main.yml

---
# .. vim: foldmarker=[[[,]]]:foldmethod=marker

# debops.gitlab default variables [[[
# ===================================

# .. contents:: Sections
#    :local:
#
# .. include:: includes/all.rst


# GitLab version configuration [[[
# --------------------------------

# .. envvar:: gitlab_version [[[
#
# Specify the GitLab version to install or manage. The role checks what version
# is currently installed and can perform automatic upgrade if the installed
# version is older than the specified. Downgrades are not supported.
gitlab_version: '{{ "9.4"
                    if (ansible_local|d() and ansible_local.core|d() and
                        ansible_local.core.distribution_release|d() and
                        ansible_local.core.distribution_release == "stretch")
                    else "8.17" }}'
                                                                   # ]]]
                                                                   # ]]]
# Application features [[[
# ------------------------

# .. envvar:: gitlab__database [[[
#
# What database to use for GitLab instance? Supported options:
#
# - ``postgresql``: use PostgreSQL database
#
# The role expects the selected database server to be configured. See the
# documentation of the debops.postgresql_server_ role for information about
# its features.
gitlab__database: '{{ ansible_local.gitlab.database
                      if (ansible_local|d() and ansible_local.gitlab|d() and
                          ansible_local.gitlab.database|d())
                      else ("postgresql"
                            if (ansible_local|d() and ansible_local.postgresql is defined)
                            else ("mariadb-is-deprecated"
                                  if (ansible_local|d() and ansible_local.mariadb is defined)
                                  else "no-database-detected")) }}'

                                                                   # ]]]
# .. envvar:: gitlab_use_systemd [[[
#
# Enable or disable use of the :command:`systemd` units instead of the upstream
# init script provided by GitLab. By default the init script will be used on
# non-systemd hosts.
gitlab_use_systemd: '{{ (ansible_local.gitlab.systemd_services
                         if (ansible_local|d() and ansible_local.gitlab|d() and
                             ansible_local.gitlab.systemd_services|d())
                         else (False
                               if (ansible_local|d() and ansible_local.gitlab|d() and
                                   ansible_local.gitlab.installed|d())
                               else (True if ansible_service_mgr == "systemd" else False))) }}'

                                                                   # ]]]
# .. envvar:: gitlab_enable_pages [[[
#
# Whether to enable ``gitlab-pages``. Available in Gitlab 8.17 and newer.
gitlab_enable_pages: '{{ gitlab_version | version_compare("8.17",
                         operator="ge", strict=True) and gitlab_pages_domain != "" }}'
                                                                   # ]]]
                                                                   # ]]]
# Application FQDN and DNS addresses [[[
# --------------------------------------

# .. envvar:: gitlab__fqdn [[[
#
# The Fully Qualified Domain Name of the GitLab application. This address is
# used to configure the webserver frontend.
gitlab__fqdn: 'code.{{ gitlab_domain }}'

                                                                   # ]]]
# .. envvar:: gitlab_domain [[[
#
# Domain which will be used for nginx server and gitlab-shell access
# GitLab will be configured with HTTPS enabled by default
gitlab_domain: [ 'code.{{ ansible_domain }}' ]
                                                                   # ]]]
                                                                   # ]]]
# APT packages [[[
# ----------------

# .. envvar:: gitlab__distribution_release [[[
#
# The OS distribution relese which is used to select the correct package names.
gitlab__distribution_release: '{{ ansible_local.core.distribution_release
                                  if (ansible_local|d() and ansible_local.core|d() and
                                      ansible_local.core.distribution_release|d())
                                  else "jessie" }}'

                                                                   # ]]]
# .. envvar:: gitlab__base_packages [[[
#
# List of base APT packages required by GitLab.
gitlab__base_packages: [ 'build-essential', 'zlib1g-dev', 'libyaml-dev',
                         'libgdbm-dev', 'libreadline-dev', 'libncurses5-dev', 'libffi-dev',
                         'libxml2-dev', 'libxslt1-dev', 'libcurl4-openssl-dev', 'libkrb5-dev',
                         'libicu-dev', 'python-docutils', 'cmake', 'pkg-config', 'unzip' ]

                                                                   # ]]]
# .. envvar:: gitlab__release_packages [[[
#
# List of base APT packages required by GitLab depending on the distribution release.
gitlab__release_packages:
  jessie:  [ 'libssl-dev' ]
  stretch: [ 'libssl1.0-dev', 'libre2-dev' ]
  precise: [ 'libssl-dev' ]
  trusty:  [ 'libssl-dev' ]
  xenial:  [ 'libssl-dev', 'libre2-dev' ]

