feat: move GitLab from EKS to EC2 (docker-compose on IDE instance)

[allamand]

Overview

Move GitLab out of the EKS hub cluster onto the same EC2 instance that hosts the code-server IDE, managed via docker-compose. Reuses the existing CloudFront distribution and Caddy reverse proxy — no new NLB or CloudFront distribution needed. GitLab owns /, code-server moves to /ide. user1 created with the same workshop password, no SSO.

Approach: single CloudFront + Caddy path routing

The IDE already has: EIP → CloudFront → Caddy (port 80) → code-server (port 8111).

New Caddyfile:

http://${domain} {
  # GitLab CE at root
  handle /* {
    reverse_proxy 127.0.0.1:8929
  }
}

http://${domain}/ide* {
  uri strip_prefix /ide
  handle @proxy { ... }   # existing /proxy/<port> handler
  handle /* {
    reverse_proxy 127.0.0.1:8111
  }
}

code-server works under a subpath with uri strip_prefix only — no flags needed on the binary itself (confirmed from code-server docs). GitLab CE at root avoids the Beta subpath limitation entirely.

Branch strategy

• GitHub (appmod-blueprints): feature/cloudfront-on-agent-platform-without-gitlab → PR feat: move GitLab from EKS to EC2 docker-compose #755 targeting feature/cloudfront-on-agent-platform
• GitLab (platform-engineering-on-eks): feat/pr-709-kind-crossplane-gitlab-on-ec2 → MR !321 targeting feat/pr-709-kind-crossplane

---

Changes — GitLab repo (platform-engineering-on-eks / CDK)

A. cdk/lib/team-stack.ts — minimal changes only

• Remove NLB (GitlabNlb, GitlabTg, GitlabListener), CloudFront distribution (GitlabDistribution), and SG rule — all unnecessary
• Keep GitTokenSeed Lambda CR: seeds git_token = ide_password into <prefix>-hub/secrets at deploy time
• Keep CfnOutput GitlabUrl — value is now https://${ide.accessUrl} (same domain)
• Pass GITLAB_CF_DOMAIN via cdk.Fn.sub = gitlabDistribution.distributionDomainName → replaced by existing ide CF domain token

B. cdk/resources/bootstrap.sh

• Install Docker + docker-compose v2
• Write docker-compose.yml for gitlab/gitlab-ce: listens on 127.0.0.1:8929, external_url 'https://${GITLAB_CF_DOMAIN}'
• Rewrite Caddyfile: GitLab at /, code-server at /ide, existing /proxy handler preserved
• Start GitLab: docker compose up -d
• Write private/gitlab-cloudfront-domain = ${GITLAB_CF_DOMAIN} (same domain as IDE)
• Write private/gitlab-ec2-private-ip for ArgoCD in-cluster git access

C. cdk/lib/team-stack.ts — summary

Change	Detail
Remove NLB + CloudFront + SG rule	Not needed — reuse IDE CloudFront
Keep GitTokenSeed Lambda CR	Seeds git_token at deploy time
CfnOutput GitlabUrl	ide.accessUrl (same domain, root path)
GITLAB_CF_DOMAIN in Fn.Sub	Use IDE domain token directly

---

Changes — GitHub repo (appmod-blueprints)

D. Disable GitLab ArgoCD addon

• gitops/overlays/environments/control-plane/enabled-addons.yaml: gitlab: false
• gitops/addons/registry/platform.yaml: remove gitlab ApplicationSet
• platform/infra/terraform/hub-config.yaml: enable_gitlab: false

E. Remove Keycloak SSO client for GitLab

• gitops/addons/charts/keycloak/templates/keycloak-config.yaml: remove gitlab-client-payload + create_client + add_client_scope calls

F. Remove NLB/CloudFront Taskfile tasks for GitLab

• cluster-providers/kind-crossplane/Taskfile.cloudfront.yaml: remove gitlab-nlb, gitlab-distribution, sync-origins GitLab block, setup-exposure refs

G. Simplify Taskfile install flow

• cluster-providers/kind-crossplane/Taskfile.yaml:
  • Replace k8s Job wait with GitLab readiness poll
  • Add gitlab:init-ec2 task (curl-based init: root token, user1, repos)
  • GITLAB_DOMAIN_INT → EC2 private IP for in-cluster ArgoCD git pulls
  • Remove git_token from seed-secrets

H. Update workshop content IDE URL references

• All content references to the IDE URL must add the /ide suffix

---

Design decisions

Decision	Choice
CloudFront	Reuse existing IDE CloudFront (EIP-based)
Routing	Caddy: / → GitLab:8929, /ide → code-server:8111
GitLab subpath	Avoided (Beta status, asset recompile overhead)
code-server subpath	Works cleanly via uri strip_prefix (no binary flags needed)
GitLab deployment	docker-compose on EC2 (independent of kind cluster lifecycle)
In-cluster git access	EC2 private IP (same VPC, no CF round-trip)
git_token	Seeded by CDK Lambda CR at deploy time

Files touched

Repo	File
GitLab	cdk/lib/team-stack.ts
GitLab	cdk/resources/bootstrap.sh
GitLab	Workshop content (IDE URL → /ide)
GitHub	gitops/overlays/environments/control-plane/enabled-addons.yaml
GitHub	gitops/addons/registry/platform.yaml
GitHub	gitops/addons/charts/keycloak/templates/keycloak-config.yaml
GitHub	cluster-providers/kind-crossplane/Taskfile.cloudfront.yaml
GitHub	cluster-providers/kind-crossplane/Taskfile.yaml
GitHub	platform/infra/terraform/hub-config.yaml

[allamand]

Design clarification — CloudFront/ALB pre-requisites

Section F of this issue says to remove setup-exposure refs from the install flow. Confirming the explicit design decision:

In the PEEKS workshop deployment model:

• CloudFront distribution + ALB are pre-created by CDK in the IDE bootstrap stack (team-stack.ts)
• The cloudfront.cloudfrontDomain value is passed to task install via config.local.yaml
• cloudfront:setup-exposure (and create-alb, hub-distribution) must not run during task install — the EKS cluster VPC does not have public subnets available for ALB creation at that stage

The setup-exposure task remains available as a standalone task for non-workshop (self-managed) deployments where users bring their own CloudFront pre-requisites.

This was validated by a live install failure (exit 254, no public subnets found) in Workshop Studio account 514714113991.