diff --git a/hosts/vm-gitlab/default.nix b/hosts/vm-gitlab/default.nix
index 0c4a31d..266e281 100644
--- a/hosts/vm-gitlab/default.nix
+++ b/hosts/vm-gitlab/default.nix
@@ -33,6 +33,7 @@ in
       gitlab-secret = cfg "secret";
       gitlab-otp = cfg "otp";
       gitlab-db = cfg "db";
+      gitlab-db-password = cfg "db-password";
       gitlab-jws = cfg "jws";
       gitlab-key = cfg "key";
       gitlab-cert = cfg "cert";
@@ -105,9 +106,11 @@ in
         keepTime = 288;
         startAt = [ "03:00" ];
       };
-      host = "src.thehellings.com";
-      https = true;
-      port = 443;
+      databaseHost = "postgres.kubernetes";
+      databaseName = "gitlab";
+      databaseUsername = "gitlab";
+      databasePasswordFile = config.age.secrets.gitlab-db-password.path;
+      databaseCreateLocally = false;
       extraConfig = {
         gitlab = {
           trustedProxies = [
@@ -115,37 +118,6 @@ in
             "100.115.57.8/32" # Public server's IP
           ];
         };
-      };
-      initialRootEmail = "greg@thehellings.com";
-      initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
-      pages = {
-        enable = true;
-        settings.pages-domain = "pages.thehellings.com";
-      };
-      puma = {
-        threadsMax = 6;
-        threadsMin = 2;
-        workers = 6;
-      };
-      redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
-      registry = {
-        enable = true;
-        certFile = config.age.secrets.gitlab-cert.path;
-        keyFile = config.age.secrets.gitlab-key.path;
-        externalAddress = "registry.thehellings.com";
-        externalPort = 443;
-      };
-      secrets = {
-        activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path;
-        activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path;
-        activeRecordSaltFile = config.age.secrets.gitlab-salt.path;
-        dbFile = config.age.secrets.gitlab-db.path;
-        jwsFile = config.age.secrets.gitlab-jws.path;
-        otpFile = config.age.secrets.gitlab-otp.path;
-        secretFile = config.age.secrets.gitlab-secret.path;
-      };
-
-      extraConfig = {
         object_store = {
           enabled = true;
           proxy_download = true; # Tell them to reach out to object storage themselves!
@@ -182,6 +154,37 @@ in
           );
         };
       };
+      host = "src.thehellings.com";
+      https = true;
+      initialRootEmail = "greg@thehellings.com";
+      initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
+      pages = {
+        enable = true;
+        settings.pages-domain = "pages.thehellings.com";
+      };
+      port = 443;
+      puma = {
+        threadsMax = 6;
+        threadsMin = 2;
+        workers = 6;
+      };
+      redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
+      registry = {
+        enable = true;
+        certFile = config.age.secrets.gitlab-cert.path;
+        keyFile = config.age.secrets.gitlab-key.path;
+        externalAddress = "registry.thehellings.com";
+        externalPort = 443;
+      };
+      secrets = {
+        activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path;
+        activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path;
+        activeRecordSaltFile = config.age.secrets.gitlab-salt.path;
+        dbFile = config.age.secrets.gitlab-db.path;
+        jwsFile = config.age.secrets.gitlab-jws.path;
+        otpFile = config.age.secrets.gitlab-otp.path;
+        secretFile = config.age.secrets.gitlab-secret.path;
+      };
     };
 
     nginx = {
@@ -206,42 +209,16 @@ in
       };
     };
 
-    logrotate = {
-      enable = true;
-      settings = {
-        "/var/lib/postgresql/*/log/*.log" = {
-          enable = true;
-          compress = true;
-          compresscmd = "${pkgs.xz}/bin/xz";
-        };
-      };
-    };
-
     openssh.enable = true;
 
-    postgresql = {
-      enable = true;
-      checkConfig = true;
-      ensureDatabases = [ "gitlab" ];
-      ensureUsers = [
-        {
-          name = "gitlab";
-          ensureDBOwnership = true;
-        }
-      ];
-      settings = {
-        log_connections = true;
-        log_statement = "all";
-        logging_collector = true;
-        log_filename = "postgresql.log";
-      };
-    };
+    postgresql.enable = true;
 
     qemuGuest.enable = true;
 
     redis.servers.gitlab = {
       enable = true;
     };
+
     resolved.enable = true;
   };
 
diff --git a/secrets/gitlab/db-password.age b/secrets/gitlab/db-password.age
new file mode 100644
index 0000000..2deed6a
Binary files /dev/null and b/secrets/gitlab/db-password.age differ
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 4e09c95..0282f14 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -87,6 +87,7 @@ in
   "gitlab/secret.age".publicKeys = everyone;
   "gitlab/otp.age".publicKeys = everyone;
   "gitlab/db.age".publicKeys = everyone;
+  "gitlab/db-password.age".publicKeys = everyone;
   "gitlab/jws.age".publicKeys = everyone;
   # openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.crt -days 365 -nodes -subj '/CN=issuer'
   # Then pipe the resulting files to agenix -e <foo>