Reduce media PR to jellyfin-only in its own namespace

Why:
Jellyfin ships and gets validated first, ahead of the rest of the media stack.
Scoping this PR to jellyfin alone keeps the initial rollout small and lets the
HA fork prove out against the real library before the download and manager apps
follow.

How:
- Drop sonarr, radarr, prowlarr, bazarr, nzbget, and jellyseerr and their shared
  media-apps foundation from this PR; they land in later PRs.
- Move jellyfin into its own jellyfin namespace and fold the namespace and the
  static mediafs PV plus its RWX claim into the jellyfin base.
- Keep the static CephFS PV bound to the in-use mediafs library with
  reclaimPolicy Retain and staticVolume true so nothing can reclaim it, mounted
  into jellyfin by the movies and tvseries subPaths; keep redis, the fresh RWX
  transcode scratch, the intel iGPU nodeSelector and i915 request, gateway, and
  httproute.
- Scope the media AppProject and ApplicationSet to the single jellyfin
  namespace and app, extensible as the remaining apps are added.

apps/base/bazarr/deployment.yaml

@@ -1,61 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: bazarr
-  namespace: media-apps
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: bazarr
-  template:
-    metadata:
-      labels:
-        app: bazarr
-    spec:
-      securityContext:
-        fsGroup: 1000
-      containers:
-        - name: bazarr
-          image: ghcr.io/home-operations/bazarr:rolling
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 6767
-              protocol: TCP
-          env:
-            - name: TZ
-              value: Australia/Sydney
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-          resources:
-            requests:
-              cpu: 50m
-              memory: 256Mi
-            limits:
-              cpu: "1"
-              memory: 1Gi
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          volumeMounts:
-            - name: config
-              mountPath: /config
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: bazarr-config

apps/base/bazarr/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: bazarr.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: bazarr.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: bazarr
-  namespace: media-apps
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: bazarr.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: bazarr.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: bazarr-tls
-        mode: Terminate

apps/base/bazarr/httproute.yaml

@@ -1,49 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: http-redirect
-  namespace: media-apps
-spec:
-  hostnames:
-    - bazarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: bazarr
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: bazarr
-  namespace: media-apps
-spec:
-  hostnames:
-    - bazarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: bazarr
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: bazarr
-          port: 6767
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/bazarr/kustomization.yaml

@@ -1,10 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml
-  - gateway.yaml
-  - httproute.yaml

apps/base/bazarr/pvc.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: bazarr-config
-  namespace: media-apps
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: cephrbd-fast-delete
-  volumeMode: Filesystem

apps/base/bazarr/service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: bazarr
-  namespace: media-apps
-spec:
-  type: ClusterIP
-  selector:
-    app: bazarr
-  ports:
-    - name: http
-      port: 6767
-      targetPort: http
-      protocol: TCP

apps/base/jellyfin/deployment.yaml

@@ -3,7 +3,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: jellyfin
-  namespace: media-apps
+  namespace: jellyfin
 spec:
   # Single-replica for now. The jellyfin-ha fork adds the Redis transcode store
   # and RWX transcode scratch that make scaling to true HA a follow-up.

apps/base/jellyfin/gateway.yaml

@@ -11,7 +11,7 @@ metadata:
     external-dns.alpha.kubernetes.io/hostname: jellyfin.k8s.syd1.au.unkin.net
     external-dns.alpha.kubernetes.io/target: 198.18.200.4
   name: jellyfin
-  namespace: media-apps
+  namespace: jellyfin
 spec:
   gatewayClassName: traefik-internal
   listeners:

apps/base/jellyfin/httproute.yaml

@@ -3,7 +3,7 @@ apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: http-redirect
-  namespace: media-apps
+  namespace: jellyfin
 spec:
   hostnames:
     - jellyfin.k8s.syd1.au.unkin.net
@@ -27,7 +27,7 @@ apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: jellyfin
-  namespace: media-apps
+  namespace: jellyfin
 spec:
   hostnames:
     - jellyfin.k8s.syd1.au.unkin.net

apps/base/jellyfin/kustomization.yaml

@@ -3,6 +3,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
+  - namespace.yaml
+  - pv_media-library.yaml
+  - pvc_media-library.yaml
   - pvc_config.yaml
   - pvc_cache.yaml
   - pvc_transcode.yaml

