gitlab-traefik-letsencrypt-docker-compose.yml

networks:
  gitlab-network:
    external: true
  traefik-network:
    external: true

volumes:
  gitlab-data:
  gitlab-logs:
  gitlab-config:
  gitlab-runner-config:
  gitlab-postgres:
  traefik-certificates:

services:
  postgres:
    image: ${GITLAB_POSTGRES_IMAGE_TAG}
    volumes:
      - gitlab-postgres:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: ${GITLAB_DB_NAME}
      POSTGRES_USER: ${GITLAB_DB_USER}
      POSTGRES_PASSWORD: ${GITLAB_DB_PASSWORD}
    networks:
      - gitlab-network
    healthcheck:
      test: [ "CMD", "pg_isready", "-q", "-d", "${GITLAB_DB_NAME}", "-U", "${GITLAB_DB_USER}" ]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 60s
    restart: unless-stopped

  gitlab:
    image: ${GITLAB_IMAGE_TAG}
    volumes:
      - gitlab-data:/var/opt/gitlab
      - gitlab-logs:/var/log/gitlab
      - gitlab-config:/etc/gitlab
    shm_size: "256m"
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url '${GITLAB_URL}'
        gitlab_rails['gitlab_shell_ssh_port'] = ${GITLAB_SHELL_SSH_PORT}
        nginx['enable'] = true
        nginx['listen_port'] = 80
        nginx['listen_https'] = false
        nginx['proxy_set_headers'] = {
                'X-Forwarded-Proto' => 'https',
                'X-Forwarded-Ssl' => 'on'
        }
        gitlab_rails['db_adapter'] = "${GITLAB_DB_TYPE}"
        gitlab_rails['db_encoding'] = "unicode"
        gitlab_rails['db_host'] = "postgres"
        gitlab_rails['db_database'] = "${GITLAB_DB_NAME}"
        gitlab_rails['db_username'] = "${GITLAB_DB_USER}"
        gitlab_rails['db_password'] = "${GITLAB_DB_PASSWORD}"
        gitlab_rails['smtp_enable'] = true
        gitlab_rails['smtp_address'] = "${GITLAB_SMTP_ADDRESS}"
        gitlab_rails['smtp_port'] = 587
        gitlab_rails['smtp_user_name'] = "${GITLAB_SMTP_USER_NAME}"
        gitlab_rails['smtp_password'] = "${GITLAB_SMTP_PASSWORD}"
        gitlab_rails['smtp_domain'] = "${GITLAB_SMTP_ADDRESS}"
        gitlab_rails['smtp_authentication'] = "login"
        gitlab_rails['smtp_enable_starttls_auto'] = true
        gitlab_rails['smtp_tls'] = false
        gitlab_rails['gitlab_email_from'] = "${GITLAB_EMAIL_FROM}"
        gitlab_rails['gitlab_email_reply_to'] = "${GITLAB_EMAIL_REPLY_TO}"
        postgresql['enable'] = false
        registry['enable'] = false
    networks:
      - gitlab-network
      - traefik-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:80/"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 240s
    labels:
      # Enable Traefik for this container
      - "traefik.enable=true"
      # Match incoming requests on a specific hostname
      - "traefik.http.routers.gitlab.rule=Host(`${GITLAB_HOSTNAME}`)"
      # Assign the router to a named Traefik service
      - "traefik.http.routers.gitlab.service=gitlab"
      # Use the 'websecure' (HTTPS) entry point
      - "traefik.http.routers.gitlab.entrypoints=websecure"
      # Define the internal container port for routing
      - "traefik.http.services.gitlab.loadbalancer.server.port=80"
      # Enable TLS on this router
      - "traefik.http.routers.gitlab.tls=true"
      # Use Let's Encrypt for certificate management
      - "traefik.http.routers.gitlab.tls.certresolver=letsencrypt"
      # Pass the original Host header to the container
      - "traefik.http.services.gitlab.loadbalancer.passhostheader=true"
      # Apply a compression middleware
      - "traefik.http.routers.gitlab.middlewares=compresstraefik"
      # Define settings for the compression middleware
      - "traefik.http.middlewares.compresstraefik.compress=true"
      # Define TCP router rules for GitLab to match all incoming requests (HostSNI)
      - "traefik.tcp.routers.gitlab-ssh.rule=HostSNI(`*`)"
      # Assign the GitLab router to a named Traefik service
      - "traefik.tcp.routers.gitlab-ssh.service=gitlab-ssh"
      # Use the 'GitLab' (custom) entry point
      - "traefik.tcp.routers.gitlab-ssh.entrypoints=ssh"
      # Define the internal container port for routing to the gitlab service
      - "traefik.tcp.services.gitlab-ssh.loadbalancer.server.port=22"
      # Specify which Docker network Traefik should use for routing
      - "traefik.docker.network=traefik-network"
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      traefik:
        condition: service_healthy

