fix: expose the lighthouse queue redis over PrivateLink

[otsybizov]

🤖 Linear

Closes CONG-XXX

[Copilot]

Pull request overview

This PR exposes the Lighthouse queue Redis instance to the staging backend VPC via AWS PrivateLink, and updates the mqclient Redis URL parsing to support TLS SNI overrides required when connecting through PrivateLink endpoint DNS.

Changes:

• Add Terraform PrivateLink “provider” (NLB + endpoint service) and “consumer” (interface endpoint + SG) modules.
• Wire mainnet staging core to publish an endpoint service for the Lighthouse queue Redis, and wire staging backend to consume it.
• Extend parseRedisUrl to support ?tlsServername= and add ioredis connection tuning defaults.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
packages/adapters/mqclient/src/index.ts	Supports tlsServername query param for correct TLS SNI when connecting via PrivateLink DNS; adds retry/timeout/keepalive defaults.
ops/modules/privatelink/provider/main.tf	Creates internal NLB + TCP target group + VPC Endpoint Service backed by IPs resolved from DNS.
ops/modules/privatelink/provider/variables.tf	Defines inputs for provider-side PrivateLink resources (VPC/subnets/target address+port).
ops/modules/privatelink/provider/outputs.tf	Exposes endpoint service name and NLB ARN for consumers.
ops/modules/privatelink/consumer/main.tf	Creates interface VPC endpoint and security group to access the endpoint service.
ops/modules/privatelink/consumer/variables.tf	Defines inputs for consumer-side endpoint creation and access control.
ops/modules/privatelink/consumer/outputs.tf	Exposes endpoint DNS names and endpoint ID for downstream configuration.
ops/mainnet/staging/core/main.tf	Instantiates provider module to expose Lighthouse queue Redis over PrivateLink.
ops/mainnet/staging/core/outputs.tf	Exposes endpoint service name plus Redis connection components for backend consumption.
ops/mainnet/staging/backend/main.tf	Instantiates consumer module to create interface endpoint to core’s endpoint service.
ops/mainnet/staging/backend/config.tf	Updates REDIS_URL to use the PrivateLink DNS name and sets tlsServername to the real Redis hostname.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.