Homelabv4/infrastructure/vps-standby/gitlab/values.yaml

# Real GitLab on the VPS - simplified single-node equivalent of
# apps/gitlab/values.yaml (home). Same chart, same version, same
# Authentik OIDC provider/client (shared, see infrastructure/authentik/
# gitlab-blueprint.yaml). Deliberately lighter than home's: no Praefect
# (pointless with 1 Gitaly node), no PgBouncer (direct CNPG connection,
# low enough traffic not to need pooling), no SAML, no Container
# Registry, no KAS - all addable later if actually needed, matches the
# "keep it lighter" decision already made for the rest of vps-standby.

global:
  hosts:
    domain: vps.huskypup.net
    gitlab:
      name: gitlab.vps.huskypup.net

  # Ingress disabled - own Ingress + Traefik https-redirect Middleware
  # handle routing (infrastructure/vps-standby/gitlab/manifests/ingress.yaml)
  ingress:
    enabled: false
    configureCertmanager: false

  edition: ce
  time_zone: UTC

  email:
    from: 'gitlab@vps.huskypup.net'
    display_name: GitLab (VPS)
    reply_to: 'noreply@vps.huskypup.net'

  # External PostgreSQL via CNPG (infrastructure/vps-standby/gitlab/manifests/cnpg-cluster.yaml)
  psql:
    host: pg-gitlab-rw.gitlab.svc.cluster.local
    port: 5432
    database: gitlabhq_production
    username: app
    password:
      secret: pg-gitlab-app
      key: password

  # Single Gitaly node, no Praefect - HA routing is pointless with 1 node
  gitaly:
    enabled: true
    internal:
      names:
        - default
    external: []

  praefect:
    enabled: false

  # Standalone Redis (infrastructure/vps-standby/gitlab/manifests/redis.yaml)
  redis:
    host: redis-gitlab.gitlab.svc.cluster.local
    port: 6379
    auth:
      enabled: true
      secret: redis-gitlab-secret
      key: password

  appConfig:
    omniauth:
      enabled: true
      allowSingleSignOn: ['openid_connect']
      blockAutoCreatedUsers: false
      autoLinkUser: ['openid_connect']
      syncProfileFromProvider: ['openid_connect']
      syncProfileAttributes: ['email', 'name']
      providers:
        - secret: gitlab-oidc-secret
          key: provider

# GitLab's pre-upgrade hook checks the deployed version against a
# previous-release ConfigMap to enforce supported upgrade paths - found
# live 2026-08-21 that it fails with "unsupported upgrade path" on a
# genuinely FRESH install too (confirmed: no prior chart-info ConfigMap,
# no Helm release secret, brand new namespace) - a chart/ArgoCD
# interaction quirk (ArgoCD doesn't do real `helm install`, so the
# optional chart-info ConfigMap's absence apparently isn't handled the
# way the script expects). Not relevant for a fresh install anyway - only
# matters for real version-to-version upgrades, which is a future concern
# once this is actually running something to upgrade FROM.
upgradeCheck:
  enabled: false

postgresql:
  install: false

redis:
  install: false

pgbouncer:
  enabled: false

# GitLab's own bundled MinIO for object storage (uploads, artifacts) -
# separate from vps-minio (which backs CNPG WAL archiving for other apps)
minio:
  persistence:
    storageClass: local-path
    size: 20Gi
  resources:
    requests:
      cpu: 25m
      memory: 256Mi
    limits:
      memory: 1Gi

registry:
  enabled: false

gitlab:
  webservice:
    minReplicas: 1
    maxReplicas: 1
    workerProcesses: 2

    extraEnvFrom:
      GITLAB_OIDC_CLIENT_ID:
        secretKeyRef:
          name: gitlab-oidc-secret
          key: GITLAB_OIDC_CLIENT_ID
      GITLAB_OIDC_CLIENT_SECRET:
        secretKeyRef:
          name: gitlab-oidc-secret
          key: GITLAB_OIDC_CLIENT_SECRET
    extraEnv:
      GITLAB_OMNIBUS_CONFIG: |
        gitlab_rails['omniauth_enabled'] = true
        gitlab_rails['omniauth_allow_single_sign_on'] = ['openid_connect']
        gitlab_rails['omniauth_block_auto_created_users'] = false
        gitlab_rails['omniauth_auto_link_user'] = ['openid_connect']
        gitlab_rails['omniauth_sync_profile_from_provider'] = ['openid_connect']
        gitlab_rails['omniauth_sync_profile_attributes'] = ['email', 'name']

        gitlab_rails['omniauth_providers'] = [
          {
            'name' => 'openid_connect',
            'label' => 'Authentik',
            'args' => {
              'name' => 'openid_connect',
              'scope' => ['openid', 'profile', 'email'],
              'response_type' => 'code',
              'issuer' => 'https://auth.kube.huskypup.net/application/o/gitlab/',
              'discovery' => true,
              'client_auth_method' => 'query',
              'uid_field' => 'sub',
              'send_scope_to_token_endpoint' => true,
              'pkce' => true,
              'client_options' => {
                'identifier' => ENV['GITLAB_OIDC_CLIENT_ID'],
                'secret' => ENV['GITLAB_OIDC_CLIENT_SECRET'],
                'redirect_uri' => 'https://gitlab.vps.huskypup.net/users/auth/openid_connect/callback'
              }
            }
          }
        ]
    resources:
      requests:
        cpu: 150m
        memory: 1536Mi
      limits:
        memory: 3Gi

  kas:
    enabled: false

  gitaly:
    persistence:
      storageClass: local-path
      size: 30Gi
    resources:
      requests:
        cpu: 50m
        memory: 256Mi
      limits:
        cpu: "1"
        memory: 1Gi

  gitlab-runner:
    install: false

  gitlab-exporter:
    enabled: true
    metrics:
      enabled: false  # no Prometheus on the VPS cluster

  sidekiq:
    minReplicas: 1
    maxReplicas: 1
    resources:
      requests:
        cpu: 25m
        memory: 384Mi
      limits:
        cpu: 250m
        memory: 1536Mi

certmanager:
  install: false
  installCRDs: false

prometheus:
  install: false

nginx-ingress:
  enabled: false

gitlab-runner:
  install: false