CodeCommit の代替として GitLab on AWS を CDK で一撃で構築する

import * as ec2 from "aws-cdk-lib/aws-ec2";
import { Construct } from "constructs";

export interface NetworkProps {
  readonly vpcCidr?: string;
  readonly useNatInstance?: boolean;
  readonly vpcId?: string;
}

export class Network extends Construct {
  public readonly vpc: ec2.IVpc;

  constructor(scope: Construct, id: string, props: NetworkProps) {
    super(scope, id);

    if (props.vpcId) {
      this.vpc = ec2.Vpc.fromLookup(this, "Default", {
        vpcId: props.vpcId,
      });
    } else {
      const natInstance = props.useNatInstance
        ? ec2.NatProvider.instanceV2({
            instanceType: ec2.InstanceType.of(
              ec2.InstanceClass.T4G,
              ec2.InstanceSize.NANO
            ),
            defaultAllowedTraffic: ec2.NatTrafficDirection.OUTBOUND_ONLY,
          })
        : undefined;

      this.vpc = new ec2.Vpc(this, "Default", {
        natGatewayProvider: natInstance ? natInstance : undefined,
        natGateways: 1,
        ipAddresses: props.vpcCidr
          ? ec2.IpAddresses.cidr(props.vpcCidr)
          : undefined,
        maxAzs: 2,
        subnetConfiguration: [
          {
            name: "Public",
            subnetType: ec2.SubnetType.PUBLIC,
          },
          {
            name: "Private",
            subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
          },
        ],
      });

      if (natInstance) {
        natInstance.connections.allowFrom(
          ec2.Peer.ipv4(this.vpc.vpcCidrBlock),
          ec2.Port.tcp(443),
          "Allow HTTPS from VPC"
        ); // for SecretManager
      }
    }
  }
}

import * as cdk from "aws-cdk-lib";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as efs from "aws-cdk-lib/aws-efs";
import { Construct } from "constructs";

export interface StorageProps {
  readonly vpc: ec2.IVpc;
}

export class Storage extends Construct {
  public readonly fileSystem: efs.FileSystem;

  constructor(scope: Construct, id: string, props: StorageProps) {
    super(scope, id);

    this.fileSystem = new efs.FileSystem(this, "Default", {
      vpc: props.vpc,
      vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
      enableAutomaticBackups: true,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
    });
  }
}

import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
import { Construct } from "constructs";

export interface SecurityProps {
  readonly gitlabRootEmail: string;
}

export class Security extends Construct {
  public readonly gitlabSecret: secretsmanager.ISecret;

  constructor(scope: Construct, id: string, props: SecurityProps) {
    super(scope, id);

    this.gitlabSecret = new secretsmanager.Secret(this, "Default", {
      description: "Gitlab root credentials",
      generateSecretString: {
        secretStringTemplate: JSON.stringify({ email: props.gitlabRootEmail }),
        generateStringKey: "password",
      },
    });
  }
}

import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as elbv2 from "aws-cdk-lib/aws-elasticloadbalancingv2";
import * as acm from "aws-cdk-lib/aws-certificatemanager";
import * as route53 from "aws-cdk-lib/aws-route53";
import * as route53targets from "aws-cdk-lib/aws-route53-targets";
import { Construct } from "constructs";

export interface LoadBalancerProps {
  readonly vpc: ec2.IVpc;
  readonly allowedCidrs: string[];
  readonly domainName?: string;
  readonly subDomain?: string;
  readonly hostedZoneId?: string;
  readonly useHttps: boolean;
}

export class LoadBalancer extends Construct {
  public readonly alb: elbv2.IApplicationLoadBalancer;
  public readonly targetGroup: elbv2.IApplicationTargetGroup;
  public readonly url: string;

  constructor(scope: Construct, id: string, props: LoadBalancerProps) {
    super(scope, id);

    this.alb = new elbv2.ApplicationLoadBalancer(this, "Default", {
      vpc: props.vpc,
      internetFacing: true,
      vpcSubnets: props.vpc.selectSubnets({ subnets: props.vpc.publicSubnets }),
    });

