arrstack: provision shared Ceph RGW bucket for media assets (#387)

## Why

Servarr MediaCover assets (movie/series posters and fanart) and app backups currently live on each replica's local `/config`, which is an `emptyDir`. A poster the leader downloads is invisible to the other replicas behind the Service, so covers render inconsistently and backups are leader-local. This provisions a shared Ceph RGW (S3) bucket to hold those assets instead.

## Changes

- Add an `arrstack-media` `ObjectStoreUser` + `Bucket` (cephrgw-operator), mirroring the CNPG backup pattern. The operator mints the `arrstack-media-s3` credential Secret in-namespace (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `S3_ENDPOINT`), so **no Vault KV seeding is required**.
- Wire the radarr Deployment to the bucket via `Radarr__MediaCover__S3__*` env (creds from the operator Secret; estate CA mounted at `/etc/ssl/vault-ca/ca.crt` for RGW TLS validation).

## Notes

- The env keys are unknown to the current `-unkin2` image and are ignored by it; they activate once the `-unkin3+` image (radarr MediaCover-S3 support, separate radarr PR) ships. sonarr/prowlarr wiring and backups-to-S3 follow in later PRs.
- `kubectl kustomize apps/base/arrstack` builds clean.

Reviewed-on: #387
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

This commit was merged in pull request #387.

This commit is contained in:

Unkin Agent

2026-08-22 16:17:23 +10:00

committed by

BenVincent

parent 5155cee5e7

commit 9cdcdf62bc

3 changed files with 72 additions and 0 deletions

									
										apps/base/arrstack/kustomization.yaml
									
		+1
		
												View File
												
				@@ -9,6 +9,7 @@ resources:

				  - pv-media-movies.yaml

				  - pvc-media-tv.yaml

				  - pvc-media-movies.yaml

				  - media-bucket.yaml

				  - postgres

				  - sonarr

				  - radarr