Pull bind CRDs from operator repo instead of vendoring

References the CRD bundle from the bind-operator repo by a stable raw URL
so the CRDs never drift from the operator, matching how other apps import
upstream manifests.

- replace the nine vendored crds/*.yaml with a single remote resource:
  git.unkin.net/unkin/bind-operator raw config/crd/install.yaml at v0.1.1
- bump the operator image to v0.1.1 so the running operator and its CRDs
  come from the same tag

.woodpecker/vector-test.yaml

@@ -1,29 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: vector-test
-    image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector:0.57.0-debian
-    commands:
-      # Dummy creds + writable dirs so the full topologies build; the unit tests
-      # only exercise the transforms (sources are not started).
-      - export CLICKHOUSE_USER=ci CLICKHOUSE_PASSWORD=ci
-      - export NATS_PRODUCER_PASSWORD=ci NATS_CONSUMER_PASSWORD=ci
-      - mkdir -p /vector-data-dir /etc/vault-ca
-      - cp /etc/ssl/certs/ca-certificates.crt /etc/vault-ca/ca.crt
-      # Transform tier + VM ingest: unit-tested transforms.
-      - vector test apps/base/logging/vector/aggregator.yaml apps/base/logging/vector/aggregator-tests.yaml
-      - vector test apps/base/logging/vector/vm-ingest.yaml apps/base/logging/vector/vm-ingest-tests.yaml
-      # Agent has no transforms to unit-test; validate it builds. (The archiver
-      # leg is now the logarchiver service, not a Vector pipeline.)
-      - vector validate --no-environment apps/base/logging/vector/agent.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 256Mi
-            cpu: 250m
-          limits:
-            memory: 1Gi
-            cpu: 1

apps/base/age-api/deployment.yaml

@@ -12,13 +12,13 @@ spec:
   template:
     metadata:
       annotations:
-        configmap.reloader.stakater.com/auto: "true"
+        reloader.stakater.com/auto: "true"
       labels:
         app: age-api
     spec:
       containers:
         - name: age-api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/age-api:v0.1.0
+          image: git.unkin.net/unkin/age-api:v0.1.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

apps/base/age-api/kustomization.yaml

@@ -8,7 +8,6 @@ resources:
   - httproute.yaml
   - namespace.yaml
   - service.yaml
-  - vpa.yaml
 
 configMapGenerator:
   - name: age-api-config

apps/base/age-api/vpa.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: autoscaling.k8s.io/v1
-kind: VerticalPodAutoscaler
-metadata:
-  name: age-api-vpa
-  namespace: age-api
-spec:
-  targetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: age-api
-  updatePolicy:
-    updateMode: "Off"

apps/base/arrstack/arrproxy/api-deployment.yaml

@@ -1,136 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: arrproxy-api
-  namespace: arrstack
-  annotations:
-    # Wave 2: serve only after the wave-1 migrate Job completes.
-    argocd.argoproj.io/sync-wave: "2"
-    secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-db-app,sonarr-apikey,radarr-apikey,prowlarr-apikey"
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: arrproxy-api
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: arrproxy-api
-    spec:
-      serviceAccountName: default
-      automountServiceAccountToken: false
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        fsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.1.0
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 8080
-              name: http
-              protocol: TCP
-          env:
-            - name: ARRPROXY_ADDR
-              value: ":8080"
-            # oauth2-proxy --pass-user-headers forwards identity to the upstream as
-            # X-Forwarded-{User,Email,Groups} (a single comma-joined Groups value).
-            # Email/User already match the api defaults; override the groups header
-            # (default X-Auth-Request-Groups is auth_request-response-only and never
-            # reaches this upstream) so group-based authorization works.
-            - name: ARRPROXY_GROUPS_HEADER
-              value: X-Forwarded-Groups
-            # Real per-app *arr keys, projected one file per app under this dir
-            # (sourced from the existing <app>-apikey Secrets). The api injects
-            # them server-side and redacts them from every proxied response.
-            - name: ARRPROXY_KEYS_DIR
-              value: /etc/arrproxy/keys
-            - name: ARRPROXY_PEPPER
-              valueFrom:
-                secretKeyRef:
-                  name: arrproxy-pepper
-                  key: pepper
-            # DSN assembled from the CNPG-generated arrproxy-db-app Secret;
-            # $(VAR) expansion resolves the two env entries defined above it.
-            - name: ARRPROXY_DB_USER
-              valueFrom:
-                secretKeyRef:
-                  name: arrproxy-db-app
-                  key: username
-            - name: ARRPROXY_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: arrproxy-db-app
-                  key: password
-            - name: DATABASE_URL
-              value: "postgres://$(ARRPROXY_DB_USER):$(ARRPROXY_DB_PASSWORD)@arrproxy-db-rw.arrstack.svc.cluster.local:5432/arrproxy?sslmode=require"
-          volumeMounts:
-            - name: arr-keys
-              mountPath: /etc/arrproxy/keys
-              readOnly: true
-            - name: tmp
-              mountPath: /tmp
-          livenessProbe:
-            httpGet:
-              path: /livez
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 100m
-              memory: 128Mi
-            limits:
-              cpu: "1"
-              memory: 512Mi
-      volumes:
-        # Real *arr API keys, one file per app named exactly <app> so the api
-        # reads /etc/arrproxy/keys/{sonarr,radarr,prowlarr}. Reuses the same
-        # <app>-apikey Secrets the *arr Deployments already consume.
-        - name: arr-keys
-          projected:
-            sources:
-              - secret:
-                  name: sonarr-apikey
-                  items:
-                    - key: apitoken
-                      path: sonarr
-              - secret:
-                  name: radarr-apikey
-                  items:
-                    - key: apitoken
-                      path: radarr
-              - secret:
-                  name: prowlarr-apikey
-                  items:
-                    - key: apitoken
-                      path: prowlarr
-        - name: tmp
-          emptyDir:
-            sizeLimit: 64Mi
-      restartPolicy: Always

apps/base/arrstack/arrproxy/cnpg_backup.yaml

@@ -1,51 +0,0 @@
----
-# Ceph RGW (S3) backup target for the arrproxy token-store CNPG cluster,
-# provisioned by the in-estate cephrgw-operator. One dedicated bucket + owner
-# user per cluster.
-apiVersion: ceph.unkin.net/v1alpha1
-kind: ObjectStoreUser
-metadata:
-  name: cnpg-arrproxy-backup
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  displayName: "CNPG backup owner (arrproxy)"
-  uid: cnpg-arrproxy-backup
-  maxBuckets: 5
-  secretName: cnpg-arrproxy-backup-s3
-  retainOnDelete: true
----
-apiVersion: ceph.unkin.net/v1alpha1
-kind: Bucket
-metadata:
-  name: cnpg-arrproxy
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  placementTarget: ec
-  bucketName: cnpg-arrproxy
-  ownerRef: cnpg-arrproxy-backup
-  versioning: false
-  tags:
-    app: arrproxy
-    purpose: cnpg-backup
-  retainOnDelete: true
----
-# Nightly base backup; continuous WAL archiving is always-on via the Cluster's
-# spec.backup.barmanObjectStore. Staggered off other clusters' schedules.
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: cnpg-arrproxy-nightly
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  schedule: "0 20 2 * * *"
-  immediate: false
-  backupOwnerReference: self
-  method: barmanObjectStore
-  cluster:
-    name: arrproxy-db

apps/base/arrstack/arrproxy/cnpg_cluster.yaml

@@ -1,117 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: arrproxy-db
-  namespace: arrstack
-  annotations:
-    # Wave 0: DB (and the generated arrproxy-db-app Secret) must be Healthy before
-    # the wave-1 migrate Job runs. ArgoCD gates on the Cluster's health status.
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  affinity:
-    podAntiAffinityType: preferred
-  backup:
-    retentionPolicy: 30d
-    barmanObjectStore:
-      destinationPath: s3://cnpg-arrproxy
-      endpointURL: https://s3.ceph.unkin.net
-      endpointCA:
-        name: vault-ca-cert
-        key: ca.crt
-      s3Credentials:
-        accessKeyId:
-          name: cnpg-arrproxy-backup-s3
-          key: AWS_ACCESS_KEY_ID
-        secretAccessKey:
-          name: cnpg-arrproxy-backup-s3
-          key: AWS_SECRET_ACCESS_KEY
-      serverName: arrproxy
-      data:
-        compression: bzip2
-        jobs: 2
-      wal:
-        compression: zstd
-        maxParallel: 2
-  bootstrap:
-    initdb:
-      # No secret ref: CNPG mints the owner credentials and publishes them in the
-      # generated "arrproxy-db-app" Secret, which the api reads to build the DSN.
-      database: arrproxy
-      encoding: UTF8
-      localeCType: C
-      localeCollate: C
-      owner: arrproxy
-  enablePDB: true
-  enableSuperuserAccess: false
-  failoverDelay: 0
-  imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
-  instances: 2
-  logLevel: info
-  maxSyncReplicas: 0
-  minSyncReplicas: 0
-  monitoring:
-    customQueriesConfigMap:
-      - key: queries
-        name: cnpg-default-monitoring
-    disableDefaultQueries: false
-    enablePodMonitor: false
-  postgresql:
-    parameters:
-      archive_mode: "on"
-      archive_timeout: 5min
-      dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
-      full_page_writes: "on"
-      log_destination: csvlog
-      log_directory: /controller/log
-      log_filename: postgres
-      log_rotation_age: "0"
-      log_rotation_size: "0"
-      log_truncate_on_rotation: "false"
-      logging_collector: "on"
-      max_connections: "200"
-      max_parallel_workers: "16"
-      max_replication_slots: "16"
-      max_worker_processes: "16"
-      shared_buffers: 128MB
-      shared_memory_type: mmap
-      ssl_max_protocol_version: TLSv1.3
-      ssl_min_protocol_version: TLSv1.3
-      wal_keep_size: 256MB
-      wal_level: logical
-      wal_log_hints: "on"
-      wal_receiver_timeout: 5s
-      wal_sender_timeout: 5s
-    syncReplicaElectionConstraint:
-      enabled: false
-  primaryUpdateMethod: restart
-  primaryUpdateStrategy: unsupervised
-  probes:
-    liveness:
-      isolationCheck:
-        connectionTimeout: 1000
-        enabled: true
-        requestTimeout: 1000
-  replicationSlots:
-    highAvailability:
-      enabled: true
-      slotPrefix: _cnpg_
-    synchronizeReplicas:
-      enabled: true
-    updateInterval: 30
-  resources:
-    limits:
-      cpu: 500m
-      memory: 512Mi
-    requests:
-      cpu: 50m
-      memory: 256Mi
-  smartShutdownTimeout: 180
-  startDelay: 3600
-  stopDelay: 1800
-  storage:
-    resizeInUseVolumes: true
-    size: 10Gi
-    storageClass: cephrbd-fast-delete
-  switchoverDelay: 3600

apps/base/arrstack/arrproxy/gateway.yaml

@@ -1,41 +0,0 @@
----
-# External (DMZ) front for the arrstack, served on arrstack.unkin.net via the
-# external Traefik (LB VIP 198.18.199.0). cert-manager mints arrproxy-gateway-tls
-# (CN arrstack.unkin.net) off the internal Vault-PKI CA. The apex arrstack.unkin.net
-# A record lives in the bind-operator unkin.net zone (bind-internal/authoritative),
-# NOT external-dns, so no external-dns annotation here.
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: external
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: arrstack.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  name: arrproxy
-  namespace: arrstack
-spec:
-  gatewayClassName: traefik-external
-  listeners:
-    - name: http
-      port: 80
-      protocol: HTTP
-      hostname: arrstack.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-    - name: https
-      port: 443
-      protocol: HTTPS
-      hostname: arrstack.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-      tls:
-        mode: Terminate
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: arrproxy-gateway-tls

apps/base/arrstack/arrproxy/httproute.yaml

@@ -1,58 +0,0 @@
----
-# Redirect plain HTTP to HTTPS.
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: arrproxy-http-redirect
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  hostnames:
-    - arrstack.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: arrproxy
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-# All HTTPS traffic enters via oauth2-proxy (the arrproxy entry Service), which
-# authenticates and path-routes to arrproxy-ui / arrproxy-api. The UI-vs-api and
-# the /<app>/api oauth-bypass split is done inside oauth2-proxy (upstreams +
-# skip-auth-regex), so a single backend here is sufficient.
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: arrproxy-route
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  hostnames:
-    - arrstack.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: arrproxy
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: arrproxy
-          port: 80
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/arrstack/arrproxy/kustomization.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - cnpg_cluster.yaml
-  - cnpg_backup.yaml
-  - migrations-configmap.yaml
-  - migrate-job.yaml
-  - vaultstaticsecret.yaml
-  - oauth2-proxy-configmap.yaml
-  - oauth2-proxy-deployment.yaml
-  - api-deployment.yaml
-  - ui-deployment.yaml
-  - services.yaml
-  - gateway.yaml
-  - httproute.yaml

apps/base/arrstack/arrproxy/migrate-job.yaml

@@ -1,92 +0,0 @@
----
-# Applies the arrproxy schema once per sync, before the api rolls, so the serve
-# replicas never race migrations (arrproxy-api does not self-migrate). Runs as the
-# CNPG-minted app user so the tokens table is owned by that role.
-#
-# Sync-phase hook at wave 1 (NOT PreSync): the CNPG Cluster + generated
-# arrproxy-db-app Secret apply at wave 0 and ArgoCD waits for the Cluster to be
-# Healthy before starting wave 1, so Postgres exists before migrate connects.
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: arrproxy-migrate
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/hook: Sync
-    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
-    argocd.argoproj.io/sync-wave: "1"
-spec:
-  backoffLimit: 6
-  ttlSecondsAfterFinished: 600
-  template:
-    metadata:
-      labels:
-        app: arrproxy-migrate
-    spec:
-      serviceAccountName: default
-      automountServiceAccountToken: false
-      restartPolicy: Never
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        fsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: migrate
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:18-alpine
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: HOME
-              value: /tmp
-            - name: PGUSER
-              valueFrom:
-                secretKeyRef:
-                  name: arrproxy-db-app
-                  key: username
-            - name: PGPASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: arrproxy-db-app
-                  key: password
-            - name: PGHOST
-              value: arrproxy-db-rw.arrstack.svc.cluster.local
-            - name: PGPORT
-              value: "5432"
-            - name: PGDATABASE
-              value: arrproxy
-            - name: PGSSLMODE
-              value: require
-          command:
-            - psql
-            - -v
-            - ON_ERROR_STOP=1
-            - -f
-            - /migrations/0001_init.sql
-          volumeMounts:
-            - name: migrations
-              mountPath: /migrations
-              readOnly: true
-            - name: tmp
-              mountPath: /tmp
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 100m
-              memory: 128Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-      volumes:
-        - name: migrations
-          configMap:
-            name: arrproxy-migrations
-        - name: tmp
-          emptyDir:
-            sizeLimit: 64Mi

apps/base/arrstack/arrproxy/migrations-configmap.yaml

@@ -1,29 +0,0 @@
----
-# arrproxy schema, mirrored from the arrproxy repo migrations/0001_init.sql
-# (v0.1.0). arrproxy-api does NOT self-migrate, so the wave-1 migrate Job applies
-# this once per sync as the app user. Keep in sync with the repo on schema bumps.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: arrproxy-migrations
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-data:
-  0001_init.sql: |
-    -- arrproxy token store. Only token hashes are persisted; plaintext is shown
-    -- once at mint time and never recoverable.
-    CREATE TABLE IF NOT EXISTS tokens (
-        id           TEXT PRIMARY KEY,
-        subject      TEXT        NOT NULL,
-        label        TEXT        NOT NULL DEFAULT '',
-        token_hash   TEXT        NOT NULL UNIQUE,
-        apps         TEXT[]      NOT NULL DEFAULT '{}',
-        created_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
-        expires_at   TIMESTAMPTZ,
-        disabled     BOOLEAN     NOT NULL DEFAULT false,
-        last_used_at TIMESTAMPTZ
-    );
-
-    CREATE INDEX IF NOT EXISTS tokens_subject_idx ON tokens (subject);
-    CREATE INDEX IF NOT EXISTS tokens_token_hash_idx ON tokens (token_hash);

apps/base/arrstack/arrproxy/oauth2-proxy-configmap.yaml

@@ -1,46 +0,0 @@
----
-# Non-secret oauth2-proxy configuration (client_id/secret/cookie_secret come from
-# the oauth-credentials Secret). oauth2-proxy is the single auth front for the
-# arrstack: it authenticates the UI and the token API against Authentik, and path-
-# routes to the arrproxy-ui / arrproxy-api upstreams. /<app>/api is exempted from
-# auth (SKIP_AUTH_REGEX) so *arr clients presenting a per-user token reach the api
-# directly; the api then validates the token. Everything else requires the oauth
-# session and receives identity via X-Forwarded-* / X-Auth-Request-* headers.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: arrproxy-oauth2-env
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-data:
-  OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
-  OAUTH2_PROXY_PROVIDER: "oidc"
-  # Authentik arrstack app discovery issuer (served by the internal unkin.net CA;
-  # trusted via PROVIDER_CA_FILES below). CONFIRM the slug matches the Authentik
-  # application (terraform-authentik PR #18).
-  OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/arrstack/"
-  OAUTH2_PROXY_REDIRECT_URL: "https://arrstack.unkin.net/oauth2/callback"
-  # Longest-prefix wins: /api and /<app> go to arrproxy-api, everything else
-  # (the SPA + static assets) to arrproxy-ui.
-  OAUTH2_PROXY_UPSTREAMS: "http://arrproxy-ui.arrstack.svc.cluster.local:8080/,http://arrproxy-api.arrstack.svc.cluster.local:8080/api/,http://arrproxy-api.arrstack.svc.cluster.local:8080/sonarr/,http://arrproxy-api.arrstack.svc.cluster.local:8080/radarr/,http://arrproxy-api.arrstack.svc.cluster.local:8080/prowlarr/"
-  OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
-  # Populate session.Groups from the Authentik ak_groups claim; pass-user-headers
-  # then emits it as a single comma-joined X-Forwarded-Groups header.
-  OAUTH2_PROXY_OIDC_GROUPS_CLAIM: "ak_groups"
-  # Forward identity + groups to arrproxy-api as X-Forwarded-{User,Email,Groups}
-  # (the api reads these; ARRPROXY_GROUPS_HEADER=X-Forwarded-Groups). NOTE:
-  # set-xauthrequest is intentionally NOT set -- it only populates auth_request
-  # *response* headers, which never reach an --upstreams-proxied backend.
-  OAUTH2_PROXY_PASS_USER_HEADERS: "true"
-  # Bypass auth ONLY for the *arr proxy API (/<app>/api...): this matches
-  # /sonarr/api but NOT /api/tokens or /api/me (which stay authenticated).
-  OAUTH2_PROXY_SKIP_AUTH_REGEX: "^/[^/]+/api"
-  OAUTH2_PROXY_EMAIL_DOMAINS: "*"
-  OAUTH2_PROXY_COOKIE_SECURE: "true"
-  OAUTH2_PROXY_COOKIE_DOMAINS: "arrstack.unkin.net"
-  OAUTH2_PROXY_WHITELIST_DOMAINS: "arrstack.unkin.net"
-  OAUTH2_PROXY_REVERSE_PROXY: "true"
-  OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt"
-  OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256"
-  OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"

apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml

@@ -1,133 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: arrproxy-oauth2
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-    configmap.reloader.stakater.com/auto: "true"
-    secret.reloader.stakater.com/reload: "oauth-credentials,vault-ca-cert"
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: arrproxy-oauth2
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: arrproxy-oauth2
-    spec:
-      serviceAccountName: default
-      automountServiceAccountToken: false
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        fsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      initContainers:
-        # identity.unkin.net serves a Vault-PKI cert; combine the system roots
-        # with the internal CA so oauth2-proxy's OIDC HTTP client trusts it.
-        - name: combine-certs
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3
-          imagePullPolicy: IfNotPresent
-          command:
-            - sh
-            - -c
-            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
-          volumeMounts:
-            - name: vault-ca-cert
-              mountPath: /custom-ca
-              readOnly: true
-            - name: combined-certs
-              mountPath: /combined-certs
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 50m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 64Mi
-      containers:
-        - name: oauth2-proxy
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/oauth2-proxy:v7.15.3
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 4180
-              name: http
-              protocol: TCP
-          envFrom:
-            - configMapRef:
-                name: arrproxy-oauth2-env
-                optional: false
-          env:
-            - name: OAUTH2_PROXY_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: oauth-credentials
-                  key: client_id
-            - name: OAUTH2_PROXY_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: oauth-credentials
-                  key: client_secret
-            - name: OAUTH2_PROXY_COOKIE_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: oauth-credentials
-                  key: cookie_secret
-          volumeMounts:
-            - name: combined-certs
-              mountPath: /etc/ssl/combined
-              readOnly: true
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-      volumes:
-        - name: vault-ca-cert
-          secret:
-            secretName: vault-ca-cert
-            items:
-              - key: ca.crt
-                path: ca.crt
-        - name: combined-certs
-          emptyDir: {}
-      restartPolicy: Always

apps/base/arrstack/arrproxy/services.yaml

@@ -1,59 +0,0 @@
----
-# Front-door entry Service: the HTTPRoute for arrstack.unkin.net targets this.
-# All traffic (UI, token API, and the *arr proxy) enters via oauth2-proxy.
-apiVersion: v1
-kind: Service
-metadata:
-  name: arrproxy
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 80
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: arrproxy-oauth2
-  sessionAffinity: None
-  type: ClusterIP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: arrproxy-api
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 8080
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: arrproxy-api
-  sessionAffinity: None
-  type: ClusterIP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: arrproxy-ui
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 8080
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: arrproxy-ui
-  sessionAffinity: None
-  type: ClusterIP

