version: '3.5'

services:
  gitlab:
    image: gitlab/gitlab-ce:13.12.15-ce.0
    hostname: 'gitlab.meganet.ru'
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://git.example.int'
        registry_external_url 'https://reg.example.int'

        gitlab_rails['registry_enabled'] = true

        registry_nginx['http2_enabled'] = true
        registry_nginx['listen_port'] = 5005
        registry_nginx['listen_https'] = false
        registry_nginx['listen_addresses'] = ['*', '[::]']

        nginx['listen_port'] = 80
        gitlab_rails['time_zone'] = 'Europe/Moscow'
        gitlab_rails['gitlab_email_from'] = 'git@example.int'
        gitlab_rails['gitlab_email_display_name'] = 'GitLab Server'
        nginx['listen_https'] = false
        letsencrypt['enable'] = false
        gitlab_rails['smtp_enable'] = true
        gitlab_rails['smtp_address'] = "mx.example.int"
        gitlab_rails['smtp_port'] = 465
        gitlab_rails['smtp_user_name'] = "git@example.int"
        gitlab_rails['smtp_password'] = "change me"
        gitlab_rails['smtp_domain'] = "example.int"
        gitlab_rails['smtp_authentication'] = "plain"
        gitlab_rails['smtp_tls'] = true
        gitlab_rails['smtp_openssl_verify_mode'] = 'peer'
        gitlab_rails['smtp_enable_starttls_auto'] = true
        gitlab_rails['gitlab_shell_ssh_port'] = 2224
    volumes:
      - gitlab_cfg:/etc/gitlab
      - gitlab_log:/var/log/gitlab
      - gitlab_data:/var/opt/gitlab
    networks:
      - gitlab
      - traefik-net

    deploy:
      placement:
        constraints:
          - node.role == manager
      labels:
        - traefik.enable=true
        - traefik.docker.network=traefik-net
        - traefik.constraint-label=traefik-net

        - traefik.http.routers.gitlab.rule=Host(`git.example.int`)
        - traefik.http.routers.gitlab.entrypoints=https
        - traefik.http.routers.gitlab.tls=true
        - traefik.http.routers.gitlab.tls.certresolver=le
        - traefik.http.middlewares.gitlab-headers.headers.customrequestheaders.X_FORWARDED_PROTO=https
        - traefik.http.middlewares.gitlab-headers.headers.customrequestheaders.X_Forwarded-Ssl=on
        - traefik.http.middlewares.gitlab-headers.headers.customresponseheaders.X_FORWARDED_PROTO=https
        - traefik.http.middlewares.gitlab-headers.headers.customresponseheaders.X_Forwarded-Ssl=on

        - traefik.http.routers.gitlab.service=gitlab

        - traefik.http.services.gitlab.loadbalancer.server.port=80

        - traefik.http.routers.gitlab-registry.rule=Host(`reg.example.int`)
        - traefik.http.routers.gitlab-registry.entrypoints=https
        - traefik.http.routers.gitlab-https.tls=true
        - traefik.http.routers.gitlab-registry.tls.certresolver=le
        - traefik.http.routers.gitlab-registry.service=gitlab-registry
        - traefik.http.services.gitlab-registry.loadbalancer.server.port=5005

        - traefik.tcp.routers.gitlab-ssh.rule=HostSNI(`*`)
        - traefik.tcp.routers.gitlab-ssh.entrypoints=ssh
        - traefik.tcp.routers.gitlab-ssh.service=gitlab-ssh-svc
        - traefik.tcp.services.gitlab-ssh-svc.loadbalancer.server.port=22

volumes:
  gitlab_cfg:
    name: gitlab_cfg
    driver_opts:
      type: nfs
      o: nfsvers=4,addr=10.100.10.58,rw
      device: ':/srv/gitlab/cfg'

  gitlab_log:
    name: gitlab_log
    driver_opts:
      type: nfs
      o: nfsvers=4,addr=10.100.10.58,rw
      device: ':/srv/gitlab/logs'

  gitlab_data:
    name: gitlab_data
    driver_opts:
      type: nfs
      o: nfsvers=4,addr=10.100.10.58,rw
      device: ':/srv/gitlab/data'

networks:
  gitlab:
    name: gitlab
    driver: overlay
    attachable: true

  traefik-net:
    external: true
