traefik-internal: add ldaps :636 entrypoint for authentik LDAPS

Why: - traefik-internal has no 636 entrypoint, so the authentik-ldap Gateway's 636/TLS passthrough listeners are invalid and the whole Gateway is rejected (Accepted: False), taking LDAPS down. - The traefik-internal LoadBalancer only publishes 80/443, so nothing reaches the Authentik LDAP outpost on 636. How: - Add an `ldaps` entrypoint on :636 (raw TCP, no TLS termination) to the traefik-internal helm values so 636/TLS passthrough streams pass through to the LDAP outpost. - Expose 636 on the traefik-internal LoadBalancer via the port's `expose.default`, keeping the pinned 198.18.200.4 / common group.
2026-08-08 23:16:50 +10:00
119 changed files with 9 additions and 4060 deletions
@@ -1,136 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: arrproxy-api
-  namespace: arrstack
-  annotations:
-    # Wave 2: serve only after the wave-1 migrate Job completes.
-    argocd.argoproj.io/sync-wave: "2"
-    secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-db-app,sonarr-apikey,radarr-apikey,prowlarr-apikey"
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: arrproxy-api
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: arrproxy-api
-    spec:
-      serviceAccountName: default
-      automountServiceAccountToken: false
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        fsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.1.0
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 8080
-              name: http
-              protocol: TCP
-          env:
-            - name: ARRPROXY_ADDR
-              value: ":8080"
-            # oauth2-proxy --pass-user-headers forwards identity to the upstream as
-            # X-Forwarded-{User,Email,Groups} (a single comma-joined Groups value).
-            # Email/User already match the api defaults; override the groups header
-            # (default X-Auth-Request-Groups is auth_request-response-only and never
-            # reaches this upstream) so group-based authorization works.
-            - name: ARRPROXY_GROUPS_HEADER
-              value: X-Forwarded-Groups
-            # Real per-app *arr keys, projected one file per app under this dir
-            # (sourced from the existing <app>-apikey Secrets). The api injects
-            # them server-side and redacts them from every proxied response.
-            - name: ARRPROXY_KEYS_DIR
-              value: /etc/arrproxy/keys
-            - name: ARRPROXY_PEPPER
-              valueFrom:
-                secretKeyRef:
-                  name: arrproxy-pepper
-                  key: pepper
-            # DSN assembled from the CNPG-generated arrproxy-db-app Secret;
-            # $(VAR) expansion resolves the two env entries defined above it.
-            - name: ARRPROXY_DB_USER
-              valueFrom:
-                secretKeyRef:
-                  name: arrproxy-db-app
-                  key: username
-            - name: ARRPROXY_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: arrproxy-db-app
-                  key: password
-            - name: DATABASE_URL
-              value: "postgres://$(ARRPROXY_DB_USER):$(ARRPROXY_DB_PASSWORD)@arrproxy-db-rw.arrstack.svc.cluster.local:5432/arrproxy?sslmode=require"
-          volumeMounts:
-            - name: arr-keys
-              mountPath: /etc/arrproxy/keys
-              readOnly: true
-            - name: tmp
-              mountPath: /tmp
-          livenessProbe:
-            httpGet:
-              path: /livez
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 100m
-              memory: 128Mi
-            limits:
-              cpu: "1"
-              memory: 512Mi
-      volumes:
-        # Real *arr API keys, one file per app named exactly <app> so the api
-        # reads /etc/arrproxy/keys/{sonarr,radarr,prowlarr}. Reuses the same
-        # <app>-apikey Secrets the *arr Deployments already consume.
-        - name: arr-keys
-          projected:
-            sources:
-              - secret:
-                  name: sonarr-apikey
-                  items:
-                    - key: apitoken
-                      path: sonarr
-              - secret:
-                  name: radarr-apikey
-                  items:
-                    - key: apitoken
-                      path: radarr
-              - secret:
-                  name: prowlarr-apikey
-                  items:
-                    - key: apitoken
-                      path: prowlarr
-        - name: tmp
-          emptyDir:
-            sizeLimit: 64Mi
-      restartPolicy: Always
@@ -1,51 +0,0 @@
---
-# Ceph RGW (S3) backup target for the arrproxy token-store CNPG cluster,
-# provisioned by the in-estate cephrgw-operator. One dedicated bucket + owner
-# user per cluster.
-apiVersion: ceph.unkin.net/v1alpha1
-kind: ObjectStoreUser
-metadata:
-  name: cnpg-arrproxy-backup
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  displayName: "CNPG backup owner (arrproxy)"
-  uid: cnpg-arrproxy-backup
-  maxBuckets: 5
-  secretName: cnpg-arrproxy-backup-s3
-  retainOnDelete: true
---
-apiVersion: ceph.unkin.net/v1alpha1
-kind: Bucket
-metadata:
-  name: cnpg-arrproxy
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  placementTarget: ec
-  bucketName: cnpg-arrproxy
-  ownerRef: cnpg-arrproxy-backup
-  versioning: false
-  tags:
-    app: arrproxy
-    purpose: cnpg-backup
-  retainOnDelete: true
---
-# Nightly base backup; continuous WAL archiving is always-on via the Cluster's
-# spec.backup.barmanObjectStore. Staggered off other clusters' schedules.
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: cnpg-arrproxy-nightly
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  schedule: "0 20 2 * * *"
-  immediate: false
-  backupOwnerReference: self
-  method: barmanObjectStore
-  cluster:
-    name: arrproxy-db
@@ -1,117 +0,0 @@
---
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: arrproxy-db
-  namespace: arrstack
-  annotations:
-    # Wave 0: DB (and the generated arrproxy-db-app Secret) must be Healthy before
-    # the wave-1 migrate Job runs. ArgoCD gates on the Cluster's health status.
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  affinity:
-    podAntiAffinityType: preferred
-  backup:
-    retentionPolicy: 30d
-    barmanObjectStore:
-      destinationPath: s3://cnpg-arrproxy
-      endpointURL: https://s3.ceph.unkin.net
-      endpointCA:
-        name: vault-ca-cert
-        key: ca.crt
-      s3Credentials:
-        accessKeyId:
-          name: cnpg-arrproxy-backup-s3
-          key: AWS_ACCESS_KEY_ID
-        secretAccessKey:
-          name: cnpg-arrproxy-backup-s3
-          key: AWS_SECRET_ACCESS_KEY
-      serverName: arrproxy
-      data:
-        compression: bzip2
-        jobs: 2
-      wal:
-        compression: zstd
-        maxParallel: 2
-  bootstrap:
-    initdb:
-      # No secret ref: CNPG mints the owner credentials and publishes them in the
-      # generated "arrproxy-db-app" Secret, which the api reads to build the DSN.
-      database: arrproxy
-      encoding: UTF8
-      localeCType: C
-      localeCollate: C
-      owner: arrproxy
-  enablePDB: true
-  enableSuperuserAccess: false
-  failoverDelay: 0
-  imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
-  instances: 2
-  logLevel: info
-  maxSyncReplicas: 0
-  minSyncReplicas: 0
-  monitoring:
-    customQueriesConfigMap:
-      - key: queries
-        name: cnpg-default-monitoring
-    disableDefaultQueries: false
-    enablePodMonitor: false
-  postgresql:
-    parameters:
-      archive_mode: "on"
-      archive_timeout: 5min
-      dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
-      full_page_writes: "on"
-      log_destination: csvlog
-      log_directory: /controller/log
-      log_filename: postgres
-      log_rotation_age: "0"
-      log_rotation_size: "0"
-      log_truncate_on_rotation: "false"
-      logging_collector: "on"
-      max_connections: "200"
-      max_parallel_workers: "16"
-      max_replication_slots: "16"
-      max_worker_processes: "16"
-      shared_buffers: 128MB
-      shared_memory_type: mmap
-      ssl_max_protocol_version: TLSv1.3
-      ssl_min_protocol_version: TLSv1.3
-      wal_keep_size: 256MB
-      wal_level: logical
-      wal_log_hints: "on"
-      wal_receiver_timeout: 5s
-      wal_sender_timeout: 5s
-    syncReplicaElectionConstraint:
-      enabled: false
-  primaryUpdateMethod: restart
-  primaryUpdateStrategy: unsupervised
-  probes:
-    liveness:
-      isolationCheck:
-        connectionTimeout: 1000
-        enabled: true
-        requestTimeout: 1000
-  replicationSlots:
-    highAvailability:
-      enabled: true
-      slotPrefix: _cnpg_
-    synchronizeReplicas:
-      enabled: true
-    updateInterval: 30
-  resources:
-    limits:
-      cpu: 500m
-      memory: 512Mi
-    requests:
-      cpu: 50m
-      memory: 256Mi
-  smartShutdownTimeout: 180
-  startDelay: 3600
-  stopDelay: 1800
-  storage:
-    resizeInUseVolumes: true
-    size: 10Gi
-    storageClass: cephrbd-fast-delete
-  switchoverDelay: 3600
@@ -1,41 +0,0 @@
---
-# External (DMZ) front for the arrstack, served on arrstack.unkin.net via the
-# external Traefik (LB VIP 198.18.199.0). cert-manager mints arrproxy-gateway-tls
-# (CN arrstack.unkin.net) off the internal Vault-PKI CA. The apex arrstack.unkin.net
-# A record lives in the bind-operator unkin.net zone (bind-internal/authoritative),
-# NOT external-dns, so no external-dns annotation here.
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: external
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: arrstack.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  name: arrproxy
-  namespace: arrstack
-spec:
-  gatewayClassName: traefik-external
-  listeners:
-    - name: http
-      port: 80
-      protocol: HTTP
-      hostname: arrstack.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-    - name: https
-      port: 443
-      protocol: HTTPS
-      hostname: arrstack.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-      tls:
-        mode: Terminate
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: arrproxy-gateway-tls
@@ -1,58 +0,0 @@
---
-# Redirect plain HTTP to HTTPS.
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: arrproxy-http-redirect
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  hostnames:
-    - arrstack.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: arrproxy
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
---
-# All HTTPS traffic enters via oauth2-proxy (the arrproxy entry Service), which
-# authenticates and path-routes to arrproxy-ui / arrproxy-api. The UI-vs-api and
-# the /<app>/api oauth-bypass split is done inside oauth2-proxy (upstreams +
-# skip-auth-regex), so a single backend here is sufficient.
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: arrproxy-route
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  hostnames:
-    - arrstack.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: arrproxy
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: arrproxy
-          port: 80
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
@@ -1,17 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - cnpg_cluster.yaml
-  - cnpg_backup.yaml
-  - migrations-configmap.yaml
-  - migrate-job.yaml
-  - vaultstaticsecret.yaml
-  - oauth2-proxy-configmap.yaml
-  - oauth2-proxy-deployment.yaml
-  - api-deployment.yaml
-  - ui-deployment.yaml
-  - services.yaml
-  - gateway.yaml
-  - httproute.yaml
@@ -1,92 +0,0 @@
---
-# Applies the arrproxy schema once per sync, before the api rolls, so the serve
-# replicas never race migrations (arrproxy-api does not self-migrate). Runs as the
-# CNPG-minted app user so the tokens table is owned by that role.
-#
-# Sync-phase hook at wave 1 (NOT PreSync): the CNPG Cluster + generated
-# arrproxy-db-app Secret apply at wave 0 and ArgoCD waits for the Cluster to be
-# Healthy before starting wave 1, so Postgres exists before migrate connects.
