nixos: Add gitlab and gitlab-shell

I had to make several adjustments to make it work with nixos:

* Replace relative config file lookups with ENV variable.
* Modify gitlab-shell to not clear then environment when running
  pre-receive.
* Modify gitlab-shell to write some environment variables into
  the .authorized_keys file to make sure gitlab-shell reads the
  correct config file.
* Log unicorn output to syslog.
  I tried various ways of adding a syslog package but the bundler would
  not pick them up. Please fix in a better way if possible.
* Gitlab-runner program wrapper.
  This is useful to run e.g. backups etc. with the correct
  environment set up.

nixos/modules/misc/ids.nix

@@ -172,6 +172,7 @@
       kubernetes = 162;
       peerflix = 163;
       chronos = 164;
+      gitlab = 165;
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 
@@ -308,6 +309,7 @@
       bosun = 157;
       kubernetes = 158;
       fleet = 159;
+      gitlab = 160;
 
       # When adding a gid, make sure it doesn't match an existing uid. And don't use gids above 399!
 

nixos/modules/module-list.nix

@@ -176,6 +176,7 @@
   ./services/misc/etcd.nix
   ./services/misc/felix.nix
   ./services/misc/folding-at-home.nix
+  ./services/misc/gitlab.nix
   ./services/misc/gitolite.nix
   ./services/misc/gpsd.nix
   ./services/misc/mesos-master.nix

nixos/modules/services/misc/defaultUnicornConfig.rb

@@ -0,0 +1,206 @@
+# The following was taken from github.com/crohr/syslogger and is BSD
+# licensed.
+require 'syslog'
+require 'logger'
+require 'thread'
+
+class Syslogger
+
+  VERSION = "1.6.0"
+
+  attr_reader :level, :ident, :options, :facility, :max_octets
+  attr_accessor :formatter
+
+  MAPPING = {
+    Logger::DEBUG => Syslog::LOG_DEBUG,
+    Logger::INFO => Syslog::LOG_INFO,
+    Logger::WARN => Syslog::LOG_WARNING,
+    Logger::ERROR => Syslog::LOG_ERR,
+    Logger::FATAL => Syslog::LOG_CRIT,
+    Logger::UNKNOWN => Syslog::LOG_ALERT
+  }
+
+  #
+  # Initializes default options for the logger
+  # <tt>ident</tt>:: the name of your program [default=$0].
+  # <tt>options</tt>::  syslog options [default=<tt>Syslog::LOG_PID | Syslog::LOG_CONS</tt>].
+  #                     Correct values are:
+  #                       LOG_CONS    : writes the message on the console if an error occurs when sending the message;
+  #                       LOG_NDELAY  : no delay before sending the message;
+  #                       LOG_PERROR  : messages will also be written on STDERR;
+  #                       LOG_PID     : adds the process number to the message (just after the program name)
+  # <tt>facility</tt>:: the syslog facility [default=nil] Correct values include:
+  #                       Syslog::LOG_DAEMON
+  #                       Syslog::LOG_USER
+  #                       Syslog::LOG_SYSLOG
+  #                       Syslog::LOG_LOCAL2
+  #                       Syslog::LOG_NEWS
+  #                       etc.
+  #
+  # Usage:
+  #   logger = Syslogger.new("my_app", Syslog::LOG_PID | Syslog::LOG_CONS, Syslog::LOG_LOCAL0)
+  #   logger.level = Logger::INFO # use Logger levels
+  #   logger.warn "warning message"
+  #   logger.debug "debug message"
+  #
+  def initialize(ident = $0, options = Syslog::LOG_PID | Syslog::LOG_CONS, facility = nil)
+    @ident = ident
+    @options = options || (Syslog::LOG_PID | Syslog::LOG_CONS)
+    @facility = facility
+    @level = Logger::INFO
+    @mutex = Mutex.new
+    @formatter = Logger::Formatter.new
+  end
+
+  %w{debug info warn error fatal unknown}.each do |logger_method|
+    # Accepting *args as message could be nil.
+    #  Default params not supported in ruby 1.8.7
+    define_method logger_method.to_sym do |*args, &block|
+      return true if @level > Logger.const_get(logger_method.upcase)
+      message = args.first || block && block.call
+      add(Logger.const_get(logger_method.upcase), message)
+    end
+
+    unless logger_method == 'unknown'
+      define_method "#{logger_method}?".to_sym do
+        @level <= Logger.const_get(logger_method.upcase)
+      end
+    end
+  end
+
+  # Log a message at the Logger::INFO level. Useful for use with Rack::CommonLogger
+  def write(msg)
+    add(Logger::INFO, msg)
+  end
+
+  # Logs a message at the Logger::INFO level.
+  def <<(msg)
+    add(Logger::INFO, msg)
+  end
+
+  # Low level method to add a message.
+  # +severity+::  the level of the message. One of Logger::DEBUG, Logger::INFO, Logger::WARN, Logger::ERROR, Logger::FATAL, Logger::UNKNOWN
+  # +message+:: the message string.
+  #             If nil, the method will call the block and use the result as the message string.
+  #             If both are nil or no block is given, it will use the progname as per the behaviour of both the standard Ruby logger, and the Rails BufferedLogger.
+  # +progname+:: optionally, overwrite the program name that appears in the log message.
+  def add(severity, message = nil, progname = nil, &block)
+    if message.nil? && block.nil? && !progname.nil?
+      message, progname = progname, nil
+    end
+    progname ||= @ident
+
+    @mutex.synchronize do
+      Syslog.open(progname, @options, @facility) do |s|
+        s.mask = Syslog::LOG_UPTO(MAPPING[@level])
+        communication = clean(message || block && block.call)
+        if self.max_octets
+          buffer = "#{tags_text}"
+          communication.bytes do |byte|
+            buffer.concat(byte)
+            # if the last byte we added is potentially part of an escape, we'll go ahead and add another byte
+            if buffer.bytesize >= self.max_octets && !['%'.ord,'\\'.ord].include?(byte)
+              s.log(MAPPING[severity],buffer)
+              buffer = ""
+            end
+          end
+          s.log(MAPPING[severity],buffer) unless buffer.empty?
+        else
+          s.log(MAPPING[severity],"#{tags_text}#{communication}")
+        end
+      end
+    end
+  end
+
+  # Set the max octets of the messages written to the log
+  def max_octets=(max_octets)
+    @max_octets = max_octets
+  end
+
+  # Sets the minimum level for messages to be written in the log.
+  # +level+:: one of <tt>Logger::DEBUG</tt>, <tt>Logger::INFO</tt>, <tt>Logger::WARN</tt>, <tt>Logger::ERROR</tt>, <tt>Logger::FATAL</tt>, <tt>Logger::UNKNOWN</tt>
+  def level=(level)
+    level = Logger.const_get(level.to_s.upcase) if level.is_a?(Symbol)
+
+    unless level.is_a?(Fixnum)
+      raise ArgumentError.new("Invalid logger level `#{level.inspect}`")
+    end
+
+    @level = level
+  end
+
+  # Sets the ident string passed along to Syslog
+  def ident=(ident)
+    @ident = ident
+  end
+
+  # Tagging code borrowed from ActiveSupport gem
+  def tagged(*tags)
+    new_tags = push_tags(*tags)
+    yield self
+  ensure
+    pop_tags(new_tags.size)
+  end
+
+  def push_tags(*tags)
+    tags.flatten.reject{ |i| i.respond_to?(:empty?) ? i.empty? : !i }.tap do |new_tags|
+      current_tags.concat new_tags
+    end
+  end
+
+  def pop_tags(size = 1)
+    current_tags.pop size
+  end
+
+  def clear_tags!
+    current_tags.clear
+  end
+
+  protected
+
+  # Borrowed from SyslogLogger.
+  def clean(message)
+    message = message.to_s.dup
+    message.strip! # remove whitespace
+    message.gsub!(/\n/, '\\n') # escape newlines
+    message.gsub!(/%/, '%%') # syslog(3) freaks on % (printf)
+    message.gsub!(/\e\[[^m]*m/, '') # remove useless ansi color codes
+    message
+  end
+
+  private
+
+  def tags_text
+    tags = current_tags
+    if tags.any?
+      tags.collect { |tag| "[#{tag}] " }.join
+    end
+  end
+
+  def current_tags
+    Thread.current[:syslogger_tagged_logging_tags] ||= []
+  end
+end
+
+worker_processes 2
+working_directory ENV["GITLAB_PATH"]
+pid ENV["UNICORN_PATH"] + "/tmp/pids/unicorn.pid"
+
+listen ENV["UNICORN_PATH"] + "/tmp/sockets/gitlab.socket", :backlog => 1024
+listen "127.0.0.1:8080", :tcp_nopush => true
+
+timeout 60
+
+logger Syslogger.new
+
+preload_app true
+
+GC.respond_to?(:copy_on_write_friendly=) and
+  GC.copy_on_write_friendly = true
+
+check_client_connection false
+
+after_fork do |server, worker|
+  defined?(ActiveRecord::Base) and
+    ActiveRecord::Base.establish_connection
+end

