mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-23 12:56:46 +00:00
Scooby HuskyandClaude Sonnet 5
04fa80ece3
Per the approved plan (jiggly-snacking-iverson.md, 'GitLab True Cross-Site Replication' section) - replacing the git-mirror CronJob with real CNPG streaming replication for pg-gitlab and pg-praefect, reusing the exact pattern already proven for pg-authentik. This commit is network plumbing only, no DB replication yet: - Repoint both CNPG clusters' barmanObjectStore backup target from in-cluster gitlab-minio-svc to VPS MinIO (also becomes the initial seed source for the VPS's replicas in Phase 1c). - New ha-gitlab-postgres/ha-praefect-postgres NodePort Services (bypass CNPG's own -rw Services) on both home and VPS. - New PeerAuthentication with portLevelMtls PERMISSIVE on the replication ports - ambient mesh STRICT default would otherwise reset the VPS/witness's connection before the Postgres TLS handshake starts. - Extended allow-gitlab-access AuthorizationPolicy with a port-scoped rule for the same traffic (no source.namespaces rule can match external, non-mesh peers). - CoreDNS rewrites for pg-gitlab.ha.huskypup.net / pg-praefect.ha.huskypup.net so home's own pods reach the floating hostname locally instead of round-tripping through the WAN forward (no NAT hairpin support). Still needed before Phase 1b/1c: UniFi WAN port-forwards for external ports 61442/61443 -> talos-cp-01:32442/32443, source-restricted to the VPS + witness public IPs (manual, same as the existing 61432 rule). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
57 lines
1.8 KiB
YAML
57 lines
1.8 KiB
YAML
---
|
|
# GitLab cross-site replication (see
|
|
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md's "GitLab True
|
|
# Cross-Site Replication" section) - direct copy of the proven pattern
|
|
# from infrastructure/authentik/manifests/ha-postgres-nodeport.yaml.
|
|
# Exposes pg-gitlab's and pg-praefect's current primaries to the
|
|
# VPS/witness over the Netbird mesh for streaming replication - same
|
|
# selectors CNPG's own -rw ClusterIP Services use, just NodePort instead,
|
|
# since CNPG doesn't manage these objects and won't fight with them.
|
|
# Needs infrastructure/kyverno/policies/ha-failover-nodeport-exception.yaml
|
|
# (name pattern ha-* already matches, no change needed there).
|
|
#
|
|
# Second port on each (61442/61443, ClusterIP only) for the CoreDNS
|
|
# rewrite in infrastructure/coredns/manifests/: home's own pods resolving
|
|
# pg-gitlab.ha.huskypup.net / pg-praefect.ha.huskypup.net rewrite to
|
|
# THESE services specifically so they can reach them on the SAME port
|
|
# number the app tier will eventually be configured with (Phase 3) -
|
|
# rewrite only changes the resolved NAME, not the port a client then
|
|
# connects to (confirmed live for the authentik precedent).
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: ha-gitlab-postgres
|
|
namespace: gitlab
|
|
spec:
|
|
type: NodePort
|
|
selector:
|
|
cnpg.io/cluster: pg-gitlab
|
|
cnpg.io/instanceRole: primary
|
|
ports:
|
|
- name: nodeport-5432
|
|
port: 5432
|
|
targetPort: 5432
|
|
nodePort: 32442
|
|
- name: floating-port-61442
|
|
port: 61442
|
|
targetPort: 5432
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: ha-praefect-postgres
|
|
namespace: gitlab
|
|
spec:
|
|
type: NodePort
|
|
selector:
|
|
cnpg.io/cluster: pg-praefect
|
|
cnpg.io/instanceRole: primary
|
|
ports:
|
|
- name: nodeport-5432
|
|
port: 5432
|
|
targetPort: 5432
|
|
nodePort: 32443
|
|
- name: floating-port-61443
|
|
port: 61443
|
|
targetPort: 5432
|