cat <<EOF > docker-compose.yml
services:
  gitlab:
    image: gitlab/gitlab-ce:latest
    container_name: gitlab-app
    restart: unless-stopped
    hostname: gitlab.snorthost.net
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://snorthost.net'
        
        # Passt die in der Web-UI angezeigten SSH-Klone-URLs an Port 2222 an
        gitlab_rails['gitlab_shell_ssh_port'] = 2222
        
        # Verhindert, dass sich fremde Personen frei registrieren können
        gitlab_rails['gitlab_signup_enabled'] = false
        
        # Datenschutz-Härtung: Keine Profilbilder von externen US-Servern laden
        gitlab_rails['gravatar_enabled'] = false
        
        # Interner Nginx lauscht unverschlüsselt, da NPM SSL übernimmt
        nginx['listen_port'] = 80
        nginx['listen_https'] = false
        
        # Empfohlen für Betrieb hinter Reverse Proxies (SSL Offloading)
        nginx['proxy_set_header'] = {
          "X-Forwarded-Proto" => "https",
          "X-Forwarded-Ssl" => "on"
        }

        # --- SSO MIT AUTHENTIK (LINUX.OR.AT CONFIG) ---
        gitlab_rails['omniauth_enabled'] = true
        gitlab_rails['omniauth_allow_single_sign_on'] = ['openid_connect']
        gitlab_rails['omniauth_block_auto_created_users'] = false
        gitlab_rails['omniauth_auto_link_user'] = ['openid_connect']
        
        gitlab_rails['omniauth_providers'] = [
          {
            name: "openid_connect",
            label: "Authentik Login",
            args: {
              name: "openid_connect",
              scope: ["openid", "profile", "email"],
              response_type: "code",
              issuer: "https://auth.domainname.at/application/o/git-lab/",
              client_auth_method: "query",
              discovery: true,
              uid_field: "preferred_username",
              client_options: {
                identifier: "DEINE_AUTHENTIK_CLIENT_ID",
                secret: "DEIN_AUTHENTIK_SECRET",
                redirect_uri: "https://gitlab.domainname.net/users/auth/openid_connect/callback"
              }
            }
          }
        ]
    ports:
      - "2222:22" # SSH-Port für Git-Clones (Host-Port 2222 -> Container 22)
    volumes:
      - ./config:/etc/gitlab
      - ./logs:/var/log/gitlab
      - ./data:/var/opt/gitlab
    shm_size: 256m
    networks:
      - proxy-nw

networks:
  proxy-nw:
    external: true
EOF