Step 1 – Verify GitLab Works

Your server’s IP address and root password are shown in the Server Information section on the Overview tab of your server in the client portal. The application settings you entered when ordering, passwords included, are shown in the GitLab Credentials card on the same tab. GitLab is available after the initial setup completes (2 – 4 minutes after server creation). Open https://your.server.ip in a browser to verify it works. If you see a 502 error, wait a few minutes and refresh – GitLab is still starting up.

GitLab login:

• Username: root
• Password: the GitLab Root Password you entered during the order

HTTPS without a domain. When your server is created it requests a Let’s Encrypt certificate for its own IP address, and GitLab switches to https://your.server.ip with no browser warning (http redirects to https). The certificate is short-lived (about six days) and renews automatically. If it could not be issued – for example, the server is behind a router or port 80 is closed from the internet – GitLab stays on http://your.server.ip. The welcome message at SSH login always shows the current address.

GitLab rejects passwords made of common words (for example, containing “gitlab”). If it rejected the password from your order, the Overview tab of your server shows a warning that the application setup did not finish: connect via SSH – the welcome message shows a temporary root password; sign in with it and set your own in User settings > Password and authentication.

Anyone can open the registration form, but new accounts stay blocked until you approve them (Admin area > Users > Pending approval) – team members sign up themselves, and you decide who gets access.

If you placed the server behind a VyOS router on a private network, the server has only a private address, so it does not get the IP certificate, and GitLab is set up for that private address. You can open GitLab over http:// on the private address through a VPN on the router (WireGuard or OpenVPN, on the router’s Configuration tab). To make GitLab reachable from the internet, forward ports 80 and 443 to the server on the router’s Configuration tab (Port forwarding), point your domain to the router’s public address and connect the domain (Step 3): until then, GitLab’s links point to the private address. Forward port 22 as well to push and pull over SSH from the internet.

Firewall. If you turn on the Firewall for this server in the client portal, allow incoming TCP port 80 in its rules, along with 443 (HTTPS) and 22 for Git over SSH. Certificates renew over port 80 – the IP certificate every few days – and without that rule the certificate expires and the browser starts showing a warning.

Step 2 – Create Your First Project

After your first sign-in GitLab opens Create your first project: enter a group name and a project name and click Continue (or Skip and create projects later with New project on the dashboard).

Clone your repository using HTTPS or SSH:

# HTTPS
git clone https://your.server.ip/root/my-project.git

# SSH (add your public key in User settings > SSH keys first)
git clone git@your.server.ip:root/my-project.git

Step 3 – Set Up a Custom Domain and HTTPS

To move GitLab to your own domain with a free Let’s Encrypt certificate:

1. Create a DNS A record pointing your domain to the server IP:

   Type	Name	Value
   A	gitlab	your.server.ip

2. SSH into your server and run (the email is optional, Let’s Encrypt uses it for expiry notices):

   /opt/setup/get-ssl.sh gitlab.yourdomain.com you@yourdomain.com

   The command obtains the certificate, switches GitLab to https://gitlab.yourdomain.com and sets up automatic renewal. It takes about two minutes. If the certificate cannot be issued, GitLab stays on its current address and the reason is written to /opt/setup/get-ssl.log.

Make sure your domain’s A record is propagated before running the command. DNS changes usually take a few minutes, but can take up to 24 hours. Check at dnschecker.org.

Step 4 – CI/CD Pipelines

GitLab has built-in CI/CD. To create a pipeline, add a .gitlab-ci.yml file to your repository root:

stages:
  - build
  - test

build-job:
  stage: build
  script:
    - echo "Building the project..."

test-job:
  stage: test
  script:
    - echo "Running tests..."

Pipelines run automatically on each push. View results in your project under Build > Pipelines.

Note: To run pipelines, you need to register a GitLab Runner. Follow the GitLab Runner installation guide to set up a runner on this server or a separate machine.

Fail2Ban – Brute-Force Protection

Your server comes with Fail2Ban pre-configured to protect SSH from brute-force attacks.

Useful commands:

# Check banned IPs
fail2ban-client status sshd

# Unban an IP
fail2ban-client set sshd unbanip 1.2.3.4

GitLab also has its own brute-force protection for web logins. If you accidentally lock yourself out, open the Console on your server’s Overview tab in the client portal and unban your IP.

Updates

Important: GitLab CE does not update automatically (blocked from unattended upgrades). GitLab must be updated through specific intermediate versions – skipping versions can break your instance.

Always check the official upgrade path before updating. To update:

# Check current version
gitlab-rake gitlab:env:info | grep "GitLab"

# Update to a specific version (follow the upgrade path!)
apt update
apt install gitlab-ce=X.Y.Z-ce.0

# Apply changes
gitlab-ctl reconfigure

OS updates can be applied via SSH:

apt update && apt upgrade -y

Server Credentials

The GitLab login is root with the password from your order; it is not stored on the server. The welcome message at SSH login shows the GitLab address. If the setup did not finish, /root/.gitlab_credentials and the welcome message hold a temporary root password instead.

Service Management

GitLab Omnibus bundles all services (Nginx, PostgreSQL, Redis, Puma, Sidekiq) under the gitlab-ctl command:

# Service management
gitlab-ctl status              # check all services
gitlab-ctl restart             # restart all services
gitlab-ctl start               # start all services
gitlab-ctl stop                # stop all services

# Configuration
gitlab-ctl reconfigure         # apply changes from gitlab.rb

# Logs
gitlab-ctl tail                # live log output (all services)
gitlab-ctl tail nginx          # Nginx logs only
gitlab-ctl tail puma           # application server logs

# Backups
gitlab-backup create           # create data backup
gitlab-ctl backup-etc          # backup configuration files

# Reset root password (asks for the new password twice)
gitlab-rake "gitlab:password:reset[root]"

Software Included

• GitLab Documentation: docs.gitlab.com
• GitLab CI/CD Guide: docs.gitlab.com/ee/ci
• GitLab Upgrade Guide: docs.gitlab.com/ee/update