# GitLab cross-site replication (see
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - direct copy of
# infrastructure/authentik/manifests/ha-postgres-peerauth.yaml's proven
# fix. The gitlab namespace carries the same ambient-mesh STRICT default
# as authentik; without this, ztunnel resets the VPS/witness's connection
# (no mesh identity - they're not in this cluster) before the Postgres
# TLS handshake can even start, surfacing as "server closed the
# connection unexpectedly" on the replica side despite the NodePort/
# firewall path being entirely correct.
#
# Scoped to just each CNPG primary pod's ports via portLevelMtls, not the
# whole namespace - GitLab's own in-mesh east-west traffic (webservice
# <-> gitaly <-> redis <-> sidekiq <-> praefect) stays STRICT.
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: allow-ha-gitlab-postgres-replication
  namespace: gitlab
spec:
  selector:
    matchLabels:
      cnpg.io/cluster: pg-gitlab
  mtls:
    mode: STRICT
  portLevelMtls:
    "5432":
      mode: PERMISSIVE
    # Floating-hostname port (see ha-postgres-nodeport.yaml) - needs its
    # own entry, ambient's port-level mTLS enforcement is keyed on the
    # port actually dialed (61442), not just the pod's real containerPort
    # (5432) it eventually reaches (confirmed live for the authentik
    # precedent, same mechanism here).
    "61442":
      mode: PERMISSIVE
---
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: allow-ha-praefect-postgres-replication
  namespace: gitlab
spec:
  selector:
    matchLabels:
      cnpg.io/cluster: pg-praefect
  mtls:
    mode: STRICT
  portLevelMtls:
    "5432":
      mode: PERMISSIVE
    "61443":
      mode: PERMISSIVE
---
# Phase 2b (Gitaly cross-site replication) - the 3 Gitaly pods, exposed
# individually via ha-gitaly-nodeport.yaml for the VPS's 4th node to
# join the same virtual storage. Gitaly pods already carry
# istio.io/use-waypoint: none (chart default, gRPC doesn't tolerate L7
# waypoint processing well) but that only skips L7 processing - L4
# ztunnel mTLS enforcement is a separate concern, same fix needed as the
# Postgres precedent.
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: allow-ha-gitaly-replication
  namespace: gitlab
spec:
  selector:
    matchLabels:
      app: gitaly
  mtls:
    mode: STRICT
  portLevelMtls:
    "8075":
      mode: PERMISSIVE
---
# Phase 2b - the VPS's Gitaly node calling home's Rails internal API
# (ha-gitlab-internal-api-nodeport.yaml) for gitlab-shell hooks.
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: allow-ha-gitlab-internal-api
  namespace: gitlab
spec:
  selector:
    matchLabels:
      app: webservice
  mtls:
    mode: STRICT
  portLevelMtls:
    "8181":
      mode: PERMISSIVE