Add glab (GitLab CLI) to container — alongside gh #62

Summary

clide already ships `gh` (GitHub CLI). Add `glab` (GitLab CLI) as a companion for self-hosted GitLab instances.

Changes

Dockerfile

# Install glab — GitLab CLI
ARG GLAB_VERSION=1.47.0
RUN curl -sLO "https://gitlab.com/gitlab-org/cli/-/releases/v${GLAB_VERSION}/downloads/glab_${GLAB_VERSION}_linux_amd64.deb" \
    && dpkg -i "glab_${GLAB_VERSION}_linux_amd64.deb" \
    && rm "glab_${GLAB_VERSION}_linux_amd64.deb"

Pin the version — check latest at https://gitlab.com/gitlab-org/cli/-/releases

.env.example

# GitLab CLI (glab)
# Use a Group Access Token scoped to your GitLab group — preferred over personal PAT.
# Create at: https://your-gitlab-host/groups/YOUR_GROUP/-/settings/access_tokens
# Scopes: api (or read_repository + write_repository for tighter scope)
# GITLAB_TOKEN=glpat-xxxxxxxxxxxxxxxxxxxx
# GITLAB_HOST=gitlab.lan.wubi.sh

docker-compose.yml

Pass through to container:

environment:
  - GITLAB_TOKEN=${GITLAB_TOKEN:-}
  - GITLAB_HOST=${GITLAB_HOST:-}

firewall.sh egress allowlist

Self-hosted instances are LAN — no firewall changes needed (egress allowlist only blocks internet).

README — Included CLIs table

Add glab row:

| glab | GitLab CLI | GITLAB_TOKEN + GITLAB_HOST |

Auth design — group token (preferred)

All itscooleric GitLab repos live under a single group. A group access token is preferred over a personal PAT:

• Not tied to a personal account — survives credential rotation
• Scoped to the group only — principle of least privilege
• Shows as group_token in audit logs

# Create at:
https://your-gitlab-host/groups/YOUR_GROUP/-/settings/access_tokens
# Scopes: api

# Add to .env:
GITLAB_TOKEN=glpat-xxxx
GITLAB_HOST=gitlab.lan.wubi.sh

# Authenticate glab (run once inside container or in entrypoint):
glab config set token $GITLAB_TOKEN --host $GITLAB_HOST

Acceptance criteria

• glab binary available in container (glab --version)
• GITLAB_TOKEN + GITLAB_HOST env vars in docker-compose.yml + .env.example
• glab repo list returns repos when group token is set
• README Included CLIs table updated
• .env.example documented with group token instructions

Notes

• glab is Go — single binary, ~30MB image size impact
• Self-hosted LAN instances don't need firewall allowlist changes
• Group token can't do user-level identity (glab auth status may show limited info) — that's fine for forge/repo operations