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: arrproxy-migrate
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/hook: Sync
-    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
-    argocd.argoproj.io/sync-wave: "1"
-spec:
-  backoffLimit: 6
-  ttlSecondsAfterFinished: 600
-  template:
-    metadata:
-      labels:
-        app: arrproxy-migrate
-    spec:
-      serviceAccountName: default
-      automountServiceAccountToken: false
-      restartPolicy: Never
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        fsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: migrate
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:18-alpine
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: HOME
-              value: /tmp
-            - name: PGUSER
-              valueFrom:
-                secretKeyRef:
-                  name: arrproxy-db-app
-                  key: username
-            - name: PGPASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: arrproxy-db-app
-                  key: password
-            - name: PGHOST
-              value: arrproxy-db-rw.arrstack.svc.cluster.local
-            - name: PGPORT
-              value: "5432"
-            - name: PGDATABASE
-              value: arrproxy
-            - name: PGSSLMODE
-              value: require
-          command:
-            - psql
-            - -v
-            - ON_ERROR_STOP=1
-            - -f
-            - /migrations/0001_init.sql
-          volumeMounts:
-            - name: migrations
-              mountPath: /migrations
-              readOnly: true
-            - name: tmp
-              mountPath: /tmp
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 100m
-              memory: 128Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-      volumes:
-        - name: migrations
-          configMap:
-            name: arrproxy-migrations
-        - name: tmp
-          emptyDir:
-            sizeLimit: 64Mi
@@ -1,29 +0,0 @@
---
-# arrproxy schema, mirrored from the arrproxy repo migrations/0001_init.sql
-# (v0.1.0). arrproxy-api does NOT self-migrate, so the wave-1 migrate Job applies
-# this once per sync as the app user. Keep in sync with the repo on schema bumps.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: arrproxy-migrations
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-data:
-  0001_init.sql: |
-    -- arrproxy token store. Only token hashes are persisted; plaintext is shown
-    -- once at mint time and never recoverable.
-    CREATE TABLE IF NOT EXISTS tokens (
-        id           TEXT PRIMARY KEY,
-        subject      TEXT        NOT NULL,
-        label        TEXT        NOT NULL DEFAULT '',
-        token_hash   TEXT        NOT NULL UNIQUE,
-        apps         TEXT[]      NOT NULL DEFAULT '{}',
-        created_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
-        expires_at   TIMESTAMPTZ,
-        disabled     BOOLEAN     NOT NULL DEFAULT false,
-        last_used_at TIMESTAMPTZ
-    );
-
-    CREATE INDEX IF NOT EXISTS tokens_subject_idx ON tokens (subject);
-    CREATE INDEX IF NOT EXISTS tokens_token_hash_idx ON tokens (token_hash);
@@ -1,46 +0,0 @@
---
-# Non-secret oauth2-proxy configuration (client_id/secret/cookie_secret come from
-# the oauth-credentials Secret). oauth2-proxy is the single auth front for the
-# arrstack: it authenticates the UI and the token API against Authentik, and path-
-# routes to the arrproxy-ui / arrproxy-api upstreams. /<app>/api is exempted from
-# auth (SKIP_AUTH_REGEX) so *arr clients presenting a per-user token reach the api
-# directly; the api then validates the token. Everything else requires the oauth
-# session and receives identity via X-Forwarded-* / X-Auth-Request-* headers.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: arrproxy-oauth2-env
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-data:
-  OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
-  OAUTH2_PROXY_PROVIDER: "oidc"
-  # Authentik arrstack app discovery issuer (served by the internal unkin.net CA;
-  # trusted via PROVIDER_CA_FILES below). CONFIRM the slug matches the Authentik
-  # application (terraform-authentik PR #18).
-  OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/arrstack/"
-  OAUTH2_PROXY_REDIRECT_URL: "https://arrstack.unkin.net/oauth2/callback"
-  # Longest-prefix wins: /api and /<app> go to arrproxy-api, everything else
-  # (the SPA + static assets) to arrproxy-ui.
-  OAUTH2_PROXY_UPSTREAMS: "http://arrproxy-ui.arrstack.svc.cluster.local:8080/,http://arrproxy-api.arrstack.svc.cluster.local:8080/api/,http://arrproxy-api.arrstack.svc.cluster.local:8080/sonarr/,http://arrproxy-api.arrstack.svc.cluster.local:8080/radarr/,http://arrproxy-api.arrstack.svc.cluster.local:8080/prowlarr/"
-  OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
-  # Populate session.Groups from the Authentik ak_groups claim; pass-user-headers
-  # then emits it as a single comma-joined X-Forwarded-Groups header.
-  OAUTH2_PROXY_OIDC_GROUPS_CLAIM: "ak_groups"
-  # Forward identity + groups to arrproxy-api as X-Forwarded-{User,Email,Groups}
-  # (the api reads these; ARRPROXY_GROUPS_HEADER=X-Forwarded-Groups). NOTE:
-  # set-xauthrequest is intentionally NOT set -- it only populates auth_request
-  # *response* headers, which never reach an --upstreams-proxied backend.
-  OAUTH2_PROXY_PASS_USER_HEADERS: "true"
-  # Bypass auth ONLY for the *arr proxy API (/<app>/api...): this matches
-  # /sonarr/api but NOT /api/tokens or /api/me (which stay authenticated).
-  OAUTH2_PROXY_SKIP_AUTH_REGEX: "^/[^/]+/api"
-  OAUTH2_PROXY_EMAIL_DOMAINS: "*"
-  OAUTH2_PROXY_COOKIE_SECURE: "true"
-  OAUTH2_PROXY_COOKIE_DOMAINS: "arrstack.unkin.net"
-  OAUTH2_PROXY_WHITELIST_DOMAINS: "arrstack.unkin.net"
-  OAUTH2_PROXY_REVERSE_PROXY: "true"
-  OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt"
-  OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256"
-  OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
@@ -1,133 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: arrproxy-oauth2
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-    configmap.reloader.stakater.com/auto: "true"
-    secret.reloader.stakater.com/reload: "oauth-credentials,vault-ca-cert"
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: arrproxy-oauth2
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: arrproxy-oauth2
-    spec:
-      serviceAccountName: default
-      automountServiceAccountToken: false
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        fsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      initContainers:
-        # identity.unkin.net serves a Vault-PKI cert; combine the system roots
-        # with the internal CA so oauth2-proxy's OIDC HTTP client trusts it.
-        - name: combine-certs
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3
-          imagePullPolicy: IfNotPresent
-          command:
-            - sh
-            - -c
-            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
-          volumeMounts:
-            - name: vault-ca-cert
-              mountPath: /custom-ca
-              readOnly: true
-            - name: combined-certs
-              mountPath: /combined-certs
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 50m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 64Mi
-      containers:
-        - name: oauth2-proxy
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/oauth2-proxy:v7.15.3
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 4180
-              name: http
-              protocol: TCP
-          envFrom:
-            - configMapRef:
-                name: arrproxy-oauth2-env
-                optional: false
-          env:
-            - name: OAUTH2_PROXY_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: oauth-credentials
-                  key: client_id
-            - name: OAUTH2_PROXY_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: oauth-credentials
-                  key: client_secret
-            - name: OAUTH2_PROXY_COOKIE_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: oauth-credentials
-                  key: cookie_secret
-          volumeMounts:
-            - name: combined-certs
-              mountPath: /etc/ssl/combined
-              readOnly: true
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-      volumes:
-        - name: vault-ca-cert
-          secret:
-            secretName: vault-ca-cert
-            items:
-              - key: ca.crt
-                path: ca.crt
-        - name: combined-certs
-          emptyDir: {}
-      restartPolicy: Always
@@ -1,59 +0,0 @@
---
-# Front-door entry Service: the HTTPRoute for arrstack.unkin.net targets this.
-# All traffic (UI, token API, and the *arr proxy) enters via oauth2-proxy.
-apiVersion: v1
-kind: Service
-metadata:
-  name: arrproxy
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 80
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: arrproxy-oauth2
-  sessionAffinity: None
-  type: ClusterIP
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: arrproxy-api
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 8080
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: arrproxy-api
-  sessionAffinity: None
-  type: ClusterIP
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: arrproxy-ui
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 8080
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: arrproxy-ui
-  sessionAffinity: None
-  type: ClusterIP
@@ -1,72 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: arrproxy-ui
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: arrproxy-ui
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: arrproxy-ui
-    spec:
-      serviceAccountName: default
-      automountServiceAccountToken: false
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        fsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: ui
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-ui:v0.1.0
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 8080
-              name: http
-              protocol: TCP
-          env:
-            - name: ARRPROXY_UI_ADDR
-              value: ":8080"
-          livenessProbe:
-            httpGet:
-              path: /livez
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 50m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 128Mi
-      restartPolicy: Always
@@ -1,49 +0,0 @@
---
-# Per-deployment token-hash pepper. Seeded (openssl rand) at
-# kv/kubernetes/namespace/arrstack/default/arrproxy-pepper (key: pepper); the
-# default k8s role's templated policy already grants read on
-# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
-# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
-# syncs it into the arrproxy-pepper Secret consumed by arrproxy-api as
-# ARRPROXY_PEPPER.
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: arrproxy-pepper
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  destination:
-    create: true
-    name: arrproxy-pepper
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/arrproxy-pepper
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
---
-# Authentik OIDC client for the arrstack front door (client_id, client_secret,
-# cookie_secret), created by terraform-authentik at
-# kv/kubernetes/namespace/arrstack/default/oauth-credentials. VSO syncs it into
-# the oauth-credentials Secret consumed by the oauth2-proxy Deployment.
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: oauth-credentials
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  destination:
-    create: true
-    name: oauth-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/oauth-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
@@ -1,16 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - vaultauth.yaml
-  - pv-media-tv.yaml
-  - pv-media-movies.yaml
-  - pvc-media-tv.yaml
-  - pvc-media-movies.yaml
-  - sonarr
-  - radarr
-  - prowlarr
-  - nzbget
-  - arrproxy
@@ -1,5 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: arrstack
@@ -1,137 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: nzbget
-  namespace: arrstack
-spec:
-  replicas: 1
-  strategy:
-    # RWO config PVC + single queue state: never run two pods at once.
-    type: Recreate
-  selector:
-    matchLabels:
-      app: nzbget
-  template:
-    metadata:
-      labels:
-        app: nzbget
-    spec:
-      securityContext:
-        fsGroup: 1000
-        fsGroupChangePolicy: OnRootMismatch
-      initContainers:
-        # Seed download layout onto the shared media PVCs (not /config or an
-        # emptyDir) so completed downloads land beside the arr libraries and
-        # imports are same-filesystem hardlink moves. Reuses the image's own
-        # template (inherits correct WebDir/ConfigTemplate) and appends the
-        # path/category overrides once; nzbget honours the last value for a
-        # repeated option, and the grep guard keeps re-runs idempotent so admin
-        # UI edits to the persisted /config/nzbget.conf survive restarts.
-        - name: seed-config
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/nzbget:version-v26.2
-          command:
-            - sh
-            - -c
-            - |
-              set -e
-              if [ ! -f /config/nzbget.conf ]; then
-                cp /app/nzbget/share/nzbget/nzbget.conf /config/nzbget.conf
-              fi
-              if ! grep -q '# arrstack-managed' /config/nzbget.conf; then
-                cat >> /config/nzbget.conf << 'CONF'
-
-              # arrstack-managed download layout (appended once; last value wins).
-              # Downloads land on the shared media PVCs by category so sonarr/radarr
-              # import with atomic hardlink moves (download dir + library share one
-              # filesystem per media type). InterDir is empty: nzbget writes each
-              # download straight into its category DestDir, so BOTH tv and movies
-              # stay on their own PVC with no cross-filesystem intermediate copy.
-              MainDir=/media/tv
-              InterDir=
-              DestDir=/media/tv/downloads
-              NzbDir=/config/nzb
-              QueueDir=/config/queue
-              TempDir=/config/tmp
-              ControlIP=0.0.0.0
-              ControlPort=6789
-              Category1.Name=tv
-              Category1.DestDir=/media/tv/downloads
-              Category2.Name=movies
-              Category2.DestDir=/media/movies/downloads
-              CONF
-              fi
-              mkdir -p /media/tv/series /media/tv/downloads /media/movies/films /media/movies/downloads
-              chown 1000:1000 /config/nzbget.conf \
-                /media/tv /media/tv/series /media/tv/downloads \
-                /media/movies /media/movies/films /media/movies/downloads
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 128Mi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: media-tv
-              mountPath: /media/tv
-            - name: media-movies
-              mountPath: /media/movies
-      containers:
-        - name: nzbget
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/nzbget:version-v26.2
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 6789
-              protocol: TCP
-          env:
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: TZ
-              value: Australia/Sydney
-          livenessProbe:
-            # nzbget's root path requires auth (401); a TCP check is the
-            # dependency-free liveness signal for the web/JSON-RPC server.
-            tcpSocket:
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            tcpSocket:
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 200m
-              memory: 256Mi
-            limits:
-              # Headroom for par2 repair + unpack of large downloads.
-              cpu: "2"
-              memory: 2Gi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: media-tv
-              mountPath: /media/tv
-            - name: media-movies
-              mountPath: /media/movies
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: nzbget-config
-        - name: media-tv
-          persistentVolumeClaim:
-            claimName: media-tv
-        - name: media-movies
-          persistentVolumeClaim:
-            claimName: media-movies
@@ -1,37 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: nzbget.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: nzbget.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: nzbget
-  namespace: arrstack
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: nzbget.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: nzbget.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: nzbget-tls
-        mode: Terminate
@@ -1,49 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: nzbget-http-redirect
-  namespace: arrstack
-spec:
-  hostnames:
-    - nzbget.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: nzbget
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: nzbget-route
-  namespace: arrstack
-spec:
-  hostnames:
-    - nzbget.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: nzbget
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: nzbget
-          port: 6789
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
@@ -1,10 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - pvc-config.yaml
-  - deployment.yaml
-  - service.yaml
-  - gateway.yaml
-  - httproute.yaml
@@ -1,16 +0,0 @@
---
-# NZBGet config + queue/temp state. RWO on cephrbd (block). Retain: this is
-# state. The download data itself lives on the shared media PVCs, not here.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: nzbget-config
-  namespace: arrstack
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephrbd-fast-retain
-  volumeMode: Filesystem
@@ -1,15 +0,0 @@
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: nzbget
-  namespace: arrstack
-spec:
-  ports:
-    - name: http
-      port: 6789
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: nzbget
-  type: ClusterIP
@@ -1,115 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: prowlarr
-  namespace: arrstack
-spec:
-  replicas: 1
-  strategy:
-    # RWO config PVC + single stateful SQLite DB: never run two pods at once.
-    type: Recreate
-  selector:
-    matchLabels:
-      app: prowlarr
-  template:
-    metadata:
-      labels:
-        app: prowlarr
-    spec:
-      securityContext:
-        fsGroup: 1000
-        fsGroupChangePolicy: OnRootMismatch
-      initContainers:
-        # Enforce the Vault-sourced API key in /config/config.xml before the app
-        # starts. Vault is source of truth (override bootstrap): the key is minted
-        # in Vault, synced by VSO into the prowlarr-apikey Secret, and written here.
-        # Runs as root to fix ownership; touches only the <ApiKey> element.
-        - name: apikey-init
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/busybox:1.37.0
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            runAsUser: 0
-          env:
-            - name: API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: prowlarr-apikey
-                  key: apitoken
-          command:
-            - sh
-            - -c
-            - |
-              set -eu
-              case "$API_KEY" in
-                "" | *[!0-9a-fA-F]*)
-                  echo "apikey-init: API_KEY missing or not hex; refusing" >&2
-                  exit 1
-                  ;;
-              esac
-              CFG=/config/config.xml
-              if [ ! -f "$CFG" ]; then
-                printf '<Config>\n  <ApiKey>%s</ApiKey>\n</Config>\n' "$API_KEY" > "$CFG"
-              elif grep -q '<ApiKey>' "$CFG"; then
-                sed -i "s|<ApiKey>[^<]*</ApiKey>|<ApiKey>${API_KEY}</ApiKey>|" "$CFG"
-              else
-                sed -i "s|<Config>|<Config>\n  <ApiKey>${API_KEY}</ApiKey>|" "$CFG"
-              fi
-              chown 1000:1000 "$CFG"
-              chmod 600 "$CFG"
-              echo "apikey-init: <ApiKey> enforced from Vault"
-          resources:
-            requests:
-              cpu: 50m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 64Mi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-      containers:
-        - name: prowlarr
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/prowlarr:2.5.2
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 9696
-              protocol: TCP
-          env:
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: TZ
-              value: Australia/Sydney
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: "1"
-              memory: 512Mi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: prowlarr-config
@@ -1,37 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: prowlarr.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: prowlarr.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: prowlarr
-  namespace: arrstack
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: prowlarr.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: prowlarr.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: prowlarr-tls
-        mode: Terminate
@@ -1,49 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: prowlarr-http-redirect
-  namespace: arrstack
-spec:
-  hostnames:
-    - prowlarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: prowlarr
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: prowlarr-route
-  namespace: arrstack
-spec:
-  hostnames:
-    - prowlarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: prowlarr
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: prowlarr
-          port: 9696
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
@@ -1,11 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - pvc-config.yaml
-  - vaultstaticsecret.yaml
-  - deployment.yaml
-  - service.yaml
-  - gateway.yaml
-  - httproute.yaml
@@ -1,16 +0,0 @@
---
-# Prowlarr config + SQLite DB. RWO on cephrbd (block) — the arr apps' SQLite
-# does not tolerate CephFS locking. Retain: this is state.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: prowlarr-config
-  namespace: arrstack
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephrbd-fast-retain
-  volumeMode: Filesystem
@@ -1,15 +0,0 @@
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: prowlarr
-  namespace: arrstack
-spec:
-  ports:
-    - name: http
-      port: 9696
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: prowlarr
-  type: ClusterIP
@@ -1,25 +0,0 @@
---
-# prowlarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/prowlarr
-# (key: apitoken); the default k8s role's templated policy already grants read
-# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
-# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
-# syncs it into the prowlarr-apikey Secret that the apikey-init initContainer reads
-# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: prowlarr-apikey
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  destination:
-    create: true
-    name: prowlarr-apikey
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/prowlarr
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
@@ -1,31 +0,0 @@
---
-# Static PV for the shared MOVIES CephFS subvolume. Same rootPath as jellyfin's
-# movies PV so radarr/nzbget write and jellyfin reads the identical library
-# tree; each namespace gets its own PV (unique name + volumeHandle) pinned by
-# claimRef.
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: arrstack-media-movies
-spec:
-  capacity:
-    storage: 1Ti
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: ""
-  volumeMode: Filesystem
-  claimRef:
-    namespace: arrstack
-    name: media-movies
-  csi:
-    driver: cephfs.csi.ceph.com
-    volumeHandle: arrstack-media-movies-static
-    nodeStageSecretRef:
-      name: csi-cephfs-secret
-      namespace: csi-cephfs
-    volumeAttributes:
-      staticVolume: "true"
-      clusterID: cephfs_csi_ssd_ec_4_1
-      fsName: cephfs
-      rootPath: /volumes/csi_ssd_ec_4_1/media-movies/e95d8ace-c736-465a-acc3-0c3e46dcede9
@@ -1,30 +0,0 @@
---
-# Static PV for the shared TV CephFS subvolume. Same rootPath as jellyfin's TV
-# PV so sonarr/nzbget write and jellyfin reads the identical library tree; each
-# namespace gets its own PV (unique name + volumeHandle) pinned by claimRef.
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: arrstack-media-tv
-spec:
-  capacity:
-    storage: 1Ti
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: ""
-  volumeMode: Filesystem
-  claimRef:
-    namespace: arrstack
-    name: media-tv
-  csi:
-    driver: cephfs.csi.ceph.com
-    volumeHandle: arrstack-media-tv-static
-    nodeStageSecretRef:
-      name: csi-cephfs-secret
-      namespace: csi-cephfs
-    volumeAttributes:
-      staticVolume: "true"
-      clusterID: cephfs_csi_ssd_ec_4_1
-      fsName: cephfs
-      rootPath: /volumes/csi_ssd_ec_4_1/media-tv/4692957d-f5df-4f72-b9c9-56e4ee6d1333
@@ -1,22 +0,0 @@
---
-# Movies library + downloads, shared RWX across radarr and nzbget. Statically
-# bound to the arrstack-media-movies PV (same CephFS subvolume jellyfin mounts
-# read-only). storageClassName "" + volumeName disables dynamic provisioning and
-# binds the pre-created static PV. Downloads and library live on one filesystem
-# so import is an atomic hardlink move.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: media-movies
-  namespace: arrstack
-  annotations:
-    k8up.io/backup: "false"
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Ti
-  storageClassName: ""
-  volumeName: arrstack-media-movies
-  volumeMode: Filesystem
@@ -1,22 +0,0 @@
---
-# TV library + downloads, shared RWX across sonarr and nzbget. Statically bound
-# to the arrstack-media-tv PV (same CephFS subvolume jellyfin mounts read-only).
-# storageClassName "" + volumeName disables dynamic provisioning and binds the
-# pre-created static PV. Downloads and library live on one filesystem so import
-# is an atomic hardlink move.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: media-tv
-  namespace: arrstack
-  annotations:
-    k8up.io/backup: "false"
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Ti
-  storageClassName: ""
-  volumeName: arrstack-media-tv
-  volumeMode: Filesystem
@@ -1,120 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: radarr
-  namespace: arrstack
-spec:
-  replicas: 1
-  strategy:
-    # RWO config PVC + single stateful SQLite DB: never run two pods at once.
-    type: Recreate
-  selector:
-    matchLabels:
-      app: radarr
-  template:
-    metadata:
-      labels:
-        app: radarr
-    spec:
-      securityContext:
-        fsGroup: 1000
-        fsGroupChangePolicy: OnRootMismatch
-      initContainers:
-        # Enforce the Vault-sourced API key in /config/config.xml before the app
-        # starts. Vault is source of truth (override bootstrap): the key is minted
-        # in Vault, synced by VSO into the radarr-apikey Secret, and written here.
-        # Runs as root to fix ownership; touches only the <ApiKey> element.
