gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-23 12:56:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

GitLab cross-site replication Phase 1a: Postgres network plumbing

Browse Source 
Per the approved plan (jiggly-snacking-iverson.md, 'GitLab True
Cross-Site Replication' section) - replacing the git-mirror CronJob
with real CNPG streaming replication for pg-gitlab and pg-praefect,
reusing the exact pattern already proven for pg-authentik.

This commit is network plumbing only, no DB replication yet:
- Repoint both CNPG clusters' barmanObjectStore backup target from
  in-cluster gitlab-minio-svc to VPS MinIO (also becomes the initial
  seed source for the VPS's replicas in Phase 1c).
- New ha-gitlab-postgres/ha-praefect-postgres NodePort Services
  (bypass CNPG's own -rw Services) on both home and VPS.
- New PeerAuthentication with portLevelMtls PERMISSIVE on the replication
  ports - ambient mesh STRICT default would otherwise reset the
  VPS/witness's connection before the Postgres TLS handshake starts.
- Extended allow-gitlab-access AuthorizationPolicy with a port-scoped
  rule for the same traffic (no source.namespaces rule can match
  external, non-mesh peers).
- CoreDNS rewrites for pg-gitlab.ha.huskypup.net / pg-praefect.ha.huskypup.net
  so home's own pods reach the floating hostname locally instead of
  round-tripping through the WAN forward (no NAT hairpin support).

Still needed before Phase 1b/1c: UniFi WAN port-forwards for external
ports 61442/61443 -> talos-cp-01:32442/32443, source-restricted to the
VPS + witness public IPs (manual, same as the existing 61432 rule).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Scooby Husky
2026-08-22 12:47:03 -05:00
co-authored by Claude Sonnet 5
parent a104008111
commit 04fa80ece3
7 changed files with 236 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infrastructure/istio/manifests/apps/authorization-policies-apps.yaml
+17
View File
@@ -83,6 +83,23 @@ spec:
- source:
ipBlocks:
- "10.244.0.0/16"
# GitLab cross-site replication (see
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md): CNPG
# streaming replication from the VPS/witness, arriving via the
# ha-gitlab-postgres/ha-praefect-postgres NodePorts - no mesh
# identity at all, so no source.namespaces rule above can match them.
# Scoped by destination port instead, matching the port-scoped
# PERMISSIVE PeerAuthentication in ha-peerauth.yaml (same root cause,
# same fix, one layer up - mTLS being allowed through isn't enough by
# itself, this ALLOW policy independently denies anything not
# matching one of the rules above). Same pattern already proven for
# Authentik in infrastructure/istio/manifests/mesh/authorization-policies.yaml.
- to:
- operation:
ports:
- "5432"
- "61442" # pg-gitlab floating-hostname port, see ha-postgres-nodeport.yaml
- "61443" # pg-praefect floating-hostname port, see ha-postgres-nodeport.yaml
---
# --- n8n: Allow ingress + Prometheus + intra-namespace ---