Rework jellyfin-ha into a真-HA StatefulSet deployment

Turn the single-replica jellyfin-ha app into a proper high-availability deployment so the fork's Redis-coordinated distributed transcoding and PostgreSQL main database can actually be exercised. - Replace the Deployment with a 2-replica StatefulSet for stable pod identity; set JELLYFIN_INSTANCE_ID from metadata.name (the fork's Redis transcode-lease owner id), add soft podAntiAffinity and a PDB minAvailable 1. - Move the main Jellyfin DB to PostgreSQL via a CloudNativePG trio (3-instance Cluster, PgBouncer Pooler, Ceph RGW barman backups) mirroring the litellm pattern; an init container writes database.xml selecting the fork's Jellyfin-PostgreSQL provider and the DSN is composed from the CNPG-generated app secret pointed at the pooler. - Share /config on an RWX cephfs PVC across replicas; keep /cache per-pod via a volumeClaimTemplate. - Fix the transcode mount to the fork's real path /config/transcodes on the RWX PVC (raid5) so a surviving pod can resume the segments of the pod it takes over. - Add Intel iGPU hardware transcoding via the gpu.intel.com/i915 device plugin resource plus render/video supplemental groups. - Switch the Service to sessionAffinity ClientIP to reduce transcode churn. - Disable UDP auto-discovery. Library scans still run on every replica; a single-scanner leader election is a planned follow-up.
Add jellyfin (HA fork) app under a new media project
2026-08-10 23:26:52 +10:00 · 2026-07-05 22:32:24 +10:00
79 changed files with 677 additions and 851 deletions
@@ -79,7 +79,7 @@ spec:
      cpu: 500m
      memory: 512Mi
    requests:
-      cpu: 50m
+      cpu: 250m
      memory: 256Mi
  smartShutdownTimeout: 180
  startDelay: 3600
@@ -79,7 +79,7 @@ spec:
      cpu: 500m
      memory: 512Mi
    requests:
-      cpu: 50m
+      cpu: 250m
      memory: 256Mi
  smartShutdownTimeout: 180
  startDelay: 3600
@@ -31,7 +31,7 @@ spec:
      external-dns.alpha.kubernetes.io/hostname: bind-authoritative-primary.k8s.syd1.au.unkin.net
  resources:
    requests:
-      cpu: 20m
+      cpu: 100m
      memory: 128Mi
    limits:
      cpu: "1"
@@ -9,16 +9,3 @@ metadata:
 spec:
  clusterRef: bind-authoritative
  algorithm: hmac-sha256
---
-# Client-update key: puppet clients (profiles::dns::updater) nsupdate their own
-# records to the authoritative zones with this key. Operator generates the
-# material into Secret client-update-tsig; the same value must reach puppet
-# eyaml (or the planned Vault-sync bridge) for clients to authenticate.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindTSIGKey
-metadata:
-  name: client-update
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  algorithm: hmac-sha256
@@ -15,8 +15,6 @@ spec:
  zoneName: unkin.net
  type: primary
  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -28,8 +26,6 @@ spec:
  zoneName: main.unkin.net
  type: primary
  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -41,8 +37,6 @@ spec:
  zoneName: 13.18.198.in-addr.arpa
  type: primary
  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -54,8 +48,6 @@ spec:
  zoneName: 14.18.198.in-addr.arpa
  type: primary
  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -67,8 +59,6 @@ spec:
  zoneName: 15.18.198.in-addr.arpa
  type: primary
  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -80,8 +70,6 @@ spec:
  zoneName: 16.18.198.in-addr.arpa
  type: primary
  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -93,8 +81,6 @@ spec:
  zoneName: 17.18.198.in-addr.arpa
  type: primary
  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -106,8 +92,6 @@ spec:
  zoneName: 19.18.198.in-addr.arpa
  type: primary
  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -119,8 +103,6 @@ spec:
  zoneName: 20.18.198.in-addr.arpa
  type: primary
  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -132,8 +114,6 @@ spec:
  zoneName: 21.18.198.in-addr.arpa
  type: primary
  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -145,8 +125,6 @@ spec:
  zoneName: 22.18.198.in-addr.arpa
  type: primary
  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -158,8 +136,6 @@ spec:
  zoneName: 23.18.198.in-addr.arpa
  type: primary
  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -171,8 +147,6 @@ spec:
  zoneName: 24.18.198.in-addr.arpa
  type: primary
  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -184,8 +158,6 @@ spec:
  zoneName: 25.18.198.in-addr.arpa
  type: primary
  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -197,8 +169,6 @@ spec:
  zoneName: 26.18.198.in-addr.arpa
  type: primary
  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -210,8 +180,6 @@ spec:
  zoneName: 27.18.198.in-addr.arpa
  type: primary
  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -223,8 +191,6 @@ spec:
  zoneName: 28.18.198.in-addr.arpa
  type: primary
  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -236,5 +202,3 @@ spec:
  zoneName: 29.18.198.in-addr.arpa
  type: primary
  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
@@ -23,7 +23,7 @@ spec:
    type: ClusterIP
  resources:
    requests:
-      cpu: 20m
+      cpu: 100m
      memory: 128Mi
    limits:
      cpu: "1"
@@ -7,4 +7,3 @@ resources:
  - authoritative
  - resolvers
  - externaldns
-  - tsig-api
@@ -21,18 +21,9 @@ spec:
  forwarders:
    - 8.8.8.8
    - 1.1.1.1
-  # The internal split-horizon zones are served UNSIGNED by the in-cluster
-  # authoritative, but their public parents publish DS records (e.g. unkin.net
-  # is DNSSEC-signed on the Internet). With dnssec-validation on, the validator
-  # sees "parent indicates secure" but gets an insecure answer and returns
-  # SERVFAIL (broken trust chain). Treat the forwarded internal domains as
-  # insecure so they are not validated. unkin.net covers all *.unkin.net
-  # (incl. k8s.syd1.au.unkin.net); 18.198.in-addr.arpa covers every reverse zone.
