GitLab test environment — teardown

A disposable GitLab CE test environment was built on rumba on 2026-07-31/08-01 to evaluate GitLab as a service (repos, API, CI runners, Pages). It proved: repo hosting + clone/push, a CI pipeline building this very site with Bun, GitLab Pages serving it, and runners both in-container and in a dedicated VM. Everything below is meant to be destroyed once the evaluation is over — this page is the checklist, written so the teardown can be done from any admin machine (VPN + pmudry's SSH key are enough; router password in the secretzone).

What exists (August 2026)

Piece	Where	Notes
srv-gitlab (LXC 105, 192.168.88.155)	rumba	GitLab CE 19.2.1 Omnibus, http://srv-gitlab.calypso. Holds a copy of this repo including the secretzone, a full-rights API token, the paused container runner, and the Pages deployments
srv-runner01 (VM 106, 192.168.88.156)	rumba	Debian 13 cloud-image VM, 24 vCPU / 64 GB, shell-executor gitlab-runner (concurrent = 4) — the active runner
5 static DNS entries	CCR2004	srv-gitlab, srv-gitlab.calypso, srv-runner01, srv-runner01.calypso, dc-isc-fcdb15.pages.calypso — all comment~"docs-sync 2026-07-31" or 2026-08-01, all → .155/.156
Cloud image	rumba /root/.cache/debian-13-genericcloud-amd64.qcow2	328 MB, keep if more VMs are planned
Docs rows	this repo	see step 4

Deliberately not created (nothing to undo): no public DNS, no srv-web01 Caddy vhost, no router port/NAT change — the whole thing is VPN-only.

Teardown steps

1. Destroy the guests — this also disposes of the secretzone copy, the API token, both runner registrations and all Pages/artifact data; nothing on them is worth preserving:

   ssh root@rumba "pct stop 105 && pct destroy 105"
   ssh root@rumba "qm stop 106 && qm destroy 106"

2. Remove the DNS entries on the CCR2004 (password in secretzone/calypso.md) — print first, then remove, per the scripting trap:

   /ip dns static print where address=192.168.88.155 or address=192.168.88.156
   /ip dns static remove [find where address=192.168.88.155]
   /ip dns static remove [find where address=192.168.88.156]

3. Refresh the router export per MikroTik backup and commit it.

4. Clean the docs: in rumba.md drop the CT 105 / VM 106 rows, the "except srv-runner01" wording and the at-a-glance mention; in secretzone/rumba.md drop the srv-gitlab section; delete this page and its sidebars.ts entry.

5. Optional: delete /root/.cache/debian-13-genericcloud-amd64.qcow2 on rumba if no other VM is planned.

No token revocation is needed if step 1 ran: the token lives in the destroyed instance. If the instance is instead kept, revoke the full-rights token (GitLab → root → Access tokens) and unpause or remove runners as wanted.

If GitLab is kept for real some day

The test validated the mechanics, but a permanent instance should differ: put the runner's executor in Docker or its own guest (a shell executor on the GitLab host runs any pushed code as a local user), publish through srv-web01 with a real isc-vs.ch name instead of HTTP-only .calypso names, and use a wildcard DNS entry (match-subdomain=yes) for Pages instead of one entry per project's unique domain.