Expost postgres cluster

Expose the postgres cluster outside of the Kubernetes cluster
Give myself the option of connecting to postgres from my own machines,
so that I can hopefully leverage the improved performance
Update some file linting issues in Nix
Add necessary gitlab keys so it can be updated properly the next time I
deploy to it
Add DNS entries for postgres
Update the configuraiton of Traefik to expose the appropriate ports

manifests/databases/ingress.yaml

@@ -0,0 +1,39 @@
+apiVersion: traefik.io/v1alpha1
+kind: MiddlewareTCP
+metadata:
+  name: local-hosts-only
+  namespace: db
+spec:
+  ipAllowList:
+    sourceRange:
+      - 127.0.0.1/32 # Localhost, obviously
+      - 10.42.0.0/16 # My internal net
+      - 10.211.0.0/16 # Kubernetes IPs
+      # Tailscale hosts
+      - 100.119.228.115 # chronicles
+      - 100.88.91.27 # dns?
+      - 100.80.99.48 # exodus
+      - 100.88.91.27 # genesis
+      - 100.91.131.66 # gitlab
+      - 100.68.203.1 # hosea
+      - 100.84.183.79 # isaiah
+      - 100.102.186.39 # jeremiah
+      - 100.90.74.19 # jude
+      - 100.115.57.8 # linode
+      - 100.65.5.38 # matrix
+      - 100.127.55.22 # jellyfin
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: ingress-route-postgres
+  namespace: db
+spec:
+  entryPoints:
+    - postgres
+  routes:
+    - match: HostSNI(`*`)
+      priority: 10
+      services:
+        - name: postgres-rw
+          port: 5432

manifests/databases/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - postgres-gitlab.yaml
   - postgres-pgadmin.yaml
   - postgres-matrix.yaml
+  - ingress.yaml

manifests/helm/kustomization.yaml

@@ -1,4 +1,5 @@
 resources:
   - flux.yaml
+  - traefik.yaml
   - external-secrets.yaml
   - cloudnative-pg.yaml

manifests/helm/traefik.yaml

@@ -0,0 +1,22 @@
+apiVersion: "helm.cattle.io/v1"
+kind: "HelmChartConfig"
+metadata:
+  name: "traefik"
+  namespace: "kube-system"
+spec:
+  valuesContent: |-
+    additionalArguments:
+      - "--entryPoints.postgres.address=:5432/tcp"
+      - "--api.dashboard=true"
+      - "--api.insecure=true"
+      - "--log.level=DEBUG"
+    ports:
+      postgres:
+        expose:
+          default: true
+        port: 5432
+        exposedPort: 5432
+        protocol: TCP
+      traefik:
+        expose:
+          default: true