Add golib-ci ServiceAccount for woodpecker (#447)

## Why

The new `golib` repo's Woodpecker pipeline needs a dedicated ServiceAccount to run its CI steps under.

## How

- Add bare ServiceAccount `golib-ci` in the `woodpecker` namespace and wire it into the base kustomization.

Reviewed-on: #447
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/arrstack/arrproxy/api-deployment.yaml

@@ -5,7 +5,9 @@ metadata:
   name: arrproxy-api
   namespace: arrstack
   annotations:
-    # Wave 2: serve only after the wave-1 migrate Job completes.
+    # Wave 2: start only after the wave-0 CNPG Cluster and VSO-synced Secrets
+    # exist. The api self-migrates at startup under a Postgres advisory lock and
+    # holds /readyz until the schema is current, so no migration ordering is needed.
     argocd.argoproj.io/sync-wave: "2"
     secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-admin-token,arrproxy-db-app,sonarr-adult-apikey,radarr-adult-apikey,sonarr-kids-apikey,radarr-kids-apikey"
     configmap.reloader.stakater.com/reload: "arrproxy-tiers"
@@ -34,7 +36,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.4.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.6.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

apps/base/arrstack/arrproxy/gateway.yaml

@@ -1,9 +1,11 @@
 ---
 # External (DMZ) front for the arrstack, served on arrstack.unkin.net via the
-# external Traefik (LB VIP 198.18.199.0). cert-manager mints arrproxy-gateway-tls
-# (CN arrstack.unkin.net) off the internal Vault-PKI CA. The apex arrstack.unkin.net
-# A record lives in the bind-operator unkin.net zone (bind-internal/authoritative),
-# NOT external-dns, so no external-dns annotation here.
+# external Traefik (LB VIP 198.18.199.0). The apex arrstack.unkin.net A record
+# lives in the bind-operator unkin.net zone (bind-internal/authoritative), NOT
+# external-dns, so no external-dns annotation here. Public TLS is terminated with
+# the real Let's Encrypt *.unkin.net wildcard, centrally minted once in the
+# cert-manager namespace (Certificate wildcard-unkin-net) and reflected into this
+# namespace by the emberstack reflector as wildcard-unkin-net-tls, not Vault PKI.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -11,9 +13,6 @@ metadata:
     traefik.io/instance: external
   annotations:
     argocd.argoproj.io/sync-wave: "2"
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: arrstack.unkin.net
-    cert-manager.io/private-key-size: "4096"
   name: arrproxy
   namespace: arrstack
 spec:
@@ -38,4 +37,4 @@ spec:
         certificateRefs:
           - group: ""
             kind: Secret
-            name: arrproxy-gateway-tls
+            name: wildcard-unkin-net-tls

apps/base/arrstack/arrproxy/kustomization.yaml

@@ -5,8 +5,6 @@ kind: Kustomization
 resources:
   - cnpg_cluster.yaml
   - cnpg_backup.yaml
-  - migrations-configmap.yaml
-  - migrate-job.yaml
   - vaultstaticsecret.yaml
   - tiers-configmap.yaml
   - oauth2-proxy-configmap.yaml

apps/base/arrstack/arrproxy/migrate-job.yaml

@@ -1,92 +0,0 @@
----
-# Applies the arrproxy schema once per sync, before the api rolls, so the serve
-# replicas never race migrations (arrproxy-api does not self-migrate). Runs as the
-# CNPG-minted app user so the tokens table is owned by that role.
-#
-# Sync-phase hook at wave 1 (NOT PreSync): the CNPG Cluster + generated
-# arrproxy-db-app Secret apply at wave 0 and ArgoCD waits for the Cluster to be
-# Healthy before starting wave 1, so Postgres exists before migrate connects.
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: arrproxy-migrate
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/hook: Sync
-    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
-    argocd.argoproj.io/sync-wave: "1"
-spec:
-  backoffLimit: 6
-  ttlSecondsAfterFinished: 600
-  template:
-    metadata:
-      labels:
-        app: arrproxy-migrate
-    spec:
-      serviceAccountName: default
-      automountServiceAccountToken: false
-      restartPolicy: Never
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        fsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: migrate
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:18-alpine
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: HOME
-              value: /tmp
-            - name: PGUSER
-              valueFrom:
-                secretKeyRef:
-                  name: arrproxy-db-app
-                  key: username
-            - name: PGPASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: arrproxy-db-app
-                  key: password
-            - name: PGHOST
-              value: arrproxy-db-rw.arrstack.svc.cluster.local
-            - name: PGPORT
-              value: "5432"
-            - name: PGDATABASE
-              value: arrproxy
-            - name: PGSSLMODE
-              value: require
-          command:
-            - psql
-            - -v
-            - ON_ERROR_STOP=1
-            - -f
-            - /migrations/0001_init.sql
-          volumeMounts:
-            - name: migrations
-              mountPath: /migrations
-              readOnly: true
-            - name: tmp
-              mountPath: /tmp
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 100m
-              memory: 128Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-      volumes:
-        - name: migrations
-          configMap:
-            name: arrproxy-migrations
-        - name: tmp
-          emptyDir:
-            sizeLimit: 64Mi

apps/base/arrstack/arrproxy/migrations-configmap.yaml

@@ -1,29 +0,0 @@
----
-# arrproxy schema, mirrored from the arrproxy repo migrations/0001_init.sql
-# (v0.1.0). arrproxy-api does NOT self-migrate, so the wave-1 migrate Job applies
-# this once per sync as the app user. Keep in sync with the repo on schema bumps.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: arrproxy-migrations
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-data:
-  0001_init.sql: |
-    -- arrproxy token store. Only token hashes are persisted; plaintext is shown
-    -- once at mint time and never recoverable.
-    CREATE TABLE IF NOT EXISTS tokens (
-        id           TEXT PRIMARY KEY,
-        subject      TEXT        NOT NULL,
-        label        TEXT        NOT NULL DEFAULT '',
-        token_hash   TEXT        NOT NULL UNIQUE,
-        apps         TEXT[]      NOT NULL DEFAULT '{}',
-        created_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
-        expires_at   TIMESTAMPTZ,
-        disabled     BOOLEAN     NOT NULL DEFAULT false,
-        last_used_at TIMESTAMPTZ
-    );
-
-    CREATE INDEX IF NOT EXISTS tokens_subject_idx ON tokens (subject);
-    CREATE INDEX IF NOT EXISTS tokens_token_hash_idx ON tokens (token_hash);

apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml

@@ -35,7 +35,7 @@ spec:
         # identity.unkin.net serves a Vault-PKI cert; combine the system roots
         # with the internal CA so oauth2-proxy's OIDC HTTP client trusts it.
         - name: combine-certs
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3
+          image: docker.io/library/alpine:3
           imagePullPolicy: IfNotPresent
           command:
             - sh

apps/base/arrstack/arrproxy/ui-deployment.yaml

@@ -31,7 +31,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: ui
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-ui:v0.4.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-ui:v0.6.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

apps/base/arrstack/kustomization.yaml

@@ -8,9 +8,12 @@ resources:
   - pv-media-tv.yaml
   - pv-media-movies.yaml
   - pv-mediafs.yaml
+  - pv-mediastore.yaml
   - pvc-media-tv.yaml
   - pvc-media-movies.yaml
   - pvc-mediafs.yaml
+  - pvc-mediastore.yaml
+  - mediastore-bootstrap-job.yaml
   - media-bucket.yaml
   - backups-bucket.yaml
   - postgres

apps/base/arrstack/mediastore-bootstrap-job.yaml

@@ -0,0 +1,74 @@
+---
+# Seeds the directory skeleton on the freshly created mediastore subvolume so
+# the arrs, nzbget and both jellyfins mount subPaths that already exist and are
+# owned by uid/gid 1000 (the uid every arrstack media pod runs as). mkdir -p is
+# idempotent, so re-running it on every sync is harmless and self-heals a tree
+# someone deleted by hand.
+#
+# Sync hook with BeforeHookCreation delete: ArgoCD replaces the completed Job
+# each sync instead of failing on the immutable pod template. No sync-wave is
+# needed -- the PVC applies in the same wave and the pod simply stays Pending
+# until it binds.
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: mediastore-bootstrap
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+spec:
+  backoffLimit: 6
+  ttlSecondsAfterFinished: 600
+  template:
+    metadata:
+      labels:
+        app: mediastore-bootstrap
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: mkdir
+          image: docker.io/library/alpine:3
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+            - |
+              set -eu
+              mkdir -p \
+                /media/fafflix/tvseries \
+                /media/fafflix/movies \
+                /media/cheeztv/tvseries \
+                /media/cheeztv/movies \
+                /media/nzbget/downloads/complete
+              ls -la /media
+          volumeMounts:
+            - name: mediastore
+              mountPath: /media
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+      volumes:
+        - name: mediastore
+          persistentVolumeClaim:
+            claimName: mediastore

apps/base/arrstack/pv-mediastore.yaml

@@ -0,0 +1,32 @@
+---
+# Static PV for the shared MEDIASTORE CephFS subvolume: one 10Ti filesystem
+# holding every library plus the nzbget download tree, so arr imports are
+# same-filesystem hardlink moves across tv AND movies. Same rootPath as the
+# fafflix/cheeztv mediastore PVs; each namespace gets its own PV (unique name +
+# volumeHandle) pinned by claimRef.
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: arrstack-mediastore
+spec:
+  capacity:
+    storage: 10Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  volumeMode: Filesystem
+  claimRef:
+    namespace: arrstack
+    name: mediastore
+  csi:
+    driver: cephfs.csi.ceph.com
+    volumeHandle: arrstack-mediastore-static
+    nodeStageSecretRef:
+      name: csi-cephfs-secret
+      namespace: csi-cephfs
+    volumeAttributes:
+      staticVolume: "true"
+      clusterID: cephfs_csi_ssd_ec_4_1
+      fsName: cephfs
+      rootPath: /volumes/csi_ssd_ec_4_1/mediastore/a0152dac-a51b-4b95-ac5e-ecdd99bfe3f1

