mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-23 12:56:46 +00:00
Scooby HuskyandClaude Sonnet 5
bce3861083
Per the approved plan (Istio federation scoped separately, current NodePort/PeerAuth/cert-manager pattern continues for these 2 remaining links). Real Let's Encrypt certs (not self-signed) via the same DNS-01 ClusterIssuer used everywhere else - both sites already trust Let's Encrypt's public CA, no custom CA distribution needed. - global.gitaly.tls.enabled: adds tls_listen_addr (8076) alongside the existing plaintext listener (8075, stays for in-cluster traffic that doesn't need it). Requires global.praefect.virtualStorages[0].tlsSecretName (chart's own NOTES.txt validation rejects the render without it, confirmed live). - global.workhorse.tls.enabled + global.workhorse.host: Gitaly's [gitlab] url (internal-API callback for gitlab-shell hooks) switches from an unpublishable *.svc.cluster.local name to a real floating hostname (gitlab-internal-api.ha.huskypup.net) that Let's Encrypt CAN certify - confirmed live this replaces the plaintext [[listeners]] block with [listeners.tls] on the SAME port (8181), not a second port like Gitaly. - praefect-ha-configmap.yaml (the manually-patched live config) updated to tls:// + floating hostnames for all 3 home nodes, so home's own Praefect uses the identical addresses it'll hand the VPS as peer addresses once Phase 2b's 4th node lands. - New CoreDNS rewrite for gitlab-internal-api.ha.huskypup.net (same local-rewrite pattern as pg-*/gitaly-* already have). Sequencing note: applying live - Certificates must issue before the TLS-enabling values land, or Gitaly/webservice pods fail to start (missing secret for their init container's cert copy). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
62 lines
1.9 KiB
YAML
62 lines
1.9 KiB
YAML
---
|
|
# GitLab cross-site replication Phase 2b (see
|
|
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - exposes each
|
|
# of home's 3 existing Gitaly nodes individually to the VPS, so Praefect
|
|
# can register the VPS as a 4th node in the SAME virtual storage and
|
|
# inter-Gitaly replication RPCs can reach each node directly. Per-pod
|
|
# (not per-StatefulSet), unlike the chart's own gitlab-gitaly-default
|
|
# Service - Praefect/Gitaly must address each node individually, not
|
|
# load-balance across them.
|
|
#
|
|
# Reached over the same public UniFi WAN forward already used for
|
|
# Postgres, NOT the Netbird mesh directly - confirmed live the direct-
|
|
# Netbird-IP path doesn't accept inbound connections to home (same gap
|
|
# already present for the existing etcd quorum; the earlier assumption
|
|
# that NodePort binds on a reachable Netbird interface was wrong).
|
|
# Targets Gitaly's TLS port (8076), not the plaintext one (8075) -
|
|
# Gitaly's gRPC has no built-in transport security, and this WAN hop
|
|
# would otherwise carry the gitaly_token, gitlab_shell_secret, and raw
|
|
# repository contents in plaintext. See gitaly-tls-certificate.yaml and
|
|
# global.gitaly.tls.enabled in values.yaml.
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: ha-gitaly-0
|
|
namespace: gitlab
|
|
spec:
|
|
type: NodePort
|
|
selector:
|
|
statefulset.kubernetes.io/pod-name: gitlab-gitaly-default-0
|
|
ports:
|
|
- port: 8076
|
|
targetPort: 8076
|
|
nodePort: 32446
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: ha-gitaly-1
|
|
namespace: gitlab
|
|
spec:
|
|
type: NodePort
|
|
selector:
|
|
statefulset.kubernetes.io/pod-name: gitlab-gitaly-default-1
|
|
ports:
|
|
- port: 8076
|
|
targetPort: 8076
|
|
nodePort: 32447
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: ha-gitaly-2
|
|
namespace: gitlab
|
|
spec:
|
|
type: NodePort
|
|
selector:
|
|
statefulset.kubernetes.io/pod-name: gitlab-gitaly-default-2
|
|
ports:
|
|
- port: 8076
|
|
targetPort: 8076
|
|
nodePort: 32448
|