gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-23 12:56:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

GitLab cross-site replication Phase 2b: home-side Gitaly network exposure

Browse Source 
Per-pod NodePort Services for the 3 existing Gitaly nodes
(ha-gitaly-nodeport.yaml) plus home's Rails internal API
(ha-gitlab-internal-api-nodeport.yaml, needed for gitlab-shell hooks
whenever the VPS node is primary for a repo). PeerAuthentication
PERMISSIVE + AuthorizationPolicy port rules for both, matching the
proven Postgres pattern. CoreDNS rewrites so home's own Praefect
resolves the floating hostnames locally instead of round-tripping.

Reached over the Netbird mesh, not the UniFi WAN forward used for
Postgres - Gitaly gRPC here is plaintext (carries the gitaly_token,
gitlab_shell_secret, and raw repo contents), unlike CNPG's
TLS-negotiated stream.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Scooby Husky
2026-08-22 13:59:03 -05:00
co-authored by Claude Sonnet 5
parent e73561e5ca
commit 166ff0ffb7
5 changed files with 133 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/gitlab/manifests/ha-gitaly-nodeport.yaml
+59
View File
@@ -0,0 +1,59 @@
---
# GitLab cross-site replication Phase 2b (see
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - exposes each
# of home's 3 existing Gitaly nodes individually to the VPS over the
# Netbird mesh, so Praefect can register the VPS as a 4th node in the
# SAME virtual storage and inter-Gitaly replication RPCs can reach each
# node directly. Per-pod (not per-StatefulSet), unlike the chart's own
# gitlab-gitaly-default Service - Praefect/Gitaly must address each node
# individually, not load-balance across them.
#
# Reached over the Netbird mesh (100.108.x.x), NOT the UniFi WAN forward
# used for Postgres - Gitaly's gRPC here is PLAINTEXT (carries the
# gitaly_token, the gitlab_shell_secret, and raw repository contents),
# unlike CNPG's TLS-negotiated stream. Home's nodes are directly
# reachable from Netbird peers on their real node IP (confirmed live for
# the ha-failover etcd precedent - infrastructure/ha-failover/manifests/
# etcd.yaml), so NodePort binds on that same interface without any
# additional exposure.
apiVersion: v1
kind: Service
metadata:
name: ha-gitaly-0
namespace: gitlab
spec:
type: NodePort
selector:
statefulset.kubernetes.io/pod-name: gitlab-gitaly-default-0
ports:
- port: 8075
targetPort: 8075
nodePort: 32446
---
apiVersion: v1
kind: Service
metadata:
name: ha-gitaly-1
namespace: gitlab
spec:
type: NodePort
selector:
statefulset.kubernetes.io/pod-name: gitlab-gitaly-default-1
ports:
- port: 8075
targetPort: 8075
nodePort: 32447
---
apiVersion: v1
kind: Service
metadata:
name: ha-gitaly-2
namespace: gitlab
spec:
type: NodePort
selector:
statefulset.kubernetes.io/pod-name: gitlab-gitaly-default-2
ports:
- port: 8075
targetPort: 8075
nodePort: 32448