From 602d541d57cc7132d90f2815070a5fe449074d15 Mon Sep 17 00:00:00 2001
From: Andrea Cimbalo <cimbalo@gmail.com>
Date: Mon, 15 Aug 2016 19:45:57 +0200
Subject: [PATCH] add gitlab roles

---
 files/lilik-150x54.png                      | Bin 0 -> 3400 bytes
 projects.yaml                               |   9 +++
 roles/gitlab/handlers/main.yaml             |   2 +
 roles/gitlab/meta/main.yaml                 |   5 ++
 roles/gitlab/tasks/main.yaml                |  62 ++++++++++++++++++++
 roles/gitlab/templates/gitlab.conf.nginx.j2 |  54 +++++++++++++++++
 roles/gitlab/templates/my-gitlab.rb.j2      |  40 +++++++++++++
 roles/gitlab/vars/main.yml                  |   2 +
 8 files changed, 174 insertions(+)
 create mode 100644 files/lilik-150x54.png
 create mode 100644 projects.yaml
 create mode 100644 roles/gitlab/handlers/main.yaml
 create mode 100644 roles/gitlab/meta/main.yaml
 create mode 100644 roles/gitlab/tasks/main.yaml
 create mode 100644 roles/gitlab/templates/gitlab.conf.nginx.j2
 create mode 100644 roles/gitlab/templates/my-gitlab.rb.j2
 create mode 100644 roles/gitlab/vars/main.yml

diff --git a/files/lilik-150x54.png b/files/lilik-150x54.png
new file mode 100644
index 0000000000000000000000000000000000000000..3e6a2083ce7204f8993860ff026808ab1b1c0709
GIT binary patch
literal 3400
zcmV-O4Y%@%P)<h;3K|Lk000e1NJLTq005Q%001@!1^@s6B^_W400006VoOIv0RI60
z0RN!9r;`8x010qNS#tmY3ljhU3ljkVnw%H_000McNliru)&>>}8WAK(ow)!24An_Q
zK~#9!?Ol6RRMi*$?(kAshzJJxO7pD?E6k;WkmV!ILNQ%Qg7&ZnYObX{l~7my$}-GS
z%2337TUKgik*27GD84aGLlhsVsDOYBGR(~P`(p#cID_&sM!MfxXRW#CoO>Sk?7R0q
z`|N#30RWQC0sId@AOLr$P*HVc0r&~P`--AmR7kb}up2;Y_1UPX1)KxmtB_m?AVjjx
z0Y{Glr22SNR33@~czXk_%Xrf&g=97WH=I8&g}J%vgHlm-xVj2cYSjt=ax?(k00762
zt3;)u`pC@{8WOl^)F)DppwR$Rrvk%<)%j5D)zzp+c<@0WG7`wj0=8`fZrrFl8dq1N
z9-(({QKUUQfWd?7mU*hHQIF84kLh<vh)P&0YLR0BfL;#_90=TZ-@jvOPzkFZ!_5uo
z)CtJR0e<)aXw(P@3c5ReHEak32Lti(qRTlssf2aUqIq**$Pn4_wQp}(-n~2E><k<@
z04!fFd1J=Z?ikv(1?J2FPM-$WtO5G<16sDU%C&C4EA;jTCQSl-eF2?LC^RYxNKd!j
z?e^o31O590o}Tgme*6*m`)~7l0Rf_ebnGZQsP*gREiW#%y*V{$B0Ig%P{7eq@{C5{
z*I$9jlYuj5%*9|*lB`ok2GF-J(56kz*2~cm7&HiY{dM5UCjt9%By;^bFlrQV^QPr}
zEJa)#DTg_dh7Tw6^Jz31dEvqZo;`b(Mx&9;%p`mDGOue3$<0mXU@%at)iNh1hX#Xz
zEGi;D{+P70lX^2}lEuX|7!1tL&ZbtYmHBVnNIE;))|{N3$%KTmCCbXm;<<C@SX^8z
z8K+K>ty)Rl4I3oysi)-ni!bDQ`t<7c-Ml&Z-h0wVDKaz3!-wT}Q4u+0i1|Hnab;Dl
z6PA}3dG#ubii#K-8cI7mJKEXVF)%QYH*VY@j~^$UoNQ+S6orhBCrL&}N7Kv8i%w2X
zeC)Buc>45dnO{T%IcN}RFfbz{g98Q(prfNBJv}|SWXTe#Gkdme5!TeHBuS&u$cTst
zIy*ZP0DXLXn3k3%V~&j_H5&5bMN+3DJw4^#UcIC|CB^ho-6?4_q`yD8W(`?Tz>?0%
z-Mh)LV@Y3M^7?hsU?9W7EbqS~VZHh)Npj)Bg#=)hX3Ur&^#={Iodp;+j3k+um`Hnj
zd$aNS`S}T_&C4r$`-cx7ZdS+M-kwK}93ih<AsaTdotGsgg(SIY(<X~`2nYy}c@-9t
z-MW!_J$d4U>3(~AVE{%W>Em<zzM3>4Cr%`f95HdH+*~p`+H`M=7G!$5lzsZCjPEvt
zWnFoH<PiWsVq&62QCVJ>F1DkGlo$iIZruvKUT;>El$3;=oE*T#1?bxsdc7XIcI`5&
zQ<mr9A-b6@z|KxA=>T@@*kMt;Z{I!?6cosgY}6>Jzh_VRNdez}D~h!>C0<bgA0OcB
zuYt2?MR)f022xT)uWr)@c<nXd;6b2qV_?Gu;DHB3ADuSsjvg@939Cdw)9G{;MMXtL
z@}ofm+d9eskZa`--Dor-KR@4$h>EQ!=~}H;9(JQfwlOE8Q8pF;TDELyQS9O20VgLX
zsn?-{WR@o^Kz42<Fmj~HB;f2U8<&IxAURox$H4(uyH++nJ$e9Neko>)Qd(HP9O&5-
z*t-{a@kJrp|Ac|m&aVEM7mP-rgj0ovhN4}&cIB9jg7ENgI5;=}M~;}x54RFlYN`-V
z>(;WXoI4jtO9NJ}1pNHO|8Dwpx&Qg+ft@?eiAGW6p5en~_c>w&P*6~*;j4$xwv3NH
z0)m3jtXVVc-MbgDv9Y*z?HYy-9g2W}03m`obAVN=fb4AGpMNadSiKtP)eBg%#3Uj&
zZx#{w+i!ruP;vhgCjwKZNZZ4P0T(Y;dgv-)*)mR^1V)bre)<XS?(TT|?YGU#qoRPz
zmqpC&-VJEAmTi3Zo#;e>h_sj(vG3i<OE@qPm^Tk7DiSOE(W6xwx=L8K42=eO`DMV)
z4mmkFh>ng%T3Q->eSHxU5(0<u<4x|sw~E11WM%@LI}4|>MtIiX;{&W%A^KHV7_ena
zm4~hpmMtSN5C{rFVPPQ#4<3x<<YWLqOiT=tl9CV|9Svo~h}#nu0OaLWzR#8|fsGr*
z)%cT7fW?ce_fDv*XTumX22d1i+qSKYs7etV8;i@AFN^*&ZypdASM&Z{U4c!T#BY7w
zIv_l}+D)k(%a&1MMmTlqltq!jV8EF%V{rfe{XjW$O10tWD7!@;A0ROi7(f2@ioHr$
z_bA-lBmrOriZ<ipYo{+o5w7>lGh&W-_Ss6C6;x4pufW?IShPrXZl#L(-S%CdJXx&m
zrDlc9%o;bTax7aymoDN@<=`OK$BxN@@7#I!`fS@)+;T`Uk{&x&I~!VcHEjqP8Nl}K
zVmktWu3d$D-7Qa00Jw5R#Gj%7Pd{CutFcO0_cHSG<UqYsC*YlTL<Dy3EDn2j3k3yo
zWRsmOmi9N^sFh}`FA5)e2zc(fx>*374%ojRIDfwO+wR%(-w8snhTL57E;xHu#M4VJ
z31L-)-o1gthpl^XRs|<ch=u=`U!>pER5|Xc6T%7(mQ+_D<w1mn)o#1rd{ehvD=Q0_
zITMJEzH{BkND-F{7Xq_p)$C&~Tek|gTC_;KA_4-ce2h~g!a8~KB!cUbpa3*%*bx2u
z_eXGWFf^Mt1BHb(Zu94#f5xRtm+Ew09v&VTIdUXAEnEmRYgT!)#QX1yg*+ppW&>EV
zMB)J6d{g|d{QZIIJ`<}Rq$RGpBSws{@LaT|^zOUw%GeDClH`;rQ>@lYFZFyRSy)&|
z7Z(?som1n+jk#yf9&t0y$stL8_St7v>;C!YpC*sbQKM?dbJgCS+_XvBOh~AjN9`Rw
zNbeDR_0?D6#HXo0dyu@mJj|UtS4<8~npFNqKfj90!o$UpZ{WZ?KP$ane76oCmQBOr
z#nsv=TJPohbpSw%7A<Ug5ex<cj7DSGwX3VE<pebvxVX5;h0zE{M@KZN%7WDqag|4d
z3cPjA@+%^&2Oa=s%n;>#%NF3Tzr;3HV%4v3cN!EVqBSH$L~X5z!r)+%WO8zHS!9SU
zrdM8hMaEtdl9ZH`L<a{4vpW9%{-$7x645bj+BBP;lSZTAiWMtlUI!17Bo7=oK#fLY
zR?pqtT_UCm3ng;q#tpJ*Q%mtQZJM;TeLJ~tUzys#>}+zu0<vpY>wysf*{6@RTU<<z
z9$h6-sIc@P>i6GGUnptN0626A=-e4eNlA!`imG$Pwmh7jo$<sIPhirdNpQG%Q#>T2
zqXB<^#KgoPA|e9W+1c>(^TX1mOVPG%Ti}Ba<c&>8fUdY03l=QEx^?SNSPP1OZNbaS
z3**L(LuhCyloKa_p+kX`6wuijvuDr7haY|jolXZ=S63`swhTc*L9!!k-(I4m`}Y?E
zYbg{(f^|D|kPn9J-!H+(6D9~pYS2JL-}dd|G#D3W8MHfkw0NOvwIWJy=bjT6Cqb<h
zax8%C)QL<@rA;F%iyS)C6tMcoA0$bgPRIO`U|Z_-WMrf%wr=udc>`@3XU>ovJIZ*6
z3=ytDGCe(=yLRnjR#ukO+q{`<)QAiZH^oktUqe4X6Gzu*%*$G|AZN`YFI+J7o0>|#
z^%m*wZeF)E<nQ7|vUTeka4ZvRkdy9!0QqezC@7H660TecT)kRep#laBkmTtp0RZdQ
zTb_S)?+(210?@6SDQw*qaOH}G$j8K(A3V2fCzklWeZ^-gEe%+@R21^!V)=$be7xlv
zE?p`{)~Qp0`SY#!>EtBbYtkg)Y8s97y>_km#UDB(dCQiGQh(@>MDtkttZ1b;mYQrY
zDT<f_Zq0ApnAB>8gF8A(o~x_qQCcl||NWJVf`0T-iLB1g7n;!P$(=jJl+m=QDcpa<
z2GYTy8j;Xyy7y9YvP3;U{IFb)8)qVds<!3jCEsm0bH*el)6>bQC=<~|MyiDMpGfoP
z%Q{Y&AlEx~$aP>~_1koCAcKO)ZQD${$x;}N@+k(Du<CglIa1bf^=jF8>2&0!OV&kJ
zbwseYH@Rq$m^Mmr^CsD^U;VSZt0;%Pd&P9nrw=f8tXS?>t*V`Gevxt@9Tp}Vi78Vg
z=F!PX%p8?AkgDn4OB#)s3yenc+BH$UyLZ2P{n^`-J$i__L*-cY7)GO*Dij59cNb%5
zO3K~qPp=m@>I#BjRl=%IDF4~1I`%7539CL5R(?M4{r7b`6g5hxKH>Or;PcPLwfNe#
zIvtAow{j|K2e<sKocc$YDr$i}S^pzU^{;zX)F#dW@YN`ak^!I(fMt+Bj8>tdI>;)a
ep+1VDWc(lPO6#aNI2V`z0000<MNUMnLSTYrqfco7

literal 0
HcmV?d00001

diff --git a/projects.yaml b/projects.yaml
new file mode 100644
index 0000000..cddc76d
--- /dev/null
+++ b/projects.yaml
@@ -0,0 +1,9 @@
+---
+- hosts: biff
+  roles:
+      - role: lxc_guest
+        vm_name: projects
+        # distro: sid
+- hosts: projects
+  roles:
+      - role: gitlab
diff --git a/roles/gitlab/handlers/main.yaml b/roles/gitlab/handlers/main.yaml
new file mode 100644
index 0000000..c4fa6c9
--- /dev/null
+++ b/roles/gitlab/handlers/main.yaml
@@ -0,0 +1,2 @@
+- name: restart gitlab-ce
+  shell: gitlab-ctl restart
diff --git a/roles/gitlab/meta/main.yaml b/roles/gitlab/meta/main.yaml
new file mode 100644
index 0000000..a943e7f
--- /dev/null
+++ b/roles/gitlab/meta/main.yaml
@@ -0,0 +1,5 @@
+---
+dependencies:
+  - role: postgresql
+  - role: nginx
+    parent_role_path: "gitlab"
diff --git a/roles/gitlab/tasks/main.yaml b/roles/gitlab/tasks/main.yaml
new file mode 100644
index 0000000..b8b6888
--- /dev/null
+++ b/roles/gitlab/tasks/main.yaml
@@ -0,0 +1,62 @@
+- name: install apt-transport-https package
+  apt:
+    name: "{{ item }}"
+    state: present
+    update_cache: yes
+    cache_valid_time: 3600
+  with_items:
+      - apt-transport-https
+
+- name: add gitlab omnibus apt key
+  apt_key:
+    url: https://packages.gitlab.com/gitlab/gitlab-ce/gpgkey
+    state: present
+
+- name: add gitlab omnibus repository
+  apt_repository: repo='deb https://packages.gitlab.com/gitlab/gitlab-ce/debian/ jessie main' state=present
+
+- name: install gitlab package
+  apt:
+    name: "{{ item }}"
+    state: present
+    update_cache: yes
+    cache_valid_time: 3600
+  with_items:
+      - gitlab-ce
+
+- block:
+    - name: create gitlab DB
+      postgresql_db: name=gitlabhq_production
+    - name: create gitlab DB user
+      postgresql_user:
+        name: gitlab-psql
+        # password: "{{ password }}"
+        db: gitlabhq_production
+        priv: ALL
+        role_attr_flags: SUPERUSER
+  become: true
+  become_method: su
+  become_user: postgres
+
+# - name: copy lilik-150x54.png
+#   copy:
+#     src: lilik-150x54.png
+#     dest: /usr/share/roundcube/skins/classic/images/
+
+- name: copy my-gitlab.rb
+  template:
+      src: "my-gitlab.rb.j2"
+      dest: "/etc/gitlab/my-gitlab.rb"
+      mode: 0600
+  notify: restart gitlab-ce
+
+- name: include my-gitlab.rb
+  lineinfile:
+    dest: /etc/gitlab/gitlab.rb
+    insertafter: EOF
+    line: eval File.open('/etc/gitlab/my-gitlab.rb').read
+  notify: restart gitlab-ce
+
+- name: reconfigure gitlab-ce
+  shell: gitlab-ctl reconfigure
+  notify: restart gitlab-ce
diff --git a/roles/gitlab/templates/gitlab.conf.nginx.j2 b/roles/gitlab/templates/gitlab.conf.nginx.j2
new file mode 100644
index 0000000..7ad7b91
--- /dev/null
+++ b/roles/gitlab/templates/gitlab.conf.nginx.j2
@@ -0,0 +1,54 @@
+#upstream gitlab {
+#    server unix:/var/opt/gitlab/gitlab-rails/sockets/gitlab.socket;
+#    proxy_pass http://localhost:8080;
+#}
+
+server {
+  listen *:80;
+
+
+  server_name projects.lilik.it;
+
+  client_max_body_size 0;
+
+
+#location ~* \.(git) {
+#    proxy_read_timeout      300;
+#    proxy_connect_timeout   300;
+#    proxy_redirect          off;
+
+#    proxy_set_header   X-Forwarded-Proto $scheme;
+#    proxy_set_header   Host              $http_host;
+#    proxy_set_header   X-Real-IP         $remote_addr;
+#    proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
+#    proxy_set_header   X-Frame-Options   SAMEORIGIN;
+#    proxy_pass http://gitlab;
+#    proxy_pass http://localhost:8080;
+#}
+
+  location / {
+    ## If you use HTTPS make sure you disable gzip compression
+    ## to be safe against BREACH attack.
+
+
+    ## https://github.com/gitlabhq/gitlabhq/issues/694
+    ## Some requests take more than 30 seconds.
+    proxy_read_timeout      3600;
+    proxy_connect_timeout   300;
+    proxy_redirect          off;
+
+    proxy_http_version 1.1;
+
+    proxy_set_header Host projects.leader.lilik.it;
+    proxy_set_header X-Forwarded-Host "";
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto http;
+
+    proxy_pass http://localhost:8181;
+    proxy_hide_header    Content-Security-Policy;
+    proxy_hide_header    X-Frame-Options;
+ }
+
+
+}
diff --git a/roles/gitlab/templates/my-gitlab.rb.j2 b/roles/gitlab/templates/my-gitlab.rb.j2
new file mode 100644
index 0000000..767311c
--- /dev/null
+++ b/roles/gitlab/templates/my-gitlab.rb.j2
@@ -0,0 +1,40 @@
+external_url  'http://projects.lilik.it'
+gitlab_rails['gitlab_default_projects_features_issues'] = true
+gitlab_rails['gitlab_default_projects_features_wiki'] = true
+gitlab_rails['gitlab_default_projects_features_snippets'] = true
+gitlab_rails['ldap_enabled'] = true
+gitlab_rails['ldap_servers'] = YAML.load <<-EOS
+  main:
+    label: 'LDAP'
+    host: 'ldap2.lilik.it'
+    port: 389
+    uid: 'mail'
+    method: 'plain'
+    base: 'vd=lilik.it,o=hosting,dc=lilik,dc=it'
+    user_filter: '(memberOf=cn=projects,o=Group,dc=lilik,dc=it)'
+    attributes:
+      username: ['uid', 'userid', 'sAMAccountName']
+      email:    ['mail', 'email', 'userPrincipalName']
+      name:       'cn'
+      first_name: 'givenName'
+      last_name:  'sn'
+EOS
+gitlab_rails['gitlab_shell_ssh_port'] = 8082
+gitlab_rails['smtp_enable'] = true
+gitlab_rails['smtp_address'] = "mail.lilik.it"
+gitlab_rails['smtp_port'] = 25
+
+unicorn['worker_processes'] = 1 # default is 2
+
+gitlab_workhorse['listen_network'] = "tcp"
+gitlab_workhorse['listen_addr'] = "localhost:8181"
+
+gitlab_rails['db_adapter'] = "postgresql"
+gitlab_rails['db_encoding'] = 'utf8'
+gitlab_rails['db_username'] = "gitlab-psql"
+gitlab_rails['db_host'] = nil
+gitlab_rails['db_socket'] = "/var/run/postgresql/"
+gitlab_rails['db_port'] = nil
+
+postgresql['enable'] = false
+nginx['enable'] = false
diff --git a/roles/gitlab/vars/main.yml b/roles/gitlab/vars/main.yml
new file mode 100644
index 0000000..261e2a1
--- /dev/null
+++ b/roles/gitlab/vars/main.yml
@@ -0,0 +1,2 @@
+config_names:
+  - gitlab