Give the puppetserver compilers the Vault cert helpers (#482 )

profiles::pki::vault and profiles::ssh::sign shell out to /usr/local/bin/certmanager and /usr/local/bin/sshsignhost from generate() during catalog compilation. Neither binary exists in the compiler image, so every node using them fails to compile. - install certmanager v0.2.0 and sshsignhost v0.1.0 onto the shared bin volume with sha256 verification - wrap both at /usr/local/bin from a pre-default entrypoint hook, failing startup loudly if either is missing - mount read-only Vault configs for both: kubernetes auth on k8s/au/syd1, internal CA verified rather than skipped Reviewed-on: #482 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
Bump jellyfin-ha to v0.4.0 (#483 )
2026-09-24 21:15:09 +10:00 · 2026-09-22 22:57:06 +10:00 · 2026-09-20 14:02:48 +10:00 · 2026-09-20 00:53:47 +10:00 · 2026-09-19 17:32:31 +10:00 · 2026-09-19 16:10:30 +10:00
190 changed files with 4101 additions and 890 deletions
@@ -5,9 +5,12 @@ metadata:
  name: arrproxy-api
  namespace: arrstack
  annotations:
-    # Wave 2: serve only after the wave-1 migrate Job completes.
+    # Wave 2: start only after the wave-0 CNPG Cluster and VSO-synced Secrets
+    # exist. The api self-migrates at startup under a Postgres advisory lock and
+    # holds /readyz until the schema is current, so no migration ordering is needed.
    argocd.argoproj.io/sync-wave: "2"
-    secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-admin-token,arrproxy-db-app,sonarr-apikey,radarr-apikey,prowlarr-apikey"
+    secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-admin-token,arrproxy-db-app,sonarr-adult-apikey,radarr-adult-apikey,sonarr-kids-apikey,radarr-kids-apikey"
+    configmap.reloader.stakater.com/reload: "arrproxy-tiers"
 spec:
  replicas: 2
  selector:
@@ -33,7 +36,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.3.1
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.6.1
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8080
@@ -49,11 +52,18 @@ spec:
            # reaches this upstream) so group-based authorization works.
            - name: ARRPROXY_GROUPS_HEADER
              value: X-Forwarded-Groups
-            # Real per-app *arr keys, projected one file per app under this dir
-            # (sourced from the existing <app>-apikey Secrets). The api injects
-            # them server-side and redacts them from every proxied response.
+            # Real per-app *arr keys, projected one file per app under a per-tier
+            # subdir (<keyDir>/<app>) matching the tiers file: adult/{sonarr,radarr}
+            # and kids/{sonarr,radarr}. Sourced from the same <instance>-apikey
+            # Secrets the *arr Deployments consume. The api injects them server-side
+            # and redacts them from every proxied response.
            - name: ARRPROXY_KEYS_DIR
              value: /etc/arrproxy/keys
+            # Tier topology (fafflix/cheeztv): upstreams, route hashes, key subdirs
+            # and group grants. Legacy unprefixed routes are retired in the file
+            # (legacyRoutes:false); see arrproxy-tiers ConfigMap.
+            - name: ARRPROXY_TIERS_FILE
+              value: /etc/arrproxy/tiers/tiers.json
            - name: ARRPROXY_PEPPER
              valueFrom:
                secretKeyRef:
@@ -86,6 +96,9 @@ spec:
            - name: arr-keys
              mountPath: /etc/arrproxy/keys
              readOnly: true
+            - name: tiers
+              mountPath: /etc/arrproxy/tiers
+              readOnly: true
            - name: tmp
              mountPath: /tmp
          livenessProbe:
@@ -118,27 +131,37 @@ spec:
              cpu: "1"
              memory: 512Mi
      volumes:
-        # Real *arr API keys, one file per app named exactly <app> so the api
-        # reads /etc/arrproxy/keys/{sonarr,radarr,prowlarr}. Reuses the same
-        # <app>-apikey Secrets the *arr Deployments already consume.
+        # Real per-tier *arr API keys, projected as <keyDir>/<app> so the api
+        # reads /etc/arrproxy/keys/{adult,kids}/{sonarr,radarr} (matching the
+        # tiers file keyDir). Reuses the same <instance>-apikey Secrets the *arr
+        # Deployments already consume (seeded by their VaultStaticSecrets).
        - name: arr-keys
          projected:
            sources:
              - secret:
-                  name: sonarr-apikey
+                  name: sonarr-adult-apikey
                  items:
                    - key: apitoken
-                      path: sonarr
+                      path: adult/sonarr
              - secret:
-                  name: radarr-apikey
+                  name: radarr-adult-apikey
                  items:
                    - key: apitoken
-                      path: radarr
+                      path: adult/radarr
              - secret:
-                  name: prowlarr-apikey
+                  name: sonarr-kids-apikey
                  items:
                    - key: apitoken
-                      path: prowlarr
+                      path: kids/sonarr
+              - secret:
+                  name: radarr-kids-apikey
+                  items:
+                    - key: apitoken
+                      path: kids/radarr
+        # Tier topology JSON (ARRPROXY_TIERS_FILE).
+        - name: tiers
+          configMap:
+            name: arrproxy-tiers
        - name: tmp
          emptyDir:
            sizeLimit: 64Mi
@@ -1,9 +1,11 @@
 ---
 # External (DMZ) front for the arrstack, served on arrstack.unkin.net via the
-# external Traefik (LB VIP 198.18.199.0). cert-manager mints arrproxy-gateway-tls
-# (CN arrstack.unkin.net) off the internal Vault-PKI CA. The apex arrstack.unkin.net
-# A record lives in the bind-operator unkin.net zone (bind-internal/authoritative),
-# NOT external-dns, so no external-dns annotation here.
+# external Traefik (LB VIP 198.18.199.0). The apex arrstack.unkin.net A record
+# lives in the bind-operator unkin.net zone (bind-internal/authoritative), NOT
+# external-dns, so no external-dns annotation here. Public TLS is terminated with
+# the real Let's Encrypt *.unkin.net wildcard, centrally minted once in the
+# cert-manager namespace (Certificate wildcard-unkin-net) and reflected into this
+# namespace by the emberstack reflector as wildcard-unkin-net-tls, not Vault PKI.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -11,9 +13,6 @@ metadata:
    traefik.io/instance: external
  annotations:
    argocd.argoproj.io/sync-wave: "2"
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: arrstack.unkin.net
-    cert-manager.io/private-key-size: "4096"
  name: arrproxy
  namespace: arrstack
 spec:
@@ -38,4 +37,4 @@ spec:
        certificateRefs:
          - group: ""
            kind: Secret
-            name: arrproxy-gateway-tls
+            name: wildcard-unkin-net-tls
@@ -5,9 +5,8 @@ kind: Kustomization
 resources:
  - cnpg_cluster.yaml
  - cnpg_backup.yaml
-  - migrations-configmap.yaml
-  - migrate-job.yaml
  - vaultstaticsecret.yaml
+  - tiers-configmap.yaml
  - oauth2-proxy-configmap.yaml
  - oauth2-proxy-deployment.yaml
  - api-deployment.yaml
@@ -1,92 +0,0 @@
---
-# Applies the arrproxy schema once per sync, before the api rolls, so the serve
-# replicas never race migrations (arrproxy-api does not self-migrate). Runs as the
-# CNPG-minted app user so the tokens table is owned by that role.
-#
-# Sync-phase hook at wave 1 (NOT PreSync): the CNPG Cluster + generated
-# arrproxy-db-app Secret apply at wave 0 and ArgoCD waits for the Cluster to be
-# Healthy before starting wave 1, so Postgres exists before migrate connects.
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: arrproxy-migrate
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/hook: Sync
-    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
-    argocd.argoproj.io/sync-wave: "1"
-spec:
-  backoffLimit: 6
-  ttlSecondsAfterFinished: 600
-  template:
-    metadata:
-      labels:
-        app: arrproxy-migrate
-    spec:
-      serviceAccountName: default
-      automountServiceAccountToken: false
-      restartPolicy: Never
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        fsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: migrate
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:18-alpine
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: HOME
-              value: /tmp
-            - name: PGUSER
-              valueFrom:
-                secretKeyRef:
-                  name: arrproxy-db-app
-                  key: username
-            - name: PGPASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: arrproxy-db-app
-                  key: password
-            - name: PGHOST
-              value: arrproxy-db-rw.arrstack.svc.cluster.local
-            - name: PGPORT
-              value: "5432"
-            - name: PGDATABASE
-              value: arrproxy
-            - name: PGSSLMODE
-              value: require
-          command:
-            - psql
-            - -v
-            - ON_ERROR_STOP=1
-            - -f
-            - /migrations/0001_init.sql
-          volumeMounts:
-            - name: migrations
-              mountPath: /migrations
-              readOnly: true
-            - name: tmp
-              mountPath: /tmp
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 100m
-              memory: 128Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-      volumes:
-        - name: migrations
-          configMap:
-            name: arrproxy-migrations
-        - name: tmp
-          emptyDir:
-            sizeLimit: 64Mi
@@ -1,29 +0,0 @@
---
-# arrproxy schema, mirrored from the arrproxy repo migrations/0001_init.sql
-# (v0.1.0). arrproxy-api does NOT self-migrate, so the wave-1 migrate Job applies
-# this once per sync as the app user. Keep in sync with the repo on schema bumps.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: arrproxy-migrations
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-data:
-  0001_init.sql: |
-    -- arrproxy token store. Only token hashes are persisted; plaintext is shown
-    -- once at mint time and never recoverable.
-    CREATE TABLE IF NOT EXISTS tokens (
-        id           TEXT PRIMARY KEY,
-        subject      TEXT        NOT NULL,
-        label        TEXT        NOT NULL DEFAULT '',
-        token_hash   TEXT        NOT NULL UNIQUE,
-        apps         TEXT[]      NOT NULL DEFAULT '{}',
-        created_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
-        expires_at   TIMESTAMPTZ,
-        disabled     BOOLEAN     NOT NULL DEFAULT false,
-        last_used_at TIMESTAMPTZ
-    );
-
-    CREATE INDEX IF NOT EXISTS tokens_subject_idx ON tokens (subject);
-    CREATE INDEX IF NOT EXISTS tokens_token_hash_idx ON tokens (token_hash);
@@ -21,9 +21,11 @@ data:
  # application (terraform-authentik PR #18).
  OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/arrstack/"
  OAUTH2_PROXY_REDIRECT_URL: "https://arrstack.unkin.net/oauth2/callback"
-  # Longest-prefix wins: /api and /<app> go to arrproxy-api, everything else
-  # (the SPA + static assets) to arrproxy-ui.
-  OAUTH2_PROXY_UPSTREAMS: "http://arrproxy-ui.arrstack.svc.cluster.local:8080/,http://arrproxy-api.arrstack.svc.cluster.local:8080/api/,http://arrproxy-api.arrstack.svc.cluster.local:8080/sonarr/,http://arrproxy-api.arrstack.svc.cluster.local:8080/radarr/,http://arrproxy-api.arrstack.svc.cluster.local:8080/prowlarr/"
+  # Longest-prefix wins: /api and the per-tier hash routes (/3aa168, /3df803) go
+  # to arrproxy-api, everything else (the SPA + static assets) to arrproxy-ui.
+  # Tier routes carry /<hash>/<app>/...; the bare /sonarr /radarr /prowlarr
+  # upstreams are retired (legacy routes off; prowlarr is served directly).
+  OAUTH2_PROXY_UPSTREAMS: "http://arrproxy-ui.arrstack.svc.cluster.local:8080/,http://arrproxy-api.arrstack.svc.cluster.local:8080/api/,http://arrproxy-api.arrstack.svc.cluster.local:8080/3aa168/,http://arrproxy-api.arrstack.svc.cluster.local:8080/3df803/"
  OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
  # Populate session.Groups from the Authentik ak_groups claim; pass-user-headers
  # then emits it as a single comma-joined X-Forwarded-Groups header.
@@ -33,14 +35,16 @@ data:
  # set-xauthrequest is intentionally NOT set -- it only populates auth_request
  # *response* headers, which never reach an --upstreams-proxied backend.
  OAUTH2_PROXY_PASS_USER_HEADERS: "true"
-  # Bypass auth for the *arr proxy API (/<app>/api...) and the machine-mint
-  # admin route (/api/admin/...). The first matches /sonarr/api; the second
-  # matches /api/admin/ only -- both routed to the arrproxy-api upstream by the
-  # catch-all /api/ prefix above. /api/admin/ is protected by arrproxy's OWN
-  # ARRPROXY_ADMIN_TOKEN bearer (OpenBao on the VMs reaches it via the ingress),
-  # so it is intentionally oauth-skipped. /api/tokens and /api/me are NOT
-  # matched and stay oauth-authenticated.
-  OAUTH2_PROXY_SKIP_AUTH_REGEX: "^/[^/]+/api,^/api/admin/"
+  # Bypass auth for the tier *arr proxy API (/<hash>/<app>/api...) and the
+  # machine-mint admin route (/api/admin/...). The first matches
+  # /3aa168/sonarr/api (two path segments before /api, since tier routes are
+  # hash-prefixed); the second matches /api/admin/ only -- both routed to the
+  # arrproxy-api upstream by the tier and catch-all /api/ prefixes above.
+  # /api/admin/ is protected by arrproxy's OWN ARRPROXY_ADMIN_TOKEN bearer
+  # (OpenBao on the VMs reaches it via the ingress), so it is intentionally
+  # oauth-skipped. /api/tokens and /api/me are NOT matched and stay
+  # oauth-authenticated.
+  OAUTH2_PROXY_SKIP_AUTH_REGEX: "^/[^/]+/[^/]+/api,^/api/admin/"
  OAUTH2_PROXY_EMAIL_DOMAINS: "*"
  # Authentik hardcodes email_verified=false in the id_token; without this
  # oauth2-proxy rejects the session ("email ... isn't verified") -> 500 on
@@ -35,7 +35,7 @@ spec:
        # identity.unkin.net serves a Vault-PKI cert; combine the system roots
        # with the internal CA so oauth2-proxy's OIDC HTTP client trusts it.
        - name: combine-certs
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3
+          image: docker.io/library/alpine:3
          imagePullPolicy: IfNotPresent
          command:
            - sh
@@ -0,0 +1,53 @@
+---
+# arrproxy v0.4.0 tier topology (ARRPROXY_TIERS_FILE). Two isolated instance
+# tiers, each with its own *arr backends, real-key subdir, and group grants:
+#   fafflix (adult, /3aa168/*) and cheeztv (kids, /3df803/*).
+# arrproxy strips the /<hash> route prefix and proxies "/<app>/..." upstream, so
+# each app's upstream URL carries the "/<hash>" path segment: the joined upstream
+# path (/3aa168/sonarr/...) then matches the *arr's own UrlBase (/3aa168/sonarr).
+# Access: the adult group reaches BOTH tiers with any method; the kids group
+# reaches ONLY the cheeztv tier and only GET/HEAD. Groups arrive on the
+# hierarchical Authentik ak_groups claim, forwarded by oauth2-proxy as
+# X-Forwarded-Groups. Legacy unprefixed routes are retired (legacyRoutes:false);
+# the old bare sonarr/radarr Services no longer exist.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: arrproxy-tiers
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+data:
+  tiers.json: |
+    {
+      "legacyTier": "fafflix",
+      "legacyRoutes": false,
+      "tiers": [
+        {
+          "name": "fafflix",
+          "hash": "3aa168",
+          "keyDir": "adult",
+          "grants": [
+            { "group": "akP-media-fafflix" }
+          ],
+          "apps": [
+            { "name": "sonarr", "upstream": "http://sonarr-adult.arrstack.svc.cluster.local:8989/3aa168", "urlBase": "/3aa168/sonarr" },
+            { "name": "radarr", "upstream": "http://radarr-adult.arrstack.svc.cluster.local:7878/3aa168", "urlBase": "/3aa168/radarr" }
+          ]
+        },
+        {
+          "name": "cheeztv",
+          "hash": "3df803",
+          "keyDir": "kids",
+          "readOnly": true,
+          "grants": [
+            { "group": "akP-media-fafflix" },
+            { "group": "akP-media-cheeztv", "methods": ["GET", "HEAD"] }
+          ],
+          "apps": [
+            { "name": "sonarr", "upstream": "http://sonarr-kids.arrstack.svc.cluster.local:8989/3df803", "urlBase": "/3df803/sonarr" },
+            { "name": "radarr", "upstream": "http://radarr-kids.arrstack.svc.cluster.local:7878/3df803", "urlBase": "/3df803/radarr" }
+          ]
+        }
+      ]
+    }
@@ -31,7 +31,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: ui
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-ui:v0.3.1
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-ui:v0.6.1
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8080
@@ -8,19 +8,22 @@ resources:
  - pv-media-tv.yaml
  - pv-media-movies.yaml
  - pv-mediafs.yaml
+  - pv-mediastore.yaml
  - pvc-media-tv.yaml
  - pvc-media-movies.yaml
  - pvc-mediafs.yaml
+  - pvc-mediastore.yaml
+  - mediastore-bootstrap-job.yaml
  - media-bucket.yaml
  - backups-bucket.yaml
  - postgres
  - valkey
-  - sonarr
-  - radarr
  - prowlarr
-  - nzbget
  - sonarr-kids
  - radarr-kids
  - nzbget-kids
+  - sonarr-adult
+  - radarr-adult
+  - nzbget-adult
  - arrproxy
  - mediamover
@@ -0,0 +1,74 @@
+---
+# Seeds the directory skeleton on the freshly created mediastore subvolume so
+# the arrs, nzbget and both jellyfins mount subPaths that already exist and are
+# owned by uid/gid 1000 (the uid every arrstack media pod runs as). mkdir -p is
+# idempotent, so re-running it on every sync is harmless and self-heals a tree
+# someone deleted by hand.
+#
+# Sync hook with BeforeHookCreation delete: ArgoCD replaces the completed Job
+# each sync instead of failing on the immutable pod template. No sync-wave is
+# needed -- the PVC applies in the same wave and the pod simply stays Pending
+# until it binds.
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: mediastore-bootstrap
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+spec:
+  backoffLimit: 6
+  ttlSecondsAfterFinished: 600
+  template:
+    metadata:
+      labels:
+        app: mediastore-bootstrap
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: mkdir
+          image: docker.io/library/alpine:3
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+            - |
+              set -eu
+              mkdir -p \
+                /media/fafflix/tvseries \
+                /media/fafflix/movies \
+                /media/cheeztv/tvseries \
+                /media/cheeztv/movies \
+                /media/nzbget/downloads/complete
+              ls -la /media
+          volumeMounts:
+            - name: mediastore
+              mountPath: /media
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+      volumes:
+        - name: mediastore
+          persistentVolumeClaim:
+            claimName: mediastore
@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: nzbget
+  name: nzbget-adult
  namespace: arrstack
 spec:
  replicas: 1
@@ -11,25 +11,25 @@ spec:
    type: Recreate
  selector:
    matchLabels:
-      app: nzbget
+      app: nzbget-adult
  template:
    metadata:
      labels:
-        app: nzbget
+        app: nzbget-adult
    spec:
      securityContext:
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
      initContainers:
-        # Seed download layout onto the shared media PVCs (not /config or an
-        # emptyDir) so completed downloads land beside the arr libraries and
-        # imports are same-filesystem hardlink moves. Reuses the image's own
-        # template (inherits correct WebDir/ConfigTemplate) and appends the
-        # path/category overrides once; nzbget honours the last value for a
-        # repeated option, and the grep guard keeps re-runs idempotent so admin
-        # UI edits to the persisted /config/nzbget.conf survive restarts.
+        # Seed download layout onto the adult media subtrees (not /config or an
+        # emptyDir) so completed adult downloads land beside the adult arr libraries
+        # and imports are same-filesystem hardlink moves. The media mounts use the
+        # tvshows/adult and movies/adult subPaths, so the in-container paths match
+        # the kids nzbget while the data stays scoped to the adult subtree. Reuses
+        # the image's own template and appends the path/category overrides once;
+        # the grep guard keeps re-runs idempotent so admin UI edits survive.
        - name: seed-config
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/nzbget:version-v26.2
+          image: docker.io/linuxserver/nzbget:version-v26.2
          command:
            - sh
            - -c
@@ -42,11 +42,12 @@ spec:
                cat >> /config/nzbget.conf << 'CONF'

              # arrstack-managed download layout (appended once; last value wins).
-              # Downloads land on the shared media PVCs by category so sonarr/radarr
-              # import with atomic hardlink moves (download dir + library share one
-              # filesystem per media type). InterDir is empty: nzbget writes each
-              # download straight into its category DestDir, so BOTH tv and movies
-              # stay on their own PVC with no cross-filesystem intermediate copy.
+              # Downloads land on the shared media PVCs by category so sonarr-adult/
+              # radarr-adult import with atomic hardlink moves (download dir +
+              # library share one filesystem per media type). InterDir is empty:
+              # nzbget writes each download straight into its category DestDir, so
+              # BOTH tv and movies stay on their own PVC with no cross-filesystem
+              # intermediate copy.
              MainDir=/media/tv
              InterDir=
              DestDir=/media/tv/downloads
@@ -77,11 +78,13 @@ spec:
              mountPath: /config
            - name: media-tv
              mountPath: /media/tv
+              subPath: tvshows/adult
            - name: media-movies
              mountPath: /media/movies
+              subPath: movies/adult
      containers:
        - name: nzbget
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/nzbget:version-v26.2
+          image: docker.io/linuxserver/nzbget:version-v26.2
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
@@ -123,12 +126,14 @@ spec:
              mountPath: /config
            - name: media-tv
              mountPath: /media/tv
+              subPath: tvshows/adult
            - name: media-movies
              mountPath: /media/movies
+              subPath: movies/adult
      volumes:
        - name: config
          persistentVolumeClaim:
-            claimName: nzbget-config
+            claimName: nzbget-adult-config
        - name: media-tv
          persistentVolumeClaim:
            claimName: media-tv
@@ -6,5 +6,3 @@ resources:
  - pvc-config.yaml
  - deployment.yaml
  - service.yaml
-  - gateway.yaml
-  - httproute.yaml
@@ -0,0 +1,16 @@
+---
+# NZBGet (adult) config + queue/temp state. RWO on cephrbd (block, fast-delete).
+# The download data itself lives on the shared media PVCs, not here.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nzbget-adult-config
+  namespace: arrstack
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: cephrbd-fast-delete
+  volumeMode: Filesystem
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: nzbget
+  name: nzbget-adult
  namespace: arrstack
 spec:
  ports:
@@ -11,5 +11,5 @@ spec:
      protocol: TCP
      targetPort: http
  selector:
-    app: nzbget
+    app: nzbget-adult
  type: ClusterIP
@@ -1,16 +0,0 @@
---
-# NZBGet config + queue/temp state. RWO on cephrbd (block). Retain: this is
-# state. The download data itself lives on the shared media PVCs, not here.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: nzbget-config
-  namespace: arrstack
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephrbd-fast-retain
-  volumeMode: Filesystem
@@ -50,30 +50,6 @@ spec:
      owner: app
  managed:
    roles:
-      - name: sonarr
-        ensure: present
-        comment: Sonarr application role (owns sonarr-main)
-        login: true
-        superuser: false
-        createdb: false
-        createrole: false
-        inherit: true
-        replication: false
-        connectionLimit: -1
-        passwordSecret:
-          name: sonarr-db
-      - name: radarr
-        ensure: present
-        comment: Radarr application role (owns radarr-main)
-        login: true
-        superuser: false
-        createdb: false
-        createrole: false
-        inherit: true
-        replication: false
-        connectionLimit: -1
-        passwordSecret:
-          name: radarr-db
      - name: prowlarr
        ensure: present
        comment: Prowlarr application role (owns prowlarr-main)
@@ -110,6 +86,30 @@ spec:
        connectionLimit: -1
        passwordSecret:
          name: radarr-kids-db
+      - name: sonarr-adult
+        ensure: present
+        comment: Sonarr (adult) application role (owns sonarr-adult-main)
+        login: true
+        superuser: false
+        createdb: false
+        createrole: false
+        inherit: true
+        replication: false
+        connectionLimit: -1
+        passwordSecret:
+          name: sonarr-adult-db
+      - name: radarr-adult
+        ensure: present
+        comment: Radarr (adult) application role (owns radarr-adult-main)
+        login: true
+        superuser: false
+        createdb: false
+        createrole: false
+        inherit: true
+        replication: false
+        connectionLimit: -1
+        passwordSecret:
+          name: radarr-adult-db
  enablePDB: true
  enableSuperuserAccess: false
  failoverDelay: 0
@@ -0,0 +1,15 @@
+---
+# Per-app database owned by the radarr-adult managed role. The fork's provider
+# runs its own schema migrations on first start (advisory-locked, so only one
+# replica migrates). retain: the database survives a Database CRD delete.
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: radarr-adult-main
+  namespace: arrstack
+spec:
+  cluster:
+    name: arrstack-postgres
+  name: radarr-adult-main
+  owner: radarr-adult
+  databaseReclaimPolicy: retain
@@ -1,15 +0,0 @@
---
-# Per-app database owned by the radarr managed role. The fork's provider runs its
-# own schema migrations on first start (advisory-locked, so only one replica
-# migrates). retain: the database survives a Database CRD delete.
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: radarr-main
-  namespace: arrstack
-spec:
-  cluster:
-    name: arrstack-postgres
-  name: radarr-main
-  owner: radarr
-  databaseReclaimPolicy: retain
@@ -0,0 +1,15 @@
+---
+# Per-app database owned by the sonarr-adult managed role. The fork's provider
+# runs its own schema migrations on first start (advisory-locked, so only one
+# replica migrates). retain: the database survives a Database CRD delete.
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: sonarr-adult-main
+  namespace: arrstack
+spec:
+  cluster:
+    name: arrstack-postgres
+  name: sonarr-adult-main
+  owner: sonarr-adult
+  databaseReclaimPolicy: retain
@@ -1,15 +0,0 @@
---
-# Per-app database owned by the sonarr managed role. The fork's provider runs its
-# own schema migrations on first start (advisory-locked, so only one replica
-# migrates). retain: the database survives a Database CRD delete.
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: sonarr-main
-  namespace: arrstack
-spec:
-  cluster:
-    name: arrstack-postgres
-  name: sonarr-main
-  owner: sonarr
-  databaseReclaimPolicy: retain
@@ -6,8 +6,8 @@ resources:
  - vaultstaticsecret.yaml
  - cnpg_cluster.yaml
  - cnpg_backup.yaml
-  - database-sonarr.yaml
-  - database-radarr.yaml
  - database-prowlarr.yaml
  - database-sonarr-kids.yaml
  - database-radarr-kids.yaml
+  - database-sonarr-adult.yaml
+  - database-radarr-adult.yaml
@@ -10,40 +10,6 @@
 # (wave 1) reconciles the roles.
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
-metadata:
-  name: sonarr-db
-  namespace: arrstack
-spec:
-  destination:
-    create: true
-    name: sonarr-db
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/sonarr-db
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
---
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: radarr-db
-  namespace: arrstack
-spec:
-  destination:
-    create: true
-    name: radarr-db
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/radarr-db
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
---
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
 metadata:
  name: prowlarr-db
  namespace: arrstack
@@ -92,3 +58,37 @@ spec:
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: sonarr-adult-db
+  namespace: arrstack
+spec:
+  destination:
+    create: true
+    name: sonarr-adult-db
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/sonarr-adult-db
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: radarr-adult-db
+  namespace: arrstack
+spec:
+  destination:
+    create: true
+    name: radarr-adult-db
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/radarr-adult-db
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
@@ -0,0 +1,32 @@
+---
+# Static PV for the shared MEDIASTORE CephFS subvolume: one 10Ti filesystem
+# holding every library plus the nzbget download tree, so arr imports are
+# same-filesystem hardlink moves across tv AND movies. Same rootPath as the
+# fafflix/cheeztv mediastore PVs; each namespace gets its own PV (unique name +
+# volumeHandle) pinned by claimRef.
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: arrstack-mediastore
+spec:
+  capacity:
+    storage: 10Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  volumeMode: Filesystem
+  claimRef:
+    namespace: arrstack
+    name: mediastore
+  csi:
+    driver: cephfs.csi.ceph.com
+    volumeHandle: arrstack-mediastore-static
+    nodeStageSecretRef:
+      name: csi-cephfs-secret
+      namespace: csi-cephfs
+    volumeAttributes:
+      staticVolume: "true"
+      clusterID: cephfs_csi_ssd_ec_4_1
+      fsName: cephfs
+      rootPath: /volumes/csi_ssd_ec_4_1/mediastore/a0152dac-a51b-4b95-ac5e-ecdd99bfe3f1
@@ -0,0 +1,22 @@
+---
+# Whole media tree (/fafflix, /cheeztv, /nzbget) on one RWX filesystem, shared
+# across the sonarr/radarr/nzbget pods. Statically bound to the
+# arrstack-mediastore PV (the same CephFS subvolume fafflix and cheeztv mount).
+# storageClassName "" + volumeName disables dynamic provisioning and binds the
+# pre-created static PV.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mediastore
+  namespace: arrstack
+  annotations:
+    k8up.io/backup: "false"
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Ti
+  storageClassName: ""
+  volumeName: arrstack-mediastore
+  volumeMode: Filesystem
@@ -0,0 +1,25 @@
+---
+# Non-secret env for the -unkin2 fork (adult tier). Identical mechanism to the
+# kids radarr, pointed at its own shared-Postgres database (radarr-adult-main)
+# and its own UrlBase (/3aa168/radarr) so arrproxy path-routing reaches the adult
+# instance separately. Shares the one arrstack Valkey (keys namespaced by the
+# fork's radarr:ratelimit: prefix). User/Password/ApiKey come from Secrets (see
+# deployment.yaml), not here.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: radarr-adult-env
+  namespace: arrstack
+data:
+  Radarr__Postgres__Host: arrstack-postgres-rw.arrstack.svc.cluster.local
+  Radarr__Postgres__Port: "5432"
+  Radarr__Postgres__MainDb: radarr-adult-main
+  Radarr__Log__DbEnabled: "false"
+  Radarr__Auth__Method: External
+  Radarr__Auth__Required: DisabledForLocalAddresses
+  Radarr__App__InstanceName: Radarr
+  Radarr__Server__Port: "7878"
+  Radarr__Server__UrlBase: /3aa168/radarr
+  Radarr__Update__Mechanism: External
+  Radarr__Redis__Host: valkey-arrstack-valkey.arrstack.svc.cluster.local
+  Radarr__Redis__Port: "6379"
@@ -2,43 +2,40 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: radarr
+  name: radarr-adult
  namespace: arrstack
  annotations:
-    # radarr-env is a plain (unhashed) ConfigMap consumed by fixed-name envFrom,
-    # so editing it does not roll the Deployment on its own. Reloader watches the
-    # referenced ConfigMap and triggers a rolling restart on change, so adding the
-    # Redis env activates the #14 features on the next ArgoCD sync without a manual
-    # `rollout restart`.