-  extraOptions:
-    - "validate-except { unkin.net; 18.198.in-addr.arpa; consul; }"
  resources:
    requests:
-      cpu: 20m
+      cpu: 100m
      memory: 128Mi
    limits:
      cpu: "1"
@@ -1,27 +0,0 @@
---
-# Companion TSIG API. The operator reconciles this into a Deployment, Service,
-# ConfigMap, master-token Secret and namespaced RBAC. vault-plugin-secrets-bind-tsig
-# calls it to create/rotate/delete TSIG keys, which it does by managing
-# BindTSIGKey resources in this namespace (the operator reconciles the material).
-#
-# The master access token Secret (bind-tsig-api-token) is generated by the
-# operator if absent; a VaultStaticSecret may later pre-seed/overwrite it so the
-# token is sourced from Vault rather than generated in-cluster.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindTSIGAPI
-metadata:
-  name: bind-tsig-api
-  namespace: bind-internal
-spec:
-  image: git.unkin.net/unkin/bind-tsig-api:v0.2.1
-  replicas: 1
-  port: 8443
-  # targetNamespace defaults to this resource's namespace (bind-internal), where
-  # the authoritative cluster and its keys live.
-  resources:
-    requests:
-      cpu: 25m
-      memory: 64Mi
-    limits:
-      cpu: 250m
-      memory: 128Mi
@@ -21,7 +21,7 @@ spec:
        runAsNonRoot: true
      containers:
        - name: operator
-          image: git.unkin.net/unkin/bind-operator:v0.2.1
+          image: git.unkin.net/unkin/bind-operator:v0.1.5
          args:
            - --metrics-bind-address=:8080
            - --health-probe-bind-address=:8081
@@ -6,6 +6,6 @@ resources:
  - namespace.yaml
  # CRDs are pulled from the bind-operator repo at the matching tag rather than
  # vendored here, so they never drift from the operator.
-  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.2.1/config/crd/install.yaml
+  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.1.5/config/crd/install.yaml
  - rbac.yaml
  - deployment.yaml
@@ -23,15 +23,7 @@ rules:
    resources: ["pods/exec"]
    verbs: ["create", "get"]
  - apiGroups: ["apps"]
-    resources: ["statefulsets", "deployments"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  # The BindTSIGAPI reconciler deploys the companion API: a ServiceAccount plus
-  # a namespaced Role/RoleBinding granting it access to BindTSIGKey + Secrets.
-  - apiGroups: [""]
-    resources: ["serviceaccounts"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: ["rbac.authorization.k8s.io"]
-    resources: ["roles", "rolebindings"]
+    resources: ["statefulsets"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: [""]
    resources: ["events"]
@@ -7,4 +7,3 @@ resources:
  - serviceaccount.yaml
  - clusterrole.yaml
  - clusterrolebinding.yaml
-  - vmservicescrape.yaml
@@ -1,17 +0,0 @@
---
-# Scrape cert-manager webhook + cainjector metrics endpoints.
-# Picked up by the observability VMAgent (selectAllByDefault).
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VMServiceScrape
-metadata:
-  name: cert-manager
-  namespace: cert-manager
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cert-manager
-  endpoints:
-    - port: metrics
-      path: /metrics
-    - port: http-metrics
-      path: /metrics
@@ -7,4 +7,3 @@ resources:
  - vaultauth.yaml
  - vaultstaticsecret.yaml
  - storageclass.yaml
-  - vmservicescrape.yaml
@@ -1,15 +0,0 @@
---
-# Scrape the ceph-csi-cephfs nodeplugin + provisioner http-metrics endpoints.
-# Picked up by the observability VMAgent (selectAllByDefault).
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VMServiceScrape
-metadata:
-  name: ceph-csi-cephfs
-  namespace: csi-cephfs
-spec:
-  selector:
-    matchLabels:
-      app: ceph-csi-cephfs
-  endpoints:
-    - port: http-metrics
-      path: /metrics
@@ -7,4 +7,3 @@ resources:
  - vaultauth.yaml
  - vaultstaticsecret.yaml
  - storageclass.yaml
-  - vmservicescrape.yaml
@@ -1,15 +0,0 @@
---
-# Scrape the ceph-csi-rbd nodeplugin + provisioner http-metrics endpoints.
