---
id: w1/m22/t003
title: Read replicas — replica endpoints/URLs (internal + external, read-only)
worker: worker1
status: todo
estimate: 60m
depends_on: [w1/m22/t001]
---

## Objective

Issue read-only replica endpoints/URLs for an HA database, distinct from the primary read-write URL — matching Render's read-replica connection strings.

## Context

- CNPG provides a `-ro`/`-r` service that load-balances across standbys; the primary uses `-rw`.
- External hostnames follow the existing `BEX_DB_DOMAIN` Traefik TCP/SNI pattern (`<name>.<domain>`); internal is the in-cluster service DNS.
- Credentials/roles reuse the existing DB access model (m17).

## Steps

1. Expose the CNPG read-only service as the replica endpoint; construct internal + external (SNI) read-only URLs.
2. Add the replica URL(s) to Database status alongside the primary URL.
3. Gate external replica hostnames on `BEX_DB_DOMAIN` (internal-only otherwise), mirroring the primary.

## Files

- `lego/operator/internal/controller/…` (replica services + URL construction)

## Acceptance criteria

- [ ] An HA database reports read-only replica URL(s) that connect and serve reads from a standby; writes against them are rejected (read-only).
- [ ] External replica hostname present only when `BEX_DB_DOMAIN` is set.

## Out of scope

- Failover (t002); API/UI (t004/t005).