nixos/modules/services/misc/gitlab.nix

@@ -0,0 +1,283 @@
+{ config, lib, pkgs, ... }:
+
+# TODO: support non-postgresql
+
+with lib;
+
+let
+  cfg = config.services.gitlab;
+
+  ruby = pkgs.ruby;
+  rubyLibs = pkgs.rubyLibs;
+
+  databaseYml = ''
+    production:
+      adapter: postgresql
+      database: ${cfg.databaseName}
+      host: ${cfg.databaseHost}
+      password: ${cfg.databasePassword}
+      username: ${cfg.databaseUsername}
+      encoding: utf8
+  '';
+  gitlabShellYml = ''
+    user: gitlab
+    gitlab_url: "http://localhost:8080/"
+    http_settings:
+      self_signed_cert: false
+    repos_path: "${cfg.stateDir}/repositories"
+    log_file: "${cfg.stateDir}/log/gitlab-shell.log"
+    redis:
+      bin: ${pkgs.redis}/bin/redis-cli
+      host: 127.0.0.1
+      port: 6379
+      database: 0
+      namespace: resque:gitlab
+  '';
+
+  unicornConfig = builtins.readFile ./defaultUnicornConfig.rb;
+
+  gitlab-runner = pkgs.stdenv.mkDerivation rec {
+    name = "gitlab-runner";
+    buildInputs = [ pkgs.gitlab pkgs.rubyLibs.bundler pkgs.makeWrapper ];
+    phases = "installPhase fixupPhase";
+    buildPhase = "";
+    installPhase = ''
+      mkdir -p $out/bin
+      makeWrapper ${rubyLibs.bundler}/bin/bundle $out/bin/gitlab-runner\
+          --set RAKEOPT '"-f ${pkgs.gitlab}/share/gitlab/Rakefile"'\
+          --set UNICORN_PATH "${cfg.stateDir}/"\
+          --set GITLAB_PATH "${pkgs.gitlab}/share/gitlab/"\
+          --set GITLAB_APPLICATION_LOG_PATH "${cfg.stateDir}/log/application.log"\
+          --set GITLAB_SATELLITES_PATH "${cfg.stateDir}/satellites"\
+          --set GITLAB_SHELL_PATH "${pkgs.gitlab-shell}"\
+          --set GITLAB_REPOSITORIES_PATH "${cfg.stateDir}/repositories"\
+          --set GITLAB_SHELL_HOOKS_PATH "${cfg.stateDir}/shell/hooks"\
+          --set BUNDLE_GEMFILE "${pkgs.gitlab}/share/gitlab/Gemfile"\
+          --set GITLAB_EMAIL_FROM "${cfg.emailFrom}"\
+          --set GITLAB_SHELL_CONFIG_PATH "${cfg.stateDir}/shell/config.yml"\
+          --set GITLAB_SHELL_SECRET_PATH "${cfg.stateDir}/config/gitlab_shell_secret"\
+          --set GITLAB_HOST "${cfg.host}"\
+          --set GITLAB_BACKUP_PATH"${cfg.backupPath}"\
+          --set RAILS_ENV "production"
+    '';
+  };
+
+in {
+
+  options = {
+    services.gitlab = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enable the gitlab service.
+        '';
+      };
+
+      satelliteDir = mkOption {
+        type = types.str;
+        default = "/var/gitlab/git-satellites";
+        description = "Directory to store checked out git trees requires for operation.";
+      };
+
+      stateDir = mkOption {
+        type = types.str;
+        default = "/var/gitlab/state";
+        description = "The state directory, logs are stored here.";
+      };
+
+      backupPath = mkOption {
+        type = types.str;
+        default = cfg.stateDir + "/backup";
+        description = "Path for backups.";
+      };
+
+      databaseHost = mkOption {
+        type = types.str;
+        default = "127.0.0.1";
+        description = "Database hostname";
+      };
+
+      databasePassword = mkOption {
+        type = types.str;
+        default = "";
+        description = "Database user password";
+      };
+
+      databaseName = mkOption {
+        type = types.str;
+        default = "gitlab";
+        description = "Database name";
+      };
+
+      databaseUsername = mkOption {
+        type = types.str;
+        default = "gitlab";
+        description = "Database user";
+      };
+
+      emailFrom = mkOption {
+        type = types.str;
+        default = "example@example.org";
+        description = "The source address for emails sent by gitlab.";
+      };
+
+      host = mkOption {
+        type = types.str;
+        default = config.networking.hostName;
+        description = "The gitlab host name. Used e.g. for copy-paste URLs.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    environment.systemPackages = [ gitlab-runner pkgs.gitlab-shell ];
+
+    assertions = [
+      { assertion = cfg.databasePassword != "";
+        message = "databasePassword must be set";
+      }
+    ];
+
+    # Redis is required for the sidekiq queue runner.
+    services.redis.enable = mkDefault true;
+    # We use postgres as the main data store.
+    services.postgresql.enable = mkDefault true;
+    # Use postfix to send out mails.
+    services.postfix.enable = mkDefault true;
+
+    users.extraUsers = [
+      { name = "gitlab";
+        group = "gitlab";
+        home = "${cfg.stateDir}/home";
+        shell = "${pkgs.bash}/bin/bash";
+        uid = config.ids.uids.gitlab;
+      } ];
+
+    users.extraGroups = [
+      { name = "gitlab";
+        gid = config.ids.gids.gitlab;
+      } ];
+
+    systemd.services.gitlab-sidekiq = {
+      after = [ "network.target" "redis.service" ];
+      wantedBy = [ "multi-user.target" ];
+      environment.HOME = "${cfg.stateDir}/home";
+      environment.UNICORN_PATH = "${cfg.stateDir}/";
+      environment.GITLAB_PATH = "${pkgs.gitlab}/share/gitlab/";
+      environment.GITLAB_APPLICATION_LOG_PATH = "${cfg.stateDir}/log/application.log";
+      environment.GITLAB_SATELLITES_PATH = "${cfg.stateDir}/satellites";
+      environment.GITLAB_SHELL_PATH = "${pkgs.gitlab-shell}";
+      environment.GITLAB_REPOSITORIES_PATH = "${cfg.stateDir}/repositories";
+      environment.GITLAB_SHELL_HOOKS_PATH = "${cfg.stateDir}/shell/hooks";
+      environment.BUNDLE_GEMFILE = "${pkgs.gitlab}/share/gitlab/Gemfile";
+      environment.GITLAB_EMAIL_FROM = "${cfg.emailFrom}";
+      environment.GITLAB_SHELL_CONFIG_PATH = "${cfg.stateDir}/shell/config.yml";
+      environment.GITLAB_SHELL_SECRET_PATH = "${cfg.stateDir}/config/gitlab_shell_secret";
+      environment.GITLAB_HOST = "${cfg.host}";
+      environment.GITLAB_DATABASE_HOST = "${cfg.databaseHost}";
+      environment.GITLAB_DATABASE_PASSWORD = "${cfg.databasePassword}";
+      environment.RAILS_ENV = "production";
+      path = with pkgs; [
+        config.services.postgresql.package
+        gitAndTools.git
+        ruby
+        openssh
+      ];
+      serviceConfig = {
+        Type = "simple";
+        User = "gitlab";
+        Group = "gitlab";
+        TimeoutSec = "300";
+        WorkingDirectory = "${pkgs.gitlab}/share/gitlab";
+        ExecStart="${rubyLibs.bundler}/bin/bundle exec \"sidekiq -q post_receive -q mailer -q system_hook -q project_web_hook -q gitlab_shell -q common -q default -e production -P ${cfg.stateDir}/tmp/sidekiq.pid\"";
+      };
+    };
+
+    systemd.services.gitlab = {
+      after = [ "network.target" "postgresql.service" "redis.service" ];
+      wantedBy = [ "multi-user.target" ];
+      environment.HOME = "${cfg.stateDir}/home";
+      environment.UNICORN_PATH = "${cfg.stateDir}/";
+      environment.GITLAB_PATH = "${pkgs.gitlab}/share/gitlab/";
+      environment.GITLAB_APPLICATION_LOG_PATH = "${cfg.stateDir}/log/application.log";
+      environment.GITLAB_SATELLITES_PATH = "${cfg.stateDir}/satellites";
+      environment.GITLAB_SHELL_PATH = "${pkgs.gitlab-shell}";
+      environment.GITLAB_REPOSITORIES_PATH = "${cfg.stateDir}/repositories";
+      environment.GITLAB_SHELL_HOOKS_PATH = "${cfg.stateDir}/shell/hooks";
+      environment.BUNDLE_GEMFILE = "${pkgs.gitlab}/share/gitlab/Gemfile";
+      environment.GITLAB_EMAIL_FROM = "${cfg.emailFrom}";
+      environment.GITLAB_HOST = "${cfg.host}";
+      environment.GITLAB_DATABASE_HOST = "${cfg.databaseHost}";
+      environment.GITLAB_DATABASE_PASSWORD = "${cfg.databasePassword}";
+      environment.RAILS_ENV = "production";
+      path = with pkgs; [
+        config.services.postgresql.package
+        gitAndTools.git
+        ruby
+        openssh
+      ];
+      preStart = ''
+        # TODO: use env vars
+        mkdir -p ${cfg.stateDir}
+        mkdir -p ${cfg.stateDir}/log
+        mkdir -p ${cfg.stateDir}/satellites
+        mkdir -p ${cfg.stateDir}/repositories
+        mkdir -p ${cfg.stateDir}/shell/hooks
+        mkdir -p ${cfg.stateDir}/tmp/pids
+        mkdir -p ${cfg.stateDir}/tmp/sockets
+        rm -rf ${cfg.stateDir}/config
+        mkdir -p ${cfg.stateDir}/config
+        # TODO: What exactly is gitlab-shell doing with the secret?
+        head -c 20 /dev/urandom > ${cfg.stateDir}/config/gitlab_shell_secret
+        mkdir -p ${cfg.stateDir}/home/.ssh
+        touch ${cfg.stateDir}/home/.ssh/authorized_keys
+
+        cp -rf ${pkgs.gitlab}/share/gitlab/config ${cfg.stateDir}/
+        cp ${pkgs.gitlab}/share/gitlab/VERSION ${cfg.stateDir}/VERSION
+
+        ln -fs ${pkgs.writeText "database.yml" databaseYml} ${cfg.stateDir}/config/database.yml
+        ln -fs ${pkgs.writeText "unicorn.rb" unicornConfig} ${cfg.stateDir}/config/unicorn.rb
+
+        chown -R gitlab:gitlab ${cfg.stateDir}/
+        chmod -R 755 ${cfg.stateDir}/
+
+        if [ "${cfg.databaseHost}" = "127.0.0.1" ]; then
+          if ! test -e "${cfg.stateDir}/db-created"; then
+            psql postgres -c "CREATE ROLE gitlab WITH LOGIN NOCREATEDB NOCREATEROLE NOCREATEUSER ENCRYPTED PASSWORD '${cfg.databasePassword}'"
+            ${config.services.postgresql.package}/bin/createdb --owner gitlab gitlab || true
+            touch "${cfg.stateDir}/db-created"
+
+            # force=yes disables the manual-interaction yes/no prompt
+            # which breaks without an stdin.
+            force=yes ${rubyLibs.bundler}/bin/bundle exec rake -f ${pkgs.gitlab}/share/gitlab/Rakefile gitlab:setup RAILS_ENV=production
+          fi
+        fi
+
+      # Install the shell required to push repositories
+      ln -fs ${pkgs.writeText "config.yml" gitlabShellYml} ${cfg.stateDir}/shell/config.yml
+      export GITLAB_SHELL_CONFIG_PATH=""${cfg.stateDir}/shell/config.yml
+      ${pkgs.gitlab-shell}/bin/install
+
+      # Change permissions in the last step because some of the
+      # intermediary scripts like to create directories as root.
+      chown -R gitlab:gitlab ${cfg.stateDir}/
+      chmod -R 755 ${cfg.stateDir}/
+      '';
+
+      serviceConfig = {
+        PermissionsStartOnly = true; # preStart must be run as root
+        Type = "simple";
+        User = "gitlab";
+        Group = "gitlab";
+        TimeoutSec = "300";
+        WorkingDirectory = "${pkgs.gitlab}/share/gitlab";
+        ExecStart="${rubyLibs.bundler}/bin/bundle exec \"unicorn -c ${cfg.stateDir}/config/unicorn.rb -E production\"";
+      };
+
+    };
+
+  };
+
+}

pkgs/applications/version-management/gitlab-shell/default.nix

@@ -0,0 +1,59 @@
+{ stdenv, ruby, rubyLibs, fetchgit }:
+
+stdenv.mkDerivation rec {
+  version = "2.1.0";
+  name = "gitlab-shell-${version}";
+  
+  srcs = fetchgit {
+    url = "https://gitlab.com/gitlab-org/gitlab-shell.git";
+    rev = "823aba63e444afa2f45477819770fec3cb5f0159";
+    sha256 = "0ppf547xs9pvmk49v4h043d0j93k5n4q0yx3b9ssrc4qf2smflgq";
+  };
+
+  buildInputs = [
+    ruby rubyLibs.bundler
+  ];
+
+  installPhase = ''
+    mkdir -p $out/
+    cp -R . $out/
+
+    # Nothing to install ATM for non-development but keeping the
+    # install command anyway in case that changes in the future:
+    export HOME=$(pwd)
+    bundle install -j4 --verbose --local --deployment --without development test
+  '';
+  
+  # gitlab-shell will try to read its config relative to the source
+  # code by default which doesn't work in nixos because it's a
+  # read-only filesystem
+  postPatch = ''
+    substituteInPlace lib/gitlab_config.rb --replace\
+       "File.join(ROOT_PATH, 'config.yml')"\
+       "ENV['GITLAB_SHELL_CONFIG_PATH']"
+    substituteInPlace lib/gitlab_net.rb --replace\
+       "File.read File.join(ROOT_PATH, '.gitlab_shell_secret')"\
+       "File.read ENV['GITLAB_SHELL_SECRET_PATH']"
+
+    # Note that we're running gitlab-shell from current-system/sw
+    # because otherwise updating gitlab-shell won't be reflected in
+    # the hardcoded path of the authorized-keys file:
+    substituteInPlace lib/gitlab_keys.rb --replace\
+        "auth_line = \"command=\\\"#{ROOT_PATH}/bin/gitlab-shell"\
+        "auth_line = \"command=\\\"GITLAB_SHELL_CONFIG_PATH=#{ENV['GITLAB_SHELL_CONFIG_PATH']} GITLAB_SHELL_SECRET_PATH=#{ENV['GITLAB_SHELL_SECRET_PATH']} /run/current-system/sw/bin/gitlab-shell"
+
+    # We're setting GITLAB_SHELL_CONFIG_PATH in the ssh authorized key
+    # environment because we need it in gitlab_configrb
+    # . unsetenv_others will remove that so we're not doing it for
+    # now.
+    #
+    # TODO: Are there any security implications? The commit adding
+    # unsetenv_others didn't mention anything...
+    # 
+    # Kernel::exec({'PATH' => ENV['PATH'], 'LD_LIBRARY_PATH' => ENV['LD_LIBRARY_PATH'], 'GL_ID' => ENV['GL_ID']}, *args, unsetenv_others: true)
+    substituteInPlace lib/gitlab_shell.rb --replace\
+        " *args, unsetenv_others: true)"\
+        " *args)"
+  '';
+
+}

pkgs/applications/version-management/gitlab/Gemfile.lock

@@ -0,0 +1,711 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    RedCloth (4.2.9)
+    ace-rails-ap (2.0.1)
+    actionmailer (4.1.1)
+      actionpack (= 4.1.1)
+      actionview (= 4.1.1)
+      mail (~> 2.5.4)
+    actionpack (4.1.1)
+      actionview (= 4.1.1)
+      activesupport (= 4.1.1)
+      rack (~> 1.5.2)
+      rack-test (~> 0.6.2)
+    actionview (4.1.1)
+      activesupport (= 4.1.1)
+      builder (~> 3.1)
+      erubis (~> 2.7.0)
+    activemodel (4.1.1)
+      activesupport (= 4.1.1)
+      builder (~> 3.1)
+    activerecord (4.1.1)
+      activemodel (= 4.1.1)
+      activesupport (= 4.1.1)
+      arel (~> 5.0.0)
+    activesupport (4.1.1)
+      i18n (~> 0.6, >= 0.6.9)
+      json (~> 1.7, >= 1.7.7)
+      minitest (~> 5.1)
+      thread_safe (~> 0.1)
+      tzinfo (~> 1.1)
+    acts-as-taggable-on (2.4.1)
+      rails (>= 3, < 5)
+    addressable (2.3.5)
+    annotate (2.6.0)
+      activerecord (>= 2.3.0)
+      rake (>= 0.8.7)
+    arel (5.0.1.20140414130214)
+    asciidoctor (0.1.4)
+    awesome_print (1.2.0)
+    axiom-types (0.0.5)
+      descendants_tracker (~> 0.0.1)
+      ice_nine (~> 0.9)
+    bcrypt (3.1.7)
+    better_errors (1.0.1)
+      coderay (>= 1.0.0)
+      erubis (>= 2.6.6)
+    binding_of_caller (0.7.2)
+      debug_inspector (>= 0.0.1)
+    bootstrap-sass (3.0.3.0)
+      sass (~> 3.2)
+    builder (3.2.2)
+    capybara (2.2.1)
+      mime-types (>= 1.16)
+      nokogiri (>= 1.3.3)
+      rack (>= 1.0.0)
+      rack-test (>= 0.5.4)
+      xpath (~> 2.0)
+    carrierwave (0.9.0)
+      activemodel (>= 3.2.0)
+      activesupport (>= 3.2.0)
+      json (>= 1.7)
+    celluloid (0.15.2)
+      timers (~> 1.1.0)
+    charlock_holmes (0.6.9.4)
+    cliver (0.3.2)
+    code_analyzer (0.4.3)
+      sexp_processor
+    coderay (1.1.0)
+    coercible (1.0.0)
+      descendants_tracker (~> 0.0.1)
+    coffee-rails (4.0.1)
+      coffee-script (>= 2.2.0)
+      railties (>= 4.0.0, < 5.0)
+    coffee-script (2.2.0)
+      coffee-script-source
+      execjs
+    coffee-script-source (1.6.3)
+    colored (1.2)
+    colorize (0.5.8)
+    connection_pool (1.2.0)
+    coveralls (0.7.0)
+      multi_json (~> 1.3)
+      rest-client
+      simplecov (>= 0.7)
+      term-ansicolor
+      thor
+    crack (0.4.1)
+      safe_yaml (~> 0.9.0)
+    creole (0.3.8)
+    d3_rails (3.1.10)
+      railties (>= 3.1.0)
+    daemons (1.1.9)
+    database_cleaner (1.3.0)
+    debug_inspector (0.0.2)
+    default_value_for (3.0.0)
+      activerecord (>= 3.2.0, < 5.0)
+    descendants_tracker (0.0.3)
+    devise (3.2.4)
+      bcrypt (~> 3.0)
+      orm_adapter (~> 0.1)
+      railties (>= 3.2.6, < 5)
+      thread_safe (~> 0.1)
+      warden (~> 1.2.3)
+    devise-async (0.9.0)
+      devise (~> 3.2)
+    diff-lcs (1.2.5)
+    diffy (3.0.3)
+    docile (1.1.5)
+    dotenv (0.9.0)
+    dropzonejs-rails (0.4.14)
+      rails (> 3.1)
+    email_spec (1.5.0)
+      launchy (~> 2.1)
+      mail (~> 2.2)
+    emoji (1.0.1)
+      json
+    enumerize (0.7.0)
+      activesupport (>= 3.2)
+    equalizer (0.0.8)
+    erubis (2.7.0)
+    escape_utils (0.2.4)
+    eventmachine (1.0.3)
+    excon (0.32.1)
+    execjs (2.0.2)
+    expression_parser (0.9.0)
+    factory_girl (4.3.0)
+      activesupport (>= 3.0.0)
+    factory_girl_rails (4.3.0)
+      factory_girl (~> 4.3.0)
+      railties (>= 3.0.0)
+    faraday (0.8.9)
+      multipart-post (~> 1.2.0)
+    faraday_middleware (0.9.0)
+      faraday (>= 0.7.4, < 0.9)
+    ffaker (1.22.1)
+    ffi (1.9.3)
+    fog (1.21.0)
+      fog-brightbox
+      fog-core (~> 1.21, >= 1.21.1)
+      fog-json
+      nokogiri (~> 1.5, >= 1.5.11)
+    fog-brightbox (0.0.1)
+      fog-core
+      fog-json
+    fog-core (1.21.1)
+      builder
+      excon (~> 0.32)
+      formatador (~> 0.2.0)
+      mime-types
+      net-scp (~> 1.1)
+      net-ssh (>= 2.1.3)
+    fog-json (1.0.0)
+      multi_json (~> 1.0)
+    font-awesome-rails (4.2.0.0)
+      railties (>= 3.2, < 5.0)
+    foreman (0.63.0)
+      dotenv (>= 0.7)
+      thor (>= 0.13.6)
+    formatador (0.2.4)
+    gemnasium-gitlab-service (0.2.2)
+      rugged (~> 0.19)
+    gherkin-ruby (0.3.1)
+      racc
+    github-markup (1.1.0)
+    gitlab-flowdock-git-hook (0.4.2.2)
+      gitlab-grit (>= 2.4.1)
+      multi_json
+    gitlab-grack (2.0.0.pre)
+      rack (~> 1.5.1)
+    gitlab-grit (2.6.12)
+      charlock_holmes (~> 0.6)
+      diff-lcs (~> 1.1)
+      mime-types (~> 1.15)
+      posix-spawn (~> 0.3)
+    gitlab-linguist (3.0.0)
+      charlock_holmes (~> 0.6.6)
+      escape_utils (~> 0.2.4)
+      mime-types (~> 1.19)
+    gitlab_emoji (0.0.1.1)
+      emoji (~> 1.0.1)
+    gitlab_git (7.0.0.rc10)
+      activesupport (~> 4.0)
+      charlock_holmes (~> 0.6)
+      gitlab-linguist (~> 3.0)
+      rugged (~> 0.21.0)
+    gitlab_meta (7.0)
+    gitlab_omniauth-ldap (1.1.0)
+      net-ldap (~> 0.7.0)
+      omniauth (~> 1.0)
+      pyu-ruby-sasl (~> 0.0.3.1)
+      rubyntlm (~> 0.1.1)
+    gollum-lib (3.0.0)
+      github-markup (~> 1.1.0)
+      gitlab-grit (~> 2.6.5)
+      nokogiri (~> 1.6.1)
+      rouge (~> 1.3.3)
+      sanitize (~> 2.1.0)
+      stringex (~> 2.5.1)
+    gon (5.0.1)
+      actionpack (>= 2.3.0)
+      json
+    grape (0.6.1)
+      activesupport
+      builder
+      hashie (>= 1.2.0)
+      multi_json (>= 1.3.2)
+      multi_xml (>= 0.5.2)
+      rack (>= 1.3.0)
+      rack-accept
+      rack-mount
+      virtus (>= 1.0.0)
+    grape-entity (0.4.2)
+      activesupport
+      multi_json (>= 1.3.2)
+    growl (1.0.3)
+    guard (2.2.4)
+      formatador (>= 0.2.4)
+      listen (~> 2.1)
+      lumberjack (~> 1.0)
+      pry (>= 0.9.12)
+      thor (>= 0.18.1)
+    guard-rspec (4.2.0)
+      guard (>= 2.1.1)
