gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-21 05:26:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Deploy real GitLab on the VPS (not just Gitea)

Browse Source 
User wants actual GitLab on the VPS, not just Gitea's pull-mirror -
deliberate scope increase from the original plan's 'keep the VPS
lighter' design for git hosting specifically.

Simplified single-node equivalent of apps/gitlab (home) - same chart
version (7.7.0), same Authentik OIDC provider/client_id (added a second
redirect_uri to the shared GitLab provider in infrastructure/authentik/
gitlab-blueprint.yaml), same known chart bugs already diagnosed at home
(redis-init-fix.yaml for the initializer-ordering bug) - but:
  - 1 CNPG instance (local-path) instead of home's 3-instance HA
  - No Praefect - pointless HA routing with a single Gitaly node
  - No PgBouncer - direct CNPG connection, traffic is low enough
  - No SAML, no Container Registry, no KAS - addable later if needed
  - Own Traefik Ingress + https-redirect Middleware from the start
    (found needed the hard way on Vault/Gitea/n8n/Nextcloud/Authentik
    earlier this session - applying that lesson here immediately)

New Vault paths this needed: secret/vps/gitlab-redis (freshly generated,
this Redis instance is new, nothing to reuse) and widened the
vps-eso-reader policy to also allow secret/gitlab-oauth (the shared
Authentik client, already used by home's GitLab).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Scooby Husky
2026-08-20 21:04:48 -05:00
co-authored by Claude Sonnet 5
parent 220cdfb00a
commit 5670a941d4
9 changed files with 487 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infrastructure/vps-standby/gitlab/manifests/ingress.yaml
+42
View File
@@ -0,0 +1,42 @@
---
# Real GitLab on the VPS. https-redirect Middleware from the start this
# time - see infrastructure/vps-standby/vault/manifests/ingress.yaml for
# why it's needed (found live 2026-08-21: Traefik serves plain HTTP
# alongside HTTPS unless explicitly redirected, which silently breaks
# OIDC login since the callback URL computed client-side won't match
# what's registered in Authentik).
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: https-redirect
namespace: gitlab
spec:
redirectScheme:
scheme: https
permanent: true
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: vps-gitlab
namespace: gitlab
annotations:
cert-manager.io/cluster-issuer: letsencrypt-production
traefik.ingress.kubernetes.io/router.middlewares: gitlab-https-redirect@kubernetescrd
spec:
ingressClassName: traefik
tls:
- hosts:
- gitlab.vps.huskypup.net
secretName: vps-gitlab-tls
rules:
- host: gitlab.vps.huskypup.net
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: gitlab-webservice-default
port:
number: 8181