+    # Reloader rolls the Deployment when radarr-adult-env changes (plain envFrom
+    # ConfigMap does not trigger a rollout on its own).
    configmap.reloader.stakater.com/auto: "true"
 spec:
  # Active-active: the -unkin2 fork keeps all state in the shared Postgres
  # (arrstack-postgres) and coordinates via Postgres advisory locks, so N
-  # replicas run concurrently behind the radarr Service. RollingUpdate is safe —
-  # no SQLite, no RWO lock.
+  # replicas run concurrently behind the radarr-adult Service. RollingUpdate is
+  # safe — no SQLite, no RWO lock.
  replicas: 3
  strategy:
    type: RollingUpdate
  selector:
    matchLabels:
-      app: radarr
+      app: radarr-adult
  template:
    metadata:
      labels:
-        app: radarr
+        app: radarr-adult
    spec:
      securityContext:
-        # Fork image has no USER (runs as root by default); pin it to a non-root
-        # UID and group-write the shared RWX CephFS /config (MediaCover etc.).
-        # OnRootMismatch avoids a recursive chown of the whole media tree.
+        # Fork image has no USER; pin it to a non-root UID and group-write the
+        # shared RWX CephFS media subtree. OnRootMismatch avoids a recursive
+        # chown of the whole media tree.
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
      initContainers:
-        # Gate the app on its own Postgres database+role being reachable, instead
-        # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
-        # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv.
+        # Gate the app on its own Postgres database+role being reachable.
+        # waitfordb reads the PG* env as a libpq fallback, so the password never
+        # lands in argv.
        - name: wait-for-db
          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
          env:
@@ -51,16 +48,16 @@ spec:
            - name: PGPORT
              value: "5432"
            - name: PGDATABASE
-              value: radarr-main
+              value: radarr-adult-main
            - name: PGUSER
              valueFrom:
                secretKeyRef:
-                  name: radarr-db
+                  name: radarr-adult-db
                  key: username
            - name: PGPASSWORD
              valueFrom:
                secretKeyRef:
-                  name: radarr-db
+                  name: radarr-adult-db
                  key: password
          resources:
            requests:
@@ -78,9 +75,8 @@ spec:
          args:
            - -nobrowser
            - -data=/config
-            # Required: bypass the single-instance guard so multiple replicas
-            # can share one /config. Cross-replica safety is the Postgres layer,
-            # not a local lock file.
+            # Bypass the single-instance guard so multiple replicas can share one
+            # /config. Cross-replica safety is the Postgres layer, not a lock file.
            - -nosingleinstancecheck
          ports:
            - name: http
@@ -88,27 +84,25 @@ spec:
              protocol: TCP
          envFrom:
            - configMapRef:
-                name: radarr-env
+                name: radarr-adult-env
          env:
            - name: Radarr__Postgres__User
              valueFrom:
                secretKeyRef:
-                  name: radarr-db
+                  name: radarr-adult-db
                  key: username
            - name: Radarr__Postgres__Password
              valueFrom:
                secretKeyRef:
-                  name: radarr-db
+                  name: radarr-adult-db
                  key: password
            - name: Radarr__Auth__ApiKey
              valueFrom:
                secretKeyRef:
-                  name: radarr-apikey
+                  name: radarr-adult-apikey
                  key: apitoken
-            # MediaCover object store (shared Ceph RGW bucket). Serves posters/fanart
-            # from S3 so any replica can render them instead of the leader-local
-            # emptyDir /config. Consumed by the -unkin3+ image; older images ignore
-            # these unknown config keys. Creds Secret is minted by cephrgw-operator.
+            # MediaCover object store (shared arrstack-media Ceph RGW bucket,
+            # partitioned by the radarr-adult key prefix).
            - name: Radarr__MediaCover__S3__Endpoint
              valueFrom:
                secretKeyRef:
@@ -127,14 +121,13 @@ spec:
            - name: Radarr__MediaCover__S3__Bucket
              value: arrstack-media
            - name: Radarr__MediaCover__S3__Prefix
-              value: radarr
+              value: radarr-adult
            - name: Radarr__MediaCover__S3__ForcePathStyle
              value: "true"
            - name: Radarr__MediaCover__S3__CaCertPath
              value: /etc/ssl/vault-ca/ca.crt
            # Backup object store (shared arrstack-backups Ceph RGW bucket,
-            # per-app key prefix). Routes the periodic config+DB zip backups off
-            # the ephemeral /config so any replica can write and restore them.
+            # partitioned by the radarr-adult key prefix).
            - name: Radarr__BackupS3__Endpoint
              valueFrom:
                secretKeyRef:
@@ -153,14 +146,14 @@ spec:
            - name: Radarr__BackupS3__Bucket
              value: arrstack-backups
            - name: Radarr__BackupS3__Prefix
-              value: radarr
+              value: radarr-adult
            - name: Radarr__BackupS3__ForcePathStyle
              value: "true"
            - name: Radarr__BackupS3__CaCertPath
              value: /etc/ssl/vault-ca/ca.crt
          livenessProbe:
            httpGet:
-              path: /radarr/ping
+              path: /3aa168/radarr/ping
              port: http
            initialDelaySeconds: 30
            periodSeconds: 30
@@ -168,7 +161,7 @@ spec:
            failureThreshold: 3
          readinessProbe:
            httpGet:
-              path: /radarr/ping
+              path: /3aa168/radarr/ping
              port: http
            initialDelaySeconds: 10
            periodSeconds: 10
@@ -184,28 +177,31 @@ spec:
          volumeMounts:
            - name: config
              mountPath: /config
+            # Adult movies subtree of the shared media-movies PVC (same CephFS
+            # subvolume the kids radarr writes and jellyfin reads).
            - name: media-movies
              mountPath: /media/movies
+              subPath: movies/adult
            - name: vault-ca
              mountPath: /etc/ssl/vault-ca
              readOnly: true
        # exportarr sidecar: polls the local replica's API and exposes Prometheus
-        # metrics on :9708 (scraped by the radarr-exportarr VMPodScrape).
+        # metrics on :9708 (scraped by the radarr-adult-exportarr VMPodScrape).
        - name: exportarr
-          image: artifactapi.k8s.syd1.au.unkin.net/ghcr/onedr0p/exportarr:v2.3.0
+          image: ghcr.io/onedr0p/exportarr:v2.3.0
          imagePullPolicy: IfNotPresent
          args:
            - radarr
          env:
            - name: PORT
              value: "9708"
-            # URL includes the /radarr UrlBase (Radarr__Server__UrlBase).
+            # URL includes the /3aa168/radarr UrlBase (Radarr__Server__UrlBase).
            - name: URL
-              value: http://localhost:7878/radarr
+              value: http://localhost:7878/3aa168/radarr
            - name: APIKEY
              valueFrom:
                secretKeyRef:
-                  name: radarr-apikey
+                  name: radarr-adult-apikey
                  key: apitoken
          ports:
            - name: metrics
@@ -7,6 +7,4 @@ resources:
  - configmap.yaml
  - deployment.yaml
  - service.yaml
-  - gateway.yaml
-  - httproute.yaml
  - vmpodscrape.yaml
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: radarr
+  name: radarr-adult
  namespace: arrstack
 spec:
  ports:
@@ -11,5 +11,5 @@ spec:
      protocol: TCP
      targetPort: http
  selector:
-    app: radarr
+    app: radarr-adult
  type: ClusterIP
@@ -0,0 +1,25 @@
+---
+# radarr-adult API key. Seeded out-of-band at
+# kv/kubernetes/namespace/arrstack/default/radarr-adult (key: apitoken); the
+# default k8s role's templated policy already grants read on
+# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
+# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
+# syncs it into the radarr-adult-apikey Secret consumed by the Deployment.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: radarr-adult-apikey
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: radarr-adult-apikey
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/radarr-adult
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
@@ -1,16 +1,16 @@
 ---
-# Scrape the exportarr sidecar (:9708) on every radarr pod. Picked up by the
+# Scrape the exportarr sidecar (:9708) on every radarr-adult pod. Picked up by the
 # observability VMAgent (selectAllByDefault). Pod-level rather than
-# VMServiceScrape because the radarr Service doesn't expose the metrics port.
+# VMServiceScrape because the radarr-adult Service doesn't expose the metrics port.
 apiVersion: operator.victoriametrics.com/v1beta1
 kind: VMPodScrape
 metadata:
-  name: radarr-exportarr
+  name: radarr-adult-exportarr
  namespace: arrstack
 spec:
  selector:
    matchLabels:
-      app: radarr
+      app: radarr-adult
  podMetricsEndpoints:
    - port: metrics
      path: /metrics
@@ -1,33 +0,0 @@
---
-# Non-secret env for the -unkin2 fork. The fork reads Servarr config from
-# Radarr__<Section>__<Key> env (no config.xml edits, no s6/PUID). Postgres wiring
-# points every replica at the same shared DB (arrstack-postgres-rw / radarr-main);
-# Auth__Method=External defers UI auth to arrproxy/oauth2-proxy; Server__UrlBase
-# keeps the /radarr prefix so arrproxy path-routing works; App__InstanceName is
-# identical across replicas (shared session-cookie name). User/Password/ApiKey
-# come from Secrets (see deployment.yaml), not here.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: radarr-env
-  namespace: arrstack
-data:
-  Radarr__Postgres__Host: arrstack-postgres-rw.arrstack.svc.cluster.local
-  Radarr__Postgres__Port: "5432"
-  Radarr__Postgres__MainDb: radarr-main
-  Radarr__Log__DbEnabled: "false"
-  Radarr__Auth__Method: External
-  Radarr__Auth__Required: DisabledForLocalAddresses
-  Radarr__App__InstanceName: Radarr
-  Radarr__Server__Port: "7878"
-  Radarr__Server__UrlBase: /radarr
-  Radarr__Update__Mechanism: External
-  # Shared arrstack Valkey (valkey-operator). Setting Host is what activates the
-  # fork's #14 Redis features (SignalR backplane, cross-replica cache-invalidation
-  # bus, distributed rate limiter): RedisOptions.IsConfigured gates purely on a
-  # non-empty Host, so there is no separate Enabled flag. The operator leaves the
-  # default user passwordless (jellyfin parity), so no Password/Ssl is wired.
-  # Channels/keys are namespaced by this fork's radarr:ratelimit: prefix, so the
-  # one cluster is safe to share with sonarr/prowlarr.
-  Radarr__Redis__Host: valkey-arrstack-valkey.arrstack.svc.cluster.local
-  Radarr__Redis__Port: "6379"
@@ -1,17 +0,0 @@
---
-# Radarr /config. RWX on CephFS so all replicas share it (the -unkin2 fork keeps
-# the database in Postgres; /config now holds only config.xml + MediaCover, which
-# tolerate — and want — shared access). Retain: this is state.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: radarr-config
-  namespace: arrstack
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephfs-raid5-retain
-  volumeMode: Filesystem
@@ -1,25 +0,0 @@
---
-# radarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/radarr
-# (key: apitoken); the default k8s role's templated policy already grants read
-# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
-# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
-# syncs it into the radarr-apikey Secret that the apikey-init initContainer reads
-# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: radarr-apikey
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  destination:
-    create: true
-    name: radarr-apikey
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/radarr
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
@@ -0,0 +1,25 @@
+---
+# Non-secret env for the -unkin2 fork (adult tier). Identical mechanism to the
+# kids sonarr, pointed at its own shared-Postgres database (sonarr-adult-main)
+# and its own UrlBase (/3aa168/sonarr) so arrproxy path-routing reaches the adult
+# instance separately. Shares the one arrstack Valkey (keys namespaced by the
+# fork's sonarr:ratelimit: prefix). User/Password/ApiKey come from Secrets (see
+# deployment.yaml), not here.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: sonarr-adult-env
+  namespace: arrstack
+data:
+  Sonarr__Postgres__Host: arrstack-postgres-rw.arrstack.svc.cluster.local
+  Sonarr__Postgres__Port: "5432"
+  Sonarr__Postgres__MainDb: sonarr-adult-main
+  Sonarr__Log__DbEnabled: "false"
+  Sonarr__Auth__Method: External
+  Sonarr__Auth__Required: DisabledForLocalAddresses
+  Sonarr__App__InstanceName: Sonarr
+  Sonarr__Server__Port: "8989"
+  Sonarr__Server__UrlBase: /3aa168/sonarr
+  Sonarr__Update__Mechanism: External
+  Sonarr__Redis__Host: valkey-arrstack-valkey.arrstack.svc.cluster.local
+  Sonarr__Redis__Port: "6379"
@@ -2,43 +2,40 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: sonarr
+  name: sonarr-adult
  namespace: arrstack
  annotations:
-    # sonarr-env is a plain (unhashed) ConfigMap consumed by fixed-name envFrom,
-    # so editing it does not roll the Deployment on its own. Reloader watches the
-    # referenced ConfigMap and triggers a rolling restart on change, so adding the
-    # Redis env activates the #14 features on the next ArgoCD sync without a manual
-    # `rollout restart`.
+    # Reloader rolls the Deployment when sonarr-adult-env changes (plain envFrom
+    # ConfigMap does not trigger a rollout on its own).
    configmap.reloader.stakater.com/auto: "true"
 spec:
  # Active-active: the -unkin2 fork keeps all state in the shared Postgres
  # (arrstack-postgres) and coordinates via Postgres advisory locks, so N
-  # replicas run concurrently behind the sonarr Service. RollingUpdate is safe —
-  # no SQLite, no RWO lock.
+  # replicas run concurrently behind the sonarr-adult Service. RollingUpdate is
+  # safe — no SQLite, no RWO lock.
  replicas: 3
  strategy:
    type: RollingUpdate
  selector:
    matchLabels:
-      app: sonarr
+      app: sonarr-adult
  template:
    metadata:
      labels:
-        app: sonarr
+        app: sonarr-adult
    spec:
      securityContext:
-        # Fork image has no USER (runs as root by default); pin it to a non-root
-        # UID and group-write the shared RWX CephFS /config (MediaCover etc.).
-        # OnRootMismatch avoids a recursive chown of the whole media tree.
+        # Fork image has no USER; pin it to a non-root UID and group-write the
+        # shared RWX CephFS media subtree. OnRootMismatch avoids a recursive
+        # chown of the whole media tree.
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
      initContainers:
-        # Gate the app on its own Postgres database+role being reachable, instead
-        # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
-        # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv.
