GitLab cross-site replication Phase 2a: Praefect config override mechanism

Proves the CONFIG_TEMPLATE_DIRECTORY redirect works before Phase 2b
adds any actual cross-site dependency. Content is byte-identical to
the chart's current rendering (confirmed live) - this commit only
tests the override plumbing itself: a new ConfigMap
(praefect-ha-configmap.yaml) mounted at a different path than the
chart's own /etc/gitaly/templates (can't reuse that path/volume name -
Kubernetes rejects duplicates), with CONFIG_TEMPLATE_DIRECTORY
overridden via extraEnv to point at it instead (last-wins env
semantics, confirmed Kubernetes-documented behavior).

Also removes gitlab.praefect.virtualStorages - confirmed live dead
config, global.praefect.virtualStorages is what the chart's template
actually reads.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/gitlab/values.yaml

@@ -285,14 +285,14 @@ gitlab:
     enabled: true
     minReplicas: 1
     maxReplicas: 1
-    
+
     # Note: Praefect PostgreSQL config is in global.praefect.psql
-    
+
     # Use CNPG-generated database secret
     dbSecret:
       secret: pg-praefect-app
       key: password
-    
+
     # Resources
     resources:
       requests:
@@ -301,11 +301,37 @@ gitlab:
       limits:
         cpu: 250m
         memory: 512Mi
-    
-    # Virtual storage configuration
-    virtualStorages:
-    - name: default
-      gitalyReplicas: 1  # Homelab sizing
+
+    # (dead config removed 2026-08-22: this virtualStorages block never
+    # actually did anything - confirmed live the chart's Praefect
+    # ConfigMap template iterates global.praefect.virtualStorages, not
+    # this one, so gitalyReplicas: 3 up there always won regardless of
+    # what this said. See global.praefect.virtualStorages above for the
+    # real config.)
+
+    # GitLab cross-site replication Phase 2a (see
+    # /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - redirects
+    # Praefect's config template source so a hand-written config.toml.tpl
+    # (praefect-ha-configmap.yaml) can add a VPS-hosted Gitaly node the
+    # chart itself has no mechanism to register. The chart's own
+    # gitlab-praefect ConfigMap is already mounted at
+    # /etc/gitaly/templates (which CONFIG_TEMPLATE_DIRECTORY points at by
+    # default) - can't add a second volume at that same path/name
+    # (Kubernetes rejects duplicate volume names), so this mounts the
+    # override at a different path and points CONFIG_TEMPLATE_DIRECTORY
+    # there instead. Duplicate env var names in a container's env: list
+    # resolve last-wins (documented Kubernetes behavior) - this entry
+    # renders after the chart's own, so it's the one that takes effect.
+    extraEnv:
+      CONFIG_TEMPLATE_DIRECTORY: /etc/gitaly/templates-ha
+    extraVolumes:
+      - name: praefect-ha-config
+        configMap:
+          name: praefect-ha-config
+    extraVolumeMounts:
+      - name: praefect-ha-config
+        mountPath: /etc/gitaly/templates-ha
+        readOnly: true
       maxUnavailable: 1
   
   # GitLab Exporter for Prometheus metrics