Scooby Husky 5f52f2b36b Multi-site active failover pilot: home etcd member + Postgres NodePort exposure ...

Part of the Authentik HA pilot (see plan doc). Home's etcd quorum member
(StatefulSet, pinned to talos-cp-01 for a stable advertised address) plus
a NodePort exposing pg-authentik's current primary - both reachable from
the VPS/witness over the already-authenticated Netbird mesh (confirmed
live: home nodes are directly reachable from Netbird peers on their real
node IP, via the netbird-egress DaemonSet's route). Deliberately NOT
going through UniFi/public-internet exposure - this stays entirely
inside the private mesh, a materially safer path than the WAN port-
forward originally considered.

Needs a scoped Kyverno PolicyException (ha-failover-nodeport-exception.yaml)
since disallow-nodeport-services is enforced cluster-wide - narrowly
scoped to Services named ha-*, matching the existing netbird-egress-
exemption.yaml precedent for exceptions.

2026-08-18 21:12:45 -05:00

..

policies

Multi-site active failover pilot: home etcd member + Postgres NodePort exposure

2026-08-18 21:12:45 -05:00

values.yaml

Scale down non-critical replicas for homelab resource savings

2026-03-15 23:00:48 -05:00