GitLab cross-site replication Phase 2b: enable Gitaly + workhorse TLS

Per the approved plan (Istio federation scoped separately, current
NodePort/PeerAuth/cert-manager pattern continues for these 2 remaining
links). Real Let's Encrypt certs (not self-signed) via the same DNS-01
ClusterIssuer used everywhere else - both sites already trust Let's
Encrypt's public CA, no custom CA distribution needed.

- global.gitaly.tls.enabled: adds tls_listen_addr (8076) alongside the
  existing plaintext listener (8075, stays for in-cluster traffic
  that doesn't need it). Requires
  global.praefect.virtualStorages[0].tlsSecretName (chart's own NOTES.txt
  validation rejects the render without it, confirmed live).
- global.workhorse.tls.enabled + global.workhorse.host: Gitaly's [gitlab]
  url (internal-API callback for gitlab-shell hooks) switches from an
  unpublishable *.svc.cluster.local name to a real floating hostname
  (gitlab-internal-api.ha.huskypup.net) that Let's Encrypt CAN certify -
  confirmed live this replaces the plaintext [[listeners]] block with
  [listeners.tls] on the SAME port (8181), not a second port like Gitaly.
- praefect-ha-configmap.yaml (the manually-patched live config) updated
  to tls:// + floating hostnames for all 3 home nodes, so home's own
  Praefect uses the identical addresses it'll hand the VPS as peer
  addresses once Phase 2b's 4th node lands.
- New CoreDNS rewrite for gitlab-internal-api.ha.huskypup.net (same
  local-rewrite pattern as pg-*/gitaly-* already have).

Sequencing note: applying live - Certificates must issue before the
TLS-enabling values land, or Gitaly/webservice pods fail to start
(missing secret for their init container's cert copy).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/gitlab/manifests/praefect-ha-configmap.yaml

@@ -28,12 +28,17 @@
 # jsonpath='{.data}' | kubectl -n gitlab patch cm gitlab-praefect --type
 # merge -p "{\"data\":$(cat -)}")
 #
-# Content below is intentionally byte-identical to the chart's own
-# current rendering for the first pass (confirmed live via `kubectl -n
-# gitlab get cm gitlab-praefect -o jsonpath='{.data.config\.toml\.tpl}'`)
-# - proves the ignoreDifferences + manual-patch mechanism itself doesn't
-# break anything, before a follow-up switches addressing to floating
-# hostnames and adds the VPS as a 4th node.
+# Content below has since moved past byte-identical: nodes 0-2 now use
+# tls:// on port 8076 (matching global.gitaly.tls.enabled in
+# values.yaml) and the floating hostnames gitaly-{0,1,2}.ha.huskypup.net
+# (CoreDNS-rewritten locally for home's own traffic, same reasoning as
+# pg-gitlab.ha.huskypup.net) rather than in-cluster DNS names or the
+# plaintext scheme - this is what makes the SAME addresses usable once
+# the VPS joins as a 4th node, without home's own Praefect needing a
+# different config than what it hands the VPS as peer addresses. Praefect
+# trusts the cert via the pod's normal system CA bundle - it's a real
+# Let's Encrypt cert (gitaly-tls-certificate.yaml), not self-signed, so
+# no extra CA trust config is needed here.
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -62,15 +67,15 @@ data:
     name = 'default'
     [[virtual_storage.node]]
     storage = 'gitlab-gitaly-default-0'
-    address = 'tcp://gitlab-gitaly-default-0.gitlab-gitaly-default.gitlab.svc:8075'
+    address = 'tls://gitaly-0.ha.huskypup.net:8076'
     token = {% file.Read "/etc/gitlab-secrets/praefect/gitaly_token" | strings.TrimSpace | data.ToJSON %}
     [[virtual_storage.node]]
     storage = 'gitlab-gitaly-default-1'
-    address = 'tcp://gitlab-gitaly-default-1.gitlab-gitaly-default.gitlab.svc:8075'
+    address = 'tls://gitaly-1.ha.huskypup.net:8076'
     token = {% file.Read "/etc/gitlab-secrets/praefect/gitaly_token" | strings.TrimSpace | data.ToJSON %}
     [[virtual_storage.node]]
     storage = 'gitlab-gitaly-default-2'
-    address = 'tcp://gitlab-gitaly-default-2.gitlab-gitaly-default.gitlab.svc:8075'
+    address = 'tls://gitaly-2.ha.huskypup.net:8076'
     token = {% file.Read "/etc/gitlab-secrets/praefect/gitaly_token" | strings.TrimSpace | data.ToJSON %}