                                                                   # ]]]
# .. envvar:: gitlab__database_packages [[[
#
# YAML dictionary which contains list of APT packages required by a particular
# database server.
gitlab__database_packages:
  jessie:
    postgresql: [ 'libpq-dev', 'ruby-pg' ]
  stretch:
    postgresql: [ 'libpq-dev', 'ruby-pg' ]
  precise:
    postgresql: [ 'libpq-dev', 'ruby-pg' ]
  trusty:
    postgresql: [ 'libpq-dev', 'ruby-pg' ]
  xenial:
    postgresql: [ 'libpq-dev', 'ruby-pg' ]
                                                                   # ]]]
                                                                   # ]]]
# GitLab Pages configuration [[[
# ------------------------------

# .. envvar:: gitlab_pages_domain [[[
#
# The main domain served by Gitlab Pages. Set this to your domain to enable
# Gitlab Pages.
#
# This should be a different one than :envvar:`gitlab_domain` to prevent cross
# domain cookie attacks.
gitlab_pages_domain: ''

                                                                   # ]]]
# .. envvar:: gitlab_pages_port [[[
#
# Port the ``gitlab-pages`` HTTP server listens to.
gitlab_pages_port: '8090'
                                                                   # ]]]
                                                                   # ]]]
# nginx webserver options [[[
# ---------------------------

# .. envvar:: gitlab_nginx_auth_realm [[[
#
# Webserver authentication realm.
gitlab_nginx_auth_realm: 'GitLab access is restricted'

                                                                   # ]]]
# .. envvar:: gitlab_nginx_access_policy [[[
#
# Name of webserver access policy to enable. Refer to debops.nginx_ for
# details.
gitlab_nginx_access_policy: ''

                                                                   # ]]]
# .. envvar:: gitlab_nginx_client_max_body_size [[[
#
# nginx client_max_body_size value.
gitlab_nginx_client_max_body_size: '0'

                                                                   # ]]]
# .. envvar:: gitlab_nginx_proxy_timeout [[[
#
# nginx - gitlab proxy timeout in seconds
gitlab_nginx_proxy_timeout: '300'
                                                                   # ]]]
                                                                   # ]]]
# E-mail configuration [[[
# ------------------------

# .. envvar:: gitlab_email_display_name [[[
#
# E-mail sender name used by GitLab
gitlab_email_display_name: 'GitLab'

                                                                   # ]]]
# .. envvar:: gitlab_email_from [[[
#
# E-mail address used by GitLab application.
gitlab_email_from: 'git@{{ gitlab_domain[0] }}'

                                                                   # ]]]
# .. envvar:: gitlab_email_reply_to [[[
#
# E-mail Reply-To address added to GitLab mails.
gitlab_email_reply_to: 'admin+gitlab@{{ ansible_domain }}'

                                                                   # ]]]
# .. envvar:: gitlab_admin_email [[[
#
# Default admin account e-mail address.
gitlab_admin_email: 'admin@{{ ansible_domain }}'

                                                                   # ]]]
# .. envvar:: gitlab_admin_password [[[
#
# Default admin account password.
gitlab_admin_password: '{{ lookup("password", secret
                           + "/credentials/" + ansible_fqdn
                           + "/gitlab/admin/password chars=ascii,numbers") }}'
                                                                   # ]]]
                                                                   # ]]]
# New user configuration [[[
# --------------------------

# .. envvar:: gitlab_default_can_create_group [[[
#
# Should new users be able to create groups?
gitlab_default_can_create_group: 'true'

                                                                   # ]]]
# .. envvar:: gitlab_username_changing_enabled [[[
#
# Can users change their own username?
gitlab_username_changing_enabled: 'false'

                                                                   # ]]]
# .. envvar:: gitlab_default_theme [[[
#
# Default GitLab theme to use
gitlab_default_theme: '2'
                                                                   # ]]]
                                                                   # ]]]
# Database configuration [[[
# --------------------------

# .. envvar:: gitlab_database_server [[[
#
# FQDN of the database server. It will be configured by the debops.postgresql_
# role.
gitlab_database_server: '{{ ansible_local[gitlab__database].server }}'

                                                                   # ]]]
# .. envvar:: gitlab_database_port [[[
#
# Port the database is listening on.
gitlab_database_port: '{{ ansible_local[gitlab__database].port }}'

                                                                   # ]]]
# .. envvar:: gitlab_database_user [[[
#
# Name of the database account to use for the GitLab application.
gitlab_database_user: 'gitlab'

                                                                   # ]]]
# .. envvar:: gitlab_database_name [[[
#
# Name of the database to use for the GitLab data.
gitlab_database_name: 'gitlabhq_production'

                                                                   # ]]]
# .. envvar:: gitlab_database_password_path [[[
#
# Path to database password file located on the Ansible Controller. See the
# debops.secret_ role for more details.
gitlab_database_password_path: '{{ secret + "/" + gitlab__database + "/" +
                                   ansible_local[gitlab__database].delegate_to }}{%
                                     if gitlab__database=="postgresql" %}/{{ ansible_local[gitlab__database].port }}{% endif
                                   %}{{ "/credentials/" + gitlab_database_user +
                                   "/password" }}'

                                                                   # ]]]
# .. envvar:: gitlab_database_password [[[
#
# Database password for GitLab.
gitlab_database_password: "{{ lookup('password', gitlab_database_password_path
                              + ' length=48 chars=ascii_letters,digits,.:-_') }}"

                                                                   # ]]]
# .. envvar:: gitlab_postgresql_database_connection [[[
#
# Connection type for PostgreSQL database (choices: socket, port)
# FIXME: not supported yet
gitlab_postgresql_database_connection: 'socket'
                                                                   # ]]]
                                                                   # ]]]
# GitLab backup options [[[
# -------------------------

# .. envvar:: gitlab_backup_frequency [[[
#
# Backup frequency (daily, weekly, monthly)
gitlab_backup_frequency: 'daily'

                                                                   # ]]]
# .. envvar:: gitlab_backup_keep_time [[[
#
# How long to store backups for, in seconds
gitlab_backup_keep_time: '{{ (60 * 60 * 24 * 7) }}'
                                                                   # ]]]
                                                                   # ]]]
# Redis configuration [[[
# -----------------------

# .. envvar:: gitlab_redis_host [[[
#
# Define hostname of redis server to use.
gitlab_redis_host: '{{ ansible_local.redis.host
                       if (ansible_local|d() and ansible_local.redis|d() and
                           ansible_local.redis.host|d())
                       else "localhost" }}'

                                                                   # ]]]
# .. envvar:: gitlab_redis_port [[[
#
# Define port of redis server to use.
gitlab_redis_port: '{{ ansible_local.redis.port
                       if (ansible_local|d() and ansible_local.redis|d() and
                           ansible_local.redis.port|d())
                       else "6379" }}'

                                                                   # ]]]
# .. envvar:: gitlab_redis_password [[[
#
# Define the Redis authentication password to use
gitlab_redis_password: '{{ ansible_local.redis.password
                           if (ansible_local|d() and ansible_local.redis|d() and
                               ansible_local.redis.password|d())
                           else "" }}'

                                                                   # ]]]
# .. envvar:: gitlab_redis_resque [[[
#
# Connection string used in the configuration file.
gitlab_redis_resque: 'redis://{{ ((":" + gitlab_redis_password + "@")
                                  if gitlab_redis_password else "") +
                      gitlab_redis_host + ":" + gitlab_redis_port }}'

                                                                   # ]]]
# .. envvar:: gitlab_redis_database [[[
#
# Specify which Redis database to use for GitLab
gitlab_redis_database: '0'
                                                                   # ]]]
                                                                   # ]]]
# GitLab directory layout [[[
# ---------------------------

# .. envvar:: gitlab_home [[[
#
# Home directory
gitlab_home: '{{ ansible_local.root.home + "/" + gitlab_user }}'

                                                                   # ]]]
# .. envvar:: gitlab_app_root_path [[[
#
# Application installation directory
gitlab_app_root_path: '{{ ansible_local.root.app + "/" + gitlab_user }}'

                                                                   # ]]]
# .. envvar:: gitlab_repositories_path [[[
#
# GitLab repositories
gitlab_repositories_path: '{{ ansible_local.root.data + "/gitlab/repositories" }}'

                                                                   # ]]]
# .. envvar:: gitlab_satellites_path [[[
#
# GitLab satellites
gitlab_satellites_path: '{{ ansible_local.root.data + "/gitlab/satellites" }}'

                                                                   # ]]]
# .. envvar:: gitlab_backup_path [[[
#
# Backup path
gitlab_backup_path: '{{ ansible_local.root.backup + "/gitlab" }}'

                                                                   # ]]]
# .. envvar:: gitlab_src_path [[[
#
# GitLab sources root path
gitlab_src_path: '{{ ansible_local.root.src + "/gitlab" }}'

                                                                   # ]]]
# .. envvar:: gitlab_lfs_path [[[
#
# Gitlab path for lfs objects
gitlab_lfs_path: '{{ ansible_local.root.data + "/gitlab/shared/lfs-objects" }}'

                                                                   # ]]]
# .. envvar:: gitlab_shared_path [[[
#
# Gitlab path for shared files
gitlab_shared_path: '{{ ansible_local.root.data + "/gitlab/shared" }}'

