feat: expose template postgres to tailnet

ops/README.md

@@ -39,7 +39,9 @@ patterns:
   `template-postgres`, a dedicated CloudNativePG cluster with its own bootstrap
   credential, TLS-only connections, daily base backups, and continuous WAL
   archiving. The production Kustomization consumes the encrypted bootstrap
-  secret through KSOPS.
+  secret through KSOPS. Its read/write endpoint is exposed only to the
+  existing tailnet as `template-db.tail6277a6.ts.net:5432`; Tailscale ACLs,
+  not public DNS, control developer access.
 
 The shared `postgres` cluster in `darkmatter/gitops` is production
 infrastructure, not a development target. Never use it to demonstrate or test

ops/deploy/kubernetes/database/cluster.yaml

@@ -16,6 +16,28 @@ spec:
       dataChecksums: true
       secret:
         name: template-postgres-bootstrap
+  certificates:
+    # Lets tailnet clients use sslmode=verify-full against the CNPG CA.
+    serverAltDNSNames:
+      - template-db.tail6277a6.ts.net
+  managed:
+    services:
+      additional:
+        - selectorType: rw
+          updateStrategy: patch
+          serviceTemplate:
+            metadata:
+              name: template-postgres-tailnet
+              annotations:
+                tailscale.com/hostname: template-db
+            spec:
+              type: LoadBalancer
+              loadBalancerClass: tailscale
+              ports:
+                - name: postgres
+                  port: 5432
+                  targetPort: 5432
+                  protocol: TCP
   backup:
     retentionPolicy: "14d"
     barmanObjectStore:

ops/deploy/kubernetes/database/networkpolicy.yaml

@@ -32,6 +32,20 @@ spec:
       ports:
         - protocol: TCP
           port: 5432
+    - from:
+        # The Tailscale operator creates one managed proxy for the CNPG
+        # additional Service. It is reachable only from approved tailnet
+        # devices, never from the public Internet.
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: tailscale
+          podSelector:
+            matchLabels:
+              tailscale.com/managed: "true"
+              tailscale.com/parent-resource: template-postgres-tailnet
+      ports:
+        - protocol: TCP
+          port: 5432
     - from:
         - namespaceSelector:
             matchLabels: