---
# Exposes the VPS's pg-gitlab/pg-praefect primaries (replicas today) back
# to home over the Netbird mesh, for GitLab cross-site replication (see
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - needed for
# failback (home rejoining as a replica once it's back). Same pattern as
# infrastructure/vps-standby/authentik/manifests/ha-postgres-nodeport.yaml.
#
# No UniFi port-forward or Kyverno PolicyException needed here - the
# VPS's k3s has no NodePort restriction, and home reaching OUT to the VPS
# already works today via the netbird-egress DaemonSet's route (confirmed
# live all session for MinIO/CrowdSec/pg-authentik) - it's only the
# reverse direction (external peers reaching INTO home) that needs the
# UniFi workaround (see apps/gitlab/manifests/ha-postgres-nodeport.yaml).
#
# Different nodePort numbers than home's side (32442/32443) - not
# required since these are different machines, but matches the
# authentik precedent's convention of keeping each site's numbers
# distinct to avoid confusion.
apiVersion: v1
kind: Service
metadata:
  name: ha-gitlab-postgres
  namespace: gitlab
spec:
  type: NodePort
  selector:
    cnpg.io/cluster: pg-gitlab
    cnpg.io/instanceRole: primary
  ports:
    - port: 5432
      targetPort: 5432
      nodePort: 32444
---
apiVersion: v1
kind: Service
metadata:
  name: ha-praefect-postgres
  namespace: gitlab
spec:
  type: NodePort
  selector:
    cnpg.io/cluster: pg-praefect
    cnpg.io/instanceRole: primary
  ports:
    - port: 5432
      targetPort: 5432
      nodePort: 32445