                                                                   # ]]]
# .. envvar:: gitlab_artifacts_path [[[
#
# Gitlab path for artifacts files
gitlab_artifacts_path: '{{ ansible_local.root.data + "/gitlab/shared/artifacts" }}'

                                                                   # ]]]
# .. envvar:: gitlab_pages_path [[[
#
# Path where GitLab Pages are stored in the filesystem.
gitlab_pages_path: '{{ ansible_local.root.data + "/gitlab/shared/pages" }}'
                                                                   # ]]]
                                                                   # ]]]
# System user, group, additional groups [[[
# -----------------------------------------

# .. envvar:: gitlab_user [[[
#
# System UNIX account used by the GitLab application. It will be visible in the
# :command:`git+ssh` remote URLs.
gitlab_user: 'git'

                                                                   # ]]]
# .. envvar:: gitlab_group [[[
#
# System UNIX group used by the Gitlab application.
gitlab_group: 'git'

                                                                   # ]]]
# .. envvar:: gitlab_user_append_groups [[[
#
# List of additional system groups to add to the GitLab user account.
# The ``sshusers`` UNIX group is used in DebOps to limit SSH access. See the
# debops.auth_ role for more details.
gitlab_user_append_groups: [ 'sshusers' ]

                                                                   # ]]]
# .. envvar:: gitlab__shell [[[
#
# The default shell used by the GitLab UNIX account.
gitlab__shell: '/bin/bash'
                                                                   # ]]]
                                                                   # ]]]
# Internal application options [[[
# --------------------------------

# .. envvar:: gitlab_time_zone [[[
#
# The timezone used by GitLab.
gitlab_time_zone: 'UTC'

                                                                   # ]]]
# .. envvar:: gitlab_git_max_size [[[
#
# Max :command:`git` upload size in bytes.
gitlab_git_max_size: '{{ (1024 * 1024 * 20) }}'

                                                                   # ]]]
# .. envvar:: gitlab_git_timeout [[[
#
# The :command:`git` connection timeout in seconds.
gitlab_git_timeout: '10'

                                                                   # ]]]
# .. envvar:: gitlab_unicorn_port [[[
#
# Unicorn port on ``localhost`` interface.
gitlab_unicorn_port: '18082'

                                                                   # ]]]
# .. envvar:: gitlab_unicorn_timeout [[[
#
# Unicorn connection timeout in seconds.
gitlab_unicorn_timeout: '60'

                                                                   # ]]]
# .. envvar:: gitlab_passenger_options [[[
#
# Additional options for Phusion Passenger as text block.
gitlab_passenger_options: ''

                                                                   # ]]]
# .. envvar:: gitlab_shell_ssh_port [[[
#
# SSH port for GitLab Shell (does not affect sshd port setting).
gitlab_shell_ssh_port: '22'
                                                                   # ]]]
                                                                   # ]]]
# Compatibility workarounds [[[
# -----------------------------

# .. envvar:: gitlab_support_filesystem_acl [[[
#
# Enable or disable ACL configuration for the webserver
gitlab_support_filesystem_acl: True
                                                                   # ]]]
                                                                   # ]]]
# Custom APT package repositories [[[
# -----------------------------------

# .. envvar:: gitlab__yarn_apt_key_id [[[
#
# The OpenPGP key used to sign Yarn repository.
gitlab__yarn_apt_key_id: '72ECF46A56B4AD39C907BBB71646B01B86E50310'

                                                                   # ]]]
# .. envvar:: gitlab__yarn_apt_repo [[[
#
# APT repository URL to Yarn repository.
gitlab__yarn_apt_repo: 'deb https://dl.yarnpkg.com/debian/ stable main'
                                                                   # ]]]
                                                                   # ]]]
# GitLab source code version [[[
# ------------------------------

# .. envvar:: gitlab_version_map [[[
#
# This YAML dictionary is used to map the selected GitLab version to the
# respecive branches and/or tags in the :command:`git` repositories of various
# GitLab components.
gitlab_version_map:

  '8.5':
    shell: 'v2.6.10'
    ce:    '8-5-stable'
    gitlab_workhorse: '0.6.4'

  '8.6':
    shell: 'v2.6.12'
    ce:    '8-6-stable'
    gitlab_workhorse: 'v0.7.1'

  '8.7':
    shell: 'v2.7.2'
    ce:    '8-7-stable'
    gitlab_workhorse: 'v0.7.1'

  '8.8':
    shell: 'v2.7.2'
    ce:    '8-8-stable'
    gitlab_workhorse: 'v0.7.1'