-        - name: apikey-init
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/busybox:1.37.0
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            runAsUser: 0
-          env:
-            - name: API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: radarr-apikey
-                  key: apitoken
-          command:
-            - sh
-            - -c
-            - |
-              set -eu
-              case "$API_KEY" in
-                "" | *[!0-9a-fA-F]*)
-                  echo "apikey-init: API_KEY missing or not hex; refusing" >&2
-                  exit 1
-                  ;;
-              esac
-              CFG=/config/config.xml
-              if [ ! -f "$CFG" ]; then
-                printf '<Config>\n  <ApiKey>%s</ApiKey>\n</Config>\n' "$API_KEY" > "$CFG"
-              elif grep -q '<ApiKey>' "$CFG"; then
-                sed -i "s|<ApiKey>[^<]*</ApiKey>|<ApiKey>${API_KEY}</ApiKey>|" "$CFG"
-              else
-                sed -i "s|<Config>|<Config>\n  <ApiKey>${API_KEY}</ApiKey>|" "$CFG"
-              fi
-              chown 1000:1000 "$CFG"
-              chmod 600 "$CFG"
-              echo "apikey-init: <ApiKey> enforced from Vault"
-          resources:
-            requests:
-              cpu: 50m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 64Mi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-      containers:
-        - name: radarr
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/radarr:6.3.0
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 7878
-              protocol: TCP
-          env:
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: TZ
-              value: Australia/Sydney
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: "1"
-              memory: 1Gi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: media-movies
-              mountPath: /media/movies
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: radarr-config
-        - name: media-movies
-          persistentVolumeClaim:
-            claimName: media-movies
@@ -1,37 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: radarr.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: radarr.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: radarr
-  namespace: arrstack
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: radarr.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: radarr.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: radarr-tls
-        mode: Terminate
@@ -1,49 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: radarr-http-redirect
-  namespace: arrstack
-spec:
-  hostnames:
-    - radarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: radarr
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: radarr-route
-  namespace: arrstack
-spec:
-  hostnames:
-    - radarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: radarr
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: radarr
-          port: 7878
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
@@ -1,11 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - pvc-config.yaml
-  - vaultstaticsecret.yaml
-  - deployment.yaml
-  - service.yaml
-  - gateway.yaml
-  - httproute.yaml
@@ -1,16 +0,0 @@
---
-# Radarr config + SQLite DB. RWO on cephrbd (block) — the arr apps' SQLite
-# does not tolerate CephFS locking. Retain: this is state.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: radarr-config
-  namespace: arrstack
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephrbd-fast-retain
-  volumeMode: Filesystem
@@ -1,15 +0,0 @@
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: radarr
-  namespace: arrstack
-spec:
-  ports:
-    - name: http
-      port: 7878
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: radarr
-  type: ClusterIP
@@ -1,25 +0,0 @@
---
-# radarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/radarr
-# (key: apitoken); the default k8s role's templated policy already grants read
-# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
-# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
-# syncs it into the radarr-apikey Secret that the apikey-init initContainer reads
-# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: radarr-apikey
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  destination:
-    create: true
-    name: radarr-apikey
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/radarr
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
@@ -1,123 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: sonarr
-  namespace: arrstack
-spec:
-  replicas: 1
-  strategy:
-    # RWO config PVC + single stateful SQLite DB: never run two pods at once.
-    type: Recreate
-  selector:
-    matchLabels:
-      app: sonarr
-  template:
-    metadata:
-      labels:
-        app: sonarr
-    spec:
-      securityContext:
-        # LinuxServer images init as root via s6 then step down to PUID/PGID.
-        # fsGroup makes the shared CephFS group-writable for that user;
-        # OnRootMismatch avoids a recursive chown of the whole media tree.
-        fsGroup: 1000
-        fsGroupChangePolicy: OnRootMismatch
-      initContainers:
-        # Enforce the Vault-sourced API key in /config/config.xml before the app
-        # starts. Vault is source of truth (override bootstrap): the key is minted
-        # in Vault, synced by VSO into the sonarr-apikey Secret, and written here.
-        # Runs as root to fix ownership; touches only the <ApiKey> element.
-        - name: apikey-init
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/busybox:1.37.0
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            runAsUser: 0
-          env:
-            - name: API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: sonarr-apikey
-                  key: apitoken
-          command:
-            - sh
-            - -c
-            - |
-              set -eu
-              case "$API_KEY" in
-                "" | *[!0-9a-fA-F]*)
-                  echo "apikey-init: API_KEY missing or not hex; refusing" >&2
-                  exit 1
-                  ;;
-              esac
-              CFG=/config/config.xml
-              if [ ! -f "$CFG" ]; then
-                printf '<Config>\n  <ApiKey>%s</ApiKey>\n</Config>\n' "$API_KEY" > "$CFG"
-              elif grep -q '<ApiKey>' "$CFG"; then
-                sed -i "s|<ApiKey>[^<]*</ApiKey>|<ApiKey>${API_KEY}</ApiKey>|" "$CFG"
-              else
-                sed -i "s|<Config>|<Config>\n  <ApiKey>${API_KEY}</ApiKey>|" "$CFG"
-              fi
-              chown 1000:1000 "$CFG"
-              chmod 600 "$CFG"
-              echo "apikey-init: <ApiKey> enforced from Vault"
-          resources:
-            requests:
-              cpu: 50m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 64Mi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-      containers:
-        - name: sonarr
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/sonarr:4.0.19
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 8989
-              protocol: TCP
-          env:
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: TZ
-              value: Australia/Sydney
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: "1"
-              memory: 1Gi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: media-tv
-              mountPath: /media/tv
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: sonarr-config
-        - name: media-tv
-          persistentVolumeClaim:
-            claimName: media-tv
@@ -1,37 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: sonarr.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: sonarr.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: sonarr
-  namespace: arrstack
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: sonarr.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: sonarr.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: sonarr-tls
-        mode: Terminate
@@ -1,49 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: sonarr-http-redirect
-  namespace: arrstack
-spec:
-  hostnames:
-    - sonarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: sonarr
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: sonarr-route
-  namespace: arrstack
-spec:
-  hostnames:
-    - sonarr.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: sonarr
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: sonarr
-          port: 8989
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
@@ -1,11 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - pvc-config.yaml
-  - vaultstaticsecret.yaml
-  - deployment.yaml
-  - service.yaml
-  - gateway.yaml
-  - httproute.yaml
@@ -1,16 +0,0 @@
---
-# Sonarr config + SQLite DB. RWO on cephrbd (block) — the arr apps' SQLite
-# does not tolerate CephFS locking. Retain: this is state.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: sonarr-config
-  namespace: arrstack
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephrbd-fast-retain
-  volumeMode: Filesystem
@@ -1,15 +0,0 @@
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: sonarr
-  namespace: arrstack
-spec:
-  ports:
-    - name: http
-      port: 8989
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: sonarr
-  type: ClusterIP
@@ -1,25 +0,0 @@
---
-# sonarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/sonarr
-# (key: apitoken); the default k8s role's templated policy already grants read
-# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
-# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
-# syncs it into the sonarr-apikey Secret that the apikey-init initContainer reads
-# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: sonarr-apikey
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  destination:
-    create: true
-    name: sonarr-apikey
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/sonarr
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
@@ -1,20 +0,0 @@
---
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  allowedNamespaces:
-    - arrstack
-  kubernetes:
-    audiences:
-      - vault
-    role: default
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default
@@ -36,7 +36,7 @@ spec:
              mountPath: /combined-certs
      containers:
        - name: api
-          image: git.unkin.net/unkin/artifactapi:v3.11.1
+          image: git.unkin.net/unkin/artifactapi:v3.7.7
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8000
@@ -22,7 +22,7 @@ spec:
      automountServiceAccountToken: true
      containers:
        - name: ui
-          image: git.unkin.net/unkin/artifactapi-ui:v3.11.1
+          image: git.unkin.net/unkin/artifactapi-ui:v3.7.7
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80
@@ -88,32 +88,3 @@ spec:
  ttl: 600
  values:
    - 103.216.191.185
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: ghp-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: ghp
-  type: A
-  ttl: 600
-  values:
-    # traefik-internal gateway VIP; the ghp Gateway serves ghp.unkin.net there.
-    - 198.18.200.4
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: arrstack-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: arrstack
-  type: A
-  ttl: 600
-  values:
-    # traefik-EXTERNAL (DMZ) gateway VIP; the arrproxy Gateway serves the
-    # arrstack.unkin.net front door (oauth2-proxy) there.
-    - 198.18.199.0
@@ -11,7 +11,7 @@ metadata:
    argocd.argoproj.io/sync-wave: "1"
 spec:
  replicas: 1
-  image: git.unkin.net/unkin/kea-api:v0.1.3
+  image: git.unkin.net/unkin/kea-api:v0.1.2
  tokenSecretName: kea-api-token
  service:
    type: ClusterIP
@@ -11,7 +11,7 @@ metadata:
    argocd.argoproj.io/sync-wave: "1"
 spec:
  replicas: 2
-  image: git.unkin.net/unkin/kea:v0.1.3
+  image: git.unkin.net/unkin/kea:v0.1.2
  domainName: main.unkin.net
  defaultLeaseTime: 1200
  maxLeaseTime: 86400
@@ -21,7 +21,7 @@ spec:
        runAsNonRoot: true
      containers:
        - name: operator
-          image: git.unkin.net/unkin/kea-operator:v0.1.3
+          image: git.unkin.net/unkin/kea-operator:v0.1.2
          args:
            - --metrics-bind-address=:8080
            - --health-probe-bind-address=:8081
@@ -1,28 +0,0 @@
---
-# Serving cert off the internal Vault-PKI CA (agents already trust vault-ca-cert).
-# SANs cover the GitHub endpoints ghp impersonates plus its own management host.
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: ghp-tls
-  namespace: ghp
-  labels:
-    app.kubernetes.io/name: ghp
-    app.kubernetes.io/instance: ghp
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  secretName: ghp-tls
-  issuerRef:
-    kind: ClusterIssuer
-    name: vault-issuer
-  commonName: ghp.k8s.syd1.au.unkin.net
-  dnsNames:
-    - github.com
-    - api.github.com
-    - codeload.github.com
-    - "*.githubcopilot.com"
-    - ghp.k8s.syd1.au.unkin.net
-  privateKey:
-    algorithm: RSA
-    size: 4096
@@ -1,50 +0,0 @@
---
-# Ceph RGW (S3) backup target for the ghp CNPG cluster, provisioned by the
-# in-estate cephrgw-operator. One dedicated bucket + owner user per cluster.
-apiVersion: ceph.unkin.net/v1alpha1
-kind: ObjectStoreUser
-metadata:
-  name: cnpg-ghp-backup
-  namespace: ghp
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  displayName: "CNPG backup owner (ghp)"
-  uid: cnpg-ghp-backup
-  maxBuckets: 5
-  secretName: cnpg-ghp-backup-s3
-  retainOnDelete: true
---
-apiVersion: ceph.unkin.net/v1alpha1
-kind: Bucket
-metadata:
-  name: cnpg-ghp
-  namespace: ghp
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  placementTarget: ec
-  bucketName: cnpg-ghp
-  ownerRef: cnpg-ghp-backup
-  versioning: false
-  tags:
-    app: ghp
-    purpose: cnpg-backup
-  retainOnDelete: true
---
-# Nightly base backup; continuous WAL archiving is always-on via the Cluster's
-# spec.backup.barmanObjectStore. Staggered off other clusters' schedules.
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: cnpg-ghp-nightly
-  namespace: ghp
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  schedule: "0 50 1 * * *"
-  immediate: false
-  backupOwnerReference: self
-  method: barmanObjectStore
-  cluster:
-    name: postgres
@@ -1,117 +0,0 @@
---
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: postgres
-  namespace: ghp
-  annotations:
-    # Wave 0: DB (and the generated postgres-app Secret) must be Healthy before
-    # the wave-1 migrate Job runs. ArgoCD gates on the Cluster's health status.
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  affinity:
-    podAntiAffinityType: preferred
-  backup:
-    retentionPolicy: 30d
-    barmanObjectStore:
-      destinationPath: s3://cnpg-ghp
-      endpointURL: https://s3.ceph.unkin.net
-      endpointCA:
-        name: vault-ca-cert
-        key: ca.crt
-      s3Credentials:
-        accessKeyId:
-          name: cnpg-ghp-backup-s3
-          key: AWS_ACCESS_KEY_ID
-        secretAccessKey:
-          name: cnpg-ghp-backup-s3
-          key: AWS_SECRET_ACCESS_KEY
-      serverName: ghp
-      data:
-        compression: bzip2
-        jobs: 2
-      wal:
-        compression: zstd
-        maxParallel: 2
-  bootstrap:
-    initdb:
-      # No secret ref: CNPG mints the owner credentials and publishes them in the
-      # generated "postgres-app" Secret, which the Deployment reads to build the DSN.
-      database: ghp
-      encoding: UTF8
-      localeCType: C
-      localeCollate: C
-      owner: ghp
-  enablePDB: true
-  enableSuperuserAccess: false
-  failoverDelay: 0
-  imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
-  instances: 3
-  logLevel: info
-  maxSyncReplicas: 0
-  minSyncReplicas: 0
-  monitoring:
-    customQueriesConfigMap:
-      - key: queries
-        name: cnpg-default-monitoring
-    disableDefaultQueries: false
-    enablePodMonitor: false
-  postgresql:
-    parameters:
-      archive_mode: "on"
-      archive_timeout: 5min
-      dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
-      full_page_writes: "on"
-      log_destination: csvlog
-      log_directory: /controller/log
-      log_filename: postgres
-      log_rotation_age: "0"
-      log_rotation_size: "0"
-      log_truncate_on_rotation: "false"
-      logging_collector: "on"
-      max_connections: "200"
-      max_parallel_workers: "16"
-      max_replication_slots: "16"
-      max_worker_processes: "16"
-      shared_buffers: 128MB
-      shared_memory_type: mmap
-      ssl_max_protocol_version: TLSv1.3
-      ssl_min_protocol_version: TLSv1.3
-      wal_keep_size: 256MB
-      wal_level: logical
-      wal_log_hints: "on"
-      wal_receiver_timeout: 5s
-      wal_sender_timeout: 5s
-    syncReplicaElectionConstraint:
-      enabled: false
-  primaryUpdateMethod: restart
-  primaryUpdateStrategy: unsupervised
-  probes:
-    liveness:
-      isolationCheck:
-        connectionTimeout: 1000
-        enabled: true
-        requestTimeout: 1000
-  replicationSlots:
-    highAvailability:
-      enabled: true
-      slotPrefix: _cnpg_
-    synchronizeReplicas:
-      enabled: true
-    updateInterval: 30
-  resources:
-    limits:
-      cpu: 500m
-      memory: 512Mi
-    requests:
-      cpu: 50m
-      memory: 256Mi
-  smartShutdownTimeout: 180
-  startDelay: 3600
-  stopDelay: 1800
-  storage:
-    resizeInUseVolumes: true
-    size: 20Gi
-    storageClass: cephrbd-fast-delete
-  switchoverDelay: 3600
@@ -1,34 +0,0 @@
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: ghp-env
-  namespace: ghp
-data:
-  GHP_DATABASE_DRIVER: postgres
-  # ghp runs in plain-HTTP reverse-proxy mode: the traefik gateway terminates TLS
-  # for ghp.unkin.net and forwards cleartext to container :8080, where ghp SERVES
-  # the full app (mgmt UI + API) via GHP_SERVER_LISTEN.
-  #
-  # Do NOT set GHP_SERVER_HTTPS_LISTEN here. Any non-empty https_listen flips ghp
-  # into TLS-only mode (server.go Run(): hasTLS -> serveTLS): the app is served on
-  # :8443 and http_listen becomes a 308 http->https REDIRECT listener, while
-  # GHP_SERVER_LISTEN is ignored entirely. The gateway forwarding cleartext into
-  # that redirect listener on :8080 was the ghp.unkin.net -> ghp.unkin.net 308 loop.
-  #
-  # nonroot cannot bind <1024; listen high and remap in the Service.
-  GHP_SERVER_LISTEN: ":8080"
-  # Behind the TLS-terminating gateway: trust its X-Forwarded-* / Forwarded headers
-  # for scheme/host when generating absolute URLs (GHP_SERVER_BASE_URL is also set).
-  GHP_SERVER_TRUST_PROXY_HEADERS: "true"
-  GHP_METRICS_LISTEN: ":9136"
-  GHP_METRICS_ENABLED: "true"
-  GHP_SERVER_BASE_URL: https://ghp.unkin.net
-  GHP_SERVER_MANAGEMENT_HOST: ghp.unkin.net
-  # private_key key from the ghp-github-app Secret, mounted as a file.
-  GHP_GITHUB_PRIVATE_KEY_FILE: /etc/ghp/github-app/private_key
-  # cert-manager Certificate ghp-tls, mounted from the ghp-tls Secret.
-  GHP_TLS_CERT_FILE: /etc/ghp/tls/tls.crt
-  GHP_TLS_KEY_FILE: /etc/ghp/tls/tls.key
-  # PLACEHOLDER: set to Ben's GitHub username before ghp will admit an admin.
-  GHP_ADMINS: "neoloc"
@@ -1,162 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: ghp
-  namespace: ghp
-  annotations:
-    # Wave 2: serve only after the wave-1 migrate Job completes.
-    argocd.argoproj.io/sync-wave: "2"
-    configmap.reloader.stakater.com/auto: "true"
-    secret.reloader.stakater.com/reload: "ghp-github-app,ghp-app,ghp-tls,postgres-app"
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: ghp
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: ghp
-    spec:
-      serviceAccountName: default
-      automountServiceAccountToken: true
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        fsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: ghp
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/ghp:v0.20.0-unkin4
-          imagePullPolicy: IfNotPresent
-          # Drop the image's default --migrate so replicas never race migrations;
-          # schema is applied by the wave-1 migrate hook Job instead.
-          command: ["/ghp", "serve"]
-          ports:
-            - containerPort: 8443
-              name: https
-              protocol: TCP
-            - containerPort: 8080
-              name: http
-              protocol: TCP
-            - containerPort: 9136
-              name: metrics
-              protocol: TCP
-          envFrom:
-            - configMapRef:
-                name: ghp-env
-                optional: false
-          env:
-            # DSN assembled from the CNPG-generated postgres-app Secret; $(VAR)
-            # expansion resolves the two env entries defined above it.
-            - name: GHP_DB_USER
-              valueFrom:
-                secretKeyRef:
-                  name: postgres-app
-                  key: username
-            - name: GHP_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: postgres-app
-                  key: password
-            - name: GHP_DATABASE_DSN
-              value: "postgres://$(GHP_DB_USER):$(GHP_DB_PASSWORD)@postgres-rw.ghp.svc:5432/ghp?sslmode=require"
-            - name: GHP_GITHUB_APP_ID
-              valueFrom:
-                secretKeyRef:
-                  name: ghp-github-app
-                  key: app_id
-            - name: GHP_GITHUB_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: ghp-github-app
-                  key: client_id
-            - name: GHP_GITHUB_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: ghp-github-app
-                  key: client_secret
-            - name: GHP_ENCRYPTION_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: ghp-app
-                  key: encryption_key
-            # Static admin service token for machine callers (the Vault ghp
-            # secrets engine authenticates with it to mint scoped tokens).
-            # optional: ghp runs fine without it until Ben seeds `service_token`
-            # into kv/kubernetes/namespace/ghp/default/app; the ghp-app reloader
-            # annotation then rolls this Deployment to pick it up.
-            - name: GHP_AUTH_SERVICE_TOKENS
-              valueFrom:
-                secretKeyRef:
-                  name: ghp-app
-                  key: service_token
-                  optional: true
-          volumeMounts:
-            - name: github-app
-              mountPath: /etc/ghp/github-app
-              readOnly: true
-            - name: tls
-              mountPath: /etc/ghp/tls
-              readOnly: true
-            - name: tmp
-              mountPath: /tmp
-          livenessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /metrics
-              port: metrics
-              # Plain HTTP: ghp only serves metrics over TLS in TLS mode
-              # (hasTLS). In reverse-proxy/plain mode the metrics server is
-              # cleartext, so probe with HTTP.
-              scheme: HTTP
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 5
-          readinessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /metrics
-              port: metrics
-              # Plain HTTP: ghp only serves metrics over TLS in TLS mode
-              # (hasTLS). In reverse-proxy/plain mode the metrics server is
-              # cleartext, so probe with HTTP.
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 5
-            successThreshold: 1
-            timeoutSeconds: 5
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            limits:
-              cpu: "2"
-              memory: 2Gi
-            requests:
-              cpu: "1"
-              memory: 512Mi
-      volumes:
-        - name: github-app
-          secret:
-            secretName: ghp-github-app
-        - name: tls
-          secret:
-            secretName: ghp-tls
-        # Writable scratch: root FS is read-only. Disk-backed (not memory medium)
-        # so codeload tarball staging doesn't count against the pod memory limit.
-        - name: tmp
-          emptyDir:
-            sizeLimit: 2Gi
-      restartPolicy: Always
@@ -1,69 +0,0 @@
---
-# HTTPS front for ghp, served on two names via the internal Traefik:
-#   ghp.unkin.net              — canonical/primary (apex, bind-operator zone)
-#   ghp.k8s.syd1.au.unkin.net  — admin/internal route (external-dns k8s.syd1 zone)
-# The cert-manager annotations below make cert-manager mint the ghp-gateway-tls
-# Secret with CN ghp.unkin.net and a DNS SAN for each TLS listener hostname
-# automatically. This is a SEPARATE Secret from ghp-tls (certificate.yaml), which
-# carries the GitHub impersonation SANs and is mounted by ghp itself — the two
-# never share a Secret, so cert-manager does not fight over either.
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: ghp.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    # Only the k8s admin route is published by external-dns (it owns just the
-    # k8s.syd1.au.unkin.net zone). ghp.unkin.net lives in the apex zone and is
-    # served by the bind-operator DNSRecord — NOT managed here.
-    external-dns.alpha.kubernetes.io/hostname: ghp.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: ghp
-  namespace: ghp
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - name: http-primary
-      port: 80
-      protocol: HTTP
-      hostname: ghp.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-    - name: https-primary
-      port: 443
-      protocol: HTTPS
-      hostname: ghp.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-      tls:
-        mode: Terminate
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: ghp-gateway-tls
-    - name: http-admin
-      port: 80
-      protocol: HTTP
-      hostname: ghp.k8s.syd1.au.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-    - name: https-admin
-      port: 443
-      protocol: HTTPS
-      hostname: ghp.k8s.syd1.au.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-      tls:
-        mode: Terminate
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: ghp-gateway-tls
@@ -1,40 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: ghp-route
-  namespace: ghp
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  hostnames:
-    - ghp.unkin.net
-    - ghp.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: ghp
-      sectionName: http-primary
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: ghp
-      sectionName: http-admin
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: ghp
-      sectionName: https-primary
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: ghp
-      sectionName: https-admin
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: ghp
-          port: 80
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
@@ -1,19 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - configmap.yaml
-  - cnpg_cluster.yaml
-  - cnpg_backup.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-  - certificate.yaml
-  - deployment.yaml
-  - migrate-job.yaml
-  - service.yaml
-  - pdb.yaml
-  - vmservicescrape.yaml
-  - gateway.yaml
-  - httproute.yaml
@@ -1,78 +0,0 @@
---
-# Runs the schema migration once per sync, before the Deployment rolls, so the
-# serve replicas never race migrations. Deleted before each re-create so a new
-# image/version re-runs it.
