUTH_GITLAB_API_KEY= + - OAUTH_GITLAB_APP_SECRET= + + - OAUTH_BITBUCKET_API_KEY= + - OAUTH_BITBUCKET_APP_SECRET= + + - OAUTH_SAML_ASSERTION_CONSUMER_SERVICE_URL= + - OAUTH_SAML_IDP_CERT_FINGERPRINT= + - OAUTH_SAML_IDP_SSO_TARGET_URL= + - OAUTH_SAML_ISSUER= + - OAUTH_SAML_LABEL="Our SAML Provider" + - OAUTH_SAML_NAME_IDENTIFIER_FORMAT=urn:oasis:names:tc:SAML:2.0:nameid-format:transient + - OAUTH_SAML_GROUPS_ATTRIBUTE= + - OAUTH_SAML_EXTERNAL_GROUPS= + - OAUTH_SAML_ATTRIBUTE_STATEMENTS_EMAIL= + - OAUTH_SAML_ATTRIBUTE_STATEMENTS_NAME= + - OAUTH_SAML_ATTRIBUTE_STATEMENTS_FIRST_NAME= + - OAUTH_SAML_ATTRIBUTE_STATEMENTS_LAST_NAME= + + - OAUTH_CROWD_SERVER_URL= + - OAUTH_CROWD_APP_NAME= + - OAUTH_CROWD_APP_PASSWORD= + + - OAUTH_AUTH0_CLIENT_ID= + - OAUTH_AUTH0_CLIENT_SECRET= + - OAUTH_AUTH0_DOMAIN= + + - OAUTH_AZURE_API_KEY= + - OAUTH_AZURE_API_SECRET= + - OAUTH_AZURE_TENANT_ID= + +configs: + gitlab-configs: + file: ./gitlab.configs + +secrets: + gitlab-secrets: + file: ./gitlab.secrets diff --git a/contrib/docker-swarm/gitlab.config b/contrib/docker-swarm/gitlab.config new file mode 100644 index 000000000..898f5209b --- /dev/null +++ b/contrib/docker-swarm/gitlab.config @@ -0,0 +1,3 @@ +# config file to be sourced on startup - will over-ride any env set in the docker-compose.yml + +TEST=none diff --git a/contrib/docker-swarm/gitlab.secret b/contrib/docker-swarm/gitlab.secret new file mode 100644 index 000000000..488566e34 --- /dev/null +++ b/contrib/docker-swarm/gitlab.secret @@ -0,0 +1,13 @@ +# config file to be sourced on startup - will over-ride any env set in the docker-compose.yml + +LDAP_ENABLED=true +LDAP_LABEL="LDAP login" +LDAP_HOST=pool.ldap.example.com +LDAP_PORT=3268 +LDAP_BIND_DN=the-ldap +LDAP_PASS=no-not-really +LDAP_BASE=ou=People,dc=example,dc=com +#LDAP_LOWERCASE_USERNAMES=true +##LDAP_USER_FILTER=uid={login} +##LDAP_UID= +#