traefik-internal: add ldaps :636 entrypoint for authentik LDAPS

Why:
- traefik-internal has no 636 entrypoint, so the authentik-ldap Gateway's
  636/TLS passthrough listeners are invalid and the whole Gateway is
  rejected (Accepted: False), taking LDAPS down.
- The traefik-internal LoadBalancer only publishes 80/443, so nothing
  reaches the Authentik LDAP outpost on 636.

How:
- Add an `ldaps` entrypoint on :636 (raw TCP, no TLS termination) to the
  traefik-internal helm values so 636/TLS passthrough streams pass through
  to the LDAP outpost.
- Expose 636 on the traefik-internal LoadBalancer via the port's
  `expose.default`, keeping the pinned 198.18.200.4 / common group.

apps/base/dhcp-system/cr/keaapi.yaml

@@ -11,7 +11,7 @@ metadata:
     argocd.argoproj.io/sync-wave: "1"
 spec:
   replicas: 1
-  image: git.unkin.net/unkin/kea-api:v0.1.3
+  image: git.unkin.net/unkin/kea-api:v0.1.2
   tokenSecretName: kea-api-token
   service:
     type: ClusterIP

apps/base/dhcp-system/cr/keacluster.yaml

@@ -11,7 +11,7 @@ metadata:
     argocd.argoproj.io/sync-wave: "1"
 spec:
   replicas: 2
-  image: git.unkin.net/unkin/kea:v0.1.3
+  image: git.unkin.net/unkin/kea:v0.1.2
   domainName: main.unkin.net
   defaultLeaseTime: 1200
   maxLeaseTime: 86400

apps/base/dhcp-system/deployment.yaml

@@ -21,7 +21,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: git.unkin.net/unkin/kea-operator:v0.1.3
+          image: git.unkin.net/unkin/kea-operator:v0.1.2
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081

apps/base/jellyfin/deployment.yaml

@@ -1,97 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: jellyfin
-  namespace: jellyfin
-spec:
-  # Single-replica for now. The jellyfin-ha fork adds the Redis transcode store
-  # and RWX transcode scratch that make scaling to true HA a follow-up.
-  replicas: 1
-  strategy:
-    # Config PVC is RWO; Recreate avoids two pods contending for it.
-    type: Recreate
-  selector:
-    matchLabels:
-      app: jellyfin
-  template:
-    metadata:
-      labels:
-        app: jellyfin
-    spec:
-      securityContext:
-        fsGroup: 1000
-      nodeSelector:
-        feature.node.kubernetes.io/pci-0300_8086.present: "true"
-      containers:
-        - name: jellyfin
-          image: git.unkin.net/unkin/jellyfin-ha:v0.1.0
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 8096
-              protocol: TCP
-          env:
-            - name: TZ
-              value: Australia/Sydney
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: JELLYFIN_PublishedServerUrl
-              value: https://jellyfin.k8s.syd1.au.unkin.net
-            # Distributed transcode session store (jellyfin-ha additions).
-            - name: Jellyfin__TranscodeStore__RedisConnectionString
-              value: "jellyfin-redis:6379,abortConnect=false"
-            - name: Jellyfin__TranscodeStore__LeaseDurationSeconds
-              value: "30"
-          resources:
-            requests:
-              cpu: 100m
-              memory: 1Gi
-            limits:
-              cpu: "4"
-              memory: 8Gi
-              gpu.intel.com/i915: "1"
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: cache
-              mountPath: /cache
-            - name: transcode
-              mountPath: /transcode
-            - name: media-library
-              mountPath: /mnt/movies
-              subPath: movies
-            - name: media-library
-              mountPath: /mnt/tvseries
-              subPath: tvseries
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: jellyfin-config
-        - name: cache
-          persistentVolumeClaim:
-            claimName: jellyfin-cache
-        - name: transcode
-          persistentVolumeClaim:
-            claimName: jellyfin-transcode
-        - name: media-library
-          persistentVolumeClaim:
-            claimName: media-library

apps/base/jellyfin/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: jellyfin.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: jellyfin.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: jellyfin
-  namespace: jellyfin
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: jellyfin.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: jellyfin.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: jellyfin-tls
-        mode: Terminate

apps/base/jellyfin/httproute.yaml

@@ -1,49 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: http-redirect
-  namespace: jellyfin
-spec:
-  hostnames:
-    - jellyfin.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: jellyfin
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: jellyfin
-  namespace: jellyfin
-spec:
-  hostnames:
-    - jellyfin.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: jellyfin
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: jellyfin
-          port: 8096
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/jellyfin/kustomization.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - pv_media-library.yaml
-  - pvc_media-library.yaml
-  - pvc_config.yaml
-  - pvc_cache.yaml
-  - pvc_transcode.yaml
-  - deployment.yaml
-  - service.yaml
-  - redis-deployment.yaml
-  - redis-service.yaml
-  - redis-pvc.yaml
-  - gateway.yaml
-  - httproute.yaml

