gistfile1.txt

{ modulesPath, ... }:
let
  host = "some.hostname";
  adminEmail = "someone@example.com";
in
{
  imports = [ "${modulesPath}/virtualisation/amazon-image.nix" ];
  ec2.hvm = true;

  services.gitlab = rec {
    enable = true;

    inherit host;
    https = true;
    port = 443;

    extraGitlabRb = ''
      external_url 'https://${host}'
    '';

    # You have to write a value here.
    initialRootPasswordFile = "/var/gitlab/state/secrets/initial-password";

    secrets = rec {
      # You, dear sysadmin, have to make these files exist.
      # A file containing 30 "0" characters.
      secretFile = "/var/gitlab/state/secrets/zeros";
      dbFile = secretFile;
      otpFile = secretFile;
      # openssl genrsa 2048 > jws.rsa
      jwsFile = "/var/gitlab/state/secrets/jws.rsa";
    };
  };

  services.nginx = {
    enable = true;
    user = "gitlab";
    virtualHosts = {
      "${host}" = {
        addSSL = true;
        enableACME = true;
        locations."/" = {
          proxyPass = "http://unix:/var/gitlab/state/tmp/sockets/gitlab.socket:/";
        };
      };
    };
  };

  security.acme = {
    acceptTerms = true;
    email = adminEmail;
    # server = "https://acme-staging-v02.api.letsencrypt.org/directory";
  };

  networking.firewall = {
    enable = true;
    allowPing = false;
    allowedTCPPorts = [
      22
      80
      443
    ];
  };
}