GitLab CE Pipelines to EC2 in a Closed Network (Gitlab Ce Pipelines To Ec2 In A Closed Network)

GitLab CE Pipelines to EC2 in a Closed Network

Self-hosted GitLab CE runners build in a closed network and promote versioned artifacts onto EC2 hosts.

commit → runner → artifact → EC2 deploy job

SaaS GitLab varsaymayın; kapalı CE gerçekliği tasarım girdiidir.

Concepts, defined where they first appear

📦 Analysis API
Django read/analysis endpoints consumed by MFEs and the control plane.

📦 Closed Network CI
Pipelines on self-hosted GitLab CE runners inside a closed network.

📦 Artifact
Versioned deploy package shipped to EC2.

📦 Continuous Pentest
Open-source security scanning in the pipeline (ProjectDiscovery ecosystem).

Blurring these layers produces the wrong truth in analytics and on the map UI.

Shape of the problem

Self-hosted GitLab CE runners build in a closed network and promote versioned artifacts onto EC2 hosts.

commit → runner → artifact → EC2 deploy job

The split that works

SaaS GitLab varsaymayın; kapalı CE gerçekliği tasarım girdiidir.

commit → runner → artifact → EC2 deploy job
        ↓
   explicit contract → frontend

Frontend bridge

Ops maps, wait-geofence UI, and MFEs consume these read models — they never bind to raw ERP/MySQL.

The mappings that get confused most often

❌ ERP MySQL = analytics database
✓ ERP is a write store; analytics lives in PostGIS

❌ Let the map trust public/vendor routers blindly
✓ Production needs your API/OSRM edge

❌ Log ML outputs with PII
✓ Evaluation and serving obey privacy boundaries

A checklist for auditing your own system

1. Which store is source of truth for this surface?
2. Which API contract does the frontend call?
3. What happens if one cluster node dies?
4. How is lag shown to operators?
5. Deny-list: any client domain/vendor leakage?

What to take away from this part

1. Polyglot stores exist for different workloads; one-DB fantasies are fragile.
2. Frontends consume clean read models, not the ERP.
3. ML/OSRM outputs need an API contract before they hit the map.

A beautiful map drawn from a dirty source is still a lie.