arrstack: wire arrproxy v0.4.0 tier routing (fafflix/cheeztv) (#416)
## Why
The old bare `sonarr`/`radarr` Services are gone, but arrproxy still ran the v0.3.x built-in default topology pointing at non-existent `sonarr`/`radarr` upstreams and mounted dead `sonarr-apikey`/`radarr-apikey` Secrets. This cuts the front door over to arrproxy v0.4.0 tier routing so the adult (fafflix, `/3aa168`) and kids (cheeztv, `/3df803`) *arr instances are reachable again, with per-tier group authorization.
## Changes
- Bump `arrproxy-api` and `arrproxy-ui` images to `v0.4.0`.
- Add `arrproxy-tiers` ConfigMap (`ARRPROXY_TIERS_FILE`): `fafflix` + `cheeztv` tiers, each with sonarr/radarr upstreams, route hash, key subdir and group grants. Adults (`akP-media-fafflix`) reach both tiers all methods; kids (`akP-media-cheeztv`) reach only cheeztv, GET/HEAD. `legacyRoutes:false` retires the unprefixed routes.
- Because arrproxy strips `/<hash>` and proxies `/<app>/...`, each upstream URL carries the `/<hash>` path segment so the joined upstream path (`/3aa168/sonarr/...`) matches the *arr's own UrlBase.
- Mount the tiers file and rework the projected keys volume to the real per-instance `{sonarr,radarr}-{adult,kids}-apikey` Secrets under `<keyDir>/<app>` (`adult/*`, `kids/*`); refresh reloader annotations.
- oauth2-proxy: route `/3aa168` and `/3df803` to arrproxy-api (drop dead `/sonarr` `/radarr` `/prowlarr`; prowlarr is served directly), and widen `SKIP_AUTH_REGEX` to `^/[^/]+/[^/]+/api` for the hash-prefixed tier api paths.
Group headers keep flowing via the existing Authentik `ak_groups` claim -> oauth2-proxy `X-Forwarded-Groups` mechanism. Validated with `kustomize build` + repo kubeconform (88/88 valid). No new Vault seeds required — the per-instance apikey Secrets already exist.
Reviewed-on: #416
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
This commit was merged in pull request #416.
This commit is contained in:
@@ -7,7 +7,8 @@ metadata:
|
||||
annotations:
|
||||
# Wave 2: serve only after the wave-1 migrate Job completes.
|
||||
argocd.argoproj.io/sync-wave: "2"
|
||||
secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-admin-token,arrproxy-db-app,sonarr-apikey,radarr-apikey,prowlarr-apikey"
|
||||
secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-admin-token,arrproxy-db-app,sonarr-adult-apikey,radarr-adult-apikey,sonarr-kids-apikey,radarr-kids-apikey"
|
||||
configmap.reloader.stakater.com/reload: "arrproxy-tiers"
|
||||
spec:
|
||||
replicas: 2
|
||||
selector:
|
||||
@@ -33,7 +34,7 @@ spec:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: api
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.3.1
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.4.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
@@ -49,11 +50,18 @@ spec:
|
||||
# reaches this upstream) so group-based authorization works.
|
||||
- name: ARRPROXY_GROUPS_HEADER
|
||||
value: X-Forwarded-Groups
|
||||
# Real per-app *arr keys, projected one file per app under this dir
|
||||
# (sourced from the existing <app>-apikey Secrets). The api injects
|
||||
# them server-side and redacts them from every proxied response.
|
||||
# Real per-app *arr keys, projected one file per app under a per-tier
|
||||
# subdir (<keyDir>/<app>) matching the tiers file: adult/{sonarr,radarr}
|
||||
# and kids/{sonarr,radarr}. Sourced from the same <instance>-apikey
|
||||
# Secrets the *arr Deployments consume. The api injects them server-side
|
||||
# and redacts them from every proxied response.
|
||||
- name: ARRPROXY_KEYS_DIR
|
||||
value: /etc/arrproxy/keys
|
||||
# Tier topology (fafflix/cheeztv): upstreams, route hashes, key subdirs
|
||||
# and group grants. Legacy unprefixed routes are retired in the file
|
||||
# (legacyRoutes:false); see arrproxy-tiers ConfigMap.
|
||||
- name: ARRPROXY_TIERS_FILE
|
||||
value: /etc/arrproxy/tiers/tiers.json
|
||||
- name: ARRPROXY_PEPPER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
@@ -86,6 +94,9 @@ spec:
|
||||
- name: arr-keys
|
||||
mountPath: /etc/arrproxy/keys
|
||||
readOnly: true
|
||||
- name: tiers
|
||||
mountPath: /etc/arrproxy/tiers
|
||||
readOnly: true
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
livenessProbe:
|
||||
@@ -118,27 +129,37 @@ spec:
|
||||
cpu: "1"
|
||||
memory: 512Mi
|
||||
volumes:
|
||||
# Real *arr API keys, one file per app named exactly <app> so the api
|
||||
# reads /etc/arrproxy/keys/{sonarr,radarr,prowlarr}. Reuses the same
|
||||
# <app>-apikey Secrets the *arr Deployments already consume.
|
||||
# Real per-tier *arr API keys, projected as <keyDir>/<app> so the api
|
||||
# reads /etc/arrproxy/keys/{adult,kids}/{sonarr,radarr} (matching the
|
||||
# tiers file keyDir). Reuses the same <instance>-apikey Secrets the *arr
|
||||
# Deployments already consume (seeded by their VaultStaticSecrets).
|
||||
- name: arr-keys
|
||||
projected:
|
||||
sources:
|
||||
- secret:
|
||||
name: sonarr-apikey
|
||||
name: sonarr-adult-apikey
|
||||
items:
|
||||
- key: apitoken
|
||||
path: sonarr
|
||||
path: adult/sonarr
|
||||
- secret:
|
||||
name: radarr-apikey
|
||||
name: radarr-adult-apikey
|
||||
items:
|
||||
- key: apitoken
|
||||
path: radarr
|
||||
path: adult/radarr
|
||||
- secret:
|
||||
name: prowlarr-apikey
|
||||
name: sonarr-kids-apikey
|
||||
items:
|
||||
- key: apitoken
|
||||
path: prowlarr
|
||||
path: kids/sonarr
|
||||
- secret:
|
||||
name: radarr-kids-apikey
|
||||
items:
|
||||
- key: apitoken
|
||||
path: kids/radarr
|
||||
# Tier topology JSON (ARRPROXY_TIERS_FILE).
|
||||
- name: tiers
|
||||
configMap:
|
||||
name: arrproxy-tiers
|
||||
- name: tmp
|
||||
emptyDir:
|
||||
sizeLimit: 64Mi
|
||||
|
||||
Reference in New Issue
Block a user