netsamurai / docker Goto Github PK

swag:
  image: linuxserver/swag
  container_name: swag
  networks:
    default:
      ipv4_address: 172.28.0.105
  depends_on:
    - authelia
  cap_add:
    - NET_ADMIN
  environment:
    - PUID=${PUID}
    - PGID=${PGID}
    - TZ=America/New_York
    - URL=${DOMAIN_NAME}
    - SUBDOMAINS=wildcard
    - VALIDATION=dns
    - DNSPLUGIN=cloudflare
    - DOCKER_MODS=linuxserver/mods:universal-cloudflared
    - CF_ZONE_ID=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    - CF_ACCOUNT_ID=${CF_ACCOUNT_ID}
    - CF_API_TOKEN=${CF_API_TOKEN}
    - CF_TUNNEL_NAME=${DOMAIN_NAME}
    - CF_TUNNEL_PASSWORD=${CF_TUNNEL_PASSWORD}
    - FILE__CF_TUNNEL_CONFIG=/config/tunnelconfig.yml
  extra_hosts:
    - ${DOMAIN_NAME}:127.0.0.1
  volumes:
    - /dockercfg/swag:/config
  ports:
    - 443:443
    - 80:80
  restart: "no"
  labels:
    - com.centurylinklabs.watchtower.enable=true
authelia:
  image: authelia/authelia #:4.34.6
  container_name: authelia
  networks:
    default:
      ipv4_address: 172.28.0.107
  user: ${PUID}:${PGID}
  environment:
    - TZ=America/New_York
  depends_on:
    - openldap
  volumes:
    - /dockercfg/authelia:/config
  restart: "no"
  labels:
    - com.centurylinklabs.watchtower.enable=true
gitlab:
  image: gitlab/gitlab-ee:latest
  container_name: gitlab
  environment:
    GITLAB_OMNIBUS_CONFIG: |
      external_url 'http://gitlab.${DOMAIN_NAME}:80'
      letsencrypt['enable'] = false
      gitlab_rails['omniauth_providers'] = [
        {
          name: "openid_connect",
          label: "Authelia",
          icon: "https://www.authelia.com/images/branding/logo-cropped.png",
          args: {
            name: "openid_connect",
            scope: ["openid","profile","email","groups"],
            response_type: "code",
            issuer: "https://auth.${DOMAIN_NAME}",
            discovery: true,
            client_auth_method: "query",
            uid_field: "preferred_username",
            send_scope_to_token_endpoint: "false",
            client_options: {
              identifier: "gitlab",
              secret: "XXXXXXXXxxxxxxxxxxxxxxxxxxxxxx",
              redirect_uri: "https://gitlab.${DOMAIN_NAME}/users/auth/openid_connect/callback"
            }
          }
        }
      ]
  volumes:
    - /dockercfg/gitlab/config:/etc/gitlab
    - /dockercfg/gitlab/logs:/var/log/gitlab
    - /dockercfg/gitlab/data:/var/opt/gitlab
  shm_size: '256m'
  restart: "no"
  labels:
    - com.centurylinklabs.watchtower.enable=true

identity_providers:
  oidc: ## See: https://www.authelia.com/c/oidc
    issuer_private_key: |
      --- the RSA key -----
    clients:
    - id: gitlab
      description: GitLab
      secret: '$pbkdf2-sha512xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
      sector_identifier: ''
      public: false
      authorization_policy: two_factor
      pre_configured_consent_duration: ''
      audience: []
      redirect_uris:
        - https://gitlab.${DOMAIN_NAME}/users/auth/openid_connect/callback
      scopes:
        - openid
        - profile
        - groups
        - email
      grant_types:
        - refresh_token
        - authorization_code
      response_types:
        - code          
      response_modes:
        - query
        - form_post
      userinfo_signing_algorithm: none

## Version 2023/05/31
# make sure that your gitlab container is named gitlab
# make sure that your dns has a cname set for gitlab

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name gitlab.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    include /config/nginx/authelia-server.conf;

    # enable for Authentik (requires authentik-location.conf in the location block)
    #include /config/nginx/authentik-server.conf;

    location / {
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        include /config/nginx/authelia-location.conf;

        # enable for Authentik (requires authentik-server.conf in the server block)
        #include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app gitlab;
        set $upstream_port 80;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }
}