# GitLab cross-site replication Phase 2a (see
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - the chart has
# no support for registering an externally-hosted Gitaly node into an
# existing Praefect virtual storage (confirmed live: no
# virtualStorages[].nodes/address-override key exists in the template,
# gitalyReplicas just counts StatefulSet ordinals). Overriding Praefect's
# rendered config.toml is the only way to add one.
#
# The chart's own gitlab-praefect ConfigMap (auto-rendered from
# global.praefect.virtualStorages) is mounted at /etc/gitaly/templates,
# which CONFIG_TEMPLATE_DIRECTORY already points at - can't just add data
# to that SAME ConfigMap (ArgoCD/Helm fully owns and would revert it),
# and can't mount a second volume at the SAME path/name (Kubernetes
# rejects duplicate volume names). So this ConfigMap mounts at a
# DIFFERENT path (values.yaml's gitlab.praefect.extraVolumes), and
# CONFIG_TEMPLATE_DIRECTORY gets overridden via extraEnv to point at it
# instead - env var duplicate-key "last wins" IS legitimate documented
# Kubernetes behavior for a container's env: list, unlike volumes.
#
# Phase 2a content is intentionally byte-identical to the chart's own
# current rendering (confirmed live via `kubectl -n gitlab get cm
# gitlab-praefect -o jsonpath='{.data.config\.toml\.tpl}'`) - this
# commit only proves the override mechanism itself doesn't break
# anything, before Phase 2b switches addressing to floating hostnames
# and adds the VPS as a 4th node (no reason to change addressing scheme
# before there's an actual cross-site node that needs it).
apiVersion: v1
kind: ConfigMap
metadata:
  name: praefect-ha-config
  namespace: gitlab
data:
  config.toml.tpl: |
    # TCP address to listen on
    listen_addr = '0.0.0.0:8075'
    prometheus_listen_addr = '0.0.0.0:9236'

    prometheus_exclude_database_from_default_metrics = true

    [failover]
    enabled = true
    read_only_after_failover = true

    [auth]
    token = {% file.Read "/etc/gitlab-secrets/praefect/praefect_token" | strings.TrimSpace | data.ToJSON %}

    transitioning = false

    [logging]

    [[virtual_storage]]
    name = 'default'
    [[virtual_storage.node]]
    storage = 'gitlab-gitaly-default-0'
    address = 'tcp://gitlab-gitaly-default-0.gitlab-gitaly-default.gitlab.svc:8075'
    token = {% file.Read "/etc/gitlab-secrets/praefect/gitaly_token" | strings.TrimSpace | data.ToJSON %}
    [[virtual_storage.node]]
    storage = 'gitlab-gitaly-default-1'
    address = 'tcp://gitlab-gitaly-default-1.gitlab-gitaly-default.gitlab.svc:8075'
    token = {% file.Read "/etc/gitlab-secrets/praefect/gitaly_token" | strings.TrimSpace | data.ToJSON %}
    [[virtual_storage.node]]
    storage = 'gitlab-gitaly-default-2'
    address = 'tcp://gitlab-gitaly-default-2.gitlab-gitaly-default.gitlab.svc:8075'
    token = {% file.Read "/etc/gitlab-secrets/praefect/gitaly_token" | strings.TrimSpace | data.ToJSON %}


    [database]
    host = 'pg-praefect-rw.gitlab.svc.cluster.local'
    port = 5432
    user = 'app'
    password = {% file.Read "/etc/gitlab-secrets/praefect/db_password" | strings.TrimSpace | data.ToJSON %}
    dbname = 'praefect_production'
    sslmode = 'disable'