# GitLab cross-site replication (see
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - direct copy of
# infrastructure/authentik/manifests/ha-postgres-peerauth.yaml's proven
# fix. The gitlab namespace carries the same ambient-mesh STRICT default
# as authentik; without this, ztunnel resets the VPS/witness's connection
# (no mesh identity - they're not in this cluster) before the Postgres
# TLS handshake can even start, surfacing as "server closed the
# connection unexpectedly" on the replica side despite the NodePort/
# firewall path being entirely correct.
#
# Scoped to just each CNPG primary pod's ports via portLevelMtls, not the
# whole namespace - GitLab's own in-mesh east-west traffic (webservice
# <-> gitaly <-> redis <-> sidekiq <-> praefect) stays STRICT.
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: allow-ha-gitlab-postgres-replication
  namespace: gitlab
spec:
  selector:
    matchLabels:
      cnpg.io/cluster: pg-gitlab
  mtls:
    mode: STRICT
  portLevelMtls:
    "5432":
      mode: PERMISSIVE
    # Floating-hostname port (see ha-postgres-nodeport.yaml) - needs its
    # own entry, ambient's port-level mTLS enforcement is keyed on the
    # port actually dialed (61442), not just the pod's real containerPort
    # (5432) it eventually reaches (confirmed live for the authentik
    # precedent, same mechanism here).
    "61442":
      mode: PERMISSIVE
---
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: allow-ha-praefect-postgres-replication
  namespace: gitlab
spec:
  selector:
    matchLabels:
      cnpg.io/cluster: pg-praefect
  mtls:
    mode: STRICT
  portLevelMtls:
    "5432":
      mode: PERMISSIVE
    "61443":
      mode: PERMISSIVE