# GitLab cross-site replication Phase 2b - exposes home's Rails internal
# API (port 8181, a dedicated internal-only listener, deliberately NOT
# exposed through the public Istio ingress on 8080) to the VPS's Gitaly
# node. Gitaly's gitlab-shell hooks call POST /api/v4/internal/{allowed,
# pre_receive,post_receive} against this whenever the VPS node is
# primary for a repository (per-repository election can cause this even
# in normal operation) or after a real failover. Carries the shell
# secret in a header - same plaintext-over-Netbird-mesh reasoning as
# ha-gitaly-nodeport.yaml, not the UniFi WAN forward.
apiVersion: v1
kind: Service
metadata:
  name: ha-gitlab-internal-api
  namespace: gitlab
spec:
  type: NodePort
  selector:
    app: webservice
    release: gitlab
  ports:
    - port: 8181
      targetPort: 8181
      nodePort: 32449