apps/base/arrstack/pvc-mediastore.yaml

@@ -0,0 +1,22 @@
+---
+# Whole media tree (/fafflix, /cheeztv, /nzbget) on one RWX filesystem, shared
+# across the sonarr/radarr/nzbget pods. Statically bound to the
+# arrstack-mediastore PV (the same CephFS subvolume fafflix and cheeztv mount).
+# storageClassName "" + volumeName disables dynamic provisioning and binds the
+# pre-created static PV.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mediastore
+  namespace: arrstack
+  annotations:
+    k8up.io/backup: "false"
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Ti
+  storageClassName: ""
+  volumeName: arrstack-mediastore
+  volumeMode: Filesystem

apps/base/arrstack/valkey/valkeycluster.yaml

@@ -28,7 +28,7 @@ metadata:
 spec:
   shards: 1
   replicas: 2
-  image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/valkey/valkey:9.0.0
+  image: docker.io/valkey/valkey:9.0.0
   exporter:
     enabled: false
   scheduling:

apps/base/artifactapi/redis-deployment.yaml

@@ -54,7 +54,7 @@ spec:
             successThreshold: 1
             timeoutSeconds: 5
         - name: metrics-exporter
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
+          image: docker.io/oliver006/redis_exporter:v1.89.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 9121

apps/base/authentik/gateway.yaml

@@ -1,19 +1,22 @@
 ---
+# External (DMZ) front for public identity.unkin.net, served via the external
+# Traefik (LB VIP 198.18.199.0). The apex identity.unkin.net A record lives in
+# the bind-operator unkin.net zone (bind-internal/authoritative), NOT
+# external-dns, so no external-dns annotation here. Public TLS is terminated with
+# the real Let's Encrypt *.unkin.net wildcard, centrally minted once in the
+# cert-manager namespace (Certificate wildcard-unkin-net) and reflected into this
+# namespace by the emberstack reflector as wildcard-unkin-net-tls, not Vault PKI.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
   labels:
-    traefik.io/instance: internal
+    traefik.io/instance: external
   annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: identity.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: identity.unkin.net,identity.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+    argocd.argoproj.io/sync-wave: "2"
   name: authentik
   namespace: authentik
 spec:
-  gatewayClassName: traefik-internal
+  gatewayClassName: traefik-external
   listeners:
     - allowedRoutes:
         namespaces:
@@ -33,20 +36,40 @@ spec:
         certificateRefs:
           - group: ""
             kind: Secret
-            name: authentik-tls
+            name: wildcard-unkin-net-tls
         mode: Terminate
+---
+# Cluster hostname variant, identity.k8s.syd1.au.unkin.net. Internal Traefik,
+# external-dns at 198.18.200.4. Own leaf from the Vault PKI issuer via the
+# cert-manager gateway-shim; the common-name keys off this cluster host.
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: identity.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: identity.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: authentik-internal
+  namespace: authentik
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
     - allowedRoutes:
         namespaces:
           from: Same
       hostname: identity.k8s.syd1.au.unkin.net
-      name: http-internal
+      name: http
       port: 80
       protocol: HTTP
     - allowedRoutes:
         namespaces:
           from: Same
       hostname: identity.k8s.syd1.au.unkin.net
-      name: https-internal
+      name: https
       port: 443
       protocol: HTTPS
       tls:

apps/base/authentik/httproute.yaml

@@ -7,16 +7,11 @@ metadata:
 spec:
   hostnames:
     - identity.unkin.net
-    - identity.k8s.syd1.au.unkin.net
   parentRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
       name: authentik
       sectionName: http
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: authentik
-      sectionName: http-internal
   rules:
     - filters:
         - type: RequestRedirect
@@ -36,16 +31,60 @@ metadata:
 spec:
   hostnames:
     - identity.unkin.net
-    - identity.k8s.syd1.au.unkin.net
   parentRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
       name: authentik
       sectionName: https
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: authentik
-      sectionName: https-internal
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: authentik-server
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: authentik-http-redirect-internal
+  namespace: authentik
+spec:
+  hostnames:
+    - identity.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik-internal
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: authentik-internal
+  namespace: authentik
+spec:
+  hostnames:
+    - identity.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik-internal
+      sectionName: https
   rules:
     - backendRefs:
         - group: ""

apps/base/authentik/kustomization.yaml

@@ -10,6 +10,9 @@ resources:
   - httproute.yaml
   - ldap-gateway.yaml
   - ldap-httproute.yaml
+  - ldap-outpost-deployment.yaml
+  - ldap-outpost-vaultstaticsecret.yaml
+  - ldap-outpost-vmpodscrape.yaml
   - ldap-service.yaml
   - ldap-tlsroute.yaml
   - namespace.yaml

apps/base/authentik/ldap-outpost-deployment.yaml

@@ -0,0 +1,104 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-ldap-outpost
+  namespace: authentik
+  labels:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/component: ldap
+spec:
+  # Outposts are stateless; run two replicas for availability.
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+      app.kubernetes.io/component: ldap
+  template:
+    metadata:
+      annotations:
+        secret.reloader.stakater.com/reload: "authentik-ldap-outpost-token,vault-ca-cert"
+      labels:
+        app.kubernetes.io/name: authentik
+        app.kubernetes.io/component: ldap
+    spec:
+      # The outpost validates the authentik core cert (identity.k8s.syd1.au.unkin.net,
+      # signed by the internal unkin.net CA). Combine the base image's public roots
+      # with the reflected vault-ca-cert into one bundle that SSL_CERT_FILE points at,
+      # so AUTHENTIK_INSECURE stays false.
+      initContainers:
+        - name: combine-certs
+          image: alpine:3
+          command:
+            - sh
+            - -c
+            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /custom-ca
+              readOnly: true
+            - name: combined-certs
+              mountPath: /combined-certs
+          resources:
+            limits:
+              cpu: 100m
+              memory: 64Mi
+            requests:
+              cpu: 25m
+              memory: 32Mi
+      containers:
+        - name: ldap
+          image: ghcr.io/goauthentik/ldap:2026.5.3
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: AUTHENTIK_HOST
+              value: https://identity.k8s.syd1.au.unkin.net
+            - name: AUTHENTIK_INSECURE
+              value: "false"
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/combined/ca-certificates.crt
+            - name: AUTHENTIK_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: authentik-ldap-outpost-token
+                  key: token
+          ports:
+            - containerPort: 3389
+              name: ldap
+              protocol: TCP
+            - containerPort: 6636
+              name: ldaps
+              protocol: TCP
+            - containerPort: 9300
+              name: metrics
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: ldap
+            initialDelaySeconds: 10
+            periodSeconds: 15
+          readinessProbe:
+            tcpSocket:
+              port: ldap
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            limits:
+              cpu: "1"
+              memory: 512Mi
+            requests:
+              cpu: 50m
+              memory: 128Mi
+          volumeMounts:
+            - name: combined-certs
+              mountPath: /etc/ssl/combined
+              readOnly: true
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: combined-certs
+          emptyDir: {}

apps/base/authentik/ldap-outpost-vaultstaticsecret.yaml

@@ -0,0 +1,20 @@
+---
+# Outpost API token, issued by authentik for the LDAP outpost and seeded into
+# Vault by the terraform-authentik apply. The KV value must exist at this path
+# with a `token` key before the outpost can connect.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: authentik-ldap-outpost-token
+  namespace: authentik
+spec:
+  destination:
+    create: true
+    name: authentik-ldap-outpost-token
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/authentik/default/outpost-token
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/authentik/ldap-outpost-vmpodscrape.yaml

@@ -0,0 +1,16 @@
+---
+# Scrape the LDAP outpost's Prometheus endpoint (:9300). Picked up by the
+# observability VMAgent (selectAllByDefault).
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: authentik-ldap-outpost
+  namespace: authentik
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+      app.kubernetes.io/component: ldap
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics

apps/base/authentik/ldap-service.yaml

@@ -7,6 +7,10 @@ metadata:
 spec:
   internalTrafficPolicy: Cluster
   ports:
+    - name: ldap
+      port: 3389
+      protocol: TCP
+      targetPort: 3389
     - name: ldaps
       port: 6636
       protocol: TCP

apps/base/authentik/redis-deployment.yaml

@@ -53,7 +53,7 @@ spec:
             - mountPath: /data
               name: redis-data
         - name: metrics-exporter
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
+          image: docker.io/oliver006/redis_exporter:v1.89.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 9121

apps/base/bind-internal/authoritative/records.yaml

@@ -16,9 +16,9 @@ spec:
   type: A
   ttl: 600
   values:
-    # traefik-internal gateway VIP; the authentik Gateway serves the
+    # traefik-EXTERNAL (DMZ) gateway VIP; the authentik Gateway serves the
     # identity.unkin.net hostname there.
-    - 198.18.200.4
+    - 198.18.199.0
 ---
 # PRODUCTION CUTOVER RECORD — intentionally commented out.
 # git.unkin.net currently resolves to the LIVE VM forge (HAProxy VRRP VIP
@@ -135,6 +135,21 @@ spec:
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: DNSRecord
+metadata:
+  name: cheeztv-dns-internal
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: cheeztv
+  type: A
+  ttl: 600
+  values:
+    # traefik-internal gateway VIP; the cheeztv Gateway serves cheeztv.unkin.net
+    # there.
+    - 198.18.200.4
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
 metadata:
   name: watchstate-dns-internal
   namespace: bind-internal

apps/base/cert-manager/certificate_wildcard-unkin-net.yaml

@@ -14,9 +14,9 @@ spec:
   secretTemplate:
     annotations:
       reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner"
       reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner"
   privateKey:
     size: 4096
   dnsNames:

apps/base/cheeztv/kustomization.yaml

@@ -15,9 +15,12 @@ resources:
   - pvc-transcode.yaml
   - pv-media-tv.yaml
   - pv-media-movies.yaml
+  - pv-mediastore.yaml
   - pvc-media-tv.yaml
   - pvc-media-movies.yaml
+  - pvc-mediastore.yaml
   - statefulset.yaml
+  - plugin-configmap.yaml
   - pdb.yaml
   - service.yaml
   - valkey.yaml

