mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-23 12:56:46 +00:00
Scooby HuskyandClaude Sonnet 5
bce3861083
Per the approved plan (Istio federation scoped separately, current NodePort/PeerAuth/cert-manager pattern continues for these 2 remaining links). Real Let's Encrypt certs (not self-signed) via the same DNS-01 ClusterIssuer used everywhere else - both sites already trust Let's Encrypt's public CA, no custom CA distribution needed. - global.gitaly.tls.enabled: adds tls_listen_addr (8076) alongside the existing plaintext listener (8075, stays for in-cluster traffic that doesn't need it). Requires global.praefect.virtualStorages[0].tlsSecretName (chart's own NOTES.txt validation rejects the render without it, confirmed live). - global.workhorse.tls.enabled + global.workhorse.host: Gitaly's [gitlab] url (internal-API callback for gitlab-shell hooks) switches from an unpublishable *.svc.cluster.local name to a real floating hostname (gitlab-internal-api.ha.huskypup.net) that Let's Encrypt CAN certify - confirmed live this replaces the plaintext [[listeners]] block with [listeners.tls] on the SAME port (8181), not a second port like Gitaly. - praefect-ha-configmap.yaml (the manually-patched live config) updated to tls:// + floating hostnames for all 3 home nodes, so home's own Praefect uses the identical addresses it'll hand the VPS as peer addresses once Phase 2b's 4th node lands. - New CoreDNS rewrite for gitlab-internal-api.ha.huskypup.net (same local-rewrite pattern as pg-*/gitaly-* already have). Sequencing note: applying live - Certificates must issue before the TLS-enabling values land, or Gitaly/webservice pods fail to start (missing secret for their init container's cert copy). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
56 lines
2.2 KiB
YAML
56 lines
2.2 KiB
YAML
# GitLab cross-site replication Phase 2b (see
|
|
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - Gitaly's gRPC
|
|
# has no TLS by default; routing it over the public UniFi WAN forward
|
|
# (needed because the direct-Netbird-IP path doesn't accept inbound
|
|
# connections to home, confirmed live the same way as the existing etcd
|
|
# quorum) would otherwise carry the gitaly_token, gitlab_shell_secret,
|
|
# and raw repository contents in plaintext.
|
|
#
|
|
# Real Let's Encrypt cert via the same DNS-01 ClusterIssuer already
|
|
# proven for every other *.huskypup.net cert in this cluster, rather
|
|
# than a self-signed cert - sidesteps having to distribute a custom CA
|
|
# to both home and the VPS (which already trust Let's Encrypt's public
|
|
# CA by default). Covers all 4 Gitaly floating hostnames as SANs - one
|
|
# shared cert, referenced by every node's tlsSecretName (or the global
|
|
# default), simpler than per-node certs.
|
|
#
|
|
# secretName matches the chart's own default (confirmed live via
|
|
# gitlab/templates/_gitaly.tpl's gitlab.gitaly.tls.secret helper:
|
|
# "<release-name>-gitaly-tls" = "gitlab-gitaly-tls") - global.gitaly.tls.
|
|
# enabled: true picks this up with no secretName override needed.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: gitlab-gitaly-tls
|
|
namespace: gitlab
|
|
spec:
|
|
secretName: gitlab-gitaly-tls
|
|
issuerRef:
|
|
name: letsencrypt-production
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- gitaly-0.ha.huskypup.net
|
|
- gitaly-1.ha.huskypup.net
|
|
- gitaly-2.ha.huskypup.net
|
|
- gitaly-vps.ha.huskypup.net
|
|
---
|
|
# Separate cert/secret for workhorse's internal-API TLS listener (port
|
|
# 8181, [gitlab] url every Gitaly node calls for gitlab-shell hooks) -
|
|
# different secretName (gitlab-workhorse-tls, chart default per
|
|
# gitlab/charts/gitlab/charts/webservice/templates/_helpers.tpl's
|
|
# workhorse.tls.secret helper) than Gitaly's own cert, kept separate
|
|
# rather than trying to share one Secret object across two different
|
|
# chart-expected names.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: gitlab-workhorse-tls
|
|
namespace: gitlab
|
|
spec:
|
|
secretName: gitlab-workhorse-tls
|
|
issuerRef:
|
|
name: letsencrypt-production
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- gitlab-internal-api.ha.huskypup.net
|