CDKでセルフマネージドGitlabの検証環境を構築するときにハマったこと

			
			.
├── README.md
├── bin
├── cdk.context.json
├── cdk.json
├── cdk.out
├── jest.config.js
├── lib
│   └── demo-self-managed-gitlab-stack.ts
├── node_modules
├── package-lock.json
├── package.json
├── parameters.example.ts
├── parameters.ts
├── scripts
│   └── gitlab-setup.sh
└── tsconfig.json


		

			
			export interface GitLabParameters {
  domainName: string;           // GitLabのドメイン名
  certificateArn: string;      // 既存のSSL証明書ARN（AWS Certificate Manager）
}

// 実際のパラメータを設定してください
export const parameters: GitLabParameters = {
  domainName: 'your-domain.example.com',     // ⚠️ 実際のドメイン名に変更してください
  certificateArn: 'arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012',  // ⚠️ 実際の証明書ARNに変更してください
};

		

			
			#!/bin/bash
set -e

# システムアップデート
dnf update -y

# GitLab公式リポジトリを追加
curl "https://packages.gitlab.com/install/repositories/gitlab/gitlab-ce/script.rpm.sh" | bash

# GitLab CEをインストール
export EXTERNAL_URL="http://${DOMAIN_NAME}"

dnf install -y gitlab-ce

# GitLab設定ファイルを作成
cat >> /etc/gitlab/gitlab.rb << EOF
nginx['listen_port'] = 80
nginx['listen_https'] = false
EOF

# GitLab設定実行
gitlab-ctl reconfigure # >>>>>>>>> 問題発生箇所 <<<<<<<<<<

# GitLabの初期rootパスワードを取得してSecrets Managerに保存
if [ -f "/etc/gitlab/initial_root_password" ]; then
  ROOT_PASSWORD=$(grep '^Password:' /etc/gitlab/initial_root_password | sed 's/^Password: //')
  if [ -n "$ROOT_PASSWORD" ]; then
    aws secretsmanager put-secret-value --secret-id "${SECRET_ARN}" --secret-string "{\"username\":\"root\",\"password\":\"$ROOT_PASSWORD\"}" --region "ap-northeast-1"
  fi
fi

		

			
			sh-5.2$ sudo tail -f /var/log/cloud-init-output.log

.
.
.
    - execute systemctl daemon-reload
[2025-09-17T01:47:05+00:00] INFO: template[/usr/lib/systemd/system/gitlab-runsvdir.service] sending run action to execute[systemctl enable gitlab-runsvdir] (immediate)
  * execute[systemctl enable gitlab-runsvdir] action run
    [execute] Created symlink /etc/systemd/system/multi-user.target.wants/gitlab-runsvdir.service → /usr/lib/systemd/system/gitlab-runsvdir.service.
[2025-09-17T01:47:05+00:00] INFO: execute[systemctl enable gitlab-runsvdir] ran successfully
    - execute systemctl enable gitlab-runsvdir
[2025-09-17T01:47:05+00:00] INFO: template[/usr/lib/systemd/system/gitlab-runsvdir.service] sending run action to execute[systemctl start gitlab-runsvdir] (immediate)
  * execute[systemctl start gitlab-runsvdir] action run  # ここで一生進まない

		

			
			systemctl status gitlab-runsvdir
  ○ gitlab-runsvdir.service - GitLab Runit supervision process
     Loaded: loaded (/usr/lib/systemd/system/gitlab-runsvdir.service;
   enabled; preset: disabled)
     Active: inactive (dead)

		

			
			sudo cat /usr/lib/systemd/system/gitlab-runsvdir.service

[Unit]
Description=GitLab Runit supervision process
After=multi-user.target

[Service]
Slice=gitlab.slice
Delegate=memory cpu
ExecStart=/opt/gitlab/embedded/bin/runsvdir-start
Restart=always
TasksMax=4915

[Install]
WantedBy=multi-user.target

		

			
			sudo cat /opt/gitlab/embedded/bin/runsvdir-start

#!/bin/bash
#
# Copyright 2012-2025 Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

PATH=/opt/gitlab/bin:/opt/gitlab/embedded/bin:/usr/local/bin:/usr/local/sbin:/bin:/sbin:/usr/bin:/usr/sbin

ulimit -c 0
ulimit -d unlimited
ulimit -e 0
ulimit -f unlimited
ulimit -i 62793
ulimit -l 64
ulimit -m unlimited
# WARNING: Increasing the global file descriptor limit increases RAM
# consumption on startup dramatically!
ulimit -n 50000
ulimit -q 819200
ulimit -r 0
ulimit -s 10240
ulimit -t unlimited
ulimit -u unlimited
ulimit -v unlimited
ulimit -x unlimited
echo "1000000" > /proc/sys/fs/file-max

umask 022

exec env - PATH=$PATH \
runsvdir -P /opt/gitlab/service 'log: ...........................................................................................................................................................................................................................................................................................................................................................................................................'