+        # Gate the app on its own Postgres database+role being reachable.
+        # waitfordb reads the PG* env as a libpq fallback, so the password never
+        # lands in argv.
        - name: wait-for-db
          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
          env:
@@ -51,16 +48,16 @@ spec:
            - name: PGPORT
              value: "5432"
            - name: PGDATABASE
-              value: sonarr-main
+              value: sonarr-adult-main
            - name: PGUSER
              valueFrom:
                secretKeyRef:
-                  name: sonarr-db
+                  name: sonarr-adult-db
                  key: username
            - name: PGPASSWORD
              valueFrom:
                secretKeyRef:
-                  name: sonarr-db
+                  name: sonarr-adult-db
                  key: password
          resources:
            requests:
@@ -78,9 +75,8 @@ spec:
          args:
            - -nobrowser
            - -data=/config
-            # Required: bypass the single-instance guard so multiple replicas
-            # can share one /config. Cross-replica safety is the Postgres layer,
-            # not a local lock file.
+            # Bypass the single-instance guard so multiple replicas can share one
+            # /config. Cross-replica safety is the Postgres layer, not a lock file.
            - -nosingleinstancecheck
          ports:
            - name: http
@@ -88,29 +84,25 @@ spec:
              protocol: TCP
          envFrom:
            - configMapRef:
-                name: sonarr-env
+                name: sonarr-adult-env
          env:
            - name: Sonarr__Postgres__User
              valueFrom:
                secretKeyRef:
-                  name: sonarr-db
+                  name: sonarr-adult-db
                  key: username
            - name: Sonarr__Postgres__Password
              valueFrom:
                secretKeyRef:
-                  name: sonarr-db
+                  name: sonarr-adult-db
                  key: password
            - name: Sonarr__Auth__ApiKey
              valueFrom:
                secretKeyRef:
-                  name: sonarr-apikey
+                  name: sonarr-adult-apikey
                  key: apitoken
            # MediaCover object store (shared arrstack-media Ceph RGW bucket,
-            # partitioned from radarr by the sonarr key prefix). Serves
-            # posters/fanart from S3 so any replica renders them instead of the
-            # leader-local emptyDir /config. Consumed by the -unkin3+ image;
-            # older images ignore these unknown config keys. Creds Secret minted
-            # by cephrgw-operator.
+            # partitioned by the sonarr-adult key prefix).
            - name: Sonarr__MediaCoverS3__Endpoint
              valueFrom:
                secretKeyRef:
@@ -129,14 +121,13 @@ spec:
            - name: Sonarr__MediaCoverS3__Bucket
              value: arrstack-media
            - name: Sonarr__MediaCoverS3__Prefix
-              value: sonarr
+              value: sonarr-adult
            - name: Sonarr__MediaCoverS3__ForcePathStyle
              value: "true"
            - name: Sonarr__MediaCoverS3__CaCertPath
              value: /etc/ssl/vault-ca/ca.crt
            # Backup object store (shared arrstack-backups Ceph RGW bucket,
-            # per-app key prefix). Routes the periodic config+DB zip backups off
-            # the ephemeral /config so any replica can write and restore them.
+            # partitioned by the sonarr-adult key prefix).
            - name: Sonarr__BackupS3__Endpoint
              valueFrom:
                secretKeyRef:
@@ -155,14 +146,14 @@ spec:
            - name: Sonarr__BackupS3__Bucket
              value: arrstack-backups
            - name: Sonarr__BackupS3__Prefix
-              value: sonarr
+              value: sonarr-adult
            - name: Sonarr__BackupS3__ForcePathStyle
              value: "true"
            - name: Sonarr__BackupS3__CaCertPath
              value: /etc/ssl/vault-ca/ca.crt
          livenessProbe:
            httpGet:
-              path: /sonarr/ping
+              path: /3aa168/sonarr/ping
              port: http
            initialDelaySeconds: 30
            periodSeconds: 30
@@ -170,7 +161,7 @@ spec:
            failureThreshold: 3
          readinessProbe:
            httpGet:
-              path: /sonarr/ping
+              path: /3aa168/sonarr/ping
              port: http
            initialDelaySeconds: 10
            periodSeconds: 10
@@ -186,28 +177,31 @@ spec:
          volumeMounts:
            - name: config
              mountPath: /config
+            # Adult TV subtree of the shared media-tv PVC (same CephFS subvolume
+            # the kids sonarr writes and jellyfin reads).
            - name: media-tv
              mountPath: /media/tv
+              subPath: tvshows/adult
            - name: vault-ca
              mountPath: /etc/ssl/vault-ca
              readOnly: true
        # exportarr sidecar: polls the local replica's API and exposes Prometheus
-        # metrics on :9707 (scraped by the sonarr-exportarr VMPodScrape).
+        # metrics on :9707 (scraped by the sonarr-adult-exportarr VMPodScrape).
        - name: exportarr
-          image: artifactapi.k8s.syd1.au.unkin.net/ghcr/onedr0p/exportarr:v2.3.0
+          image: ghcr.io/onedr0p/exportarr:v2.3.0
          imagePullPolicy: IfNotPresent
          args:
            - sonarr
          env:
            - name: PORT
              value: "9707"
-            # URL includes the /sonarr UrlBase (Sonarr__Server__UrlBase).
+            # URL includes the /3aa168/sonarr UrlBase (Sonarr__Server__UrlBase).
            - name: URL
-              value: http://localhost:8989/sonarr
+              value: http://localhost:8989/3aa168/sonarr
            - name: APIKEY
              valueFrom:
                secretKeyRef:
-                  name: sonarr-apikey
+                  name: sonarr-adult-apikey
                  key: apitoken
          ports:
            - name: metrics
@@ -7,6 +7,4 @@ resources:
  - configmap.yaml
  - deployment.yaml
  - service.yaml
-  - gateway.yaml
-  - httproute.yaml
  - vmpodscrape.yaml
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: sonarr
+  name: sonarr-adult
  namespace: arrstack
 spec:
  ports:
@@ -11,5 +11,5 @@ spec:
      protocol: TCP
      targetPort: http
  selector:
-    app: sonarr
+    app: sonarr-adult
  type: ClusterIP
@@ -0,0 +1,25 @@
+---
+# sonarr-adult API key. Seeded out-of-band at
+# kv/kubernetes/namespace/arrstack/default/sonarr-adult (key: apitoken); the
+# default k8s role's templated policy already grants read on
+# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
+# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
+# syncs it into the sonarr-adult-apikey Secret consumed by the Deployment.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: sonarr-adult-apikey
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: sonarr-adult-apikey
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/sonarr-adult
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
@@ -1,16 +1,16 @@
 ---
-# Scrape the exportarr sidecar (:9707) on every sonarr pod. Picked up by the
+# Scrape the exportarr sidecar (:9707) on every sonarr-adult pod. Picked up by the
 # observability VMAgent (selectAllByDefault). Pod-level rather than
-# VMServiceScrape because the sonarr Service doesn't expose the metrics port.
+# VMServiceScrape because the sonarr-adult Service doesn't expose the metrics port.
 apiVersion: operator.victoriametrics.com/v1beta1
 kind: VMPodScrape
 metadata:
-  name: sonarr-exportarr
+  name: sonarr-adult-exportarr
  namespace: arrstack
 spec:
  selector:
    matchLabels:
-      app: sonarr
+      app: sonarr-adult
  podMetricsEndpoints:
    - port: metrics
      path: /metrics
@@ -1,33 +0,0 @@
---
-# Non-secret env for the -unkin2 fork. The fork reads Servarr config from
-# Sonarr__<Section>__<Key> env (no config.xml edits, no s6/PUID). Postgres wiring
-# points every replica at the same shared DB (arrstack-postgres-rw / sonarr-main);
-# Auth__Method=External defers UI auth to arrproxy/oauth2-proxy; Server__UrlBase
-# keeps the /sonarr prefix so arrproxy path-routing works; App__InstanceName is
-# identical across replicas (shared session-cookie name). User/Password/ApiKey
-# come from Secrets (see deployment.yaml), not here.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: sonarr-env
-  namespace: arrstack
-data:
-  Sonarr__Postgres__Host: arrstack-postgres-rw.arrstack.svc.cluster.local
-  Sonarr__Postgres__Port: "5432"
-  Sonarr__Postgres__MainDb: sonarr-main
-  Sonarr__Log__DbEnabled: "false"
-  Sonarr__Auth__Method: External
-  Sonarr__Auth__Required: DisabledForLocalAddresses
-  Sonarr__App__InstanceName: Sonarr
-  Sonarr__Server__Port: "8989"
-  Sonarr__Server__UrlBase: /sonarr
-  Sonarr__Update__Mechanism: External
-  # Shared arrstack Valkey (valkey-operator). Setting Host is what activates the
-  # fork's #14 Redis features (SignalR backplane, cross-replica cache-invalidation
-  # bus, distributed rate limiter): RedisOptions.IsConfigured gates purely on a
-  # non-empty Host, so there is no separate Enabled flag. The operator leaves the
-  # default user passwordless (jellyfin parity), so no Password/Ssl is wired.
-  # Channels/keys are namespaced by this fork's sonarr:ratelimit: prefix, so the
-  # one cluster is safe to share with radarr/prowlarr.
-  Sonarr__Redis__Host: valkey-arrstack-valkey.arrstack.svc.cluster.local
-  Sonarr__Redis__Port: "6379"
@@ -1,17 +0,0 @@
---
-# Sonarr /config. RWX on CephFS so all replicas share it (the -unkin2 fork keeps
-# the database in Postgres; /config now holds only config.xml + MediaCover, which
-# tolerate — and want — shared access). Retain: this is state.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: sonarr-config
-  namespace: arrstack
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephfs-raid5-retain
-  volumeMode: Filesystem
@@ -1,25 +0,0 @@
---
-# sonarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/sonarr
-# (key: apitoken); the default k8s role's templated policy already grants read
-# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
-# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
-# syncs it into the sonarr-apikey Secret that the apikey-init initContainer reads
-# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: sonarr-apikey
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  destination:
-    create: true
-    name: sonarr-apikey
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/sonarr
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
@@ -28,7 +28,7 @@ metadata:
 spec:
  shards: 1
  replicas: 2
-  image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/valkey/valkey:9.0.0
+  image: docker.io/valkey/valkey:9.0.0
  exporter:
    enabled: false
  scheduling:
@@ -36,7 +36,7 @@ spec:
              mountPath: /combined-certs
      containers:
        - name: api
-          image: git.unkin.net/unkin/artifactapi:v3.11.1
+          image: git.unkin.net/unkin/artifactapi:v3.11.2
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8000
@@ -1,4 +1,21 @@
 ---
+# Path split between the authenticated UI and the unauthenticated machine API.
+# Longest matching prefix wins, so the two UI rules take precedence over "/".
+#
+# AUTHENTICATED (oauth2 Service -> oauth2-proxy -> ui Service):
+#   /oauth2   oauth2-proxy sign_in / start / callback / sign_out
+#   /ui       the human-facing SPA
+#
+# NOT AUTHENTICATED (artifactapi Service, unchanged):
+#   /api/v1/{remote,local,virtual}/*   package proxy reads (yum/dnf, pip, ...)
+#   /api/v2/remotes|virtuals|locals/*  management API + the UI's own XHR calls
+#   /api/v2/remotes/{name}/files/*     CI publish uploads (PUT) and downloads
+#   /v2/*                              Docker Registry V2 (containerd, buildah)
+#   /terraform/v1/providers/*          Terraform provider registry
+#   /.well-known/terraform.json        Terraform service discovery
+#   /health, /version, /               probes and the redirect to /ui/
+# Those clients cannot complete a browser OIDC flow, so they must never be
+# routed through oauth2-proxy.
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
@@ -22,7 +39,17 @@ spec:
    - backendRefs:
        - group: ""
          kind: Service
-          name: ui
+          name: oauth2
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /oauth2
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: oauth2
          port: 80
          weight: 1
      matches:
@@ -12,6 +12,8 @@ resources:
  - gateway.yaml
  - httproute.yaml
  - namespace.yaml
+  - oauth2-proxy-configmap.yaml
+  - oauth2-proxy-deployment.yaml
  - redis-deployment.yaml
  - services.yaml
  - ui-deployment.yaml
@@ -0,0 +1,46 @@
+---
+# Non-secret oauth2-proxy configuration (client_id/secret/cookie_secret come
+# from the oauth-credentials Secret).
+#
+# SCOPE: this proxy fronts the artifactapi web UI ONLY. The HTTPRoute sends just
+# /ui and /oauth2 here; every machine surface (/api/v1, /api/v2, /v2 docker
+# registry, /terraform, /.well-known/terraform.json, /health, /version, /) goes
+# straight to the api Service and is NOT authenticated. yum/dnf, containerd
+# registry mirrors, docker/buildah, terraform init and Woodpecker publish steps
+# cannot complete a browser OIDC flow, so they must never reach this container.
+# Its only upstream is the ui Service -- there is deliberately no api upstream.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: artifactapi-oauth2-env
+  namespace: artifactapi
+data:
+  OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
+  OAUTH2_PROXY_METRICS_ADDRESS: "0.0.0.0:44180"
+  OAUTH2_PROXY_PROVIDER: "oidc"
+  # Publicly-trusted Authentik host: the authorize step is a browser redirect,
+  # so the issuer must present a cert every user's browser already trusts (the
+  # k8s host serves an internal-CA cert). Slug from terraform-authentik.
+  OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/artifactapi/"
+  OAUTH2_PROXY_REDIRECT_URL: "https://artifactapi.k8s.syd1.au.unkin.net/oauth2/callback"
+  OAUTH2_PROXY_UPSTREAMS: "http://ui.artifactapi.svc.cluster.local:80/"
+  OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
+  # Populate session.Groups from the Authentik hierarchical ak_groups claim.
+  OAUTH2_PROXY_OIDC_GROUPS_CLAIM: "ak_groups"
+  OAUTH2_PROXY_ALLOWED_GROUPS: "akP-artifactapi-admin"
+  OAUTH2_PROXY_PASS_USER_HEADERS: "true"
+  OAUTH2_PROXY_EMAIL_DOMAINS: "*"
+  # Authentik hardcodes email_verified=false in the id_token; authorization is
+  # enforced via ak_groups, so accepting the unverified email is safe.
+  OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true"
+  OAUTH2_PROXY_COOKIE_SECURE: "true"
+  OAUTH2_PROXY_COOKIE_DOMAINS: "artifactapi.k8s.syd1.au.unkin.net"
+  OAUTH2_PROXY_WHITELIST_DOMAINS: "artifactapi.k8s.syd1.au.unkin.net"
+  OAUTH2_PROXY_REVERSE_PROXY: "true"
+  OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256"
+  OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
+  # Back-channel discovery/token calls resolve the issuer inside the cluster,
+  # where it is served under the internal unkin.net CA rather than the publicly
+  # trusted cert the browser sees. Trust the bundle the combine-certs init
+  # container assembles, as every other oauth2-proxy in the estate does.
+  OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt"
@@ -0,0 +1,136 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oauth2
+  namespace: artifactapi
+  annotations:
+    configmap.reloader.stakater.com/auto: "true"
+    secret.reloader.stakater.com/reload: "oauth-credentials,vault-ca-cert"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: oauth2
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: oauth2
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        # The Authentik issuer is served behind the internal unkin.net CA;
+        # combine the system roots with it so oauth2-proxy's OIDC HTTP client
+        # trusts the discovery endpoint.
