GitLab CE

• Teams that need private Git hosting with code review
• Companies that must keep source code on their own infrastructure in the EU
• DevOps engineers who want CI/CD close to their servers

Use cases

• Private Git hosting for a team

  Repositories, merge requests, protected branches and code review without per-user fees.

• CI/CD pipelines

  Define pipelines in .gitlab-ci.yml and run them on GitLab Runners you register, for example on Docker CE servers.

• Container registry

  Build images in CI and push them to the registry next to your code.

GitLab needs at least 4 GB of RAM. S2 works for a few users; S4 (4 vCPU, 8 GB) is noticeably faster and suits a team. Run CI jobs on separate runner servers, not on the GitLab server. You can resize the server later. See current prices.

1. 1

   Let the first boot finish

   GitLab configures itself on first boot, which takes several minutes. Until it is done the address does not answer, or shows a 502 page. The log is in /var/log/nexoran-gitlab-reconfigure.log.

2. 2

   Find your address and password

   The address, user name and password are written to /root/APP-INFO.txt and printed when you log in over SSH as root. If you created the server with a root password and it meets GitLab's rules (8 or more characters), the app uses that same password, so you can sign in with what the console showed you at creation. If you used an SSH key (or the password does not meet the policy), a strong password is generated for this server and written to /root/APP-INFO.txt.

   ssh [email protected]
   cat /root/APP-INFO.txt

3. 3

   Sign in as root

   Open the address and sign in as root. Until you add your own domain, the app is served at https://<your-ip-with-dashes>.sslip.io (for example https://203-0-113-10.sslip.io), a public wildcard DNS name that resolves to your server, with a Let's Encrypt certificate obtained automatically. Opening the bare IP address redirects there. If Let's Encrypt is not reachable at first, GitLab serves a self-signed certificate and retries every 15 minutes until a valid one is issued.

4. 4

   Lock down sign-ups

   In the Admin area, under Settings → General → Sign-up restrictions, turn off sign-ups or require approval, and create accounts for your team.

5. 5

   Use your own domain

   Create an A record for your domain that points to the server's IPv4 address and wait until it resolves. Then run the domain helper as root: it switches the app to the new name and obtains a new certificate. For GitLab it updates external_url and runs gitlab-ctl reconfigure.

   nexoran-app-domain app.example.com

6. 6

   Configure email

   No mail server is installed, so GitLab cannot send notifications or password resets yet. Add your SMTP provider to /etc/gitlab/gitlab.rb, then run gitlab-ctl reconfigure.

7. 7

   Add a runner

   Pipelines need at least one GitLab Runner. Install it on a separate server (a Docker CE server works well) and register it from your project or the Admin area.

• The build's secrets are removed from the image; each server generates its own gitlab-secrets.json on first boot. Back it up with your data: backups cannot be restored without it.
• A server without a firewall accepts all inbound traffic. Create an Odinex firewall that allows only SSH (22), HTTP (80), HTTPS (443) and, if you use the registry, 5050 and apply it to the server. Odinex firewalls filter traffic before it reaches the server, so Docker's own iptables rules cannot bypass them.
• Require two-factor authentication for all users in the Admin area.
• Keep GitLab updated with apt update && apt install gitlab-ce; GitLab's package repository is already configured. Take a snapshot before every upgrade.
• Use gitlab-backup create for application backups and Odinex backups or snapshots for the whole server.

• Docker CEDocker CE
• WordPressWordPress
• n8nn8nn8n
• CoolifyCoolify
• WireGuard VPNWireGuard VPN
• opeOpenClawOpenClaw