apps/base/cheeztv/plugin-configmap.yaml

@@ -0,0 +1,97 @@
+---
+# Declarative config for the browser-auth plugins bundled in the jellyfin-ha
+# image (jellyfin-plugin-sso, jellyfin-plugin-ldapauth). Rendered into
+# /config/plugins/configurations/ by the inject-plugin-config initContainer,
+# which substitutes the OidSecret / LdapBindPassword placeholders from the
+# VSO-synced oauth-credentials Secret so no secret is committed here. The SSO
+# provider key "authentik" must match the redirect path segment registered on
+# the shared Authentik "jellyfin" OAuth2 client. Roles/AdminRoles are matched
+# against the hierarchical Authentik groups claim (akP-jellyfin-user grants
+# login, akP-jellyfin-admin grants Jellyfin admin; global admins inherit the
+# latter via akR-global-admin).
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cheeztv-plugin-config
+  namespace: cheeztv
+data:
+  SSO-Auth.xml: |
+    <?xml version="1.0" encoding="utf-8"?>
+    <PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+      <SamlConfigs />
+      <OidConfigs>
+        <item>
+          <key>
+            <string>authentik</string>
+          </key>
+          <value>
+            <PluginConfiguration>
+              <OidEndpoint>https://identity.k8s.syd1.au.unkin.net/application/o/jellyfin/</OidEndpoint>
+              <OidClientId>jellyfin</OidClientId>
+              <OidSecret>@@CLIENT_SECRET@@</OidSecret>
+              <Enabled>true</Enabled>
+              <EnableAuthorization>true</EnableAuthorization>
+              <EnableAllFolders>true</EnableAllFolders>
+              <EnabledFolders />
+              <AdminRoles>
+                <string>akP-jellyfin-admin</string>
+              </AdminRoles>
+              <Roles>
+                <string>akP-jellyfin-user</string>
+                <string>akP-jellyfin-admin</string>
+              </Roles>
+              <EnableFolderRoles>false</EnableFolderRoles>
+              <EnableLiveTvRoles>false</EnableLiveTvRoles>
+              <EnableLiveTv>false</EnableLiveTv>
+              <EnableLiveTvManagement>false</EnableLiveTvManagement>
+              <LiveTvRoles />
+              <LiveTvManagementRoles />
+              <FolderRoleMappings />
+              <RoleClaim>ak_groups</RoleClaim>
+              <OidScopes>
+                <string>openid</string>
+                <string>profile</string>
+                <string>email</string>
+                <string>ak_groups</string>
+              </OidScopes>
+              <CanonicalLinks></CanonicalLinks>
+              <DisableHttps>false</DisableHttps>
+              <DoNotValidateEndpoints>false</DoNotValidateEndpoints>
+              <DoNotValidateIssuerName>false</DoNotValidateIssuerName>
+              <SchemeOverride>https</SchemeOverride>
+            </PluginConfiguration>
+          </value>
+        </item>
+      </OidConfigs>
+    </PluginConfiguration>
+  LDAP-Auth.xml: |
+    <?xml version="1.0" encoding="utf-8"?>
+    <PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+      <LdapServer>authentik-ldap.authentik.svc.cluster.local</LdapServer>
+      <LdapPort>6636</LdapPort>
+      <UseSsl>true</UseSsl>
+      <UseStartTls>false</UseStartTls>
+      <SkipSslVerify>true</SkipSslVerify>
+      <LdapBindUser>cn=jellyfin-ldap,ou=users,DC=ldap,DC=goauthentik,DC=io</LdapBindUser>
+      <LdapBindPassword>@@LDAP_BIND_PASSWORD@@</LdapBindPassword>
+      <LdapBaseDn>ou=users,DC=ldap,DC=goauthentik,DC=io</LdapBaseDn>
+      <LdapSearchFilter>(objectClass=user)</LdapSearchFilter>
+      <LdapAdminBaseDn>ou=users,DC=ldap,DC=goauthentik,DC=io</LdapAdminBaseDn>
+      <LdapAdminFilter>(memberOf=cn=akP-jellyfin-admin,ou=groups,DC=ldap,DC=goauthentik,DC=io)</LdapAdminFilter>
+      <EnableLdapAdminFilterMemberUid>false</EnableLdapAdminFilterMemberUid>
+      <LdapSearchAttributes>uid, cn, mail, displayName</LdapSearchAttributes>
+      <CreateUsersFromLdap>true</CreateUsersFromLdap>
+      <AllowPassChange>false</AllowPassChange>
+      <LdapUidAttribute>cn</LdapUidAttribute>
+      <LdapUsernameAttribute>cn</LdapUsernameAttribute>
+      <LdapPasswordAttribute>userPassword</LdapPasswordAttribute>
+      <EnableAllFolders>true</EnableAllFolders>
+      <EnabledFolders />
+    </PluginConfiguration>
+  branding.xml: |
+    <?xml version="1.0" encoding="utf-8"?>
+    <BrandingOptions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+      <LoginDisclaimer>&lt;p style="text-align:center"&gt;&lt;a href="/sso/OID/start/authentik"&gt;Sign in with SSO&lt;/a&gt;&lt;/p&gt;</LoginDisclaimer>
+      <CustomCss></CustomCss>
+      <SplashscreenEnabled>false</SplashscreenEnabled>
+    </BrandingOptions>

apps/base/cheeztv/pv-mediastore.yaml

@@ -0,0 +1,31 @@
+---
+# Static PV for the shared MEDIASTORE CephFS subvolume. Same rootPath as
+# arrstack's mediastore PV so the arrs write and cheeztv reads the identical
+# library tree (cheeztv scans /cheeztv/{tvseries,movies}); each namespace gets
+# its own PV (unique name + volumeHandle) pinned by claimRef.
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: cheeztv-mediastore
+spec:
+  capacity:
+    storage: 10Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  volumeMode: Filesystem
+  claimRef:
+    namespace: cheeztv
+    name: cheeztv-mediastore
+  csi:
+    driver: cephfs.csi.ceph.com
+    volumeHandle: cheeztv-mediastore-static
+    nodeStageSecretRef:
+      name: csi-cephfs-secret
+      namespace: csi-cephfs
+    volumeAttributes:
+      staticVolume: "true"
+      clusterID: cephfs_csi_ssd_ec_4_1
+      fsName: cephfs
+      rootPath: /volumes/csi_ssd_ec_4_1/mediastore/a0152dac-a51b-4b95-ac5e-ecdd99bfe3f1

apps/base/cheeztv/pvc-mediastore.yaml

@@ -0,0 +1,24 @@
+---
+# Shared media tree, read-many across replicas. Statically bound to the
+# cheeztv-mediastore PV (the CephFS subvolume also used by arrstack and
+# fafflix). storageClassName "" + volumeName disables dynamic provisioning and
+# binds the pre-created static PV.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: cheeztv-mediastore
+  namespace: cheeztv
+  annotations:
+    # Exclude from the cheeztv-config k8up Schedule (skipWithoutAnnotation is
+    # false cluster-wide, so unannotated PVCs are swept in). Only cheeztv-config
+    # is backed up; the media library is not restic-backup material.
+    k8up.io/backup: "false"
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Ti
+  storageClassName: ""
+  volumeName: cheeztv-mediastore
+  volumeMode: Filesystem

apps/base/cheeztv/statefulset.yaml

@@ -109,9 +109,60 @@ spec:
           volumeMounts:
             - name: config
               mountPath: /config
+        # Render the SSO/LDAP plugin configs into the shared config volume,
+        # substituting the client secret and LDAP bind password from the
+        # VSO-synced oauth-credentials Secret (never committed). Plugin configs
+        # are fully managed here so they are overwritten every start; the login
+        # button branding is written only when absent so admin edits survive.
+        - name: inject-plugin-config
+          image: busybox:1.37.0
+          command:
+            - sh
+            - -c
+            - |
+              mkdir -p /config/plugins/configurations /config/config
+              chown 1000:1000 /config/plugins /config/plugins/configurations /config/config
+              esc() { printf '%s' "$1" | sed -e 's/[&|\\]/\\&/g'; }
+              cs=$(esc "${CLIENT_SECRET}")
+              lp=$(esc "${LDAP_BIND_PASSWORD}")
+              sed "s|@@CLIENT_SECRET@@|${cs}|" /templates/SSO-Auth.xml > /config/plugins/configurations/SSO-Auth.xml
+              sed "s|@@LDAP_BIND_PASSWORD@@|${lp}|" /templates/LDAP-Auth.xml > /config/plugins/configurations/LDAP-Auth.xml
+              chown 1000:1000 /config/plugins/configurations/SSO-Auth.xml /config/plugins/configurations/LDAP-Auth.xml
+              chmod 600 /config/plugins/configurations/SSO-Auth.xml /config/plugins/configurations/LDAP-Auth.xml
+              if [ ! -e /config/config/branding.xml ]; then
+                cp /templates/branding.xml /config/config/branding.xml
+                chown 1000:1000 /config/config/branding.xml
+                chmod 664 /config/config/branding.xml
+              fi
+          env:
+            - name: CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_secret
+                  optional: true
+            - name: LDAP_BIND_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: ldap_bind_password
+                  optional: true
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: plugin-config
+              mountPath: /templates
+              readOnly: true
       containers:
         - name: cheeztv
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.1.3
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.2.0
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
@@ -222,6 +273,9 @@ spec:
               subPath: kids
               readOnly: true
       volumes:
+        - name: plugin-config
+          configMap:
+            name: cheeztv-plugin-config
         - name: config
           persistentVolumeClaim:
             claimName: cheeztv-config

apps/base/cheeztv/vaultstaticsecret.yaml

@@ -22,3 +22,27 @@ spec:
   refreshAfter: 5m
   type: kv-v2
   vaultAuthRef: default
+---
+# Shared Authentik "jellyfin" OAuth2 client secret (key: client_secret) plus the
+# LDAP outpost bind password (key: ldap_bind_password) for the auth plugins.
+# The default k8s role's templated policy is namespace-scoped
+# (kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*), so each instance
+# reads its own namespace path; the SAME shared values must be seeded at both
+# fafflix and cheeztv paths. VSO syncs into the oauth-credentials Secret, whose
+# keys the inject-plugin-config initContainer substitutes into the plugin XML.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: oauth-credentials
+  namespace: cheeztv
+spec:
+  destination:
+    create: true
+    name: oauth-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/cheeztv/default/oauth-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/dhcp-system/deployment.yaml