+        - name: combine-certs
+          image: docker.io/library/alpine:3
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /custom-ca
+              readOnly: true
+            - name: combined-certs
+              mountPath: /combined-certs
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 50m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 64Mi
+      containers:
+        - name: oauth2-proxy
+          image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 4180
+              name: http
+              protocol: TCP
+            - containerPort: 44180
+              name: metrics
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: artifactapi-oauth2-env
+                optional: false
+          env:
+            - name: OAUTH2_PROXY_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_id
+            - name: OAUTH2_PROXY_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_secret
+            - name: OAUTH2_PROXY_COOKIE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: cookie_secret
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: combined-certs
+              mountPath: /etc/ssl/combined
+              readOnly: true
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: combined-certs
+          emptyDir: {}
+      restartPolicy: Always
@@ -54,7 +54,7 @@ spec:
            successThreshold: 1
            timeoutSeconds: 5
        - name: metrics-exporter
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
+          image: docker.io/oliver006/redis_exporter:v1.89.0
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 9121
@@ -16,6 +16,26 @@ spec:
  sessionAffinity: None
  type: ClusterIP
 ---
+# Authenticated front door for the web UI only: api-route sends /ui and /oauth2
+# here, oauth2-proxy authenticates and forwards to the ui Service. Every other
+# path reaches the api Service above directly and stays unauthenticated.
+apiVersion: v1
+kind: Service
+metadata:
+  name: oauth2
+  namespace: artifactapi
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: oauth2
+  sessionAffinity: None
+  type: ClusterIP
+---
 apiVersion: v1
 kind: Service
 metadata:
@@ -22,7 +22,7 @@ spec:
      automountServiceAccountToken: true
      containers:
        - name: ui
-          image: git.unkin.net/unkin/artifactapi-ui:v3.11.1
+          image: git.unkin.net/unkin/artifactapi-ui:v3.11.2
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80
@@ -32,3 +32,26 @@ spec:
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
+---
+# Authentik OIDC client for the artifactapi UI front door (client_id,
+# client_secret, cookie_secret). Seeded out of band at
+# kv/kubernetes/namespace/artifactapi/default/oauth-credentials; the default
+# k8s auth role already grants the artifactapi/default ServiceAccount read on
+# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*, so no
+# terraform-vault change is needed. Consumed by the oauth2 Deployment.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: oauth-credentials
+  namespace: artifactapi
+spec:
+  destination:
+    create: true
+    name: oauth-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/artifactapi/default/oauth-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
@@ -14,3 +14,17 @@ spec:
  podMetricsEndpoints:
    - port: metrics
      path: /metrics
+---
+# Scrape the UI oauth2-proxy (:44180), which exposes sign-in/authz counters.
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: oauth2
+  namespace: artifactapi
+spec:
+  selector:
+    matchLabels:
+      app: oauth2
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics
@@ -64,8 +64,12 @@ spec:
      archive_mode: "on"
      archive_timeout: 5min
      dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
+      effective_cache_size: 1536MB
      full_page_writes: "on"
+      # Replicas report their oldest xmin to the primary, so multi-second reads on
+      # a hot standby stop exhausting max_standby_streaming_delay and being
+      # cancelled. Retained-dead-tuple cost is negligible on a ~155MB database.
+      hot_standby_feedback: "on"
      log_destination: csvlog
      log_directory: /controller/log
      log_filename: postgres
@@ -77,7 +81,12 @@ spec:
      max_parallel_workers: "16"
      max_replication_slots: "16"
      max_worker_processes: "16"
-      shared_buffers: 128MB
+      # A pg_stat_statements.* parameter is what makes CNPG treat the extension as
+      # managed and run CREATE EXTENSION in every database; preloading alone does
+      # not create it.
+      pg_stat_statements.max: "10000"
+      pg_stat_statements.track: top
+      shared_buffers: 512MB
      shared_memory_type: mmap
      ssl_max_protocol_version: TLSv1.3
      ssl_min_protocol_version: TLSv1.3
@@ -86,6 +95,9 @@ spec:
      wal_log_hints: "on"
      wal_receiver_timeout: 5s
      wal_sender_timeout: 5s
+    # CNPG merges this with the libraries it manages itself.
+    shared_preload_libraries:
+      - pg_stat_statements
    syncReplicaElectionConstraint:
      enabled: false
  primaryUpdateMethod: restart
@@ -105,13 +117,16 @@ spec:
    updateInterval: 30
  resources:
    limits:
-      cpu: 500m
+      # 500m is a 50ms CFS quota per 100ms period, exhausted by bursts even at
+      # ~0.01 cores average, so every query pays throttle latency.
+      cpu: "2"
      # 512Mi OOMKilled replicas under load (shared_buffers 128MB +
      # max_connections 200 leave no headroom) — see incident 2026-07-28.
-      memory: 1Gi
+      # shared_buffers 512MB needs the same headroom multiple, hence 2Gi.
+      memory: 2Gi
    requests:
-      cpu: 50m
-      memory: 512Mi
+      cpu: 500m
+      memory: 1Gi
  smartShutdownTimeout: 180
  startDelay: 3600
  stopDelay: 1800
@@ -1,19 +1,22 @@
 ---
+# External (DMZ) front for public identity.unkin.net, served via the external
+# Traefik (LB VIP 198.18.199.0). The apex identity.unkin.net A record lives in
+# the bind-operator unkin.net zone (bind-internal/authoritative), NOT
+# external-dns, so no external-dns annotation here. Public TLS is terminated with
+# the real Let's Encrypt *.unkin.net wildcard, centrally minted once in the
+# cert-manager namespace (Certificate wildcard-unkin-net) and reflected into this
+# namespace by the emberstack reflector as wildcard-unkin-net-tls, not Vault PKI.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  labels:
-    traefik.io/instance: internal
+    traefik.io/instance: external
  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: identity.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: identity.unkin.net,identity.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+    argocd.argoproj.io/sync-wave: "2"
  name: authentik
  namespace: authentik
 spec:
-  gatewayClassName: traefik-internal
+  gatewayClassName: traefik-external
  listeners:
    - allowedRoutes:
        namespaces:
@@ -33,20 +36,40 @@ spec:
        certificateRefs:
          - group: ""
            kind: Secret
-            name: authentik-tls
+            name: wildcard-unkin-net-tls
        mode: Terminate
+---
+# Cluster hostname variant, identity.k8s.syd1.au.unkin.net. Internal Traefik,
+# external-dns at 198.18.200.4. Own leaf from the Vault PKI issuer via the
+# cert-manager gateway-shim; the common-name keys off this cluster host.
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: identity.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: identity.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: authentik-internal
+  namespace: authentik
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: identity.k8s.syd1.au.unkin.net
-      name: http-internal
+      name: http
      port: 80
      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: identity.k8s.syd1.au.unkin.net
-      name: https-internal
+      name: https
      port: 443
      protocol: HTTPS
      tls:
@@ -7,16 +7,11 @@ metadata:
 spec:
  hostnames:
    - identity.unkin.net
-    - identity.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: authentik
      sectionName: http
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: authentik
-      sectionName: http-internal
  rules:
    - filters:
        - type: RequestRedirect
@@ -36,17 +31,93 @@ metadata:
 spec:
  hostnames:
    - identity.unkin.net
-    - identity.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: authentik
      sectionName: https
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: authentik
-      sectionName: https-internal
  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: authentik-server
+          port: 80
+          weight: 1
+      filters:
+        - type: URLRewrite
+          urlRewrite:
+            path:
+              type: ReplaceFullPath
+              replaceFullPath: /application/o/token/
+      matches:
+        - path:
+            type: Exact
+            value: /application/o/token
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: authentik-server
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: authentik-http-redirect-internal
+  namespace: authentik
+spec:
+  hostnames:
+    - identity.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik-internal
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: authentik-internal
+  namespace: authentik
+spec:
+  hostnames:
+    - identity.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik-internal
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: authentik-server
+          port: 80
+          weight: 1
+      filters:
+        - type: URLRewrite
+          urlRewrite:
+            path:
+              type: ReplaceFullPath
+              replaceFullPath: /application/o/token/
+      matches:
+        - path:
+            type: Exact
+            value: /application/o/token
    - backendRefs:
        - group: ""
          kind: Service
@@ -10,12 +10,16 @@ resources:
  - httproute.yaml
  - ldap-gateway.yaml
  - ldap-httproute.yaml
+  - ldap-outpost-deployment.yaml
+  - ldap-outpost-vaultstaticsecret.yaml
+  - ldap-outpost-vmpodscrape.yaml
  - ldap-service.yaml
  - ldap-tlsroute.yaml
  - namespace.yaml
  - redis-deployment.yaml
  - redis-pvc.yaml
  - redis-service.yaml
+  - server-vmpodscrape.yaml
  - vaultauth.yaml
  - vaultstaticsecret.yaml
  - vmpodscrape.yaml
@@ -0,0 +1,104 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-ldap-outpost
+  namespace: authentik
+  labels:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/component: ldap
+spec:
+  # Outposts are stateless; run two replicas for availability.
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+      app.kubernetes.io/component: ldap
+  template:
+    metadata:
+      annotations:
+        secret.reloader.stakater.com/reload: "authentik-ldap-outpost-token,vault-ca-cert"
+      labels:
+        app.kubernetes.io/name: authentik
+        app.kubernetes.io/component: ldap
+    spec:
+      # The outpost validates the authentik core cert (identity.k8s.syd1.au.unkin.net,
+      # signed by the internal unkin.net CA). Combine the base image's public roots
+      # with the reflected vault-ca-cert into one bundle that SSL_CERT_FILE points at,
+      # so AUTHENTIK_INSECURE stays false.
+      initContainers:
+        - name: combine-certs
+          image: alpine:3
+          command:
+            - sh
+            - -c
+            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /custom-ca
+              readOnly: true
+            - name: combined-certs
+              mountPath: /combined-certs
+          resources:
+            limits:
+              cpu: 100m
+              memory: 64Mi
+            requests:
+              cpu: 25m
+              memory: 32Mi
+      containers:
+        - name: ldap
+          image: ghcr.io/goauthentik/ldap:2026.5.3
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: AUTHENTIK_HOST
+              value: https://identity.k8s.syd1.au.unkin.net
+            - name: AUTHENTIK_INSECURE
+              value: "false"
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/combined/ca-certificates.crt
+            - name: AUTHENTIK_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: authentik-ldap-outpost-token
+                  key: token
+          ports:
+            - containerPort: 3389
+              name: ldap
+              protocol: TCP
+            - containerPort: 6636
+              name: ldaps
+              protocol: TCP
+            - containerPort: 9300
+              name: metrics
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: ldap
+            initialDelaySeconds: 10
+            periodSeconds: 15
+          readinessProbe:
+            tcpSocket:
+              port: ldap
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            limits:
+              cpu: "1"
+              memory: 512Mi
+            requests:
+              cpu: 50m
+              memory: 128Mi
+          volumeMounts:
+            - name: combined-certs
+              mountPath: /etc/ssl/combined
+              readOnly: true
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: combined-certs
+          emptyDir: {}
@@ -0,0 +1,20 @@
+---
+# Outpost API token, issued by authentik for the LDAP outpost and seeded into
+# Vault by the terraform-authentik apply. The KV value must exist at this path
+# with a `token` key before the outpost can connect.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: authentik-ldap-outpost-token
+  namespace: authentik
+spec:
+  destination:
+    create: true
+    name: authentik-ldap-outpost-token
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/authentik/default/outpost-token
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
@@ -0,0 +1,16 @@
+---
+# Scrape the LDAP outpost's Prometheus endpoint (:9300). Picked up by the
+# observability VMAgent (selectAllByDefault).
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: authentik-ldap-outpost
+  namespace: authentik
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+      app.kubernetes.io/component: ldap
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics
@@ -7,6 +7,10 @@ metadata:
 spec:
  internalTrafficPolicy: Cluster
  ports:
+    - name: ldap
+      port: 3389
+      protocol: TCP
+      targetPort: 3389
    - name: ldaps
      port: 6636
      protocol: TCP
@@ -53,7 +53,7 @@ spec:
            - mountPath: /data
              name: redis-data
        - name: metrics-exporter
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
+          image: docker.io/oliver006/redis_exporter:v1.89.0
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 9121
@@ -0,0 +1,16 @@
+---
+# Scrape the authentik server's django_prometheus endpoint (:9300). Picked up
+# by the observability VMAgent (selectAllByDefault).
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: authentik-server
+  namespace: authentik
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+      app.kubernetes.io/component: server
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics
@@ -16,9 +16,9 @@ spec:
  type: A
  ttl: 600
  values:
-    # traefik-internal gateway VIP; the authentik Gateway serves the
+    # traefik-EXTERNAL (DMZ) gateway VIP; the authentik Gateway serves the
    # identity.unkin.net hostname there.
-    - 198.18.200.4
+    - 198.18.199.0
 ---
 # PRODUCTION CUTOVER RECORD — intentionally commented out.
 # git.unkin.net currently resolves to the LIVE VM forge (HAProxy VRRP VIP
@@ -132,3 +132,33 @@ spec:
    # traefik-internal gateway VIP; the logviewer Gateway serves
    # logviewer.unkin.net there.
    - 198.18.200.4
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: cheeztv-dns-internal
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: cheeztv
+  type: A
+  ttl: 600
+  values:
+    # traefik-internal gateway VIP; the cheeztv Gateway serves cheeztv.unkin.net
+    # there.
+    - 198.18.200.4
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: watchstate-dns-internal
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: watchstate
+  type: A
+  ttl: 600
+  values:
+    # traefik-EXTERNAL (DMZ) gateway VIP; the watchstate-external Gateway serves
+    # the watchstate.unkin.net front door (oauth2-proxy) there.
+    - 198.18.199.0
@@ -21,7 +21,7 @@ spec:
        runAsNonRoot: true
      containers:
        - name: operator
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-operator:v0.2.6
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-operator:v0.2.7
          args:
            - --metrics-bind-address=:8080
            - --health-probe-bind-address=:8081
@@ -6,7 +6,7 @@ resources:
  - namespace.yaml
  # CRDs are pulled from the bind-operator repo at the matching tag rather than
  # vendored here, so they never drift from the operator.
-  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.2.6/config/crd/install.yaml
+  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.2.7/config/crd/install.yaml
  - rbac.yaml
  - agent-dns-rbac.yaml
  - deployment.yaml
@@ -0,0 +1,27 @@
+---
+# Single, centrally-managed Let's Encrypt *.unkin.net wildcard. DNS-01 validates
+# once against the delegated _acme-challenge.unkin.net CNAME, so consumers get a
+# real public leaf without per-host challenge records. The minted secret carries
+# emberstack reflector annotations (via secretTemplate) so it is auto-reflected
+# into consumer namespaces; append future consumers to the *-namespaces lists.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-unkin-net
+  namespace: cert-manager
+spec:
+  secretName: wildcard-unkin-net-tls
+  secretTemplate:
+    annotations:
+      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner"
+      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner"
+  privateKey:
+    size: 4096
+  dnsNames:
+    - "*.unkin.net"
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+    group: cert-manager.io
@@ -11,3 +11,4 @@ resources:
  - vmservicescrape.yaml
  - clusterissuer_letsencrypt.yaml
  - clusterissuer_letsencrypt-staging.yaml
+  - certificate_wildcard-unkin-net.yaml
@@ -1,17 +1,17 @@
 ---
 # Friendly public hostname for the kids instance, cheeztv.unkin.net. Same
 # internal-Traefik + external-dns pattern as logviewer.unkin.net: external-dns
-# publishes the A record at the internal LB VIP (198.18.200.4) and cert-manager
-# mints cheeztv-tls (CN cheeztv.unkin.net) off the Vault-PKI cluster issuer.
+# publishes the A record at the internal LB VIP (198.18.200.4). Public TLS is
+# terminated with the real Let's Encrypt *.unkin.net wildcard, centrally minted
+# once in the cert-manager namespace (Certificate wildcard-unkin-net) and
+# reflected into this namespace by the emberstack reflector as the secret
+# wildcard-unkin-net-tls, not the Vault PKI issuer.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  labels:
    traefik.io/instance: internal
  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: cheeztv.unkin.net
-    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: cheeztv.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  name: cheeztv
@@ -37,7 +37,7 @@ spec:
        certificateRefs:
          - group: ""
            kind: Secret
-            name: cheeztv-tls
+            name: wildcard-unkin-net-tls
        mode: Terminate
 ---
 # Cluster hostname variant, mirroring fafflix's jellyfin.k8s.syd1.au.unkin.net
@@ -15,9 +15,12 @@ resources:
  - pvc-transcode.yaml
  - pv-media-tv.yaml
  - pv-media-movies.yaml
+  - pv-mediastore.yaml
  - pvc-media-tv.yaml
  - pvc-media-movies.yaml
+  - pvc-mediastore.yaml
  - statefulset.yaml
+  - plugin-configmap.yaml
  - pdb.yaml
  - service.yaml
  - valkey.yaml
@@ -0,0 +1,97 @@
+---
+# Declarative config for the browser-auth plugins bundled in the jellyfin-ha
+# image (jellyfin-plugin-sso, jellyfin-plugin-ldapauth). Rendered into
+# /config/plugins/configurations/ by the inject-plugin-config initContainer,
+# which substitutes the OidSecret / LdapBindPassword placeholders from the
+# VSO-synced oauth-credentials Secret so no secret is committed here. The SSO
+# provider key "authentik" must match the redirect path segment registered on
+# the shared Authentik "jellyfin" OAuth2 client. Roles/AdminRoles are matched
+# against the hierarchical Authentik groups claim (akP-jellyfin-user grants
+# login, akP-jellyfin-admin grants Jellyfin admin; global admins inherit the
+# latter via akR-global-admin).
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cheeztv-plugin-config
+  namespace: cheeztv
+data:
+  SSO-Auth.xml: |
+    <?xml version="1.0" encoding="utf-8"?>
+    <PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+      <SamlConfigs />
+      <OidConfigs>
+        <item>
+          <key>
+            <string>authentik</string>
+          </key>
+          <value>
+            <PluginConfiguration>
+              <OidEndpoint>https://identity.unkin.net/application/o/jellyfin/</OidEndpoint>
+              <OidClientId>jellyfin</OidClientId>
+              <OidSecret>@@CLIENT_SECRET@@</OidSecret>
+              <Enabled>true</Enabled>
+              <EnableAuthorization>true</EnableAuthorization>
+              <EnableAllFolders>true</EnableAllFolders>
+              <EnabledFolders />
+              <AdminRoles>
+                <string>akP-jellyfin-admin</string>
+              </AdminRoles>
+              <Roles>
+                <string>akP-jellyfin-user</string>
+                <string>akP-jellyfin-admin</string>
+              </Roles>
+              <EnableFolderRoles>false</EnableFolderRoles>
+              <EnableLiveTvRoles>false</EnableLiveTvRoles>
+              <EnableLiveTv>false</EnableLiveTv>
+              <EnableLiveTvManagement>false</EnableLiveTvManagement>
+              <LiveTvRoles />
+              <LiveTvManagementRoles />
+              <FolderRoleMappings />
+              <RoleClaim>ak_groups</RoleClaim>
+              <OidScopes>
+                <string>openid</string>
+                <string>profile</string>
+                <string>email</string>
+                <string>ak_groups</string>
+              </OidScopes>
+              <CanonicalLinks></CanonicalLinks>
+              <DisableHttps>false</DisableHttps>
+              <DoNotValidateEndpoints>false</DoNotValidateEndpoints>
+              <DoNotValidateIssuerName>false</DoNotValidateIssuerName>
+              <SchemeOverride>https</SchemeOverride>
+            </PluginConfiguration>
+          </value>
+        </item>
+      </OidConfigs>
+    </PluginConfiguration>
+  LDAP-Auth.xml: |
+    <?xml version="1.0" encoding="utf-8"?>
+    <PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+      <LdapServer>authentik-ldap.authentik.svc.cluster.local</LdapServer>
+      <LdapPort>6636</LdapPort>
+      <UseSsl>true</UseSsl>
+      <UseStartTls>false</UseStartTls>
+      <SkipSslVerify>true</SkipSslVerify>
+      <LdapBindUser>cn=jellyfin-ldap,ou=users,DC=ldap,DC=goauthentik,DC=io</LdapBindUser>
+      <LdapBindPassword>@@LDAP_BIND_PASSWORD@@</LdapBindPassword>
+      <LdapBaseDn>ou=users,DC=ldap,DC=goauthentik,DC=io</LdapBaseDn>
+      <LdapSearchFilter>(objectClass=user)</LdapSearchFilter>
+      <LdapAdminBaseDn>ou=users,DC=ldap,DC=goauthentik,DC=io</LdapAdminBaseDn>
+      <LdapAdminFilter>(memberOf=cn=akP-jellyfin-admin,ou=groups,DC=ldap,DC=goauthentik,DC=io)</LdapAdminFilter>
+      <EnableLdapAdminFilterMemberUid>false</EnableLdapAdminFilterMemberUid>
+      <LdapSearchAttributes>uid, cn, mail, displayName</LdapSearchAttributes>
+      <CreateUsersFromLdap>true</CreateUsersFromLdap>
+      <AllowPassChange>false</AllowPassChange>
+      <LdapUidAttribute>cn</LdapUidAttribute>
+      <LdapUsernameAttribute>cn</LdapUsernameAttribute>
+      <LdapPasswordAttribute>userPassword</LdapPasswordAttribute>
+      <EnableAllFolders>true</EnableAllFolders>
+      <EnabledFolders />
+    </PluginConfiguration>
+  branding.xml: |
+    <?xml version="1.0" encoding="utf-8"?>
+    <BrandingOptions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+      <LoginDisclaimer>&lt;p style="text-align:center"&gt;&lt;a href="/sso/OID/start/authentik"&gt;Sign in with SSO&lt;/a&gt;&lt;/p&gt;</LoginDisclaimer>
+      <CustomCss></CustomCss>
+      <SplashscreenEnabled>false</SplashscreenEnabled>
+    </BrandingOptions>
@@ -0,0 +1,31 @@
+---
+# Static PV for the shared MEDIASTORE CephFS subvolume. Same rootPath as
+# arrstack's mediastore PV so the arrs write and cheeztv reads the identical
+# library tree (cheeztv scans /cheeztv/{tvseries,movies}); each namespace gets
+# its own PV (unique name + volumeHandle) pinned by claimRef.
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: cheeztv-mediastore
+spec:
+  capacity:
+    storage: 10Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  volumeMode: Filesystem
+  claimRef:
+    namespace: cheeztv
+    name: cheeztv-mediastore
+  csi:
+    driver: cephfs.csi.ceph.com
+    volumeHandle: cheeztv-mediastore-static
+    nodeStageSecretRef:
+      name: csi-cephfs-secret
+      namespace: csi-cephfs
+    volumeAttributes:
+      staticVolume: "true"
+      clusterID: cephfs_csi_ssd_ec_4_1
+      fsName: cephfs
+      rootPath: /volumes/csi_ssd_ec_4_1/mediastore/a0152dac-a51b-4b95-ac5e-ecdd99bfe3f1
@@ -0,0 +1,24 @@
+---
+# Shared media tree, read-many across replicas. Statically bound to the
+# cheeztv-mediastore PV (the CephFS subvolume also used by arrstack and
+# fafflix). storageClassName "" + volumeName disables dynamic provisioning and
+# binds the pre-created static PV.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: cheeztv-mediastore
+  namespace: cheeztv
+  annotations:
+    # Exclude from the cheeztv-config k8up Schedule (skipWithoutAnnotation is
+    # false cluster-wide, so unannotated PVCs are swept in). Only cheeztv-config
+    # is backed up; the media library is not restic-backup material.
+    k8up.io/backup: "false"
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Ti
+  storageClassName: ""
+  volumeName: cheeztv-mediastore
+  volumeMode: Filesystem
@@ -13,6 +13,4 @@ spec:
      targetPort: http
  selector:
    app: cheeztv
-  # Pin each client to one replica to reduce transcode-session churn/takeover.
-  sessionAffinity: ClientIP
  type: ClusterIP
@@ -4,6 +4,8 @@ kind: StatefulSet
 metadata:
  name: cheeztv
  namespace: cheeztv
+  annotations:
+    configmap.reloader.stakater.com/auto: "true"
 spec:
  # HA: two replicas coordinate transcode session ownership through Valkey and
  # resume each other's HLS segments off the shared RWX transcode PVC. Stable
@@ -109,9 +111,60 @@ spec:
          volumeMounts:
            - name: config
              mountPath: /config
+        # Render the SSO/LDAP plugin configs into the shared config volume,
+        # substituting the client secret and LDAP bind password from the
+        # VSO-synced oauth-credentials Secret (never committed). Plugin configs
+        # are fully managed here so they are overwritten every start; the login
+        # button branding is written only when absent so admin edits survive.
+        - name: inject-plugin-config
+          image: busybox:1.37.0
+          command:
+            - sh
+            - -c
+            - |
+              mkdir -p /config/plugins/configurations /config/config
+              chown 1000:1000 /config/plugins /config/plugins/configurations /config/config
+              esc() { printf '%s' "$1" | sed -e 's/[&|\\]/\\&/g'; }
+              cs=$(esc "${CLIENT_SECRET}")
+              lp=$(esc "${LDAP_BIND_PASSWORD}")
+              sed "s|@@CLIENT_SECRET@@|${cs}|" /templates/SSO-Auth.xml > /config/plugins/configurations/SSO-Auth.xml
+              sed "s|@@LDAP_BIND_PASSWORD@@|${lp}|" /templates/LDAP-Auth.xml > /config/plugins/configurations/LDAP-Auth.xml
+              chown 1000:1000 /config/plugins/configurations/SSO-Auth.xml /config/plugins/configurations/LDAP-Auth.xml
+              chmod 600 /config/plugins/configurations/SSO-Auth.xml /config/plugins/configurations/LDAP-Auth.xml
+              if [ ! -e /config/config/branding.xml ]; then
+                cp /templates/branding.xml /config/config/branding.xml
+                chown 1000:1000 /config/config/branding.xml
+                chmod 664 /config/config/branding.xml
+              fi
+          env:
+            - name: CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_secret
+                  optional: true
+            - name: LDAP_BIND_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: ldap_bind_password
+                  optional: true
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: plugin-config
+              mountPath: /templates
+              readOnly: true
      containers:
        - name: cheeztv
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.1.3
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.4.0
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
@@ -222,6 +275,9 @@ spec:
              subPath: kids
              readOnly: true
      volumes:
+        - name: plugin-config
+          configMap:
+            name: cheeztv-plugin-config
        - name: config
          persistentVolumeClaim:
            claimName: cheeztv-config
@@ -22,3 +22,27 @@ spec:
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
+---
+# Shared Authentik "jellyfin" OAuth2 client secret (key: client_secret) plus the
+# LDAP outpost bind password (key: ldap_bind_password) for the auth plugins.
+# The default k8s role's templated policy is namespace-scoped
+# (kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*), so each instance
+# reads its own namespace path; the SAME shared values must be seeded at both
+# fafflix and cheeztv paths. VSO syncs into the oauth-credentials Secret, whose
+# keys the inject-plugin-config initContainer substitutes into the plugin XML.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: oauth-credentials
+  namespace: cheeztv
+spec:
+  destination:
+    create: true
+    name: oauth-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/cheeztv/default/oauth-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
@@ -21,7 +21,7 @@ spec:
        runAsNonRoot: true
      containers:
        - name: operator
-          image: git.unkin.net/unkin/kea-operator:v0.1.3
+          image: git.unkin.net/unkin/kea-operator:v0.1.5
          args:
            - --metrics-bind-address=:8080
            - --health-probe-bind-address=:8081
@@ -23,7 +23,7 @@ spec:
      automountServiceAccountToken: true
      containers:
        - name: encapi
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/encapi:v0.1.1
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/encapi:v0.1.2
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8000
@@ -1,32 +1,32 @@
 ---
-# Second Ceph RGW (S3) bucket owned by the existing jellyfin backup user
-# (cnpg-jellyfin-backup, defined in cnpg_backup.yaml) — one user, two buckets:
+# Second Ceph RGW (S3) bucket owned by the existing fafflix backup user
+# (cnpg-fafflix-backup, defined in cnpg_backup.yaml) — one user, two buckets:
 # the CNPG barman bucket plus this one, which k8up uses to hold restic backups
-# of the jellyfin-config PVC. The BucketAccess emits read-write S3 creds into a
+# of the fafflix-config PVC. The BucketAccess emits read-write S3 creds into a
 # Secret the k8up Schedule consumes.
 apiVersion: ceph.unkin.net/v1alpha1
 kind: Bucket
 metadata:
-  name: jellyfin-config-backup
-  namespace: jellyfin
+  name: fafflix-config-backup
+  namespace: fafflix
 spec:
  placementTarget: ec
-  bucketName: jellyfin-config-backup
-  ownerRef: cnpg-jellyfin-backup
+  bucketName: fafflix-config-backup
+  ownerRef: cnpg-fafflix-backup
  versioning: false
  tags:
-    app: jellyfin
+    app: fafflix
    purpose: config-backup
  retainOnDelete: true
 ---
 apiVersion: ceph.unkin.net/v1alpha1
 kind: BucketAccess
 metadata:
-  name: jellyfin-config-backup
-  namespace: jellyfin
+  name: fafflix-config-backup
+  namespace: fafflix
 spec:
