---
# Exposes pg-authentik's current primary to the VPS/witness over the
# Netbird mesh for streaming replication (see the "Multi-Site Active
# Failover" plan) - same selector CNPG's own pg-authentik-rw ClusterIP
# Service uses, just NodePort instead, since CNPG doesn't manage this
# object and won't fight with it. Needs
# infrastructure/kyverno/policies/ha-failover-nodeport-exception.yaml
# (disallow-nodeport-services is enforced cluster-wide otherwise).
apiVersion: v1
kind: Service
metadata:
  name: ha-authentik-postgres
  namespace: authentik
spec:
  type: NodePort
  selector:
    cnpg.io/cluster: pg-authentik
    cnpg.io/instanceRole: primary
  ports:
    - port: 5432
      targetPort: 5432
      nodePort: 32432