Klaster OKD 4.19 (OpenShift) – Serwer GitLab pod Argo CD i OKD

sudo apt update
sudo apt full-upgrade -y
sudo reboot

sudo apt update
sudo apt install -y \
  nano mc htop curl fastfetch git screen wget ncdu nmap \
  sysstat vnstat atop iftop
  
 sudo apt install -y sshfs
 sudo apt install -y nfs-common
 sudo apt install -y cifs-utils

sudo swapoff /dev/mapper/gitlab--vg-swap_1
# usunąć z /etc/fstab
/dev/mapper/gitlab--vg-swap_1 none swap sw 0 0
sudo sed -i '\|/dev/mapper/gitlab--vg-swap_1|d' /etc/fstab

# Usuń LV swap_1 z LVM
sudo lvremove -y /dev/gitlab-vg/swap_1
# Rozszerz LV root o 100% wolnego miejsca
sudo lvextend -l +100%FREE /dev/gitlab-vg/root
# Rozszerz system plików root (online)
sudo resize2fs /dev/gitlab-vg/root

# przygotowanie swapa w pliku
sudo fallocate -l 1G /var/swap
sudo chmod 600 /var/swap
sudo mkswap /var/swap
sudo swapon /var/swap
echo '/var/swap none swap defaults 0 0' | sudo tee -a /etc/fstab

# w razie długiego uruchamiania
cat /etc/initramfs-tools/conf.d/resume 2>/dev/null || echo "brak pliku resume"
RESUME=/dev/mapper/gitlab--vg-swap_1
echo "RESUME=none" | sudo tee /etc/initramfs-tools/conf.d/resume
# Przebuduj initramfs
sudo update-initramfs -u -k all

# wyłaczenie banera po połaczeniu
> /etc/motd

sudo nano /root/.bashrc
# Dopisz na końcu

# --- fastfetch banner on interactive SSH login (root) ---
if [[ $- == *i* ]] && [[ -n "$SSH_CONNECTION" || -n "$SSH_TTY" ]] && command -v fastfetch >/dev/null 2>&1; then
  if [[ -t 1 ]]; then
    fastfetch
  fi
fi

sudo dmesg -T --level=err,warn

echo "blacklist snd_hda_intel" | sudo tee /etc/modprobe.d/blacklist-audio.conf
echo "blacklist pciehp"        | sudo tee /etc/modprobe.d/blacklist-pciehp.conf
echo "blacklist shpchp"        | sudo tee /etc/modprobe.d/blacklist-shpchp.conf

sudo update-initramfs -u
sudo reboot

sudo apt install -y tuned
sudo systemctl enable --now tuned
sudo tuned-adm profile throughput-performance
# Weryfikacja:
sudo tuned-adm active
sudo tuned-adm list

sudo nano /etc/default/grub
# Znajdź np.:
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash"
# I zmień np. na:
GRUB_CMDLINE_LINUX_DEFAULT=""

sudo timedatectl set-timezone Europe/Warsaw
journalctl -u systemd-timesyncd --since "1 hour ago" --no-pager

# przed zmianami
root@gitlab:~# timedatectl timesync-status
       Server: 149.156.70.60 (2.debian.pool.ntp.org)
Poll interval: 2min 8s (min: 32s; max 34min 8s)
         Leap: normal
      Version: 4
      Stratum: 2
    Reference: 959C464B
    Precision: 1us (-25)
Root distance: 22.468ms (max: 5s)
       Offset: -2.870ms
        Delay: 15.786ms
       Jitter: 3.893ms
 Packet count: 3
    Frequency: +25.176ppm

# zmiana 
sudo mkdir -p /etc/systemd/timesyncd.conf.d
sudo nano /etc/systemd/timesyncd.conf.d/10-ntp.conf
# wkleić
[Time]
NTP=0.pl.pool.ntp.org 1.pl.pool.ntp.org 2.pl.pool.ntp.org 3.pl.pool.ntp.org
FallbackNTP=

sudo systemctl restart systemd-timesyncd

# po zmianach
       Server: 91.212.242.20 (0.pl.pool.ntp.org)
Poll interval: 1min 4s (min: 32s; max 34min 8s)
         Leap: normal
      Version: 4
      Stratum: 2
    Reference: C292FB64
    Precision: 2us (-19)
Root distance: 40.931ms (max: 5s)
       Offset: -2.037ms
        Delay: 10.939ms
       Jitter: 0
 Packet count: 1
    Frequency: +9.257ppm

sudo nano /root/.bash_profile

# Load ~/.bashrc if present (interactive settings)
if [ -f ~/.bashrc ]; then
  . ~/.bashrc
fi

sudo nano /root/.bashrc

# -------------------------------
# Root bash history - extended + timestamps + safe append
# -------------------------------

