Configure GitLab for unprivileged LXC

Preconfigure /etc/gitlab/gitlab.rb before installation, setting external_url to the container IP and disabling package['modify_kernel_parameters'] to avoid sysctl failures in unprivileged LXCs. Install GitLab CE without EXTERNAL_URL env injection, then explicitly run gitlab-ctl reconfigure. Also update GitLab metadata notes to document this requirement and adjust the CT post-install password command styling.

Author: MickLesk

ct/gitlab.sh

@@ -50,4 +50,4 @@ echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
 echo -e "${INFO}${YW}The initial root password is valid for 24 hours:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}cat /etc/gitlab/initial_root_password${CL}"
+echo -e "${TAB}${DEFAULT}${BGN}cat /etc/gitlab/initial_root_password${CL}"

install/gitlab-install.sh

@@ -27,10 +27,25 @@ setup_deb822_repo \
   "$(get_os_info codename)" \
   "main"
 
+msg_info "Configuring GitLab"
+mkdir -p /etc/gitlab
+cat <<EOF >/etc/gitlab/gitlab.rb
+external_url 'http://${LOCAL_IP}'
+
+# Omnibus runs 'sysctl -e --system' during reconfigure, which fails in an
+# unprivileged LXC because most kernel keys are not writable.
+package['modify_kernel_parameters'] = false
+EOF
+msg_ok "Configured GitLab"
+
 msg_info "Installing GitLab CE (Patience)"
-EXTERNAL_URL="http://${LOCAL_IP}" $STD apt install -y gitlab-ce
+$STD apt install -y gitlab-ce
 msg_ok "Installed GitLab CE"
 
+msg_info "Reconfiguring GitLab (Patience)"
+$STD gitlab-ctl reconfigure
+msg_ok "Reconfigured GitLab"
+
 motd_ssh
 customize
 cleanup_lxc

json/gitlab.json

@@ -43,9 +43,13 @@
       "type": "warning"
     },
     {
-      "text": "EXTERNAL_URL is set to the container IP at install time. If you use a domain or a reverse proxy, change external_url in /etc/gitlab/gitlab.rb and run 'gitlab-ctl reconfigure'.",
+      "text": "external_url is set to the container IP at install time. If you use a domain or a reverse proxy, change external_url in /etc/gitlab/gitlab.rb and run 'gitlab-ctl reconfigure'.",
       "type": "info"
     },
+    {
+      "text": "/etc/gitlab/gitlab.rb sets package['modify_kernel_parameters'] = false. Omnibus otherwise runs 'sysctl -e --system' during reconfigure, which fails in an unprivileged LXC because most kernel keys are not writable. Do not remove that line.",
+      "type": "warning"
+    },
     {
       "text": "Omnibus bundles its own PostgreSQL, Redis and NGINX - do not install those separately in this container. Repositories live in /var/opt/gitlab; back up with 'gitlab-backup create' rather than copying directories.",
       "type": "info"