Add a Layer 3 tailscale service for the proxy API

Author: ryanjjung

bases/stalwart-migration-proxy/service.yaml

@@ -58,7 +58,7 @@ spec:
   externalName: "" # Populate with Kustomize
 
 ---
-# Exposes the Stalwart migration proxy admin API internally for Tailscale to grant human access
+# Exposes the Stalwart migration proxy admin API internally for private programmatic access
 apiVersion: v1
 kind: Service
 metadata:
@@ -74,6 +74,20 @@ spec:
       port: 8080
       targetPort: proxy-api
 
-# ---
-# Potentially we need another service here to expose 8080 for Legacy Accounts, but only if Accounts
-# is not migrated before we start sending traffic through this proxy.
+---
+# Exposes the Stalwart migration proxy admin API as a Layer 3 Tailscale service
+apiVersion: v1
+kind: Service
+metadata:
+  name: stalwart-migration-proxy-api-tailscale
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  type: LoadBalancer
+  loadBalancerClass: tailscale
+  selector:
+    app: stalwart-migration-proxy
+  ports:
+    - name: proxy-api
+      port: 8080
+      targetPort: proxy-api