    this.targetGroup = new elbv2.ApplicationTargetGroup(
      this,
      "GitlabTargetGroup",
      {
        vpc: props.vpc,
        port: 80,
        protocol: elbv2.ApplicationProtocol.HTTP,
        targetType: elbv2.TargetType.IP,
        healthCheck: {
          path: "/users/sign_in",
          port: "80",
        },
      }
    );

    let certificate: acm.ICertificate | undefined;
    if (props.useHttps) {
      const hostedZone = route53.PublicHostedZone.fromHostedZoneAttributes(
        this,
        "HostedZone",
        {
          zoneName: props.domainName!,
          hostedZoneId: props.hostedZoneId!,
        }
      );

      certificate = new acm.Certificate(this, "GitlabCertificate", {
        domainName: `${props.subDomain}.${props.domainName}`,
        validation: acm.CertificateValidation.fromDns(hostedZone),
      });

      new route53.ARecord(this, "GitlabDnsRecord", {
        zone: hostedZone,
        recordName: props.subDomain,
        target: route53.RecordTarget.fromAlias(
          new route53targets.LoadBalancerTarget(this.alb)
        ),
      });
    }

    const listener = this.alb.addListener("GitlabListener", {
      protocol: props.useHttps
        ? elbv2.ApplicationProtocol.HTTPS
        : elbv2.ApplicationProtocol.HTTP,
      open: false,
      certificates: props.useHttps ? [certificate!] : undefined,
      defaultTargetGroups: [this.targetGroup],
    });

    props.allowedCidrs.forEach((cidr) =>
      listener.connections.allowDefaultPortFrom(ec2.Peer.ipv4(cidr))
    );

    this.url = props.useHttps
      ? `https://${props.subDomain}.${props.domainName}`
      : `http://${this.alb.loadBalancerDnsName}`;
  }
}

import * as cdk from "aws-cdk-lib";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as efs from "aws-cdk-lib/aws-efs";
import * as lambda from "aws-cdk-lib/aws-lambda";
import * as cr from "aws-cdk-lib/custom-resources";
import * as logs from "aws-cdk-lib/aws-logs";
import { Construct } from "constructs";

export interface EfsInitLambdaProps {
  readonly vpc: ec2.IVpc;
  readonly fileSystem: efs.FileSystem;
}

export class EfsInitLambda extends Construct {
  public readonly initFunction: lambda.IFunction;

  // Define Lambda function to initialize EFS.
  // This function makes 3 directories in EFS root: data, logs, config.
  constructor(scope: Construct, id: string, props: EfsInitLambdaProps) {
    super(scope, id);

    this.initFunction = new lambda.Function(this, "Default", {
      runtime: lambda.Runtime.PYTHON_3_9,
      handler: "index.handler",
      code: lambda.Code.fromAsset("lambda"),
      vpc: props.vpc,
      vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
      timeout: cdk.Duration.minutes(1),
      allowAllOutbound: false,
      filesystem: lambda.FileSystem.fromEfsAccessPoint(
        props.fileSystem.addAccessPoint("LambdaAccessPoint", {
          createAcl: {
            ownerGid: "0",
            ownerUid: "0",
            permissions: "755",
          },
          posixUser: {
            uid: "0",
            gid: "0",
          },
          path: "/",
        }),
        "/mnt/efs"
      ),
      environment: {
        EFS_ID: props.fileSystem.fileSystemId,
      },
    });

    const efsInitProvider = new cr.Provider(this, "EfsInitProvider", {
      onEventHandler: this.initFunction,
      logRetention: logs.RetentionDays.ONE_WEEK,
    });

    new cdk.CustomResource(this, "EfsInitializer", {
      serviceToken: efsInitProvider.serviceToken,
    });
  }
}

import logging
import os
from typing import Any, Dict

logger = logging.getLogger()
logger.setLevel(logging.INFO)

MOUNT_POINT = "/mnt/efs"

GITLAB_DIRS = [
    "/srv/gitlab/data",
    "/srv/gitlab/logs",
    "/srv/gitlab/config",
]


def handler(event: Dict[str, Any], context: Any) -> Dict[str, Any]:
    try:
        # check if the EFS mount point exists
        if not os.path.exists(MOUNT_POINT):
            logger.error(f"EFS mount point {MOUNT_POINT} does not exist")
            raise FileNotFoundError(f"EFS mount point {MOUNT_POINT} does not exist")

        # make 3 directories
        for dir_path in GITLAB_DIRS:
            full_path = os.path.join(MOUNT_POINT, dir_path.lstrip("/"))
            os.makedirs(full_path, exist_ok=True)
            logger.info(f"Successfully created directory: {full_path}")

        return {
            "StatusCode": 200,
            "Message": "Successfully initialized EFS directories",
        }

    except Exception as e:
        logger.error(f"Error during EFS initialization: {str(e)}")
        raise e

import * as cdk from "aws-cdk-lib";
import * as ecs from "aws-cdk-lib/aws-ecs";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as iam from "aws-cdk-lib/aws-iam";
import * as elbv2 from "aws-cdk-lib/aws-elasticloadbalancingv2";
import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
import * as efs from "aws-cdk-lib/aws-efs";
import { Construct } from "constructs";

export interface ComputingProps {
  readonly vpc: ec2.IVpc;
  readonly fileSystem: efs.IFileSystem;
  readonly targetGroup: elbv2.IApplicationTargetGroup;
  readonly gitlabSecret: secretsmanager.ISecret;
  readonly gitlabImageTag: string;
  readonly externalUrl: string;
  readonly useHttps: boolean;
}

export class Computing extends Construct {
  private readonly gitlabDir = {
    container: {
      data: "/var/opt/gitlab",
      logs: "/var/log/gitlab",
      config: "/etc/gitlab",
    },
    efs: {
      data: "/srv/gitlab/data",
      logs: "/srv/gitlab/logs",
      config: "/srv/gitlab/config",
    },
  } as const;

  constructor(scope: Construct, id: string, props: ComputingProps) {
    super(scope, id);

    const cluster = new ecs.Cluster(this, "GitlabCluster", {
      vpc: props.vpc,
      containerInsights: true,
    });

    const taskRole = new iam.Role(this, "EcsTaskRole", {
      assumedBy: new iam.ServicePrincipal("ecs-tasks.amazonaws.com"),
    });
    // Allow ECS tasks to mount EFS
    props.fileSystem.grantReadWrite(taskRole);

    const taskDefinition = new ecs.FargateTaskDefinition(
      this,
      "GitlabTaskDefinition",
      {
        cpu: 2048,
        memoryLimitMiB: 6144, // require more than 6GB in my experience
        taskRole: taskRole,
        runtimePlatform: { cpuArchitecture: ecs.CpuArchitecture.X86_64 },
      }
    );

    const container = taskDefinition.addContainer("GitlabContainer", {
      image: ecs.ContainerImage.fromRegistry(
        `gitlab/gitlab-ce:${props.gitlabImageTag}`
      ),
      portMappings: [{ containerPort: 80 }],
      secrets: {
        GITLAB_ROOT_PASSWORD: ecs.Secret.fromSecretsManager(
          props.gitlabSecret,
          "password"
        ),
        GITLAB_ROOT_EMAIL: ecs.Secret.fromSecretsManager(
          props.gitlabSecret,
          "email"
        ),
      },
      environment: {
        GITLAB_OMNIBUS_CONFIG: props.useHttps
          ? // If HTTPS is enabled, set the external URL to use the domain name with HTTPS.
            // Also, configure NGINX to listen on port 80 and disable HTTPS inside the GitLab container,
            // as SSL termination is handled by the ALB (reverse proxy).
            // https://stackoverflow.com/questions/51487180/gitlab-set-external-url-to-https-without-certificate
            `external_url '${props.externalUrl}'; nginx['listen_port'] = 80; nginx['listen_https'] = false;`
          : // If HTTPS is not enabled, use the ALB's DNS name and set the external URL.
            `external_url '${props.externalUrl}'`,
      },
      logging: ecs.LogDrivers.awsLogs({ streamPrefix: "gitlab" }),
    });

    container.addMountPoints(
      {
        sourceVolume: "data",
        containerPath: this.gitlabDir.container.data,
        readOnly: false,
      },
      {
        sourceVolume: "logs",
        containerPath: this.gitlabDir.container.logs,
        readOnly: false,
      },
      {
        sourceVolume: "config",
        containerPath: this.gitlabDir.container.config,
        readOnly: false,
      }
    );

    // Mount EFS directories
    // Not using EFS access points because multiple UID/GID operations are required for file operations at mount points
    const addEfsVolume = (
      taskDefinition: ecs.FargateTaskDefinition,
      name: string,
      fileSystemId: string,
      rootDirectory: string
    ) => {
      taskDefinition.addVolume({
        name: name,
        efsVolumeConfiguration: {
          fileSystemId: fileSystemId,
          transitEncryption: "ENABLED",
          authorizationConfig: {
            iam: "ENABLED",
          },
          rootDirectory: rootDirectory,
        },
      });
    };

    addEfsVolume(
      taskDefinition,
      "data",
      props.fileSystem.fileSystemId,
      this.gitlabDir.efs.data
    );
    addEfsVolume(
      taskDefinition,
      "logs",
      props.fileSystem.fileSystemId,
      this.gitlabDir.efs.logs
    );
    addEfsVolume(
      taskDefinition,
      "config",
      props.fileSystem.fileSystemId,
      this.gitlabDir.efs.config
    );

    const service = new ecs.FargateService(this, "GitlabService", {
      cluster,
      taskDefinition,
      desiredCount: 1,
      assignPublicIp: false,
      vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
      healthCheckGracePeriod: cdk.Duration.seconds(540), // gitlab requires a long grace period for health checks
      enableExecuteCommand: true,
    });

    service.attachToApplicationTargetGroup(props.targetGroup);

    // Allow inbound NFS traffic from ECS
    props.fileSystem.connections.allowDefaultPortFrom(
      service,
      "Allow inbound NFS traffic from ECS"
    );
  }
}

import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";
import { Network } from "./constructs/network";
import { Storage } from "./constructs/storage";
import { LoadBalancer } from "./constructs/loadbalancer";
import { Security } from "./constructs/security";
import { Computing } from "./constructs/computing";
import { EfsInitLambda } from "./constructs/efs-init-lambda";

export interface GitlabServerlessStackProps extends cdk.StackProps {
  /**
   * The IP address ranges in CIDR notation that have access to GitLab.
   * You can restrict access to specific IP ranges for security.
   * @example ["1.1.1.1/32", "2.2.2.2/24"]
   */
  readonly allowedCidrs: string[];

  /**
   * The CIDR block for the VPC where GitLab will be deployed.
   * Ignored when you import an existing VPC.
   * @example "10.0.0.0/16"
   */
  readonly vpcCidr?: string;

  /**
   * Use t4g.nano NAT instances instead of NAT Gateway.
   * Set to true to minimize AWS costs.
   * Ignored when you import an existing VPC.
   * @default false
   */
  readonly useNatInstance?: boolean;

  /**
   * If set, it imports the existing VPC instead of creating a new one.
   * The VPC must have public and private subnets.
   * @default create a new VPC
   */
  readonly vpcId?: string;

  /**
   * The domain name for GitLab's service URL.
   * You must own a Route53 public hosted zone for the domain in your account.
   * @default undefined - No custom domain is used
   */
  readonly domainName?: string;

  /**
   * The subdomain to use for GitLab.
   * This will be combined with the domain name to form the complete URL.
   * @example "gitlab" will result in "gitlab.yourdomain.com"
   * @default undefined
   */
  readonly subDomain?: string;

