arrstack: add kids backend tier (sonarr/radarr/nzbget-kids)
Split the arrstack media pipeline into an adult and a kids tier so kids content lives in its own libraries, databases, and downloader while reusing the shared prowlarr, CNPG cluster, Valkey, media PVCs, and S3 buckets. Backend workloads only — no routing/ingress or arrproxy changes in this PR; the adult instances are untouched. - sonarr-kids/radarr-kids: mirror the adult -unkin fork Deployments (same images/tags, 3 active-active replicas), pointed at their own Postgres DBs (sonarr-kids-main/radarr-kids-main), UrlBase /3df803/sonarr and /3df803/radarr, and kids MediaCover/Backup S3 prefixes; media mounts use the tvshows/kids and movies/kids subPaths of the shared media-tv/media-movies PVCs. - nzbget-kids: second downloader on its own RWO config PVC, writing completed downloads into the kids media subtrees for same-filesystem hardlink imports. - postgres: two managed roles + Database CRDs (sonarr-kids/radarr-kids) and their VSO-synced <app>-kids-db credential secrets. - per-app VMPodScrape for each kids exportarr sidecar; register the three new apps in the base kustomization.
This commit is contained in:
@@ -0,0 +1,25 @@
|
||||
---
|
||||
# Non-secret env for the -unkin2 fork (kids tier). Identical mechanism to the
|
||||
# adult sonarr, pointed at its own shared-Postgres database (sonarr-kids-main)
|
||||
# and its own UrlBase (/3df803/sonarr) so arrproxy path-routing reaches the kids
|
||||
# instance separately. Shares the one arrstack Valkey (keys namespaced by the
|
||||
# fork's sonarr:ratelimit: prefix). User/Password/ApiKey come from Secrets (see
|
||||
# deployment.yaml), not here.
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: sonarr-kids-env
|
||||
namespace: arrstack
|
||||
data:
|
||||
Sonarr__Postgres__Host: arrstack-postgres-rw.arrstack.svc.cluster.local
|
||||
Sonarr__Postgres__Port: "5432"
|
||||
Sonarr__Postgres__MainDb: sonarr-kids-main
|
||||
Sonarr__Log__DbEnabled: "false"
|
||||
Sonarr__Auth__Method: External
|
||||
Sonarr__Auth__Required: DisabledForLocalAddresses
|
||||
Sonarr__App__InstanceName: Sonarr
|
||||
Sonarr__Server__Port: "8989"
|
||||
Sonarr__Server__UrlBase: /3df803/sonarr
|
||||
Sonarr__Update__Mechanism: External
|
||||
Sonarr__Redis__Host: valkey-arrstack-valkey.arrstack.svc.cluster.local
|
||||
Sonarr__Redis__Port: "6379"
|
||||
@@ -0,0 +1,245 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: sonarr-kids
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
# Reloader rolls the Deployment when sonarr-kids-env changes (plain envFrom
|
||||
# ConfigMap does not trigger a rollout on its own).
|
||||
configmap.reloader.stakater.com/auto: "true"
|
||||
spec:
|
||||
# Active-active: the -unkin2 fork keeps all state in the shared Postgres
|
||||
# (arrstack-postgres) and coordinates via Postgres advisory locks, so N
|
||||
# replicas run concurrently behind the sonarr-kids Service. RollingUpdate is
|
||||
# safe — no SQLite, no RWO lock.
|
||||
replicas: 3
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: sonarr-kids
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: sonarr-kids
|
||||
spec:
|
||||
securityContext:
|
||||
# Fork image has no USER; pin it to a non-root UID and group-write the
|
||||
# shared RWX CephFS media subtree. OnRootMismatch avoids a recursive
|
||||
# chown of the whole media tree.
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
initContainers:
|
||||
# Gate the app on its own Postgres database+role being reachable.
|
||||
# waitfordb reads the PG* env as a libpq fallback, so the password never
|
||||
# lands in argv.
|
||||
- name: wait-for-db
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
|
||||
env:
|
||||
- name: WAITFORDB_TIMEOUT
|
||||
value: 5m
|
||||
- name: WAITFORDB_SSLMODE
|
||||
value: disable
|
||||
- name: PGHOST
|
||||
value: arrstack-postgres-rw.arrstack.svc.cluster.local
|
||||
- name: PGPORT
|
||||
value: "5432"
|
||||
- name: PGDATABASE
|
||||
value: sonarr-kids-main
|
||||
- name: PGUSER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: sonarr-kids-db
|
||||
key: username
|
||||
- name: PGPASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: sonarr-kids-db
|
||||
key: password
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
containers:
|
||||
- name: sonarr
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/sonarr:v5.0.0-unkin6
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- /app/Sonarr
|
||||
args:
|
||||
- -nobrowser
|
||||
- -data=/config
|
||||
# Bypass the single-instance guard so multiple replicas can share one
|
||||
# /config. Cross-replica safety is the Postgres layer, not a lock file.
|
||||
- -nosingleinstancecheck
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8989
|
||||
protocol: TCP
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: sonarr-kids-env
|
||||
env:
