setting up ci/cd with gitlab runner

assuming a dedicated system and shell executor

install shell executor

install and register a new runner

wget -O - "https://packages.gitlab.com/install/repositories/runner/gitlab-runner/script.deb.sh" | bash
apt install gitlab-runner
systemctl status gitlab-runner # enabled

notice the gitlab-runner user got created

date
ls -lF /home/

register runner

grab some TOKEN from the gitlab server

SHARED (aka instance runner)

admin area > ci/cd > runners
    ==> new instance runner

admin area > settings > ci/cd > runners

GROUP (aka group runner)

groups > (choose group) > build / runners
    ==> new group runner with tag "runner1"

groups > (choose group) > settings / ci/cd > runners

SPECIFIC (aka project runner)

projects > (choose project) > settings > ci/cd / runners
    ==> new project runner

you can also review all kinds of runners at once from the admin area

admin area > ci/cd > runners

on the runner node

make sure you’ve got name resolution against the gitlab server

host gitlab.domain.tld

eventually fix the route towards its internal IP, in case DNS views aren’t done right

vi /etc/hosts

x.x.x.x gitlab.domain.tld

and check that it is reachable

nmap -p 443 gitlab.domain.tld

and proceed

# as provided from the step above
gitlab-runner register --url ... --token ...

executor: shell

Setup

trigger a test-run from your workstation

git clone PROJECT-URL
cd PROJECT/
vi .gitlab-ci.yml

stages:
  - deploy

deploy prod:
  stage: deploy
  script:
    - echo TEST OK
  only:
    #- master
    - main
  tags:
    - runner1

git add .gitlab-ci.yml
git commit -m "test ci/cd"
git push

ready to go

on the runner node

su - gitlab-runner

ssh-keygen -t ed25519
cat .ssh/id_ed25519.pub

now allow that user to reach the target servers e.g. as user runner

some target host

useradd -m -g users -s /bin/bash runner

# unlock the freaking user - the right way
apt update && apt install pwgen
pass=`pwgen -n -y -s -B -1 16 1`
echo $pass
echo -n unlocking runner user the right way ...
echo "runner:$pass" | chpasswd && echo done || echo FAIL
unset pass

cd /home/runner/
mkdir .ssh/
cat > .ssh/authorized_keys <<EOF
THE PUBLIC KEY FROM ABOVE
EOF
chown -R runner:users .ssh/
chmod 700 .ssh/
chmod 600 .ssh/authorized_keys

cp -pi /etc/sudoers /etc/sudoers.dist
echo "runner ALL= (ALL) NOPASSWD: ALL" >> /etc/sudoers

and check – take the chance to record target’s host keys

back to the runner system, as gitlab-runner user

vi ~/.ssh/config

host TARGET-SERVER
        hostname x.x.x.x
        port xxxx
        identityfile ~/.ssh/id_ed25519
        user runner

ssh TARGET-SERVER