From 9a9eb207b5ed0c3bdb3abb11214132421ecc63fa Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Sat, 22 Aug 2026 14:55:40 -0500 Subject: [PATCH] Revert workhorse TLS: broke public site on shared port 8181 global.workhorse.tls.enabled replaced workhorse's plaintext listener with a TLS-only one on port 8181 - but that port isn't internal-API -only, it's also what gitlab-web HTTPRoute routes ALL public gitlab.kube.huskypup.net traffic to. Envoy terminates public HTTPS and proxies to the pod in plaintext, so the TLS-only listener 400'd every public request ("Client sent an HTTP request to an HTTPS server"). Restored live via a direct ConfigMap patch + rollout restart before this commit could even be pushed, since the outage took out this repo's own GitLab-hosted git access too. global.workhorse.host stays (harmless without tls.enabled). Securing the VPS's future internal-API-over-WAN hop needs a different mechanism that doesn't collide with the public listener - not solved here. --- apps/gitlab/values.yaml | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/apps/gitlab/values.yaml b/apps/gitlab/values.yaml index a76c3bc..e105c91 100644 --- a/apps/gitlab/values.yaml +++ b/apps/gitlab/values.yaml @@ -77,13 +77,26 @@ global: # already proven for Postgres and Gitaly's own node addresses: home's # 3 Gitaly nodes resolve this locally (no WAN round-trip), the VPS's # 4th node resolves it via the UniFi WAN forward - one consistent - # https:// URL for every node regardless of site, rather than trying - # to TLS-certify an unpublishable *.svc.cluster.local name (which - # Let's Encrypt fundamentally can't issue for). + # URL for every node regardless of site. + # + # tls.enabled REVERTED 2026-08-22 - broke the live site (HTTP 400 + # "Client sent an HTTP request to an HTTPS server" on + # gitlab.kube.huskypup.net). Root cause: port 8181 is NOT internal-API + # -only - confirmed live via `kubectl get httproute gitlab-web` that + # ALL public traffic (gitlab.kube.huskypup.net, routed through Envoy/ + # Istio edge gateway) also targets gitlab-webservice-default:8181. + # global.workhorse.tls.enabled replaces the plaintext listener with + # TLS on that SAME port chart-wide, for both the public site AND the + # internal API - there's no chart-native way to TLS one without the + # other. Envoy terminates public HTTPS and proxies to the pod in + # plaintext, so a TLS-only pod listener 400s every public request. + # host: left in place (harmless without tls.enabled - only used for + # the [gitlab] url string, not port selection). Internal-API-over-WAN + # transport security for the VPS's future Gitaly node needs a + # different mechanism (e.g. network-layer TLS/mTLS via Istio, or a + # second dedicated port if the chart ever adds one) - not solved here. workhorse: host: gitlab-internal-api.ha.huskypup.net - tls: - enabled: true # Praefect configuration praefect: