From 9c37d0edbb76b8e34d5cbac02e63f85a16b46a9e Mon Sep 17 00:00:00 2001
From: jgrusewski <jgrusewski@localhost>
Date: Wed, 25 Feb 2026 00:29:13 +0100
Subject: [PATCH] infra(gitlab): enable Prometheus, SSH proxy, explicit
 always-on type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Enable Prometheus server (GitLab chart bundled) on gitlab node pool
- Add socat SSH proxy sidecar (port 2222 → gitlab-shell) to Tailscale proxy
- Remove nginx stream module (not available in alpine) in favor of socat
- Set unlimited nginx client_max_body_size for large git pushes
- Add workhorse extraArgs for API limits
- Explicit always_on_type = DEV1-M in kapsule terragrunt

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 infra/k8s/gitlab/tailscale-proxy.yaml        | 16 ++++++++++++-
 infra/k8s/gitlab/values.yaml                 | 25 +++++++++++++++++++-
 infra/live/production/kapsule/terragrunt.hcl |  1 +
 3 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/infra/k8s/gitlab/tailscale-proxy.yaml b/infra/k8s/gitlab/tailscale-proxy.yaml
index fd4a2a3c4..9ceecdd3c 100644
--- a/infra/k8s/gitlab/tailscale-proxy.yaml
+++ b/infra/k8s/gitlab/tailscale-proxy.yaml
@@ -74,6 +74,20 @@ spec:
             limits:
               cpu: 100m
               memory: 64Mi
+        - name: ssh-proxy
+          image: alpine/socat:latest
+          args:
+            - "TCP-LISTEN:2222,fork,reuseaddr"
+            - "TCP:gitlab-gitlab-shell.foxhunt.svc.cluster.local:2222"
+          ports:
+            - containerPort: 2222
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              cpu: 50m
+              memory: 32Mi
         - name: tailscale
           image: ghcr.io/tailscale/tailscale:latest
           env:
@@ -120,7 +134,7 @@ data:
         listen 80;
         server_name git.fxhnt.ai;
 
-        client_max_body_size 250m;
+        client_max_body_size 0;
 
         location / {
             proxy_pass http://gitlab-webservice-default.foxhunt.svc.cluster.local:8181;
diff --git a/infra/k8s/gitlab/values.yaml b/infra/k8s/gitlab/values.yaml
index 3eabe1d8b..f0f0dbfbd 100644
--- a/infra/k8s/gitlab/values.yaml
+++ b/infra/k8s/gitlab/values.yaml
@@ -67,7 +67,28 @@ certmanager:
 nginx-ingress:
   enabled: false
 prometheus:
-  install: false
+  install: true
+  rbac:
+    create: true
+  alertmanager:
+    enabled: false
+  server:
+    nodeSelector:
+      k8s.scaleway.com/pool-name: gitlab
+    tolerations:
+      - key: gitlab
+        operator: Equal
+        value: "true"
+        effect: NoSchedule
+    persistentVolume:
+      enabled: false
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+      limits:
+        cpu: 500m
+        memory: 512Mi
 gitlab-runner:
   install: false
 
@@ -96,6 +117,8 @@ gitlab:
       minReplicas: 1
       maxReplicas: 1
     workerProcesses: 2
+    workhorse:
+      extraArgs: "-apiLimit 0 -apiQueueLimit 0"
     nodeSelector:
       k8s.scaleway.com/pool-name: gitlab
     tolerations:
diff --git a/infra/live/production/kapsule/terragrunt.hcl b/infra/live/production/kapsule/terragrunt.hcl
index 472f4e058..acb6977be 100644
--- a/infra/live/production/kapsule/terragrunt.hcl
+++ b/infra/live/production/kapsule/terragrunt.hcl
@@ -9,6 +9,7 @@ terraform {
 inputs = {
   cluster_name   = "foxhunt"
   k8s_version    = "1.34"
+  always_on_type = "DEV1-M"
 
   # GPU training pool (H100 for 10-model ensemble training)
   enable_gpu_training_pool = true