-  bucketRef: jellyfin-config-backup
+  bucketRef: fafflix-config-backup
  level: read-write
  # Operator writes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (+ S3_ENDPOINT,
  # BUCKET_NAME) into this Secret; the k8up Schedule reads the access keys.
-  secretName: jellyfin-config-backup-s3
+  secretName: fafflix-config-backup-s3
@@ -1,31 +1,31 @@
 ---
-# Ceph RGW (S3) backup target for the jellyfin CNPG cluster, provisioned by the
+# Ceph RGW (S3) backup target for the fafflix CNPG cluster, provisioned by the
 # in-estate cephrgw-operator: one dedicated bucket + owner user. CNPG reads the
 # S3 credential Secret from its own namespace.
 apiVersion: ceph.unkin.net/v1alpha1
 kind: ObjectStoreUser
 metadata:
-  name: cnpg-jellyfin-backup
-  namespace: jellyfin
+  name: cnpg-fafflix-backup
+  namespace: fafflix
 spec:
-  displayName: "CNPG backup owner (jellyfin)"
-  uid: cnpg-jellyfin-backup
+  displayName: "CNPG backup owner (fafflix)"
+  uid: cnpg-fafflix-backup
  maxBuckets: 5
-  secretName: cnpg-jellyfin-backup-s3
+  secretName: cnpg-fafflix-backup-s3
  retainOnDelete: true
 ---
 apiVersion: ceph.unkin.net/v1alpha1
 kind: Bucket
 metadata:
-  name: cnpg-jellyfin
-  namespace: jellyfin
+  name: cnpg-fafflix
+  namespace: fafflix
 spec:
  placementTarget: ec
-  bucketName: cnpg-jellyfin
-  ownerRef: cnpg-jellyfin-backup
+  bucketName: cnpg-fafflix
+  ownerRef: cnpg-fafflix-backup
  versioning: false
  tags:
-    app: jellyfin
+    app: fafflix
    purpose: cnpg-backup
  retainOnDelete: true
 ---
@@ -34,12 +34,12 @@ spec:
 apiVersion: postgresql.cnpg.io/v1
 kind: ScheduledBackup
 metadata:
-  name: cnpg-jellyfin-nightly
-  namespace: jellyfin
+  name: cnpg-fafflix-nightly
+  namespace: fafflix
 spec:
  schedule: "0 35 3 * * *"
  immediate: false
  backupOwnerReference: self
  method: barmanObjectStore
  cluster:
-    name: jellyfin-postgres
+    name: fafflix-postgres
@@ -1,17 +1,17 @@
 ---
-# Main Jellyfin database. The jellyfin-ha fork's experimental EF Core provider
+# Main Jellyfin database. The fafflix-ha fork's experimental EF Core provider
 # moves the entire Jellyfin DB (incl. library items) off SQLite into PostgreSQL,
 # which is what makes a shared-nothing multi-replica deployment possible. No
-# bootstrap secret is given, so CNPG generates the jellyfin-postgres-app secret
+# bootstrap secret is given, so CNPG generates the fafflix-postgres-app secret
 # (username/password/dbname) that the StatefulSet composes its DSN from.
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
-  name: jellyfin-postgres
-  namespace: jellyfin
+  name: fafflix-postgres
+  namespace: fafflix
 spec:
-  # Exclude the operator-managed data PVCs (jellyfin-postgres-N) from the
-  # jellyfin-config k8up Schedule (skipWithoutAnnotation is false cluster-wide,
+  # Exclude the operator-managed data PVCs (fafflix-postgres-N) from the
+  # fafflix-config k8up Schedule (skipWithoutAnnotation is false cluster-wide,
  # so unannotated PVCs are swept in). Postgres has its own barmanObjectStore
  # backup below; restic must not touch the raw RWO data volumes.
  inheritedMetadata:
@@ -23,19 +23,19 @@ spec:
    retentionPolicy: 30d
    barmanObjectStore:
      # Dedicated per-cluster Ceph RGW bucket (cephrgw-operator provisions it).
-      destinationPath: s3://cnpg-jellyfin
+      destinationPath: s3://cnpg-fafflix
      endpointURL: https://s3.ceph.unkin.net
      endpointCA:
        name: vault-ca-cert
        key: ca.crt
      s3Credentials:
        accessKeyId:
-          name: cnpg-jellyfin-backup-s3
+          name: cnpg-fafflix-backup-s3
          key: AWS_ACCESS_KEY_ID
        secretAccessKey:
-          name: cnpg-jellyfin-backup-s3
+          name: cnpg-fafflix-backup-s3
          key: AWS_SECRET_ACCESS_KEY
-      serverName: jellyfin
+      serverName: fafflix
      data:
        compression: bzip2
        jobs: 2
@@ -44,11 +44,11 @@ spec:
        maxParallel: 2
  bootstrap:
    initdb:
-      database: jellyfin
+      database: fafflix
      encoding: UTF8
      localeCType: C
      localeCollate: C
-      owner: jellyfin
+      owner: fafflix
  enablePDB: true
  enableSuperuserAccess: false
  failoverDelay: 0
@@ -1,15 +1,15 @@
 ---
-# PgBouncer pooler in front of the jellyfin-postgres cluster. Jellyfin connects
-# here (jellyfin-postgres-pooler:5432) rather than the -rw service so EF Core's
+# PgBouncer pooler in front of the fafflix-postgres cluster. Jellyfin connects
+# here (fafflix-postgres-pooler:5432) rather than the -rw service so EF Core's
 # connection churn is absorbed by the pool.
 apiVersion: postgresql.cnpg.io/v1
 kind: Pooler
 metadata:
-  name: jellyfin-postgres-pooler
-  namespace: jellyfin
+  name: fafflix-postgres-pooler
+  namespace: fafflix
 spec:
  cluster:
-    name: jellyfin-postgres
+    name: fafflix-postgres
  instances: 2
  pgbouncer:
    parameters:
@@ -20,7 +20,7 @@ spec:
  template:
    metadata:
      labels:
-        app: jellyfin-pooler
+        app: fafflix-pooler
    spec:
      affinity:
        podAntiAffinity:
@@ -30,7 +30,7 @@ spec:
                  - key: app
                    operator: In
                    values:
-                      - jellyfin-pooler
+                      - fafflix-pooler
              topologyKey: kubernetes.io/hostname
      containers: []
  type: rw
@@ -1,4 +1,9 @@
 ---
+# Fafflix (adult instance) keeps serving the legacy jellyfin hostname
+# (jellyfin.k8s.syd1.au.unkin.net) so the switch to a dedicated fafflix domain
+# can be deferred. Same internal-Traefik + external-dns pattern the old jellyfin app
+# used: external-dns publishes the A record at the internal LB VIP
+# (198.18.200.4) and cert-manager mints fafflix-tls off the Vault-PKI issuer.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -10,8 +15,8 @@ metadata:
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: jellyfin.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: jellyfin
-  namespace: jellyfin
+  name: fafflix
+  namespace: fafflix
 spec:
  gatewayClassName: traefik-internal
  listeners:
@@ -33,5 +38,5 @@ spec:
        certificateRefs:
          - group: ""
            kind: Secret
-            name: jellyfin-tls
+            name: fafflix-tls
        mode: Terminate
@@ -3,14 +3,14 @@ apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: http-redirect
-  namespace: jellyfin
+  namespace: fafflix
 spec:
  hostnames:
    - jellyfin.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
-      name: jellyfin
+      name: fafflix
      sectionName: http
  rules:
    - filters:
@@ -26,21 +26,21 @@ spec:
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: jellyfin-route
-  namespace: jellyfin
+  name: fafflix-route
+  namespace: fafflix
 spec:
  hostnames:
    - jellyfin.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
-      name: jellyfin
+      name: fafflix
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
-          name: jellyfin
+          name: fafflix
          port: 8096
          weight: 1
      matches:
@@ -15,9 +15,12 @@ resources:
  - pvc-transcode.yaml
  - pv-media-tv.yaml
  - pv-media-movies.yaml
+  - pv-mediastore.yaml
  - pvc-media-tv.yaml
  - pvc-media-movies.yaml
+  - pvc-mediastore.yaml
  - statefulset.yaml
+  - plugin-configmap.yaml
  - pdb.yaml
  - service.yaml
  - valkey.yaml
@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: jellyfin
+  name: fafflix
@@ -4,10 +4,10 @@
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
-  name: jellyfin
-  namespace: jellyfin
+  name: fafflix
+  namespace: fafflix
 spec:
  minAvailable: 1
  selector:
    matchLabels:
-      app: jellyfin
+      app: fafflix
@@ -0,0 +1,97 @@
+---
+# Declarative config for the browser-auth plugins bundled in the jellyfin-ha
+# image (jellyfin-plugin-sso, jellyfin-plugin-ldapauth). Rendered into
+# /config/plugins/configurations/ by the inject-plugin-config initContainer,
+# which substitutes the OidSecret / LdapBindPassword placeholders from the
+# VSO-synced oauth-credentials Secret so no secret is committed here. The SSO
+# provider key "authentik" must match the redirect path segment registered on
+# the shared Authentik "jellyfin" OAuth2 client. Roles/AdminRoles are matched
+# against the hierarchical Authentik groups claim (akP-jellyfin-user grants
+# login, akP-jellyfin-admin grants Jellyfin admin; global admins inherit the
+# latter via akR-global-admin).
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: fafflix-plugin-config
+  namespace: fafflix
+data:
+  SSO-Auth.xml: |
+    <?xml version="1.0" encoding="utf-8"?>
+    <PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+      <SamlConfigs />
+      <OidConfigs>
+        <item>
+          <key>
+            <string>authentik</string>
+          </key>
+          <value>
+            <PluginConfiguration>
+              <OidEndpoint>https://identity.unkin.net/application/o/jellyfin/</OidEndpoint>
+              <OidClientId>jellyfin</OidClientId>
+              <OidSecret>@@CLIENT_SECRET@@</OidSecret>
+              <Enabled>true</Enabled>
+              <EnableAuthorization>true</EnableAuthorization>
+              <EnableAllFolders>true</EnableAllFolders>
+              <EnabledFolders />
+              <AdminRoles>
+                <string>akP-jellyfin-admin</string>
+              </AdminRoles>
+              <Roles>
+                <string>akP-jellyfin-user</string>
+                <string>akP-jellyfin-admin</string>
+              </Roles>
+              <EnableFolderRoles>false</EnableFolderRoles>
+              <EnableLiveTvRoles>false</EnableLiveTvRoles>
+              <EnableLiveTv>false</EnableLiveTv>
+              <EnableLiveTvManagement>false</EnableLiveTvManagement>
+              <LiveTvRoles />
+              <LiveTvManagementRoles />
+              <FolderRoleMappings />
+              <RoleClaim>ak_groups</RoleClaim>
+              <OidScopes>
+                <string>openid</string>
+                <string>profile</string>
+                <string>email</string>
+                <string>ak_groups</string>
+              </OidScopes>
+              <CanonicalLinks></CanonicalLinks>
+              <DisableHttps>false</DisableHttps>
+              <DoNotValidateEndpoints>false</DoNotValidateEndpoints>
+              <DoNotValidateIssuerName>false</DoNotValidateIssuerName>
+              <SchemeOverride>https</SchemeOverride>
+            </PluginConfiguration>
+          </value>
+        </item>
+      </OidConfigs>
+    </PluginConfiguration>
+  LDAP-Auth.xml: |
+    <?xml version="1.0" encoding="utf-8"?>
+    <PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+      <LdapServer>authentik-ldap.authentik.svc.cluster.local</LdapServer>
+      <LdapPort>6636</LdapPort>
+      <UseSsl>true</UseSsl>
+      <UseStartTls>false</UseStartTls>
+      <SkipSslVerify>true</SkipSslVerify>
+      <LdapBindUser>cn=jellyfin-ldap,ou=users,DC=ldap,DC=goauthentik,DC=io</LdapBindUser>
+      <LdapBindPassword>@@LDAP_BIND_PASSWORD@@</LdapBindPassword>
+      <LdapBaseDn>ou=users,DC=ldap,DC=goauthentik,DC=io</LdapBaseDn>
+      <LdapSearchFilter>(objectClass=user)</LdapSearchFilter>
+      <LdapAdminBaseDn>ou=users,DC=ldap,DC=goauthentik,DC=io</LdapAdminBaseDn>
+      <LdapAdminFilter>(memberOf=cn=akP-jellyfin-admin,ou=groups,DC=ldap,DC=goauthentik,DC=io)</LdapAdminFilter>
+      <EnableLdapAdminFilterMemberUid>false</EnableLdapAdminFilterMemberUid>
+      <LdapSearchAttributes>uid, cn, mail, displayName</LdapSearchAttributes>
+      <CreateUsersFromLdap>true</CreateUsersFromLdap>
+      <AllowPassChange>false</AllowPassChange>
+      <LdapUidAttribute>cn</LdapUidAttribute>
+      <LdapUsernameAttribute>cn</LdapUsernameAttribute>
+      <LdapPasswordAttribute>userPassword</LdapPasswordAttribute>
+      <EnableAllFolders>true</EnableAllFolders>
+      <EnabledFolders />
+    </PluginConfiguration>
+  branding.xml: |
+    <?xml version="1.0" encoding="utf-8"?>
+    <BrandingOptions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+      <LoginDisclaimer>&lt;p style="text-align:center"&gt;&lt;a href="/sso/OID/start/authentik"&gt;Sign in with SSO&lt;/a&gt;&lt;/p&gt;</LoginDisclaimer>
+      <CustomCss></CustomCss>
+      <SplashscreenEnabled>false</SplashscreenEnabled>
+    </BrandingOptions>
@@ -1,11 +1,11 @@
 ---
 # Static PV for the shared MOVIES CephFS subvolume. Same rootPath as arrstack's
-# movies PV so radarr writes and jellyfin reads the identical library tree; each
+# movies PV so radarr writes and fafflix reads the identical library tree; each
 # namespace gets its own PV (unique name + volumeHandle) pinned by claimRef.
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: jellyfin-media-movies
+  name: fafflix-media-movies
 spec:
  capacity:
    storage: 1Ti
@@ -15,11 +15,11 @@ spec:
  storageClassName: ""
  volumeMode: Filesystem
  claimRef:
-    namespace: jellyfin
-    name: jellyfin-media-movies
+    namespace: fafflix
+    name: fafflix-media-movies
  csi:
    driver: cephfs.csi.ceph.com
-    volumeHandle: jellyfin-media-movies-static
+    volumeHandle: fafflix-media-movies-static
    nodeStageSecretRef:
      name: csi-cephfs-secret
      namespace: csi-cephfs
@@ -1,11 +1,11 @@
 ---
 # Static PV for the shared TV CephFS subvolume. Same rootPath as arrstack's
-# TV PV so sonarr writes and jellyfin reads the identical library tree; each
+# TV PV so sonarr writes and fafflix reads the identical library tree; each
 # namespace gets its own PV (unique name + volumeHandle) pinned by claimRef.
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: jellyfin-media-tv
+  name: fafflix-media-tv
 spec:
  capacity:
    storage: 1Ti
@@ -15,11 +15,11 @@ spec:
  storageClassName: ""
  volumeMode: Filesystem
  claimRef:
-    namespace: jellyfin
-    name: jellyfin-media-tv
+    namespace: fafflix
+    name: fafflix-media-tv
  csi:
    driver: cephfs.csi.ceph.com
-    volumeHandle: jellyfin-media-tv-static
+    volumeHandle: fafflix-media-tv-static
    nodeStageSecretRef:
      name: csi-cephfs-secret
      namespace: csi-cephfs
@@ -0,0 +1,31 @@
+---
+# Static PV for the shared MEDIASTORE CephFS subvolume. Same rootPath as
+# arrstack's mediastore PV so the arrs write and fafflix reads the identical
+# library tree (fafflix scans /fafflix/{tvseries,movies}); each namespace gets
+# its own PV (unique name + volumeHandle) pinned by claimRef.