@@ -21,7 +21,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: git.unkin.net/unkin/kea-operator:v0.1.3
+          image: git.unkin.net/unkin/kea-operator:v0.1.5
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081

apps/base/fafflix/kustomization.yaml

@@ -15,9 +15,12 @@ resources:
   - pvc-transcode.yaml
   - pv-media-tv.yaml
   - pv-media-movies.yaml
+  - pv-mediastore.yaml
   - pvc-media-tv.yaml
   - pvc-media-movies.yaml
+  - pvc-mediastore.yaml
   - statefulset.yaml
+  - plugin-configmap.yaml
   - pdb.yaml
   - service.yaml
   - valkey.yaml

apps/base/fafflix/plugin-configmap.yaml

@@ -0,0 +1,97 @@
+---
+# Declarative config for the browser-auth plugins bundled in the jellyfin-ha
+# image (jellyfin-plugin-sso, jellyfin-plugin-ldapauth). Rendered into
+# /config/plugins/configurations/ by the inject-plugin-config initContainer,
+# which substitutes the OidSecret / LdapBindPassword placeholders from the
+# VSO-synced oauth-credentials Secret so no secret is committed here. The SSO
+# provider key "authentik" must match the redirect path segment registered on
+# the shared Authentik "jellyfin" OAuth2 client. Roles/AdminRoles are matched
+# against the hierarchical Authentik groups claim (akP-jellyfin-user grants
+# login, akP-jellyfin-admin grants Jellyfin admin; global admins inherit the
+# latter via akR-global-admin).
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: fafflix-plugin-config
+  namespace: fafflix
+data:
+  SSO-Auth.xml: |
+    <?xml version="1.0" encoding="utf-8"?>
+    <PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+      <SamlConfigs />
+      <OidConfigs>
+        <item>
+          <key>
+            <string>authentik</string>
+          </key>
+          <value>
+            <PluginConfiguration>
+              <OidEndpoint>https://identity.k8s.syd1.au.unkin.net/application/o/jellyfin/</OidEndpoint>
+              <OidClientId>jellyfin</OidClientId>
+              <OidSecret>@@CLIENT_SECRET@@</OidSecret>
+              <Enabled>true</Enabled>
+              <EnableAuthorization>true</EnableAuthorization>
+              <EnableAllFolders>true</EnableAllFolders>
+              <EnabledFolders />
+              <AdminRoles>
+                <string>akP-jellyfin-admin</string>
+              </AdminRoles>
+              <Roles>
+                <string>akP-jellyfin-user</string>
+                <string>akP-jellyfin-admin</string>
+              </Roles>
+              <EnableFolderRoles>false</EnableFolderRoles>
+              <EnableLiveTvRoles>false</EnableLiveTvRoles>
+              <EnableLiveTv>false</EnableLiveTv>
+              <EnableLiveTvManagement>false</EnableLiveTvManagement>
+              <LiveTvRoles />
+              <LiveTvManagementRoles />
+              <FolderRoleMappings />
+              <RoleClaim>ak_groups</RoleClaim>
+              <OidScopes>
+                <string>openid</string>
+                <string>profile</string>
+                <string>email</string>
+                <string>ak_groups</string>
+              </OidScopes>
+              <CanonicalLinks></CanonicalLinks>
+              <DisableHttps>false</DisableHttps>
+              <DoNotValidateEndpoints>false</DoNotValidateEndpoints>
+              <DoNotValidateIssuerName>false</DoNotValidateIssuerName>
+              <SchemeOverride>https</SchemeOverride>
+            </PluginConfiguration>
+          </value>
+        </item>
+      </OidConfigs>
+    </PluginConfiguration>
+  LDAP-Auth.xml: |
+    <?xml version="1.0" encoding="utf-8"?>
+    <PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+      <LdapServer>authentik-ldap.authentik.svc.cluster.local</LdapServer>
+      <LdapPort>6636</LdapPort>
+      <UseSsl>true</UseSsl>
+      <UseStartTls>false</UseStartTls>
+      <SkipSslVerify>true</SkipSslVerify>
+      <LdapBindUser>cn=jellyfin-ldap,ou=users,DC=ldap,DC=goauthentik,DC=io</LdapBindUser>
+      <LdapBindPassword>@@LDAP_BIND_PASSWORD@@</LdapBindPassword>
+      <LdapBaseDn>ou=users,DC=ldap,DC=goauthentik,DC=io</LdapBaseDn>
+      <LdapSearchFilter>(objectClass=user)</LdapSearchFilter>
+      <LdapAdminBaseDn>ou=users,DC=ldap,DC=goauthentik,DC=io</LdapAdminBaseDn>
+      <LdapAdminFilter>(memberOf=cn=akP-jellyfin-admin,ou=groups,DC=ldap,DC=goauthentik,DC=io)</LdapAdminFilter>
+      <EnableLdapAdminFilterMemberUid>false</EnableLdapAdminFilterMemberUid>
+      <LdapSearchAttributes>uid, cn, mail, displayName</LdapSearchAttributes>
+      <CreateUsersFromLdap>true</CreateUsersFromLdap>
+      <AllowPassChange>false</AllowPassChange>
+      <LdapUidAttribute>cn</LdapUidAttribute>
+      <LdapUsernameAttribute>cn</LdapUsernameAttribute>
+      <LdapPasswordAttribute>userPassword</LdapPasswordAttribute>
+      <EnableAllFolders>true</EnableAllFolders>
+      <EnabledFolders />
+    </PluginConfiguration>
+  branding.xml: |
+    <?xml version="1.0" encoding="utf-8"?>
+    <BrandingOptions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+      <LoginDisclaimer>&lt;p style="text-align:center"&gt;&lt;a href="/sso/OID/start/authentik"&gt;Sign in with SSO&lt;/a&gt;&lt;/p&gt;</LoginDisclaimer>
+      <CustomCss></CustomCss>
+      <SplashscreenEnabled>false</SplashscreenEnabled>
+    </BrandingOptions>

apps/base/fafflix/pv-mediastore.yaml

@@ -0,0 +1,31 @@
+---
+# Static PV for the shared MEDIASTORE CephFS subvolume. Same rootPath as
+# arrstack's mediastore PV so the arrs write and fafflix reads the identical
+# library tree (fafflix scans /fafflix/{tvseries,movies}); each namespace gets
+# its own PV (unique name + volumeHandle) pinned by claimRef.
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: fafflix-mediastore
+spec:
+  capacity:
+    storage: 10Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  volumeMode: Filesystem
+  claimRef:
+    namespace: fafflix
+    name: fafflix-mediastore
+  csi:
+    driver: cephfs.csi.ceph.com
+    volumeHandle: fafflix-mediastore-static
+    nodeStageSecretRef:
+      name: csi-cephfs-secret
+      namespace: csi-cephfs
+    volumeAttributes:
+      staticVolume: "true"
+      clusterID: cephfs_csi_ssd_ec_4_1
+      fsName: cephfs
+      rootPath: /volumes/csi_ssd_ec_4_1/mediastore/a0152dac-a51b-4b95-ac5e-ecdd99bfe3f1

apps/base/fafflix/pvc-mediastore.yaml

@@ -0,0 +1,24 @@
+---
+# Shared media tree, read-many across replicas. Statically bound to the
+# fafflix-mediastore PV (the CephFS subvolume also used by arrstack and
+# cheeztv). storageClassName "" + volumeName disables dynamic provisioning and
+# binds the pre-created static PV.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: fafflix-mediastore
+  namespace: fafflix
+  annotations:
+    # Exclude from the fafflix-config k8up Schedule (skipWithoutAnnotation is
+    # false cluster-wide, so unannotated PVCs are swept in). Only fafflix-config
+    # is backed up; the media library is not restic-backup material.
+    k8up.io/backup: "false"
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Ti
+  storageClassName: ""
+  volumeName: fafflix-mediastore
+  volumeMode: Filesystem

apps/base/fafflix/statefulset.yaml

@@ -109,9 +109,60 @@ spec:
           volumeMounts:
             - name: config
               mountPath: /config
+        # Render the SSO/LDAP plugin configs into the shared config volume,
+        # substituting the client secret and LDAP bind password from the
+        # VSO-synced oauth-credentials Secret (never committed). Plugin configs
+        # are fully managed here so they are overwritten every start; the login
+        # button branding is written only when absent so admin edits survive.
+        - name: inject-plugin-config
+          image: busybox:1.37.0
+          command:
+            - sh
+            - -c
+            - |
+              mkdir -p /config/plugins/configurations /config/config
+              chown 1000:1000 /config/plugins /config/plugins/configurations /config/config
+              esc() { printf '%s' "$1" | sed -e 's/[&|\\]/\\&/g'; }
+              cs=$(esc "${CLIENT_SECRET}")
+              lp=$(esc "${LDAP_BIND_PASSWORD}")
+              sed "s|@@CLIENT_SECRET@@|${cs}|" /templates/SSO-Auth.xml > /config/plugins/configurations/SSO-Auth.xml
+              sed "s|@@LDAP_BIND_PASSWORD@@|${lp}|" /templates/LDAP-Auth.xml > /config/plugins/configurations/LDAP-Auth.xml
+              chown 1000:1000 /config/plugins/configurations/SSO-Auth.xml /config/plugins/configurations/LDAP-Auth.xml
+              chmod 600 /config/plugins/configurations/SSO-Auth.xml /config/plugins/configurations/LDAP-Auth.xml
+              if [ ! -e /config/config/branding.xml ]; then
+                cp /templates/branding.xml /config/config/branding.xml
+                chown 1000:1000 /config/config/branding.xml
+                chmod 664 /config/config/branding.xml
+              fi
+          env:
+            - name: CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_secret
+                  optional: true
+            - name: LDAP_BIND_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: ldap_bind_password
+                  optional: true
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: plugin-config
+              mountPath: /templates
+              readOnly: true
       containers:
         - name: fafflix
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.1.3
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.2.0
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
@@ -236,6 +287,9 @@ spec:
               subPath: kids
               readOnly: true
       volumes:
+        - name: plugin-config
+          configMap:
+            name: fafflix-plugin-config
         - name: config
           persistentVolumeClaim:
             claimName: fafflix-config

apps/base/fafflix/vaultstaticsecret.yaml

@@ -22,3 +22,27 @@ spec:
   refreshAfter: 5m
   type: kv-v2
   vaultAuthRef: default
+---
+# Shared Authentik "jellyfin" OAuth2 client secret (key: client_secret) plus the
+# LDAP outpost bind password (key: ldap_bind_password) for the auth plugins.
+# The default k8s role's templated policy is namespace-scoped
+# (kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*), so each instance
+# reads its own namespace path; the SAME shared values must be seeded at both
+# fafflix and cheeztv paths. VSO syncs into the oauth-credentials Secret, whose
+# keys the inject-plugin-config initContainer substitutes into the plugin XML.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: oauth-credentials
+  namespace: fafflix
+spec:
+  destination:
+    create: true
+    name: oauth-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/fafflix/default/oauth-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/gitea/valkey-deployment.yaml

@@ -83,7 +83,7 @@ spec:
             - mountPath: /data
               name: data
         - name: metrics-exporter
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
+          image: docker.io/oliver006/redis_exporter:v1.89.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 9121

apps/base/grafana/grafana.yaml

@@ -26,13 +26,6 @@ spec:
                     secretKeyRef:
                       name: oauth-credentials
                       key: client_secret
-              # identity.unkin.net is served by the internal unkin.net CA, which
-              # the stock Grafana image doesn't trust. Mount the reflected
-              # vault-ca-cert and point generic_oauth's tls_client_ca at it.
-              volumeMounts:
-                - name: vault-ca-cert
-                  mountPath: /etc/grafana/vault-ca
-                  readOnly: true
               resources:
                 requests:
                   cpu: 100m
@@ -40,13 +33,6 @@ spec:
                 limits:
                   cpu: "1"
                   memory: 1Gi
-          volumes:
-            - name: vault-ca-cert
-              secret:
-                secretName: vault-ca-cert
-                items:
-                  - key: ca.crt
-                    path: ca.crt
   config:
     server:
       root_url: "https://grafana.k8s.syd1.au.unkin.net"
@@ -71,9 +57,6 @@ spec:
       auth_url: "https://identity.unkin.net/application/o/authorize/"
       token_url: "https://identity.unkin.net/application/o/token/"
       api_url: "https://identity.unkin.net/application/o/userinfo/"
-      # Trust the internal unkin.net CA that signs identity.unkin.net's cert
-      # (mounted from the reflected vault-ca-cert Secret).
-      tls_client_ca: "/etc/grafana/vault-ca/ca.crt"
       # Authentik permission groups -> Grafana roles. akP-grafana-admin is granted
       # to akR-global-admin members (and direct members) via terraform-authentik.
       role_attribute_path: "contains(ak_groups[*], 'akP-grafana-admin') && 'Admin' || 'Viewer'"

apps/base/litellm/redis-deployment.yaml

@@ -61,7 +61,7 @@ spec:
               mountPropagation: None
               name: data
         - name: metrics-exporter
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
+          image: docker.io/oliver006/redis_exporter:v1.89.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 9121

apps/base/logging/clickhouseinstallation.yaml

@@ -87,7 +87,7 @@ spec:
             runAsGroup: 101
           containers:
             - name: clickhouse
-              image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/clickhouse/clickhouse-server:24.8
+              image: docker.io/clickhouse/clickhouse-server:24.8
               resources:
                 requests:
                   cpu: 500m

apps/base/logging/job_clickhouse-schema.yaml

@@ -32,7 +32,7 @@ spec:
         runAsGroup: 101
       containers:
         - name: clickhouse-schema
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/clickhouse/clickhouse-server:24.8
+          image: docker.io/clickhouse/clickhouse-server:24.8
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

apps/base/logging/logviewer/oauth2-proxy-deployment.yaml

@@ -34,7 +34,7 @@ spec:
         # identity.unkin.net serves a Vault-PKI cert; combine the system roots
         # with the internal CA so oauth2-proxy's OIDC HTTP client trusts it.
         - name: combine-certs
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3
+          image: docker.io/library/alpine:3
           imagePullPolicy: IfNotPresent
           command:
             - sh

apps/base/logging/nats-bootstrap-job.yaml

@@ -58,7 +58,7 @@ spec:
         runAsGroup: 1000
       containers:
         - name: nats-bootstrap
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/natsio/nats-box:0.18.0
+          image: docker.io/natsio/nats-box:0.18.0
           # nats CLI stats the working directory when loading its response
           # schemas; under readOnlyRootFilesystem + runAsUser 1000 the image's
           # default WORKDIR is not accessible ("stat .: permission denied"), so

apps/base/mediamark/deployment.yaml

@@ -0,0 +1,114 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mediamark
+  namespace: mediamark
+  annotations:
+    secret.reloader.stakater.com/reload: "arrstack-virtual-key"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: mediamark
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: mediamark
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        # 1000:1000 matches the media tree ownership on the shared mediastore
+        # subvolume; mediamark hardlinks/renames files the *arr apps own, so it
+        # deliberately does NOT run as the usual 65532.
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: mediamark
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/mediamark:v0.1.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8080
+              name: http
+              protocol: TCP
+          env:
+            - name: MEDIAMARK_MEDIA_ROOT
+              value: /media
+            - name: MEDIAMARK_KEYS_DIR
+              value: /etc/mediamark/keys
+            # Virtual keys are only honoured by arrproxy, which validates the
+            # machine token and injects the real per-app key upstream; the
+            # sonarr/radarr Services would reject them.
+            - name: MEDIAMARK_SONARR_URL
+              value: http://arrproxy-api.arrstack.svc.cluster.local:8080/3aa168/sonarr
+            - name: MEDIAMARK_RADARR_URL
+              value: http://arrproxy-api.arrstack.svc.cluster.local:8080/3aa168/radarr
+            # oauth2-proxy --pass-user-headers forwards the Authentik groups as a
+            # comma-joined X-Forwarded-Groups; X-Auth-Request-Groups is
+            # auth_request-response-only and never reaches a proxied upstream.
+            - name: MEDIAMARK_GROUPS_HEADER
+              value: X-Forwarded-Groups
+            - name: MEDIAMARK_ALLOWED_GROUPS
+              value: akP-mediamark-user
+          volumeMounts:
+            - name: mediastore
+              mountPath: /media
+            - name: arr-keys
+              mountPath: /etc/mediamark/keys
+              readOnly: true
+          livenessProbe:
+            httpGet:
+              path: /livez
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+      volumes:
+        - name: mediastore
+          persistentVolumeClaim:
+            claimName: mediamark-mediastore
+        # One ephemeral virtual key covers both apps, so the same token lands on
+        # both per-app files under MEDIAMARK_KEYS_DIR; mediamark re-reads the
+        # file per request, so lease renewal rotates in place.
+        - name: arr-keys
+          projected:
+            sources:
+              - secret:
+                  name: arrstack-virtual-key
+                  items:
+                    - key: token
+                      path: sonarr
+                    - key: token
+                      path: radarr
+      restartPolicy: Always

apps/base/mediamark/gateway-external.yaml

@@ -0,0 +1,39 @@
+---
+# External (DMZ) front for mediamark on mediamark.unkin.net via the external
+# Traefik (LB VIP 198.18.199.0). TLS terminates with the real Let's Encrypt
+# *.unkin.net wildcard (Certificate wildcard-unkin-net in cert-manager,
+# reflected into this namespace as wildcard-unkin-net-tls by the emberstack
+# reflector), so there is no cert-manager annotation here. The apex
+# mediamark.unkin.net A record lives in the bind-operator unkin.net zone, NOT
+# external-dns, so no external-dns annotation either. oauth2-proxy fronts both
+# hostnames.
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: external
+  name: mediamark-external
+  namespace: mediamark
+spec:
+  gatewayClassName: traefik-external
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: mediamark.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: mediamark.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: wildcard-unkin-net-tls

apps/base/mediamark/gateway.yaml

@@ -0,0 +1,38 @@
+---
+# Internal front for mediamark (cf. watchstate).
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: mediamark.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: mediamark.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: mediamark
+  namespace: mediamark
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: mediamark.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: mediamark.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: mediamark-tls
+        mode: Terminate

apps/base/mediamark/httproute-external.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: mediamark-external-http-redirect
+  namespace: mediamark
+spec:
+  hostnames:
+    - mediamark.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: mediamark-external
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: mediamark-external
+  namespace: mediamark
+spec:
+  hostnames:
+    - mediamark.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: mediamark-external
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: mediamark-oauth2
+          port: 4180
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/mediamark/httproute.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: mediamark-http-redirect
+  namespace: mediamark
+spec:
+  hostnames:
+    - mediamark.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: mediamark
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: mediamark
+  namespace: mediamark
+spec:
+  hostnames:
+    - mediamark.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: mediamark
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: mediamark-oauth2
+          port: 4180
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/mediamark/kustomization.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+  - vaultdynamicsecret.yaml
+  - pv-mediastore.yaml
+  - pvc-mediastore.yaml
+  - deployment.yaml
+  - oauth2-proxy-configmap.yaml
+  - oauth2-proxy-deployment.yaml
+  - service.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - gateway-external.yaml
+  - httproute-external.yaml

apps/base/mediamark/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: mediamark
+  name: mediamark

