initial commit

roles/gitlab_install/defaults/main.yml

@@ -0,0 +1,8 @@
+---
+gitlab_install_external_url: "https://gitlab.example.corp"
+gitlab_install_edition: "ce"
+gitlab_install_version: ""   # empty = latest available; pin e.g. "17.5.2-ce.0" for reproducible installs
+gitlab_install_reduce_memory_footprint: true
+gitlab_install_puma_workers: 2
+gitlab_install_sidekiq_concurrency: 10
+gitlab_install_letsencrypt_enabled: false

roles/gitlab_install/handlers/main.yml

@@ -0,0 +1,4 @@
+---
+- name: reconfigure gitlab
+  ansible.builtin.command: gitlab-ctl reconfigure
+  changed_when: true

roles/gitlab_install/tasks/main.yml

@@ -0,0 +1,74 @@
+---
+- name: Install prerequisite packages
+  ansible.builtin.dnf:
+    name:
+      - curl
+      - policycoreutils-python-utils
+      - openssh-server
+      - perl
+      - firewalld
+    state: present
+  tags: [gitlab_install]
+
+- name: Configure the GitLab package repository
+  ansible.builtin.yum_repository:
+    name: "gitlab_gitlab-{{ gitlab_install_edition }}"
+    description: "GitLab {{ gitlab_install_edition | upper }} packages"
+    baseurl: "https://packages.gitlab.com/gitlab/gitlab-{{ gitlab_install_edition }}/el/$releasever/$basearch"
+    gpgcheck: true
+    repo_gpgcheck: true
+    gpgkey: "https://packages.gitlab.com/gitlab/gitlab-{{ gitlab_install_edition }}/gpgkey"
+    sslverify: true
+    enabled: true
+  tags: [gitlab_install]
+
+- name: Install GitLab
+  ansible.builtin.dnf:
+    name: "gitlab-{{ gitlab_install_edition }}{{ ('-' + gitlab_install_version) if gitlab_install_version | length > 0 else '' }}"
+    state: present
+  tags: [gitlab_install]
+
+- name: Deploy gitlab.rb configuration
+  ansible.builtin.template:
+    src: gitlab.rb.j2
+    dest: /etc/gitlab/gitlab.rb
+    owner: root
+    group: root
+    mode: "0600"
+  notify: reconfigure gitlab
+  tags: [gitlab_install]
+
+- name: Open firewall ports for HTTP/HTTPS
+  ansible.posix.firewalld:
+    zone: "{{ firewall_default_zone }}"
+    service: "{{ item }}"
+    permanent: true
+    immediate: true
+    state: enabled
+  loop:
+    - http
+    - https
+  tags: [gitlab_install]
+
+- name: Flush handlers to apply gitlab.rb changes now
+  ansible.builtin.meta: flush_handlers
+  tags: [gitlab_install]
+
+- name: Wait for GitLab to report healthy
+  ansible.builtin.uri:
+    url: "{{ gitlab_install_external_url }}/-/health"
+    validate_certs: false
+    status_code: 200
+  register: gitlab_install_health
+  until: gitlab_install_health.status == 200
+  retries: 30
+  delay: 20
+  tags: [gitlab_install]
+
+- name: Report GitLab access details
+  ansible.builtin.debug:
+    msg: >-
+      GitLab is reachable at {{ gitlab_install_external_url }} with user 'root'.
+      Initial password is stored in vault/secrets.yml (gitlab_root_password) -
+      change it on first login.
+  tags: [gitlab_install]

roles/gitlab_install/templates/gitlab.rb.j2

@@ -0,0 +1,14 @@
+# {{ ansible_managed }}
+external_url '{{ gitlab_install_external_url }}'
+
+letsencrypt['enable'] = {{ gitlab_install_letsencrypt_enabled | lower }}
+
+gitlab_rails['initial_root_password'] = '{{ gitlab_root_password }}'
+
+{% if gitlab_install_reduce_memory_footprint %}
+# Reduced footprint for a single small VM
+puma['worker_processes'] = {{ gitlab_install_puma_workers }}
+sidekiq['max_concurrency'] = {{ gitlab_install_sidekiq_concurrency }}
+prometheus_monitoring['enable'] = false
+grafana['enable'] = false
+{% endif %}