# GitLab cross-site replication Phase 2b (see
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - Gitaly's gRPC
# has no TLS by default; routing it over the public UniFi WAN forward
# (needed because the direct-Netbird-IP path doesn't accept inbound
# connections to home, confirmed live the same way as the existing etcd
# quorum) would otherwise carry the gitaly_token, gitlab_shell_secret,
# and raw repository contents in plaintext.
#
# Real Let's Encrypt cert via the same DNS-01 ClusterIssuer already
# proven for every other *.huskypup.net cert in this cluster, rather
# than a self-signed cert - sidesteps having to distribute a custom CA
# to both home and the VPS (which already trust Let's Encrypt's public
# CA by default). Covers all 4 Gitaly floating hostnames as SANs - one
# shared cert, referenced by every node's tlsSecretName (or the global
# default), simpler than per-node certs.
#
# secretName matches the chart's own default (confirmed live via
# gitlab/templates/_gitaly.tpl's gitlab.gitaly.tls.secret helper:
# "<release-name>-gitaly-tls" = "gitlab-gitaly-tls") - global.gitaly.tls.
# enabled: true picks this up with no secretName override needed.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: gitlab-gitaly-tls
  namespace: gitlab
spec:
  secretName: gitlab-gitaly-tls
  issuerRef:
    name: letsencrypt-production
    kind: ClusterIssuer
  dnsNames:
    - gitaly-0.ha.huskypup.net
    - gitaly-1.ha.huskypup.net
    - gitaly-2.ha.huskypup.net
    - gitaly-vps.ha.huskypup.net
---
# Separate cert/secret for workhorse's internal-API TLS listener (port
# 8181, [gitlab] url every Gitaly node calls for gitlab-shell hooks) -
# different secretName (gitlab-workhorse-tls, chart default per
# gitlab/charts/gitlab/charts/webservice/templates/_helpers.tpl's
# workhorse.tls.secret helper) than Gitaly's own cert, kept separate
# rather than trying to share one Secret object across two different
# chart-expected names.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: gitlab-workhorse-tls
  namespace: gitlab
spec:
  secretName: gitlab-workhorse-tls
  issuerRef:
    name: letsencrypt-production
    kind: ClusterIssuer
  dnsNames:
    - gitlab-internal-api.ha.huskypup.net