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: fafflix-mediastore
+spec:
+  capacity:
+    storage: 10Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  volumeMode: Filesystem
+  claimRef:
+    namespace: fafflix
+    name: fafflix-mediastore
+  csi:
+    driver: cephfs.csi.ceph.com
+    volumeHandle: fafflix-mediastore-static
+    nodeStageSecretRef:
+      name: csi-cephfs-secret
+      namespace: csi-cephfs
+    volumeAttributes:
+      staticVolume: "true"
+      clusterID: cephfs_csi_ssd_ec_4_1
+      fsName: cephfs
+      rootPath: /volumes/csi_ssd_ec_4_1/mediastore/a0152dac-a51b-4b95-ac5e-ecdd99bfe3f1
@@ -1,17 +1,17 @@
 ---
 # Jellyfin config: metadata images, plugins, subtitles and config XML. Shared
 # ReadWriteMany across replicas (all pods read/write the same library metadata);
-# the main library DB now lives in PostgreSQL, not here. Retain — this is state.
+# the main library DB now lives in PostgreSQL, not here (on CephFS, raid5-delete).
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellyfin-config
-  namespace: jellyfin
+  name: fafflix-config
+  namespace: fafflix
 spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 20Gi
-  storageClassName: cephfs-raid5-retain
+  storageClassName: cephfs-raid5-delete
  volumeMode: Filesystem
@@ -1,16 +1,16 @@
 ---
 # Movie library, shared read-many across replicas. Statically bound to the
-# jellyfin-media-movies PV (shared CephFS subvolume also used by arrstack/radarr).
+# fafflix-media-movies PV (shared CephFS subvolume also used by arrstack/radarr).
 # storageClassName "" + volumeName disables dynamic provisioning and binds the
 # pre-created static PV.
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellyfin-media-movies
-  namespace: jellyfin
+  name: fafflix-media-movies
+  namespace: fafflix
  annotations:
-    # Exclude from the jellyfin-config k8up Schedule (skipWithoutAnnotation is
-    # false cluster-wide, so unannotated PVCs are swept in). Only jellyfin-config
+    # Exclude from the fafflix-config k8up Schedule (skipWithoutAnnotation is
+    # false cluster-wide, so unannotated PVCs are swept in). Only fafflix-config
    # is backed up; the media library is not restic-backup material.
    k8up.io/backup: "false"
 spec:
@@ -20,5 +20,5 @@ spec:
    requests:
      storage: 1Ti
  storageClassName: ""
-  volumeName: jellyfin-media-movies
+  volumeName: fafflix-media-movies
  volumeMode: Filesystem
@@ -1,16 +1,16 @@
 ---
 # TV library, shared read-many across replicas. Statically bound to the
-# jellyfin-media-tv PV (shared CephFS subvolume also used by arrstack/sonarr).
+# fafflix-media-tv PV (shared CephFS subvolume also used by arrstack/sonarr).
 # storageClassName "" + volumeName disables dynamic provisioning and binds the
 # pre-created static PV.
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellyfin-media-tv
-  namespace: jellyfin
+  name: fafflix-media-tv
+  namespace: fafflix
  annotations:
-    # Exclude from the jellyfin-config k8up Schedule (skipWithoutAnnotation is
-    # false cluster-wide, so unannotated PVCs are swept in). Only jellyfin-config
+    # Exclude from the fafflix-config k8up Schedule (skipWithoutAnnotation is
+    # false cluster-wide, so unannotated PVCs are swept in). Only fafflix-config
    # is backed up; the media library is not restic-backup material.
    k8up.io/backup: "false"
 spec:
@@ -20,5 +20,5 @@ spec:
    requests:
      storage: 1Ti
  storageClassName: ""
-  volumeName: jellyfin-media-tv
+  volumeName: fafflix-media-tv
  volumeMode: Filesystem
@@ -0,0 +1,24 @@
+---
+# Shared media tree, read-many across replicas. Statically bound to the
+# fafflix-mediastore PV (the CephFS subvolume also used by arrstack and
+# cheeztv). storageClassName "" + volumeName disables dynamic provisioning and
+# binds the pre-created static PV.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: fafflix-mediastore
+  namespace: fafflix
+  annotations:
+    # Exclude from the fafflix-config k8up Schedule (skipWithoutAnnotation is
+    # false cluster-wide, so unannotated PVCs are swept in). Only fafflix-config
+    # is backed up; the media library is not restic-backup material.
+    k8up.io/backup: "false"
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Ti
+  storageClassName: ""
+  volumeName: fafflix-mediastore
+  volumeMode: Filesystem
@@ -6,10 +6,10 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellyfin-transcode
-  namespace: jellyfin
+  name: fafflix-transcode
+  namespace: fafflix
  annotations:
-    # Exclude from the jellyfin-config k8up Schedule (skipWithoutAnnotation is
+    # Exclude from the fafflix-config k8up Schedule (skipWithoutAnnotation is
    # false cluster-wide, so unannotated PVCs are swept in). Transcode is RWX
    # scratch — nothing to back up.
    k8up.io/backup: "false"
@@ -1,8 +1,8 @@
 ---
-# k8up Schedule: restic backups of the jellyfin-config PVC (library metadata,
+# k8up Schedule: restic backups of the fafflix-config PVC (library metadata,
 # plugins, config XML) to the dedicated Ceph RGW config-backup bucket. S3 creds
-# come from the cephrgw BucketAccess Secret (jellyfin-config-backup-s3); the
-# restic repo password comes from Vault via the jellyfin-k8up-restic Secret.
+# come from the cephrgw BucketAccess Secret (fafflix-config-backup-s3); the
+# restic repo password comes from Vault via the fafflix-k8up-restic Secret.
 #
 # s3.ceph.unkin.net presents the internal unkin.net CA, which the k8up/restic
 # image does not trust by default, so the reflected vault-ca-cert Secret is
@@ -10,21 +10,21 @@
 apiVersion: k8up.io/v1
 kind: Schedule
 metadata:
-  name: jellyfin-config
-  namespace: jellyfin
+  name: fafflix-config
+  namespace: fafflix
 spec:
  backend:
    repoPasswordSecretRef:
-      name: jellyfin-k8up-restic
+      name: fafflix-k8up-restic
      key: password
    s3:
      endpoint: https://s3.ceph.unkin.net
-      bucket: jellyfin-config-backup
+      bucket: fafflix-config-backup
      accessKeyIDSecretRef:
-        name: jellyfin-config-backup-s3
+        name: fafflix-config-backup-s3
        key: AWS_ACCESS_KEY_ID
      secretAccessKeySecretRef:
-        name: jellyfin-config-backup-s3
+        name: fafflix-config-backup-s3
        key: AWS_SECRET_ACCESS_KEY
    tlsOptions:
      caCert: /etc/k8up/ca/ca.crt
@@ -2,8 +2,8 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: jellyfin
-  namespace: jellyfin
+  name: fafflix
+  namespace: fafflix
 spec:
  internalTrafficPolicy: Cluster
  ports:
@@ -12,7 +12,5 @@ spec:
      protocol: TCP
      targetPort: http
  selector:
-    app: jellyfin
-  # Pin each client to one replica to reduce transcode-session churn/takeover.
-  sessionAffinity: ClientIP
+    app: fafflix
  type: ClusterIP
@@ -2,24 +2,26 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: jellyfin
-  namespace: jellyfin
+  name: fafflix
+  namespace: fafflix
+  annotations:
+    configmap.reloader.stakater.com/auto: "true"
 spec:
  # HA: two replicas coordinate transcode session ownership through Valkey and
  # resume each other's HLS segments off the shared RWX transcode PVC. Stable
-  # pod names (jellyfin-0/1) are the lease owner identity, hence StatefulSet.
+  # pod names (fafflix-0/1) are the lease owner identity, hence StatefulSet.
  replicas: 2
-  serviceName: jellyfin
+  serviceName: fafflix
  podManagementPolicy: Parallel
  updateStrategy:
    type: RollingUpdate
  selector:
    matchLabels:
-      app: jellyfin
+      app: fafflix
  template:
    metadata:
      labels:
-        app: jellyfin
+        app: fafflix
    spec:
      securityContext:
        # Group-write the shared RWX volumes and grant the render/video groups so
@@ -41,7 +43,7 @@ spec:
              podAffinityTerm:
                labelSelector:
                  matchLabels:
-                    app: jellyfin
+                    app: fafflix
                topologyKey: kubernetes.io/hostname
      initContainers:
        # Seed the fork's PostgreSQL provider (database.xml) and Intel iGPU
@@ -109,9 +111,60 @@ spec:
          volumeMounts:
            - name: config
              mountPath: /config
+        # Render the SSO/LDAP plugin configs into the shared config volume,
+        # substituting the client secret and LDAP bind password from the
+        # VSO-synced oauth-credentials Secret (never committed). Plugin configs
+        # are fully managed here so they are overwritten every start; the login
+        # button branding is written only when absent so admin edits survive.
+        - name: inject-plugin-config
+          image: busybox:1.37.0
+          command:
+            - sh
+            - -c
+            - |
+              mkdir -p /config/plugins/configurations /config/config
+              chown 1000:1000 /config/plugins /config/plugins/configurations /config/config
+              esc() { printf '%s' "$1" | sed -e 's/[&|\\]/\\&/g'; }
+              cs=$(esc "${CLIENT_SECRET}")
+              lp=$(esc "${LDAP_BIND_PASSWORD}")
+              sed "s|@@CLIENT_SECRET@@|${cs}|" /templates/SSO-Auth.xml > /config/plugins/configurations/SSO-Auth.xml
+              sed "s|@@LDAP_BIND_PASSWORD@@|${lp}|" /templates/LDAP-Auth.xml > /config/plugins/configurations/LDAP-Auth.xml
+              chown 1000:1000 /config/plugins/configurations/SSO-Auth.xml /config/plugins/configurations/LDAP-Auth.xml
+              chmod 600 /config/plugins/configurations/SSO-Auth.xml /config/plugins/configurations/LDAP-Auth.xml
+              if [ ! -e /config/config/branding.xml ]; then
+                cp /templates/branding.xml /config/config/branding.xml
+                chown 1000:1000 /config/config/branding.xml
+                chmod 664 /config/config/branding.xml
+              fi
+          env:
+            - name: CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_secret
+                  optional: true
+            - name: LDAP_BIND_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: ldap_bind_password
+                  optional: true
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: plugin-config
+              mountPath: /templates
+              readOnly: true
      containers:
-        - name: jellyfin
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.1.3
+        - name: fafflix
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.4.0
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
@@ -137,9 +190,9 @@ spec:
            # Config dir must differ from the data root (Jellyfin sanity check).
            - name: JELLYFIN_CONFIG_DIR
              value: /config/config
-            # Distributed transcode session store (jellyfin-ha additions).
+            # Distributed transcode session store (fafflix-ha additions).
            - name: Jellyfin__TranscodeStore__RedisConnectionString
-              value: "valkey-jellyfin-valkey:6379,abortConnect=false"
+              value: "valkey-fafflix-valkey:6379,abortConnect=false"
            - name: Jellyfin__TranscodeStore__LeaseDurationSeconds
              value: "30"
            # PostgreSQL main DB via the CNPG-generated app secret, routed through
@@ -148,22 +201,22 @@ spec:
            - name: PGUSER
              valueFrom:
                secretKeyRef:
-                  name: jellyfin-postgres-app
+                  name: fafflix-postgres-app
                  key: username
            - name: PGPASSWORD
              valueFrom:
                secretKeyRef:
-                  name: jellyfin-postgres-app
+                  name: fafflix-postgres-app
                  key: password
            - name: PGDB
              valueFrom:
                secretKeyRef:
-                  name: jellyfin-postgres-app
+                  name: fafflix-postgres-app
                  key: dbname
            - name: POSTGRES_CONNECTION_STRING
-              value: "postgresql://$(PGUSER):$(PGPASSWORD)@jellyfin-postgres-pooler:5432/$(PGDB)"
+              value: "postgresql://$(PGUSER):$(PGPASSWORD)@fafflix-postgres-pooler:5432/$(PGDB)"
            - name: DATABASE_URL
-              value: "postgresql://$(PGUSER):$(PGPASSWORD)@jellyfin-postgres-pooler:5432/$(PGDB)"
+              value: "postgresql://$(PGUSER):$(PGPASSWORD)@fafflix-postgres-pooler:5432/$(PGDB)"
          livenessProbe:
            httpGet:
              path: /health
@@ -208,42 +261,55 @@ spec:
            - name: cache
              mountPath: /cache
            - name: media-tv
+              # Adult instance: mount the tvshows/adult subtree of the shared TV
+              # subvolume (subPath adult) as fafflix's primary TV library. Same
+              # rootPath the cheeztv instance reads under subPath kids, so an
+              # episode resolves identically across instances.
              mountPath: /media/tv
+              subPath: adult
              readOnly: true
-            - name: media-movies
-              mountPath: /media/movies
-              readOnly: true
-            # Kids subtrees surfaced as their own paths (same media PVCs, subPath
-            # kids) so a "Kids TV"/"Kids Movies" library can be added here and its
-            # titles are browsable and resume in this instance's own DB. The full
-            # /media/{tv,movies} mounts above are unchanged.
            - name: media-tv
+              # Also mount the kids TV subtree (subPath kids) so fafflix can
+              # resume playback of kids content started on cheeztv — same
+              # underlying subvolume, different subtree, distinct mount path.
              mountPath: /media/tv-kids
              subPath: kids
              readOnly: true
            - name: media-movies
+              # Adult instance: mount the movies/adult subtree of the shared
+              # movies subvolume (subPath adult) as fafflix's primary movie
+              # library.
+              mountPath: /media/movies
+              subPath: adult
+              readOnly: true
+            - name: media-movies
+              # Also mount the kids movies subtree (subPath kids) for cross-resume
+              # of kids content started on cheeztv.
              mountPath: /media/movies-kids
              subPath: kids
              readOnly: true
      volumes:
+        - name: plugin-config
+          configMap:
+            name: fafflix-plugin-config
        - name: config
          persistentVolumeClaim:
-            claimName: jellyfin-config
+            claimName: fafflix-config
        - name: transcode
          persistentVolumeClaim:
-            claimName: jellyfin-transcode
+            claimName: fafflix-transcode
        - name: media-tv
          persistentVolumeClaim:
-            claimName: jellyfin-media-tv
+            claimName: fafflix-media-tv
        - name: media-movies
          persistentVolumeClaim:
-            claimName: jellyfin-media-movies
+            claimName: fafflix-media-movies
  volumeClaimTemplates:
    # Per-pod scratch cache — RWO, disposable, one PVC per replica.
    - metadata:
        name: cache
        annotations:
-          # Exclude the per-pod cache PVCs from the jellyfin-config k8up Schedule
+          # Exclude the per-pod cache PVCs from the fafflix-config k8up Schedule
          # (skipWithoutAnnotation is false cluster-wide). Cache is disposable and
          # RWO — it would also fail to mount into the backup pod while in use.
          k8up.io/backup: "false"
--- a/Show More
+++ b/Show More