apps/base/jellyfin/namespace.yaml

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: media-apps
+  name: jellyfin

apps/base/jellyfin/pv_media-library.yaml

@@ -9,7 +9,7 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: media-apps-media-library
+  name: jellyfin-media-library
 spec:
   accessModes:
     - ReadWriteMany
@@ -24,10 +24,10 @@ spec:
     apiVersion: v1
     kind: PersistentVolumeClaim
     name: media-library
-    namespace: media-apps
+    namespace: jellyfin
   csi:
     driver: cephfs.csi.ceph.com
-    volumeHandle: media-apps-media-library-static
+    volumeHandle: jellyfin-media-library-static
     nodeStageSecretRef:
       name: csi-cephfs-secret
       namespace: csi-cephfs

apps/base/jellyfin/pvc_cache.yaml

@@ -4,7 +4,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: jellyfin-cache
-  namespace: media-apps
+  namespace: jellyfin
 spec:
   accessModes:
     - ReadWriteOnce

apps/base/jellyfin/pvc_config.yaml

@@ -4,7 +4,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: jellyfin-config
-  namespace: media-apps
+  namespace: jellyfin
 spec:
   accessModes:
     - ReadWriteOnce

apps/base/jellyfin/pvc_media-library.yaml

@@ -7,12 +7,12 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: media-library
-  namespace: media-apps
+  namespace: jellyfin
 spec:
   accessModes:
     - ReadWriteMany
   storageClassName: ""
-  volumeName: media-apps-media-library
+  volumeName: jellyfin-media-library
   resources:
     requests:
       storage: 10Ti

apps/base/jellyfin/pvc_transcode.yaml

@@ -6,7 +6,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: jellyfin-transcode
-  namespace: media-apps
+  namespace: jellyfin
 spec:
   accessModes:
     - ReadWriteMany

apps/base/jellyfin/redis-deployment.yaml

@@ -3,7 +3,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: jellyfin-redis
-  namespace: media-apps
+  namespace: jellyfin
 spec:
   replicas: 1
   strategy:

apps/base/jellyfin/redis-pvc.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: jellyfin-redis-data
-  namespace: media-apps
+  namespace: jellyfin
 spec:
   accessModes:
     - ReadWriteOnce

apps/base/jellyfin/redis-service.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: jellyfin-redis
-  namespace: media-apps
+  namespace: jellyfin
 spec:
   type: ClusterIP
   internalTrafficPolicy: Cluster

apps/base/jellyfin/service.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: jellyfin
-  namespace: media-apps
+  namespace: jellyfin
 spec:
   type: ClusterIP
   internalTrafficPolicy: Cluster

apps/base/jellyseerr/deployment.yaml

@@ -1,61 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: jellyseerr
-  namespace: media-apps
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: jellyseerr
-  template:
-    metadata:
-      labels:
-        app: jellyseerr
-    spec:
-      securityContext:
-        fsGroup: 1000
-      containers:
-        - name: jellyseerr
-          image: ghcr.io/fallenbagel/jellyseerr:latest
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 5055
-              protocol: TCP
-          env:
-            - name: TZ
-              value: Australia/Sydney
-            - name: LOG_LEVEL
-              value: debug
-            - name: PORT
-              value: "5055"
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: "1"
-              memory: 1Gi
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          volumeMounts:
-            - name: config
-              mountPath: /app/config
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: jellyseerr-config

apps/base/jellyseerr/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: jellyseerr.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: jellyseerr.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: jellyseerr
-  namespace: media-apps
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: jellyseerr.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: jellyseerr.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: jellyseerr-tls
-        mode: Terminate

apps/base/jellyseerr/httproute.yaml

@@ -1,49 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: http-redirect
-  namespace: media-apps
-spec:
-  hostnames:
-    - jellyseerr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: jellyseerr
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: jellyseerr
-  namespace: media-apps
-spec:
-  hostnames:
-    - jellyseerr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: jellyseerr
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: jellyseerr
-          port: 5055
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/jellyseerr/kustomization.yaml

@@ -1,10 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml
-  - gateway.yaml
-  - httproute.yaml

apps/base/jellyseerr/pvc.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyseerr-config
-  namespace: media-apps
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: cephrbd-fast-delete
-  volumeMode: Filesystem

apps/base/jellyseerr/service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: jellyseerr
-  namespace: media-apps
-spec:
-  type: ClusterIP
-  selector:
-    app: jellyseerr
-  ports:
-    - name: http
-      port: 5055
-      targetPort: http
-      protocol: TCP

apps/base/media-apps/kustomization.yaml

@@ -1,10 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - serviceaccount.yaml
-  - vaultauth.yaml
-  - pv_media-library.yaml
-  - pvc_media-library.yaml

apps/base/media-apps/serviceaccount.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: media-apps-vault-reader
-  namespace: media-apps
-  labels:
-    app.kubernetes.io/name: vault-reader
-    app.kubernetes.io/component: service-account
-  annotations:
-    vault.hashicorp.com/auth-method: kubernetes
-automountServiceAccountToken: true

apps/base/media-apps/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: media-apps
-spec:
-  allowedNamespaces:
-    - media-apps
-  kubernetes:
-    audiences:
-      - vault
-    role: media-apps
-    serviceAccount: media-apps-vault-reader
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default

apps/base/nzbget/deployment.yaml

@@ -1,80 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: nzbget
-  namespace: media-apps
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: nzbget
-  template:
-    metadata:
-      labels:
-        app: nzbget
-    spec:
-      securityContext:
-        fsGroup: 1000
-      containers:
-        - name: nzbget
-          image: ghcr.io/home-operations/nzbget:rolling
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 6789
-              protocol: TCP
-          env:
-            - name: TZ
-              value: Australia/Sydney
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: NZBGET_USER
-              valueFrom:
-                secretKeyRef:
-                  name: nzbget-secrets
-                  key: NZBGET_USER
-            - name: NZBGET_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: nzbget-secrets
-                  key: NZBGET_PASS
-          resources:
-            requests:
-              cpu: 100m
-              memory: 512Mi
-            limits:
-              cpu: "4"
-              memory: 8Gi
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: media-library
-              mountPath: /mnt/movies
-              subPath: movies
-            - name: media-library
-              mountPath: /mnt/tvseries
-              subPath: tvseries
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: nzbget-config
-        - name: media-library
-          persistentVolumeClaim:
-            claimName: media-library

apps/base/nzbget/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: nzbget.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: nzbget.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: nzbget
-  namespace: media-apps
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: nzbget.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: nzbget.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: nzbget-tls
-        mode: Terminate

apps/base/nzbget/httproute.yaml

@@ -1,49 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: http-redirect
-  namespace: media-apps
-spec:
-  hostnames:
-    - nzbget.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: nzbget
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: nzbget
-  namespace: media-apps
-spec:
-  hostnames:
-    - nzbget.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: nzbget
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: nzbget
-          port: 6789
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/nzbget/kustomization.yaml

@@ -1,11 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - pvc.yaml
-  - vaultstaticsecret.yaml
-  - deployment.yaml
-  - service.yaml
-  - gateway.yaml
-  - httproute.yaml

apps/base/nzbget/pvc.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: nzbget-config
-  namespace: media-apps
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: cephrbd-fast-delete
-  volumeMode: Filesystem

apps/base/nzbget/service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: nzbget
-  namespace: media-apps
-spec:
-  type: ClusterIP
-  selector:
-    app: nzbget
-  ports:
-    - name: http
-      port: 6789
-      targetPort: http
-      protocol: TCP

apps/base/nzbget/vaultstaticsecret.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: nzbget
-  namespace: media-apps
-spec:
-  destination:
-    create: true
-    name: nzbget-secrets
-  mount: kv
-  path: service/media-apps/nzbget
-  refreshAfter: 30s
-  type: kv-v2
-  vaultAuthRef: default
-  rolloutRestartTargets:
-    - kind: Deployment
-      name: nzbget

apps/base/prowlarr/configmap.yaml

@@ -1,25 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: prowlarr-config-xml
-  namespace: media-apps
-data:
-  config.xml: |
-    <Config>
-      <BindAddress>*</BindAddress>
-      <Port>9696</Port>
-      <SslPort>9898</SslPort>
-      <EnableSsl>False</EnableSsl>
-      <LaunchBrowser>True</LaunchBrowser>
-      <ApiKey>{{API_KEY}}</ApiKey>
-      <AuthenticationMethod>External</AuthenticationMethod>
-      <AuthenticationRequired>Enabled</AuthenticationRequired>
-      <LogLevel>info</LogLevel>
-      <SslCertPath></SslCertPath>
-      <SslCertPassword></SslCertPassword>
-      <UrlBase></UrlBase>
-      <InstanceName>prowlarr</InstanceName>
-      <UpdateMechanism>Docker</UpdateMechanism>
-      <AnalyticsEnabled>False</AnalyticsEnabled>
-    </Config>

apps/base/prowlarr/deployment.yaml

@@ -1,136 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: prowlarr
-  namespace: media-apps
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: prowlarr
-  template:
-    metadata:
-      labels:
-        app: prowlarr
-    spec:
-      securityContext:
-        fsGroup: 1000
-      initContainers:
-        - name: config-template
-          image: busybox:latest
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh"]
-          args:
-            - -c
-            - |
-              cp /config-template/config.xml /config/config.xml
-              sed -i "s/{{API_KEY}}/$API_KEY/g" /config/config.xml
-          env:
-            - name: API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: prowlarr-secrets
-                  key: apitoken
-          securityContext:
-            runAsUser: 1000
-            runAsGroup: 1000
-            runAsNonRoot: true
-          volumeMounts:
-            - name: config-template
-              mountPath: /config-template
-            - name: config
-              mountPath: /config
-      containers:
-        - name: prowlarr
-          image: ghcr.io/home-operations/prowlarr:rolling
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 9696
-              protocol: TCP
-          env:
-            - name: TZ
-              value: Australia/Sydney
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: "1"
-              memory: 1Gi
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          volumeMounts:
-            - name: config
-              mountPath: /config
-        - name: exportarr
-          image: ghcr.io/onedr0p/exportarr:latest
-          imagePullPolicy: IfNotPresent
-          args: ["prowlarr"]
-          ports:
-            - name: metrics
-              containerPort: 9707
-              protocol: TCP
-          env:
-            - name: TZ
-              value: Australia/Sydney
-            - name: PORT
-              value: "9707"
-            - name: URL
-              value: "http://localhost:9696"
-            - name: API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: prowlarr-secrets
-                  key: apitoken
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: 250m
-              memory: 256Mi
-          securityContext:
-            runAsUser: 1000
-            runAsGroup: 1000
-            runAsNonRoot: true
-          livenessProbe:
-            httpGet:
-              path: /metrics
-              port: metrics
-            initialDelaySeconds: 30
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              path: /metrics
-              port: metrics
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          volumeMounts:
-            - name: config
-              mountPath: /config
-              readOnly: true
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: prowlarr-config
-        - name: config-template
-          configMap:
-            name: prowlarr-config-xml

apps/base/prowlarr/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: prowlarr.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: prowlarr.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: prowlarr
-  namespace: media-apps
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: prowlarr.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: prowlarr.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: prowlarr-tls
-        mode: Terminate

apps/base/prowlarr/httproute.yaml

@@ -1,49 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: http-redirect
-  namespace: media-apps
-spec:
-  hostnames:
-    - prowlarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: prowlarr
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: prowlarr
-  namespace: media-apps
-spec:
-  hostnames:
-    - prowlarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: prowlarr
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: prowlarr
-          port: 9696
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/prowlarr/kustomization.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - pvc.yaml
-  - configmap.yaml
-  - vaultstaticsecret.yaml
-  - deployment.yaml
-  - service.yaml
-  - gateway.yaml
-  - httproute.yaml

apps/base/prowlarr/pvc.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: prowlarr-config
-  namespace: media-apps
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: cephrbd-fast-delete
-  volumeMode: Filesystem

apps/base/prowlarr/service.yaml

@@ -1,30 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: prowlarr
-  namespace: media-apps
-spec:
-  type: ClusterIP
-  selector:
-    app: prowlarr
-  ports:
-    - name: http
-      port: 9696
-      targetPort: http
-      protocol: TCP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: prowlarr-metrics
-  namespace: media-apps
-spec:
-  type: ClusterIP
-  selector:
-    app: prowlarr
-  ports:
-    - name: metrics
-      port: 9707
-      targetPort: metrics
-      protocol: TCP

apps/base/prowlarr/vaultstaticsecret.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: prowlarr
-  namespace: media-apps
-spec:
-  destination:
-    create: true
-    name: prowlarr-secrets
-  mount: kv
-  path: service/media-apps/prowlarr
-  refreshAfter: 30s
-  type: kv-v2
-  vaultAuthRef: default
-  rolloutRestartTargets:
-    - kind: Deployment
-      name: prowlarr

apps/base/radarr/configmap.yaml

@@ -1,25 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: radarr-config-xml
-  namespace: media-apps
-data:
-  config.xml: |
-    <Config>
-      <BindAddress>*</BindAddress>
-      <Port>7878</Port>
-      <SslPort>9898</SslPort>
-      <EnableSsl>False</EnableSsl>
-      <LaunchBrowser>True</LaunchBrowser>
-      <ApiKey>{{API_KEY}}</ApiKey>
-      <AuthenticationMethod>External</AuthenticationMethod>
-      <AuthenticationRequired>Enabled</AuthenticationRequired>
-      <LogLevel>debug</LogLevel>
-      <SslCertPath></SslCertPath>
-      <SslCertPassword></SslCertPassword>
-      <UrlBase></UrlBase>
-      <InstanceName>Radarr</InstanceName>
-      <UpdateMechanism>Docker</UpdateMechanism>
-      <AnalyticsEnabled>False</AnalyticsEnabled>
-    </Config>

apps/base/radarr/deployment.yaml

@@ -1,140 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: radarr
-  namespace: media-apps
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: radarr
-  template:
-    metadata:
-      labels:
-        app: radarr
-    spec:
-      securityContext:
-        fsGroup: 1000
-      initContainers:
-        - name: config-template
-          image: busybox:latest
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh"]
-          args:
-            - -c
-            - |
-              cp /config-template/config.xml /config/config.xml
-              sed -i "s/{{API_KEY}}/$API_KEY/g" /config/config.xml
-          env:
-            - name: API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: radarr-secrets
-                  key: apitoken
-          securityContext:
-            runAsUser: 1000
-            runAsGroup: 1000
-            runAsNonRoot: true
-          volumeMounts:
-            - name: config-template
-              mountPath: /config-template
-            - name: config
-              mountPath: /config
-      containers:
-        - name: radarr
-          image: ghcr.io/home-operations/radarr:rolling
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 7878
-              protocol: TCP
-          env:
-            - name: TZ
-              value: Australia/Sydney
-            - name: PORT
-              value: "7878"
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: "1"
-              memory: 1Gi
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: media-library
-              mountPath: /mnt/movies
-              subPath: movies
-        - name: exportarr
-          image: ghcr.io/onedr0p/exportarr:latest
-          imagePullPolicy: IfNotPresent
-          args: ["radarr"]
-          ports:
-            - name: metrics
-              containerPort: 9707
-              protocol: TCP
-          env:
-            - name: TZ
-              value: Australia/Sydney
-            - name: PORT
-              value: "9707"
-            - name: URL
-              value: "http://localhost:7878"
-            - name: API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: radarr-secrets
-                  key: apitoken
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: 250m
-              memory: 256Mi
-          securityContext:
-            runAsUser: 1000
-            runAsGroup: 1000
-            runAsNonRoot: true
-          livenessProbe:
-            httpGet:
-              path: /metrics
-              port: metrics
-            initialDelaySeconds: 30
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              path: /metrics
-              port: metrics
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          volumeMounts:
-            - name: config
-              mountPath: /config
-              readOnly: true
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: radarr-config
-        - name: config-template
-          configMap:
-            name: radarr-config-xml
-        - name: media-library
-          persistentVolumeClaim:
-            claimName: media-library

apps/base/radarr/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: radarr.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: radarr.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: radarr
-  namespace: media-apps
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: radarr.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: radarr.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: radarr-tls
-        mode: Terminate

apps/base/radarr/httproute.yaml

@@ -1,49 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: http-redirect
-  namespace: media-apps
-spec:
-  hostnames:
-    - radarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: radarr
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: radarr
-  namespace: media-apps
-spec:
-  hostnames:
-    - radarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: radarr
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: radarr
-          port: 7878
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/radarr/kustomization.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - pvc.yaml
-  - configmap.yaml
-  - vaultstaticsecret.yaml
-  - deployment.yaml
-  - service.yaml
-  - gateway.yaml
-  - httproute.yaml