  /**
   * The ID of Route53 hosted zone for the domain.
   * Required if domainName is specified.
   * @default undefined
   */
  readonly hostedZoneId?: string;

  /**
   * The email address for the GitLab root user.
   * This will be used to create the initial admin account.
   * @default "[email protected]"
   */
  readonly gitlabRootEmail?: string;

  /**
   * The version tag of the GitLab container image to deploy.
   * The image will be pulled from [here](https://hub.docker.com/r/gitlab/gitlab-ce)
   * @example "17.5.0-ce.0"
   * @default "latest"
   */
  readonly gitlabImageTag?: string;
}

export class GitlabServerlessStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: GitlabServerlessStackProps) {
    super(scope, id, props);

    const {
      gitlabRootEmail: rootEmail = "[email protected]",
      gitlabImageTag: imageTag = "latest",
    } = props;

    if (
      (props.hostedZoneId != null) !== (props.domainName != null) ||
      (props.hostedZoneId != null) !== (props.subDomain != null)
    ) {
      throw new Error(
        `You have to set hostedZoneId, domainName, and subDomain together! Or leave them all blank.`
      );
    }

    const useHttps = Boolean(
      props.domainName && props.subDomain && props.hostedZoneId
    );

    // Network (VPC)
    const network = new Network(this, "Network", {
      useNatInstance: props.useNatInstance,
      vpcId: props.vpcId,
    });

    // Storage (EFS)
    const storage = new Storage(this, "Storage", {
      vpc: network.vpc,
    });

    // Security (Secrets Manager)
    const security = new Security(this, "Security", {
      gitlabRootEmail: rootEmail,
    });

    // LoadBalancer (ALB, DNS)
    const loadBalancer = new LoadBalancer(this, "LoadBalancer", {
      vpc: network.vpc,
      allowedCidrs: props.allowedCidrs,
      domainName: props.domainName,
      subDomain: props.subDomain,
      hostedZoneId: props.hostedZoneId,
      useHttps,
    });

    // EFS Initialization (Lambda)
    const efsInitializer = new EfsInitLambda(this, "EfsInitLambda", {
      vpc: network.vpc,
      fileSystem: storage.fileSystem,
    });

    // Computing (ECS, Fargate)
    const computing = new Computing(this, "Computing", {
      vpc: network.vpc,
      fileSystem: storage.fileSystem,
      targetGroup: loadBalancer.targetGroup,
      gitlabSecret: security.gitlabSecret,
      gitlabImageTag: imageTag,
      externalUrl: loadBalancer.url,
      useHttps,
    });

    // Dependencies (VPC -> Lambda -> ECS)
    efsInitializer.initFunction.node.addDependency(network.vpc);
    computing.node.addDependency(efsInitializer.initFunction);

    new cdk.CfnOutput(this, "GitlabUrl", {
      value: loadBalancer.url,
    });
  }
}

const container = taskDefinition.addContainer("GitlabContainer", {
  image: ecs.ContainerImage.fromRegistry(
    `gitlab/gitlab-ce:${props.gitlabImageTag}`
  ),
  portMappings: [{ containerPort: 80 }],
  secrets: {
    GITLAB_ROOT_PASSWORD: ecs.Secret.fromSecretsManager(
      props.gitlabSecret,
      "password"
    ),
    GITLAB_ROOT_EMAIL: ecs.Secret.fromSecretsManager(
      props.gitlabSecret,
      "email"
    ),
  },
  environment: {
    GITLAB_OMNIBUS_CONFIG: props.useHttps
      ? `external_url '${props.externalUrl}'; nginx['listen_port'] = 80; nginx['listen_https'] = false;`
      : `external_url '${props.externalUrl}'`,
  },
  logging: ecs.LogDrivers.awsLogs({ streamPrefix: "gitlab" }),
});

#!/bin/bash
cd /tmp || exit
git clone https://github.com/ren8k/aws-cdk-gitlab-on-ecs.git
cd aws-cdk-gitlab-on-ecs || exit
npm ci
npx cdk bootstrap
npx cdk deploy