apps/base/arrstack/arrproxy/ui-deployment.yaml

@@ -1,72 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: arrproxy-ui
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: arrproxy-ui
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: arrproxy-ui
-    spec:
-      serviceAccountName: default
-      automountServiceAccountToken: false
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        fsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: ui
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-ui:v0.1.0
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 8080
-              name: http
-              protocol: TCP
-          env:
-            - name: ARRPROXY_UI_ADDR
-              value: ":8080"
-          livenessProbe:
-            httpGet:
-              path: /livez
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 50m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 128Mi
-      restartPolicy: Always

apps/base/arrstack/arrproxy/vaultstaticsecret.yaml

@@ -1,49 +0,0 @@
----
-# Per-deployment token-hash pepper. Seeded (openssl rand) at
-# kv/kubernetes/namespace/arrstack/default/arrproxy-pepper (key: pepper); the
-# default k8s role's templated policy already grants read on
-# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
-# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
-# syncs it into the arrproxy-pepper Secret consumed by arrproxy-api as
-# ARRPROXY_PEPPER.
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: arrproxy-pepper
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  destination:
-    create: true
-    name: arrproxy-pepper
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/arrproxy-pepper
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-# Authentik OIDC client for the arrstack front door (client_id, client_secret,
-# cookie_secret), created by terraform-authentik at
-# kv/kubernetes/namespace/arrstack/default/oauth-credentials. VSO syncs it into
-# the oauth-credentials Secret consumed by the oauth2-proxy Deployment.
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: oauth-credentials
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  destination:
-    create: true
-    name: oauth-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/oauth-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/arrstack/kustomization.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - vaultauth.yaml
-  - pv-media-tv.yaml
-  - pv-media-movies.yaml
-  - pvc-media-tv.yaml
-  - pvc-media-movies.yaml
-  - sonarr
-  - radarr
-  - prowlarr
-  - nzbget
-  - arrproxy

apps/base/arrstack/nzbget/deployment.yaml

@@ -1,137 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: nzbget
-  namespace: arrstack
-spec:
-  replicas: 1
-  strategy:
-    # RWO config PVC + single queue state: never run two pods at once.
-    type: Recreate
-  selector:
-    matchLabels:
-      app: nzbget
-  template:
-    metadata:
-      labels:
-        app: nzbget
-    spec:
-      securityContext:
-        fsGroup: 1000
-        fsGroupChangePolicy: OnRootMismatch
-      initContainers:
-        # Seed download layout onto the shared media PVCs (not /config or an
-        # emptyDir) so completed downloads land beside the arr libraries and
-        # imports are same-filesystem hardlink moves. Reuses the image's own
-        # template (inherits correct WebDir/ConfigTemplate) and appends the
-        # path/category overrides once; nzbget honours the last value for a
-        # repeated option, and the grep guard keeps re-runs idempotent so admin
-        # UI edits to the persisted /config/nzbget.conf survive restarts.
-        - name: seed-config
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/nzbget:version-v26.2
-          command:
-            - sh
-            - -c
-            - |
-              set -e
-              if [ ! -f /config/nzbget.conf ]; then
-                cp /app/nzbget/share/nzbget/nzbget.conf /config/nzbget.conf
-              fi
-              if ! grep -q '# arrstack-managed' /config/nzbget.conf; then
-                cat >> /config/nzbget.conf << 'CONF'
-
-              # arrstack-managed download layout (appended once; last value wins).
-              # Downloads land on the shared media PVCs by category so sonarr/radarr
-              # import with atomic hardlink moves (download dir + library share one
-              # filesystem per media type). InterDir is empty: nzbget writes each
-              # download straight into its category DestDir, so BOTH tv and movies
-              # stay on their own PVC with no cross-filesystem intermediate copy.
-              MainDir=/media/tv
-              InterDir=
-              DestDir=/media/tv/downloads
-              NzbDir=/config/nzb
-              QueueDir=/config/queue
-              TempDir=/config/tmp
-              ControlIP=0.0.0.0
-              ControlPort=6789
-              Category1.Name=tv
-              Category1.DestDir=/media/tv/downloads
-              Category2.Name=movies
-              Category2.DestDir=/media/movies/downloads
-              CONF
-              fi
-              mkdir -p /media/tv/series /media/tv/downloads /media/movies/films /media/movies/downloads
-              chown 1000:1000 /config/nzbget.conf \
-                /media/tv /media/tv/series /media/tv/downloads \
-                /media/movies /media/movies/films /media/movies/downloads
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 128Mi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: media-tv
-              mountPath: /media/tv
-            - name: media-movies
-              mountPath: /media/movies
-      containers:
-        - name: nzbget
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/nzbget:version-v26.2
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 6789
-              protocol: TCP
-          env:
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: TZ
-              value: Australia/Sydney
-          livenessProbe:
-            # nzbget's root path requires auth (401); a TCP check is the
-            # dependency-free liveness signal for the web/JSON-RPC server.
-            tcpSocket:
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            tcpSocket:
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 200m
-              memory: 256Mi
-            limits:
-              # Headroom for par2 repair + unpack of large downloads.
-              cpu: "2"
-              memory: 2Gi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: media-tv
-              mountPath: /media/tv
-            - name: media-movies
-              mountPath: /media/movies
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: nzbget-config
-        - name: media-tv
-          persistentVolumeClaim:
-            claimName: media-tv
-        - name: media-movies
-          persistentVolumeClaim:
-            claimName: media-movies

apps/base/arrstack/nzbget/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: nzbget.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: nzbget.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: nzbget
-  namespace: arrstack
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: nzbget.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: nzbget.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: nzbget-tls
-        mode: Terminate

apps/base/arrstack/nzbget/httproute.yaml

@@ -1,49 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: nzbget-http-redirect
-  namespace: arrstack
-spec:
-  hostnames:
-    - nzbget.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: nzbget
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: nzbget-route
-  namespace: arrstack
-spec:
-  hostnames:
-    - nzbget.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: nzbget
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: nzbget
-          port: 6789
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/arrstack/nzbget/kustomization.yaml

@@ -1,10 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - pvc-config.yaml
-  - deployment.yaml
-  - service.yaml
-  - gateway.yaml
-  - httproute.yaml

apps/base/arrstack/nzbget/pvc-config.yaml

@@ -1,16 +0,0 @@
----
-# NZBGet config + queue/temp state. RWO on cephrbd (block). Retain: this is
-# state. The download data itself lives on the shared media PVCs, not here.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: nzbget-config
-  namespace: arrstack
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephrbd-fast-retain
-  volumeMode: Filesystem

apps/base/arrstack/nzbget/service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: nzbget
-  namespace: arrstack
-spec:
-  ports:
-    - name: http
-      port: 6789
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: nzbget
-  type: ClusterIP

apps/base/arrstack/prowlarr/deployment.yaml

@@ -1,115 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: prowlarr
-  namespace: arrstack
-spec:
-  replicas: 1
-  strategy:
-    # RWO config PVC + single stateful SQLite DB: never run two pods at once.
-    type: Recreate
-  selector:
-    matchLabels:
-      app: prowlarr
-  template:
-    metadata:
-      labels:
-        app: prowlarr
-    spec:
-      securityContext:
-        fsGroup: 1000
-        fsGroupChangePolicy: OnRootMismatch
-      initContainers:
-        # Enforce the Vault-sourced API key in /config/config.xml before the app
-        # starts. Vault is source of truth (override bootstrap): the key is minted
-        # in Vault, synced by VSO into the prowlarr-apikey Secret, and written here.
-        # Runs as root to fix ownership; touches only the <ApiKey> element.
-        - name: apikey-init
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/busybox:1.37.0
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            runAsUser: 0
-          env:
-            - name: API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: prowlarr-apikey
-                  key: apitoken
-          command:
-            - sh
-            - -c
-            - |
-              set -eu
-              case "$API_KEY" in
-                "" | *[!0-9a-fA-F]*)
-                  echo "apikey-init: API_KEY missing or not hex; refusing" >&2
-                  exit 1
-                  ;;
-              esac
-              CFG=/config/config.xml
-              if [ ! -f "$CFG" ]; then
-                printf '<Config>\n  <ApiKey>%s</ApiKey>\n</Config>\n' "$API_KEY" > "$CFG"
-              elif grep -q '<ApiKey>' "$CFG"; then
-                sed -i "s|<ApiKey>[^<]*</ApiKey>|<ApiKey>${API_KEY}</ApiKey>|" "$CFG"
-              else
-                sed -i "s|<Config>|<Config>\n  <ApiKey>${API_KEY}</ApiKey>|" "$CFG"
-              fi
-              chown 1000:1000 "$CFG"
-              chmod 600 "$CFG"
-              echo "apikey-init: <ApiKey> enforced from Vault"
-          resources:
-            requests:
-              cpu: 50m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 64Mi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-      containers:
-        - name: prowlarr
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/prowlarr:2.5.2
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 9696
-              protocol: TCP
-          env:
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: TZ
-              value: Australia/Sydney
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: "1"
-              memory: 512Mi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: prowlarr-config

apps/base/arrstack/prowlarr/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: prowlarr.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: prowlarr.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: prowlarr
-  namespace: arrstack
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: prowlarr.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: prowlarr.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: prowlarr-tls
-        mode: Terminate

apps/base/arrstack/prowlarr/httproute.yaml

@@ -1,49 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: prowlarr-http-redirect
-  namespace: arrstack
-spec:
-  hostnames:
-    - prowlarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: prowlarr
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: prowlarr-route
-  namespace: arrstack
-spec:
-  hostnames:
-    - prowlarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: prowlarr
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: prowlarr
-          port: 9696
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/arrstack/prowlarr/kustomization.yaml

@@ -1,11 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - pvc-config.yaml
-  - vaultstaticsecret.yaml
-  - deployment.yaml
-  - service.yaml
-  - gateway.yaml
-  - httproute.yaml

apps/base/arrstack/prowlarr/pvc-config.yaml

@@ -1,16 +0,0 @@
----
-# Prowlarr config + SQLite DB. RWO on cephrbd (block) — the arr apps' SQLite
-# does not tolerate CephFS locking. Retain: this is state.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: prowlarr-config
-  namespace: arrstack
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephrbd-fast-retain
-  volumeMode: Filesystem

apps/base/arrstack/prowlarr/service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: prowlarr
-  namespace: arrstack
-spec:
-  ports:
-    - name: http
-      port: 9696
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: prowlarr
-  type: ClusterIP

apps/base/arrstack/prowlarr/vaultstaticsecret.yaml

@@ -1,25 +0,0 @@
----
-# prowlarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/prowlarr
-# (key: apitoken); the default k8s role's templated policy already grants read
-# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
-# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
-# syncs it into the prowlarr-apikey Secret that the apikey-init initContainer reads
-# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: prowlarr-apikey
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  destination:
-    create: true
-    name: prowlarr-apikey
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/prowlarr
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/arrstack/pv-media-movies.yaml

@@ -1,31 +0,0 @@
----
-# Static PV for the shared MOVIES CephFS subvolume. Same rootPath as jellyfin's
-# movies PV so radarr/nzbget write and jellyfin reads the identical library
-# tree; each namespace gets its own PV (unique name + volumeHandle) pinned by
-# claimRef.
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: arrstack-media-movies
-spec:
-  capacity:
-    storage: 1Ti
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: ""
-  volumeMode: Filesystem
-  claimRef:
-    namespace: arrstack
-    name: media-movies
-  csi:
-    driver: cephfs.csi.ceph.com
-    volumeHandle: arrstack-media-movies-static
-    nodeStageSecretRef:
-      name: csi-cephfs-secret
-      namespace: csi-cephfs
-    volumeAttributes:
-      staticVolume: "true"
-      clusterID: cephfs_csi_ssd_ec_4_1
-      fsName: cephfs
-      rootPath: /volumes/csi_ssd_ec_4_1/media-movies/e95d8ace-c736-465a-acc3-0c3e46dcede9

apps/base/arrstack/pv-media-tv.yaml

@@ -1,30 +0,0 @@
----
-# Static PV for the shared TV CephFS subvolume. Same rootPath as jellyfin's TV
-# PV so sonarr/nzbget write and jellyfin reads the identical library tree; each
-# namespace gets its own PV (unique name + volumeHandle) pinned by claimRef.
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: arrstack-media-tv
-spec:
-  capacity:
-    storage: 1Ti
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: ""
-  volumeMode: Filesystem
-  claimRef:
-    namespace: arrstack
-    name: media-tv
-  csi:
-    driver: cephfs.csi.ceph.com
-    volumeHandle: arrstack-media-tv-static
-    nodeStageSecretRef:
-      name: csi-cephfs-secret
-      namespace: csi-cephfs
-    volumeAttributes:
-      staticVolume: "true"
-      clusterID: cephfs_csi_ssd_ec_4_1
-      fsName: cephfs
-      rootPath: /volumes/csi_ssd_ec_4_1/media-tv/4692957d-f5df-4f72-b9c9-56e4ee6d1333

apps/base/arrstack/pvc-media-movies.yaml

@@ -1,22 +0,0 @@
----
-# Movies library + downloads, shared RWX across radarr and nzbget. Statically
-# bound to the arrstack-media-movies PV (same CephFS subvolume jellyfin mounts
-# read-only). storageClassName "" + volumeName disables dynamic provisioning and
-# binds the pre-created static PV. Downloads and library live on one filesystem
-# so import is an atomic hardlink move.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: media-movies
-  namespace: arrstack
-  annotations:
-    k8up.io/backup: "false"
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Ti
-  storageClassName: ""
-  volumeName: arrstack-media-movies
-  volumeMode: Filesystem

apps/base/arrstack/pvc-media-tv.yaml

@@ -1,22 +0,0 @@
----
-# TV library + downloads, shared RWX across sonarr and nzbget. Statically bound
-# to the arrstack-media-tv PV (same CephFS subvolume jellyfin mounts read-only).
-# storageClassName "" + volumeName disables dynamic provisioning and binds the
-# pre-created static PV. Downloads and library live on one filesystem so import
-# is an atomic hardlink move.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: media-tv
-  namespace: arrstack
-  annotations:
-    k8up.io/backup: "false"
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Ti
-  storageClassName: ""
-  volumeName: arrstack-media-tv
-  volumeMode: Filesystem

apps/base/arrstack/radarr/deployment.yaml

@@ -1,120 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: radarr
-  namespace: arrstack
-spec:
-  replicas: 1
-  strategy:
-    # RWO config PVC + single stateful SQLite DB: never run two pods at once.
-    type: Recreate
-  selector:
-    matchLabels:
-      app: radarr
-  template:
-    metadata:
-      labels:
-        app: radarr
-    spec:
-      securityContext:
-        fsGroup: 1000
-        fsGroupChangePolicy: OnRootMismatch
-      initContainers:
-        # Enforce the Vault-sourced API key in /config/config.xml before the app
-        # starts. Vault is source of truth (override bootstrap): the key is minted
-        # in Vault, synced by VSO into the radarr-apikey Secret, and written here.
-        # Runs as root to fix ownership; touches only the <ApiKey> element.
-        - name: apikey-init
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/busybox:1.37.0
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            runAsUser: 0
-          env:
-            - name: API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: radarr-apikey
-                  key: apitoken
-          command:
-            - sh
-            - -c
-            - |
-              set -eu
-              case "$API_KEY" in
-                "" | *[!0-9a-fA-F]*)
-                  echo "apikey-init: API_KEY missing or not hex; refusing" >&2
-                  exit 1
-                  ;;
-              esac
-              CFG=/config/config.xml
-              if [ ! -f "$CFG" ]; then
-                printf '<Config>\n  <ApiKey>%s</ApiKey>\n</Config>\n' "$API_KEY" > "$CFG"
-              elif grep -q '<ApiKey>' "$CFG"; then
-                sed -i "s|<ApiKey>[^<]*</ApiKey>|<ApiKey>${API_KEY}</ApiKey>|" "$CFG"
-              else
-                sed -i "s|<Config>|<Config>\n  <ApiKey>${API_KEY}</ApiKey>|" "$CFG"
-              fi
-              chown 1000:1000 "$CFG"
-              chmod 600 "$CFG"
-              echo "apikey-init: <ApiKey> enforced from Vault"
-          resources:
-            requests:
-              cpu: 50m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 64Mi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-      containers:
-        - name: radarr
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/radarr:6.3.0
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 7878
-              protocol: TCP
-          env:
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: TZ
-              value: Australia/Sydney
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: "1"
-              memory: 1Gi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: media-movies
-              mountPath: /media/movies
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: radarr-config
-        - name: media-movies
-          persistentVolumeClaim:
-            claimName: media-movies

apps/base/arrstack/radarr/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: radarr.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: radarr.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: radarr
-  namespace: arrstack
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: radarr.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: radarr.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: radarr-tls
-        mode: Terminate

apps/base/arrstack/radarr/httproute.yaml

@@ -1,49 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: radarr-http-redirect
-  namespace: arrstack
-spec:
-  hostnames:
-    - radarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: radarr
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: radarr-route
-  namespace: arrstack
-spec:
-  hostnames:
-    - radarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: radarr
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: radarr
-          port: 7878
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/arrstack/radarr/kustomization.yaml

@@ -1,11 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - pvc-config.yaml
-  - vaultstaticsecret.yaml
-  - deployment.yaml
-  - service.yaml
-  - gateway.yaml
-  - httproute.yaml

apps/base/arrstack/radarr/pvc-config.yaml

@@ -1,16 +0,0 @@
----
-# Radarr config + SQLite DB. RWO on cephrbd (block) — the arr apps' SQLite
-# does not tolerate CephFS locking. Retain: this is state.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: radarr-config
-  namespace: arrstack
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephrbd-fast-retain
-  volumeMode: Filesystem

apps/base/arrstack/radarr/service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: radarr
-  namespace: arrstack
-spec:
-  ports:
-    - name: http
-      port: 7878
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: radarr
-  type: ClusterIP

apps/base/arrstack/radarr/vaultstaticsecret.yaml

@@ -1,25 +0,0 @@
----
-# radarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/radarr
-# (key: apitoken); the default k8s role's templated policy already grants read
-# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
-# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
-# syncs it into the radarr-apikey Secret that the apikey-init initContainer reads
-# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: radarr-apikey
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  destination:
-    create: true
-    name: radarr-apikey
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/radarr
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/arrstack/sonarr/deployment.yaml

@@ -1,123 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: sonarr
-  namespace: arrstack
-spec:
-  replicas: 1
-  strategy:
-    # RWO config PVC + single stateful SQLite DB: never run two pods at once.
-    type: Recreate
-  selector:
-    matchLabels:
-      app: sonarr
-  template:
-    metadata:
-      labels:
-        app: sonarr
-    spec:
-      securityContext:
-        # LinuxServer images init as root via s6 then step down to PUID/PGID.
-        # fsGroup makes the shared CephFS group-writable for that user;
-        # OnRootMismatch avoids a recursive chown of the whole media tree.
-        fsGroup: 1000
-        fsGroupChangePolicy: OnRootMismatch
-      initContainers:
-        # Enforce the Vault-sourced API key in /config/config.xml before the app
-        # starts. Vault is source of truth (override bootstrap): the key is minted
-        # in Vault, synced by VSO into the sonarr-apikey Secret, and written here.
-        # Runs as root to fix ownership; touches only the <ApiKey> element.
-        - name: apikey-init
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/busybox:1.37.0
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            runAsUser: 0
-          env:
-            - name: API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: sonarr-apikey
-                  key: apitoken
-          command:
-            - sh
-            - -c
-            - |
-              set -eu
-              case "$API_KEY" in
-                "" | *[!0-9a-fA-F]*)
-                  echo "apikey-init: API_KEY missing or not hex; refusing" >&2
-                  exit 1
-                  ;;
-              esac
-              CFG=/config/config.xml
-              if [ ! -f "$CFG" ]; then
-                printf '<Config>\n  <ApiKey>%s</ApiKey>\n</Config>\n' "$API_KEY" > "$CFG"
-              elif grep -q '<ApiKey>' "$CFG"; then
-                sed -i "s|<ApiKey>[^<]*</ApiKey>|<ApiKey>${API_KEY}</ApiKey>|" "$CFG"
-              else
-                sed -i "s|<Config>|<Config>\n  <ApiKey>${API_KEY}</ApiKey>|" "$CFG"
-              fi
-              chown 1000:1000 "$CFG"
-              chmod 600 "$CFG"
-              echo "apikey-init: <ApiKey> enforced from Vault"
-          resources:
-            requests:
-              cpu: 50m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 64Mi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-      containers:
-        - name: sonarr
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/sonarr:4.0.19
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 8989
-              protocol: TCP
-          env:
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: TZ
-              value: Australia/Sydney
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: "1"
-              memory: 1Gi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: media-tv
-              mountPath: /media/tv
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: sonarr-config
-        - name: media-tv
-          persistentVolumeClaim:
-            claimName: media-tv

apps/base/arrstack/sonarr/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: sonarr.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: sonarr.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: sonarr
-  namespace: arrstack
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: sonarr.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: sonarr.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: sonarr-tls
-        mode: Terminate

apps/base/arrstack/sonarr/httproute.yaml

@@ -1,49 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: sonarr-http-redirect
-  namespace: arrstack
-spec:
-  hostnames:
-    - sonarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: sonarr
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: sonarr-route
-  namespace: arrstack
-spec:
-  hostnames:
-    - sonarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: sonarr
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: sonarr
-          port: 8989
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/arrstack/sonarr/kustomization.yaml

@@ -1,11 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - pvc-config.yaml
-  - vaultstaticsecret.yaml
-  - deployment.yaml
-  - service.yaml
-  - gateway.yaml
-  - httproute.yaml

apps/base/arrstack/sonarr/pvc-config.yaml

@@ -1,16 +0,0 @@
----
-# Sonarr config + SQLite DB. RWO on cephrbd (block) — the arr apps' SQLite
-# does not tolerate CephFS locking. Retain: this is state.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: sonarr-config
-  namespace: arrstack
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephrbd-fast-retain
-  volumeMode: Filesystem

apps/base/arrstack/sonarr/service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: sonarr
-  namespace: arrstack
-spec:
-  ports:
-    - name: http
-      port: 8989
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: sonarr
-  type: ClusterIP

apps/base/arrstack/sonarr/vaultstaticsecret.yaml

@@ -1,25 +0,0 @@
----
-# sonarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/sonarr
-# (key: apitoken); the default k8s role's templated policy already grants read
-# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
-# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
-# syncs it into the sonarr-apikey Secret that the apikey-init initContainer reads
-# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: sonarr-apikey
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  destination:
-    create: true
-    name: sonarr-apikey
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/sonarr
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/arrstack/vaultauth.yaml

@@ -1,20 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  allowedNamespaces:
-    - arrstack
-  kubernetes:
-    audiences:
-      - vault
-    role: default
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default

apps/base/artifactapi/api-deployment.yaml

@@ -5,8 +5,7 @@ metadata:
   name: api
   namespace: artifactapi
   annotations:
-    configmap.reloader.stakater.com/auto: "true"
-    secret.reloader.stakater.com/reload: "vault-ca-cert"
+    reloader.stakater.com/auto: "true"
 spec:
   selector:
     matchLabels:
@@ -36,7 +35,7 @@ spec:
               mountPath: /combined-certs
       containers:
         - name: api
-          image: git.unkin.net/unkin/artifactapi:v3.11.1
+          image: git.unkin.net/unkin/artifactapi:v3.7.3
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000

apps/base/artifactapi/cnpg_backup.yaml

@@ -1,56 +0,0 @@
----
-# Ceph RGW (S3) backup target for the artifactapi CNPG cluster, provisioned by the
-# in-estate cephrgw-operator. One dedicated bucket + owner user per cluster:
-# cephrgw CRs are namespace-scoped and CNPG reads its S3 credential Secret from
-# its own namespace, so backups are per-database rather than one shared bucket.
-apiVersion: ceph.unkin.net/v1alpha1
-kind: ObjectStoreUser
-metadata:
-  name: cnpg-artifactapi-backup
-  namespace: artifactapi
-spec:
-  displayName: "CNPG backup owner (artifactapi)"
-  # RGW users are global; keep the uid namespace-qualified so it never collides.
-  uid: cnpg-artifactapi-backup
-  maxBuckets: 5
-  # Operator writes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (+ RGW_UID,
-  # S3_ENDPOINT) into this Secret; the Cluster's barmanObjectStore consumes it.
-  secretName: cnpg-artifactapi-backup-s3
-  # Keep the RGW user (and thus the keys) if this CR is ever deleted, so an
-  # in-flight restore can still reach the archive.
-  retainOnDelete: true
----
-apiVersion: ceph.unkin.net/v1alpha1
-kind: Bucket
-metadata:
-  name: cnpg-artifactapi
-  namespace: artifactapi
-spec:
-  placementTarget: ec
-  bucketName: cnpg-artifactapi
-  # The owner user has full control of its own bucket (read + write), which is
-  # all the backup/restore identity needs — no extra BucketAccess grant.
-  ownerRef: cnpg-artifactapi-backup
-  versioning: false
-  tags:
-    app: artifactapi
-    purpose: cnpg-backup
-  # Never drop the backups if the CR is removed; retire buckets by hand.
-  retainOnDelete: true
----
-# Nightly base backup. Continuous WAL archiving is always-on via the Cluster's
-# spec.backup.barmanObjectStore; this schedules the periodic full backup that
-# WAL is layered on top of. Schedules are staggered across clusters so the 8
-# base backups do not hit RGW at once (CNPG cron is 6-field, seconds first).
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: cnpg-artifactapi-nightly
-  namespace: artifactapi
-spec:
-  schedule: "0 40 1 * * *"
-  immediate: false
-  backupOwnerReference: self
-  method: barmanObjectStore
-  cluster:
-    name: postgres

apps/base/artifactapi/cnpg_cluster.yaml

@@ -7,35 +7,6 @@ metadata:
 spec:
   affinity:
     podAntiAffinityType: preferred
-  backup:
-    # 30-day retention (DEFAULT — adjust per cluster if needed). Enforced by CNPG
-    # against the object store on each successful base backup.
-    retentionPolicy: 30d
-    barmanObjectStore:
-      # Dedicated per-cluster Ceph RGW bucket (cephrgw-operator provisions it).
-      destinationPath: s3://cnpg-artifactapi
-      endpointURL: https://s3.ceph.unkin.net
-      # radosgw serves a Vault-PKI cert; trust the internal CA (reflected into
-      # every namespace as the vault-ca-cert Secret).
-      endpointCA:
-        name: vault-ca-cert
-        key: ca.crt
-      # Keys minted by the ObjectStoreUser in cnpg_backup.yaml; never hardcoded.
-      s3Credentials:
-        accessKeyId:
-          name: cnpg-artifactapi-backup-s3
-          key: AWS_ACCESS_KEY_ID
-        secretAccessKey:
-          name: cnpg-artifactapi-backup-s3
-          key: AWS_SECRET_ACCESS_KEY
-      # Path prefix within the bucket; keep stable across restores (see docs).
-      serverName: artifactapi
-      data:
-        compression: bzip2
-        jobs: 2
-      wal:
-        compression: zstd
-        maxParallel: 2
   bootstrap:
     initdb:
       database: artifacts
@@ -108,7 +79,7 @@ spec:
       cpu: 500m
       memory: 512Mi
     requests:
-      cpu: 50m
+      cpu: 250m
       memory: 256Mi
   smartShutdownTimeout: 180
   startDelay: 3600

apps/base/artifactapi/httproute.yaml

@@ -1,6 +1,30 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
+metadata:
+  name: http-redirect
+  namespace: artifactapi
+spec:
+  hostnames:
+    - artifactapi.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: artifactapi
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
 metadata:
   name: api-route
   namespace: artifactapi
@@ -8,12 +32,6 @@ spec:
   hostnames:
     - artifactapi.k8s.syd1.au.unkin.net
   parentRefs:
-    # Early-boot clients (anaconda/kickstart, yum in %post, PXE) need plain HTTP
-    # for the rpm repos; serve the app directly on port 80 instead of redirecting.
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: artifactapi
-      sectionName: http
     - group: gateway.networking.k8s.io
       kind: Gateway
       name: artifactapi

apps/base/artifactapi/kustomization.yaml

@@ -7,7 +7,6 @@ resources:
   - api-hpa.yaml
   - configmap.yaml
   - cnpg_cluster.yaml
-  - cnpg_backup.yaml
   - cnpg_pooler.yaml
   - gateway.yaml
   - httproute.yaml
@@ -18,4 +17,3 @@ resources:
   - ui-hpa.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
-  - vpa.yaml

apps/base/artifactapi/ui-deployment.yaml

@@ -5,7 +5,7 @@ metadata:
   name: ui
   namespace: artifactapi
   annotations:
-    configmap.reloader.stakater.com/auto: "true"
+    reloader.stakater.com/auto: "true"
 spec:
   selector:
     matchLabels:
@@ -22,7 +22,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: ui
-          image: git.unkin.net/unkin/artifactapi-ui:v3.11.1
+          image: git.unkin.net/unkin/artifactapi-ui:v3.7.3
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80

apps/base/artifactapi/vpa.yaml

@@ -1,45 +0,0 @@
----
-apiVersion: autoscaling.k8s.io/v1
-kind: VerticalPodAutoscaler
-metadata:
-  name: api-vpa
-  namespace: artifactapi
-  # NOTE: this workload also has an HPA. updateMode Off is recommendation-only
-  # and does not act, so there is no HPA/VPA conflict today. Do not flip to Auto/
-  # Initial without first moving the HPA off CPU/memory (VPA owns those under Auto).
-spec:
-  targetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: api
-  updatePolicy:
-    updateMode: "Off"
----
-apiVersion: autoscaling.k8s.io/v1
-kind: VerticalPodAutoscaler
-metadata:
-  name: redis-vpa
-  namespace: artifactapi
-spec:
-  targetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: redis
-  updatePolicy:
-    updateMode: "Off"
----
-apiVersion: autoscaling.k8s.io/v1
-kind: VerticalPodAutoscaler
-metadata:
-  name: ui-vpa
-  namespace: artifactapi
-  # NOTE: this workload also has an HPA. updateMode Off is recommendation-only
-  # and does not act, so there is no HPA/VPA conflict today. Do not flip to Auto/
-  # Initial without first moving the HPA off CPU/memory (VPA owns those under Auto).
-spec:
-  targetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: ui
-  updatePolicy:
-    updateMode: "Off"

apps/base/authentik/cnpg_backup.yaml

@@ -1,56 +0,0 @@
----
-# Ceph RGW (S3) backup target for the authentik CNPG cluster, provisioned by the
-# in-estate cephrgw-operator. One dedicated bucket + owner user per cluster:
-# cephrgw CRs are namespace-scoped and CNPG reads its S3 credential Secret from
-# its own namespace, so backups are per-database rather than one shared bucket.
-apiVersion: ceph.unkin.net/v1alpha1
-kind: ObjectStoreUser
-metadata:
-  name: cnpg-authentik-backup
-  namespace: authentik
-spec:
-  displayName: "CNPG backup owner (authentik)"
-  # RGW users are global; keep the uid namespace-qualified so it never collides.
-  uid: cnpg-authentik-backup
-  maxBuckets: 5
-  # Operator writes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (+ RGW_UID,
-  # S3_ENDPOINT) into this Secret; the Cluster's barmanObjectStore consumes it.
-  secretName: cnpg-authentik-backup-s3
-  # Keep the RGW user (and thus the keys) if this CR is ever deleted, so an
-  # in-flight restore can still reach the archive.
-  retainOnDelete: true
----
-apiVersion: ceph.unkin.net/v1alpha1
-kind: Bucket
-metadata:
-  name: cnpg-authentik
-  namespace: authentik
-spec:
-  placementTarget: ec
-  bucketName: cnpg-authentik
-  # The owner user has full control of its own bucket (read + write), which is
-  # all the backup/restore identity needs — no extra BucketAccess grant.
-  ownerRef: cnpg-authentik-backup
-  versioning: false
-  tags:
-    app: authentik
-    purpose: cnpg-backup
-  # Never drop the backups if the CR is removed; retire buckets by hand.
-  retainOnDelete: true
----
-# Nightly base backup. Continuous WAL archiving is always-on via the Cluster's
-# spec.backup.barmanObjectStore; this schedules the periodic full backup that
-# WAL is layered on top of. Schedules are staggered across clusters so the 8
-# base backups do not hit RGW at once (CNPG cron is 6-field, seconds first).
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: cnpg-authentik-nightly
-  namespace: authentik
-spec:
-  schedule: "0 0 1 * * *"
-  immediate: false
-  backupOwnerReference: self
-  method: barmanObjectStore
-  cluster:
-    name: postgres

apps/base/authentik/cnpg_cluster.yaml

@@ -7,35 +7,6 @@ metadata:
 spec:
   affinity:
     podAntiAffinityType: preferred
-  backup:
-    # 30-day retention (DEFAULT — adjust per cluster if needed). Enforced by CNPG
-    # against the object store on each successful base backup.
-    retentionPolicy: 30d
-    barmanObjectStore:
-      # Dedicated per-cluster Ceph RGW bucket (cephrgw-operator provisions it).
-      destinationPath: s3://cnpg-authentik
-      endpointURL: https://s3.ceph.unkin.net
-      # radosgw serves a Vault-PKI cert; trust the internal CA (reflected into
-      # every namespace as the vault-ca-cert Secret).
-      endpointCA:
-        name: vault-ca-cert
-        key: ca.crt
-      # Keys minted by the ObjectStoreUser in cnpg_backup.yaml; never hardcoded.
-      s3Credentials:
-        accessKeyId:
-          name: cnpg-authentik-backup-s3
-          key: AWS_ACCESS_KEY_ID
-        secretAccessKey:
-          name: cnpg-authentik-backup-s3
-          key: AWS_SECRET_ACCESS_KEY
-      # Path prefix within the bucket; keep stable across restores (see docs).
-      serverName: authentik
-      data:
-        compression: bzip2
-        jobs: 2
-      wal:
-        compression: zstd
-        maxParallel: 2
   bootstrap:
     initdb:
       database: authentik
@@ -106,12 +77,10 @@ spec:
   resources:
     limits:
       cpu: 500m
-      # 512Mi OOMKilled replicas under load (shared_buffers 128MB +
-      # max_connections 200 leave no headroom) — see incident 2026-07-28.
-      memory: 1Gi
-    requests:
-      cpu: 50m
       memory: 512Mi
+    requests:
+      cpu: 250m
+      memory: 256Mi
   smartShutdownTimeout: 180
   startDelay: 3600
   stopDelay: 1800

apps/base/authentik/kustomization.yaml

@@ -4,7 +4,6 @@ kind: Kustomization
 
 resources:
   - cnpg_cluster.yaml
-  - cnpg_backup.yaml
   - cnpg_pooler.yaml
   - gateway.yaml
   - httproute.yaml
@@ -18,4 +17,3 @@ resources:
   - redis-service.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
-  - vpa.yaml

apps/base/authentik/vpa.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: autoscaling.k8s.io/v1
-kind: VerticalPodAutoscaler
-metadata:
-  name: redis-vpa
-  namespace: authentik
-spec:
-  targetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: redis
-  updatePolicy:
-    updateMode: "Off"

apps/base/bind-external/agent-dns-rolebinding.yaml

@@ -1,16 +0,0 @@
----
-# Confines the agent-dns service account (in bind-system) to the agent-dns
-# ClusterRole within this namespace.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: agent-dns
-  namespace: bind-external
-subjects:
-  - kind: ServiceAccount
-    name: agent-dns
-    namespace: bind-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: agent-dns

apps/base/bind-external/cluster.yaml

@@ -1,52 +0,0 @@
----
-# Externally-reachable authoritative BIND for zones we delegate to ourselves.
-# First tenant: acme.unkin.net, the DNS-01 challenge zone Let's Encrypt validates
-# via a one-time _acme-challenge.unkin.net CNAME. Authoritative-only, recursion
-# off, no forwarding, no open transfers -- the primaryService is the single
-# dmz-pinned LoadBalancer that public NAT targets and that cert-manager writes to.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCluster
-metadata:
-  name: bind-external
-  namespace: bind-external
-spec:
-  mode: authoritative
-  recursion: false
-  replicas: 2
-  storageClassName: cephrbd-fast-delete
-  storageSize: 1Gi
-  # Public server: answer queries from anywhere (Let's Encrypt validates over the
-  # internet), deny recursion and open zone transfers. localhost + pod net are
-  # implied by "any" and cover in-pod nsupdate and secondary SOA refresh; per-zone
-  # allow-transfer (catalog + acme zone) still permits key-authenticated AXFR.
-  extraOptions:
-    - "allow-query { any; }"
-    - "allow-transfer { none; }"
-  service:
-    type: ClusterIP
-  primaryService:
-    type: LoadBalancer
-    externalTrafficPolicy: Local
-    annotations:
-      purelb.io/service-group: dmz
-      purelb.io/addresses: 198.18.199.53
-      external-dns.alpha.kubernetes.io/hostname: bind-external-primary.k8s.syd1.au.unkin.net
-  resources:
-    requests:
-      cpu: 20m
-      memory: 128Mi
-    limits:
-      cpu: "1"
-      memory: 512Mi
----
-# Catalog zone so the acme zone replicates onto the secondary (AXFR/IXFR keyed
-# with the certmanager TSIG key, reused here as the transfer key).
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCatalogZone
-metadata:
-  name: bind-external-catalog
-  namespace: bind-external
-spec:
-  clusterRef: bind-external
-  zoneName: catalog.external
-  transferKeyRef: certmanager

apps/base/bind-external/kustomization.yaml

@@ -1,10 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - cluster.yaml
-  - tsigkey.yaml
-  - zones.yaml
-  - agent-dns-rolebinding.yaml

apps/base/bind-external/tsigkey.yaml

@@ -1,20 +0,0 @@
----
-# TSIG key cert-manager uses to send RFC2136 dynamic updates (the DNS-01 TXT
-# records) to the primary, and that the secondary reuses for AXFR. The operator
-# generates the material into Secret certmanager-tsig in this namespace;
-# secretTemplate stamps emberstack reflector hints so the Secret is mirrored into
-# the cert-manager namespace, where the rfc2136 solver reads its "secret" key.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindTSIGKey
-metadata:
-  name: certmanager
-  namespace: bind-external
-spec:
-  clusterRef: bind-external
-  algorithm: hmac-sha256
-  secretTemplate:
-    annotations:
-      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cert-manager"
-      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cert-manager"

apps/base/bind-external/zones.yaml

@@ -1,19 +0,0 @@
----
-# Self-delegated ACME challenge zone. Google Cloud DNS holds a one-time
-# _acme-challenge.unkin.net CNAME -> _acme-challenge.acme.unkin.net and an
-# acme.unkin.net NS delegation pointing here; cert-manager writes the challenge
-# TXT records via RFC2136 authenticated with the certmanager key.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: acme-unkin-net
-  namespace: bind-external
-spec:
-  clusterRef: bind-external
-  zoneName: acme.unkin.net
-  type: primary
-  defaultTTL: 60
-  dynamicUpdate: true
-  updateKeyRef: certmanager
-  allowTransfer:
-    - key certmanager

apps/base/bind-internal/agent-dns-rolebinding.yaml

@@ -1,16 +0,0 @@
----
-# Confines the agent-dns service account (in bind-system) to the agent-dns
-# ClusterRole within this namespace.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: agent-dns
-  namespace: bind-internal
-subjects:
-  - kind: ServiceAccount
-    name: agent-dns
-    namespace: bind-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: agent-dns

apps/base/bind-internal/authoritative/acls.yaml

@@ -1,29 +0,0 @@
----
-# Internal client networks allowed to query the authoritative servers,
-# mirrored from the puppet authoritative /etc/named/acls.conf
-# (acl-main.unkin.net). Named auth-acl-main because the resolver has its own,
-# differently-scoped acl-main.unkin.net in the same namespace.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindACL
-metadata:
-  name: auth-acl-main
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  entries:
-    - 198.18.13.0/24
-    - 198.18.14.0/24
-    - 198.18.15.0/24
-    - 198.18.16.0/24
-    - 198.18.17.0/24
-    - 198.18.19.0/24
-    - 198.18.20.0/24
-    - 198.18.24.0/24
-    - 198.18.25.0/24
-    - 198.18.26.0/24
-    - 198.18.27.0/24
-    - 198.18.28.0/24
-    - 198.18.29.0/24
-    # Admin/management access (individual hosts, not whole subnets)
-    - 10.10.12.200/32   # benvin workstation (wireguard)
-    - 198.18.21.160/32  # benvin router

apps/base/bind-internal/authoritative/cluster.yaml

@@ -1,54 +0,0 @@
----
-# Authoritative masters (replaces the 3x Puppet authoritative servers).
-# pod-0 is the primary; pods 1-2 replicate via the catalog zone + AXFR/IXFR.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCluster
-metadata:
-  name: bind-authoritative
-  namespace: bind-internal
-spec:
-  mode: authoritative
-  replicas: 3
-  storageClassName: cephrbd-fast-delete
-  storageSize: 2Gi
-  # Restrict queries to internal networks (puppet acl-main.unkin.net).
-  # 10.42.0.0/16 (pod net) is required so secondaries can SOA-refresh
-  # from the primary during catalog replication. localhost is required so the
-  # operator's in-pod `nsupdate` (sent to 127.0.0.1) passes query-authorization;
-  # without it every dynamic update is "denied due to allow-query".
-  extraOptions:
-    - "allow-query { localhost; auth-acl-main; 10.42.0.0/16; }"
-    # Enable query logging for the Tier-2 vector bind_query pipeline (see the
-    # resolvers cluster for the routing rationale).
-    - "querylog yes"
-  service:
-    type: LoadBalancer
-    externalTrafficPolicy: Local
-    annotations:
-      purelb.io/service-group: common
-      purelb.io/addresses: 198.18.200.6
-      external-dns.alpha.kubernetes.io/hostname: bind-authoritative.k8s.syd1.au.unkin.net
-  primaryService:
-    type: LoadBalancer
-    annotations:
-      purelb.io/service-group: common
-      purelb.io/addresses: 198.18.200.9
-      external-dns.alpha.kubernetes.io/hostname: bind-authoritative-primary.k8s.syd1.au.unkin.net
-  resources:
-    requests:
-      cpu: 20m
-      memory: 128Mi
-    limits:
-      cpu: "1"
-      memory: 512Mi
----
-# Catalog zone so new BindZones auto-provision onto the secondaries.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCatalogZone
-metadata:
-  name: bind-authoritative-catalog
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: catalog.internal
-  transferKeyRef: transfer-key

apps/base/bind-internal/authoritative/kustomization.yaml

@@ -1,10 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - cluster.yaml
-  - tsigkey.yaml
-  - zones.yaml
-  - records.yaml
-  - acls.yaml

apps/base/bind-internal/authoritative/records.yaml

@@ -1,119 +0,0 @@
-# Individually-managed authoritative records for the unkin.net zone.
-# DNSRecords must live in the same namespace as their BindZone (the operator
-# resolves zoneRef/clusterRef/updateKeyRef within the record's namespace), so
-# these sit alongside the zone in bind-internal, not in the app namespace.
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  # "internal" in the name distinguishes this from the external DNS that
-  # Authentik will manage its own records from later.
-  name: identity-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: identity
-  type: A
-  ttl: 600
-  values:
-    # traefik-internal gateway VIP; the authentik Gateway serves the
-    # identity.unkin.net hostname there.
-    - 198.18.200.4
----
-# PRODUCTION CUTOVER RECORD — intentionally commented out.
-# git.unkin.net currently resolves to the LIVE VM forge (HAProxy VRRP VIP
-# 198.18.19.17), which holds every repo the estate depends on. Uncommenting this
-# repoints the whole org's git.unkin.net at the new k8s Gitea gateway VIP, so it
-# is the FINAL step of the forge migration — gated on the data migration (gitea
-# dump/restore + SECRET_KEY copy) in argocd-apps docs/gitea-migration.md.
-# NOTE: the live git.unkin.net answer is served by the puppet DNS master today
-# (profiles::dns::master, records from PuppetDB); this k8s apex zone holds only
-# SOA+NS + a few DNSRecords so far. Confirm the k8s bind cluster is the live
-# authority for unkin.net (or update the puppet record instead) before relying
-# on this CR at cutover.
-# ---
-# apiVersion: bind.unkin.net/v1alpha1
-# kind: DNSRecord
-# metadata:
-#   name: git-dns-internal
-#   namespace: bind-internal
-# spec:
-#   zoneRef: unkin-net
-#   name: git
-#   type: A
-#   ttl: 600
-#   values:
-#     # traefik-internal gateway VIP; the gitea Gateway serves git.unkin.net there.
-#     - 198.18.200.4
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: s3-ceph-cname
-  namespace: bind-internal
-spec:
-  zoneRef: ceph-unkin-net
-  name: s3
-  type: CNAME
-  ttl: 600
-  values:
-    # radosgw S3 endpoint. Points at the Consul service for now; the real
-    # target will be changed later.
-    - radosgw.service.consul.
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: dashboard-ceph-cname
-  namespace: bind-internal
-spec:
-  zoneRef: ceph-unkin-net
-  name: dashboard
-  type: CNAME
-  ttl: 600
-  values:
-    # Ceph mgr dashboard, reached via lb1. Lets in-cluster clients (the
-    # cephrgw-operator) resolve dashboard.ceph.unkin.net.
-    - lb1.unkin.net.
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: lb1-unkin-net
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: lb1
-  type: A
-  ttl: 600
-  values:
-    - 103.216.191.185
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: ghp-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: ghp
-  type: A
-  ttl: 600
-  values:
-    # traefik-internal gateway VIP; the ghp Gateway serves ghp.unkin.net there.
-    - 198.18.200.4
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: arrstack-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: arrstack
-  type: A
-  ttl: 600
-  values:
-    # traefik-EXTERNAL (DMZ) gateway VIP; the arrproxy Gateway serves the
-    # arrstack.unkin.net front door (oauth2-proxy) there.
-    - 198.18.199.0

apps/base/bind-internal/authoritative/tsigkey.yaml

@@ -1,24 +0,0 @@
----
-# Zone-transfer / catalog key. The operator generates the material into a
-# Secret (transfer-key-tsig); nothing sensitive is committed to git.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindTSIGKey
-metadata:
-  name: transfer-key
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  algorithm: hmac-sha256
----
-# Client-update key: puppet clients (profiles::dns::updater) nsupdate their own
-# records to the authoritative zones with this key. Operator generates the
-# material into Secret client-update-tsig; the same value must reach puppet
-# eyaml (or the planned Vault-sync bridge) for clients to authenticate.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindTSIGKey
-metadata:
-  name: client-update
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  algorithm: hmac-sha256

apps/base/bind-internal/authoritative/zones.yaml

@@ -1,256 +0,0 @@
-# Authoritative zones migrated from puppet-prod
-# (profiles::dns::master::zones in hieradata/roles/infra/dns/master.yaml).
-# type primary, static (puppet dynamic:false); TTL 600 as in the puppet zone header.
-# Record data is populated by PuppetDB exported resources upstream, so it is
-# NOT in this repo — migrate it into these zones (AXFR from the current masters,
-# or DNSRecord CRs) as a follow-up. The zones start with SOA+NS only.
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: unkin.net
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: main-unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: main.unkin.net
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-# ceph.unkin.net: the ceph host (ausyd1nxvm2069/halb) publishes
-# dashboard.ceph.unkin.net via nsupdate; puppet targets a dedicated
-# `zone ceph.unkin.net.`, so it must exist here or the update gets NOTZONE.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: ceph-unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: ceph.unkin.net
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 13-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 13.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 14-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 14.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 15-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 15.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 16-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 16.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 17-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 17.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 19-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 19.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 20-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 20.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 21-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 21.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 22-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 22.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 23-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 23.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 24-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 24.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 25-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 25.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 26-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 26.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 27-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 27.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 28-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 28.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 29-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 29.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update

apps/base/bind-internal/externaldns/cluster.yaml

@@ -1,42 +0,0 @@
----
-# external-dns tier (replaces the 3x Puppet external-dns servers). An ordinary
-# authoritative cluster; external-dns writes to its zones via RFC2136 because
-# those BindZones set dynamicUpdate (allow-update { key externaldns-key; }).
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCluster
-metadata:
-  name: bind-externaldns
-  namespace: bind-internal
-spec:
-  mode: authoritative
-  replicas: 3
-  storageClassName: cephrbd-fast-delete
-  storageSize: 1Gi
-  service:
-    type: LoadBalancer
-    externalTrafficPolicy: Local
-    annotations:
-      purelb.io/service-group: common
-      purelb.io/addresses: 198.18.200.8
-      external-dns.alpha.kubernetes.io/hostname: bind-externaldns.k8s.syd1.au.unkin.net
-  primaryService:
-    type: ClusterIP
-  resources:
-    requests:
-      cpu: 20m
-      memory: 128Mi
-    limits:
-      cpu: "1"
-      memory: 512Mi
----
-# Catalog zone so the dynamic zones replicate onto the cluster's secondaries
-# (external-dns writes to the primary; secondaries IXFR the result).
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCatalogZone
-metadata:
-  name: bind-externaldns-catalog
-  namespace: bind-internal
-spec:
-  clusterRef: bind-externaldns
-  zoneName: catalog.externaldns.internal
-  transferKeyRef: externaldns-key

apps/base/bind-internal/externaldns/tsigkey.yaml

@@ -1,21 +0,0 @@
----
-# Key that external-dns (and DNSRecord objects) use to send RFC2136 dynamic
-# updates to the primary. The operator generates the material into a Secret
-# (externaldns-key-tsig) in this namespace. secretTemplate stamps emberstack
-# reflector hints onto that Secret so it is mirrored into the externaldns
-# namespace, where the external-dns controller reads it -- guaranteeing
-# external-dns presents exactly the key the primary's allow-update accepts.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindTSIGKey
-metadata:
-  name: externaldns-key
-  namespace: bind-internal
-spec:
-  clusterRef: bind-externaldns
-  algorithm: hmac-sha256
-  secretTemplate:
-    annotations:
-      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "externaldns"
-      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "externaldns"

apps/base/bind-internal/externaldns/zones.yaml

@@ -1,34 +0,0 @@
-# k8s external-dns zones migrated from puppet-prod
-# (externaldns::k8s_zones in hieradata/roles/infra/dns/externaldns.yaml).
-# Primary + dynamicUpdate: the Kubernetes external-dns controller writes
-# records here via RFC2136 authenticated with externaldns-key.
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: k8s-syd1-au-unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-externaldns
-  zoneName: k8s.syd1.au.unkin.net
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: externaldns-key
-  allowTransfer:
-    - key externaldns-key
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 200-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-externaldns
-  zoneName: 200.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: externaldns-key
-  allowTransfer:
-    - key externaldns-key

apps/base/bind-internal/kustomization.yaml

@@ -1,11 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - authoritative
-  - resolvers
-  - externaldns
-  - tsig-api
-  - agent-dns-rolebinding.yaml

apps/base/bind-internal/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: bind-internal

apps/base/bind-internal/resolvers/acls.yaml

@@ -1,69 +0,0 @@
-# Internal client ACLs, mirrored from puppet /etc/named/acls.conf.
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindACL
-metadata:
-  name: acl-main.unkin.net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  entries:
-    - 10.42.0.0/16   # k8s pod network (kube-proxy masquerades node-originated LB queries)
-    - 198.18.1.10/32
-    - 198.18.2.160/27
-    - 198.18.21.160/27
-    - 198.18.2.192/27
-    - 198.18.21.192/27
-    # Admin/management access
-    - 10.10.12.200/32   # benvin workstation (wireguard)
-    - 198.18.21.160/32  # benvin router (also within 198.18.21.160/27 above)
-    - 198.18.13.0/24
-    - 198.18.14.0/24
-    - 198.18.15.0/24
-    - 198.18.16.0/24
-    - 198.18.17.0/24
-    - 198.18.18.0/24
-    - 198.18.19.0/24
-    - 198.18.20.0/24
-    - 198.18.21.0/24
-    - 198.18.22.0/24
-    - 198.18.23.0/24
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindACL
-metadata:
-  name: acl-dmz
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  entries:
-    - 198.18.24.0/24
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindACL
-metadata:
-  name: acl-common
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  entries:
-    - 198.18.25.0/24
-    - 198.18.26.0/24
-    - 198.18.27.0/24
-    - 198.18.28.0/24
-    - 198.18.29.0/24
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindACL
-metadata:
-  name: acl-nomad-jobs
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  entries:
-    - 198.18.64.0/24
-    - 198.18.65.0/24
-    - 198.18.66.0/24
-    - 198.18.67.0/24
-    - 198.18.68.0/24
-    - 198.18.69.0/24

apps/base/bind-internal/resolvers/cluster.yaml

@@ -1,44 +0,0 @@
----
-# Recursive resolvers (replaces the 3x Puppet only-resolver servers).
-# Three identical recursive servers; no zone replication.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCluster
-metadata:
-  name: bind-resolvers
-  namespace: bind-internal
-spec:
-  mode: resolver
-  replicas: 3
-  storageClassName: cephrbd-fast-delete
-  storageSize: 1Gi
-  service:
-    type: LoadBalancer
-    externalTrafficPolicy: Local
-    annotations:
-      purelb.io/service-group: common
-      purelb.io/addresses: 198.18.200.7
-      external-dns.alpha.kubernetes.io/hostname: bind-resolvers.k8s.syd1.au.unkin.net
-  forwarders:
-    - 8.8.8.8
-    - 1.1.1.1
-  # The internal split-horizon zones are served UNSIGNED by the in-cluster
-  # authoritative, but their public parents publish DS records (e.g. unkin.net
-  # is DNSSEC-signed on the Internet). With dnssec-validation on, the validator
-  # sees "parent indicates secure" but gets an insecure answer and returns
-  # SERVFAIL (broken trust chain). Treat the forwarded internal domains as
-  # insecure so they are not validated. unkin.net covers all *.unkin.net
-  # (incl. k8s.syd1.au.unkin.net); 18.198.in-addr.arpa covers every reverse zone.
-  extraOptions:
-    - "validate-except { unkin.net; 18.198.in-addr.arpa; consul; }"
-    # Enable query logging so the Tier-2 vector bind_query pipeline can parse
-    # client/qname/qtype. Routes to the `queries` category which, with no explicit
-    # logging{} clause, follows the default category to the named foreground
-    # stderr channel -> pod stdout -> vector (subject logs.k8s.bind-internal.*).
-    - "querylog yes"
-  resources:
-    requests:
-      cpu: 20m
-      memory: 128Mi
-    limits:
-      cpu: "1"
-      memory: 512Mi

apps/base/bind-internal/resolvers/forward-zones.yaml

@@ -1,303 +0,0 @@
-# Conditional forward zones, from the puppet openforwarder view.
-# Upstreams: unkin authoritative 198.18.200.6, consul 198.18.19.14,
-#   k8s 198.18.200.8 (in-cluster bind-externaldns VIP).
-# k8s -> in-cluster bind-externaldns 198.18.200.8 for both the forward zone
-#   k8s.syd1.au.unkin.net and the reverse zone 200.18.198.in-addr.arpa, which
-#   external-dns now publishes to (see the external-dns migration PRs).
-# (Zones that forwarded to 10.10.16.x were dropped; consul left as-is.)
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: unkin.net
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-main-unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: main.unkin.net
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-consul
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: consul
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.19.14
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-k8s-syd1-au-unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: k8s.syd1.au.unkin.net
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.8
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-200-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 200.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    # Reverse zone for the k8s LB range, published by external-dns to the
-    # in-cluster bind-externaldns alongside k8s.syd1.au.unkin.net.
-    - 198.18.200.8
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-13-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 13.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-14-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 14.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-15-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 15.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-16-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 16.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-17-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 17.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-19-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 19.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-20-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 20.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-21-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 21.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-22-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 22.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-23-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 23.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-24-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 24.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-25-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 25.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-26-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 26.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-27-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 27.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-28-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 28.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-29-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 29.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6

apps/base/bind-internal/resolvers/kustomization.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - cluster.yaml
-  - acls.yaml
-  - view.yaml
-  - forward-zones.yaml

apps/base/bind-internal/resolvers/view.yaml

@@ -1,23 +0,0 @@
----
-# openforwarder view, mirrored from puppet /etc/named/views.conf.
-# match-clients gates access to internal networks; recursion/query are 'any'
-# within the view since match-clients already restricts who reaches it.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindView
-metadata:
-  name: openforwarder
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  order: 100
-  matchClients:
-    - acl-main.unkin.net
-    - acl-nomad-jobs
-    - acl-common
-    - acl-dmz
-  recursion: true
-  allowQuery:
-    - any
-  extraOptions:
-    - "allow-recursion { any; }"
-    - "allow-query-cache { any; }"

apps/base/bind-internal/tsig-api/tsig-api.yaml

@@ -1,27 +0,0 @@
----
-# Companion TSIG API. The operator reconciles this into a Deployment, Service,
-# ConfigMap, master-token Secret and namespaced RBAC. vault-plugin-secrets-bind-tsig
-# calls it to create/rotate/delete TSIG keys, which it does by managing
-# BindTSIGKey resources in this namespace (the operator reconciles the material).
-#
-# The master access token Secret (bind-tsig-api-token) is generated by the
-# operator if absent; a VaultStaticSecret may later pre-seed/overwrite it so the
-# token is sourced from Vault rather than generated in-cluster.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindTSIGAPI
-metadata:
-  name: bind-tsig-api
-  namespace: bind-internal
-spec:
-  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-tsig-api:v0.2.3
-  replicas: 1
-  port: 8443
-  # targetNamespace defaults to this resource's namespace (bind-internal), where
-  # the authoritative cluster and its keys live.
-  resources:
-    requests:
-      cpu: 25m
-      memory: 64Mi
-    limits:
-      cpu: 250m
-      memory: 128Mi

apps/base/bind-system/agent-dns-rbac.yaml

@@ -1,38 +0,0 @@
----
-# Static service account that Vault's kubernetes secret engine mints scoped
-# tokens for (agent-dns role). RBAC is confined to the bind namespaces via the
-# per-namespace RoleBindings below, not a ClusterRoleBinding.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: agent-dns
-  namespace: bind-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: agent-dns
-rules:
-  - apiGroups: ["bind.unkin.net"]
-    resources: ["*"]
-    verbs: ["*"]
-  - apiGroups: [""]
-    resources: ["pods", "services", "configmaps", "events"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["pods/log"]
-    verbs: ["get"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: agent-dns
-  namespace: bind-system
-subjects:
-  - kind: ServiceAccount
-    name: agent-dns
-    namespace: bind-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: agent-dns

apps/base/bind-system/deployment.yaml

@@ -21,7 +21,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-operator:v0.2.6
+          image: git.unkin.net/unkin/bind-operator:v0.1.1
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081

apps/base/bind-system/kustomization.yaml

@@ -6,8 +6,6 @@ resources:
   - namespace.yaml
   # CRDs are pulled from the bind-operator repo at the matching tag rather than
   # vendored here, so they never drift from the operator.
-  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.2.6/config/crd/install.yaml
+  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.1.1/config/crd/install.yaml
   - rbac.yaml
-  - agent-dns-rbac.yaml
   - deployment.yaml
-  - vpa.yaml

apps/base/bind-system/rbac.yaml

@@ -23,15 +23,7 @@ rules:
     resources: ["pods/exec"]
     verbs: ["create", "get"]
   - apiGroups: ["apps"]
-    resources: ["statefulsets", "deployments"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  # The BindTSIGAPI reconciler deploys the companion API: a ServiceAccount plus
-  # a namespaced Role/RoleBinding granting it access to BindTSIGKey + Secrets.
-  - apiGroups: [""]
-    resources: ["serviceaccounts"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: ["rbac.authorization.k8s.io"]
-    resources: ["roles", "rolebindings"]
+    resources: ["statefulsets"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
   - apiGroups: [""]
     resources: ["events"]

apps/base/bind-system/vpa.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: autoscaling.k8s.io/v1
-kind: VerticalPodAutoscaler
-metadata:
-  name: bind-operator-vpa
-  namespace: bind-system
-spec:
-  targetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: bind-operator
-  updatePolicy:
-    updateMode: "Off"

apps/base/binddns-auth/cluster.yaml

@@ -0,0 +1,36 @@
+---
+# Authoritative masters (replaces the 3x Puppet authoritative servers).
+# pod-0 is the primary; pods 1-2 replicate via the catalog zone + AXFR/IXFR.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: auth
+  namespace: binddns-auth
+spec:
+  mode: authoritative
+  replicas: 3
+  storageClassName: cephrbd-fast-delete
+  storageSize: 2Gi
+  service:
+    type: LoadBalancer
+    annotations:
+      purelb.io/service-group: common
+      external-dns.alpha.kubernetes.io/hostname: ns-auth.k8s.syd1.au.unkin.net
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: "1"
+      memory: 512Mi
+---
+# Catalog zone so new BindZones auto-provision onto the secondaries.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCatalogZone
+metadata:
+  name: auth-catalog
+  namespace: binddns-auth
+spec:
+  clusterRef: auth
+  zoneName: catalog.internal
+  transferKeyRef: transfer-key

apps/base/binddns-auth/kustomization.yaml

@@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - cluster.yaml
+  - namespace.yaml
   - tsigkey.yaml
-  - zones.yaml
+  - cluster.yaml

apps/base/binddns-auth/namespace.yaml

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: arrstack
+  name: binddns-auth

apps/base/binddns-auth/tsigkey.yaml

@@ -0,0 +1,10 @@
+---
+# Zone-transfer / catalog key. The operator generates the material into a
+# Secret (transfer-key-tsig); nothing sensitive is committed to git.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindTSIGKey
+metadata:
+  name: transfer-key
+  namespace: binddns-auth
+spec:
+  algorithm: hmac-sha256

apps/base/binddns-externaldns/cluster.yaml

@@ -0,0 +1,26 @@
+---
+# external-dns tier (replaces the 3x Puppet external-dns servers). An ordinary
+# authoritative cluster; external-dns writes to its zones via RFC2136 because
+# those BindZones set dynamicUpdate (allow-update { key externaldns-key; }).
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: externaldns
+  namespace: binddns-externaldns
+spec:
+  mode: authoritative
+  replicas: 3
+  storageClassName: cephrbd-fast-delete
+  storageSize: 1Gi
+  service:
+    type: LoadBalancer
+    annotations:
+      purelb.io/service-group: dmz
+      external-dns.alpha.kubernetes.io/hostname: ns-ext.k8s.syd1.au.unkin.net
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: "1"
+      memory: 512Mi

apps/base/binddns-externaldns/kustomization.yaml

@@ -4,3 +4,5 @@ kind: Kustomization
 
 resources:
   - namespace.yaml
+  - tsigkey.yaml
+  - cluster.yaml

apps/base/binddns-externaldns/namespace.yaml

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: cephrgw-system
+  name: binddns-externaldns

apps/base/binddns-externaldns/tsigkey.yaml

@@ -0,0 +1,10 @@
+---
+# Key that external-dns (and DNSRecord objects) use to send RFC2136 dynamic
+# updates to the primary. The operator generates the material into a Secret.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindTSIGKey
+metadata:
+  name: externaldns-key
+  namespace: binddns-externaldns
+spec:
+  algorithm: hmac-sha256

apps/base/binddns-resolver/cluster.yaml

@@ -0,0 +1,28 @@
+---
+# Recursive resolvers (replaces the 3x Puppet only-resolver servers).
+# Three identical recursive servers; no zone replication.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: resolver
+  namespace: binddns-resolver
+spec:
+  mode: resolver
+  replicas: 3
+  storageClassName: cephrbd-fast-delete
+  storageSize: 1Gi
+  service:
+    type: LoadBalancer
+    annotations:
+      purelb.io/service-group: common
+      external-dns.alpha.kubernetes.io/hostname: resolver.k8s.syd1.au.unkin.net
+  forwarders:
+    - 1.1.1.1
+    - 9.9.9.9
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: "1"
+      memory: 512Mi

apps/base/binddns-resolver/kustomization.yaml

@@ -4,3 +4,4 @@ kind: Kustomization
 
 resources:
   - namespace.yaml
+  - cluster.yaml

apps/base/binddns-resolver/namespace.yaml

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: bind-external
+  name: binddns-resolver