compose.yml

# https://docs.docker.com/compose/compose-file

services:

  # https://doc.traefik.io/traefik/
  traefik:
    image: traefik:v3.6.12
    command:
    - --log=true
    - --log.level=DEBUG
    - --api=true
    - --api.dashboard=true
    - --entrypoints.http.address=:80
    - --entrypoints.ssh.address=:2222
    - --providers.docker=true
    - --providers.docker.exposedByDefault=false
    ports:
    - 2222:2222
    - 80:80
    volumes:
    - /var/run/docker.sock:/var/run/docker.sock:ro
    - /etc/localtime:/etc/localtime:ro
    restart: always
    healthcheck:
      test: ["CMD-SHELL", "netstat -tunapl | grep LISTEN | grep :80"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 5s
    labels:
      traefik.enable: "true"
      traefik.http.routers.traefik.entrypoints: http
      traefik.http.routers.traefik.service: api@internal
      traefik.http.routers.traefik.rule: Host(`traefik.${DOMAIN:?You must supply DOMAIN}`) || Host(`traefik.${IP:?You must supply IP}.nip.io`)

  # https://docs.gitlab.com/ee/install/docker.html
  gitlab:
    image: gitlab/gitlab-ee:18.10.8-ee.0
    environment:
      # https://gitlab.com/gitlab-org/omnibus-gitlab/blob/master/files/gitlab-config-template/gitlab.rb.template
      GITLAB_OMNIBUS_CONFIG: |
        gitlab_rails['time_zone'] = 'Europe/Berlin'

        gitlab_rails['usage_ping_enabled'] = false

        external_url 'http://gitlab.${DOMAIN:?You must supply DOMAIN}'
        nginx['listen_port'] = 80
        nginx['listen_https'] = false
        nginx['real_ip_trusted_addresses'] = [ '172.16.0.0/12' ]
        nginx['real_ip_header'] = 'X-Real-Ip'
        nginx['real_ip_recursive'] = 'on'

        gitlab_pages['enable'] = true
        pages_external_url 'http://gitlab.${DOMAIN:?You must supply DOMAIN}'
        # Set listen-proxy when behind reverse proxy. see https://docs.gitlab.com/ee/administration/pages/#configure-listener-for-reverse-proxy-requests
        gitlab_pages['listen_proxy'] = "0.0.0.0:8090"
        # Required due to https://gitlab.com/gitlab-org/gitlab-pages/issues/129
        # "chroot bind mount breaks containerised Omnibus deployment"
        gitlab_pages['inplace_chroot'] = true
        # Fix for https://gitlab.com/gitlab-org/gitlab-pages/-/issues/534 causing failed DNS queries
        gitlab_pages['internal_gitlab_server'] = "http://127.0.0.1"

        # Prevent conflict with host SSH port
        gitlab_rails['gitlab_shell_ssh_port'] = 2222

        # https://docs.gitlab.com/ee/administration/monitoring/prometheus/index.html#configuring-prometheus
        prometheus_monitoring['enable'] = true
        prometheus['listen_address'] = ':9090'
    # https://docs.gitlab.com/ee/install/docker.html#devshm-mount-not-having-enough-space-in-docker-container
    shm_size: 256m
    volumes:
    - /etc/localtime:/etc/localtime:ro
    - /etc/gitlab:/etc/gitlab
    - /var/log/gitlab:/var/log/gitlab
    - /var/opt/gitlab:/var/opt/gitlab
    labels:
      traefik.enable: "true"
      traefik.http.services.www.loadbalancer.server.port: 80
      traefik.http.routers.www.entrypoints: http
      traefik.http.routers.www.rule: Host(`gitlab.${DOMAIN:?You must supply DOMAIN}`) || Host(`gitlab.${IP:?You must supply IP}.nip.io`)
      traefik.http.routers.www.service: www
      traefik.http.services.pages.loadbalancer.server.port: 8090
      traefik.http.routers.pages.entrypoints: http
      traefik.http.routers.pages.rule: HostRegexp(`.+\.gitlab\.${DOMAIN:?You must supply DOMAIN}`) || HostRegexp(`.+\.gitlab\.${IP:?You must supply IP}.nip.io`)
      traefik.http.routers.pages.service: pages
      traefik.tcp.services.ssh.loadbalancer.server.port: 2222
      traefik.tcp.routers.ssh.entrypoints: ssh
      traefik.tcp.routers.ssh.rule: HostSNI(`*`)
      traefik.tcp.routers.ssh.service: ssh
      traefik.tcp.routers.ssh.tls.passthrough: true