-#
-# Sync-phase hook at wave 1 (NOT PreSync): the CNPG Cluster + generated
-# postgres-app Secret apply at wave 0 and ArgoCD waits for the Cluster to be
-# Healthy before starting wave 1, so on a fresh install Postgres exists before
-# migrate connects. (A PreSync hook would run before the Sync phase that creates
-# the DB, deadlocking the first install.)
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: ghp-migrate
-  namespace: ghp
-  annotations:
-    argocd.argoproj.io/hook: Sync
-    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
-    argocd.argoproj.io/sync-wave: "1"
-spec:
-  backoffLimit: 6
-  ttlSecondsAfterFinished: 600
-  template:
-    metadata:
-      labels:
-        app: ghp-migrate
-    spec:
-      serviceAccountName: default
-      automountServiceAccountToken: true
-      restartPolicy: Never
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        fsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: migrate
-          image: ghcr.io/goodtune/ghp:0.20.0
-          imagePullPolicy: IfNotPresent
-          command: ["/ghp", "migrate"]
-          env:
-            - name: GHP_DATABASE_DRIVER
-              value: postgres
-            - name: GHP_DB_USER
-              valueFrom:
-                secretKeyRef:
-                  name: postgres-app
-                  key: username
-            - name: GHP_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: postgres-app
-                  key: password
-            - name: GHP_DATABASE_DSN
-              value: "postgres://$(GHP_DB_USER):$(GHP_DB_PASSWORD)@postgres-rw.ghp.svc:5432/ghp?sslmode=require"
-          volumeMounts:
-            - name: tmp
-              mountPath: /tmp
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            limits:
-              cpu: "1"
-              memory: 512Mi
-            requests:
-              cpu: 250m
-              memory: 256Mi
-      volumes:
-        # Writable scratch: root FS is read-only, so give the migrator a /tmp.
-        - name: tmp
-          emptyDir:
-            sizeLimit: 256Mi
@@ -1,5 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ghp
@@ -1,13 +0,0 @@
---
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: ghp
-  namespace: ghp
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  minAvailable: 1
-  selector:
-    matchLabels:
-      app: ghp
@@ -1,29 +0,0 @@
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: ghp
-  namespace: ghp
-  labels:
-    app: ghp
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: https
-    - name: http
-      port: 80
-      protocol: TCP
-      targetPort: http
-    - name: metrics
-      port: 9136
-      protocol: TCP
-      targetPort: metrics
-  selector:
-    app: ghp
-  sessionAffinity: None
-  type: ClusterIP
@@ -1,20 +0,0 @@
---
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: ghp
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  allowedNamespaces:
-    - ghp
-  kubernetes:
-    audiences:
-      - vault
-    role: default
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default
@@ -1,44 +0,0 @@
---
-# GitHub App credentials (app_id, client_id, client_secret, private_key). Ben
-# populates kv/kubernetes/namespace/ghp/default/github-app via the runbook; the
-# default k8s role's templated policy already grants read here, so no
-# terraform-vault change is needed. VSO syncs it into the ghp-github-app Secret.
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: ghp-github-app
-  namespace: ghp
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  destination:
-    create: true
-    name: ghp-github-app
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/ghp/default/github-app
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
---
-# Application encryption key (encryption_key) from
-# kv/kubernetes/namespace/ghp/default/app.
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: ghp-app
-  namespace: ghp
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  destination:
-    create: true
-    name: ghp-app
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/ghp/default/app
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
@@ -1,21 +0,0 @@
---
-# Scrape ghp's Prometheus metrics endpoint. Picked up by the observability
-# VMAgent (selectAllByDefault). Estate uses VictoriaMetrics, so VMServiceScrape
-# rather than a prometheus-operator ServiceMonitor.
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VMServiceScrape
-metadata:
-  name: ghp
-  namespace: ghp
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  selector:
-    matchLabels:
-      app: ghp
-  endpoints:
-    - port: metrics
-      path: /metrics
-      # ghp runs in plain reverse-proxy mode (no GHP_SERVER_HTTPS_LISTEN), so the
-      # metrics server is cleartext HTTP rather than TLS. Scrape over http.
-      scheme: http
@@ -1,32 +0,0 @@
---
-# Second Ceph RGW (S3) bucket owned by the existing jellyfin backup user
-# (cnpg-jellyfin-backup, defined in cnpg_backup.yaml) — one user, two buckets:
-# the CNPG barman bucket plus this one, which k8up uses to hold restic backups
-# of the jellyfin-config PVC. The BucketAccess emits read-write S3 creds into a
-# Secret the k8up Schedule consumes.
-apiVersion: ceph.unkin.net/v1alpha1
-kind: Bucket
-metadata:
-  name: jellyfin-config-backup
-  namespace: jellyfin
-spec:
-  placementTarget: ec
-  bucketName: jellyfin-config-backup
-  ownerRef: cnpg-jellyfin-backup
-  versioning: false
-  tags:
-    app: jellyfin
-    purpose: config-backup
-  retainOnDelete: true
---
-apiVersion: ceph.unkin.net/v1alpha1
-kind: BucketAccess
-metadata:
-  name: jellyfin-config-backup
-  namespace: jellyfin
-spec:
-  bucketRef: jellyfin-config-backup
-  level: read-write
-  # Operator writes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (+ S3_ENDPOINT,
-  # BUCKET_NAME) into this Secret; the k8up Schedule reads the access keys.
-  secretName: jellyfin-config-backup-s3
@@ -1,45 +0,0 @@
---
-# Ceph RGW (S3) backup target for the jellyfin CNPG cluster, provisioned by the
-# in-estate cephrgw-operator: one dedicated bucket + owner user. CNPG reads the
-# S3 credential Secret from its own namespace.
-apiVersion: ceph.unkin.net/v1alpha1
-kind: ObjectStoreUser
-metadata:
-  name: cnpg-jellyfin-backup
-  namespace: jellyfin
-spec:
-  displayName: "CNPG backup owner (jellyfin)"
-  uid: cnpg-jellyfin-backup
-  maxBuckets: 5
-  secretName: cnpg-jellyfin-backup-s3
-  retainOnDelete: true
---
-apiVersion: ceph.unkin.net/v1alpha1
-kind: Bucket
-metadata:
-  name: cnpg-jellyfin
-  namespace: jellyfin
-spec:
-  placementTarget: ec
-  bucketName: cnpg-jellyfin
-  ownerRef: cnpg-jellyfin-backup
-  versioning: false
-  tags:
-    app: jellyfin
-    purpose: cnpg-backup
-  retainOnDelete: true
---
-# Nightly base backup on top of always-on WAL archiving. Scheduled off-peak and
-# staggered from the other CNPG clusters (6-field cron, seconds first).
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: cnpg-jellyfin-nightly
-  namespace: jellyfin
-spec:
-  schedule: "0 35 3 * * *"
-  immediate: false
-  backupOwnerReference: self
-  method: barmanObjectStore
-  cluster:
-    name: jellyfin-postgres
@@ -1,126 +0,0 @@
---
-# Main Jellyfin database. The jellyfin-ha fork's experimental EF Core provider
-# moves the entire Jellyfin DB (incl. library items) off SQLite into PostgreSQL,
-# which is what makes a shared-nothing multi-replica deployment possible. No
-# bootstrap secret is given, so CNPG generates the jellyfin-postgres-app secret
-# (username/password/dbname) that the StatefulSet composes its DSN from.
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: jellyfin-postgres
-  namespace: jellyfin
-spec:
-  # Exclude the operator-managed data PVCs (jellyfin-postgres-N) from the
-  # jellyfin-config k8up Schedule (skipWithoutAnnotation is false cluster-wide,
-  # so unannotated PVCs are swept in). Postgres has its own barmanObjectStore
-  # backup below; restic must not touch the raw RWO data volumes.
-  inheritedMetadata:
-    annotations:
-      k8up.io/backup: "false"
-  affinity:
-    podAntiAffinityType: preferred
-  backup:
-    retentionPolicy: 30d
-    barmanObjectStore:
-      # Dedicated per-cluster Ceph RGW bucket (cephrgw-operator provisions it).
-      destinationPath: s3://cnpg-jellyfin
-      endpointURL: https://s3.ceph.unkin.net
-      endpointCA:
-        name: vault-ca-cert
-        key: ca.crt
-      s3Credentials:
-        accessKeyId:
-          name: cnpg-jellyfin-backup-s3
-          key: AWS_ACCESS_KEY_ID
-        secretAccessKey:
-          name: cnpg-jellyfin-backup-s3
-          key: AWS_SECRET_ACCESS_KEY
-      serverName: jellyfin
-      data:
-        compression: bzip2
-        jobs: 2
-      wal:
-        compression: zstd
-        maxParallel: 2
-  bootstrap:
-    initdb:
-      database: jellyfin
-      encoding: UTF8
-      localeCType: C
-      localeCollate: C
-      owner: jellyfin
-  enablePDB: true
-  enableSuperuserAccess: false
-  failoverDelay: 0
-  # PG 17 — accepted by the fork's Npgsql/EF Core provider (needs PG14+); the
-  # provider generates its own migrations on first start.
-  imageName: ghcr.io/cloudnative-pg/postgresql:17-system-trixie
-  instances: 3
-  logLevel: info
-  maxSyncReplicas: 0
-  minSyncReplicas: 0
-  monitoring:
-    customQueriesConfigMap:
-      - key: queries
-        name: cnpg-default-monitoring
-    disableDefaultQueries: false
-    enablePodMonitor: false
-  postgresql:
-    parameters:
-      archive_mode: "on"
-      archive_timeout: 5min
-      dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
-      full_page_writes: "on"
-      log_destination: csvlog
-      log_directory: /controller/log
-      log_filename: postgres
-      log_rotation_age: "0"
-      log_rotation_size: "0"
-      log_truncate_on_rotation: "false"
-      logging_collector: "on"
-      max_connections: "200"
-      max_parallel_workers: "16"
-      max_replication_slots: "16"
-      max_worker_processes: "16"
-      shared_buffers: 128MB
-      shared_memory_type: mmap
-      ssl_max_protocol_version: TLSv1.3
-      ssl_min_protocol_version: TLSv1.3
-      wal_keep_size: 256MB
-      wal_level: logical
-      wal_log_hints: "on"
-      wal_receiver_timeout: 5s
-      wal_sender_timeout: 5s
-    syncReplicaElectionConstraint:
-      enabled: false
-  primaryUpdateMethod: restart
-  primaryUpdateStrategy: unsupervised
-  probes:
-    liveness:
-      isolationCheck:
-        connectionTimeout: 1000
-        enabled: true
-        requestTimeout: 1000
-  replicationSlots:
-    highAvailability:
-      enabled: true
-      slotPrefix: _cnpg_
-    synchronizeReplicas:
-      enabled: true
-    updateInterval: 30
-  resources:
-    limits:
-      cpu: "1"
-      memory: 1Gi
-    requests:
-      cpu: 50m
-      memory: 512Mi
-  smartShutdownTimeout: 180
-  startDelay: 3600
-  stopDelay: 1800
-  storage:
-    resizeInUseVolumes: true
-    size: 10Gi
-    storageClass: cephrbd-fast-delete
-  switchoverDelay: 3600
@@ -1,36 +0,0 @@
---
-# PgBouncer pooler in front of the jellyfin-postgres cluster. Jellyfin connects
-# here (jellyfin-postgres-pooler:5432) rather than the -rw service so EF Core's
-# connection churn is absorbed by the pool.
