version: "3.7"
services:

  server:
    image: gitlab/gitlab-ce:latest
    deploy:
      placement:
        constraints:
        - node.labels.powerful == true
    domainname: [DOMAIN]
    ports:
      - "4901:22"
      - "8884:80"
    volumes:
      - data:/var/opt/gitlab
      - logs:/var/log/gitlab
      - config:/etc/gitlab
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://[DOMAIN]'
        gitlab_rails['lfs_enabled'] = true
        gitlab_rails['time_zone'] = 'UTC'
        gitlab_rails['initial_root_password'] = File.read('/run/secrets/gitlab_root_password')
        nginx['listen_port'] = 80
        nginx['listen_https'] = false
        gitlab_rails['gitlab_ssh_host'] = '[DOMAIN]:4901'
        gitlab_rails['ldap_enabled'] = true
        gitlab_rails['ldap_servers'] = YAML.load <<-'EOS'
        main: # 'main' is the GitLab 'provider ID' of this LDAP server
          label: 'blah'
          host: '[DOMAIN]'
          port: 389
          uid: 'sAMAccountName'
          bind_dn: 'works-gud'
          password: File.read('/run/secrets/git_ad_user_password')
          encryption: 'plain' # "start_tls" or "simple_tls" or "plain"
          verify_certificates: false
          smartcard_auth: false
          active_directory: true
          allow_username_or_email_login: false
          lowercase_usernames: true
          block_auto_created_users: false
          base: 'works-gud'
          user_filter: 'works-gud'
          attributes:
            username: 'sAMAccountname'
            email: 'mail'
            name: 'name'
            first_name: 'givenname'
            last_name: 'sn'
        EOS
    secrets:
      - gitlab_root_password
      - git_ad_user_password

  runner:
    image: gitlab/gitlab-runner:alpine
    deploy:
      mode: replicated
      replicas: 1
      command: /sbin/ash -c '
        gitlab-runner register -n
        --url https://[DOMAIN]
        --registration-token farts
        --executor docker
        --description "Docker Runner"
        --docker-image "docker:latest"
        --docker-volumes /var/run/docker.sock:/var/run/docker.sock'
    environment:
      REGISTRATION_TOKEN: "farts"
      URL: server