---
# GitLab cross-site replication (see
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md's "GitLab True
# Cross-Site Replication" section) - direct copy of the proven pattern
# from infrastructure/authentik/manifests/ha-postgres-nodeport.yaml.
# Exposes pg-gitlab's and pg-praefect's current primaries to the
# VPS/witness over the Netbird mesh for streaming replication - same
# selectors CNPG's own -rw ClusterIP Services use, just NodePort instead,
# since CNPG doesn't manage these objects and won't fight with them.
# Needs infrastructure/kyverno/policies/ha-failover-nodeport-exception.yaml
# (name pattern ha-* already matches, no change needed there).
#
# Second port on each (61442/61443, ClusterIP only) for the CoreDNS
# rewrite in infrastructure/coredns/manifests/: home's own pods resolving
# pg-gitlab.ha.huskypup.net / pg-praefect.ha.huskypup.net rewrite to
# THESE services specifically so they can reach them on the SAME port
# number the app tier will eventually be configured with (Phase 3) -
# rewrite only changes the resolved NAME, not the port a client then
# connects to (confirmed live for the authentik precedent).
apiVersion: v1
kind: Service
metadata:
  name: ha-gitlab-postgres
  namespace: gitlab
spec:
  type: NodePort
  selector:
    cnpg.io/cluster: pg-gitlab
    cnpg.io/instanceRole: primary
  ports:
    - name: nodeport-5432
      port: 5432
      targetPort: 5432
      nodePort: 32442
    - name: floating-port-61442
      port: 61442
      targetPort: 5432
---
apiVersion: v1
kind: Service
metadata:
  name: ha-praefect-postgres
  namespace: gitlab
spec:
  type: NodePort
  selector:
    cnpg.io/cluster: pg-praefect
    cnpg.io/instanceRole: primary
  ports:
    - name: nodeport-5432
      port: 5432
      targetPort: 5432
      nodePort: 32443
    - name: floating-port-61443
      port: 61443
      targetPort: 5432