|
||||
- name: Sonarr__Postgres__User
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: sonarr-kids-db
|
||||
key: username
|
||||
- name: Sonarr__Postgres__Password
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: sonarr-kids-db
|
||||
key: password
|
||||
- name: Sonarr__Auth__ApiKey
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: sonarr-kids-apikey
|
||||
key: apitoken
|
||||
# MediaCover object store (shared arrstack-media Ceph RGW bucket,
|
||||
# partitioned by the sonarr-kids key prefix).
|
||||
- name: Sonarr__MediaCoverS3__Endpoint
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrstack-media-s3
|
||||
key: S3_ENDPOINT
|
||||
- name: Sonarr__MediaCoverS3__AccessKey
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrstack-media-s3
|
||||
key: AWS_ACCESS_KEY_ID
|
||||
- name: Sonarr__MediaCoverS3__SecretKey
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrstack-media-s3
|
||||
key: AWS_SECRET_ACCESS_KEY
|
||||
- name: Sonarr__MediaCoverS3__Bucket
|
||||
value: arrstack-media
|
||||
- name: Sonarr__MediaCoverS3__Prefix
|
||||
value: sonarr-kids
|
||||
- name: Sonarr__MediaCoverS3__ForcePathStyle
|
||||
value: "true"
|
||||
- name: Sonarr__MediaCoverS3__CaCertPath
|
||||
value: /etc/ssl/vault-ca/ca.crt
|
||||
# Backup object store (shared arrstack-backups Ceph RGW bucket,
|
||||
# partitioned by the sonarr-kids key prefix).
|
||||
- name: Sonarr__BackupS3__Endpoint
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrstack-backups-s3
|
||||
key: S3_ENDPOINT
|
||||
- name: Sonarr__BackupS3__AccessKey
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrstack-backups-s3
|
||||
key: AWS_ACCESS_KEY_ID
|
||||
- name: Sonarr__BackupS3__SecretKey
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrstack-backups-s3
|
||||
key: AWS_SECRET_ACCESS_KEY
|
||||
- name: Sonarr__BackupS3__Bucket
|
||||
value: arrstack-backups
|
||||
- name: Sonarr__BackupS3__Prefix
|
||||
value: sonarr-kids
|
||||
- name: Sonarr__BackupS3__ForcePathStyle
|
||||
value: "true"
|
||||
- name: Sonarr__BackupS3__CaCertPath
|
||||
value: /etc/ssl/vault-ca/ca.crt
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /3df803/sonarr/ping
|
||||
port: http
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /3df803/sonarr/ping
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 1Gi
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
# Kids TV subtree of the shared media-tv PVC (same CephFS subvolume
|
||||
# the adult sonarr writes and jellyfin reads).
|
||||
- name: media-tv
|
||||
mountPath: /media/tv
|
||||
subPath: tvshows/kids
|
||||
- name: vault-ca
|
||||
mountPath: /etc/ssl/vault-ca
|
||||
readOnly: true
|
||||
# exportarr sidecar: polls the local replica's API and exposes Prometheus
|
||||
# metrics on :9707 (scraped by the sonarr-kids-exportarr VMPodScrape).
|
||||
- name: exportarr
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/ghcr/onedr0p/exportarr:v2.3.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- sonarr
|
||||
env:
|
||||
- name: PORT
|
||||
value: "9707"
|
||||
# URL includes the /3df803/sonarr UrlBase (Sonarr__Server__UrlBase).
|
||||
- name: URL
|
||||
value: http://localhost:8989/3df803/sonarr
|
||||
- name: APIKEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: sonarr-kids-apikey
|
||||
key: apitoken
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 9707
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: metrics
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: metrics
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
resources:
|
||||
requests:
|
||||
cpu: 25m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
volumes:
|
||||
- name: config
|
||||
emptyDir: {}
|
||||
- name: media-tv
|
||||
persistentVolumeClaim:
|
||||
claimName: media-tv
|
||||
# Estate CA for validating the Ceph RGW (s3.ceph.unkin.net) TLS cert.
|
||||
- name: vault-ca
|
||||
secret:
|
||||
secretName: vault-ca-cert
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- vaultstaticsecret.yaml
|
||||
- configmap.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- vmpodscrape.yaml
|
||||
@@ -0,0 +1,15 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: sonarr-kids
|
||||
namespace: arrstack
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 8989
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app: sonarr-kids
|
||||
type: ClusterIP
|
||||
@@ -0,0 +1,25 @@
|
||||
---
|
||||
# sonarr-kids API key. Seeded out-of-band at
|
||||
# kv/kubernetes/namespace/arrstack/default/sonarr-kids (key: apitoken); the
|
||||
# default k8s role's templated policy already grants read on
|
||||
# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
|
||||
# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
|
||||
# syncs it into the sonarr-kids-apikey Secret consumed by the Deployment.
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: sonarr-kids-apikey
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: sonarr-kids-apikey
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: kubernetes/namespace/arrstack/default/sonarr-kids
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
# Scrape the exportarr sidecar (:9707) on every sonarr-kids pod. Picked up by the
|
||||
# observability VMAgent (selectAllByDefault). Pod-level rather than
|
||||
# VMServiceScrape because the sonarr-kids Service doesn't expose the metrics port.
|
||||
apiVersion: operator.victoriametrics.com/v1beta1
|
||||
kind: VMPodScrape
|
||||
metadata:
|
||||
name: sonarr-kids-exportarr
|
||||
namespace: arrstack
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: sonarr-kids
|
||||
podMetricsEndpoints:
|
||||
- port: metrics
|
||||
path: /metrics
|
||||
Reference in New Issue
Block a user