-apiVersion: postgresql.cnpg.io/v1
-kind: Pooler
-metadata:
-  name: jellyfin-postgres-pooler
-  namespace: jellyfin
-spec:
-  cluster:
-    name: jellyfin-postgres
-  instances: 2
-  pgbouncer:
-    parameters:
-      default_pool_size: "50"
-      max_client_conn: "200"
-    paused: false
-    poolMode: session
-  template:
-    metadata:
-      labels:
-        app: jellyfin-pooler
-    spec:
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchExpressions:
-                  - key: app
-                    operator: In
-                    values:
-                      - jellyfin-pooler
-              topologyKey: kubernetes.io/hostname
-      containers: []
-  type: rw
@@ -1,37 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: jellyfin.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: jellyfin.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: jellyfin
-  namespace: jellyfin
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: jellyfin.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: jellyfin.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: jellyfin-tls
-        mode: Terminate
@@ -1,49 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: http-redirect
-  namespace: jellyfin
-spec:
-  hostnames:
-    - jellyfin.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: jellyfin
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: jellyfin-route
-  namespace: jellyfin
-spec:
-  hostnames:
-    - jellyfin.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: jellyfin
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: jellyfin
-          port: 8096
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
@@ -1,25 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - cnpg_cluster.yaml
-  - cnpg_pooler.yaml
-  - cnpg_backup.yaml
-  - cephrgw-config-backup.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-  - schedule.yaml
-  - pvc-config.yaml
-  - pvc-transcode.yaml
-  - pv-media-tv.yaml
-  - pv-media-movies.yaml
-  - pvc-media-tv.yaml
-  - pvc-media-movies.yaml
-  - statefulset.yaml
-  - pdb.yaml
-  - service.yaml
-  - valkey.yaml
-  - gateway.yaml
-  - httproute.yaml
@@ -1,5 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: jellyfin
@@ -1,13 +0,0 @@
---
-# Keep at least one Jellyfin replica serving through voluntary disruptions
-# (node drains, rollouts) so active streams can fail over rather than drop.
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: jellyfin
-  namespace: jellyfin
-spec:
-  minAvailable: 1
-  selector:
-    matchLabels:
-      app: jellyfin
@@ -1,30 +0,0 @@
---
-# Static PV for the shared MOVIES CephFS subvolume. Same rootPath as arrstack's
-# movies PV so radarr writes and jellyfin reads the identical library tree; each
-# namespace gets its own PV (unique name + volumeHandle) pinned by claimRef.
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: jellyfin-media-movies
-spec:
-  capacity:
-    storage: 1Ti
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: ""
-  volumeMode: Filesystem
-  claimRef:
-    namespace: jellyfin
-    name: jellyfin-media-movies
-  csi:
-    driver: cephfs.csi.ceph.com
-    volumeHandle: jellyfin-media-movies-static
-    nodeStageSecretRef:
-      name: csi-cephfs-secret
-      namespace: csi-cephfs
-    volumeAttributes:
-      staticVolume: "true"
-      clusterID: cephfs_csi_ssd_ec_4_1
-      fsName: cephfs
-      rootPath: /volumes/csi_ssd_ec_4_1/media-movies/e95d8ace-c736-465a-acc3-0c3e46dcede9
@@ -1,30 +0,0 @@
---
-# Static PV for the shared TV CephFS subvolume. Same rootPath as arrstack's
-# TV PV so sonarr writes and jellyfin reads the identical library tree; each
-# namespace gets its own PV (unique name + volumeHandle) pinned by claimRef.
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: jellyfin-media-tv
-spec:
-  capacity:
-    storage: 1Ti
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: ""
-  volumeMode: Filesystem
-  claimRef:
-    namespace: jellyfin
-    name: jellyfin-media-tv
-  csi:
-    driver: cephfs.csi.ceph.com
-    volumeHandle: jellyfin-media-tv-static
-    nodeStageSecretRef:
-      name: csi-cephfs-secret
-      namespace: csi-cephfs
-    volumeAttributes:
-      staticVolume: "true"
-      clusterID: cephfs_csi_ssd_ec_4_1
-      fsName: cephfs
-      rootPath: /volumes/csi_ssd_ec_4_1/media-tv/4692957d-f5df-4f72-b9c9-56e4ee6d1333
@@ -1,17 +0,0 @@
---
-# Jellyfin config: metadata images, plugins, subtitles and config XML. Shared
-# ReadWriteMany across replicas (all pods read/write the same library metadata);
-# the main library DB now lives in PostgreSQL, not here. Retain — this is state.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-config
-  namespace: jellyfin
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 20Gi
-  storageClassName: cephfs-raid5-retain
-  volumeMode: Filesystem
@@ -1,24 +0,0 @@
---
-# Movie library, shared read-many across replicas. Statically bound to the
-# jellyfin-media-movies PV (shared CephFS subvolume also used by arrstack/radarr).
-# storageClassName "" + volumeName disables dynamic provisioning and binds the
-# pre-created static PV.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-media-movies
-  namespace: jellyfin
-  annotations:
-    # Exclude from the jellyfin-config k8up Schedule (skipWithoutAnnotation is
-    # false cluster-wide, so unannotated PVCs are swept in). Only jellyfin-config
-    # is backed up; the media library is not restic-backup material.
-    k8up.io/backup: "false"
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Ti
-  storageClassName: ""
-  volumeName: jellyfin-media-movies
-  volumeMode: Filesystem
@@ -1,24 +0,0 @@
---
-# TV library, shared read-many across replicas. Statically bound to the
-# jellyfin-media-tv PV (shared CephFS subvolume also used by arrstack/sonarr).
-# storageClassName "" + volumeName disables dynamic provisioning and binds the
-# pre-created static PV.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-media-tv
-  namespace: jellyfin
-  annotations:
-    # Exclude from the jellyfin-config k8up Schedule (skipWithoutAnnotation is
-    # false cluster-wide, so unannotated PVCs are swept in). Only jellyfin-config
-    # is backed up; the media library is not restic-backup material.
-    k8up.io/backup: "false"
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Ti
-  storageClassName: ""
-  volumeName: jellyfin-media-tv
-  volumeMode: Filesystem
@@ -1,23 +0,0 @@
---
-# Shared transcode scratch. ReadWriteMany is the hard requirement for the HA
-# fork: a taking-over pod must read the in-flight HLS segments written by the
-# pod it replaces. Scratch data (delete reclaim); raid5 avoids the raid6
-# double-parity write penalty on the many small HLS segment writes.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-transcode
-  namespace: jellyfin
-  annotations:
-    # Exclude from the jellyfin-config k8up Schedule (skipWithoutAnnotation is
-    # false cluster-wide, so unannotated PVCs are swept in). Transcode is RWX
-    # scratch — nothing to back up.
-    k8up.io/backup: "false"
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 100Gi
-  storageClassName: cephfs-raid5-delete
-  volumeMode: Filesystem
@@ -1,58 +0,0 @@
---
-# k8up Schedule: restic backups of the jellyfin-config PVC (library metadata,
-# plugins, config XML) to the dedicated Ceph RGW config-backup bucket. S3 creds
-# come from the cephrgw BucketAccess Secret (jellyfin-config-backup-s3); the
-# restic repo password comes from Vault via the jellyfin-k8up-restic Secret.
-#
-# s3.ceph.unkin.net presents the internal unkin.net CA, which the k8up/restic
-# image does not trust by default, so the reflected vault-ca-cert Secret is
-# mounted into every job pod and pointed at via backend.tlsOptions.caCert.
-apiVersion: k8up.io/v1
-kind: Schedule
-metadata:
-  name: jellyfin-config
-  namespace: jellyfin
-spec:
-  backend:
-    repoPasswordSecretRef:
-      name: jellyfin-k8up-restic
-      key: password
-    s3:
-      endpoint: https://s3.ceph.unkin.net
-      bucket: jellyfin-config-backup
-      accessKeyIDSecretRef:
-        name: jellyfin-config-backup-s3
-        key: AWS_ACCESS_KEY_ID
-      secretAccessKeySecretRef:
-        name: jellyfin-config-backup-s3
-        key: AWS_SECRET_ACCESS_KEY
-    tlsOptions:
-      caCert: /etc/k8up/ca/ca.crt
-    volumeMounts:
-      - name: vault-ca
-        mountPath: /etc/k8up/ca
-        readOnly: true
-  backup:
-    schedule: "0 2 * * *"
-    failedJobsHistoryLimit: 3
-    successfulJobsHistoryLimit: 3
-    volumes:
-      - name: vault-ca
-        secret:
-          secretName: vault-ca-cert
-  prune:
-    schedule: "0 3 * * 0"
-    retention:
-      keepDaily: 14
-      keepWeekly: 8
-      keepMonthly: 12
-    volumes:
-      - name: vault-ca
-        secret:
-          secretName: vault-ca-cert
-  check:
-    schedule: "0 4 * * 0"
-    volumes:
-      - name: vault-ca
-        secret:
-          secretName: vault-ca-cert
@@ -1,18 +0,0 @@
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: jellyfin
-  namespace: jellyfin
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 8096
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: jellyfin
-  # Pin each client to one replica to reduce transcode-session churn/takeover.
-  sessionAffinity: ClientIP
-  type: ClusterIP
@@ -1,245 +0,0 @@
---
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: jellyfin
-  namespace: jellyfin
-spec:
-  # HA: two replicas coordinate transcode session ownership through Valkey and
-  # resume each other's HLS segments off the shared RWX transcode PVC. Stable
-  # pod names (jellyfin-0/1) are the lease owner identity, hence StatefulSet.
-  replicas: 2
-  serviceName: jellyfin
-  podManagementPolicy: Parallel
-  updateStrategy:
-    type: RollingUpdate
-  selector:
-    matchLabels:
-      app: jellyfin
-  template:
-    metadata:
-      labels:
-        app: jellyfin
-    spec:
-      securityContext:
-        # Group-write the shared RWX volumes and grant the render/video groups so
-        # the runAsUser 1000 process can open the Intel DRI render node injected
-        # by the device plugin.
-        fsGroup: 1000
-        supplementalGroups:
-          - 44
-          - 105
-          - 109
-        seccompProfile:
-          type: RuntimeDefault
-      affinity:
-        # Spread the two replicas across nodes for node-level HA. Soft so a
-        # single-GPU-node cluster still schedules both (i915 has 4 shared slots).
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              podAffinityTerm:
-                labelSelector:
-                  matchLabels:
-                    app: jellyfin
-                topologyKey: kubernetes.io/hostname
-      initContainers:
-        # Seed the fork's PostgreSQL provider (database.xml) and Intel iGPU
-        # hardware transcode settings (encoding.xml) before Jellyfin starts.
-        # Runs as root to chown into the shared config volume; mirrors the fork
-        # Helm chart's inject-db-config. Each file is written only when absent so
-        # admin changes persisted to the shared RWX /config survive pod restarts.
