I think we're in a similar boat, with VERY rigid internal and external firewalls. Access to gitlab for RPMs will be blocked by default, but we're hoping to allow for a spacewalk/satellite box to have access to cache packages.
Changing the URL in the attributes should do the trick for us handily. Will that work for you too, @DanW85 ?
Update: @DanW85 , we went with a custom cookbook external to cookbook-omnibus-gitlab, which pre-installs the gitlab-ce from a copy in files/default, and then includes the omnibus-gitlab cookbook. Yes, it's a ridiculous 400Mb cookbook, but when spacewalk lights up we'll go behind and trim it.
It seems to go well, (but we're still gnashing our teeth on the "please use the web form to go reset the password by hand unless someone jumped onto the box and stole it first" race issue. I sinCEREly hope pros didn't write it like that without a fix, lest the predicates find a challenge. And hey, if you're cheffing gitlab-ce too, show me where I can set the ENV and have that pre-populated ... if that still works!)