		

			
			ls -la /opt/gitlab/service/
total 16
drwxr-xr-x.  2 root root     6 Sep 17 06:55 .
drwxr-xr-x. 10 root root 16384 Sep 24 01:50 ..

		

			
			sudo systemctl list-dependencies

default.target
○ ├─display-manager.service
○ ├─systemd-update-utmp-runlevel.service
○ └─multi-user.target
●   ├─amazon-ssm-agent.service
●   ├─atd.service
●   ├─auditd.service
●   ├─chronyd.service
○   ├─gitlab-runsvdir.service # 起動に失敗している
○   ├─hibinit-agent.service
●   ├─irqbalance.service
●   ├─libstoragemgmt.service
●   ├─sshd.service
○   ├─sssd.service
●   ├─sysstat.service
●   ├─systemd-ask-password-wall.path
●   ├─systemd-homed.service
●   ├─systemd-logind.service
●   ├─systemd-networkd.service
○   ├─systemd-update-utmp-runlevel.service
●   ├─systemd-user-sessions.service
○   ├─update-motd.service
●   ├─basic.target
●   │ ├─-.mount
○   │ ├─rpmdb-rebuild.service
●   │ ├─tmp.mount
●   │ ├─paths.target
●   │ ├─slices.target
●   │ │ ├─-.slice
●   │ │ └─system.slice
●   │ ├─sockets.target
●   │ │ ├─dbus.socket
●   │ │ ├─sssd-kcm.socket
●   │ │ ├─systemd-coredump.socket
●   │ │ ├─systemd-initctl.socket
●   │ │ ├─systemd-journald-audit.socket
●   │ │ ├─systemd-journald-dev-log.socket
●   │ │ ├─systemd-journald.socket
●   │ │ ├─systemd-networkd.socket
●   │ │ ├─systemd-udevd-control.socket
●   │ │ ├─systemd-udevd-kernel.socket
●   │ │ └─systemd-userdbd.socket
●   │ ├─sysinit.target
●   │ │ ├─dev-hugepages.mount
●   │ │ ├─dev-mqueue.mount
●   │ │ ├─dracut-shutdown.service
○   │ │ ├─import-state.service
●   │ │ ├─kmod-static-nodes.service
○   │ │ ├─ldconfig.service
●   │ │ ├─proc-sys-fs-binfmt_misc.automount
○   │ │ ├─selinux-autorelabel-mark.service
●   │ │ ├─sys-fs-fuse-connections.mount
●   │ │ ├─sys-kernel-config.mount

		

			
			systemctl list-jobs
JOB  UNIT                                 TYPE  STATE
199  cloud-init.target                    start waiting
225  systemd-update-utmp-runlevel.service start waiting
250  update-motd.service                  start waiting
110  multi-user.target                    start waiting
109  graphical.target                     start waiting
1307 gitlab-runsvdir.service              start waiting
214  cloud-final.service                  start running

		

			
			systemctl list-dependencies --reverse cloud-final.service
cloud-final.service
○ ├─update-motd.service
○ └─cloud-init.target
○   └─multi-user.target
○     └─graphical.target

		

			
			#!/bin/bash
set -e

# システムアップデートと基本依存関係のインストール
dnf update -y
dnf install -y policycoreutils-python-utils openssh-server openssh-clients perl wget

# GitLab公式リポジトリを追加
curl "https://packages.gitlab.com/install/repositories/gitlab/gitlab-ce/script.rpm.sh" | bash

# GitLab CEをインストール
dnf install -y gitlab-ce

# GitLab設定ファイルに追記
cat >> /etc/gitlab/gitlab.rb << EOF

# GitLab基本設定
external_url 'http://${DOMAIN_NAME}'
nginx['listen_port'] = 80
nginx['listen_https'] = false

# AWS EC2 UserData環境でのsystemdターゲット競合を回避
package['systemd_after'] = 'basic.target'
package['systemd_wanted_by'] = 'basic.target'
EOF

# GitLab設定を適用
gitlab-ctl reconfigure

# GitLabの初期rootパスワードを取得してSecrets Managerに保存
if [ -f "/etc/gitlab/initial_root_password" ]; then
  ROOT_PASSWORD=$(grep '^Password:' /etc/gitlab/initial_root_password | sed 's/^Password: //')
  if [ -n "$ROOT_PASSWORD" ]; then
    aws secretsmanager put-secret-value --secret-id "${SECRET_ARN}" --secret-string "{\"username\":\"root\",\"password\":\"$ROOT_PASSWORD\"}" --region "ap-northeast-1"
  fi
fi


		

			
			# AWS EC2 UserData環境でのsystemdターゲット競合を回避
package['systemd_after'] = 'basic.target'
package['systemd_wanted_by'] = 'basic.target'