#  Deploying Self-Hosted GitLab CE on Bare Metal Infrastructure



GitLab Community Edition (CE) integrates source code management, CI/CD orchestration, container registries, and issue tracking into a unified stack. Due to the coupled architecture of its internal components—PostgreSQL, Redis, Gitaly, Sidekiq, and Puma—resource contention is a common issue under multi-tenant virtualization.

Deploying on bare metal hardware provides dedicated compute cores and unthrottled storage I/O, guaranteeing deterministic build times for automated pipeline runners.

Here is the step-by-step deployment blueprint for Ubuntu 22.04 LTS.

---

Infrastructure Requirements
- OS: Ubuntu 22.04 LTS
- Minimum Compute: 4 vCPU / 8 GB RAM (16 GB+ recommended for active development teams)
- Storage: 80 GB+ NVMe / SSD
- Network: FQDN mapped via A-Record (e.g., git.example.com)

---

Step 1: System Preparation & Dependencies
Set the system FQDN hostname and update standard repositories:

sudo apt update && sudo apt upgrade -y
sudo hostnamectl set-hostname git.example.com

Install the mandatory dependencies, including OpenSSH for Git over SSH access and Postfix for system mail generation:

sudo apt install -y curl openssh-server ca-certificates tzdata perl postfix
(Select 'Internet Site' during the Postfix interactive prompt).

---

Step 2: Repository Configuration & Installation
Import the official Omnibus repository setup script:

curl https://packages.gitlab.com/install/repositories/gitlab/gitlab-ce/script.deb.sh | sudo bash

Execute the package installation while passing the EXTERNAL_URL environment variable:

sudo EXTERNAL_URL="https://git.example.com" apt install gitlab-ce

---

Step 3: Automated SSL Certificate Management
GitLab's Omnibus package includes built-in ACME integration for Let's Encrypt certificate automation. Open /etc/gitlab/gitlab.rb:

sudo nano /etc/gitlab/gitlab.rb

Append or modify the following configuration directives:

external_url 'https://git.example.com'
letsencrypt['enable'] = true
letsencrypt['contact_emails'] = ['admin@example.com']

Trigger Chef Omnibus to apply configuration states and request certificates:

sudo gitlab-ctl reconfigure

---

Step 4: Firewall Configuration
Limit exposed ingress ports strictly to SSH, HTTP, and HTTPS:

sudo ufw allow OpenSSH
sudo ufw allow http
sudo ufw allow https
sudo ufw enable

---

Step 5: Initial Credential Retrieval & Maintenance
Retrieve the initial administrative password generated during reconfiguration:

sudo cat /etc/gitlab/initial_root_password
(Log in at https://git.example.com as user root and reset credentials immediately. Note that this file is purged automatically after 24 hours).

To create a manual database and repository backup artifact:

sudo gitlab-backup create