mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-23 12:56:46 +00:00
Scooby HuskyandClaude Sonnet 5
166ff0ffb7
Per-pod NodePort Services for the 3 existing Gitaly nodes (ha-gitaly-nodeport.yaml) plus home's Rails internal API (ha-gitlab-internal-api-nodeport.yaml, needed for gitlab-shell hooks whenever the VPS node is primary for a repo). PeerAuthentication PERMISSIVE + AuthorizationPolicy port rules for both, matching the proven Postgres pattern. CoreDNS rewrites so home's own Praefect resolves the floating hostnames locally instead of round-tripping. Reached over the Netbird mesh, not the UniFi WAN forward used for Postgres - Gitaly gRPC here is plaintext (carries the gitaly_token, gitlab_shell_secret, and raw repo contents), unlike CNPG's TLS-negotiated stream. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
91 lines
2.8 KiB
YAML
91 lines
2.8 KiB
YAML
# GitLab cross-site replication (see
|
|
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - direct copy of
|
|
# infrastructure/authentik/manifests/ha-postgres-peerauth.yaml's proven
|
|
# fix. The gitlab namespace carries the same ambient-mesh STRICT default
|
|
# as authentik; without this, ztunnel resets the VPS/witness's connection
|
|
# (no mesh identity - they're not in this cluster) before the Postgres
|
|
# TLS handshake can even start, surfacing as "server closed the
|
|
# connection unexpectedly" on the replica side despite the NodePort/
|
|
# firewall path being entirely correct.
|
|
#
|
|
# Scoped to just each CNPG primary pod's ports via portLevelMtls, not the
|
|
# whole namespace - GitLab's own in-mesh east-west traffic (webservice
|
|
# <-> gitaly <-> redis <-> sidekiq <-> praefect) stays STRICT.
|
|
apiVersion: security.istio.io/v1
|
|
kind: PeerAuthentication
|
|
metadata:
|
|
name: allow-ha-gitlab-postgres-replication
|
|
namespace: gitlab
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
cnpg.io/cluster: pg-gitlab
|
|
mtls:
|
|
mode: STRICT
|
|
portLevelMtls:
|
|
"5432":
|
|
mode: PERMISSIVE
|
|
# Floating-hostname port (see ha-postgres-nodeport.yaml) - needs its
|
|
# own entry, ambient's port-level mTLS enforcement is keyed on the
|
|
# port actually dialed (61442), not just the pod's real containerPort
|
|
# (5432) it eventually reaches (confirmed live for the authentik
|
|
# precedent, same mechanism here).
|
|
"61442":
|
|
mode: PERMISSIVE
|
|
---
|
|
apiVersion: security.istio.io/v1
|
|
kind: PeerAuthentication
|
|
metadata:
|
|
name: allow-ha-praefect-postgres-replication
|
|
namespace: gitlab
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
cnpg.io/cluster: pg-praefect
|
|
mtls:
|
|
mode: STRICT
|
|
portLevelMtls:
|
|
"5432":
|
|
mode: PERMISSIVE
|
|
"61443":
|
|
mode: PERMISSIVE
|
|
---
|
|
# Phase 2b (Gitaly cross-site replication) - the 3 Gitaly pods, exposed
|
|
# individually via ha-gitaly-nodeport.yaml for the VPS's 4th node to
|
|
# join the same virtual storage. Gitaly pods already carry
|
|
# istio.io/use-waypoint: none (chart default, gRPC doesn't tolerate L7
|
|
# waypoint processing well) but that only skips L7 processing - L4
|
|
# ztunnel mTLS enforcement is a separate concern, same fix needed as the
|
|
# Postgres precedent.
|
|
apiVersion: security.istio.io/v1
|
|
kind: PeerAuthentication
|
|
metadata:
|
|
name: allow-ha-gitaly-replication
|
|
namespace: gitlab
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: gitaly
|
|
mtls:
|
|
mode: STRICT
|
|
portLevelMtls:
|
|
"8075":
|
|
mode: PERMISSIVE
|
|
---
|
|
# Phase 2b - the VPS's Gitaly node calling home's Rails internal API
|
|
# (ha-gitlab-internal-api-nodeport.yaml) for gitlab-shell hooks.
|
|
apiVersion: security.istio.io/v1
|
|
kind: PeerAuthentication
|
|
metadata:
|
|
name: allow-ha-gitlab-internal-api
|
|
namespace: gitlab
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: webservice
|
|
mtls:
|
|
mode: STRICT
|
|
portLevelMtls:
|
|
"8181":
|
|
mode: PERMISSIVE
|