+      rspec (>= 2.14, < 4.0)
+    guard-spinach (0.0.2)
+      guard (>= 1.1)
+      spinach
+    haml (4.0.5)
+      tilt
+    haml-rails (0.5.3)
+      actionpack (>= 4.0.1)
+      activesupport (>= 4.0.1)
+      haml (>= 3.1, < 5.0)
+      railties (>= 4.0.1)
+    hashie (2.1.2)
+    hike (1.2.3)
+    hipchat (0.14.0)
+      httparty
+      httparty
+    html-pipeline (1.11.0)
+      activesupport (>= 2)
+      nokogiri (~> 1.4)
+    html-pipeline-gitlab (0.1.5)
+      actionpack (~> 4)
+      gitlab_emoji (~> 0.0.1)
+      html-pipeline (~> 1.11.0)
+      sanitize (~> 2.1)
+    http_parser.rb (0.5.3)
+    httparty (0.13.0)
+      json (~> 1.8)
+      multi_xml (>= 0.5.2)
+    httpauth (0.2.1)
+    i18n (0.6.11)
+    ice_nine (0.10.0)
+    jasmine (2.0.2)
+      jasmine-core (~> 2.0.0)
+      phantomjs
+      rack (>= 1.2.1)
+      rake
+    jasmine-core (2.0.0)
+    jquery-atwho-rails (0.3.3)
+    jquery-rails (3.1.0)
+      railties (>= 3.0, < 5.0)
+      thor (>= 0.14, < 2.0)
+    jquery-scrollto-rails (1.4.3)
+      railties (> 3.1, < 5.0)
+    jquery-turbolinks (2.0.1)
+      railties (>= 3.1.0)
+      turbolinks
+    jquery-ui-rails (4.2.1)
+      railties (>= 3.2.16)
+    json (1.8.1)
+    jwt (0.1.13)
+      multi_json (>= 1.5)
+    kaminari (0.15.1)
+      actionpack (>= 3.0.0)
+      activesupport (>= 3.0.0)
+    kgio (2.8.1)
+    launchy (2.4.2)
+      addressable (~> 2.3)
+    letter_opener (1.1.2)
+      launchy (~> 2.2)
+    libv8 (3.16.14.3)
+    listen (2.3.1)
+      celluloid (>= 0.15.2)
+      rb-fsevent (>= 0.9.3)
+      rb-inotify (>= 0.9)
+    lumberjack (1.0.4)
+    mail (2.5.4)
+      mime-types (~> 1.16)
+      treetop (~> 1.4.8)
+    method_source (0.8.2)
+    mime-types (1.25.1)
+    mini_portile (0.6.0)
+    minitest (5.3.5)
+    mousetrap-rails (1.4.6)
+    multi_json (1.10.1)
+    multi_xml (0.5.5)
+    multipart-post (1.2.0)
+    net-ldap (0.7.0)
+    net-scp (1.1.2)
+      net-ssh (>= 2.6.5)
+    net-ssh (2.8.0)
+    newrelic_rpm (3.9.4.245)
+    nokogiri (1.6.2.1)
+      mini_portile (= 0.6.0)
+    nprogress-rails (0.1.2.3)
+    oauth (0.4.7)
+    oauth2 (0.8.1)
+      faraday (~> 0.8)
+      httpauth (~> 0.1)
+      jwt (~> 0.1.4)
+      multi_json (~> 1.0)
+      rack (~> 1.2)
+    omniauth (1.1.4)
+      hashie (>= 1.2, < 3)
+      rack
+    omniauth-github (1.1.1)
+      omniauth (~> 1.0)
+      omniauth-oauth2 (~> 1.1)
+    omniauth-google-oauth2 (0.2.5)
+      omniauth (> 1.0)
+      omniauth-oauth2 (~> 1.1)
+    omniauth-oauth (1.0.1)
+      oauth
+      omniauth (~> 1.0)
+    omniauth-oauth2 (1.1.1)
+      oauth2 (~> 0.8.0)
+      omniauth (~> 1.0)
+    omniauth-shibboleth (1.1.1)
+      omniauth (>= 1.0.0)
+    omniauth-twitter (1.0.1)
+      multi_json (~> 1.3)
+      omniauth-oauth (~> 1.0)
+    org-ruby (0.9.9)
+      rubypants (~> 0.2)
+    orm_adapter (0.5.0)
+    pg (0.15.1)
+    phantomjs (1.9.2.0)
+    poltergeist (1.5.1)
+      capybara (~> 2.1)
+      cliver (~> 0.3.1)
+      multi_json (~> 1.0)
+      websocket-driver (>= 0.2.0)
+    polyglot (0.3.4)
+    posix-spawn (0.3.9)
+    pry (0.9.12.4)
+      coderay (~> 1.0)
+      method_source (~> 0.8)
+      slop (~> 3.4)
+    pyu-ruby-sasl (0.0.3.3)
+    quiet_assets (1.0.2)
+      railties (>= 3.1, < 5.0)
+    racc (1.4.10)
+    rack (1.5.2)
+    rack-accept (0.4.5)
+      rack (>= 0.4)
+    rack-attack (2.3.0)
+      rack
+    rack-cors (0.2.9)
+    rack-mini-profiler (0.9.0)
+      rack (>= 1.1.3)
+    rack-mount (0.8.3)
+      rack (>= 1.0.0)
+    rack-protection (1.5.1)
+      rack
+    rack-test (0.6.2)
+      rack (>= 1.0)
+    rails (4.1.1)
+      actionmailer (= 4.1.1)
+      actionpack (= 4.1.1)
+      actionview (= 4.1.1)
+      activemodel (= 4.1.1)
+      activerecord (= 4.1.1)
+      activesupport (= 4.1.1)
+      bundler (>= 1.3.0, < 2.0)
+      railties (= 4.1.1)
+      sprockets-rails (~> 2.0)
+    rails_autolink (1.1.6)
+      rails (> 3.1)
+    rails_best_practices (1.14.4)
+      activesupport
+      awesome_print
+      code_analyzer (>= 0.4.3)
+      colored
+      erubis
+      i18n
+      require_all
+      ruby-progressbar
+    railties (4.1.1)
+      actionpack (= 4.1.1)
+      activesupport (= 4.1.1)
+      rake (>= 0.8.7)
+      thor (>= 0.18.1, < 2.0)
+    raindrops (0.12.0)
+    rake (10.3.2)
+    raphael-rails (2.1.2)
+    rb-fsevent (0.9.3)
+    rb-inotify (0.9.2)
+      ffi (>= 0.5.0)
+    rdoc (3.12.2)
+      json (~> 1.4)
+    redcarpet (3.1.2)
+    redis (3.0.6)
+    redis-actionpack (4.0.0)
+      actionpack (~> 4)
+      redis-rack (~> 1.5.0)
+      redis-store (~> 1.1.0)
+    redis-activesupport (4.0.0)
+      activesupport (~> 4)
+      redis-store (~> 1.1.0)
+    redis-namespace (1.4.1)
+      redis (~> 3.0.4)
+    redis-rack (1.5.0)
+      rack (~> 1.5)
+      redis-store (~> 1.1.0)
+    redis-rails (4.0.0)
+      redis-actionpack (~> 4)
+      redis-activesupport (~> 4)
+      redis-store (~> 1.1.0)
+    redis-store (1.1.4)
+      redis (>= 2.2)
+    ref (1.0.5)
+    request_store (1.0.5)
+    require_all (1.3.2)
+    rest-client (1.6.7)
+      mime-types (>= 1.16)
+    rinku (1.7.3)
+    rouge (1.3.3)
+    rspec (2.14.1)
+      rspec-core (~> 2.14.0)
+      rspec-expectations (~> 2.14.0)
+      rspec-mocks (~> 2.14.0)
+    rspec-core (2.14.7)
+    rspec-expectations (2.14.4)
+      diff-lcs (>= 1.1.3, < 2.0)
+    rspec-mocks (2.14.4)
+    rspec-rails (2.14.0)
+      actionpack (>= 3.0)
+      activesupport (>= 3.0)
+      railties (>= 3.0)
+      rspec-core (~> 2.14.0)
+      rspec-expectations (~> 2.14.0)
+      rspec-mocks (~> 2.14.0)
+    ruby-progressbar (1.2.0)
+    rubyntlm (0.1.1)
+    rubypants (0.2.0)
+    rugged (0.21.0)
+    safe_yaml (0.9.7)
+    sanitize (2.1.0)
+      nokogiri (>= 1.4.4)
+    sass (3.2.19)