-        - name: inject-config
-          image: busybox:1.37.0
-          command:
-            - sh
-            - -c
-            - |
-              mkdir -p /config/config
-              chown 1000:1000 /config/config
-              chmod 775 /config/config
-              if [ ! -e /config/config/database.xml ]; then
-                cat > /config/config/database.xml << 'DBEOF'
-              <?xml version="1.0" encoding="utf-8"?>
-              <DatabaseConfigurationOptions>
-                <DatabaseType>Jellyfin-PostgreSQL</DatabaseType>
-                <LockingBehavior>NoLock</LockingBehavior>
-              </DatabaseConfigurationOptions>
-              DBEOF
-                chown 1000:1000 /config/config/database.xml
-                chmod 664 /config/config/database.xml
-              fi
-              # VAAPI on the Intel render node the device plugin injects
-              # (/dev/dri/renderD128 — ffmpeg's default DRM node, reachable via
-              # the render/video supplementalGroups). Without this the attached
-              # iGPU is idle and every transcode runs in software. Omitted
-              # elements fall back to the fork's EncodingOptions defaults.
-              if [ ! -e /config/config/encoding.xml ]; then
-                cat > /config/config/encoding.xml << 'ENCEOF'
-              <?xml version="1.0" encoding="utf-8"?>
-              <EncodingOptions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
-                <EncodingThreadCount>-1</EncodingThreadCount>
-                <HardwareAccelerationType>vaapi</HardwareAccelerationType>
-                <VaapiDevice>/dev/dri/renderD128</VaapiDevice>
-                <EnableHardwareEncoding>true</EnableHardwareEncoding>
-                <AllowHevcEncoding>true</AllowHevcEncoding>
-                <AllowAv1Encoding>false</AllowAv1Encoding>
-                <EnableIntelLowPowerH264HwEncoder>false</EnableIntelLowPowerH264HwEncoder>
-                <EnableIntelLowPowerHevcHwEncoder>false</EnableIntelLowPowerHevcHwEncoder>
-                <EnableTonemapping>false</EnableTonemapping>
-                <EnableVppTonemapping>false</EnableVppTonemapping>
-                <HardwareDecodingCodecs>
-                  <string>h264</string>
-                  <string>hevc</string>
-                  <string>vc1</string>
-                  <string>vp9</string>
-                </HardwareDecodingCodecs>
-              </EncodingOptions>
-              ENCEOF
-                chown 1000:1000 /config/config/encoding.xml
-                chmod 664 /config/config/encoding.xml
-              fi
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-            limits:
-              cpu: 100m
-              memory: 64Mi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-      containers:
-        - name: jellyfin
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.1.3
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 8096
-              protocol: TCP
-          env:
-            # Pod identity for the Valkey transcode lease owner. The fork reads
-            # JELLYFIN_INSTANCE_ID (falling back to MachineName); the stable
-            # StatefulSet pod name gives each replica a unique lease identity so
-            # takeover can target a dead replica. JELLYFIN_HA_POD_NAME is set for
-            # parity with the fork Helm chart (nothing currently reads it).
-            - name: JELLYFIN_INSTANCE_ID
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: JELLYFIN_HA_POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            # Multiple replicas must not each answer UDP auto-discovery.
-            - name: JELLYFIN_Network__AutoDiscovery
-              value: "false"
-            # Config dir must differ from the data root (Jellyfin sanity check).
-            - name: JELLYFIN_CONFIG_DIR
-              value: /config/config
-            # Distributed transcode session store (jellyfin-ha additions).
-            - name: Jellyfin__TranscodeStore__RedisConnectionString
-              value: "valkey-jellyfin-valkey:6379,abortConnect=false"
-            - name: Jellyfin__TranscodeStore__LeaseDurationSeconds
-              value: "30"
-            # PostgreSQL main DB via the CNPG-generated app secret, routed through
-            # the PgBouncer pooler. Composed with $(VAR) expansion so the password
-            # is never rendered into the manifest; CNPG passwords are URL-safe.
-            - name: PGUSER
-              valueFrom:
-                secretKeyRef:
-                  name: jellyfin-postgres-app
-                  key: username
-            - name: PGPASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: jellyfin-postgres-app
-                  key: password
-            - name: PGDB
-              valueFrom:
-                secretKeyRef:
-                  name: jellyfin-postgres-app
-                  key: dbname
-            - name: POSTGRES_CONNECTION_STRING
-              value: "postgresql://$(PGUSER):$(PGPASSWORD)@jellyfin-postgres-pooler:5432/$(PGDB)"
-            - name: DATABASE_URL
-              value: "postgresql://$(PGUSER):$(PGPASSWORD)@jellyfin-postgres-pooler:5432/$(PGDB)"
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: "1"
-              memory: 1Gi
-              gpu.intel.com/i915: "1"
-            limits:
-              cpu: "4"
-              memory: 6Gi
-              # Intel iGPU (QSV/VA-API) slot. Requesting it pins the pod to a
-              # GPU-labelled node and injects /dev/dri/renderD* automatically, so
-              # no /dev/dri hostPath or privileged container is needed. VA-API is
-              # pre-enabled via the seeded encoding.xml (see inject-config), so
-              # transcodes use the iGPU on first boot with no manual UI step.
-              gpu.intel.com/i915: "1"
-          securityContext:
-            runAsUser: 1000
-            runAsGroup: 1000
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: transcode
-              # Fork's real transcode temp path. RWX so a surviving pod reads the
-              # in-flight .ts/.m3u8 segments of the pod it takes over. A per-pod
-              # volume here silently breaks HA takeover.
-              mountPath: /config/transcodes
-            - name: cache
-              mountPath: /cache
-            - name: media-tv
-              mountPath: /media/tv
-              readOnly: true
-            - name: media-movies
-              mountPath: /media/movies
-              readOnly: true
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: jellyfin-config
-        - name: transcode
-          persistentVolumeClaim:
-            claimName: jellyfin-transcode
-        - name: media-tv
-          persistentVolumeClaim:
-            claimName: jellyfin-media-tv
-        - name: media-movies
-          persistentVolumeClaim:
-            claimName: jellyfin-media-movies
-  volumeClaimTemplates:
-    # Per-pod scratch cache — RWO, disposable, one PVC per replica.
-    - metadata:
-        name: cache
-        annotations:
-          # Exclude the per-pod cache PVCs from the jellyfin-config k8up Schedule
-          # (skipWithoutAnnotation is false cluster-wide). Cache is disposable and
-          # RWO — it would also fail to mount into the backup pod while in use.
-          k8up.io/backup: "false"
-      spec:
-        accessModes:
-          - ReadWriteOnce
-        resources:
-          requests:
-            storage: 30Gi
-        storageClassName: cephrbd-fast-delete
-        volumeMode: Filesystem
@@ -1,43 +0,0 @@
---
-# HA Valkey managed by valkey-operator as Jellyfin's distributed transcode-session
-# store. shards:1 + replicas:2 is one primary with two replicas in a single shard
-# group (three ValkeyNodes total): losing the primary triggers an automatic
-# failover to a replica, so a node/pod loss no longer drops the shared transcode
-# lease state the two Jellyfin replicas coordinate through. The operator always
-# runs Valkey cluster-mode-enabled with protected-mode off and leaves the built-in
-# `default` user passwordless, so clients connect with no auth/TLS (parity with the
-# old open redis); StackExchange.Redis seeds off the single headless service and
-# auto-discovers the topology plus failovers, so the connection string is
-# unchanged. scheduling.node.spread.shard:Required renders pod anti-affinity that
-# keeps the three nodes on distinct hosts (kubernetes.io/hostname), so one host
-# loss removes at most one node. podDisruptionBudget.mode:Cluster lets the operator
-# manage a quorum-aware PDB. Persistence stays omitted so /data is an emptyDir:
-# lease state is ephemeral (30s TTLs), replication+failover already provide
-# redundancy and a replaced node re-syncs from the primary, and an operator-managed
-# PVC cannot carry the k8up.io/backup:"false" annotation the namespace's
-# cluster-wide k8up Schedule needs to skip in-use RWO volumes.
-apiVersion: valkey.io/v1alpha1
-kind: ValkeyCluster
-metadata:
-  name: jellyfin-valkey
-  namespace: jellyfin
-spec:
-  shards: 1
-  replicas: 2
-  image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/valkey/valkey:9.0.0
-  exporter:
-    enabled: false
-  scheduling:
-    node:
-      spread:
-        shard:
-          mode: Required
-  podDisruptionBudget:
-    mode: Cluster
-  resources:
-    requests:
-      cpu: 50m
-      memory: 128Mi
-    limits:
-      cpu: 500m
-      memory: 512Mi
@@ -1,20 +0,0 @@
---
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: jellyfin
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  allowedNamespaces:
-    - jellyfin
-  kubernetes:
-    audiences:
-      - vault
-    role: default
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default
@@ -1,24 +0,0 @@
---
-# restic repository password for the k8up jellyfin-config backups. Seeded at
-# kv/kubernetes/namespace/jellyfin/default/k8up-restic (key: password); the
-# default k8s role's templated policy already grants read here, so no
-# terraform-vault change is needed. VSO syncs it into the jellyfin-k8up-restic
-# Secret that the Schedule references via backend.repoPasswordSecretRef.
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: jellyfin-k8up-restic
-  namespace: jellyfin
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  destination:
-    create: true
-    name: jellyfin-k8up-restic
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/jellyfin/default/k8up-restic
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
@@ -1,5 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: k8up-system
@@ -19,13 +19,7 @@ spec:
  type: kv-v2
  vaultAuthRef: default
 ---
-# Config secret. Keys:
-#   secret_key         : Django SECRET_KEY (50+ random chars). One-time Vault seed.
-#   api_token_peppers  : JSON object {"1": "<50+ char random>"} used to HMAC-hash
-#                        v2 API tokens. One-time Vault seed — rotating a pepper
-#                        invalidates existing v2 tokens, so set it once.
-# VSO syncs every key at the path into the destination Secret, and the NetBox
-# chart mounts both keys from it (existingSecret) — no explicit key mapping needed.
+# Django SECRET_KEY (key: secret_key). One-time Vault seed.
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
 metadata:
@@ -4,8 +4,6 @@ metadata:
  annotations:
    configmap.reloader.stakater.com/auto: "true"
    secret.reloader.stakater.com/reload: "vault-ca-cert"
-    # Replace clears the stale, API-server-defaulted spec.strategy.rollingUpdate that SSA cannot drop, which otherwise makes Recreate invalid.
-    argocd.argoproj.io/sync-options: Replace=true
  labels:
    app.kubernetes.io/component: puppetserver
    app.kubernetes.io/instance: puppetserver
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
@@ -1,5 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: valkey-operator-system
@@ -7,12 +7,7 @@ resources:
  - cnpg_cluster.yaml
  - cnpg_backup.yaml
  - cnpg_pooler.yaml
-  - serviceaccount_arrproxy_ci.yaml
-  - serviceaccount_autobackup_operator_ci.yaml
-  - serviceaccount_ghp.yaml
  - serviceaccount_kea_operator_ci.yaml
-  - serviceaccount_plugin_docker_buildx.yaml
-  - serviceaccount_jellyfin_ha_src.yaml
  - serviceaccount_terraform_artifactapi.yaml
  - serviceaccount_terraform_authentik.yaml
  - serviceaccount_terraform_enc.yaml
@@ -1,6 +0,0 @@
---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: arrproxy-ci
-  namespace: woodpecker
@@ -1,6 +0,0 @@
---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: autobackup-operator-ci
-  namespace: woodpecker
@@ -1,6 +0,0 @@
---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: ghp
-  namespace: woodpecker
@@ -1,6 +0,0 @@
---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: jellyfin-ha-src
-  namespace: woodpecker
--- a/Show More
+++ b/Show More