If you want to make your life absolutely hell, perhaps you could manage this. I don’t recommend it.
I recommend a Gitlab CE “omnibus” install, without any splitting up of various parts of it to various machines.
The only thing you MIGHT be able to move to a different server would be perhaps the PostGres instance but I see zero benefit in that.
You could run your entire Gitlab CE instance from your DMZ, and the only allow certain things like your Gitlab’s fixed IP to access,say, your LDAP server that is in your main network, for company logins.
But I don’t recommend that. A private Gitlab Instance belongs ENTIRELY in your private network, and you can give trusted people access to it via VPN.
Either you want a private gitlab or you don’t. There’s no such thing as half way here.