Article · By Sashree Seepersad · 20 October 2026
Self-hosted GitLab CE: what, why, where, and how
The forge for this practice is GitLab Community Edition on a machine I operate. It is not GitLab.com, and it is not this website. This page is the public note. The repositories stay on the mesh.
What
GitLab CE is the Community Edition, the omnibus distribution: one install that runs Git, merge requests, CI, and a container registry together. The process list on the box is the omnibus set. Gitaly stores the repositories. Workhorse and Puma serve the application. Sidekiq runs the background jobs. Postgres and Redis stay inside the same install. A GitLab Runner on that same machine runs the pipelines, so a job does not leave for a shared runner fleet.
The names are git.neplusultra.eu for the application and registry.neplusultra.eu for the images. Both are names on the estate, not accounts on someone else’s forge.
Why
A hosted Git service holds the history, the CI credentials, and the images. That is another operator. The same test I use for a cloud exit applies here: if the baseline can only be read by asking the vendor, the estate has not left. Source is part of that baseline.
Self-hosting CE keeps three things in one place I can inspect. The repositories. The pipelines that build them. The registry that stores the result. When an engagement ends, the forge does not end with a SaaS subscription.
Where
The install sits on an OVH VPS, the second node of the WireGuard mesh. This website, sashreeseepersad.com, is a static site on the hub. GitLab is not published here. A browser on the public internet that asks for git.neplusultra.eu receives a mesh-required refusal from the hub. Operators reach the forge over WireGuard.
TLS on that name is a Let’s Encrypt certificate. The key agreement negotiated from the hub is the hybrid group X25519MLKEM768, so the session key is not only elliptic curve. The certificate signature itself is still classical. No public CA is issuing post-quantum certificates yet.
How
- 1Ubuntu on the OVH node
- 2Omnibus in rootless Podman
- 3Runner on the same host
- 4Hub Caddy, mesh only
- The node. Ubuntu 24.04 on the OVH VPS. GitLab is a workload on that node, next to the other estate services, not a separate SaaS tenant.
- The install. GitLab CE omnibus runs as a rootless Podman container. Rootless means the forge does not need a privileged daemon on the host to exist. The omnibus image brings Gitaly, Workhorse, Puma, Sidekiq, Postgres, Redis, nginx, and the registry with it.
- The runner. GitLab Runner is a service on the same host. Pipelines execute where the repositories already are.
- The front door. Caddy on the hub terminates TLS for git.neplusultra.eu and the registry name, and it only forwards a client that is already on the mesh. The public website and the forge stay on different machines on purpose.
The forge is part of the estate. The website can describe it. The website does not host it.