version: '2'

services:
  gitlab:
    image: gitlab/gitlab-ce:latest
    dns:
      - 1.1.1.1
      - 1.0.0.1
      - 2606:4700:4700::1111
      - 2606:4700:4700::1001
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://${TRAEFIK_HOST}'
        gitlab_rails['gitlab_shell_ssh_port'] = 22
        nginx['real_ip_trusted_addresses'] = [ '10.42.0.0/16' ] # 10.42.0.0/16 is the default Rancher-managed subnet
        nginx['listen_port'] = 80 # Using HTTP between the Traefik container and GitLab
        nginx['listen_https'] = false # Traefik is handling HTTPS termination
    hostname: ${TRAEFIK_HOST}
    labels:
      io.rancher.container.pull_image: always
      {{- if .Values.HOST_LABEL}}
      io.rancher.scheduler.affinity:host_label: ${HOST_LABEL}
      {{- end}}
      traefik.enable: true
      traefik.http.routers.gitlab-router.rule: Host(`${TRAEFIK_HOST}`)
      traefik.http.routers.gitlab-router.entrypoints: https
      traefik.http.routers.gitlab-router.service: gitlab-service
      traefik.http.routers.gitlab-router.tls: true
      traefik.http.routers.gitlab-router.tls.certresolver: letsencrypt
      traefik.http.services.gitlab-service.loadbalancer.server.port: "80"
      traefik.http.services.gitlab-service.loadbalancer.server.scheme: http
      traefik.http.services.gitlab-service.loadbalancer.passhostheader: true
    restart: on-failure
    volumes:
      - /etc/localtime:/etc/localtime:ro # Syncronize time of container with the host system
      - /etc/timezone:/etc/timezone:ro # Syncronize timezone of container with the host system
      - /Persistent/${DATA_DIR}/Config:/etc/gitlab
      - /Persistent/${DATA_DIR}/Logs:/var/log/gitlab
      - /Persistent/${DATA_DIR}/Data:/var/opt/gitlab