fix(logto): fix postgres role error and update to 1.41.0

The postgres healthcheck ran pg_isready without -U while POSTGRES_USER
was set to logto, so every probe attempted to connect as role
"postgres" and spammed FATAL: role "postgres" does not exist.
Pass -U logto -d logto explicitly and set POSTGRES_DB.

Also fix LOGTO_ENDPOINT pointing at the admin domain instead of the
main domain, update Logto 1.27.0 -> 1.41.0, use ${password:32} for the
generated password, drop the ephemeral host port publishing and add
restart policies.

Closes #130

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

blueprints/gitlab-ce/docker-compose.yml

@@ -1,24 +1,65 @@
 services:
   gitlab:
-    image: gitlab/gitlab-ce:19.1.2-ce.0
+    image: gitlab/gitlab-ce:latest
     restart: unless-stopped
-    shm_size: "256m"
+    hostname: gitlab.example.com
     environment:
       GITLAB_OMNIBUS_CONFIG: |
         external_url 'http://${GITLAB_HOST}'
+        gitlab_rails['gitlab_ssh_host'] = '${GITLAB_HOST}'
+        gitlab_rails['gitlab_shell_ssh_port'] = 2224
+        gitlab_rails['db_adapter'] = 'postgresql'
+        gitlab_rails['db_host'] = 'postgresql'
+        gitlab_rails['db_port'] = '5432'
+        gitlab_rails['db_database'] = '${POSTGRES_DB}'
+        gitlab_rails['db_username'] = '${POSTGRES_USER}'
+        gitlab_rails['db_password'] = '${POSTGRES_PASSWORD}'
+        # Redis config for external TCP connection
+        gitlab_rails['redis_url'] = 'redis://redis:6379/0'
+        gitlab_rails['redis_host'] = 'redis'
+        gitlab_rails['redis_port'] = 6379
+        gitlab_rails['redis_socket'] = nil
+        gitlab_rails['gitlab_email_enabled'] = false
+        gitlab_rails['gitlab_default_can_create_group'] = true
+        gitlab_rails['gitlab_username_changing_enabled'] = false
+        unicorn['worker_processes'] = 2
+        unicorn['worker_timeout'] = 60
+        postgresql['enable'] = false
+        redis['enable'] = false
+        nginx['enable'] = true
         nginx['listen_port'] = 80
         nginx['listen_https'] = false
-        gitlab_rails['initial_root_password'] = '${GITLAB_ROOT_PASSWORD}'
-        gitlab_rails['gitlab_email_enabled'] = false
-        puma['worker_processes'] = 0
-        sidekiq['concurrency'] = 10
         prometheus_monitoring['enable'] = false
+    ports:
+      - "80"
+      - "2224"
     volumes:
       - gitlab_config:/etc/gitlab
       - gitlab_logs:/var/log/gitlab
       - gitlab_data:/var/opt/gitlab
+    depends_on:
+      - postgresql
+      - redis
+
+  postgresql:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB}
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    volumes:
+      - postgresql_data:/var/lib/postgresql/data
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    volumes:
+      - redis_data:/data
 
 volumes:
   gitlab_config:
   gitlab_logs:
   gitlab_data:
+  postgresql_data:
+  redis_data:

blueprints/gitlab-ce/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "gitlab-ce",
   "name": "GitLab CE",
-  "version": "19.1.2",
+  "version": "latest",
   "description": "GitLab Community Edition is a free and open source platform for managing Git repositories, CI/CD pipelines, and project management.",
   "logo": "gitlab-ce.svg",
   "links": {

blueprints/gitlab-ce/template.toml

@@ -1,11 +1,15 @@
 [variables]
 main_domain = "${domain}"
-gitlab_root_password = "${password:32}"
+postgres_db = "gitlab"
+postgres_user = "gitlab"
+postgres_password = "${password:32}"
 
 [config]
 env = [
   "GITLAB_HOST=${main_domain}",
-  "GITLAB_ROOT_PASSWORD=${gitlab_root_password}",
+  "POSTGRES_DB=${postgres_db}",
+  "POSTGRES_USER=${postgres_user}",
+  "POSTGRES_PASSWORD=${postgres_password}",
 ]
 
 [[config.domains]]

blueprints/logto/docker-compose.yml

@@ -1,14 +1,11 @@
 services:
   app:
+    image: ghcr.io/logto-io/logto:1.41.0
+    restart: unless-stopped
     depends_on:
       postgres:
         condition: service_healthy
-    image: ghcr.io/logto-io/logto:1.27.0
     entrypoint: ["sh", "-c", "npm run cli db seed -- --swe && npm start"]
-    ports:
-      - 3001
-      - 3002
-
     environment:
       TRUST_PROXY_HEADER: 1
       DB_URL: postgres://logto:${LOGTO_POSTGRES_PASSWORD}@postgres:5432/logto
@@ -18,20 +15,19 @@ services:
       - logto-connectors:/etc/logto/packages/core/connectors
   postgres:
     image: postgres:17-alpine
-    user: postgres
-
+    restart: unless-stopped
     environment:
       POSTGRES_USER: logto
       POSTGRES_PASSWORD: ${LOGTO_POSTGRES_PASSWORD}
+      POSTGRES_DB: logto
     volumes:
       - postgres-data:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready"]
+      test: ["CMD-SHELL", "pg_isready -U logto -d logto"]
       interval: 10s
       timeout: 5s
       retries: 5
 
-
 volumes:
   logto-connectors:
   postgres-data:

blueprints/logto/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "logto",
   "name": "Logto",
-  "version": "1.27.0",
+  "version": "1.41.0",
   "description": "Logto is an open-source Identity and Access Management (IAM) platform designed to streamline Customer Identity and Access Management (CIAM) and Workforce Identity Management.",
   "logo": "logto.png",
   "links": {

blueprints/logto/template.toml

@@ -1,7 +1,7 @@
 [variables]
 main_domain = "${domain}"
 admin_domain = "${domain}"
-postgres_password = "${password}"
+postgres_password = "${password:32}"
 
 [config]
 mounts = []
@@ -17,6 +17,6 @@ port = 3_002
 host = "${admin_domain}"
 
 [config.env]
-LOGTO_ENDPOINT = "http://${admin_domain}"
+LOGTO_ENDPOINT = "http://${main_domain}"
 LOGTO_ADMIN_ENDPOINT = "http://${admin_domain}"
 LOGTO_POSTGRES_PASSWORD = "${postgres_password}"