gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-23 12:56:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

GitLab cross-site replication Phase 2b: enable Gitaly + workhorse TLS

Browse Source 
Per the approved plan (Istio federation scoped separately, current
NodePort/PeerAuth/cert-manager pattern continues for these 2 remaining
links). Real Let's Encrypt certs (not self-signed) via the same DNS-01
ClusterIssuer used everywhere else - both sites already trust Let's
Encrypt's public CA, no custom CA distribution needed.

- global.gitaly.tls.enabled: adds tls_listen_addr (8076) alongside the
  existing plaintext listener (8075, stays for in-cluster traffic
  that doesn't need it). Requires
  global.praefect.virtualStorages[0].tlsSecretName (chart's own NOTES.txt
  validation rejects the render without it, confirmed live).
- global.workhorse.tls.enabled + global.workhorse.host: Gitaly's [gitlab]
  url (internal-API callback for gitlab-shell hooks) switches from an
  unpublishable *.svc.cluster.local name to a real floating hostname
  (gitlab-internal-api.ha.huskypup.net) that Let's Encrypt CAN certify -
  confirmed live this replaces the plaintext [[listeners]] block with
  [listeners.tls] on the SAME port (8181), not a second port like Gitaly.
- praefect-ha-configmap.yaml (the manually-patched live config) updated
  to tls:// + floating hostnames for all 3 home nodes, so home's own
  Praefect uses the identical addresses it'll hand the VPS as peer
  addresses once Phase 2b's 4th node lands.
- New CoreDNS rewrite for gitlab-internal-api.ha.huskypup.net (same
  local-rewrite pattern as pg-*/gitaly-* already have).

Sequencing note: applying live - Certificates must issue before the
TLS-enabling values land, or Gitaly/webservice pods fail to start
(missing secret for their init container's cert copy).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Scooby Husky
2026-08-22 14:24:13 -05:00
co-authored by Claude Sonnet 5
parent 166ff0ffb7
commit bce3861083
6 changed files with 145 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/gitlab/manifests/ha-gitlab-internal-api-nodeport.yaml
+12 -3
View File
@@ -4,9 +4,18 @@
# node. Gitaly's gitlab-shell hooks call POST /api/v4/internal/{allowed,
# pre_receive,post_receive} against this whenever the VPS node is
# primary for a repository (per-repository election can cause this even
# in normal operation) or after a real failover. Carries the shell
# secret in a header - same plaintext-over-Netbird-mesh reasoning as
# ha-gitaly-nodeport.yaml, not the UniFi WAN forward.
# in normal operation) or after a real failover.
#
# Reached over the same public UniFi WAN forward already used for
# Postgres/Gitaly, not the Netbird mesh directly (confirmed live that
# path doesn't accept inbound connections to home). Port stays 8181
# (unlike Gitaly's separate 8075/8076 split) - global.workhorse.tls.
# enabled in values.yaml replaces the plaintext listener with TLS on
# this SAME port rather than adding a second one. Carries the
# gitlab_shell_secret in a header, so this needed TLS just as much as
# Gitaly's gRPC did - see gitaly-tls-certificate.yaml's second
# Certificate (gitlab-workhorse-tls) and the
# gitlab-internal-api.ha.huskypup.net CoreDNS rewrite.
apiVersion: v1
kind: Service
metadata: