Self-hosted GitLab stack
Self-hosted GitLab Community Edition stack for Git repositories and CI/CD, with PostgreSQL, Valkey, email, and an optional GitLab Runner.
Start with this stackWhy teams use this stack
Start with the right services already linked
Use a ready, configurable service baseline.
Keep stack configuration in Git
Version stack.yml and import approved changes as new revisions.
Stay secure with automatic stack maintenance
Control eligible updates and environment maintenance windows.
Monitor and debug running services
Stream logs, inspect metrics, and open a web terminal.
Route traffic through managed endpoints
Use technical routes, custom domains, HTTPS, and published ports.
Reuse one stack across environments
Create development, staging, and production with tailored configuration.
Good to know
What to know before you deploy GitLab
The GitLab stack deploys GitLab Community Edition with the official GitLab Helm chart, alongside PostgreSQL, Valkey, and OpenSMTPD for mail. A GitLab Runner for CI jobs is included but stays off until you enable it.
Object storage comes first
Before creating the app, set up S3-compatible object storage with a separate bucket for each kind of GitLab data, plus a variable integration that supplies the connection details. The app cannot be created without that integration.
First sign-in as root
Wodby generates the root administrator's password at app creation. Reveal it on the GitLab service's Tokens tab, sign in on the main domain, then change it in GitLab. Editing the token afterwards leaves the password unchanged.
Backups go to your own bucket
GitLab uploads a daily backup archive to your backups bucket. These are not Wodby backups, Wodby does not delete old ones, and the Rails secrets are left out, so keep a protected copy of them.
Single instance with some features off
GitLab cannot be scaled to several replicas. Pages, incoming email, and bundled monitoring are switched off. CI jobs run in unprivileged containers, which rules out Docker-in-Docker.
Read the GitLab stack guide for setup steps, settings, and limits.
Services
Start with the right services, then make the stack your own
The GitLab stack comes with these services already connected. The table shows which ones are enabled by default when you create an app environment and, where services depend on each other, how they are linked.
When you add the stack to your organization, the copy is yours to change. Changes go into a draft that you publish as a new stack revision, and app environments pick them up when they upgrade.
Add services
Add any service from the catalog, such as a cache, a search engine, or a mail relay, and link it to the services that use it.
Remove what you do not need
Leave optional services out when you create an app, disable a service in one app environment, or remove it from the stack for every environment.
Change how services connect
Point a link at another service in the stack or, where the link allows it, at a service of another app or at custom values such as a managed database. Change it for the whole stack or for one app environment.
| Stack service | Base service | Role | Links |
|---|---|---|---|
| GitLab Community Edition | Primary |
| |
| OpenSMTPD | Required | — | |
| PostgreSQL | Required | — | |
| Valkey | Required | — | |
| GitLab Runner | Disabled by default |
|
Explore the full stack service catalog for configs, settings, actions, cron, volumes, links, backups, and imports attached to each service in this stack. The stack configuration guide covers adding services, removing them, and changing links.
Deploy
Choose where it runs. Wodby maintains it either way.
The application stack stays the same on Wodby Cloud, in your own cloud account, or on your own server. Wodby keeps Kubernetes, the cluster infrastructure, and the stack up to date wherever it runs, so the choice comes down to where you want the resources and what you want to pay.
Wodby hosts the cluster, so there is no cloud account or server to set up first.
Keep the cluster and its resources in your own cloud account. Wodby creates it and keeps it up to date.
Run the same stack on a VM, bare-metal server, or dedicated host at the lowest cost. You keep the server’s operating system updated.
Explore hosting options for this stack to compare managed cloud, customer-cloud, and server-based deployment models in more detail.
Routing and endpoints
Publish and control application endpoints
Services in this stack declare the endpoints and ports they can expose. Each app environment can start on default technical domains, then add custom domains, HTTPS, access controls, redirects, or published TCP and UDP ports as needed.
Default technical domains
Reach supported services on generated Wodby domains, then attach custom domains when ready.
Automatic Let's Encrypt HTTPS
Provision and automatically renew trusted certificates for supported public routes.
Authentication and route controls
Protect routes with HTTP basic auth, redirect alternate domains or paths, and tune HSTS, no-index, upload limits, and more.
Explore routing and endpoints to see technical routes, custom domains, managed certificates, route controls, redirects, and published ports.
Private app access
Deploy GitLab behind private access
Choose private app access during app creation to keep every eligible HTTP endpoint behind an approved identity or private network. Protect the complete app, or only admin, staging, dashboard, and other restricted web surfaces.
Cloudflare
View integrationPublish behind a Cloudflare Access identity policy or keep endpoints inside a Cloudflare One private network.
Tailscale
View integrationGive authorized tailnet users and devices stable private HTTPS addresses for the app.
Explore private app access to compare identity-aware access through Cloudflare Access with private-network access through Cloudflare One or Tailscale.
Databases
Choose the right database model for each environment
This stack includes container-based databases such as PostgreSQL. You can also add managed database services when you want the database to run outside the stack.
Container databases in this stack
Managed database integrations
Explore database options for this stack for container services, managed providers, and the connection model used by this stack.
Backups
Automate backups and move data between environments
Container-based services in this stack can run automatic backups, upload archives to connected cloud storage, and import working data into other environments when teams need realistic copies.
Run automatic backups on a schedule
Keep backup workflows attached to the stack instead of rebuilding them manually for each environment.
Refresh development and staging
Import an archive, uploaded file, or URL to create realistic non-production data.
Upload backup archives to cloud storage
Send backup archives to third-party storage instead of keeping them only inside the platform.
Services with backup workflows
Backup storage integrations
Explore backups and migration workflows for archive destinations, restore paths, and ways to move working data onto Wodby.
Deliver email reliably with trusted SMTP providers
OpenSMTPD in this stack can relay outbound mail through trusted SMTP providers instead of relying on local delivery.
Email services in this stack
Trusted SMTP providers
Explore email delivery for this stack for development mail capture, SMTP relays, and provider-backed delivery.
Configuration and customization
Customize services for each environment
Tune the config files and settings exposed by each service without changing its image or rebuilding the stack. Start from the stack defaults, then override only what a particular environment needs.
Explore configs and settings to see exactly what can be customized for each service in this stack.
Git-managed configuration
Keep your stack configuration in Git
Store the application blueprint in a stack.yml template alongside your code. Version service definitions, defaults, settings, and environment behavior while Wodby turns approved source changes into controlled stack revisions.
Version the application blueprint
Review stack configuration through commits and pull requests before it reaches an environment.
Import updates as new revisions
Follow an approved branch or semantic-version tags without changing running app environments in place.
Keep service updates enabled
Control Git template updates and service auto-updates separately, so customized stacks can still receive eligible releases.
Explore Git-backed stacks and see how they work with automatic updates.
Security and maintenance
Stay secure with automatic service updates
Enable service auto-updates at stack level to pick up eligible security patches and maintenance releases. Wodby creates a new stack revision instead of changing running app environments in place, so every update stays visible and reviewable.
Choose which app environments should auto-upgrade and limit production rollouts to a local-time maintenance window. Development and staging can move sooner while production follows your security and maintenance policy.
Explore automatic updates to see how policies, revisions, maintenance windows, and app environment auto-upgrades work.
Observability and debugging
Understand what running services are doing
Keep the signals and tools for day-to-day troubleshooting close to each app environment, from a quick health check to direct inspection inside a running container.
Stream live container logs
Follow app service output in real time and select a specific workload or container when a service exposes more than one.
Track runtime health
Inspect app environment and service metrics for CPU, memory, storage, readiness, and restarts before changing resources or scaling.
Debug with a web terminal
Open an interactive shell in a running service container for quick inspection and one-off commands without exposing a public SSH port.
Explore observability for logs and metrics, or review service configuration for web terminal access and other runtime operations.
Environments
Create development, staging, and production environments
Launch development, staging, production, or customer-specific environments from the same GitLab stack, then tailor values and configuration to each one.
Start from a consistent baseline
Use the same enabled services and integrations across development, staging, and production.
Customize each environment
Override values, configs, and settings without changing the shared stack definition.
Explore environments for development, staging, and production workflows.
Get started
Create a new GitLab environment
Reuse the same stack across app environments without rebuilding the definition for every new environment.
FAQ
Common questions about the GitLab stack
What does the GitLab stack include?
Self-hosted GitLab Community Edition stack for Git repositories and CI/CD, with PostgreSQL, Valkey, email, and an optional GitLab Runner. App environments created from this stack inherit the services enabled by default, attached integrations, hosting options, and stack revision history.
How can one stack support multiple apps and environments?
You can reuse the same stack for multiple similar apps and for development, staging, production, and other environment types. The stack defines the shared services and defaults, you can set different values for env types such as dev and prod, and each app environment can still be configured individually.
How do stack updates work?
When an included service gets an update, the stack can be marked as outdated or create a new revision automatically under its update policy. Existing app environments stay on their current revision until you upgrade them manually or enable stack auto-upgrades with a maintenance window.
How do integrations work with this stack?
External integrations stay attached to the stack definition so SMTP relays, backup storage, managed databases, and related services can be reused across app environments.
Can app environments from this stack run on different infrastructure?
Yes. Development and production app environments from the same stack can run on different hosting models, including Wodby Cloud, managed Kubernetes, and self-hosted Kubernetes on a VM or dedicated server, while keeping the same stack definition and upgrade path.