c8355967d4e9dd3e141860ca8a4f2d9ccf187137
2 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 unkin-agent
|
b9f727bc97 |
watchstate: expose externally at watchstate.unkin.net (#420)
## Why WatchState currently only has an internal front door (watchstate.k8s.syd1.au.unkin.net, PR #419, merged). This adds a public front door at **watchstate.unkin.net** via the external (DMZ) Traefik so the admin UI is reachable off-cluster, still fully gated by oauth2-proxy/Authentik. The internal gateway and routes are untouched; oauth2-proxy now fronts BOTH hostnames. Stacked base note: the intended base (benvin/watchstate-deploy, PR #419) merged into main before this PR opened, so this targets `main`. ## How - **DNS**: `watchstate-dns-internal` DNSRecord in `apps/base/bind-internal/authoritative/records.yaml` (unkin.net zone, bind-internal) -> `A 198.18.199.0`, the traefik-external VIP. Mirrors the `arrstack-dns-internal` precedent (external front door via bind, not external-dns). Kept in the central bind-internal location, so no AppProject destination widening is needed. - **Gateway**: new `watchstate-external` Gateway (`gatewayClassName: traefik-external`), http + https listeners on hostname `watchstate.unkin.net`. TLS terminated with the Let's Encrypt `*.unkin.net` wildcard secret `wildcard-unkin-net-tls` — so **no cert-manager and no external-dns annotations**. - **Routes**: `watchstate-external-http-redirect` (http->https 301) and `watchstate-external` (https -> `watchstate-oauth2:80`), mirroring the arrproxy/cheeztv external patterns. - **oauth2-proxy dual-host**: `OAUTH2_PROXY_REDIRECT_URL` changed from the pinned cluster callback to the **relative** `/oauth2/callback`. With `OAUTH2_PROXY_REVERSE_PROXY=true` (already set), oauth2-proxy derives scheme+host per request from `X-Forwarded-Proto/Host` (verified in oauth2-proxy v7.15.3 `getOAuthRedirectURI`: host-less redirectURL falls through to request-derived), so the callback works on both `watchstate.unkin.net` and `watchstate.k8s.syd1.au.unkin.net`. `COOKIE_DOMAINS` and `WHITELIST_DOMAINS` now list both hosts (one cookie per host; a single parent-domain cookie can't cleanly span unkin.net vs k8s.syd1.au.unkin.net). - Dropped the no-op `argocd.argoproj.io/sync-wave: "0"` annotation on the `default` VaultAuth. New resources intentionally carry no sync-wave annotations. ## Validation - `kustomize build --enable-helm` on `apps/overlays/au-syd1/watchstate` and `.../bind-internal`: OK. - kubeconform (repo CI config, k8s 1.33.7): watchstate overlay 15/15 valid (2 Gateways, 4 HTTPRoutes); bind-internal overlay 67/67 valid (incl. `watchstate-dns-internal`). ## Dependencies - **Reflector allow-list (argocd-apps PR #418)**: reflects `wildcard-unkin-net-tls` into the `watchstate` namespace. This PR references that secret as if present. - **Authentik (terraform-authentik, separate PR)**: register both `https://watchstate.unkin.net/oauth2/callback` and `https://watchstate.k8s.syd1.au.unkin.net/oauth2/callback` as redirect URIs on the watchstate provider. Reviewed-on: #420 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net> |
||
|
unkin-agent
|
48632eb9f9 |
watchstate: deploy admin-gated jellyfin watch-state sync tool (#419)
## Why Deploy WatchState (arabcoders/watchstate), the Jellyfin/Plex/Emby watch-state sync tool, as an internal admin tool. It gets an admin-only web UI/API gated the same way as logviewer: an oauth2-proxy front backed by Authentik OIDC. ## What - New `watchstate` namespace + media-project app; base at `apps/base/watchstate`, overlay at `apps/overlays/au-syd1/watchstate`. - Image `ghcr.io/arabcoders/watchstate:v1.10.3` (current release; canonical upstream name, containerd mirrors route ghcr via artifactapi). - `replicas: 1`, `strategy: Recreate`, single `5Gi` `cephrbd-fast-delete` RWO PVC at `/config` — sqlite + the in-container cron/redis are single-writer. - `runAsUser/runAsGroup/fsGroup: 1000` (image's rootless user); liveness/readiness `GET /v1/api/system/healthcheck` on 8080 (route confirmed in upstream `src/API/System/HealthCheck.php`, no auth guard). - oauth2-proxy (mirrors logviewer 1:1) fronts every path. Authentik issuer `identity.k8s.syd1.au.unkin.net`, redirect `https://watchstate.k8s.syd1.au.unkin.net/oauth2/callback`. Authorization is enforced Authentik-side (akR-global-admin only), so no oauth2-proxy group allowlist is configured. - Internal-only Gateway (`traefik-internal`) for `watchstate.k8s.syd1.au.unkin.net`, `vault-issuer` TLS leaf, external-dns to `198.18.200.4`. HTTP -> HTTPS redirect. - `VaultStaticSecret` pulls OIDC creds from `kv/kubernetes/namespace/watchstate/default/oauth-credentials`; `vault-ca-cert` auto-reflects into the namespace. - Registered in the media `ApplicationSet` + `AppProject`. ## Scrape decision No `VMPodScrape`: WatchState exposes no Prometheus/`/metrics` endpoint. ## Follow-ups - **Seed check:** the VaultStaticSecret expects `client_id`, `client_secret`, and `cookie_secret` keys at the kv path. Only `client_secret` was confirmed seeded; `client_id` and a generated `cookie_secret` must also be present or the oauth2-proxy pod will not start. - **Webhook ingestion:** the Jellyfin webhook endpoint (`/v1/api/webhook`) currently sits behind oauth2-proxy like everything else. When sync is wired up, the jellyfins pushing webhooks will need an auth-bypass or an apikey route for that path. Reviewed-on: #419 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net> |