-# Picked up by the observability VMAgent (selectAllByDefault).
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VMServiceScrape
-metadata:
-  name: ceph-csi-rbd
-  namespace: csi-cephrbd
-spec:
-  selector:
-    matchLabels:
-      app: ceph-csi-rbd
-  endpoints:
-    - port: http-metrics
-      path: /metrics
@@ -79,7 +79,7 @@ spec:
      cpu: 500m
      memory: 512Mi
    requests:
-      cpu: 50m
+      cpu: 250m
      memory: 256Mi
  smartShutdownTimeout: 180
  startDelay: 3600
@@ -1,58 +0,0 @@
---
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: postgres
-  namespace: grafana
-spec:
-  affinity:
-    podAntiAffinityType: preferred
-  bootstrap:
-    initdb:
-      database: grafana
-      encoding: UTF8
-      localeCType: C
-      localeCollate: C
-      owner: grafana
-      secret:
-        name: postgres-credentials
-  enablePDB: true
-  enableSuperuserAccess: false
-  failoverDelay: 0
-  imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
-  instances: 2
-  logLevel: info
-  monitoring:
-    customQueriesConfigMap:
-      - key: queries
-        name: cnpg-default-monitoring
-    disableDefaultQueries: false
-    enablePodMonitor: false
-  postgresql:
-    parameters:
-      max_connections: "200"
-      shared_buffers: 128MB
-  primaryUpdateMethod: restart
-  primaryUpdateStrategy: unsupervised
-  replicationSlots:
-    highAvailability:
-      enabled: true
-      slotPrefix: _cnpg_
-    synchronizeReplicas:
-      enabled: true
-    updateInterval: 30
-  resources:
-    limits:
-      cpu: 500m
-      memory: 512Mi
-    requests:
-      cpu: 50m
-      memory: 256Mi
-  smartShutdownTimeout: 180
-  startDelay: 3600
-  stopDelay: 1800
-  storage:
-    resizeInUseVolumes: true
-    size: 10Gi
-    storageClass: cephrbd-fast-delete
-  switchoverDelay: 3600
@@ -1,13 +0,0 @@
---
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDashboard
-metadata:
-  name: bind9-exporter-dns
-  namespace: grafana
-spec:
-  instanceSelector:
-    matchLabels:
-      dashboards: "grafana"
-  resyncPeriod: 5m
-  allowCrossNamespaceImport: false
