docker-compose.yml

services:
  gitlab:
    image: gitlab/gitlab-ce:${GITLAB_VERSION:-17.10.0}-ce.0
    container_name: gitlab
    restart: always
    hostname: ${GITLAB_HOSTNAME}
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://${GITLAB_HOSTNAME}'

        # Let nginx-proxy handle TLS termination — GitLab's nginx listens on plain HTTP
        nginx['listen_https'] = false
        nginx['listen_port'] = 80
        nginx['proxy_set_headers'] = {
          'X-Forwarded-Proto' => 'https',
          'X-Forwarded-Ssl'   => 'on'
        }

        # Tell GitLab which SSH port users will connect to (host-mapped)
        gitlab_rails['gitlab_shell_ssh_port'] = ${GITLAB_SSH_PORT:-2222}

      # nginx-proxy picks these up automatically
      VIRTUAL_HOST: ${GITLAB_HOSTNAME}
      VIRTUAL_PORT: 80
      # acme-companion (Let's Encrypt) picks these up if running
      LETSENCRYPT_HOST: ${GITLAB_HOSTNAME}
      LETSENCRYPT_EMAIL: ${LETSENCRYPT_EMAIL}

    ports:
      - '${GITLAB_SSH_PORT:-2222}:22'

    volumes:
      - '${GITLAB_HOME}/config:/etc/gitlab'
      - '${GITLAB_HOME}/logs:/var/log/gitlab'
      - '${GITLAB_HOME}/data:/var/opt/gitlab'

    shm_size: '256m'

    networks:
      - proxy

networks:
  # Must already exist on the server — created by the nginx-proxy stack
  proxy:
    external: true
    name: ${NGINX_PROXY_NETWORK:-nginx-proxy}