GitLab cross-site replication Phase 2b: enable Gitaly + workhorse TLS

Per the approved plan (Istio federation scoped separately, current
NodePort/PeerAuth/cert-manager pattern continues for these 2 remaining
links). Real Let's Encrypt certs (not self-signed) via the same DNS-01
ClusterIssuer used everywhere else - both sites already trust Let's
Encrypt's public CA, no custom CA distribution needed.

- global.gitaly.tls.enabled: adds tls_listen_addr (8076) alongside the
  existing plaintext listener (8075, stays for in-cluster traffic
  that doesn't need it). Requires
  global.praefect.virtualStorages[0].tlsSecretName (chart's own NOTES.txt
  validation rejects the render without it, confirmed live).
- global.workhorse.tls.enabled + global.workhorse.host: Gitaly's [gitlab]
  url (internal-API callback for gitlab-shell hooks) switches from an
  unpublishable *.svc.cluster.local name to a real floating hostname
  (gitlab-internal-api.ha.huskypup.net) that Let's Encrypt CAN certify -
  confirmed live this replaces the plaintext [[listeners]] block with
  [listeners.tls] on the SAME port (8181), not a second port like Gitaly.
- praefect-ha-configmap.yaml (the manually-patched live config) updated
  to tls:// + floating hostnames for all 3 home nodes, so home's own
  Praefect uses the identical addresses it'll hand the VPS as peer
  addresses once Phase 2b's 4th node lands.
- New CoreDNS rewrite for gitlab-internal-api.ha.huskypup.net (same
  local-rewrite pattern as pg-*/gitaly-* already have).

Sequencing note: applying live - Certificates must issue before the
TLS-enabling values land, or Gitaly/webservice pods fail to start
(missing secret for their init container's cert copy).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/gitlab/manifests/ha-gitaly-nodeport.yaml

@@ -1,21 +1,23 @@
 ---
 # GitLab cross-site replication Phase 2b (see
 # /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - exposes each
-# of home's 3 existing Gitaly nodes individually to the VPS over the
-# Netbird mesh, so Praefect can register the VPS as a 4th node in the
-# SAME virtual storage and inter-Gitaly replication RPCs can reach each
-# node directly. Per-pod (not per-StatefulSet), unlike the chart's own
-# gitlab-gitaly-default Service - Praefect/Gitaly must address each node
-# individually, not load-balance across them.
+# of home's 3 existing Gitaly nodes individually to the VPS, so Praefect
+# can register the VPS as a 4th node in the SAME virtual storage and
+# inter-Gitaly replication RPCs can reach each node directly. Per-pod
+# (not per-StatefulSet), unlike the chart's own gitlab-gitaly-default
+# Service - Praefect/Gitaly must address each node individually, not
+# load-balance across them.
 #
-# Reached over the Netbird mesh (100.108.x.x), NOT the UniFi WAN forward
-# used for Postgres - Gitaly's gRPC here is PLAINTEXT (carries the
-# gitaly_token, the gitlab_shell_secret, and raw repository contents),
-# unlike CNPG's TLS-negotiated stream. Home's nodes are directly
-# reachable from Netbird peers on their real node IP (confirmed live for
-# the ha-failover etcd precedent - infrastructure/ha-failover/manifests/
-# etcd.yaml), so NodePort binds on that same interface without any
-# additional exposure.
+# Reached over the same public UniFi WAN forward already used for
+# Postgres, NOT the Netbird mesh directly - confirmed live the direct-
+# Netbird-IP path doesn't accept inbound connections to home (same gap
+# already present for the existing etcd quorum; the earlier assumption
+# that NodePort binds on a reachable Netbird interface was wrong).
+# Targets Gitaly's TLS port (8076), not the plaintext one (8075) -
+# Gitaly's gRPC has no built-in transport security, and this WAN hop
+# would otherwise carry the gitaly_token, gitlab_shell_secret, and raw
+# repository contents in plaintext. See gitaly-tls-certificate.yaml and
+# global.gitaly.tls.enabled in values.yaml.
 apiVersion: v1
 kind: Service
 metadata:
@@ -26,8 +28,8 @@ spec:
   selector:
     statefulset.kubernetes.io/pod-name: gitlab-gitaly-default-0
   ports:
-    - port: 8075
-      targetPort: 8075
+    - port: 8076
+      targetPort: 8076
       nodePort: 32446
 ---
 apiVersion: v1
@@ -40,8 +42,8 @@ spec:
   selector:
     statefulset.kubernetes.io/pod-name: gitlab-gitaly-default-1
   ports:
-    - port: 8075
-      targetPort: 8075
+    - port: 8076
+      targetPort: 8076
       nodePort: 32447
 ---
 apiVersion: v1
@@ -54,6 +56,6 @@ spec:
   selector:
     statefulset.kubernetes.io/pod-name: gitlab-gitaly-default-2
   ports:
-    - port: 8075
-      targetPort: 8075
+    - port: 8076
+      targetPort: 8076
       nodePort: 32448