From e86384ff9965113d26344c2d7da98a05405c9b01 Mon Sep 17 00:00:00 2001
From: jgrusewski <jgrusewski@localhost>
Date: Sun, 21 Jun 2026 18:01:41 +0200
Subject: [PATCH] fix(infra): admit tailscale proxy to minio ingress netpol
 (minio.fxhnt.ai S3 API)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

minio.fxhnt.ai returned 000 — proxy not in minio's ingress allow-list. Same pattern as
gitea/postgres. Now reachable over the tailnet (health 200).
---
 infra/k8s/network-policies/infrastructure.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/infra/k8s/network-policies/infrastructure.yaml b/infra/k8s/network-policies/infrastructure.yaml
index 59278dc25..48b252975 100644
--- a/infra/k8s/network-policies/infrastructure.yaml
+++ b/infra/k8s/network-policies/infrastructure.yaml
@@ -81,6 +81,9 @@ spec:
         - podSelector:
             matchLabels:
               app.kubernetes.io/name: minio-init
+        - podSelector:                              # tailscale proxy fronts minio.fxhnt.ai (S3 API)
+            matchLabels:
+              app.kubernetes.io/name: tailscale-gitlab-proxy
       ports:
         - protocol: TCP
           port: 9000