apps/base/radarr/pvc.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: radarr-config
-  namespace: media-apps
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: cephrbd-fast-delete
-  volumeMode: Filesystem

apps/base/radarr/service.yaml

@@ -1,30 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: radarr
-  namespace: media-apps
-spec:
-  type: ClusterIP
-  selector:
-    app: radarr
-  ports:
-    - name: http
-      port: 7878
-      targetPort: http
-      protocol: TCP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: radarr-metrics
-  namespace: media-apps
-spec:
-  type: ClusterIP
-  selector:
-    app: radarr
-  ports:
-    - name: metrics
-      port: 9707
-      targetPort: metrics
-      protocol: TCP

apps/base/radarr/vaultstaticsecret.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: radarr
-  namespace: media-apps
-spec:
-  destination:
-    create: true
-    name: radarr-secrets
-  mount: kv
-  path: service/media-apps/radarr
-  refreshAfter: 30s
-  type: kv-v2
-  vaultAuthRef: default
-  rolloutRestartTargets:
-    - kind: Deployment
-      name: radarr

apps/base/sonarr/configmap.yaml

@@ -1,25 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: sonarr-config-xml
-  namespace: media-apps
-data:
-  config.xml: |
-    <Config>
-      <BindAddress>*</BindAddress>
-      <Port>8989</Port>
-      <SslPort>9898</SslPort>
-      <EnableSsl>False</EnableSsl>
-      <LaunchBrowser>True</LaunchBrowser>
-      <ApiKey>{{API_KEY}}</ApiKey>
-      <AuthenticationMethod>External</AuthenticationMethod>
-      <AuthenticationRequired>Enabled</AuthenticationRequired>
-      <LogLevel>info</LogLevel>
-      <SslCertPath></SslCertPath>
-      <SslCertPassword></SslCertPassword>
-      <UrlBase></UrlBase>
-      <InstanceName>Sonarr</InstanceName>
-      <UpdateMechanism>Docker</UpdateMechanism>
-      <AnalyticsEnabled>False</AnalyticsEnabled>
-    </Config>

apps/base/sonarr/deployment.yaml

@@ -1,140 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: sonarr
-  namespace: media-apps
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: sonarr
-  template:
-    metadata:
-      labels:
-        app: sonarr
-    spec:
-      securityContext:
-        fsGroup: 1000
-      initContainers:
-        - name: config-template
-          image: busybox:latest
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh"]
-          args:
-            - -c
-            - |
-              cp /config-template/config.xml /config/config.xml
-              sed -i "s/{{API_KEY}}/$API_KEY/g" /config/config.xml
-          env:
-            - name: API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: sonarr-secrets
-                  key: apitoken
-          securityContext:
-            runAsUser: 1000
-            runAsGroup: 1000
-            runAsNonRoot: true
-          volumeMounts:
-            - name: config-template
-              mountPath: /config-template
-            - name: config
-              mountPath: /config
-      containers:
-        - name: sonarr
-          image: ghcr.io/home-operations/sonarr:rolling
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 8989
-              protocol: TCP
-          env:
-            - name: TZ
-              value: Australia/Sydney
-            - name: PORT
-              value: "8989"
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: "1"
-              memory: 1Gi
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: media-library
-              mountPath: /mnt/tvseries
-              subPath: tvseries
-        - name: exportarr
-          image: ghcr.io/onedr0p/exportarr:latest
-          imagePullPolicy: IfNotPresent
-          args: ["sonarr"]
-          ports:
-            - name: metrics
-              containerPort: 9707
-              protocol: TCP
-          env:
-            - name: TZ
-              value: Australia/Sydney
-            - name: PORT
-              value: "9707"
-            - name: URL
-              value: "http://localhost:8989"
-            - name: API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: sonarr-secrets
-                  key: apitoken
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: 250m
-              memory: 256Mi
-          securityContext:
-            runAsUser: 1000
-            runAsGroup: 1000
-            runAsNonRoot: true
-          livenessProbe:
-            httpGet:
-              path: /metrics
-              port: metrics
-            initialDelaySeconds: 30
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              path: /metrics
-              port: metrics
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          volumeMounts:
-            - name: config
-              mountPath: /config
-              readOnly: true
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: sonarr-config
-        - name: config-template
-          configMap:
-            name: sonarr-config-xml
-        - name: media-library
-          persistentVolumeClaim:
-            claimName: media-library

apps/base/sonarr/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: sonarr.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: sonarr.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: sonarr
-  namespace: media-apps
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: sonarr.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: sonarr.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: sonarr-tls
-        mode: Terminate

apps/base/sonarr/httproute.yaml

@@ -1,49 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: http-redirect
-  namespace: media-apps
-spec:
-  hostnames:
-    - sonarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: sonarr
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: sonarr
-  namespace: media-apps
-spec:
-  hostnames:
-    - sonarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: sonarr
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: sonarr
-          port: 8989
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/sonarr/kustomization.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - pvc.yaml
-  - configmap.yaml
-  - vaultstaticsecret.yaml
-  - deployment.yaml
-  - service.yaml
-  - gateway.yaml
-  - httproute.yaml

apps/base/sonarr/pvc.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: sonarr-config
-  namespace: media-apps
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: cephrbd-fast-delete
-  volumeMode: Filesystem

apps/base/sonarr/service.yaml

@@ -1,30 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: sonarr
-  namespace: media-apps
-spec:
-  type: ClusterIP
-  selector:
-    app: sonarr
-  ports:
-    - name: http
-      port: 8989
-      targetPort: http
-      protocol: TCP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: sonarr-metrics
-  namespace: media-apps
-spec:
-  type: ClusterIP
-  selector:
-    app: sonarr
-  ports:
-    - name: metrics
-      port: 9707
-      targetPort: metrics
-      protocol: TCP

apps/base/sonarr/vaultstaticsecret.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: sonarr
-  namespace: media-apps
-spec:
-  destination:
-    create: true
-    name: sonarr-secrets
-  mount: kv
-  path: service/media-apps/sonarr
-  refreshAfter: 30s
-  type: kv-v2
-  vaultAuthRef: default
-  rolloutRestartTargets:
-    - kind: Deployment
-      name: sonarr

apps/overlays/au-syd1/bazarr/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/bazarr

apps/overlays/au-syd1/jellyseerr/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/jellyseerr

apps/overlays/au-syd1/media-apps/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/media-apps

apps/overlays/au-syd1/nzbget/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/nzbget

apps/overlays/au-syd1/prowlarr/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/prowlarr

apps/overlays/au-syd1/radarr/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/radarr

apps/overlays/au-syd1/sonarr/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/sonarr

argocd/applicationsets/media.yaml

@@ -10,16 +10,8 @@ spec:
         repoURL: https://git.unkin.net/unkin/argocd-apps
         revision: HEAD
         directories:
-          # Shared foundation: media-apps namespace, vault-reader SA, VaultAuth,
+          # jellyfin only for now; downloads/managers apps join in later PRs.
-          # and the RWX movies/tvseries library PVCs the whole stack mounts.
-          - path: apps/overlays/*/media-apps
           - path: apps/overlays/*/jellyfin
-          - path: apps/overlays/*/sonarr
-          - path: apps/overlays/*/radarr
-          - path: apps/overlays/*/prowlarr
-          - path: apps/overlays/*/bazarr
-          - path: apps/overlays/*/nzbget
-          - path: apps/overlays/*/jellyseerr
   template:
     metadata:
       name: 'media-{{path[3]}}'
@@ -31,8 +23,7 @@ spec:
         path: '{{path}}'
       destination:
         server: https://kubernetes.default.svc
-        # All media apps share the media-apps namespace (not the dir name).
+        namespace: jellyfin
-        namespace: media-apps
       syncPolicy:
         automated:
           prune: true

argocd/projects/media.yaml

@@ -5,11 +5,11 @@ metadata:
   name: media
   namespace: argocd
 spec:
-  description: Media services (jellyfin + *arr stack)
+  description: Media services (jellyfin; downloads/managers namespaces to follow)
   sourceRepos:
     - https://git.unkin.net/unkin/argocd-apps
   destinations:
-    - namespace: media-apps
+    - namespace: jellyfin
       server: https://kubernetes.default.svc
   clusterResourceWhitelist:
     - group: ''