gitlab: init

gitlab/files/gitlab.gpg

+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.4.11 (GNU/Linux)
+
+mQINBFUxDA4BEAC0Pwepk/QZK7QOv6loLtUqmPCJtUuOS3Gu410FoOCgh5agWmXe
+J2pCTejLIMWPEG1Q35lrv5PRlcRA+XLIcYd6x7pF4+sDE1lOZVBndUMSHDReq+r+
+lzRB0Rd6S75RshBRDuwHfBfzjmFcyPqqYdiY3YUqk+hHl/w8m5QlxgLDnp2Vjh2B
+yzJqDtJh2+TmvY4XD91Q1fvihZkN3RFBgIjjs4xVQ+wptjg8FsPovgA+QED+hkFc
+bBveClexICHi6mTFG+1HV1MfcZnIRDlggTCUj/U8TGnU5crs6GVbbxtKfTCAZYlQ
+k5Q2JoPE4156wNFPQ7/Eyr3GnP62oySmuaCDzVVOlnmu4GMTVq/LVQZV3wOAdHM1
++9i0ob/SLYT5QKuL5jYj99rz2wy4HWxGR6TrSc/Ls0sc2MvZBeIXpOsPI2rxOeS+
+3Kbz8E+0ezNWxHC2LBQezW1ikNfLow/vwIBDCS9ApDAdW8VN28cROoiCMd6yxnVI
+1P2nMCkDMCBNqvcWtGrhUvpFD4jfaQ8661GEspqMbrXuNQ//JsrD9n98dJDWdCUV
+0LWBEyAJTOV9kIEH128MlPK8SLNkvCBZNJS4pzUxJFmf3LbDmYMuqcgz1d5NltMk
+tzVEpVJ4tgZ0gyn4f/yuZHobq6hP1YHgu3lNt7Aibi6dX5pfw2oWqufuPwARAQAB
+tEJHaXRMYWIgQi5WLiAocGFja2FnZSByZXBvc2l0b3J5IHNpZ25pbmcga2V5KSA8
+cGFja2FnZXNAZ2l0bGFiLmNvbT6JAj4EEwECACgFAlUxDA4CGwMFCQlmAYAGCwkI
+BwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEBQhmpbhXnj0iN0QAIGHf0CShvrEZXOq
+8Tlq+zJ42CQTOLa9Hijd85mqwijgoBwCdLaePaOqOBIkqev3UDfcoMJP9/JuXMpI
+9H+JvfY/USwP7FVTpdyC+iecWOSJ/qdbxJEau2wyGwsVhcas9iOExzd6tjsS61Td
+1bpdTBYG7eAenCu5WYU/cb0OhPbzRuUiLrtpt43tx2cXIU+XcEC/R9aym7EPw3WG
+SePegNhKbtr3LaTuRswgO464LHgJ0YsUx9789QSyuhHtQGznBpBDj0F/xVjnxRs4
+6vpd46AWad0G7RhDCWduuG0qx1/1ZBbQKKjRq/1Uw54qiVJB0T/7qtQ9OliUonDj
+Vgkj3w1HGXTwKVSkDwEqyn+SDWERA9k04DQrOLEG0qi9NGLYy59v4SaU3ftZw0L6
+jnCJksnACtrsksJWPI0Gbs+wbII6fhu8Zc1iV3hdzi92lDMv0W1KzM7FCrz3ex6i
+3oL+ntZW/PuHNSUVBlr2FkkSr/EmRkBoD9efZsG7+5vYImtkSZSaiMi5IsexjTEH
+HkP0xG0OUaCagSNrNolDyLEmTjhOmky67oE1VIOIbMajXzeNdqYahz8+kBQ5vgpr
+0PqlNbnVgCiTlFjTVGHUj84SKh/Gii+GRHlCV1d5UL/GzJppZ5MfpjRXOTamqU/C
+O0JLVZiTnW+KSqbLEdflanh8IPTF
+=jmzU
+-----END PGP PUBLIC KEY BLOCK-----

gitlab/files/robots.txt

+User-Agent: *
+Disallow: /

gitlab/init.sls

+gitlab-ce:
+  pkgrepo.managed:
+    - name: deb https://packages.gitlab.com/gitlab/gitlab-ce/debian/ stretch main
+    - key_url: salt://gitlab/files/gitlab.gpg
+    - file: /etc/apt/sources.list.d/gitlab.list
+  pkg.installed:
+    - require:
+      - pkgrepo: gitlab-ce
+
+/etc/gitlab/gitlab.rb:
+  file.managed:
+    - source: salt://gitlab/files/gitlab.rb.j2
+    - template: jinja
+    - user: root
+    - group: root
+    - mode: 0600
+    - require:
+      - pkg: gitlab-ce
+
+gitlab-ctl-reconfigure:
+  cmd.run:
+    - onchanges:
+      - file: /etc/gitlab/gitlab.rb
+
+gitlab-ctl-restart:
+  cmd.run:
+    - onchanges:
+      - cmd: gitlab-ctl reconfigure
+
+/etc/systemd/system/certbot.service.d/gitlab.conf:
+  file.managed:
+    - user: root
+    - group: root
+    - mode: 0644
+    - makedirs: True
+    - contents: |
+        [Service]
+        ExecStartPost=/usr/bin/gitlab-ctl restart nginx
+
+/var/www/gitlab-robots.txt:
+  file.managed:
+    - source: salt://gitlab/files/robots.txt
+    - makedirs: True
+    - user: www-data
+    - group: www-data
+    - mode: 0644

kernel/bbr.sls

+{% set sysctld = "/etc/sysctl.d" %}
+
+net.core.default_qdisc:
+  sysctl.present:
+    - value: fq_codel
+    - config: {{ sysctld }}/codel.conf
+
+net.ipv4.tcp_congestion_control:
+  sysctl.present:
+    - value: bbr
+    - config: {{ sysctld }}/bbr.conf

top.sls

@@ -204,3 +204,9 @@ base:
     - network
   'netbox.aixit.off.de.as64475.net':
     - netbox
+  'gitlab.aixit.off.de.frickel.cloud':
+    - kernel
+    - kernel.sysctl
+    - kernel.bbr
+    - letsencrypt
+    - gitlab