  '8.9':
    shell: 'v3.0.0'
    ce:    '8-9-stable'
    gitlab_workhorse: 'v0.7.5'

  '8.10':
    shell: 'v3.3.2'
    ce:    '8-10-stable'
    gitlab_workhorse: 'v0.7.8'

  '8.11':
    shell: 'v3.4.0'
    ce:    '8-11-stable'
    gitlab_workhorse: 'v0.7.11'

  '8.12':
    shell: 'v3.6.3'
    ce:    '8-12-stable'
    gitlab_workhorse: 'v0.8.5'

  '8.13':
    shell: 'v3.6.6'
    ce:    '8-13-stable'
    gitlab_workhorse: 'v0.8.5'

  '8.14':
    shell: 'v4.0.3'
    ce:    '8-14-stable'
    gitlab_workhorse: 'v1.0.1'

  '8.15':
    shell: 'v4.1.1'
    ce:    '8-15-stable'
    gitlab_workhorse: 'v1.3.0'

  '8.16':
    shell: 'v4.1.1'
    ce:    '8-16-stable'
    gitlab_workhorse: 'v1.3.0'

  '8.17':
    shell: 'v4.1.1'
    ce:    '8-17-stable'
    gitlab_workhorse: 'v1.3.0'
    pages: 'v0.3.2'

  '9.0':
    shell: 'v5.0.0'
    ce:    '9-0-stable'
    gitlab_workhorse: 'v1.4.2'
    pages: 'v0.4.0'
    gitaly: 'v0.3.0'

  '9.1':
    shell: 'v5.0.2'
    ce:    '9-1-stable'
    gitlab_workhorse: 'v1.4.3'
    pages: 'v0.4.1'
    gitaly: 'v0.6.0'

  '9.2':
    shell: 'v5.0.4'
    ce:    '9-2-stable'
    gitlab_workhorse: 'v2.0.0'
    pages: 'v0.4.2'
    gitaly: 'v0.10.0'

  '9.3':
    shell: 'v5.1.1'
    ce:    '9-3-stable'
    gitlab_workhorse: 'v2.1.1'
    pages: 'v0.4.3'
    gitaly: 'v0.11.2'

  '9.4':
    shell: 'v5.3.1'
    ce:    '9-4-stable'
    gitlab_workhorse: 'v2.3.0'
    pages: 'v0.5.0'
    gitaly: 'v0.21.2'
                                                                   # ]]]
                                                                   # ]]]
# gitlab-shell source code [[[
# ----------------------------

# .. envvar:: gitlab_shell_git_repo [[[
#
# URL of the ``gitlab-shell`` repository.
gitlab_shell_git_repo: 'https://gitlab.com/gitlab-org/gitlab-shell.git'

                                                                   # ]]]
# .. envvar:: gitlab_shell_git_dest [[[
#
# Path where the ``gitlab-shell`` source code will be cloned into a bare
# repository.
gitlab_shell_git_dest: '{{ gitlab_src_path + "/" + gitlab_shell_git_repo.split("://")[1] }}'

                                                                   # ]]]
# .. envvar:: gitlab_shell_git_checkout [[[
#
# Path where the ``gitlab-shell`` source code will be checked out.
gitlab_shell_git_checkout: '{{ gitlab_app_root_path + "/gitlab-shell" }}'
                                                                   # ]]]
                                                                   # ]]]
# GitLab CE source code [[[
# -------------------------

# .. envvar:: gitlab_ce_git_repo [[[
#
# URL of the GitLab CE repository.
gitlab_ce_git_repo: 'https://gitlab.com/gitlab-org/gitlab-ce.git'

                                                                   # ]]]
# .. envvar:: gitlab_ce_git_dest [[[
#
# Path where the GitLab CE source code will be cloned into a bare repository.
gitlab_ce_git_dest: '{{ gitlab_src_path + "/" + gitlab_ce_git_repo.split("://")[1] }}'

                                                                   # ]]]
# .. envvar:: gitlab_ce_git_checkout [[[
#
# Path where the GitLab CE source code will be checked out.
gitlab_ce_git_checkout: '{{ gitlab_app_root_path + "/gitlab" }}'
                                                                   # ]]]
                                                                   # ]]]
# GitLab git HTTP server source code [[[
# --------------------------------------

# .. envvar:: gitlab_git_http_server_repo [[[
#
# URL of the git HTTP server repository.
gitlab_git_http_server_repo: 'https://gitlab.com/gitlab-org/gitlab-git-http-server.git'

                                                                   # ]]]
# .. envvar:: gitlab_git_http_server_dest [[[
#
# Path where the git HTTP server source code will be cloned into a bare
# repository.
gitlab_git_http_server_dest: '{{ gitlab_src_path + "/" + gitlab_git_http_server_repo.split("://")[1] }}'

