[GeneraBlack]

Add GitLab CE module (gitlab) to NethForge with its logo, metadata, and screenshot.

Features

• GitLab CE 19.5 (19.5.0-ce.0) in a rootless Podman pod behind NS8 Traefik (with HTTP-to-HTTPS and Let's Encrypt support)

• LDAP / Active Directory Authentication via NS8 Ldapproxy (auto-reconfigures on user-domain-changed events)

• Smarthost / Central Mail Relay auto-discovery (auto-reconfigures on smarthost-changed events)

• Git over SSH port allocation (org.nethserver.tcp-ports-demand=3) and automatic firewall rule management (
  ode:fwadm)

• Optional GitLab Container Registry with automatic secondary Traefik route

• Integrated GitLab Runner (�19.5.0) with automatic background registration via Ci::Runners::CreateRunnerService (glrt- token)

• Full NS8 Lifecycle Support: Backup, Restore (
  estore-module), Clone, Move (clone-module), and Update (update-module)

• Container Image: ghcr.io/bls-isp/gitlab

• Source Code & Documentation: https://github.com/BLS-ISP/NS8-GitLab

• Companion Documentation PR: docs(nethforge): add GitLab CE module documentation ns8-docs#287

[stephdl]

Hi @GeneraBlack, thanks a lot for this contribution. GitLab on NethForge is a nice addition. I went through this PR, the docs PR NethServer/ns8-docs#287 and the module repo. Here is what I'd like to see before we merge. Most of it is small.

NethForge index (this PR)

1. Please drop the pins.yml change. Pin rules match the module tags (1.0.0 to 1.0.3), not the GitLab version. match: ">=19.0.0" hides nothing today, and it will hide the whole module the day you tag 19.x. pins.yml is only for staged upgrades across breaking releases, see the README.
2. upstream_name: "GitLab CE 19.5.0" will go stale at the first Renovate bump. I'd use "GitLab CE".

Documentation (ns8-docs#287)

1. The file contains raw \r characters. They eat letters in the rendered page: "the ^Moot administrator" and "e.g. ^Megistry.example.com". Can you regenerate it with plain LF line endings? Please add the final newline too.
2. Step 2 reads as if the root password is mandatory. The module generates one when it's left empty. Can you say so, and explain how the admin gets that generated password back?
3. Please add a :::warning about the runner. CI jobs get the module's Podman socket, so a job can control gitlab-app and read its secrets. Admins should only enable it for trusted projects.

Module repo

These are not blockers for the index. I think they need fixing before people trust the module with real data:

1. The root password is stored with agent.set_env() (GITLAB_INITIAL_PASSWORD). That goes to Redis in plain text, readable by every module on the node. It is also passed as --env to the container, so podman inspect shows it. Please use a secrets file instead.
2. module-dump-state runs gitlab-backup create, but restore-module never runs gitlab-backup restore. A restore ends up with the raw PostgreSQL files copied while the DB was live. A 40restoreDB step is missing, plus a Robot test that does backup then restore.
3. configure-module/70write_config changes the password with a detached Popen and sends its output to DEVNULL. A failure is silent and the password shows up in ps.
4. The UI uses cv-text-input and cv-tile. The ns8-ui-lib equivalents NsTextInput and NsTile should be used instead.

Tooling that helps

We publish agent skills with our module conventions: layout, authorizations, secrets, backup/restore, UI components, docs. They're here: https://github.com/NethServer/agents. If you use Claude Code, add the marketplace and run the nethserver-ns8-module skill on your repo. It catches most of the points above. The same checks apply to your Vaultwarden PR (#46).

Thanks again. Ping me when it's updated and I'll do another pass.