Todos

• Self sign-up stays open: Gitlab::CurrentSettings.signup_enabled? returns true and require_admin_approval_after_user_signup returns true on the deployed instance, so /users/sign_up accepts visitors whose accounts wait for an administrator’s approval (no takeover). The role sets neither signup_enabled in templates/config/gitlab.yml.j2 nor the application setting. Options: signup_enabled: false in gitlab.yml.j2 (applies to fresh installs only), or converge the application setting from a rails runner task.

• tasks/utils/mcp/provision.yml:17 hands GITLAB_MCP_TOKEN_OWNER_PASSWORD=<value> to container exec in argv, which the deploy log prints at -vv. Options: pass -e GITLAB_MCP_TOKEN_OWNER_PASSWORD without a value plus the task’s environment:.

• Gravatar is on (gravatar_enabled returns true): the top bar avatar loads from https://secure.gravatar.com/avatar/<hash> (measured naturalWidth 80 from the Playwright container), so avatars break on an offline host and every page view sends the e-mail hash to a third party. Options: gravatar: enabled: false in templates/config/gitlab.yml.j2 (fresh installs), or converge the application setting gravatar_enabled.

• The README section “MCP server” names v19.3.1 and a token on root; meta/services.yml pins a newer release and tasks/utils/mcp/provision.yml mints the token on mcp-web-app-gitlab.