                                                                   # ]]]
# .. envvar:: gitlab_git_http_server_checkout [[[
#
# Path where the git HTTP server source code will be checked out.
gitlab_git_http_server_checkout: '{{ gitlab_app_root_path + "/gitlab-git-http-server" }}'
                                                                   # ]]]
                                                                   # ]]]
# GitLab Workhorse source code [[[
# --------------------------------

# .. envvar:: gitlab_workhorse_repo [[[
#
# URL of the GitLab Workhorse repository.
gitlab_workhorse_repo: 'https://gitlab.com/gitlab-org/gitlab-workhorse.git'

                                                                   # ]]]
# .. envvar:: gitlab_workhorse_dest [[[
#
# Path where the GitLab Workhorse source code will be cloned into a bare
# repository.
gitlab_workhorse_dest: '{{ gitlab_src_path + "/" + gitlab_workhorse_repo.split("://")[1] }}'

                                                                   # ]]]
# .. envvar:: gitlab_workhorse_checkout [[[
#
# Path where the GitLab Workhorse source code will be checked out.
gitlab_workhorse_checkout: '{{ gitlab_app_root_path + "/gitlab-workhorse" }}'
                                                                   # ]]]
                                                                   # ]]]
# GitLab Pages source code [[[
# ----------------------------

# .. envvar:: gitlab_pages_repo [[[
#
# URL of the GitLab Pages repository.
gitlab_pages_repo: 'https://gitlab.com/gitlab-org/gitlab-pages.git'

                                                                   # ]]]
# .. envvar:: gitlab_pages_dest [[[
#
# Path where the GitLab Pages source code will be cloned into a bare
# repository.
gitlab_pages_dest: '{{ gitlab_src_path + "/" + gitlab_pages_repo.split("://")[1] }}'

                                                                   # ]]]
# .. envvar:: gitlab_pages_checkout [[[
#
# Path where the GitLab Pages source code will be checked out.
gitlab_pages_checkout: '{{ gitlab_app_root_path + "/gitlab-pages" }}'
                                                                   # ]]]
                                                                   # ]]]
# Gitaly source code [[[
# ----------------------

# .. envvar:: gitlab__gitaly_repo [[[
#
# URL of the Gitaly repository.
gitlab__gitaly_repo: 'https://gitlab.com/gitlab-org/gitaly.git'

                                                                   # ]]]
# .. envvar:: gitlab__gitaly_dest [[[
#
# Path where the Gitaly source code will be cloned into a bare repository.
gitlab__gitaly_dest: '{{ gitlab_src_path + "/" + gitlab__gitaly_repo.split("://")[1] }}'

                                                                   # ]]]
# .. envvar:: gitlab__gitaly_checkout [[[
#
# Path where the Gitaly source code will be checked out.
gitlab__gitaly_checkout: '{{ gitlab_app_root_path + "/gitaly" }}'
                                                                   # ]]]
                                                                   # ]]]
# Build and deployment commands [[[
# Different versions of GitLab might require different command parameters to
# build and deploy the service. The variables below define the commands
# according to the selected version or feature.

# .. envvar:: gitlab_assets_clean [[[
#
# Rake task which cleans GitLab static assets during upgrades.
gitlab_assets_clean: '{{ "gitlab:assets:clean"
                         if (gitlab_version | version_compare("8.17", operator="ge", strict=True))
                         else "assets:clean" }}'

                                                                   # ]]]
# .. envvar:: gitlab_assets_compile [[[
#
# Rake task which builds or rebuilds GitLab assets during installation or
# upgrades.
gitlab_assets_compile: '{{ "gitlab:assets:compile"
                           if (gitlab_version | version_compare("8.17", operator="ge", strict=True))
                           else "assets:precompile" }}'

                                                                   # ]]]
# .. envvar:: gitlab_ce_bundle_install_without [[[
#
# YAML dictionary which maps Bundler parameters to the selected database
# backend.
gitlab_ce_bundle_install_without:
  'postgresql': 'development test aws mysql'
                                                                   # ]]]
                                                                   # ]]]
# LDAP Authentication configuration [[[
# -------------------------------------

# More information about LDAP support in GitLab can be found at
# https://gitlab.com/help/administration/auth/ldap.md

# .. envvar:: gitlab_ldap_enable [[[
#
# Enable or disable LDAP support.
gitlab_ldap_enable: False

                                                                   # ]]]
# .. envvar:: gitlab_ldap_domain [[[
#
# The base DNS domain used to generate LDAP configuration parameters.
gitlab_ldap_domain: '{{ ansible_domain }}'

