Damn, this thing uses Go, Rails, and Vue.js? Then shells out to run other stuff?
Anyway, I'm thinking that since Plesk doesn't seem to really know about other LE update processes, and Gitlab doesn't know about Plesk's, you may have had a bit of a 'race' condition, where each was trying to update the cert. But since neither recognized what the other may have already pulled, they each in fact requested a NEW cert causing the sandbox to hit the LE limit.
It's the only thing that makes sense to me. So if you insist on using Plesk to manage, then disable any other system that might duplicate that management functionality.
BTW, answer a question: Are you using Apache or Nginx? Because GL seems to have an Nginx module that it uses.
Personally, projects like Gitlab are too heavy for me to use. For git repositories I run, I use either Gogs or Gitea, which are both written in Go and perform much better without all the bells and whistles. They provide Git, and a Wiki, and both have the added bonus of being able to import repositories from github/bitbucket/etc, AND keep them synchronized with the original....Gitlab appears to allow imports, but doesn't keep the imported repository synced with the original.
AIR.
