gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-23 12:56:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

GitLab cross-site replication Phase 2b: home-side Gitaly network exposure

Browse Source 
Per-pod NodePort Services for the 3 existing Gitaly nodes
(ha-gitaly-nodeport.yaml) plus home's Rails internal API
(ha-gitlab-internal-api-nodeport.yaml, needed for gitlab-shell hooks
whenever the VPS node is primary for a repo). PeerAuthentication
PERMISSIVE + AuthorizationPolicy port rules for both, matching the
proven Postgres pattern. CoreDNS rewrites so home's own Praefect
resolves the floating hostnames locally instead of round-tripping.

Reached over the Netbird mesh, not the UniFi WAN forward used for
Postgres - Gitaly gRPC here is plaintext (carries the gitaly_token,
gitlab_shell_secret, and raw repo contents), unlike CNPG's
TLS-negotiated stream.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Scooby Husky
2026-08-22 13:59:03 -05:00
co-authored by Claude Sonnet 5
parent e73561e5ca
commit 166ff0ffb7
5 changed files with 133 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/gitlab/manifests/ha-peerauth.yaml
+39
View File
@@ -49,3 +49,42 @@ spec:
mode: PERMISSIVE
"61443":
mode: PERMISSIVE
---
# Phase 2b (Gitaly cross-site replication) - the 3 Gitaly pods, exposed
# individually via ha-gitaly-nodeport.yaml for the VPS's 4th node to
# join the same virtual storage. Gitaly pods already carry
# istio.io/use-waypoint: none (chart default, gRPC doesn't tolerate L7
# waypoint processing well) but that only skips L7 processing - L4
# ztunnel mTLS enforcement is a separate concern, same fix needed as the
# Postgres precedent.
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
name: allow-ha-gitaly-replication
namespace: gitlab
spec:
selector:
matchLabels:
app: gitaly
mtls:
mode: STRICT
portLevelMtls:
"8075":
mode: PERMISSIVE
---
# Phase 2b - the VPS's Gitaly node calling home's Rails internal API
# (ha-gitlab-internal-api-nodeport.yaml) for gitlab-shell hooks.
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
name: allow-ha-gitlab-internal-api
namespace: gitlab
spec:
selector:
matchLabels:
app: webservice
mtls:
mode: STRICT
portLevelMtls:
"8181":
mode: PERMISSIVE