apps/base/jellyfin/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: jellyfin

apps/base/jellyfin/pv_media-library.yaml

@@ -1,41 +0,0 @@
----
-# Static CephFS PersistentVolume bound to the pre-existing, ACTIVELY-USED
-# puppet media library (ceph filesystem "mediafs", mounted by the VM/incus
-# instances at /shared/media). ceph-csi only mounts this volume; staticVolume
-# tells it the storage pre-exists and it must never provision or delete it.
-#
-# reclaimPolicy MUST stay Retain: deleting this PV or its PVC must NEVER be able
-# to reclaim or destroy the underlying CephFS data that the VM instances use.
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: jellyfin-media-library
-spec:
-  accessModes:
-    - ReadWriteMany
-  capacity:
-    storage: 10Ti
-  # Load-bearing safety control. Do not change to Delete.
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: ""
-  volumeMode: Filesystem
-  # Pre-bind to the media-library claim so nothing else can grab this PV.
-  claimRef:
-    apiVersion: v1
-    kind: PersistentVolumeClaim
-    name: media-library
-    namespace: jellyfin
-  csi:
-    driver: cephfs.csi.ceph.com
-    volumeHandle: jellyfin-media-library-static
-    nodeStageSecretRef:
-      name: csi-cephfs-secret
-      namespace: csi-cephfs
-    volumeAttributes:
-      # clusterID maps (in the csi-cephfs ceph-csi-config) to the mon set that
-      # also serves mediafs; for a static volume only the mon lookup is used.
-      clusterID: cephfs_csi_ssd_ec_4_1
-      fsName: mediafs
-      staticVolume: "true"
-      # Filesystem-internal root of the library (mediafs root == /shared/media).
-      rootPath: /

apps/base/jellyfin/pvc_cache.yaml

@@ -1,15 +0,0 @@
----
-# Local transcode/image cache. Scratch, delete reclaim policy.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-cache
-  namespace: jellyfin
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 200Gi
-  storageClassName: cephrbd-fast-delete
-  volumeMode: Filesystem

apps/base/jellyfin/pvc_config.yaml

@@ -1,15 +0,0 @@
----
-# Jellyfin config + SQLite library database. Single-writer, block storage.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-config
-  namespace: jellyfin
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi
-  storageClassName: cephrbd-fast-retain
-  volumeMode: Filesystem

apps/base/jellyfin/pvc_media-library.yaml

@@ -1,19 +0,0 @@
----
-# Claim bound to the static mediafs PV. RWX so every app in the stack shares the
-# one library. storageClassName "" + volumeName pin it to the static PV (no
-# dynamic provisioning). Deleting this claim cannot reclaim the data (PV is
-# Retain).
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: media-library
-  namespace: jellyfin
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: jellyfin-media-library
-  resources:
-    requests:
-      storage: 10Ti
-  volumeMode: Filesystem

apps/base/jellyfin/pvc_transcode.yaml

@@ -1,17 +0,0 @@
----
-# Shared transcode scratch. ReadWriteMany is the hard requirement for the HA
-# fork: a taking-over pod must read the in-flight HLS segments written by the
-# pod it replaces. Scratch data, so delete reclaim policy.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-transcode
-  namespace: jellyfin
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 100Gi
-  storageClassName: cephfs-raid5-delete
-  volumeMode: Filesystem

apps/base/jellyfin/redis-deployment.yaml

@@ -1,64 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: jellyfin-redis
-  namespace: jellyfin
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: jellyfin-redis
-  template:
-    metadata:
-      labels:
-        app: jellyfin-redis
-    spec:
-      restartPolicy: Always
-      containers:
-        - name: redis
-          image: redis:7-alpine
-          imagePullPolicy: IfNotPresent
-          command:
-            - redis-server
-            - --save
-            - "20"
-            - "1"
-          ports:
-            - name: redis
-              containerPort: 6379
-              protocol: TCP
-          livenessProbe:
-            exec:
-              command:
-                - redis-cli
-                - ping
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            exec:
-              command:
-                - redis-cli
-                - ping
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: 500m
-              memory: 512Mi
-          volumeMounts:
-            - name: data
-              mountPath: /data
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: jellyfin-redis-data

apps/base/jellyfin/redis-pvc.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-redis-data
-  namespace: jellyfin
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephrbd-fast-delete
-  volumeMode: Filesystem

apps/base/jellyfin/redis-service.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: jellyfin-redis
-  namespace: jellyfin
-spec:
-  type: ClusterIP
-  internalTrafficPolicy: Cluster
-  sessionAffinity: None
-  selector:
-    app: jellyfin-redis
-  ports:
-    - name: redis
-      port: 6379
-      targetPort: redis
-      protocol: TCP

apps/base/jellyfin/service.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: jellyfin
-  namespace: jellyfin
-spec:
-  type: ClusterIP
-  internalTrafficPolicy: Cluster
-  sessionAffinity: None
-  selector:
-    app: jellyfin
-  ports:
-    - name: http
-      port: 8096
-      targetPort: http
-      protocol: TCP

apps/base/netbox/vaultstaticsecret.yaml

@@ -19,13 +19,7 @@ spec:
   type: kv-v2
   vaultAuthRef: default
 ---
-# Config secret. Keys:
-#   secret_key         : Django SECRET_KEY (50+ random chars). One-time Vault seed.
-#   api_token_peppers  : JSON object {"1": "<50+ char random>"} used to HMAC-hash
-#                        v2 API tokens. One-time Vault seed — rotating a pepper
-#                        invalidates existing v2 tokens, so set it once.
-# VSO syncs every key at the path into the destination Secret, and the NetBox
-# chart mounts both keys from it (existingSecret) — no explicit key mapping needed.
+# Django SECRET_KEY (key: secret_key). One-time Vault seed.
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
 metadata:

apps/overlays/au-syd1/cert-manager/values.yaml

@@ -5,7 +5,7 @@ config:
   apiVersion: controller.config.cert-manager.io/v1alpha1
   kind: ControllerConfiguration
   enableGatewayAPI: true
-  acmeDNS01Config:
+  acmeDNS01:
     recursiveNameservers:
       - "8.8.8.8:53"
       - "1.1.1.1:53"

apps/overlays/au-syd1/jellyfin/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/jellyfin

apps/overlays/au-syd1/netbox/values.yaml

@@ -13,24 +13,13 @@ image:
 # Two web replicas for zero-downtime rollouts (media is RWX, see below).
 replicaCount: 2
 
-# Config secret. Must contain key: secret_key (Django SECRET_KEY). Also carries
-# api_token_peppers — a JSON object {"1": "<50+ char random>"} the chart mounts
-# (optional file) into API_TOKEN_PEPPERS; NetBox 4.6 refuses to save v2 tokens
-# without it. The chart only auto-generates a pepper when it creates this secret
-# itself, which it does NOT do while existingSecret is set — so the pepper is
-# seeded into Vault alongside secret_key (see base/vaultstaticsecret.yaml).
+# Django SECRET_KEY — existingSecret must contain key: secret_key.
 existingSecret: netbox-secret-key
 
 # Bootstrap superuser — existingSecret keys: username, password, email, api_token.
 superuser:
   existingSecret: netbox-superuser
 
-# Roll NetBox (web + worker) when the config secret changes, so a Vault-seeded
-# api_token_peppers (or a rotated secret_key) is picked up without a manual
-# restart. commonAnnotations lands on Deployment metadata, where reloader reads it.
-commonAnnotations:
-  secret.reloader.stakater.com/reload: netbox-secret-key
-
 # Disable the bundled Bitnami subcharts; we bring our own Postgres and Valkey.
 postgresql:
   enabled: false

argocd/applicationsets/kustomization.yaml

@@ -5,7 +5,6 @@ kind: Kustomization
 resources:
   - aitooling.yaml
   - logging.yaml
-  - media.yaml
   - observability.yaml
   - platform.yaml
   - storage.yaml

argocd/applicationsets/media.yaml

@@ -1,32 +0,0 @@
----
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: media-apps
-  namespace: argocd
-spec:
-  generators:
-    - git:
-        repoURL: https://git.unkin.net/unkin/argocd-apps
-        revision: HEAD
-        directories:
-          # jellyfin only for now; downloads/managers apps join in later PRs.
-          - path: apps/overlays/*/jellyfin
-  template:
-    metadata:
-      name: 'media-{{path[3]}}'
-    spec:
-      project: media
-      source:
-        repoURL: https://git.unkin.net/unkin/argocd-apps
-        targetRevision: HEAD
-        path: '{{path}}'
-      destination:
-        server: https://kubernetes.default.svc
-        namespace: jellyfin
-      syncPolicy:
-        automated:
-          prune: true
-          selfHeal: true
-        syncOptions:
-          - ServerSideApply=true

argocd/projects/kustomization.yaml

@@ -5,7 +5,6 @@ kind: Kustomization
 resources:
   - aitooling.yaml
   - logging.yaml
-  - media.yaml
   - observability.yaml
   - platform.yaml
   - storage.yaml

argocd/projects/media.yaml

@@ -1,21 +0,0 @@
----
-apiVersion: argoproj.io/v1alpha1
-kind: AppProject
-metadata:
-  name: media
-  namespace: argocd
-spec:
-  description: Media services (jellyfin; downloads/managers namespaces to follow)
-  sourceRepos:
-    - https://git.unkin.net/unkin/argocd-apps
-  destinations:
-    - namespace: jellyfin
-      server: https://kubernetes.default.svc
-  clusterResourceWhitelist:
-    - group: ''
-      kind: Namespace
-    - group: ''
-      kind: PersistentVolume
-  namespaceResourceWhitelist:
-    - group: '*'
-      kind: '*'