From 082582200d817b02aa8efac7de290456138f6fed Mon Sep 17 00:00:00 2001
From: cooper <cooper@darkmatter.io>
Date: Sat, 10 Oct 2026 04:47:10 -0700
Subject: [PATCH] feat: expose template postgres to tailnet

---
 ops/README.md                                 |  4 +++-
 ops/deploy/kubernetes/database/cluster.yaml   | 22 +++++++++++++++++++
 .../kubernetes/database/networkpolicy.yaml    | 14 ++++++++++++
 3 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/ops/README.md b/ops/README.md
index 6c4b80c..b2fb577 100644
--- a/ops/README.md
+++ b/ops/README.md
@@ -39,7 +39,9 @@ patterns:
   `template-postgres`, a dedicated CloudNativePG cluster with its own bootstrap
   credential, TLS-only connections, daily base backups, and continuous WAL
   archiving. The production Kustomization consumes the encrypted bootstrap
-  secret through KSOPS.
+  secret through KSOPS. Its read/write endpoint is exposed only to the
+  existing tailnet as `template-db.tail6277a6.ts.net:5432`; Tailscale ACLs,
+  not public DNS, control developer access.
 
 The shared `postgres` cluster in `darkmatter/gitops` is production
 infrastructure, not a development target. Never use it to demonstrate or test
diff --git a/ops/deploy/kubernetes/database/cluster.yaml b/ops/deploy/kubernetes/database/cluster.yaml
index 61557df..9344863 100644
--- a/ops/deploy/kubernetes/database/cluster.yaml
+++ b/ops/deploy/kubernetes/database/cluster.yaml
@@ -16,6 +16,28 @@ spec:
       dataChecksums: true
       secret:
         name: template-postgres-bootstrap
+  certificates:
+    # Lets tailnet clients use sslmode=verify-full against the CNPG CA.
+    serverAltDNSNames:
+      - template-db.tail6277a6.ts.net
+  managed:
+    services:
+      additional:
+        - selectorType: rw
+          updateStrategy: patch
+          serviceTemplate:
+            metadata:
+              name: template-postgres-tailnet
+              annotations:
+                tailscale.com/hostname: template-db
+            spec:
+              type: LoadBalancer
+              loadBalancerClass: tailscale
+              ports:
+                - name: postgres
+                  port: 5432
+                  targetPort: 5432
+                  protocol: TCP
   backup:
     retentionPolicy: "14d"
     barmanObjectStore:
diff --git a/ops/deploy/kubernetes/database/networkpolicy.yaml b/ops/deploy/kubernetes/database/networkpolicy.yaml
index dd7a97e..3f849ca 100644
--- a/ops/deploy/kubernetes/database/networkpolicy.yaml
+++ b/ops/deploy/kubernetes/database/networkpolicy.yaml
@@ -32,6 +32,20 @@ spec:
       ports:
         - protocol: TCP
           port: 5432
+    - from:
+        # The Tailscale operator creates one managed proxy for the CNPG
+        # additional Service. It is reachable only from approved tailnet
+        # devices, never from the public Internet.
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: tailscale
+          podSelector:
+            matchLabels:
+              tailscale.com/managed: "true"
+              tailscale.com/parent-resource: template-postgres-tailnet
+      ports:
+        - protocol: TCP
+          port: 5432
     - from:
         - namespaceSelector:
             matchLabels: