---
# GitLab cross-site replication Phase 2b (see
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - exposes each
# of home's 3 existing Gitaly nodes individually to the VPS over the
# Netbird mesh, so Praefect can register the VPS as a 4th node in the
# SAME virtual storage and inter-Gitaly replication RPCs can reach each
# node directly. Per-pod (not per-StatefulSet), unlike the chart's own
# gitlab-gitaly-default Service - Praefect/Gitaly must address each node
# individually, not load-balance across them.
#
# Reached over the Netbird mesh (100.108.x.x), NOT the UniFi WAN forward
# used for Postgres - Gitaly's gRPC here is PLAINTEXT (carries the
# gitaly_token, the gitlab_shell_secret, and raw repository contents),
# unlike CNPG's TLS-negotiated stream. Home's nodes are directly
# reachable from Netbird peers on their real node IP (confirmed live for
# the ha-failover etcd precedent - infrastructure/ha-failover/manifests/
# etcd.yaml), so NodePort binds on that same interface without any
# additional exposure.
apiVersion: v1
kind: Service
metadata:
  name: ha-gitaly-0
  namespace: gitlab
spec:
  type: NodePort
  selector:
    statefulset.kubernetes.io/pod-name: gitlab-gitaly-default-0
  ports:
    - port: 8075
      targetPort: 8075
      nodePort: 32446
---
apiVersion: v1
kind: Service
metadata:
  name: ha-gitaly-1
  namespace: gitlab
spec:
  type: NodePort
  selector:
    statefulset.kubernetes.io/pod-name: gitlab-gitaly-default-1
  ports:
    - port: 8075
      targetPort: 8075
      nodePort: 32447
---
apiVersion: v1
kind: Service
metadata:
  name: ha-gitaly-2
  namespace: gitlab
spec:
  type: NodePort
  selector:
    statefulset.kubernetes.io/pod-name: gitlab-gitaly-default-2
  ports:
    - port: 8075
      targetPort: 8075
      nodePort: 32448