# Where to store history
export HISTFILE="$HOME/.bash_history"

# Make history very long (in memory + on disk)
export HISTSIZE=200000
export HISTFILESIZE=500000

# Timestamp format: "2026-02-19 15:10:15 "
# NOTE: timestamp is stored internally and shown by `history`
export HISTTIMEFORMAT="%F %T "

# Append (do not overwrite) and keep clean history behavior
shopt -s histappend          # append to HISTFILE, don't overwrite
shopt -s cmdhist             # multi-line commands as one entry

# Avoid useless duplicates + ignore commands starting with space
# ignoreboth = ignorespace + ignoredups
export HISTCONTROL="ignoreboth:erasedups"

# Optional: ignore some noisy commands (tweak to taste)
export HISTIGNORE="ls:ll:la:pwd:cd:cd -:exit:history:clear:reset:fg:bg:jobs"

# Save after EVERY command, and also reload new lines from disk.
# This is important when you have multiple root SSH sessions.
PROMPT_COMMAND='history -a; history -n'

# (Optional but often useful) Add "checkwinsize" so terminal size updates
shopt -s checkwinsize

# Pakiety bazowe
sudo apt update
sudo apt -y full-upgrade
sudo apt -y install curl ca-certificates tzdata openssh-server perl
sudo systemctl enable --now ssh

# Dodaj repo GitLab
curl -fsSL https://packages.gitlab.com/install/repositories/gitlab/gitlab-ce/script.deb.sh | sudo bash

# Na start ustawimy HTTPS i domenę:
sudo EXTERNAL_URL="https://gitlab.okdlab.local" apt -y install gitlab-ce
# Po instalacji:
sudo gitlab-ctl status

There was an error running gitlab-ctl reconfigure:

letsencrypt_certificate[gitlab.okdlab.local] (letsencrypt::http_authorization line 6) had an error: Acme::Client::Error::RejectedIdentifier: acme_certificate[staging] (letsencrypt::http_authorization line 60) had an error: Acme::Client::Error::RejectedIdentifier: Invalid identifiers requested :: Cannot issue for "gitlab.okdlab.local": Domain name does not end with a valid public suffix (TLD)

sudo nano /etc/gitlab/gitlab.rb

# ustawić te 2 linie
letsencrypt['enable'] = false
letsencrypt['auto_renew'] = false

sudo mkdir -p /etc/gitlab/ssl
sudo chmod 700 /etc/gitlab/ssl

# Ustal IP GitLaba (żeby dać SAN = DNS + IP)
ip -4 addr show | egrep -o 'inet 192\.168\.40\.[0-9]+' | awk '{print $2}' | head -n1

sudo nano /etc/gitlab/ssl/gitlab.okdlab.local-openssl.cnf

[ req ]
default_bits       = 4096
prompt             = no
default_md         = sha256
distinguished_name = dn
req_extensions     = req_ext

[ dn ]
C  = PL
ST = OKDLab
L  = OKDLab
O  = OKDLab
OU = DevOps
CN = gitlab.okdlab.local

[ req_ext ]
subjectAltName = @alt_names
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth

[ alt_names ]
DNS.1 = gitlab.okdlab.local
IP.1 = 192.168.40.35

cd /etc/gitlab/ssl

# Wygeneruj klucz i cert (self-signed z SAN)
sudo openssl req -x509 -nodes -days 825 -newkey rsa:4096 \
  -keyout gitlab.okdlab.local.key \
  -out gitlab.okdlab.local.crt \
  -config gitlab.okdlab.local-openssl.cnf \
  -extensions req_ext

# Sprawdź, czy SAN jest obecny
openssl x509 -in /etc/gitlab/ssl/gitlab.okdlab.local.crt -noout -text | egrep -i 'Subject:|Subject Alternative|DNS:|IP Address'

# Upewnij się, że GitLab ma wyłączony Let’s Encrypt i wskazuje na te pliki
sudo nano /etc/gitlab/gitlab.rb
#U pewnij się, że masz:
external_url "https://gitlab.okdlab.local"
nginx['ssl_certificate'] = "/etc/gitlab/ssl/gitlab.okdlab.local.crt"
nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/gitlab.okdlab.local.key"

sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart
sudo gitlab-ctl status

sudo gitlab-ctl status
run: alertmanager: (pid 18947) 16s; run: log: (pid 18720) 48s
run: gitaly: (pid 17521) 705s; run: log: (pid 16528) 839s
run: gitlab-exporter: (pid 18904) 18s; run: log: (pid 18632) 67s
run: gitlab-kas: (pid 16959) 830s; run: log: (pid 16988) 827s
run: gitlab-workhorse: (pid 17498) 705s; run: log: (pid 17201) 749s
run: logrotate: (pid 15916) 854s; run: log: (pid 15930) 853s
run: nginx: (pid 18886) 19s; run: log: (pid 17229) 745s
run: node-exporter: (pid 18896) 19s; run: log: (pid 18605) 75s
run: postgres-exporter: (pid 18959) 16s; run: log: (pid 18761) 43s
run: postgresql: (pid 16580) 836s; run: log: (pid 16829) 833s
run: prometheus: (pid 18923) 17s; run: log: (pid 18687) 55s
run: puma: (pid 18835) 33s; run: log: (pid 17079) 761s
run: redis: (pid 16264) 848s; run: log: (pid 16479) 845s
run: redis-exporter: (pid 18909) 18s; run: log: (pid 18656) 63s
run: sidekiq: (pid 18775) 40s; run: log: (pid 17132) 755s

sudo cat /etc/gitlab/initial_root_password

curl -kI https://gitlab.okdlab.local

HTTP/2 302
server: nginx
date: Thu, 18 Feb 2026 17:15:11 GMT
content-type: text/html; charset=utf-8
content-length: 0
location: https://gitlab.okdlab.local/users/sign_in
cache-control: no-cache
content-security-policy:
nel: {"max_age": 0}
permissions-policy: interest-cohort=()
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-gitlab-meta: {"correlation_id":"01KHV42E1CRJ183T93RA1PW197","version":"1"}
x-permitted-cross-domain-policies: none
x-request-id: 01KHV42E1CRJ183T93RA1PW197
x-runtime: 0.070672
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block
strict-transport-security: max-age=63072000
referrer-policy: strict-origin-when-cross-origin

# na maszynie bastion
scp [email protected]:/etc/gitlab/ssl/gitlab.okdlab.local.crt /tmp/gitlab.okdlab.local.crt
sudo cp /tmp/gitlab.okdlab.local.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

# Sprawdź, czy system ufa certowi
curl -I https://gitlab.okdlab.local

# w raazie problemów
# fatal: unable to access 'https://gitlab.okdlab.local/dev-ops/healthlog-gui.git/': SSL certificate problem: self-signed certificate
# * SSL certificate problem: self-signed certificate

mkdir -p "$HOME/.certs"

echo | openssl s_client -connect gitlab.okdlab.local:443 -servername gitlab.okdlab.local 2>/dev/null \
  | openssl x509 -outform PEM > "$HOME/.certs/gitlab-okdlab-ca.crt"

chmod 0644 "$HOME/.certs/gitlab-okdlab-ca.crt"

ls -l "$HOME/.certs/gitlab-okdlab-ca.crt"
head -n 2 "$HOME/.certs/gitlab-okdlab-ca.crt"
tail -n 2 "$HOME/.certs/gitlab-okdlab-ca.crt"
curl --cacert "$HOME/.certs/gitlab-okdlab-ca.crt" -Iv https://gitlab.okdlab.local 2>&1 | egrep -i 'verify|error'
cd /repo/git/healthlog-gui

git config --local http.sslCAInfo "$HOME/.certs/gitlab-okdlab-ca.crt"
git config --local http.sslVerify true

git config --local --get http.sslCAInfo
git push

cd /repo/git/healthlog-gui

cat > .gitignore <<'EOF'
# OS/editor
.DS_Store
*.swp
*.swo
*.bak
.idea/
.vscode/

# Logs
*.log

# Local env
.env
EOF

cd /repo/git/healthlog-gui

git init -b main
git config --local user.name "Jan Kowalski"
git config --local user.email "[email protected]"
git remote add origin https://gitlab.okdlab.local/dev-ops/healthlog-gui.git
git add .
git commit -m "Initial import: healthlog gui (code + helm + env values)"
git push -u origin main

sudo dnf install -y git-credential-libsecret libsecret
git config --global credential.helper /usr/libexec/git-core/git-credential-libsecret

# po pierwszym commit zostanie zapisane hasło i login na stałe, np.
git add kustomize/overlays/dev/values-dev.yaml
git commit -m "dev: deploy image <tag>"
git push

# Potem 1 raz podajesz login+PAT i przez 8h masz spokój.
git config --global credential.helper 'cache --timeout=28800'

ssh-keygen -t ed25519 -C "[email protected]"
at ~/.ssh/id_ed25519.pub

git remote -v
git remote set-url origin [email protected]:dev-ops/healthlog-gui.git
ssh -T [email protected]
git push