  gitlab-runner-1:
    image: ${GITLAB_RUNNER_IMAGE_TAG}
    volumes:
      - gitlab-runner-config:/etc/gitlab-runner
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - gitlab-network
    restart: unless-stopped

  traefik:
    image: ${TRAEFIK_IMAGE_TAG}
    command:
      # Set the log level (DEBUG, INFO, WARN, ERROR)
      - "--log.level=${TRAEFIK_LOG_LEVEL}"
      # Enable the built-in API and web-based dashboard
      - "--api.dashboard=true"
      # Enable the /ping endpoint so we can health-check Traefik
      - "--ping=true"
      # Assign the /ping endpoint to a dedicated entry point on port 8082
      - "--ping.entrypoint=ping"
      - "--entrypoints.ping.address=:8082"
      # Define the primary HTTP entry point on port 80
      - "--entrypoints.web.address=:80"
      # Define the secure (HTTPS) entry point on port 443
      - "--entrypoints.websecure.address=:443"
      # Define the SSH entry point using an environment variable for the port
      - "--entryPoints.ssh.address=:${GITLAB_SHELL_SSH_PORT}"
      # Enable the Docker provider to detect containers and their labels
      - "--providers.docker=true"
      # Point Traefik to the Docker socket
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      # Prevent automatic exposure of all containers; only expose containers
      # with "traefik.enable=true"
      - "--providers.docker.exposedbydefault=false"
      # Use ACME (Let's Encrypt) to generate/renew certificates via TLS challenge
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      # The email address used by Let's Encrypt for renewal notices
      - "--certificatesresolvers.letsencrypt.acme.email=${TRAEFIK_ACME_EMAIL}"
      # The file where ACME certificates are stored inside the container
      - "--certificatesresolvers.letsencrypt.acme.storage=/etc/traefik/acme/acme.json"
      # Enable Prometheus metrics
      - "--metrics.prometheus=true"
      # Configure Prometheus histogram buckets
      - "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
      # Check for newer Traefik versions and optionally log that info
      - "--global.checknewversion=true"
      # Disable sending anonymous usage data to the Traefik maintainers
      - "--global.sendanonymoususage=false"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik-certificates:/etc/traefik/acme
    networks:
      - traefik-network
    ports:
      - "${GITLAB_SHELL_SSH_PORT}:${GITLAB_SHELL_SSH_PORT}"
      - "80:80"
      - "443:443"
    healthcheck:
      test: ["CMD", "wget", "http://localhost:8082/ping","--spider"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 5s
    labels:
      # Enable Traefik for this container
      - "traefik.enable=true"
      # A router to expose the Traefik dashboard
      - "traefik.http.routers.dashboard.rule=Host(`${TRAEFIK_HOSTNAME}`)"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.tls=true"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
      - "traefik.http.routers.dashboard.service=api@internal"
      # Basic Authentication for the Traefik dashboard
      - "traefik.http.routers.dashboard.middlewares=authtraefik"
      - "traefik.http.middlewares.authtraefik.basicauth.users=${TRAEFIK_BASIC_AUTH}"
      # Specify the internal server port to the dashboard service
      - "traefik.http.services.dashboard.loadbalancer.server.port=8080"
      # Pass the original Host header to the backend
      - "traefik.http.services.dashboard.loadbalancer.passhostheader=true"
      # HTTP -> HTTPS redirect for all hosts
      - "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"
      - "traefik.http.routers.http-catchall.entrypoints=web"
      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
    restart: unless-stopped