arrstack: rebuild adult tier on the shared-Postgres pattern (#414)
## Why Rebuild the ADULT arr tier on the same shared-Postgres, active-active pattern the kids tier now uses, replacing the legacy adult sonarr/radarr/nzbget. The old adult apps hold **no data**, so the wipe is sanctioned. **Stacked on** `benvin/arrstack-kids` (#412) — review/merge that first. ## How - **Add** `sonarr-adult` / `radarr-adult` / `nzbget-adult` (copies of the `*-kids` dirs, `s/kids/adult`): - own DBs `sonarr-adult-main` / `radarr-adult-main`, Vault paths `.../default/{sonarr,radarr}-adult(+-db)` - S3 prefixes `sonarr-adult` / `radarr-adult`; UrlBase + probe + exportarr URLs `/3aa168/{sonarr,radarr}` (adult hash) - media subPaths `tvshows/adult` + `movies/adult`; nzbget config PVC on `cephrbd-fast-delete` - **postgres**: add managed roles `sonarr-adult`/`radarr-adult`, Database CRDs `{sonarr,radarr}-adult-main`, VaultStaticSecrets `{sonarr,radarr}-adult-db` - **Remove** legacy `sonarr`/`radarr`/`nzbget` dirs (incl. their gateway/httproute), managed roles `sonarr`/`radarr`, databases `{sonarr,radarr}-main`, VSS `{sonarr,radarr}-db`, and all kustomization entries - Third-party images stay canonical upstream; in-house images stay explicit `docker-internal` `prowlarr`, `arrproxy`, and everything else untouched. arrproxy path re-wiring is a later PR. Verified: `kustomize build` + `kubeconform` (87/87 valid), no dangling refs to removed apps, no `3df803` in adult files. Reviewed-on: #414 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
This commit was merged in pull request #414.
This commit is contained in:
@@ -0,0 +1,25 @@
|
||||
---
|
||||
# Non-secret env for the -unkin2 fork (adult tier). Identical mechanism to the
|
||||
# kids sonarr, pointed at its own shared-Postgres database (sonarr-adult-main)
|
||||
# and its own UrlBase (/3aa168/sonarr) so arrproxy path-routing reaches the adult
|
||||
# instance separately. Shares the one arrstack Valkey (keys namespaced by the
|
||||
# fork's sonarr:ratelimit: prefix). User/Password/ApiKey come from Secrets (see
|
||||
# deployment.yaml), not here.
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: sonarr-adult-env
|
||||
namespace: arrstack
|
||||
data:
|
||||
Sonarr__Postgres__Host: arrstack-postgres-rw.arrstack.svc.cluster.local
|
||||
Sonarr__Postgres__Port: "5432"
|
||||
Sonarr__Postgres__MainDb: sonarr-adult-main
|
||||
Sonarr__Log__DbEnabled: "false"
|
||||
Sonarr__Auth__Method: External
|
||||
Sonarr__Auth__Required: DisabledForLocalAddresses
|
||||
Sonarr__App__InstanceName: Sonarr
|
||||
Sonarr__Server__Port: "8989"
|
||||
Sonarr__Server__UrlBase: /3aa168/sonarr
|
||||
Sonarr__Update__Mechanism: External
|
||||
Sonarr__Redis__Host: valkey-arrstack-valkey.arrstack.svc.cluster.local
|
||||
Sonarr__Redis__Port: "6379"
|
||||
@@ -0,0 +1,245 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: sonarr-adult
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
# Reloader rolls the Deployment when sonarr-adult-env changes (plain envFrom
|
||||
# ConfigMap does not trigger a rollout on its own).
|
||||
configmap.reloader.stakater.com/auto: "true"
|
||||
spec:
|
||||
# Active-active: the -unkin2 fork keeps all state in the shared Postgres
|
||||
# (arrstack-postgres) and coordinates via Postgres advisory locks, so N
|
||||
# replicas run concurrently behind the sonarr-adult Service. RollingUpdate is
|
||||
# safe — no SQLite, no RWO lock.
|
||||
replicas: 3
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: sonarr-adult
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: sonarr-adult
|
||||
spec:
|
||||
securityContext:
|
||||
# Fork image has no USER; pin it to a non-root UID and group-write the
|
||||
# shared RWX CephFS media subtree. OnRootMismatch avoids a recursive
|
||||
# chown of the whole media tree.
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
initContainers:
|
||||
# Gate the app on its own Postgres database+role being reachable.
|
||||
# waitfordb reads the PG* env as a libpq fallback, so the password never
|
||||
# lands in argv.
|
||||
- name: wait-for-db
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
|
||||
env:
|
||||
- name: WAITFORDB_TIMEOUT
|
||||
value: 5m
|
||||
- name: WAITFORDB_SSLMODE
|
||||
value: disable
|
||||
- name: PGHOST
|
||||
value: arrstack-postgres-rw.arrstack.svc.cluster.local
|
||||
- name: PGPORT
|
||||
value: "5432"
|
||||
- name: PGDATABASE
|
||||
value: sonarr-adult-main
|
||||
- name: PGUSER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: sonarr-adult-db
|
||||
key: username
|
||||
- name: PGPASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: sonarr-adult-db
|
||||
key: password
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
containers:
|
||||
- name: sonarr
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/sonarr:v5.0.0-unkin6
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- /app/Sonarr
|
||||
args:
|
||||
- -nobrowser
|
||||
- -data=/config
|
||||
# Bypass the single-instance guard so multiple replicas can share one
|
||||
# /config. Cross-replica safety is the Postgres layer, not a lock file.
|
||||
- -nosingleinstancecheck
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8989
|
||||
protocol: TCP
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: sonarr-adult-env
|
||||
env:
|
||||
- name: Sonarr__Postgres__User
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: sonarr-adult-db
|
||||
key: username
|
||||
- name: Sonarr__Postgres__Password
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: sonarr-adult-db
|
||||
key: password
|
||||
- name: Sonarr__Auth__ApiKey
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: sonarr-adult-apikey
|
||||
key: apitoken
|
||||
# MediaCover object store (shared arrstack-media Ceph RGW bucket,
|
||||
# partitioned by the sonarr-adult key prefix).
|
||||
- name: Sonarr__MediaCoverS3__Endpoint
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrstack-media-s3
|
||||
key: S3_ENDPOINT
|
||||
- name: Sonarr__MediaCoverS3__AccessKey
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrstack-media-s3
|
||||
key: AWS_ACCESS_KEY_ID
|
||||
- name: Sonarr__MediaCoverS3__SecretKey
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrstack-media-s3
|
||||
key: AWS_SECRET_ACCESS_KEY
|
||||
- name: Sonarr__MediaCoverS3__Bucket
|
||||
value: arrstack-media
|
||||
- name: Sonarr__MediaCoverS3__Prefix
|
||||
value: sonarr-adult
|
||||
- name: Sonarr__MediaCoverS3__ForcePathStyle
|
||||
value: "true"
|
||||
- name: Sonarr__MediaCoverS3__CaCertPath
|
||||
value: /etc/ssl/vault-ca/ca.crt
|
||||
# Backup object store (shared arrstack-backups Ceph RGW bucket,
|
||||
# partitioned by the sonarr-adult key prefix).
|
||||
- name: Sonarr__BackupS3__Endpoint
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrstack-backups-s3
|
||||
key: S3_ENDPOINT
|
||||
- name: Sonarr__BackupS3__AccessKey
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrstack-backups-s3
|
||||
key: AWS_ACCESS_KEY_ID
|
||||
- name: Sonarr__BackupS3__SecretKey
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrstack-backups-s3
|
||||
key: AWS_SECRET_ACCESS_KEY
|
||||
- name: Sonarr__BackupS3__Bucket
|
||||
value: arrstack-backups
|
||||
- name: Sonarr__BackupS3__Prefix
|
||||
value: sonarr-adult
|
||||
- name: Sonarr__BackupS3__ForcePathStyle
|
||||
value: "true"
|
||||
- name: Sonarr__BackupS3__CaCertPath
|
||||
value: /etc/ssl/vault-ca/ca.crt
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /3aa168/sonarr/ping
|
||||
port: http
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /3aa168/sonarr/ping
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 1Gi
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
# Adult TV subtree of the shared media-tv PVC (same CephFS subvolume
|
||||
# the kids sonarr writes and jellyfin reads).
|
||||
- name: media-tv
|
||||
mountPath: /media/tv
|
||||
subPath: tvshows/adult
|
||||
- name: vault-ca
|
||||
mountPath: /etc/ssl/vault-ca
|
||||
readOnly: true
|
||||
# exportarr sidecar: polls the local replica's API and exposes Prometheus
|
||||
# metrics on :9707 (scraped by the sonarr-adult-exportarr VMPodScrape).
|
||||
- name: exportarr
|
||||
image: ghcr.io/onedr0p/exportarr:v2.3.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- sonarr
|
||||
env:
|
||||
- name: PORT
|
||||
value: "9707"
|
||||
# URL includes the /3aa168/sonarr UrlBase (Sonarr__Server__UrlBase).
|
||||
- name: URL
|
||||
value: http://localhost:8989/3aa168/sonarr
|
||||
- name: APIKEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: sonarr-adult-apikey
|
||||
key: apitoken
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 9707
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: metrics
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: metrics
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
resources:
|
||||
requests:
|
||||
cpu: 25m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
volumes:
|
||||
- name: config
|
||||
emptyDir: {}
|
||||
- name: media-tv
|
||||
persistentVolumeClaim:
|
||||
claimName: media-tv
|
||||
# Estate CA for validating the Ceph RGW (s3.ceph.unkin.net) TLS cert.
|
||||
- name: vault-ca
|
||||
secret:
|
||||
secretName: vault-ca-cert
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- vaultstaticsecret.yaml
|
||||
- configmap.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- vmpodscrape.yaml
|
||||
@@ -0,0 +1,15 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: sonarr-adult
|
||||
namespace: arrstack
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 8989
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app: sonarr-adult
|
||||
type: ClusterIP
|
||||
@@ -0,0 +1,25 @@
|
||||
---
|
||||
# sonarr-adult API key. Seeded out-of-band at
|
||||
# kv/kubernetes/namespace/arrstack/default/sonarr-adult (key: apitoken); the
|
||||
# default k8s role's templated policy already grants read on
|
||||
# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
|
||||
# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
|
||||
# syncs it into the sonarr-adult-apikey Secret consumed by the Deployment.
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: sonarr-adult-apikey
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: sonarr-adult-apikey
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: kubernetes/namespace/arrstack/default/sonarr-adult
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
# Scrape the exportarr sidecar (:9707) on every sonarr-adult pod. Picked up by the
|
||||
# observability VMAgent (selectAllByDefault). Pod-level rather than
|
||||
# VMServiceScrape because the sonarr-adult Service doesn't expose the metrics port.
|
||||
apiVersion: operator.victoriametrics.com/v1beta1
|
||||
kind: VMPodScrape
|
||||
metadata:
|
||||
name: sonarr-adult-exportarr
|
||||
namespace: arrstack
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: sonarr-adult
|
||||
podMetricsEndpoints:
|
||||
- port: metrics
|
||||
path: /metrics
|
||||
Reference in New Issue
Block a user