+    sass-rails (4.0.3)
+      railties (>= 4.0.0, < 5.0)
+      sass (~> 3.2.0)
+      sprockets (~> 2.8, <= 2.11.0)
+      sprockets-rails (~> 2.0)
+    sdoc (0.3.20)
+      json (>= 1.1.3)
+      rdoc (~> 3.10)
+    seed-fu (2.3.1)
+      activerecord (>= 3.1, < 4.2)
+      activesupport (>= 3.1, < 4.2)
+    select2-rails (3.5.2)
+      thor (~> 0.14)
+    semantic-ui-sass (0.16.1.0)
+      sass (~> 3.2)
+    settingslogic (2.0.9)
+    sexp_processor (4.4.0)
+    shoulda-matchers (2.1.0)
+      activesupport (>= 3.0.0)
+    sidekiq (2.17.0)
+      celluloid (>= 0.15.2)
+      connection_pool (>= 1.0.0)
+      json
+      redis (>= 3.0.4)
+      redis-namespace (>= 1.3.1)
+    simple_oauth (0.1.9)
+    simplecov (0.9.0)
+      docile (~> 1.1.0)
+      multi_json
+      simplecov-html (~> 0.8.0)
+    simplecov-html (0.8.0)
+    sinatra (1.4.4)
+      rack (~> 1.4)
+      rack-protection (~> 1.4)
+      tilt (~> 1.3, >= 1.3.4)
+    six (0.2.0)
+    slack-notifier (0.3.2)
+    slim (2.0.2)
+      temple (~> 0.6.6)
+      tilt (>= 1.3.3, < 2.1)
+    slop (3.4.7)
+    spinach (0.8.7)
+      colorize (= 0.5.8)
+      gherkin-ruby (>= 0.3.1)
+    spinach-rails (0.2.1)
+      capybara (>= 2.0.0)
+      railties (>= 3)
+      spinach (>= 0.4)
+    spring (1.1.3)
+    spring-commands-rspec (1.0.1)
+      spring (>= 0.9.1)
+    spring-commands-spinach (1.0.0)
+      spring (>= 0.9.1)
+    sprockets (2.11.0)
+      hike (~> 1.2)
+      multi_json (~> 1.0)
+      rack (~> 1.0)
+      tilt (~> 1.1, != 1.3.0)
+    sprockets-rails (2.1.3)
+      actionpack (>= 3.0)
+      activesupport (>= 3.0)
+      sprockets (~> 2.8)
+    stamp (0.5.0)
+    state_machine (1.2.0)
+    stringex (2.5.1)
+    temple (0.6.7)
+    term-ansicolor (1.2.2)
+      tins (~> 0.8)
+    test_after_commit (0.2.2)
+    therubyracer (0.12.0)
+      libv8 (~> 3.16.14.0)
+      ref
+    thin (1.6.1)
+      daemons (>= 1.0.9)
+      eventmachine (>= 1.0.0)
+      rack (>= 1.0.0)
+    thor (0.19.1)
+    thread_safe (0.3.4)
+    tilt (1.4.1)
+    timers (1.1.0)
+    tinder (1.9.3)
+      eventmachine (~> 1.0)
+      faraday (~> 0.8)
+      faraday_middleware (~> 0.9)
+      hashie (>= 1.0, < 3)
+      json (~> 1.8.0)
+      mime-types (~> 1.19)
+      multi_json (~> 1.7)
+      twitter-stream (~> 0.1)
+    tins (0.13.1)
+    treetop (1.4.15)
+      polyglot
+      polyglot (>= 0.3.1)
+    turbolinks (2.0.0)
+      coffee-rails
+    twitter-stream (0.1.16)
+      eventmachine (>= 0.12.8)
+      http_parser.rb (~> 0.5.1)
+      simple_oauth (~> 0.1.4)
+    tzinfo (1.2.2)
+      thread_safe (~> 0.1)
+    uglifier (2.3.2)
+      execjs (>= 0.3.0)
+      json (>= 1.8.0)
+    underscore-rails (1.4.4)
+    unf (0.1.4)
+      unf_ext
+    unf_ext (0.0.6)
+    unicorn (4.6.3)
+      kgio (~> 2.6)
+      rack
+      raindrops (~> 0.7)
+    unicorn-worker-killer (0.4.2)
+      unicorn (~> 4)
+    version_sorter (1.1.0)
+    virtus (1.0.1)
+      axiom-types (~> 0.0.5)
+      coercible (~> 1.0)
+      descendants_tracker (~> 0.0.1)
+      equalizer (~> 0.0.7)
+    warden (1.2.3)
+      rack (>= 1.0)
+    webmock (1.16.0)
+      addressable (>= 2.2.7)
+      crack (>= 0.3.2)
+    websocket-driver (0.3.3)
+    wikicloth (0.8.1)
+      builder
+      expression_parser
+      rinku
+    xpath (2.0.0)
+      nokogiri (~> 1.3)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  RedCloth
+  ace-rails-ap
+  acts-as-taggable-on
+  annotate (~> 2.6.0.beta2)
+  asciidoctor (= 0.1.4)
+  awesome_print
+  better_errors
+  binding_of_caller
+  bootstrap-sass (~> 3.0)
+  capybara (~> 2.2.1)
+  carrierwave
+  coffee-rails
+  colored
+  coveralls
+  creole (~> 0.3.6)
+  d3_rails (~> 3.1.4)
+  database_cleaner
+  default_value_for (~> 3.0.0)
+  devise (= 3.2.4)
+  devise-async (= 0.9.0)
+  diffy (~> 3.0.3)
+  dropzonejs-rails
+  email_spec
+  enumerize
+  factory_girl_rails
+  ffaker
+  fog (~> 1.14)
+  font-awesome-rails (~> 4.2)
+  foreman
+  gemnasium-gitlab-service (~> 0.2)
+  github-markup
+  gitlab-flowdock-git-hook (~> 0.4.2)
+  gitlab-grack (~> 2.0.0.pre)
+  gitlab-linguist (~> 3.0.0)
+  gitlab_emoji (~> 0.0.1.1)
+  gitlab_git (= 7.0.0.rc10)
+  gitlab_meta (= 7.0)
+  gitlab_omniauth-ldap (= 1.1.0)
+  gollum-lib (~> 3.0.0)
+  gon (~> 5.0.0)
+  grape (~> 0.6.1)
+  grape-entity (~> 0.4.2)
+  growl
+  guard-rspec
+  guard-spinach
+  haml-rails
+  hipchat (~> 0.14.0)
+  html-pipeline-gitlab (~> 0.1.0)
+  httparty
+  jasmine (= 2.0.2)
+  jquery-atwho-rails (~> 0.3.3)
+  jquery-rails
+  jquery-scrollto-rails
+  jquery-turbolinks
+  jquery-ui-rails
+  kaminari (~> 0.15.1)
+  launchy
+  letter_opener
+  minitest (~> 5.3.0)
+  mousetrap-rails
+  mysql2
+  newrelic_rpm
+  nprogress-rails
+  omniauth (~> 1.1.3)
+  omniauth-github
+  omniauth-google-oauth2
+  omniauth-shibboleth
+  omniauth-twitter
+  org-ruby (= 0.9.9)
+  pg
+  poltergeist (~> 1.5.1)
+  pry
+  quiet_assets (~> 1.0.1)
+  rack-attack
+  rack-cors
+  rack-mini-profiler
+  rails (~> 4.1.0)
+  rails_autolink (~> 1.1)
+  rails_best_practices
+  raphael-rails (~> 2.1.2)
+  rb-fsevent
+  rb-inotify
+  rdoc (~> 3.6)
+  redcarpet (~> 3.1.2)
+  redis-rails
+  request_store
+  rspec-rails
+  sanitize (~> 2.0)
+  sass-rails (~> 4.0.2)
+  sdoc
+  seed-fu
+  select2-rails
+  semantic-ui-sass (~> 0.16.1.0)
+  settingslogic
+  shoulda-matchers (~> 2.1.0)
+  sidekiq (= 2.17.0)
+  simplecov
+  sinatra
+  six
+  slack-notifier (~> 0.3.2)
+  slim
+  spinach-rails
+  spring (= 1.1.3)
+  spring-commands-rspec (= 1.0.1)
+  spring-commands-spinach (= 1.0.0)
+  stamp
+  state_machine
+  test_after_commit
+  therubyracer
+  thin
+  tinder (~> 1.9.2)
+  turbolinks
+  uglifier
+  underscore-rails (~> 1.4.4)
+  unf
+  unicorn (~> 4.6.3)
+  unicorn-worker-killer
+  version_sorter
+  virtus
+  webmock
+  wikicloth (= 0.8.1)

pkgs/applications/version-management/gitlab/README

@@ -0,0 +1,5 @@
+to regenerate Gemfile.nix and Gemfile.lock you need to
+
+  % nix-build bootstrap.nix
+  % cp result/Gemfile.nix ./
+  % cp result/Gemfile.lock ./

pkgs/applications/version-management/gitlab/bootstrap.nix

@@ -0,0 +1,43 @@
+{ pkgs ? import <nixpkgs> {}
+}:
+
+with pkgs;
+
+let
+
+in stdenv.mkDerivation rec {
+  version = "7.4.2";
+  name = "gitlab-${version}";
+  __noChroot = true;
+  src = fetchurl {
+    url = "https://github.com/gitlabhq/gitlabhq/archive/v${version}.zip";
+    sha256 = "01iplkpa4scr0wcap6vjrc960dj15z4ciclaqswj0sz5hrp9glw6";
+  };
+  buildInputs = [
+    ruby rubyLibs.bundler libiconv libxslt libxml2 pkgconfig
+    libffi postgresql which stdenv unzip
+  ];
+  installPhase = ''
+    unset http_proxy
+    unset ftp_proxy
+
+    cp -R . $out
+    cp ${./generate_nix_requirements.rb} $out/generate_nix_requirements.rb
+    cd $out
+
+    cat > config/database.yml <<EOF
+    production:
+      adapter: postgresql
+    EOF
+
+    bundle config --local build.nokogiri --use-system-libraries \
+      --with-iconv-dir=${libiconv} \
+      --with-xslt-dir=${libxslt} \
+      --with-xml2-dir=${libxml2} \
+      --with-pkg-config \
+      --with-pg-config=${postgresql}/bin/pg_config
+
+    HOME="/tmp/gitlab-${version}" ruby generate_nix_requirements.rb
+    rm -R /tmp/gems
+  '';
+}

pkgs/applications/version-management/gitlab/default.nix

@@ -0,0 +1,80 @@
+{ stdenv, fetchurl, ruby, rubyLibs, libxslt, libxml2, pkgconfig, libffi, postgresql, libyaml, ncurses, curl, openssh, redis, zlib, icu, checkinstall, logrotate, docutils, cmake, git, gdbm, readline, unzip, gnumake, which }:
+
+let
+  gemspec = map (gem: fetchurl { url=gem.url; sha256=gem.hash; }) (import ./Gemfile.nix);
+
+
+in stdenv.mkDerivation rec {
+  version = "7.4.2";
+  name = "gitlab-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/gitlabhq/gitlabhq/archive/v${version}.zip";
+    sha256 = "01iplkpa4scr0wcap6vjrc960dj15z4ciclaqswj0sz5hrp9glw6";
+  };
+
+  buildInputs = [
+    ruby rubyLibs.bundler libyaml gdbm readline ncurses curl openssh redis zlib
+    postgresql libxslt libxml2 pkgconfig libffi icu checkinstall logrotate docutils
+    git unzip gnumake which cmake
+  ];
+
+  # cmake is required by a build depdenceny, not the main binary:
+  dontUseCmakeConfigure = true;
+
+  patches = [
+    ./remove-hardcoded-locations.patch
+  ];
+  postPatch = ''
+    mv config/gitlab.yml.example config/gitlab.yml
+  '';
+
+  installPhase = ''
+    mkdir -p $out/share/gitlab
+    cp -R . $out/share/gitlab
+    cd $out/share/gitlab
+
+    export HOME=$(pwd)
+    export GITLAB_EMAIL_FROM="required@to-make-it-work.org"
+
+    # required for some gems:
+    cat > config/database.yml <<EOF
+      production:
+        adapter: postgresql
+        database: gitlab
+        host: <%= ENV["GITLAB_DATABASE_HOST"] || "127.0.0.1" %>
+        password: <%= ENV["GITLAB_DATABASE_PASSWORD"] || "blerg" %>
+        username: gitlab
+        encoding: utf8
+    EOF
+
+    mkdir -p vendor/cache
+    ${stdenv.lib.concatStrings (map (gem: "ln -s ${gem} vendor/cache/${gem.name};") gemspec)}
+
+    bundle config build.nokogiri \
+      --use-system-libraries \
+      --with-xslt-dir=${libxslt} \
+      --with-xml2-dir=${libxml2} \
+      --with-pkg-config=${pkgconfig}/bin/pkg-config \
+      --with-pg-config=${postgresql}/bin/pg_config
+
+    # See https://github.com/gitlabhq/gitlab-public-wiki/wiki/Trouble-Shooting-Guide:
+    bundle install -j4 --verbose --local --deployment --without development test mysql
+
+    # For reasons I don't understand "bundle exec" ignores the
+    # RAILS_ENV causing tests to be executed that fail because we're
+    # not installing development and test gems above. Deleting the
+    # tests works though.:
+    rm $out/share/gitlab/lib/tasks/test.rake
+
+    # Assets
+    bundle exec rake assets:precompile RAILS_ENV=production
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = http://www.gitlab.com/;
+    platforms = platforms.linux;
+    maintainers = [ ];
+    license = licenses.mit;
+  };
+}

pkgs/applications/version-management/gitlab/generate_nix_requirements.rb

@@ -0,0 +1,56 @@
+#!/usr/bin/env ruby
+
+require 'rubygems'
+require 'bundler'
+require 'fileutils'
+require 'net/http'
+require 'net/https'
+require 'uri'
+
+TMP_DIR = "/tmp/gems"
+
+FileUtils.rm_rf(TMP_DIR) if File.exists?(TMP_DIR)
+FileUtils.mkdir TMP_DIR
+
+GEMSERVER = "http://rubygems.org"
+
+# inspect Gemfile.lock
+lockfile = Bundler::LockfileParser.new(Bundler.read_file("Gemfile.lock"))
+
+to_mirror = {}
+
+uri = URI(GEMSERVER)
+http = Net::HTTP.new(uri.host, uri.port)
+http.use_ssl = uri.scheme == 'https'
+
+requirements = {}
+
+lockfile.specs.each do |s|
+  possible_gem_name = "#{s.name}-#{s.version.to_s}.gem"
+
+  Dir.chdir TMP_DIR do
+    filename = `gem fetch #{s.name} -v #{s.version.to_s}`.split()[1]
+    hash = `sha256sum #{filename}.gem`
+    url = "#{GEMSERVER}/downloads/#{filename}.gem"
+    puts url
+    requirements[s.name] = { :version => s.version.to_s, 
+                             :hash => hash.split().first,
+                             :url => url,}
+    
+  end
+end
+
+filename = 'Gemfile.nix'
+
+File.open(filename, 'w') do |file|
+  file.puts "["
+  requirements.each do |name, info|
+    file.puts "{"
+    file.puts ['name = ', '"', name, '";'].join('')
+    file.puts ['hash = ', '"', info[:hash], '";'].join('')
+    file.puts ['url = ', '"', info[:url], '";'].join('')
+    file.puts ['version = ', '"', info[:version], '";'].join('')
+    file.puts "}"
+  end
+  file.puts "]"
+end

pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch

@@ -0,0 +1,109 @@
+diff --git a/config/environments/production.rb b/config/environments/production.rb
+index 78bf543..9b37122 100644
+--- a/config/environments/production.rb
++++ b/config/environments/production.rb
+@@ -66,10 +66,10 @@ Gitlab::Application.configure do
+ 
+   config.action_mailer.delivery_method = :sendmail
+   # Defaults to:
+-  # # config.action_mailer.sendmail_settings = {
+-  # #   location: '/usr/sbin/sendmail',
+-  # #   arguments: '-i -t'
+-  # # }
++  config.action_mailer.sendmail_settings = {
++    location: '/var/setuid-wrappers/sendmail',
++    arguments: '-i -t'
++  }
+   config.action_mailer.perform_deliveries = true
+   config.action_mailer.raise_delivery_errors = true
+ 
+diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example
+index e7a8d08..834ecaf 100644
+--- a/config/gitlab.yml.example
++++ b/config/gitlab.yml.example
+@@ -17,8 +17,8 @@ production: &base
+   ## GitLab settings
+   gitlab:
+     ## Web server settings (note: host is the FQDN, do not include http://)
+-    host: localhost
+-    port: 80 # Set to 443 if using HTTPS, see installation.md#using-https for additional HTTPS configuration details
++    host: <%= ENV['GITLAB_HOST'] || 'localhost' %>
++    port: <%= ENV['GITLAB_PORT'] || 80 %>
+     https: false # Set to true if using HTTPS, see installation.md#using-https for additional HTTPS configuration details
+ 
+     # Uncommment this line below if your ssh host is different from HTTP/HTTPS one
+@@ -31,11 +31,11 @@ production: &base
+     # relative_url_root: /gitlab
+ 
+     # Uncomment and customize if you can't use the default user to run GitLab (default: 'git')
+-    # user: git
++    user: gitlab
+ 
+     ## Email settings
+     # Email address used in the "From" field in mails sent by GitLab
+-    email_from: example@example.com
++    email_from: <%= ENV['GITLAB_EMAIL_FROM'] %>
+ 
+     # Email server smtp settings are in [a separate file](initializers/smtp_settings.rb.sample).
+ 
+@@ -230,12 +230,12 @@ production: &base
+   # GitLab Satellites
+   satellites:
+     # Relative paths are relative to Rails.root (default: tmp/repo_satellites/)
+-    path: /home/git/gitlab-satellites/
++    path: <%= ENV['GITLAB_SATELLITES_PATH'] %>
+     timeout: 30
+ 
+   ## Backup settings
+   backup:
+-    path: "tmp/backups"   # Relative paths are relative to Rails.root (default: tmp/backups/)
++    path: <%= ENV['GITLAB_BACKUP_PATH'] %>
+     # keep_time: 604800   # default: 0 (forever) (in seconds)
+     # upload:
+     #   # Fog storage connection settings, see http://fog.io/storage/ .
+@@ -249,11 +249,11 @@ production: &base
+ 
+   ## GitLab Shell settings
+   gitlab_shell:
+-    path: /home/git/gitlab-shell/
++    path: <%= ENV['GITLAB_SHELL_PATH'] %>
+ 
+     # REPOS_PATH MUST NOT BE A SYMLINK!!!
+-    repos_path: /home/git/repositories/
+-    hooks_path: /home/git/gitlab-shell/hooks/
++    repos_path: <%= ENV['GITLAB_REPOSITORIES_PATH'] %>
++    hooks_path: <%= ENV['GITLAB_SHELL_HOOKS_PATH'] %>
+ 
+     # Git over HTTP
+     upload_pack: true
+@@ -266,7 +266,7 @@ production: &base
+   # CAUTION!
+   # Use the default values unless you really know what you are doing
+   git:
+-    bin_path: /usr/bin/git
++    bin_path: git
+     # The next value is the maximum memory size grit can use
+     # Given in number of bytes per git object (e.g. a commit)
+     # This value can be increased if you have very large commits
+@@ -299,7 +299,7 @@ test:
+   gravatar:
+     enabled: true
+   gitlab:
+-    host: localhost
++    host: <%= ENV['GITLAB_HOST'] %>
+     port: 80
+ 
+     # When you run tests we clone and setup gitlab-shell
+diff --git a/lib/gitlab/app_logger.rb b/lib/gitlab/app_logger.rb
+index 8e4717b..abfe2e4 100644
+--- a/lib/gitlab/app_logger.rb
++++ b/lib/gitlab/app_logger.rb
+@@ -1,7 +1,7 @@
+ module Gitlab
+   class AppLogger < Gitlab::Logger
+     def self.file_name
+-      'application.log'
++      ENV["GITLAB_APPLICATION_LOG_PATH"]
+     end
+ 
+     def format_message(severity, timestamp, progname, msg)

pkgs/top-level/all-packages.nix

@@ -1271,6 +1271,10 @@ let
 
   gifsicle = callPackage ../tools/graphics/gifsicle { };
 
+  gitlab = callPackage ../applications/version-management/gitlab { };
+
+  gitlab-shell = callPackage ../applications/version-management/gitlab-shell { };
+
   glusterfs = callPackage ../tools/filesystems/glusterfs { };
 
   glmark2 = callPackage ../tools/graphics/glmark2 { };