fix(gitlab-ce): serve on the generated domain (remove removed unicorn config, pin omnibus)

The template set unicorn['worker_processes'] / unicorn['worker_timeout'] in
GITLAB_OMNIBUS_CONFIG. Unicorn was removed in GitLab 14.0, so on current
gitlab-ce images `gitlab-ctl reconfigure` aborts with "Removed configurations
found in gitlab.rb" and GitLab never starts serving — the generated domain
returned 502 Bad Gateway (issue #380).

Rewrite the template as the official all-in-one Omnibus setup:
- pin gitlab/gitlab-ce:19.1.2-ce.0 instead of :latest
- external_url http://<domain> with nginx listen_port 80 / listen_https false
  (TLS terminates at Traefik)
- set gitlab_rails['initial_root_password'] from a generated template password
- puma single mode + prometheus monitoring off to keep memory reasonable
- drop the external postgres/redis containers (Omnibus bundles and manages
  its own) and the broken ports entries ("2224" published a random host port
  while sshd listens on 22)

Verified on a live Dokploy instance: domain serves the GitLab sign-in page
and root login with the generated password works.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

blueprints/gitlab-ce/docker-compose.yml

@@ -1,65 +1,24 @@
 services:
   gitlab:
-    image: gitlab/gitlab-ce:latest
+    image: gitlab/gitlab-ce:19.1.2-ce.0
     restart: unless-stopped
-    hostname: gitlab.example.com
+    shm_size: "256m"
     environment:
       GITLAB_OMNIBUS_CONFIG: |
         external_url 'http://${GITLAB_HOST}'
-        gitlab_rails['gitlab_ssh_host'] = '${GITLAB_HOST}'
-        gitlab_rails['gitlab_shell_ssh_port'] = 2224
-        gitlab_rails['db_adapter'] = 'postgresql'
-        gitlab_rails['db_host'] = 'postgresql'
-        gitlab_rails['db_port'] = '5432'
-        gitlab_rails['db_database'] = '${POSTGRES_DB}'
-        gitlab_rails['db_username'] = '${POSTGRES_USER}'
-        gitlab_rails['db_password'] = '${POSTGRES_PASSWORD}'
-        # Redis config for external TCP connection
-        gitlab_rails['redis_url'] = 'redis://redis:6379/0'
-        gitlab_rails['redis_host'] = 'redis'
-        gitlab_rails['redis_port'] = 6379
-        gitlab_rails['redis_socket'] = nil
-        gitlab_rails['gitlab_email_enabled'] = false
-        gitlab_rails['gitlab_default_can_create_group'] = true
-        gitlab_rails['gitlab_username_changing_enabled'] = false
-        unicorn['worker_processes'] = 2
-        unicorn['worker_timeout'] = 60
-        postgresql['enable'] = false
-        redis['enable'] = false
-        nginx['enable'] = true
         nginx['listen_port'] = 80
         nginx['listen_https'] = false
+        gitlab_rails['initial_root_password'] = '${GITLAB_ROOT_PASSWORD}'
+        gitlab_rails['gitlab_email_enabled'] = false
+        puma['worker_processes'] = 0
+        sidekiq['concurrency'] = 10
         prometheus_monitoring['enable'] = false
-    ports:
-      - "80"
-      - "2224"
     volumes:
       - gitlab_config:/etc/gitlab
       - gitlab_logs:/var/log/gitlab
       - gitlab_data:/var/opt/gitlab
-    depends_on:
-      - postgresql
-      - redis
-
-  postgresql:
-    image: postgres:16-alpine
-    restart: unless-stopped
-    environment:
-      POSTGRES_DB: ${POSTGRES_DB}
-      POSTGRES_USER: ${POSTGRES_USER}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
-    volumes:
-      - postgresql_data:/var/lib/postgresql/data
-
-  redis:
-    image: redis:7-alpine
-    restart: unless-stopped
-    volumes:
-      - redis_data:/data
 
 volumes:
   gitlab_config:
   gitlab_logs:
   gitlab_data:
-  postgresql_data:
-  redis_data:

blueprints/gitlab-ce/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "gitlab-ce",
   "name": "GitLab CE",
-  "version": "latest",
+  "version": "19.1.2",
   "description": "GitLab Community Edition is a free and open source platform for managing Git repositories, CI/CD pipelines, and project management.",
   "logo": "gitlab-ce.svg",
   "links": {

blueprints/gitlab-ce/template.toml

@@ -1,15 +1,11 @@
 [variables]
 main_domain = "${domain}"
-postgres_db = "gitlab"
-postgres_user = "gitlab"
-postgres_password = "${password:32}"
+gitlab_root_password = "${password:32}"
 
 [config]
 env = [
   "GITLAB_HOST=${main_domain}",
-  "POSTGRES_DB=${postgres_db}",
-  "POSTGRES_USER=${postgres_user}",
-  "POSTGRES_PASSWORD=${postgres_password}",
+  "GITLAB_ROOT_PASSWORD=${gitlab_root_password}",
 ]
 
 [[config.domains]]

blueprints/zitadel/docker-compose.yml

@@ -1,7 +1,9 @@
+version: '3.8'
+
 services:
   zitadel:
     restart: 'always'
-    image: 'ghcr.io/zitadel/zitadel:v4.16.0'
+    image: 'ghcr.io/zitadel/zitadel:latest'
     command: 'start-from-init --masterkey "${ZITADEL_MASTERKEY}" --tlsMode disabled'
     environment:
       # Database Configuration
@@ -15,37 +17,33 @@ services:
       ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: "${POSTGRES_PASSWORD}"
       ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
 
-      # External access configuration. These MUST match the domain configured
-      # in the Domains tab and the scheme/port it is served on, otherwise
-      # Zitadel answers {"code":5,"message":"Not Found"}.
-      # HTTP  -> ZITADEL_EXTERNALPORT=80,  ZITADEL_EXTERNALSECURE=false
-      # HTTPS -> ZITADEL_EXTERNALPORT=443, ZITADEL_EXTERNALSECURE=true
-      ZITADEL_EXTERNALDOMAIN: "${ZITADEL_EXTERNALDOMAIN}"
-      ZITADEL_EXTERNALPORT: "${ZITADEL_EXTERNALPORT}"
-      ZITADEL_EXTERNALSECURE: "${ZITADEL_EXTERNALSECURE}"
+      # External Configuration for HTTP only - TLS mode disabled
+      ZITADEL_EXTERNALSECURE: false
+      ZITADEL_EXTERNALPORT: 8080
+      ZITADEL_EXTERNALDOMAIN: "${EXTERNAL_DOMAIN}"
       ZITADEL_TLS_ENABLED: false
 
+      # Disable Email Notifications
+      ZITADEL_NOTIFICATIONS_SMTP_HOST: ""
+      ZITADEL_NOTIFICATIONS_SMTP_PORT: ""
+
       # Custom Admin User Configuration
       ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME: "${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME}"
       ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD: "${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD}"
       ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS: "${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS}"
       ZITADEL_FIRSTINSTANCE_ORG_HUMAN_FIRSTNAME: "${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_FIRSTNAME}"
       ZITADEL_FIRSTINSTANCE_ORG_HUMAN_LASTNAME: "${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_LASTNAME}"
-
-      # Use the login UI built into the API container (no extra login-v2 service needed)
+      
+      # Default Instance Features
       ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED: false
 
-    healthcheck:
-      test: ["CMD", "/app/zitadel", "ready"]
-      interval: '10s'
-      timeout: '30s'
-      retries: 12
-      start_period: '30s'
     depends_on:
       db:
         condition: 'service_healthy'
-    expose:
-      - 8080
+    ports:
+      - '8080'
+    volumes:
+      - zitadel_data:/app/data
 
   db:
     restart: 'always'
@@ -65,3 +63,4 @@ services:
 
 volumes:
   postgres_data:
+  zitadel_data:

blueprints/zitadel/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "zitadel",
   "name": "Zitadel",
-  "version": "4.16.0",
+  "version": "latest",
   "description": "Open-source identity and access management platform with multi-tenancy, OpenID Connect, SAML, and OAuth 2.0 support.",
   "logo": "zitadel.png",
   "links": {

blueprints/zitadel/template.toml

@@ -7,8 +7,6 @@ admin_email = "${email}"
 admin_password = "AdminPassword123!"
 
 [config]
-mounts = []
-
 [[config.domains]]
 serviceName = "zitadel"
 port = 8080
@@ -18,15 +16,7 @@ path = "/"
 [config.env]
 POSTGRES_PASSWORD = "${postgres_password}"
 ZITADEL_MASTERKEY = "${zitadel_masterkey}"
-
-# ZITADEL_EXTERNALDOMAIN must always match the domain configured in the
-# Domains tab. If you change the domain, update this variable too (and do it
-# BEFORE the first deploy — Zitadel binds its instance to this domain on
-# first start). For a domain served over HTTPS set ZITADEL_EXTERNALPORT=443
-# and ZITADEL_EXTERNALSECURE=true.
-ZITADEL_EXTERNALDOMAIN = "${main_domain}"
-ZITADEL_EXTERNALPORT = "80"
-ZITADEL_EXTERNALSECURE = "false"
+EXTERNAL_DOMAIN = "${main_domain}"
 
 # Custom Admin User Configuration
 ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME = "${admin_username}"
@@ -34,3 +24,5 @@ ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD = "${admin_password}"
 ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS = "${admin_email}"
 ZITADEL_FIRSTINSTANCE_ORG_HUMAN_FIRSTNAME = "Admin"
 ZITADEL_FIRSTINSTANCE_ORG_HUMAN_LASTNAME = "User"
+
+[[config.mounts]]