AdminSysGNULinux

Voir :

• Notes Gitlab-CI
• https://gdevops.frama.io/opsindev/tuto-project/management/gitlab/ci/ci.html
• CIS GitLab Benchmark

Voir aussi :

• Gogs
• Gitea
• GitPrep
• gitweb
• ArgoCD
• Tekton

Docker-compose avec Gitlab runner :

• https://www.jamescoyle.net/how-to/docker-compose-files/3179-docker-compose-yml-for-gitlab-and-gitlab-runner
• https://gitlab.com/gitlab-org/gitlab/-/issues/23911
• https://github.com/jeshan/gitlab-on-compose/blob/master/docker-compose.yml
• https://gist.github.com/barnybug/e988cfcd937e7414187c51f4d1e2cb82

https://medium.com/@rukeith/how-to-use-docker-to-build-a-self-host-gitlab-and-gitlab-runner-781981dc4d03

Configuration du runner

docker run --rm -ti --name gitlab-runner --add-host gitlab.local:172.17.0.1 \
 -v /srv/gitlab-runner/config:/etc/gitlab-runner \
 -v /var/run/docker.sock:/var/run/docker.sock \
 gitlab/gitlab-runner:alpine register

/srv/gitlab-runner/config/config.toml

concurrent = 1
check_interval = 0
 
[session_server]
  session_timeout = 1800
 
[[runners]]
  name = "89fa5654f698"
  url = "http://gitlab.local:8081/"
  token = "FKXKQ5Zg1KmwB9ssNVU9"
  executor = "docker"
  [runners.custom_build_dir]
  [runners.cache]
    [runners.cache.s3]
    [runners.cache.gcs]
    [runners.cache.azure]
  [runners.docker]
    tls_verify = false
    image = "alpine"
    privileged = false
    disable_entrypoint_overwrite = false
    oom_kill_disable = false
    disable_cache = false
    volumes = ["/cache"]
    shm_size = 0

Gitlab créera de nouveau containers. Ils devrons etre capable de faire un git clone Pour configurer les flux réseaux, ajoutez clone_url = Dans notre exemple 172.18.0.1 est la passerelle par défaut des nouveaux containers crées.

/gitlab-runner/config/config.toml

[[runners]]
  #url = "http://gitlab.local:8081/"
  url = "http://gitlab.local/"
  clone_url = "http://172.18.0.1:8081"

docker-compose.yml

version: '3.7'
services:
  gitlab:
    image: 'gitlab/gitlab-ce:latest'
    restart: unless-stopped
    hostname: 'gitlab.local'
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        #external_url 'http://gitlab.local'
        # Add any other gitlab.rb configuration here, each on its own line
    ports:
      - '127.0.0.1:8081:80'
      - '127.0.0.1:4443:443'
      - '127.0.0.1:2222:22'
    volumes:
      - "/srv/gitlab/config:/etc/gitlab"
      - "/srv/gitlab/logs:/var/log/gitlab"
      - "/srv/gitlab/data:/var/opt/gitlab"
    networks:
      - gitlab-net

  gitlab-runner:
    image: gitlab/gitlab-runner:alpine
    restart: unless-stopped
    depends_on:
      - gitlab
    volumes:
      - /srv/gitlab-runner/config:/etc/gitlab-runner
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - gitlab-net

networks:
  gitlab-net:
    name: gitlab-net

srv/gitlab/config/gitlab.rb

gitlab_rails['env'] = {
    'MALLOC_CONF' => 'dirty_decay_ms:1000,muzzy_decay_ms:1000'
}
 
gitaly['env'] = {
    'LD_PRELOAD' => '/opt/gitlab/embedded/lib/libjemalloc.so',
    'MALLOC_CONF' => 'dirty_decay_ms:1000,muzzy_decay_ms:1000',
    'GITALY_COMMAND_SPAWN_MAX_PARALLEL' => '2'
}
 
gitlab_rails['gitlab_username_changing_enabled'] = true
gitlab_rails['trusted_proxies'] = ["172.16.0.0/12"]
gitlab_rails['omniauth_enabled'] = false
 
puma['worker_processes'] = 0
puma['exporter_enabled'] = false
 
sidekiq['max_concurrency'] = 10
sidekiq['metrics_enabled'] = false
postgresql['shared_buffers'] = "1024MB"
 
nginx['redirect_http_to_https'] = true
nginx['listen_port'] = 80
nginx['listen_https'] = false
 
prometheus['enable'] = false
alertmanager['enable'] = false
 
node_exporter['enable'] = false
redis_exporter['enable'] = false
postgres_exporter['enable'] = false
pgbouncer_exporter['enable'] = false
gitlab_exporter['enable'] = false
 
grafana['enable'] = false
grafana['metrics_enabled'] = false
 
#gitaly['enable'] = false
gitaly['ruby_max_rss'] = 200_000_000 # RSS threshold in bytes for triggering a gitaly-ruby restart
gitaly['concurrency'] = [
  {
    'rpc' => "/gitaly.SmartHTTPService/PostReceivePack",
    'max_per_repo' => 3
  }, {
    'rpc' => "/gitaly.SSHService/SSHUploadPack",
    'max_per_repo' => 3
  }
]
gitaly['cgroups_count'] = 2
gitaly['cgroups_hierarchy_root'] = 'gitaly'
gitaly['cgroups_memory_enabled'] = true
gitaly['cgroups_memory_limit'] = 500000
gitaly['cgroups_cpu_enabled'] = true
gitaly['cgroups_cpu_shares'] = 512

Lancement de Gitlab et de Gitlab-Runner

docker-compose -d up

docker exec -ti gitlab gitlab-ctl reconfigure
docker restart gitlab

User : root

Password

docker exec -it gitlab grep 'Password:' /etc/gitlab/initial_root_password

Open registration is enabled on your instance.

