greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Make gitlab use remote postgres

Browse Source
This commit is contained in:
Greg Hellings
2025-06-11 21:29:20 -05:00
parent 963757171a
commit e13bee750c
3 changed files with 40 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/vm-gitlab/default.nix
+39 -62
View File
@@ -33,6 +33,7 @@ in
gitlab-secret = cfg "secret";
gitlab-otp = cfg "otp";
gitlab-db = cfg "db";
gitlab-db-password = cfg "db-password";
gitlab-jws = cfg "jws";
gitlab-key = cfg "key";
gitlab-cert = cfg "cert";
@@ -105,9 +106,11 @@ in
keepTime = 288;
startAt = [ "03:00" ];
};
host = "src.thehellings.com";
https = true;
port = 443;
databaseHost = "postgres.kubernetes";
databaseName = "gitlab";
databaseUsername = "gitlab";
databasePasswordFile = config.age.secrets.gitlab-db-password.path;
databaseCreateLocally = false;
extraConfig = {
gitlab = {
trustedProxies = [
@@ -115,37 +118,6 @@ in
"100.115.57.8/32" # Public server's IP
];
};
};
initialRootEmail = "greg@thehellings.com";
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
pages = {
enable = true;
settings.pages-domain = "pages.thehellings.com";
};
puma = {
threadsMax = 6;
threadsMin = 2;
workers = 6;
};
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
registry = {
enable = true;
certFile = config.age.secrets.gitlab-cert.path;
keyFile = config.age.secrets.gitlab-key.path;
externalAddress = "registry.thehellings.com";
externalPort = 443;
};
secrets = {
activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path;
activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path;
activeRecordSaltFile = config.age.secrets.gitlab-salt.path;
dbFile = config.age.secrets.gitlab-db.path;
jwsFile = config.age.secrets.gitlab-jws.path;
otpFile = config.age.secrets.gitlab-otp.path;
secretFile = config.age.secrets.gitlab-secret.path;
};
extraConfig = {
object_store = {
enabled = true;
proxy_download = true; # Tell them to reach out to object storage themselves!
@@ -182,6 +154,37 @@ in
);
};
};
host = "src.thehellings.com";
https = true;
initialRootEmail = "greg@thehellings.com";
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
pages = {
enable = true;
settings.pages-domain = "pages.thehellings.com";
};
port = 443;
puma = {
threadsMax = 6;
threadsMin = 2;
workers = 6;
};
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
registry = {
enable = true;
certFile = config.age.secrets.gitlab-cert.path;
keyFile = config.age.secrets.gitlab-key.path;
externalAddress = "registry.thehellings.com";
externalPort = 443;
};
secrets = {
activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path;
activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path;
activeRecordSaltFile = config.age.secrets.gitlab-salt.path;
dbFile = config.age.secrets.gitlab-db.path;
jwsFile = config.age.secrets.gitlab-jws.path;
otpFile = config.age.secrets.gitlab-otp.path;
secretFile = config.age.secrets.gitlab-secret.path;
};
};
nginx = {
@@ -206,42 +209,16 @@ in
};
};
logrotate = {
enable = true;
settings = {
"/var/lib/postgresql/*/log/*.log" = {
enable = true;
compress = true;
compresscmd = "${pkgs.xz}/bin/xz";
};
};
};
openssh.enable = true;
postgresql = {
enable = true;
checkConfig = true;
ensureDatabases = [ "gitlab" ];
ensureUsers = [
{
name = "gitlab";
ensureDBOwnership = true;
}
];
settings = {
log_connections = true;
log_statement = "all";
logging_collector = true;
log_filename = "postgresql.log";
};
};
postgresql.enable = true;
qemuGuest.enable = true;
redis.servers.gitlab = {
enable = true;
};
resolved.enable = true;
};