LXC Install and Container
Create a Sources-File
When getting an error like:
The following signatures were invalid: EXPKEYSIG 3F01618A51312F3F GitLab B.V. (package repository signing key) <packages@gitlab.com>
This means the GPG key has been expired and must be renewed.
The easiest is to use a gitlab.sources file with an embedded GPG-key by running the next command.
Renew the GPG-file.
wget -qO- https://packages.gitlab.com/gpg.key | gpg --dearmor -o /etc/apt/trusted.gpg.d/omnibus_gitlab.gpg
Create the sources file for GitLab service.
cat <<EOD > /etc/apt/sources.list.d/gitlab.sources
Types: deb deb-src
Architectures: $(dpkg --print-architecture)
URIs: https://packages.gitlab.com/gitlab/gitlab-ce/$(lsb_release -is | tr '[:upper:]' '[:lower:]')/
Suites: $(lsb_release -cs)
Components: main
Signed-By: /etc/apt/trusted.gpg.d/omnibus_gitlab.gpg
EOD
Create the sources file for GitLab-Runner service.
cat <<EOD > /etc/apt/sources.list.d/gitlab-runner.sources
Types: deb deb-src
Architectures: $(dpkg --print-architecture)
URIs: https://packages.gitlab.com/gitlab/gitlab-ce/$(lsb_release -is | tr '[:upper:]' '[:lower:]')/
Suites: $(lsb_release -cs)
Components: main
Signed-By: /etc/apt/trusted.gpg.d/omnibus_gitlab.gpg
EOD
Install LXC on host
Show possible lxc container OS'es
Create an LXC container.
Container type from selection out of the list.
Create a container immediate of type debian.
Enable restart after a host reboot
Add these lines to the configuration file at /var/lib/lxc/<container-name>/config
Enable auto start of this container.
Delay starting this container 30 seconds from when the host starts.
The following lines need kernel options "cgroup_enable=memory swapaccount=1".
Limit memory to 512M
Total usage or memory + swap to 1G. Note the second setting is for overall memory + swap, not just swap usage.
Add a kernel option for cgroup and swapaccount.
Set the GRUB_CMDLINE_LINUX value as follows in file /etc/default/grub file.'
Execute the following commands.
GitLab Install on LXC container
Grab hold of the root console.
Install GitLab needed packages
Get the script to install the gitlab package
Get the script
Execute the script
Actually install the package since it is available now.
Reconfigure after failure.
Work-around to fix reconfigure to comment out a command that fails
Probably already fixed...
I modified /opt/gitlab/embedded/cookbooks/gitlab/definitions/sysctl.rb like that:
# Load the settings right away
execute "load sysctl conf" do
#command "cat /etc/sysctl.conf /etc/sysctl.d/*.conf | sysctl -e -p -"
action :nothing
end
Fix nginx problem 422 The change you requested was rejected.
This fix will be undone when gitlab-ctl reconfigure is called.
Update: It Seems to be fixed now (2016-03) and not needed anymore.
Add line
at location / { section in file /var/opt/gitlab/nginx/conf/gitlab-http.conf
Restart gitlab to make it have an effect.
Configure the GitLab web application
Login on the webapp for the first time.
- Username:
root - Password:
5iveL!fe
Fixes
When gitlab becomes very slow because of swapping to memory.
Change swappiness to 10 from default 60.
See http://en.wikipedia.org/wiki/Swappiness for more details.
When apparmor 'DENIED'
When having the following errors when examining dmesg -w of journalctl --dmesg --follow.
audit: type=1400 audit(????): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-cgns" name="/" pid=???? comm="(d-logind)" flags="rw, rslave"
In my case this was caused by the GitLab container running Debian bullseye.
To solve this add a rules to allow the mount operation with the following line to file
/etc/apparmor.d/lxc/lxc-default-cgns. There are multiple rules added since fixing the rw, rslave the next one (rw,
rbind) will pop up and so on.
# Added for Debian bookworm nexus3 container which has aparmor audit warnings.
# Allow rslave and rbind mounts for non-specific directories.
mount options=(rw, rslave),
mount options=(rw, rbind),
mount options=(rw, rshared),
mount options=(rw, nosuid),
mount options=(rw, nodev),
mount options=(rw, noexec),
Run the next command to make it have an effect.
SMTP instead of Postfix
The e-mail provider has tightened the security so SMTP is selected to be configured.
Configuration
Configure /etc/gitlab/gitlab.rb and add the following:
gitlab_rails['smtp_enable'] = true
gitlab_rails['smtp_address'] = "smtp.example.com"
gitlab_rails['smtp_port'] = 465
gitlab_rails['smtp_user_name'] = "gitlab@example.com"
gitlab_rails['smtp_password'] = "<your_email_password>"
gitlab_rails['smtp_domain'] = "example.com"
gitlab_rails['smtp_authentication'] = "login"
gitlab_rails['smtp_enable_starttls_auto'] = false
gitlab_rails['smtp_tls'] = true
# Ensure the from address matches your verified Strato account.
gitlab_rails['gitlab_email_from'] = 'gitlab@example.com'
# Can be any external address you want users to reply to.
gitlab_rails['gitlab_email_reply_to'] = 'any@example.nl'
Reconfigure so the changes are in effect.
Test the configuration
Send a test email using the following command.
Note: This can take about a minute to be able to type a command.
Execute the following command to send an e-mail.
Notify.test_email('test@example.nl', 'GitLab SMTP Test', 'If you receive this, SMTP is working correctly.').deliver_now
Command to retrieve the e-mail settings.
Command to see what is happening with all mail.
Reduction of Memory Usage
Configure /etc/gitlab/gitlab.rb and add the following.
# Limit Puma web workers (default scales with CPU count)
puma['worker_processes'] = 2
# Limit max memory in MB threshold before a worker process auto-restarts
puma['per_worker_max_memory_mb'] = 1200
# Limit Sidekiq concurrency to reduce peak memory usage
sidekiq['max_concurrency'] = 10
Reconfigure to make it have an effect.