gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-23 12:56:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

GitLab cross-site replication Phase 1c (stage 2): live streaming replication

Browse Source 
Adds externalClusters connectionParameters + replica.self/primary/source
to all four Cluster CRs (home pg-gitlab/pg-praefect, VPS
pg-gitlab/pg-praefect), turning last commit's recovery-only replicas
into real CNPG streaming replicas - exact pattern already proven for
pg-authentik. TLS certs copied cross-cluster manually (kubectl, not
git, same as every other cross-cluster secret in this plan).

Also adds pg-gitlab-app/pg-praefect-app password sync (PushSecret home
-> Vault -> ExternalSecret VPS, Merge policy) - CNPG-generated
passwords stay in sync via WAL replication but the K8s Secret OBJECTS
never resync on their own, same gap already closed for pg-authentik-app.

VPS's standalone clusters were already destroyed and recreated as
recovery-mode replicas in the prior commit (with the user's explicit
help running the classifier-blocked kubectl delete) - this commit turns
on the actual streaming replication on top of that.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Scooby Husky
2026-08-22 13:31:09 -05:00
co-authored by Claude Sonnet 5
parent 83c06a888d
commit 4a0de188df
6 changed files with 284 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/gitlab/manifests/praefect-cnpg-cluster.yaml
+41
View File
@@ -76,3 +76,44 @@ spec:
monitoring:
enablePodMonitor: true
# GitLab cross-site replication Phase 1c stage 2 - same pattern as
# cnpg-cluster.yaml (pg-gitlab) in this same directory.
externalClusters:
- name: home
connectionParameters:
host: pg-praefect-rw
port: "5432"
dbname: praefect_production
user: streaming_replica
sslmode: verify-ca
sslCert:
name: pg-praefect-replication
key: tls.crt
sslKey:
name: pg-praefect-replication
key: tls.key
sslRootCert:
name: pg-praefect-ca
key: ca.crt
- name: vps
connectionParameters:
host: 100.108.113.41
port: "32445"
dbname: praefect_production
user: streaming_replica
sslmode: verify-ca
sslCert:
name: pg-praefect-vps-replication
key: tls.crt
sslKey:
name: pg-praefect-vps-replication
key: tls.key
sslRootCert:
name: pg-praefect-vps-ca
key: ca.crt
replica:
self: home
primary: home
source: home