mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-23 12:56:46 +00:00
Scooby HuskyandClaude Sonnet 5
166ff0ffb7
Per-pod NodePort Services for the 3 existing Gitaly nodes (ha-gitaly-nodeport.yaml) plus home's Rails internal API (ha-gitlab-internal-api-nodeport.yaml, needed for gitlab-shell hooks whenever the VPS node is primary for a repo). PeerAuthentication PERMISSIVE + AuthorizationPolicy port rules for both, matching the proven Postgres pattern. CoreDNS rewrites so home's own Praefect resolves the floating hostnames locally instead of round-tripping. Reached over the Netbird mesh, not the UniFi WAN forward used for Postgres - Gitaly gRPC here is plaintext (carries the gitaly_token, gitlab_shell_secret, and raw repo contents), unlike CNPG's TLS-negotiated stream. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
24 lines
853 B
YAML
24 lines
853 B
YAML
# GitLab cross-site replication Phase 2b - exposes home's Rails internal
|
|
# API (port 8181, a dedicated internal-only listener, deliberately NOT
|
|
# exposed through the public Istio ingress on 8080) to the VPS's Gitaly
|
|
# node. Gitaly's gitlab-shell hooks call POST /api/v4/internal/{allowed,
|
|
# pre_receive,post_receive} against this whenever the VPS node is
|
|
# primary for a repository (per-repository election can cause this even
|
|
# in normal operation) or after a real failover. Carries the shell
|
|
# secret in a header - same plaintext-over-Netbird-mesh reasoning as
|
|
# ha-gitaly-nodeport.yaml, not the UniFi WAN forward.
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: ha-gitlab-internal-api
|
|
namespace: gitlab
|
|
spec:
|
|
type: NodePort
|
|
selector:
|
|
app: webservice
|
|
release: gitlab
|
|
ports:
|
|
- port: 8181
|
|
targetPort: 8181
|
|
nodePort: 32449
|