From 26e0caf67c3b600c605cfb3c9616bb67d55a5267 Mon Sep 17 00:00:00 2001 From: jgrusewski Date: Wed, 25 Feb 2026 00:06:10 +0100 Subject: [PATCH] fix(gitlab): Helm values schema, Tailscale proxy, DNS record MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Fix certmanager: use installCertmanager top-level key (not certmanager.install) - Fix redis: global.redis.auth.enabled (not password.enabled) - Remove grafana (not in GitLab chart), remove top-level minio (use global.minio.enabled) - Add toolbox backup objectStorage config (required when minio disabled) - Set HPA minReplicas/maxReplicas=1 for single-node DEV1-L - Add Tailscale proxy (nginx + tailscale sidecar) for private access - DNS: git.fxhnt.ai → 100.90.76.85 (foxhunt-gitlab Tailscale IP) Co-Authored-By: Claude Opus 4.6 --- infra/k8s/gitlab/tailscale-proxy.yaml | 147 +++++++++++++++++++++++ infra/k8s/gitlab/values.yaml | 33 ++++- infra/live/production/dns/terragrunt.hcl | 5 +- 3 files changed, 176 insertions(+), 9 deletions(-) create mode 100644 infra/k8s/gitlab/tailscale-proxy.yaml diff --git a/infra/k8s/gitlab/tailscale-proxy.yaml b/infra/k8s/gitlab/tailscale-proxy.yaml new file mode 100644 index 000000000..fd4a2a3c4 --- /dev/null +++ b/infra/k8s/gitlab/tailscale-proxy.yaml @@ -0,0 +1,147 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: tailscale-gitlab + namespace: foxhunt +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: tailscale-gitlab + namespace: foxhunt +rules: + - apiGroups: [""] + resources: ["secrets"] + verbs: ["create", "get", "update", "patch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tailscale-gitlab + namespace: foxhunt +subjects: + - kind: ServiceAccount + name: tailscale-gitlab + namespace: foxhunt +roleRef: + kind: Role + name: tailscale-gitlab + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: tailscale-gitlab-proxy + namespace: foxhunt + labels: + app.kubernetes.io/name: tailscale-gitlab-proxy + app.kubernetes.io/part-of: foxhunt +spec: + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + app.kubernetes.io/name: tailscale-gitlab-proxy + template: + metadata: + labels: + app.kubernetes.io/name: tailscale-gitlab-proxy + spec: + serviceAccountName: tailscale-gitlab + nodeSelector: + k8s.scaleway.com/pool-name: gitlab + tolerations: + - key: gitlab + operator: Equal + value: "true" + effect: NoSchedule + containers: + - name: nginx + image: nginx:alpine + ports: + - containerPort: 80 + - containerPort: 443 + - containerPort: 5050 + volumeMounts: + - name: nginx-conf + mountPath: /etc/nginx/conf.d + resources: + requests: + cpu: 25m + memory: 32Mi + limits: + cpu: 100m + memory: 64Mi + - name: tailscale + image: ghcr.io/tailscale/tailscale:latest + env: + - name: TS_AUTHKEY + valueFrom: + secretKeyRef: + name: tailscale-auth + key: TS_AUTHKEY + - name: TS_KUBE_SECRET + value: tailscale-gitlab-state + - name: TS_USERSPACE + value: "false" + - name: TS_HOSTNAME + value: "foxhunt-gitlab" + - name: TS_ACCEPT_DNS + value: "false" + - name: TS_EXTRA_ARGS + value: "" + resources: + requests: + cpu: 25m + memory: 32Mi + limits: + cpu: 100m + memory: 64Mi + securityContext: + capabilities: + add: + - NET_ADMIN + - NET_RAW + volumes: + - name: nginx-conf + configMap: + name: tailscale-gitlab-nginx +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: tailscale-gitlab-nginx + namespace: foxhunt +data: + default.conf: | + server { + listen 80; + server_name git.fxhnt.ai; + + client_max_body_size 250m; + + location / { + proxy_pass http://gitlab-webservice-default.foxhunt.svc.cluster.local:8181; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + } + + server { + listen 5050; + server_name git.fxhnt.ai; + + client_max_body_size 0; + + location / { + proxy_pass http://gitlab-registry.foxhunt.svc.cluster.local:5000; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + } diff --git a/infra/k8s/gitlab/values.yaml b/infra/k8s/gitlab/values.yaml index c2209e3c8..3eabe1d8b 100644 --- a/infra/k8s/gitlab/values.yaml +++ b/infra/k8s/gitlab/values.yaml @@ -26,8 +26,10 @@ global: redis: host: redis.foxhunt.svc.cluster.local port: 6379 - password: + auth: enabled: false + minio: + enabled: false registry: bucket: foxhunt-gitlab-registry appConfig: @@ -59,21 +61,22 @@ redis: install: false # Disable components we don't need +installCertmanager: false certmanager: - install: false + installCRDs: false nginx-ingress: enabled: false prometheus: install: false -grafana: - install: false gitlab-runner: install: false -minio: - install: false # Registry — S3-backed registry: + replicaCount: 1 + hpa: + minReplicas: 1 + maxReplicas: 1 storage: secret: gitlab-s3-credentials key: registry @@ -89,6 +92,9 @@ registry: gitlab: webservice: replicaCount: 1 + hpa: + minReplicas: 1 + maxReplicas: 1 workerProcesses: 2 nodeSelector: k8s.scaleway.com/pool-name: gitlab @@ -109,6 +115,9 @@ gitlab: sidekiq: replicas: 1 + hpa: + minReplicas: 1 + maxReplicas: 1 concurrency: 10 nodeSelector: k8s.scaleway.com/pool-name: gitlab @@ -147,6 +156,10 @@ gitlab: memory: 2Gi gitlab-shell: + replicaCount: 1 + hpa: + minReplicas: 1 + maxReplicas: 1 nodeSelector: k8s.scaleway.com/pool-name: gitlab tolerations: @@ -159,6 +172,11 @@ gitlab: nodePort: 32222 toolbox: + backups: + objectStorage: + config: + secret: gitlab-s3-credentials + key: connection nodeSelector: k8s.scaleway.com/pool-name: gitlab tolerations: @@ -169,6 +187,9 @@ gitlab: kas: enabled: false + hpa: + minReplicas: 0 + maxReplicas: 0 gitlab-exporter: enabled: false diff --git a/infra/live/production/dns/terragrunt.hcl b/infra/live/production/dns/terragrunt.hcl index 9fd912045..e9e9e3ff7 100644 --- a/infra/live/production/dns/terragrunt.hcl +++ b/infra/live/production/dns/terragrunt.hcl @@ -8,7 +8,6 @@ terraform { inputs = { dns_zone = "fxhnt.ai" - # Tailscale subnet router IP — GitLab CE is accessed via this - # Update this after deploying GitLab and finding the routable IP - git_ip = "PLACEHOLDER_UPDATE_AFTER_DEPLOY" + # Tailscale IP of foxhunt-gitlab proxy pod + git_ip = "100.90.76.85" }