apps/base/mediamark/oauth2-proxy-configmap.yaml

@@ -0,0 +1,45 @@
+---
+# Non-secret oauth2-proxy configuration (client_id/secret/cookie_secret come
+# from the oauth-credentials Secret). Single auth front for mediamark on both
+# host names; access is gated here on the akP-mediamark-user Authentik group and
+# re-checked by the app from X-Forwarded-Groups.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: mediamark-oauth2-env
+  namespace: mediamark
+data:
+  OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
+  OAUTH2_PROXY_PROVIDER: "oidc"
+  OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/mediamark/"
+  # Relative (host-less) redirect URL: with reverse-proxy mode on, oauth2-proxy
+  # derives scheme+host per request from X-Forwarded-Proto/Host, so the same
+  # deployment serves BOTH the external mediamark.unkin.net and internal
+  # mediamark.k8s.syd1.au.unkin.net callbacks. Both absolute callback URIs are
+  # registered on the Authentik provider (terraform-authentik, separate PR).
+  OAUTH2_PROXY_REDIRECT_URL: "/oauth2/callback"
+  OAUTH2_PROXY_UPSTREAMS: "http://mediamark.mediamark.svc.cluster.local:8080/"
+  OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
+  # Populate session.Groups from the Authentik ak_groups claim; pass-user-headers
+  # then emits it as a single comma-joined X-Forwarded-Groups header.
+  OAUTH2_PROXY_OIDC_GROUPS_CLAIM: "ak_groups"
+  OAUTH2_PROXY_ALLOWED_GROUPS: "akP-mediamark-user"
+  # Forward identity + groups to mediamark as X-Forwarded-{User,Email,Groups}.
+  # NOTE: set-xauthrequest is intentionally NOT set -- it only populates
+  # auth_request *response* headers, which never reach a proxied upstream.
+  OAUTH2_PROXY_PASS_USER_HEADERS: "true"
+  OAUTH2_PROXY_EMAIL_DOMAINS: "*"
+  # Authentik hardcodes email_verified=false in the id_token; authorization is
+  # enforced via ak_groups, so accepting the unverified email is safe.
+  OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true"
+  OAUTH2_PROXY_COOKIE_SECURE: "true"
+  # One cookie domain per host (a single parent-domain cookie can't span
+  # unkin.net and k8s.syd1.au.unkin.net cleanly); oauth2-proxy picks the domain
+  # matching the request host. Whitelist both so post-auth `rd` redirects to
+  # either front door are honoured.
+  OAUTH2_PROXY_COOKIE_DOMAINS: "mediamark.unkin.net,mediamark.k8s.syd1.au.unkin.net"
+  OAUTH2_PROXY_WHITELIST_DOMAINS: "mediamark.unkin.net,mediamark.k8s.syd1.au.unkin.net"
+  OAUTH2_PROXY_REVERSE_PROXY: "true"
+  OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt"
+  OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256"
+  OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"

apps/base/mediamark/oauth2-proxy-deployment.yaml

@@ -0,0 +1,133 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mediamark-oauth2
+  namespace: mediamark
+  annotations:
+    configmap.reloader.stakater.com/auto: "true"
+    secret.reloader.stakater.com/reload: "oauth-credentials,vault-ca-cert"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: mediamark-oauth2
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: mediamark-oauth2
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        # The Authentik issuer is served behind the internal unkin.net CA;
+        # combine the system roots with it so oauth2-proxy's OIDC HTTP client
+        # trusts the discovery endpoint.
+        - name: combine-certs
+          image: docker.io/library/alpine:3
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /custom-ca
+              readOnly: true
+            - name: combined-certs
+              mountPath: /combined-certs
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 50m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 64Mi
+      containers:
+        - name: oauth2-proxy
+          image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 4180
+              name: http
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: mediamark-oauth2-env
+                optional: false
+          env:
+            - name: OAUTH2_PROXY_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_id
+            - name: OAUTH2_PROXY_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_secret
+            - name: OAUTH2_PROXY_COOKIE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: cookie_secret
+          volumeMounts:
+            - name: combined-certs
+              mountPath: /etc/ssl/combined
+              readOnly: true
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: combined-certs
+          emptyDir: {}
+      restartPolicy: Always

apps/base/mediamark/pv-mediastore.yaml

@@ -0,0 +1,32 @@
+---
+# Static PV for the shared MEDIASTORE CephFS subvolume, same rootPath as the
+# arrstack/fafflix/cheeztv mediastore PVs. Each namespace gets its own PV
+# (unique name + volumeHandle) pinned by claimRef; mediamark reads and rewrites
+# the same library tree the *arr apps import into, so it must be the same
+# filesystem (hardlink-safe).
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: mediamark-mediastore
+spec:
+  capacity:
+    storage: 10Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  volumeMode: Filesystem
+  claimRef:
+    namespace: mediamark
+    name: mediamark-mediastore
+  csi:
+    driver: cephfs.csi.ceph.com
+    volumeHandle: mediamark-mediastore-static
+    nodeStageSecretRef:
+      name: csi-cephfs-secret
+      namespace: csi-cephfs
+    volumeAttributes:
+      staticVolume: "true"
+      clusterID: cephfs_csi_ssd_ec_4_1
+      fsName: cephfs
+      rootPath: /volumes/csi_ssd_ec_4_1/mediastore/a0152dac-a51b-4b95-ac5e-ecdd99bfe3f1

apps/base/mediamark/pvc-mediastore.yaml

@@ -0,0 +1,20 @@
+---
+# Statically bound to the mediamark-mediastore PV; storageClassName "" +
+# volumeName disables dynamic provisioning. Not backed up here -- the media tree
+# is backed up once from arrstack.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mediamark-mediastore
+  namespace: mediamark
+  annotations:
+    k8up.io/backup: "false"
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Ti
+  storageClassName: ""
+  volumeName: mediamark-mediastore
+  volumeMode: Filesystem

apps/base/mediamark/service.yaml

@@ -0,0 +1,36 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mediamark
+  namespace: mediamark
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 8080
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: mediamark
+  sessionAffinity: None
+  type: ClusterIP
+---
+# Front-door entry Service: both HTTPRoutes target this; all traffic enters via
+# oauth2-proxy.
+apiVersion: v1
+kind: Service
+metadata:
+  name: mediamark-oauth2
+  namespace: mediamark
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 4180
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: mediamark-oauth2
+  sessionAffinity: None
+  type: ClusterIP

apps/base/mediamark/vaultauth.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: mediamark
+spec:
+  allowedNamespaces:
+    - mediamark
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
+---
+# Separate auth for the arrstack secrets engine: the `mediamark` k8s role is the
+# only one whose policy grants arrstack/creds/mediamark.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: arrstack-creds
+  namespace: mediamark
+spec:
+  allowedNamespaces:
+    - mediamark
+  kubernetes:
+    audiences:
+      - vault
+    role: mediamark
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default

apps/base/mediamark/vaultdynamicsecret.yaml

@@ -0,0 +1,21 @@
+---
+# Ephemeral arrstack virtual key. The engine mints one machine token covering
+# both radarr and sonarr; it is only honoured by arrproxy, which validates it and
+# swaps in the real per-app key upstream. Role ttl is 60s, so VSO renews the
+# lease continuously (renewalPercent default 67) and rewrites the secret; the
+# reloader annotation restarts pods when the token actually changes.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultDynamicSecret
+metadata:
+  name: arrstack-virtual-key
+  namespace: mediamark
+spec:
+  allowStaticCreds: false
+  destination:
+    create: true
+    name: arrstack-virtual-key
+    overwrite: true
+  mount: arrstack
+  path: creds/mediamark
+  revoke: true
+  vaultAuthRef: arrstack-creds

apps/base/mediamark/vaultstaticsecret.yaml

@@ -0,0 +1,22 @@
+---
+# Authentik OIDC client for the mediamark front door (client_id, client_secret,
+# cookie_secret) at kv/kubernetes/namespace/mediamark/default/oauth-credentials.
+# The default k8s role's templated policy already grants read on
+# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*, so no
+# terraform-vault change is needed.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: oauth-credentials
+  namespace: mediamark
+spec:
+  destination:
+    create: true
+    name: oauth-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/mediamark/default/oauth-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/netbox/valkey-deployment.yaml

@@ -83,7 +83,7 @@ spec:
             - mountPath: /data
               name: data
         - name: metrics-exporter
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
+          image: docker.io/oliver006/redis_exporter:v1.89.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 9121

apps/base/repospawner/deployment.yaml

@@ -0,0 +1,123 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: repospawner
+  namespace: repospawner
+  annotations:
+    secret.reloader.stakater.com/reload: "repospawner-woodpecker"
+spec:
+  # Request state lives in memory and is rebuilt from Job labels on startup, so
+  # exactly one replica may exist at a time.
+  replicas: 1
+  selector:
+    matchLabels:
+      app: repospawner
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: repospawner
+    spec:
+      serviceAccountName: repospawner
+      automountServiceAccountToken: true
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: repospawner
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/repospawner:v0.1.1
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8080
+              name: http
+              protocol: TCP
+          env:
+            - name: REPOSPAWNER_NAMESPACE
+              value: repospawner
+            # The server passes its own image down to the Jobs, so this must
+            # match the image above exactly.
+            - name: REPOSPAWNER_IMAGE
+              value: artifactapi.k8s.syd1.au.unkin.net/docker-internal/repospawner:v0.1.1
+            - name: REPOSPAWNER_JOB_SERVICE_ACCOUNT
+              value: repospawner
+            - name: GITEA_URL
+              value: https://git.unkin.net
+            - name: REPOSPAWNER_TFGIT_REPO
+              value: unkin/terraform-git
+            - name: VAULT_ADDR
+              value: https://vault.service.consul:8200
+            - name: WOODPECKER_SERVER
+              value: https://ci.k8s.syd1.au.unkin.net
+            # Name only: the enablement Job mounts this Secret itself.
+            - name: REPOSPAWNER_WOODPECKER_SECRET
+              value: repospawner-woodpecker
+            - name: REPOSPAWNER_WOODPECKER_TOKEN_FILE
+              value: /etc/repospawner/woodpecker/token
+            # oauth2-proxy --pass-user-headers forwards the Authentik groups as a
+            # comma-joined X-Forwarded-Groups; X-Auth-Request-Groups is
+            # auth_request-response-only and never reaches a proxied upstream.
+            - name: REPOSPAWNER_GROUPS_HEADER
+              value: X-Forwarded-Groups
+            - name: REPOSPAWNER_ALLOWED_GROUPS
+              value: akP-repospawner-admin
+          volumeMounts:
+            - name: vault-token
+              mountPath: /var/run/secrets/vault
+              readOnly: true
+            - name: woodpecker-token
+              mountPath: /etc/repospawner/woodpecker
+              readOnly: true
+          livenessProbe:
+            httpGet:
+              path: /livez
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 300m
+              memory: 256Mi
+      volumes:
+        # Native Vault kubernetes login: the default kubernetes.io token has the
+        # wrong audience, so the app reads this audience-vault projection.
+        - name: vault-token
+          projected:
+            sources:
+              - serviceAccountToken:
+                  path: token
+                  audience: vault
+                  expirationSeconds: 600
+        # Optional: absent, the server starts and refuses woodpecker requests.
+        - name: woodpecker-token
+          secret:
+            secretName: repospawner-woodpecker
+            optional: true
+            items:
+              - key: token
+                path: token
+      restartPolicy: Always

apps/base/repospawner/gateway-external.yaml

@@ -0,0 +1,39 @@
+---
+# External (DMZ) front for repospawner on repospawner.unkin.net via the external
+# Traefik (LB VIP 198.18.199.0). TLS terminates with the real Let's Encrypt
+# *.unkin.net wildcard (Certificate wildcard-unkin-net in cert-manager,
+# reflected into this namespace as wildcard-unkin-net-tls by the emberstack
+# reflector), so there is no cert-manager annotation here. The apex
+# repospawner.unkin.net A record lives in the bind-operator unkin.net zone, NOT
+# external-dns, so no external-dns annotation either. oauth2-proxy fronts both
+# hostnames.
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: external
+  name: repospawner-external
+  namespace: repospawner
+spec:
+  gatewayClassName: traefik-external
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: repospawner.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: repospawner.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: wildcard-unkin-net-tls

apps/base/repospawner/gateway.yaml

@@ -0,0 +1,38 @@
+---
+# Internal front for repospawner (cf. mediamark).
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: repospawner.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: repospawner.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: repospawner
+  namespace: repospawner
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: repospawner.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: repospawner.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: repospawner-tls
+        mode: Terminate

apps/base/repospawner/httproute-external.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: repospawner-external-http-redirect
+  namespace: repospawner
+spec:
+  hostnames:
+    - repospawner.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: repospawner-external
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: repospawner-external
+  namespace: repospawner
+spec:
+  hostnames:
+    - repospawner.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: repospawner-external
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: repospawner-oauth2
+          port: 4180
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/repospawner/httproute.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: repospawner-http-redirect
+  namespace: repospawner
+spec:
+  hostnames:
+    - repospawner.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: repospawner
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: repospawner
+  namespace: repospawner
+spec:
+  hostnames:
+    - repospawner.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: repospawner
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: repospawner-oauth2
+          port: 4180
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/repospawner/kustomization.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - serviceaccount.yaml
+  - vaultauth.yaml
+  - rbac.yaml
+  - vaultstaticsecret.yaml
+  - deployment.yaml
+  - oauth2-proxy-configmap.yaml
+  - oauth2-proxy-deployment.yaml
+  - service.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - gateway-external.yaml
+  - httproute-external.yaml

apps/base/repospawner/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: repospawner
+  name: repospawner

apps/base/repospawner/oauth2-proxy-configmap.yaml

@@ -0,0 +1,45 @@
+---
+# Non-secret oauth2-proxy configuration (client_id/secret/cookie_secret come
+# from the oauth-credentials Secret). Single auth front for repospawner on both
+# host names; access is gated here on the akP-repospawner-admin Authentik group
+# and re-checked by the app from X-Forwarded-Groups.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: repospawner-oauth2-env
+  namespace: repospawner
+data:
+  OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
+  OAUTH2_PROXY_PROVIDER: "oidc"
+  OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/repospawner/"
+  # Relative (host-less) redirect URL: with reverse-proxy mode on, oauth2-proxy
+  # derives scheme+host per request from X-Forwarded-Proto/Host, so the same
+  # deployment serves BOTH the external repospawner.unkin.net and internal
+  # repospawner.k8s.syd1.au.unkin.net callbacks. Both absolute callback URIs are
+  # registered on the Authentik provider (terraform-authentik, separate PR).
+  OAUTH2_PROXY_REDIRECT_URL: "/oauth2/callback"
+  OAUTH2_PROXY_UPSTREAMS: "http://repospawner.repospawner.svc.cluster.local:8080/"
+  OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
+  # Populate session.Groups from the Authentik ak_groups claim; pass-user-headers
+  # then emits it as a single comma-joined X-Forwarded-Groups header.
+  OAUTH2_PROXY_OIDC_GROUPS_CLAIM: "ak_groups"
+  OAUTH2_PROXY_ALLOWED_GROUPS: "akP-repospawner-admin"
+  # Forward identity + groups to repospawner as X-Forwarded-{User,Email,Groups}.
+  # NOTE: set-xauthrequest is intentionally NOT set -- it only populates
+  # auth_request *response* headers, which never reach a proxied upstream.
+  OAUTH2_PROXY_PASS_USER_HEADERS: "true"
+  OAUTH2_PROXY_EMAIL_DOMAINS: "*"
+  # Authentik hardcodes email_verified=false in the id_token; authorization is
+  # enforced via ak_groups, so accepting the unverified email is safe.
+  OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true"
+  OAUTH2_PROXY_COOKIE_SECURE: "true"
+  # One cookie domain per host (a single parent-domain cookie can't span
+  # unkin.net and k8s.syd1.au.unkin.net cleanly); oauth2-proxy picks the domain
+  # matching the request host. Whitelist both so post-auth `rd` redirects to
+  # either front door are honoured.
+  OAUTH2_PROXY_COOKIE_DOMAINS: "repospawner.unkin.net,repospawner.k8s.syd1.au.unkin.net"
+  OAUTH2_PROXY_WHITELIST_DOMAINS: "repospawner.unkin.net,repospawner.k8s.syd1.au.unkin.net"
+  OAUTH2_PROXY_REVERSE_PROXY: "true"
+  OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt"
+  OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256"
+  OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"

apps/base/repospawner/oauth2-proxy-deployment.yaml

@@ -0,0 +1,133 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: repospawner-oauth2
+  namespace: repospawner
+  annotations:
+    configmap.reloader.stakater.com/auto: "true"
+    secret.reloader.stakater.com/reload: "oauth-credentials,vault-ca-cert"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: repospawner-oauth2
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: repospawner-oauth2
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        # The Authentik issuer is served behind the internal unkin.net CA;
+        # combine the system roots with it so oauth2-proxy's OIDC HTTP client
+        # trusts the discovery endpoint.
+        - name: combine-certs
+          image: docker.io/library/alpine:3
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /custom-ca
+              readOnly: true
+            - name: combined-certs
+              mountPath: /combined-certs
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 50m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 64Mi
+      containers:
+        - name: oauth2-proxy
+          image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 4180
+              name: http
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: repospawner-oauth2-env
+                optional: false
+          env:
+            - name: OAUTH2_PROXY_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_id
+            - name: OAUTH2_PROXY_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_secret
+            - name: OAUTH2_PROXY_COOKIE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: cookie_secret
+          volumeMounts:
+            - name: combined-certs
+              mountPath: /etc/ssl/combined
+              readOnly: true
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: combined-certs
+          emptyDir: {}
+      restartPolicy: Always

apps/base/repospawner/rbac.yaml

@@ -0,0 +1,48 @@
+---
+# The server creates one Job per request phase and polls Job/Pod state to drive
+# the state machine and rebuild it after a restart.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: repospawner
+  namespace: repospawner
+rules:
+  - apiGroups:
+      - batch
+    resources:
+      - jobs
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - delete
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - pods/log
+    verbs:
+      - get
+      - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: repospawner
+  namespace: repospawner
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: repospawner
+subjects:
+  - kind: ServiceAccount
+    name: repospawner
+    namespace: repospawner

apps/base/repospawner/service.yaml

@@ -0,0 +1,36 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: repospawner
+  namespace: repospawner
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 8080
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: repospawner
+  sessionAffinity: None
+  type: ClusterIP
+---
+# Front-door entry Service: both HTTPRoutes target this; all traffic enters via
+# oauth2-proxy.
+apiVersion: v1
+kind: Service
+metadata:
+  name: repospawner-oauth2
+  namespace: repospawner
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 4180
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: repospawner-oauth2
+  sessionAffinity: None
+  type: ClusterIP

apps/base/repospawner/serviceaccount.yaml

@@ -0,0 +1,8 @@
+---
+# Bound to the Vault kubernetes auth role `repospawner`; the server and the Jobs
+# it spawns both run as this account and log into Vault natively.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: repospawner
+  namespace: repospawner

apps/base/repospawner/vaultauth.yaml

@@ -0,0 +1,20 @@
+---
+# Only VSO uses this; repospawner itself authenticates to Vault directly with a
+# projected audience-vault token, not through the operator.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: repospawner
+spec:
+  allowedNamespaces:
+    - repospawner
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default

apps/base/repospawner/vaultstaticsecret.yaml

@@ -0,0 +1,42 @@
+---
+# Authentik OIDC client for the repospawner front door (client_id,
+# client_secret, cookie_secret). The default k8s role's templated policy already
+# grants read on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*, so
+# no terraform-vault change is needed.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: oauth-credentials
+  namespace: repospawner
+spec:
+  destination:
+    create: true
+    name: oauth-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/repospawner/default/oauth-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+# Woodpecker API token (key `token`). Optional by design: without it the server
+# still starts and refuses `woodpecker: true` requests with 503. The server
+# mounts it to answer /api/capabilities; the enablement Job mounts the same
+# secret by name via REPOSPAWNER_WOODPECKER_SECRET.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: repospawner-woodpecker
+  namespace: repospawner
+spec:
+  destination:
+    create: true
+    name: repospawner-woodpecker
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/repospawner/default/woodpecker
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/watchstate/oauth2-proxy-deployment.yaml