Admin Area - Settings - General - Sign-up restrictions

Sign-up enabled Require admin approval for new sign-ups

URL d'admin : https://gitlab.acme.local/admin

Le compte admin par defaut est “root”

Edit Profile - Account

admin/application_settings/general Account and limit Gravatar enabled Disable

admin/application_settings/general User OAuth applications Allow users to register any application to use GitLab as an OAuth provider Disable

admin/application_settings/general Third-party offers Do not display offers from third parties Checked

admin/application_settings/metrics_and_profiling Metrics - Prometheus Enable health and performance metrics endpoint Disable

profile Private profile Don't display activity-related personal information on your profile

Admin Area - Overview - Users

Admin Area - Overview - Runners

docker-compose exec gitlab-runner gitlab-runner register

Enter the GitLab instance URL (for example, https://gitlab.com/): http://gitlab/

Enter the registration token: 2_xtsj1yw4sacbWwG46y

Enter an executor: docker, docker-ssh, ssh, docker+machine, kubernetes, custom, parallels, shell, virtualbox, docker-ssh+machine:
docker Enter the default Docker image (for example, ruby:2.6): alpine

docker-compose exec gitlab gitlab-ctl reconfigure
docker-compose exec gitlab gitlab-ctl restart

Solution :

Settings, General, Visibility, project features, permissions in Pipelines (Build, test, and deploy your changes) select Only Project Members

https://packages.gitlab.com/gitlab/gitlab-ce/install

curl -s https://packages.gitlab.com/install/repositories/gitlab/gitlab-ce/script.deb.sh | sudo bash
 
apt-get install gitlab-ce

--------------
GitLab was unable to detect a valid hostname for your instance.
Please configure a URL for your GitLab instance by setting `external_url`
configuration in /etc/gitlab/gitlab.rb file.
Then, you can start your GitLab instance by running the following command:
  sudo gitlab-ctl reconfigure

For a comprehensive list of configuration options please see the Omnibus GitLab readme
https://gitlab.com/gitlab-org/omnibus-gitlab/blob/master/README.md
---------------

sudo gitlab-ctl reconfigure

/etc/gitlab/gitlab.rb

##! **recommend value is 1/4 of total RAM, up to 14GB.**
# postgresql['shared_buffers'] = "256MB"
postgresql['shared_buffers'] = "4096MB"

gitlab-ctl restart postgresql

Les composants suivants seront automatiquement installés :

• nginx
• postgres
• redis

A présent connectez vous sur le port 80 et définissez un mot de passe

PHC0

Remote repository pull mirroring Automatically sync branches, tags, and commits from external repositories every 30 minutes, with safeguards to prevent data loss. https://docs.gitlab.com/user/project/repository/mirror/pull/

• https://docs.gitlab.com/administration/auth/ldap/
• https://about.gitlab.com/pricing/feature-comparison/
• https://gitlab.lcqb.upmc.fr/help/administration/auth/ldap.md
• https://gitlab.com/gitlab-org/gitlab/-/blob/v10.8.0-rc3/doc/administration/auth/how_to_configure_ldap_gitlab_ce/index.md
• https://forum.gitlab.com/t/gitlab-integrate-with-active-directory/98245
• https://forum.gitlab.com/t/gitlab-integration-with-active-directory/37777/9
• https://www.reddit.com/r/gitlab/comments/1jj5bc7/gitlab_integrations_with_ad/?tl=fr

Advanced LDAP/SAML Configuration Automatically synchronize GitLab users with LDAP groups, configuring administrator access, external user status, and SSH keys through customizable directory attribute

• https://docs.gitlab.com/administration/auth/ldap/#ldap-sync-configuration-settings

• https://about.gitlab.com/blog/using-ansible-and-gitlab-as-infrastructure-for-code/
• https://dev.to/kenmoini/automate-gitlab-with-ansible-kinda-b5d
• https://gitlab.com/gitlab-org/gitlab-environment-toolkit/-/blob/main/docs/environment_configure.md
• https://developers.redhat.com/articles/2023/08/15/continuous-integration-pipeline-ansible-gitlab#
• https://forum.ansible.com/t/ansible-ci-pipeline-tips-for-gitlab-ci/11123
• https://gazerad.com/fr/article/deploiement-continu-avec-gitlab-et-ansible

• https://docs.gitlab.com/user/permissions/
• https://medium.com/@vk4607895/setting-up-a-gitlab-project-with-ci-pipeline-role-permissions-and-issue-tracking-12cde6a32504
• https://gitlab.com/gitlab-org/gitlab/-/blob/d86d1d09aa5bfd97ce76ad13cbe3aacf4be785ad/doc/user/permissions.md
• https://forum.gitlab.com/t/how-can-a-guest-trigger-a-pipeline/87077