Adds the arrproxy front door to the arrstack app: the external, oauth-gated
entry to sonarr/radarr/prowlarr with per-user API-key brokering, wired to match
the arrproxy v0.1.0 code (ports, routes, identity headers, keys dir).
Topology (apps/base/arrstack/arrproxy):
- oauth2-proxy Deployment/Service is the single front (Authentik OIDC), path-
routing via --upstreams to arrproxy-ui (/, static SPA) and arrproxy-api
(/api token API + /<app> proxy). skip-auth-regex ^/[^/]+/api bypasses auth
only for the *arr proxy API (/sonarr/api...), keeping /api/tokens + /api/me
and the UI authenticated.
- Identity+groups reach the api via --pass-user-headers (X-Forwarded-*); the api
reads ARRPROXY_GROUPS_HEADER=X-Forwarded-Groups (set-xauthrequest is
auth_request-response-only and never reaches an upstream).
- oauth2-proxy trusts identity.unkin.net's internal-CA cert via a combine-certs
initContainer (system roots + vault-ca-cert).
- CNPG token store (arrproxy-db, 2 instances, cephrgw backups); a wave-1 Sync
hook Job applies the schema (arrproxy-api does not self-migrate).
- VaultStaticSecrets for the seeded ARRPROXY_PEPPER and the oauth-credentials;
the real *arr keys reuse the existing <app>-apikey Secrets (projected one file
per app into /etc/arrproxy/keys).
- External Gateway (traefik-external, arrstack.unkin.net, vault-issuer TLS) +
HTTPRoute to the oauth2-proxy entry.
Also adds the arrstack.unkin.net apex A record (-> external DMZ VIP 198.18.199.0)
to the bind-operator unkin.net zone.
The nzbget pod in namespace `arrstack` is stuck in `Init:ImagePullBackOff`.
## Why
The deployment pins `artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/nzbget:v26.2` on both the `seed-config` initContainer and the main `nzbget` container. linuxserver does not publish a bare `v26.2` tag - the pull fails with:
```
failed to resolve reference ".../linuxserver/nzbget:v26.2": ... not found
Error: ImagePullBackOff
```
Confirmed against the artifactapi dockerhub mirror: `manifests/v26.2` -> HTTP 404. linuxserver version-pins nzbget under the `version-v<MAJOR>.<MINOR>` scheme, and the immutable date tags `26.2.<date>`. `manifests/version-v26.2` -> HTTP 200.
## Change
- Set both nzbget images (initContainer + main container) to `version-v26.2`, keeping nzbget on the intended 26.2 line and matching the version-pin convention used by the sibling sonarr (`4.0.19`) / radarr (`6.3.0`) deployments.
No other change. The `seed-config` init logic is unaffected - it already mirrors linuxserver's own init (`cp /app/nzbget/share/nzbget/nzbget.conf /config/nzbget.conf`), and since it seeds `/config/nzbget.conf` before the main container, linuxserver's init copy is skipped (no conflict). Instant-move download layout on the media PVCs is preserved.
## Validation
- `kustomize build --enable-helm apps/overlays/au-syd1/arrstack` renders cleanly (both images -> `version-v26.2`, no stale `v26.2`).
- `pre-commit run --files apps/base/arrstack/nzbget/deployment.yaml` passes (yamllint et al).
Scoped to `apps/base/arrstack/nzbget/deployment.yaml` only; the top-level `apps/base/arrstack/kustomization.yaml` was not touched (another agent is editing sonarr/radarr/prowlarr on a separate branch).
---------
Co-authored-by: unkin-agent <unkin-agent@users.noreply.git.unkin.net>
Reviewed-on: #370
Co-authored-by: Unkin Agent <unkin-agent@unkin.net>
Co-committed-by: Unkin Agent <unkin-agent@unkin.net>
## Why
The sonarr/radarr/prowlarr images self-generate an API key into
/config/config.xml on first boot, so the key is unmanaged and differs per
volume reset. This makes Vault the source of truth for those keys (override
bootstrap, chosen by Ben): the key is minted in Vault and enforced into
config.xml before each app starts.
## Changes
- Add a `VaultAuth` `default` in the `arrstack` namespace (kubernetes auth,
mount `k8s/au/syd1`, role `default`, SA `default`), mirroring jellyfin.
- Add a per-app `VaultStaticSecret` that syncs
`kv/kubernetes/namespace/arrstack/default/<app>` (key `apitoken`) into the
`<app>-apikey` Secret. The `default` k8s role's templated policy already
grants read on that path for the `arrstack/default` SA, so no
terraform-vault change is needed.
- Add an `apikey-init` initContainer to each of the three deployments that
reads `API_KEY` from the VSO-created Secret, fails closed on a missing or
non-hex value, and writes/updates only the `<ApiKey>` element in
`/config/config.xml` (then fixes ownership 1000:1000, mode 600). Image is a
pinned busybox via artifactapi to keep this PR atomic (no new image
dependency).
- Wire the new manifests into the base and per-app kustomizations.
## Notes
- Keys already seeded in Vault at `kv/kubernetes/namespace/arrstack/default/<app>`.
- nzbget is out of scope: it has no config.xml `<ApiKey>` (uses ControlPassword),
a separate follow-up.
- Downstream consumers (proxy, terraform) currently read
`kv/service/media-apps/<app>`; the authoritative key now lives at the path
above. Reconciliation is deferred.
---------
Co-authored-by: unkin-agent <unkin-agent@git.unkin.net>
Reviewed-on: #369
Co-authored-by: Unkin Agent <unkin-agent@unkin.net>
Co-committed-by: Unkin Agent <unkin-agent@unkin.net>
## Why
Stands up the download-automation stack (sonarr, radarr, prowlarr, nzbget) in a new `arrstack` namespace, sharing the same CephFS TV/movies subvolumes that jellyfin serves read-only (jellyfin static-PV rework is on the base branch, PR #237). Downloads and libraries live on one filesystem per media type so the arrs import with atomic hardlink moves.
## Changes
- Add `apps/base/arrstack/` namespace with its own static CephFS PVs (`arrstack-media-tv`, `arrstack-media-movies`) + RWX PVCs (`media-tv`, `media-movies`) bound to the same rootPaths jellyfin uses; each namespace gets a unique PV name/volumeHandle pinned by claimRef.
- Deploy sonarr (mounts media-tv RW), radarr (media-movies RW), prowlarr (config only), nzbget (both media PVCs RW); single replica, Recreate strategy, LinuxServer images via artifactapi dockerhub remote, PUID/PGID/TZ, probes, fsGroup for CephFS writability.
- Per-app config PVCs on `cephrbd-fast-retain` (RWO, 5Gi) for the SQLite state; internal-only Gateway + HTTPRoute per app (traefik-internal, vault-issuer, external-dns `<app>.k8s.syd1.au.unkin.net`), no oauth yet.
- nzbget: initContainer seeds `/config/nzbget.conf` (copy image template if absent, append managed path/category block once) and creates the media dirs; category `tv` -> `/media/tv/downloads`, `movies` -> `/media/movies/downloads`.
- Wire ArgoCD: add `apps/overlays/*/arrstack` to the media ApplicationSet. (media AppProject already gains the arrstack destination + PersistentVolume whitelist on the base branch.)
## Depends on
terraform-artifactapi PR #31 (allowlist `^linuxserver/` on the dockerhub remote) must be merged + applied before these pods can pull.
## Follow-up (terraform)
Root folders (/media/tv/series, /media/movies/films), download-client wiring (host `nzbget`, port 6789, categories tv/movies) and API keys are configured later via terraform-arr.
---------
Co-authored-by: Ben Vincent <neotheo@gmail.com>
Co-authored-by: Ben Vin <neotheo@gmail.com>
Reviewed-on: #366
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
unkin-agent