@@ -35,7 +35,7 @@ spec:
         # system roots with the internal CA so oauth2-proxy's OIDC HTTP client
         # trusts it.
         - name: combine-certs
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3
+          image: docker.io/library/alpine:3
           imagePullPolicy: IfNotPresent
           command:
             - sh

apps/base/woodpecker/kustomization.yaml

@@ -10,9 +10,12 @@ resources:
   - serviceaccount_arrproxy_ci.yaml
   - serviceaccount_autobackup_operator_ci.yaml
   - serviceaccount_ghp.yaml
+  - serviceaccount_golib_ci.yaml
   - serviceaccount_kea_operator_ci.yaml
+  - serviceaccount_mediamark_ci.yaml
   - serviceaccount_plugin_docker_buildx.yaml
   - serviceaccount_jellyfin_ha_src.yaml
+  - serviceaccount_repospawner_ci.yaml
   - serviceaccount_terraform_artifactapi.yaml
   - serviceaccount_terraform_authentik.yaml
   - serviceaccount_terraform_enc.yaml

apps/base/woodpecker/serviceaccount_golib_ci.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: golib-ci
+  namespace: woodpecker

apps/base/woodpecker/serviceaccount_mediamark_ci.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mediamark-ci
+  namespace: woodpecker

apps/base/woodpecker/serviceaccount_repospawner_ci.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: repospawner-ci
+  namespace: woodpecker

apps/overlays/au-syd1/clickhouse-system/values.yaml

@@ -2,10 +2,9 @@
 # resources in all namespaces (the logs cluster lives in the `logging` namespace).
 # CRDs are installed at runtime by the chart's crdHook Job.
 #
-# All images are pulled through the artifactapi dockerhub remote (no direct
-# upstream). Upstream official images are used; no Docker Hardened Image variant
-# is adopted (DHI is subscription-gated and served from a private org namespace
-# not reachable via the anonymous artifactapi dockerhub proxy).
+# Upstream official images; no Docker Hardened Image variant is adopted (DHI is
+# subscription-gated and served from a private org namespace not reachable via
+# the anonymous artifactapi dockerhub proxy).
 #
 # Watch the logging namespace where the ClickHouseInstallation lives. The chart
 # default (watchNamespaces: []) makes the operator watch ONLY its own namespace
@@ -14,7 +13,7 @@ watchNamespaces:
   - logging
 crdHook:
   image:
-    repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/bitnami/kubectl
+    repository: docker.io/bitnami/kubectl
   resources:
     requests:
       cpu: 50m
@@ -25,7 +24,7 @@ crdHook:
 
 operator:
   image:
-    repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/altinity/clickhouse-operator
+    repository: docker.io/altinity/clickhouse-operator
   resources:
     requests:
       cpu: 100m
@@ -36,7 +35,7 @@ operator:
 
 metrics:
   image:
-    repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/altinity/metrics-exporter
+    repository: docker.io/altinity/metrics-exporter
   resources:
     requests:
       cpu: 50m

apps/overlays/au-syd1/logging/values-nats.yaml

@@ -57,10 +57,9 @@ config:
                 - "_INBOX.>"
 
 container:
-  # Pulled through the artifactapi dockerhub remote (upstream official nats;
-  # no DHI variant available for nats).
+  # Upstream official nats; no DHI variant available.
   image:
-    repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/nats
+    repository: docker.io/library/nats
     tag: 2.14.2-alpine
   env:
     NATS_ADMIN_PASSWORD:
@@ -94,10 +93,10 @@ podTemplate:
       annotations:
         configmap.reloader.stakater.com/auto: "true"
 
-# Config-reloader sidecar image, also through artifactapi.
+# Config-reloader sidecar image.
 reloader:
   image:
-    repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/natsio/nats-server-config-reloader
+    repository: docker.io/natsio/nats-server-config-reloader
     tag: "0.23.0"
 
 natsBox:

apps/overlays/au-syd1/logging/values-vector-agent.yaml

@@ -5,10 +5,10 @@
 role: Agent
 fullnameOverride: vector-agent
 
-# Pulled through the artifactapi dockerhub remote; distroless-libc (no DHI —
-# subscription-gated/private-namespace, not reachable via the anon proxy).
+# distroless-libc (no DHI — subscription-gated/private-namespace, not reachable
+# via the anon proxy).
 image:
-  repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector
+  repository: docker.io/timberio/vector
   tag: 0.57.0-distroless-libc
 
 rbac:

apps/overlays/au-syd1/logging/values-vector-aggregator.yaml

@@ -15,7 +15,7 @@ role: Stateless-Aggregator
 fullnameOverride: vector-aggregator
 
 image:
-  repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector
+  repository: docker.io/timberio/vector
   tag: 0.57.0-distroless-libc
 
 # Horizontal autoscaling on CPU — safe with N replicas on one durable consumer.

apps/overlays/au-syd1/logging/values-vector-vm-ingest.yaml

@@ -6,7 +6,7 @@ fullnameOverride: vector-vm-ingest
 replicas: 2
 
 image:
-  repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector
+  repository: docker.io/timberio/vector
   tag: 0.57.0-distroless-libc
 
 workloadResourceAnnotations:

apps/overlays/au-syd1/mediamark/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/mediamark

apps/overlays/au-syd1/repospawner/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/repospawner

apps/overlays/au-syd1/valkey-operator-system/values.yaml

@@ -1,5 +1,7 @@
+# rke2's `registries.yaml` rewrites upstream image names to the artifactapi
+# mirror, so this manifest carries the canonical upstream registry.
 image:
-  registry: artifactapi.k8s.syd1.au.unkin.net/ghcr
+  registry: ghcr.io
   repository: valkey-io/valkey-operator
   tag: v0.5.0
 

argocd/applicationsets/media.yaml

@@ -14,6 +14,7 @@ spec:
       - path: apps/overlays/*/cheeztv
       - path: apps/overlays/*/arrstack
       - path: apps/overlays/*/watchstate
+      - path: apps/overlays/*/mediamark
   template:
     metadata:
       name: 'media-{{path[3]}}'

argocd/applicationsets/platform.yaml

@@ -41,6 +41,7 @@ spec:
       - path: apps/overlays/*/purelb
       - path: apps/overlays/*/reflector-system
       - path: apps/overlays/*/reloader-system
+      - path: apps/overlays/*/repospawner
       - path: apps/overlays/*/reposync
       - path: apps/overlays/*/traefik-system
       - path: apps/overlays/*/valkey-operator-system

argocd/projects/media.yaml

@@ -17,6 +17,8 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'watchstate'
       server: https://kubernetes.default.svc
+    - namespace: 'mediamark'
+      server: https://kubernetes.default.svc
   clusterResourceWhitelist:
     - group: ''
       kind: Namespace

argocd/projects/platform.yaml

@@ -59,6 +59,8 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'puppet'
       server: https://kubernetes.default.svc
+    - namespace: 'repospawner'
+      server: https://kubernetes.default.svc
     - namespace: 'reposync'
       server: https://kubernetes.default.svc
     - namespace: 'vault'

clusters/au-syd1/bootstrap/argocd-cm-patch.yaml

@@ -26,33 +26,8 @@ data:
     issuer: https://identity.unkin.net/application/o/argocd/
     clientID: argocd
     clientSecret: $argocd-oidc:client_secret
-    # argocd-server does OIDC discovery/egress to identity.unkin.net over TLS,
-    # which is served by the internal `unkin.net` CA (not a public root), so the
-    # stock image trust store rejects it (x509: certificate signed by unknown
-    # authority). Anchor on the stable `unkin.net` root; identity presents its
-    # intermediate in the handshake, and the intermediate is periodically
-    # re-keyed, so pinning the root (not the intermediate) is rotation-proof.
-    rootCA: |
-      -----BEGIN CERTIFICATE-----
-      MIIDLzCCAhegAwIBAgIUIDADwsHIrQ8dfncpechBdIUCQdIwDQYJKoZIhvcNAQEL
-      BQAwFDESMBAGA1UEAxMJdW5raW4ubmV0MB4XDTI0MDQyNzExMjcwMloXDTM0MDQy
-      NTExMjczMlowFDESMBAGA1UEAxMJdW5raW4ubmV0MIIBIjANBgkqhkiG9w0BAQEF
-      AAOCAQ8AMIIBCgKCAQEA3ENPv7R7gCUJAg8Q4hB2LEZSdvbK155YbcrguLDDnu6m
-      2fkJn8jYMMW3Z6/+Y04ouGwi6sKup8ggTb217sY+dC4IUZjotDPAhruxfXVQAh0v
-      Yr3RYoxVDrm4nRSFLo1RA4Qt+1KK299mHGQf9iAiwbsFp5mDrJT9uz15FE2uWmbK
-      8/onMyJC4fnkMihVN6NIgTtjpHYNm5aAJwxoWldTopgF0ucb7X3XVPNbKAmd3Avd
-      lsOo6m751zSZ0HvJOxgRSy7lvPzMuUfCQsOcmI4O4+Z2FL4Y7p+T9DvWkciC7L3i
-      tBiK30fPfGKNpWaof1ONCcPQNjMwWcEFXqSiWUOXkwIDAQABo3kwdzAOBgNVHQ8B
-      Af8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGpy/pj6F8e3gSOAp
-      r+6hAYQdOScwHwYDVR0jBBgwFoAUGpy/pj6F8e3gSOApr+6hAYQdOScwFAYDVR0R
-      BA0wC4IJdW5raW4ubmV0MA0GCSqGSIb3DQEBCwUAA4IBAQA5xocILzuvD+R2Iub1
-      UnTdcVpgNcxJmESz0eX4UrkcBmddtuFINXvDTv5//XTFs78LsVVSf00xZ+2C62Xe
-      xRdCdluHN8VDCAKulP4XJY1BiZ7im0v+iMgPDKhq4OXb86WFYI/8J6uRm7oIAwj1
-      zhhKxMimkzli+yHB8ipL15W7l68CMUgmOjFA+EG6sbfadFpQTX/h6TVj3FQPkU/p
-      UJEm2XjlGNAKGJrNRU47PM4vRDv5Joyowp9zv/pHFXvUJladaJupMKRJQVWQz1US
-      EXE67rawG79s3vm8dDolnbli/IhPHtjDRIprxAwrMs5tt9cY0xsRkFBZVcAOjrpb
-      4gqd
-      -----END CERTIFICATE-----
+    # identity.unkin.net now serves the LetsEncrypt *.unkin.net wildcard, so the
+    # stock image trust store validates it; no rootCA pin.
     requestedScopes:
       - openid
       - profile