---
# Exposes pg-authentik's current primary to the VPS/witness over the
# Netbird mesh for streaming replication (see the "Multi-Site Active
# Failover" plan) - same selector CNPG's own pg-authentik-rw ClusterIP
# Service uses, just NodePort instead, since CNPG doesn't manage this
# object and won't fight with it. Needs
# infrastructure/kyverno/policies/ha-failover-nodeport-exception.yaml
# (disallow-nodeport-services is enforced cluster-wide otherwise).
#
# Second port (61432, ClusterIP only - no nodePort needed) added for the
# CoreDNS rewrite in infrastructure/coredns/manifests/: home's own pods
# resolving pg-authentik.ha.huskypup.net rewrite to THIS service (not
# CNPG's own pg-authentik-rw) specifically so they can reach it on the
# SAME port number the app tier is configured with (61432, matching the
# external floating hostname's port - see infrastructure/authentik/
# values.yaml's AUTHENTIK_POSTGRESQL__PORT) - CoreDNS rewrite only
# changes the resolved NAME, not the port the client then connects to,
# so the target service has to actually listen on that same port too, or
# the connection times out even though DNS resolves correctly (confirmed
# live 2026-08-20).
apiVersion: v1
kind: Service
metadata:
  name: ha-authentik-postgres
  namespace: authentik
spec:
  type: NodePort
  selector:
    cnpg.io/cluster: pg-authentik
    cnpg.io/instanceRole: primary
  ports:
    - name: nodeport-5432
      port: 5432
      targetPort: 5432
      nodePort: 32432
    - name: floating-port-61432
      port: 61432
      targetPort: 5432