                                                                   # ]]]
# .. envvar:: gitlab_ldap_label [[[
#
# Specify the name of the LDAP server displayed on the login page.
gitlab_ldap_label: '{{ gitlab_ldap_domain }}'

                                                                   # ]]]
# .. envvar:: gitlab_ldap_host [[[
#
# FQDN address of the LDAP server to connect to.
gitlab_ldap_host: 'ldap.{{ ansible_domain }}'

                                                                   # ]]]
# .. envvar:: gitlab_ldap_port [[[
#
# The LDAP service port to use for connections.
gitlab_ldap_port: '389'

                                                                   # ]]]
# .. envvar:: gitlab_ldap_method [[[
#
# The connection method that should be used to connect to the LDAP server.
# Available methods: ``tls``, ``ssl``, ``plain``.
gitlab_ldap_method: 'tls'

                                                                   # ]]]
# .. envvar:: gitlab_ldap_basedn [[[
#
# The LDAP BaseDN string used to connect to the LDAP server.
gitlab_ldap_basedn: '{{ "dc=" + gitlab_ldap_domain.split(".") | join(",dc=") }}'

                                                                   # ]]]
# .. envvar:: gitlab_ldap_binddn [[[
#
# The GitLab user account on the LDAP server, used to bind to the LDAP server.
gitlab_ldap_binddn: '{{ "cn=gitlab," + secret_ldap_services_dn }}'

                                                                   # ]]]
# .. envvar:: gitlab_ldap_password_file [[[
#
# Path to the LDAP bind account password file on the Ansible Controller.
# See the debops.secret_ role for more details.
gitlab_ldap_password_file: '{{ secret + "/credentials/" + gitlab_ldap_host
                               + "/slapd/" + gitlab_ldap_basedn + "/"
                               + gitlab_ldap_binddn + ".password" }}'

                                                                   # ]]]
# .. envvar:: gitlab_ldap_password [[[
#
# The password of the LDAP bind account.
gitlab_ldap_password: '{{ lookup("password", gitlab_ldap_password_file) }}'

                                                                   # ]]]
# .. envvar:: gitlab_ldap_activedirectory [[[
#
# Enable or disable support for ActiveDirectory servers.
gitlab_ldap_activedirectory: False

                                                                   # ]]]
# .. envvar:: gitlab_ldap_uid [[[
#
# Name of the LDAP attribute to use for account lookups. On plain LDAP servers
# it's usually ``uid``, on older ActiveDirectory installations it could be
# ``sAMAccountName``.
gitlab_ldap_uid: 'uid'
                                                                   # ]]]
                                                                   # ]]]
# Piwik configuration [[[
# -----------------------

# .. envvar:: gitlab__piwik_url [[[
#
# The URL (ex.: analytics.example.com) on which Piwik analytics responds
# (default to disabled). Please note that the visit requests from GitLab to the
# Piwik URL will be pushed with the same http scheme that the GitLab is
# hosted with. So, the URL variable must not contain the http scheme, but may
# contain a port or subdirectories.
gitlab__piwik_url: ''

                                                                   # ]]]
# .. envvar:: gitlab__piwik_site_id [[[
#
# The ID of the GitLab website in Piwik analytics.
gitlab__piwik_site_id: '0'
                                                                   # ]]]
                                                                   # ]]]
# Configuration for other Ansible roles [[[
# -----------------------------------------

# .. envvar:: gitlab__etc_services__dependent_list [[[
#
# List of custom :file:`/etc/services` to configure for the debops.etc_services_
# Ansible role.
gitlab__etc_services__dependent_list:

  - name: 'gitlab'
    port: '{{ gitlab_unicorn_port }}'
    comment: 'GitLab'

  - name: 'gitlab-pages'
    port: '{{ gitlab_pages_port }}'
    comment: 'GitLab Pages'

                                                                   # ]]]
# .. envvar:: gitlab__apt_preferences__dependent_list [[[
#
# Configuration for the debops.apt_preferences_ role.
gitlab__apt_preferences__dependent_list:

  - package: 'git git-*'
    backports: [ 'jessie' ]
    reason:  'Meet version requirement of GitLab 8.17 (Git version >= 2.7.3) on Debian Jessie.'
    by_role: 'debops.gitlab'

                                                                   # ]]]
# .. envvar:: gitlab__postgresql__dependent_roles [[[
#
# Configuration of PostgreSQL roles for debops.postgresql_ Ansible role.
gitlab__postgresql__dependent_roles:

  # Owner of the ``gitlabhq_production`` database
  - name: '{{ gitlab_database_name }}'
    flags: [ 'NOLOGIN' ]

  # GitLab user account role
  - name: '{{ gitlab_database_user }}'
    password: '{{ gitlab_database_password }}'

                                                                   # ]]]
# .. envvar:: gitlab__postgresql__dependent_databases [[[
#
# Configuration of PostgreSQL databases for the debops.postgresql_ Ansible
# role.
gitlab__postgresql__dependent_databases:

  - name:  '{{ gitlab_database_name }}'
    owner: '{{ gitlab_database_name }}'

                                                                   # ]]]
# .. envvar:: gitlab__postgresql__dependent_groups [[[
#
# Configuration of PostgreSQL groups for the debops.postgresql_ Ansible role.
gitlab__postgresql__dependent_groups:

  - roles:  [ '{{ gitlab_database_user }}' ]
    groups: [ '{{ gitlab_database_name }}' ]
    database: '{{ gitlab_database_name }}'

                                                                   # ]]]
# .. envvar:: gitlab__postgresql__dependent_extensions [[[
#
# Configuration of PostgreSQL extensions for the debops.postgresql_ Ansible
# role.
gitlab__postgresql__dependent_extensions:

  - database: '{{ gitlab_database_name }}'
    extension: 'pg_trgm'

                                                                   # ]]]
# .. envvar:: gitlab__postgresql__dependent_pgpass [[[
#
# The ``~/.pgpass`` configuration for debops.postgresql_ Ansible role.
gitlab__postgresql__dependent_pgpass:

  - owner: '{{ gitlab_user }}'
    home: '{{ gitlab_home }}'
    database: '{{ gitlab_database_name }}'
    role: '{{ gitlab_database_user }}'

                                                                   # ]]]
# .. envvar:: gitlab__nginx__dependent_upstreams [[[
#
# List of :command:`nginx` upstreams for the debops.nginx_ Ansible role.
gitlab__nginx__dependent_upstreams:

  # Upstream configuration for the ``gitlab-workhorse`` used in GitLab 8.2+
  - name: 'gitlab-workhorse'
    server: 'unix:{{ gitlab_ce_git_checkout }}/tmp/sockets/gitlab-workhorse.socket'

                                                                   # ]]]
# .. envvar:: gitlab__nginx__dependent_servers [[[
#
# List of :command:`nginx` servers for the debops.nginx_ Ansible role.
gitlab__nginx__dependent_servers:

  - '{{ gitlab__nginx_server }}'
  - '{{ gitlab__nginx_pages_server }}'

                                                                   # ]]]
# .. envvar:: gitlab__nginx_server [[[
#
# Configuration of the GitLab :command:`nginx` proxy for the debops.nginx_
# Ansible role.
gitlab__nginx_server:
  by_role: 'debops.gitlab'
  enabled: True
  type: 'rails'
  name: '{{ gitlab_domain }}'
  root: '{{ gitlab_ce_git_checkout }}/public'

  deny_hidden: False

  access_policy: '{{ gitlab_nginx_access_policy }}'
  auth_basic_realm: '{{ gitlab_nginx_auth_realm }}'

  error_pages:
    '404': '/404.html'
    '422': '/422.html'
    '500': '/500.html'
    '502': '/502.html'

  # Phusion Passenger options
  passenger_user: '{{ gitlab_user }}'
  passenger_group: '{{ gitlab_group }}'
  passenger_options: '{{ gitlab_passenger_options }}'

  options: |
    client_max_body_size {{ gitlab_nginx_client_max_body_size }};

  location_list:
    - pattern: '/'
      options: |
        client_max_body_size 0;
        gzip off;

        ## https://github.com/gitlabhq/gitlabhq/issues/694
        ## Some requests take more than 30 seconds.
        proxy_read_timeout      300;
        proxy_connect_timeout   300;
        proxy_redirect          off;

        proxy_http_version 1.1;

        proxy_set_header    Host                $http_host;
        proxy_set_header    X-Real-IP           $remote_addr;
        proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto   $scheme;

        proxy_pass http://gitlab-workhorse;

# ]]]
# .. envvar:: gitlab__nginx_pages_server [[[
#
# Configuration of the GitLab Pages :command:`nginx` proxy for the
# debops.nginx_ role.
gitlab__nginx_pages_server:
  by_role: 'debops.gitlab'
  enabled: '{{ gitlab_enable_pages }}'
  type: 'proxy'
  name: [ '{{ gitlab_pages_domain }}', '*.{{ gitlab_pages_domain }}' ]
  filename: 'gitlab-pages'
  proxy_pass: 'http://localhost:{{ gitlab_pages_port }}'
                                                                   # ]]]
                                                                   # ]]]
                                                                   # ]]]