SRE / instance administrator

Use case: an SRE or instance administrator manages instance-level settings — application settings, system hooks, instance CI/CD variables, and topics — as code, with an admin-scoped personal access token. The role runs from the control node against the GitLab API; no connection to the GitLab host itself is needed for the default api backend, and strict mode fails loudly on anything that cannot be applied.

ansible-playbook -i localhost, examples/instance-sre.yml

Source: examples/instance-sre.yml

---
# Persona: SRE / instance administrator.
# Scope: instance-level settings, applied with an admin-scoped token.
#
#   ansible-playbook -i localhost, examples/instance-sre.yml
#
# The role runs from the control node against the GitLab API — no connection to
# the GitLab host itself is needed for the default (api) backend.
- name: Converge GitLab instance settings
  hosts: localhost
  gather_facts: false
  connection: local
  vars:
    gitlab_settings_target:
      url: https://gitlab.example.com
      # Store the token in Ansible Vault, not in plaintext.
      auth:
        type: personal_access_token
        token: "{{ vault_gitlab_admin_token }}"
  tasks:
    - name: Apply instance settings
      ansible.builtin.include_role:
        name: primetheus.gitlab_settings
        tasks_from: apply
      vars:
        # backend defaults to `api` ([rest, graphql]) — the protocol is chosen
        # per resource, and strict mode is the default for production.
        gitlab_settings_resource: instance
        gitlab_settings_instance:
          application:
            account:
              signup_enabled: false
              require_admin_approval_after_user_signup: true
            defaults:
              default_project_visibility: private
              default_branch_name: main
            rate_limits:
              throttle_authenticated_api_enabled: true
              throttle_authenticated_api_requests_per_period: 7200
          system_hooks:
            - name: audit-sink
              url: https://siem.example.com/hooks/gitlab
              token: "{{ vault_system_hook_token }}"
              push_events: true
              repository_update_events: true
          ci_variables:
            - key: INSTANCE_DEPLOY_TOKEN
              value: "{{ vault_instance_deploy_token }}"
              masked: true
              protected: true
          topics:
            - name: platform
            - name: security