mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-23 12:56:46 +00:00
Scooby HuskyandClaude Sonnet 5
166ff0ffb7
Per-pod NodePort Services for the 3 existing Gitaly nodes (ha-gitaly-nodeport.yaml) plus home's Rails internal API (ha-gitlab-internal-api-nodeport.yaml, needed for gitlab-shell hooks whenever the VPS node is primary for a repo). PeerAuthentication PERMISSIVE + AuthorizationPolicy port rules for both, matching the proven Postgres pattern. CoreDNS rewrites so home's own Praefect resolves the floating hostnames locally instead of round-tripping. Reached over the Netbird mesh, not the UniFi WAN forward used for Postgres - Gitaly gRPC here is plaintext (carries the gitaly_token, gitlab_shell_secret, and raw repo contents), unlike CNPG's TLS-negotiated stream. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
60 lines
1.8 KiB
YAML
60 lines
1.8 KiB
YAML
---
|
|
# GitLab cross-site replication Phase 2b (see
|
|
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - exposes each
|
|
# of home's 3 existing Gitaly nodes individually to the VPS over the
|
|
# Netbird mesh, so Praefect can register the VPS as a 4th node in the
|
|
# SAME virtual storage and inter-Gitaly replication RPCs can reach each
|
|
# node directly. Per-pod (not per-StatefulSet), unlike the chart's own
|
|
# gitlab-gitaly-default Service - Praefect/Gitaly must address each node
|
|
# individually, not load-balance across them.
|
|
#
|
|
# Reached over the Netbird mesh (100.108.x.x), NOT the UniFi WAN forward
|
|
# used for Postgres - Gitaly's gRPC here is PLAINTEXT (carries the
|
|
# gitaly_token, the gitlab_shell_secret, and raw repository contents),
|
|
# unlike CNPG's TLS-negotiated stream. Home's nodes are directly
|
|
# reachable from Netbird peers on their real node IP (confirmed live for
|
|
# the ha-failover etcd precedent - infrastructure/ha-failover/manifests/
|
|
# etcd.yaml), so NodePort binds on that same interface without any
|
|
# additional exposure.
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: ha-gitaly-0
|
|
namespace: gitlab
|
|
spec:
|
|
type: NodePort
|
|
selector:
|
|
statefulset.kubernetes.io/pod-name: gitlab-gitaly-default-0
|
|
ports:
|
|
- port: 8075
|
|
targetPort: 8075
|
|
nodePort: 32446
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: ha-gitaly-1
|
|
namespace: gitlab
|
|
spec:
|
|
type: NodePort
|
|
selector:
|
|
statefulset.kubernetes.io/pod-name: gitlab-gitaly-default-1
|
|
ports:
|
|
- port: 8075
|
|
targetPort: 8075
|
|
nodePort: 32447
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: ha-gitaly-2
|
|
namespace: gitlab
|
|
spec:
|
|
type: NodePort
|
|
selector:
|
|
statefulset.kubernetes.io/pod-name: gitlab-gitaly-default-2
|
|
ports:
|
|
- port: 8075
|
|
targetPort: 8075
|
|
nodePort: 32448
|