-  gzipJson: H4sIAAycS2oC/+1da1PbuBr+Kx5v5wx0A8QJ4ZKZ/QCBnu2Z0naBdmany8kotpKodSwfSaZkMzm/fd9Xsh2HXEhCYiDkC8SWLOm9PM+rq92zSRBwRRTjgbSrPdtnUtnVbz27ETFfvQ/sqlOwPaKI5JFwKWZR3RD+Z28W7Ih5cKslSJMExO4XbBqQhg/ZlIhowW4zL/3NXB7UuM8FPCBaDbJVLFglx4E/lUrBcrahtIB0sIaTQdOsf1knPhVKQqoiokWVaWyHwQ+nWCzYHaLc9knQtatN4kuK2Vog0bebwqDBst3gRHjYvtF7N3DXo9IVLMQqIfGUBd6xdfbxyrqi4pa51LrC5kjFXLkLDaEeU1kpm0y6xP+TEgH5hLrggWrbVWhbK6DqPSjIKZWLxwVUU9i+5txXLNTpPgt+SK11VA7UTO8UFQHxLUyxh2RhCiu0z5KGW1eJDVRSom2n8sXPR8KHi7ZSoazu7bWYakeNXZd39kLqEqkE34tNt5MqRO41fN7Y60AyFXuh4B2q2jSC26iVHXoXcgEpO14gd79LaHX/BgW5pR/5z9QGIQmobyRzue+TUFIvTRzrVYOKUq96k8nYR+0x7zPXztrW3gnVlfYL9p1WJdi/CJnwQec404CbxG9MaxasW9Am2tE+0dImtrjqgo46A6UL0EC/sHAlTUZ9r8aDJmvhcx5tkshXWmDX4KZndzgCylZtQWWb+560tfe6rENQXAfxEIYsaBlxeZgCXOMEHg0i37dRIgmF6/aB08H9j3sg3AAgEjyEEd/IO6ht0ATSkNyPFDogaCFMja3x3RKUBpByS/wIMmOdqJgkWYA3pIlHRQ3BKEBI21ogfksFWJtqA46Yfl+b/iBjeSex/ABSN6iJuzNQ8GfOAtSiZouMQnRjLowwAQ9QEA3Q4VvfI4B9sxvfJJHicJMLRgPDUAgvuPwbME+MXr3IpZ8y1RDfxQbZHUoC+yY2szRo1SqQMTJQ+doWvfhXtlK4FfpRiwVfqZCm3uPdyq5jL8W/AdVolze9el3xKqTRqqRASZ7sWzsWKHIL0V9vcK7qinVoPU7tsUAqErj0t///Zb8JoL3V3bd/2f1tC2oyaSrl/wBoAwQ2kidX74ir0CfQdLRFA+8dF+CqJpMgQYumvDEAoXE58AE0aRIW7CFsXlKJXKwdLXFpsNgGn/ni82AIn6UNPleKT1c752wIfXqAmtZGYixGic+I1N1FaRTeIEJmuhCy/YEGLexnOUVzTeVjexhTAJ667RjvbzJAbLVsfvxbEA+dz/T/xuDCKWlg4L8YGdBJ9mgAXU2WEQHbV05UjgWQ21aa6EZC6Dria3CAwW8WpL+BFAZ9MsURAcnVfc8GAfHSeAJe/GQearc8BFkkCo3XBISGrDKoJdhbv04IyRSI2KCgY4BgxlsmwSXE8lGLYKhqJb6WGScLPCoowqHpc4WupjX3KWsVuBkSl2ZdBDzL/THQDLhnSL0PIGhm4LAsnLLAFZRIugVPuFTKuhtGCSDr2g4TYFmwvvPGb3AH/gFIvzmlorzZth/CZmksNkfQ6IyCMRM5zCijQy9pyxgzO+z4CCMzz6p9/mJdQ5bsoKMHXkYQw7HvSBgeaOfXHlaPVQfsxG6ZF2HESsGu6RzKuiN3LBu6lKnCeK8pNXFXDbguuaPGTM1EXrSIz1unoHRNVYNnkUwG2drYuolZb3TZLHZk1kqQ1H+RjOTMyEhHmZ50ZRofOQdDhIQKOpHXZiQcZ1uEpQRrtdWVnikY4i1j+cVoy1k+bZk6noa1YmitlLS2ZNTZEtC12EI6mpmyEpLathpdawsRvG29taAzt23tWTgvQsSWy6NATSoWHwHKi0AhSICT+ivIgu2sk8xLib2ehVVZ/f7SyPF5cWDsrPfoTaPOBnvYMersor0APxrAzUGQ9gdOPMupdKDYX2q1k7Jugbmp7x0dF98VS8m9OJ9TqTmH9tqR69EM5Hr4Ysi1tF7kmkuXUJOfD57ujPKoJrgFOnkJmGags8LS2l+ZFAcWFaCSFeB09QI4S5fAGRKhtkYhZVw82ASRpQWRylxBxDmYIYocveYu+pPOLOTRR9ck1qEdLrr1C9q5RsXXG11FJ87zwfTg1r2n3sHk7wMP/WplnzmNmk1Q5lzP1Ijbpt70RxaZ2Pgi9XRhTgFvHqUtIAyUa2HB+QXAeSy6gEBxubNEw6XKM4u3LSCOKTYjzdkKY3tpVbE95ucJIV7r7AlD/FqM9Q6zU/tmJu14WpjeX87M/jMbxK0+/MbOg9RJ7qx3zKfWWbx1h2vaMQYr9p96uJdM/IP96s3sKlxCSW9wGw3Mdw3N9y8SQsBB8giHiUA8pMFqJfoU6qXpBwPiPMsXYzzluY+0yqUcVjFwmwRACwknM5b6yoSKtMF+KZ7slw9rg3vWhQ64maQXwN+l+fg7XpqdSuCVpyfwzcrsI2js1rhz0n+813FcNqUlgMqTqEWM7JxETIlkycwd882z4+tx3ebNovPsfeWhnbvOwTSuPX56rnU2XPuIXTB6b9r/Igos5EWhz1xYZB5ZVJ5KSKMbYSYz0VlaxVi+3V8u3Y4TEkwAeF2ZgLCQrWsYXsk+zVNCQQF76LGrk/IyrWLsbNL+whHlj8hQzItYbFlBSMnvQEapnOz7dXI6kfE+gMMtsLt69EzG65h0Ku1PC6RTtm8ZD33k0lAMntcZbXv9J14bGuZpFiNBEzZ7dLidY5MVtnuZm6zuQduamb9Lz3ixfHAkZAeBPncRr3qCPZ6gmU52hxuyW9tl8AlUJyiQnVQr7Xnz0F3yJtL7/HZppLA+6ZpeCM9tpj4WnPooTz0BdLQhsVdCYqCKEJRDV0pe5lDpJPJafEh9GTceuEtqvLxWzspvbF0+SsbW5ZzG1mBb7gN8XtHYeljjUxcEncpmlnotWFj7eErHOczl3jL6EygZTkuNn9jNaep6VHQfznzmI/iHk4vz/KeyRyXuMKlfw5CP1Bfvry5Ormu/zzC/vXLJAWoBrpl4+Yh+ffnlY+3k+vxs7N7KR3VEtGBW2iM51/jdDKLWLTRnDy3vT10+dkqbyLxGkXk589mzR+QVTWenTPWiprM3DDUvQx3NwlDlDUOtGUN1n9XAYdl7DKcLDm+GLOYq/jm8qrOYyxmqqYILqvKLTJdQWXdpp44zW2O6my7zWgek+BTxAxFpfxOR1mDP5T2C8iKh34mYvoCnEbk/qMohOvmr6EIbtjrtWmexXBvKWuvNbZXyVMoqbijrRVLWMFO5eOS6LoSEwuc/rfJ8hvX66Lh1eQmvkFevd6/xK9mJ9gAzORtmWqPhPQxvof9UB80zz3Sn8hzrfiU+jM+ecpQ/Kr+MXH3kMK+5jnHbWJZy2BDmEa7Oa6jjWLTX2aO80WpFnUEpFXQTCcGsQ1KQl49Q2V3ffElFZL5UoqM5XHr62A5epF8MQU4YuB5qnXZCH9QctIY+QJOSIiic+tRVmd008bvwP2ddOH5NffZmP3lVaBHdy/Ujj574A9L0SYP6979k0wGXYmmW+Es0QzlSekSX0SOq+2hKtebg7xa9M9vm5Q8WfhH+VTdwB5KMfExH7x9KZe8vHP8g4DF4V79hY3s2TfyHNyap4LtOGid7L1WCLqZuXNewRRTqV1lvZxA6sM8OpOx8JYLhTsYdPYyLtx3Nqj2DPUe73Vdd7R9xU2JXzF4axZm2FvA9s9faV+OQ+XRK/51LVZ2kdmTOBfWeEPAE5WPJM2p/b+vbf6s3v27DC5T21tkSnw1RjjVEaNLmN8SY91Bt7b7dhtj3oImwzllNpC2kS55uovISTIQxSccsEL0JzdV++nNHv/4SvoGhr+w4T8hgbkl/EyVudj0J9DpO6LDiFPFvWf/V7zHVJZnXaZaL+jeGzRL+cTw7Dt31gS2yD+isBzqrfqC0r/9iNDr0dIGenQjwN348BIaesINRmh2NcQ/AfPrrPA5Z+A2w1M+Gv3+FgScJh7g9k9If+uNfus/xD1uJBfNebQAA
@@ -1,13 +0,0 @@
---
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDashboard
-metadata:
-  name: frr-ospf-route-metrics
-  namespace: grafana
-spec:
-  instanceSelector:
-    matchLabels:
-      dashboards: "grafana"
-  resyncPeriod: 5m
-  allowCrossNamespaceImport: false
-  gzipJson: H4sIAAycS2oC/+1ZbW/bNhD+KwJRFC0gF7brZkGAfXDcZgiQpkFcbNiawqCkk82FJjWScuIK/u+7o14sN0lXB0nRJfliS5TIe+655046sWBcKe24E1pZtlcwKaxje58KFuVCukPF9nohS7jjVucmBrrFLTP8Z1PDU644C1kuEjzvdILfyqGg02GrkIHikcQ7nckhZDORNMci1mqkpTY4zUwj/qIbBv1eD3/evAmD3ktcU/E5GRmu0QXPg6EE4yxerSAk3M4izU3CVp/JYCJc22QqbMzln8DN2HHj3mvlZmyvGxL0bPZRa+lE5gekUOfo/qfPIcu4Amk9BakAmYy0SsWU/E4g5bl0nqY5zzKhptUcNzNgZ1om5TVNnjIeWS1zBwjXOsjKJePK66kBUHhlwWWON3dX4fqagWR9ZbeLrqFvegHGIIXe4opcEMmJ9vbQp9chu2B7g5BdeneWfkVGYcHo6ayJrjfxvsRXGqjIqMaUVjT0d26dSJfVYAzKgcFhbQQe+miQf7nTOJiBoRtGM66mMGqtbx1XCcUmJI/yGD60cHAZkydMcpTb57CkGkdY7Tkep1xaQDeQ2YuTtpXqEvIOl66yVqHZPhLEdpv9ryLT88q6QOaP+FLnrtQWDmUynwr1Oxhb0tHrv+q96hIEbqbgSiPtxGHPWmco1suMzKXGTNC0hNhpM8mzojn59Yxpm6VnLBSKuIwBR57Vx2ds5YlNDyn3hpgAaFk4Ej/7MD45CEb1OgGK3+WtrMEFnHf5/6nvwYa+d7bSNzfAr+i7ks49qftYu+NcyrsU+f2q0eC6MHFYduUkFVHBU4HCE9ligFJcmJRUiH+30OXhyWIQnNLyNhAqODjcfzCi3N0Q5S9PovxRoty5A1HuPFBRlpXydSXKwZMo70+U91MlH1h5rJX45kmJP0KJd1kat1NipZpGdhmX4Bx0YiTXipiawxjDqed0D78Udl+bBMwY+WwopOGR7zwg+QuM3rzQiipxzcrhIx6BLGNFpyeSxzDHNdZhiLgZSjFV5WjXD/whEjc74PSujEOv8I0yMfxi7JaeBGwNiexUSPkh47FwKORe2UMmJL7Nzom63ANTOiZhCipZa6LuN6vzhfiylhKGA1tbEp1tbiDLh0RApmUtcRrj1IvRgQfO9vooJS2UG4sv4JOLul54i428EVFeTmy69mqBWr00j9StYOFbPIvt7yYKjHd8jmWF1piizjIvk7AOrfd71S43FXFN8HWaMqoWP1l52vXlqd9t9cw7VX3qb9SnOozrGoHwE2Ezyetq5D+aUEKv9RZpR/ouaT6qlqgSv1FC4fVC6l7zXVFhkSrpidDGNTzfbdWg9nKiQEzxI4qxxXfWipKPA23mnIAVhUjR7dV/tKPHtZkgWgZe1TRrXVacmAOmgMBoPaLikpX591V5+amqS+8OqkvFz6MuLr1BVV1eP6bqQi9vE2n5ROXzCEzx3WXlI73LBEfjYVAUtMjX9SW8JQxwF9qcbw3nuJx3E6D9WwPiNjJboxmO909vgjK6PTf2FnE6HiOMG6C83RYKocCCC0Zhmx/rnMrT90N5V80kOC0U764+jAjviJa3Tw+gpwfQQ3wA7Vx9APX71QNo95E8gGyMXxFgkuTGy2tiAbcdE1ts8WrbbMZ84/X24PS0vdnijQZvK6PX1xfaZjQgNV+nD65NkiGPu5SPNp7BnDc8DHrEgJcXGcQbqJDhH7XnpF8CBPOMMqlUc7ORG+fG+KAVPhFjmScwxI8bteVqp3WDxX9yMEsqD5jr4Gbgt48aiL3WBmwzyQu2MVXWLYwzEC9BTfNaxozS6htxvBloa60apqTKOCk/z7y42tmEjf2X17tRrnO9B1XlbyGvR27rADZY22DH278Nm7Kf1JWJ+BxMGWc6/0I5halq9IX1zX1bsf45+Lz8uhO8B6ylsW228hFGh2B0TP3xZ1ELsb/6F7MoRVUzIAAA
@@ -1,13 +0,0 @@
---
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDashboard
-metadata:
-  name: gitea
-  namespace: grafana
-spec:
-  instanceSelector:
-    matchLabels:
-      dashboards: "grafana"
-  resyncPeriod: 5m
-  allowCrossNamespaceImport: false
-  gzipJson: H4sIAAycS2oC/+2abW/bNhDHv4pBDMMGOIWlxG5qYC+yDimCpknQtOuLNjAo6SwzoUiNpJK4gb/77qgH20G2dbCgtIBe2BAlinf83+9OpKAHxpXSjjuhlWXTByaFdWz6+YH99NOC28VbWLIp09E1xG4ajl6O2ZBFhZDuRLFpMGQJd9zqwsSA3fb2Bm8Mn3PFB3t72BEUjyRecKaAIVuIpDkWsVavtdQG7zJpxH8ZDQdhEODfeDwcBL/izYpnNObR2r3Bz4MjCcZZvOqWOV1N0MVIc5Ow1dUKvQEbG5FTb7z4TivhtBm8EQ74wIK5BUNeJcJt+pUqcCcJzmY/eBVi0/B88UFr6UTOpqMhKqJuUJrPV0OWcwXSenm4FNz6KZBsaDvidDTn0sLQ+3UKKnULHHdUtmHz8oZqCbhwOR4nPD64vonRwbmQ0otLByhoIkBhTMbkm0gutI8TDjwZsjs2PRyye+8nBmq08jInoC7BiA2DAue3jyNKSEEldD+/TZurcWGMN1G1M36/PhaqObYLfdc0HIZFNq1bLovG3sqLRs1SYWrciYTEQD9VIeWFFsq90wSEb+Osdd4wSPKc1qrjYDmgUsrxFBp7uSxSof4EY8tYT168fLGPo+Q0MElW4M1h1V7rgNNMwABhN5fa4Q3WC3WOaKC2UMXZ5jyGzfhZx+ObtQ4O8hwSdHHtkOMmBVeyAfc5WciNjsHamQGLQys3yyDTZjmLlg7sw7WOfvvCUmLzC1uhJ+goIkqaMlZH6libjLvyjIE5YcqOkHW0t8BhF1omlctOZHBsdMampGfZfg9pKWnd4XIh5m7dw1ESsPeVe4PSPUqumv4HDDk3kNSBtNo4H0Mf7lmVhEIl4lYkBbqOwUL1FepXAlXeVvXzmYXD3/N74eMcFfGN16x0KCt5IEeb/C+vlOCVg9WkeTKW/B5Kzee1UtjXUGAlj0DWA0id/s4t+KzydFcWCe7HJlbDVke78l6WE8aika7TybdO4bYeeEWWv7O6cvgNdSXs68qz1JU4L2YW8Ema2JlX7amaghY2IvBcNeb1xcdBldd9cemLS1Vcgsk3VJf9vro8S3XROajZPHliodLwS8k0K135z1pTt4557GjZH3RZfs5xLoPjPy778vOs5effK8h2nTjwdWKysbmZrMqKEG5lXUzVrMpJL5+vRSCT840+XMakJM7UujPtzih3r2i7OOeFdL5PxvNcqLQmaQO9hzp4PLJaFo4sUC6VsYmrXWzCzc1eVNov/SjnfYUzZ3o7UR+XHQ9PXVe0oiGuC+vEfFmdpDri967aUFnl1QaXF04Tlv9UVp7Ibp/GMx5TildZ+79WBE+k4JMZd1ZkEZiBng+O1raqXMEy4dguPEy2eAgOeyB2BcJAri29LBHdQPF+215bYAThdqU46MnYlYwCn++dIPGxMtQaC4dbLIx7FHZFQVhbdFMeTmpLu8NwsLGCCEb1IyP4fmlYgpS4wPohVhGlOp0sImpTbRFx8IiIUU/E7kT4nUQnQJzWltri4XCbh7CvEC3woE3KlfjKO6sT548MtkVHtbBcl4tJj8fueOAv6wSLD5Wh1nCYbONw2NOwOw1zTZ52wsNxY6otIsJHK8ywX0+0gEReRFLge9RlJ1RceGtvS2st7zwO6gfHy++Xi7wwufwhdqIYlW5eSlxWhlredTQ0HPQ07E7DHUQLrW86AeLT2lbLO4+GiVc9E2280JbAbVcvsxtbbe83aij6p0YLTMQ6y0C5Tph4vbbV9qajZmK/Z2J3JjIhwTqtuqkU7zattb31qLkIxz0YLSwquIsX3VDxqTG1hcSVH5pkxlNBRqJit4w3kwhD0nkpoVLXT6cJEGS5RBVUuvFVP31W4j9BwVNz7ySKebcXLPyHMWWLVX1y2ngZ6ll5MauF8KTsj8hh79aY/gL/vz/yxzReSH9BwmqbXylqUxYZ3Hj7QNVC+M/zsV0QvEyd/RWc3I3ffPWQGEFf6ttHU7itFRiv/gYQwxSUwDAAAA==
@@ -1,13 +0,0 @@
---
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDashboard
-metadata:
-  name: nzbget
-  namespace: grafana
-spec:
-  instanceSelector:
-    matchLabels:
-      dashboards: "grafana"
-  resyncPeriod: 5m
-  allowCrossNamespaceImport: false
-  gzipJson: H4sIAAycS2oC/+1X227bRhD9FWIfCqegDcmNAtdAH2wHLgzErgEZDVpbMJbkiNx4uUvsDq0blG/vzHJFybHbpg3aIkBfJHEvczlz5gy1EtIYixKVNV4cr4RWHsXx7UpkrdJ4YcTxMBWFROlt63LgI7ho6FuUTk6lkSIVrSroeX8/+bFbSvb3xToVYGSm6SS6FlJRqaL/rXJrzqy2jq65MpN7gzQ5HA7pYzRKk+ErsmlkzU5OttEl3yQnGhx62o0hFNJXmZWuEOsJOywU7rqcKp9L/QtIN0bp8NIarMTxIOXQm+rGWo2qCQlqZR4o/dtJKhppQPsAwYtpN87WgBW0vs+8ADxcjEaFzF9/eMg59akCXZxZM1UlXy1gKluNAeC8y3slalsEe1IDIuznWnqvwu289WhrPiPnyp9aV4AbV3YmjqdSe0qMl8/AIDgofgVnn26wg8vOOMIcRbf8TmagaSk+XmuZQ002aEm2aGk5k+5Eq9J0q4Ow8F4VWJ3LHDnmwcEb4oKTszEuGGWGDQRnq/VPjcwVLjbwFoqMxCCMDaeYAOeuy0tDCabow8ZNKeLzo1rG34SGMp6qftVqrko8wI4vOP/G6sCOGIx0otsMcYfSNlYZHKslRTJKBRMC3hLHncra7mJf2WiAXHoC+5rveQ4fHoHNemLG0yg8yvxBmVDi0tm2YcLSyXonb7KGlQOyqAsfcetrb6dTsd7Q5VKZSznvjdeyach2ZOXWxs51mXmrW2RwPULTkTbyiwICMLTzKHVLhw1Fvk6328Sc7ebRIPRPaxTT4ZQs0ZOltB3VrDNbS8wrCMQNnM8WV9yhdKyJ2iFuqFN1clMREmXVtMhGqFsaqp6KVsLVLoTe+YrSn0Nx9kncMcewxyBtLofeOOBadWju2GE5IDfDQTocTDpaRpEgA5OQYkkZXdsAIh09SgU11eHrVMwDcZm+zLgiMKfPbMtXwk/qnHMR1K54ZQMvOVqQIWgVPqmM5L9QvtFysWnFoEyEyE7jOVVW3J/Mt3fRBUvXeqcl+mp7YkOw4K3Dnl58VLoS8Esli6LlCG9IMd6TPPY8ZFHt9STnL1qbN1wq5STCnllm5P7ewMzfU6cSa+6RmXCfLRD8qlv64eOdOPj2TqxvR/WE9X1KuF0CyjG1XF713pTJdVvAVdzldPqhYajfGLaNBgTAzq0jalIwq+hpvSbrTpqyHwMOphdFbM3Wwyk17VZ8mFh/H7SXwYGaiuy2CHZo+bbe+xzEAkKv7ozYzMwemj/M/1n3/Q4KpzQriTMKg4J3oSRv3yXjBqBIskVy7ewj+XXbMYuqBoqTm/jL4PoqxyIvj+0USZ83U/H/MfmfjMl/fSR+MgU/a4AcxQFy+CcD5NmACG/eT+dDZpEZ/xUNCP7X0GlHVL2odVwsWdzntjX4T6j/SY7qERLSFgN5h/pfmgLPJfFFiy8I4iSYZirSxjAUi16UavkzOB8a57vvuQI9a8NwwNgO8d8WE4tthpeh0PtUvNn+m4pd2u5JxDONosBZKePzkqtMwDs7851oP8mjLyjA4GFp1AezHJSDnIm+CZC6fwbwEP4jsRKufwNsYW6gFQ4AAA==
@@ -1,13 +0,0 @@
---
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDashboard
-metadata:
-  name: puppet-report
-  namespace: grafana
-spec:
-  instanceSelector:
-    matchLabels:
-      dashboards: "grafana"
-  resyncPeriod: 5m
-  allowCrossNamespaceImport: false
-  gzipJson: H4sIAAycS2oC/+2be2/bNhDAv4rAbUACOJ0k27FjYAOaFzagj60J9sfaIqAlWiYiiyopOU4977Pvjg9J9pLGbtM2bVy0qsXn8e7440lnzwnNMlHQgotMkcGcpFwVZPD67aJFYqYiyXOsIgNyzArKUxZ7PBsJOdE9PDoUZeH9UeY5KzzJciELb8IKySNFWoTFvKDDlJFBIUvWIknGit9jMuj5fouMecyORFZIkSrXIOXZpcLZW0SykWRqTAYjmiqokuIKa+YkEmlKc8WqmtVZxownY1gDCbp+PgMxcpqx1Ham0Zid8wkDsckgK9O0hQMKeUijy0SKMourcXX5XzQt2XIRjkRkMqQ7Xb/lBb2w5XW6Lc9/ctDbhdl0TdjuQVV4AFU+VvUP6ips3O2Yf9Bpl8BqY1pQJUoZwVyEsndpnvFeycJphxE0RMQnFJdgJF5dMZNSyEpIYx0YB02Q0DJhaNcJndm1BP19UP+EZ/YebtRYXLnBijHqXaTxMzrUarPDVuXPqbxk0lUsGgqH+TjoL4D/soLJKU2dxFy9YFc3WHlC85xnyfl1znS/xr0xWEYnqJIpiuoVwivYrIBppnYpi1bVRNIsuaFJuNDTzI5Bw38IkAvGDdD/UDBd8FzE2D8SWcaigsXE1J3jMFb8XKhixGdmifbmFHz3jL/Hrj3/JywHl63a6M+NJl3dRMv4HLxXr20kxQSqcAqo02IPyIufn+KNcBUovgIPhpXoD/IS1KctOuJpeoQOiYtHz2oH4HNBHy79A3StoI9ON8JRnBGxb6OP6RKiGx+0sbFxBGfYgsqEFUZYNsuxUwF7Z2d3L9c7/sLs+PkYNPLLG/Ij/v+GtFg25VJkE5bp0sbtG7L4GZTve796ewExDKhkcz5zSqMCBYT1pixhWXzqHJpoLCBBCCpJFSyHZh0fdVS5p8Kd3wcLB/2+j6rkBe4UgrveUzyLmJdS5WiFDcAqqFiQr3Z27ZAEmicpU4BH51ANk/a1SXVpZVIBApFfVq1pXbE2qC54Yfw2KqWeGl35Y/Fk9tUSnXaQO/B3HSTdwLE7mbQmgzKRsVsw5N9MoVXc3IkhnH9hyNN9bOTpfmfksba8ATxLxLlgU9gyahPwtNBYUHoOwU4KHHIIups68zl2XSygsQltbpFmfTq1giaXUCBPjLwTN8rjgs9HxEMPkj29LXu+CntW/Cfw70RPs4f/pOt/NH4sUk7huaiUDBizSSD0YABkxSfbqOcbJc/+ljzbqOfDUc9ZGUVMqYeEHSsSqOu7IA/dqViy/tugGlffJnn6W/I8DvKAD2jPrGIe+xj1bUY8r9xq7pE8/jbi+XLcCcIteB4HeKIxrmejmGdxM2JuAYmdYH2SNDhyVPX9gvELnSbGYqDHcyOITdxYqZ7h222bkntlXnJr5qydN2v7/8ub0ZRTdWS5M7cLR2X90Ds5DPePofWpzg5i0UnYOe6EUPQScoPwYktdZ6j3H46OnsLQUP4KVSQL29rvdUMc4AyYGJd2jJ5/fHiiSy85rESXdftBxz+CMn34YEk/POwe92F5ZEhllUX8JKBxdOXA5icR0S+n0GIpT4EAClaBow8w1A2oKsmeqvPmHGiziuf2HHBah6FPJnlx3Sz4m0nh7gEsVV/AaJ0QRWudacFMw2YST4HVjyF9W/mG0Zjtqt2pJiruWLW0f694XIw1qxsgXaWZhUrOQNFZQZNaQzm2kjTmpdLIzS0UneSgKSYZbvZRKnCrKCY5U07Tdj6DpH3cjHAqViuDnQn+8EwTyp0VN+SpRH6502st73VMXs03jVi8YJc0TxuyaQRzA1dWqYLLReFODa7DCTH3Z2M+qk4It7+PS2mS7zspLViVydrVTBdpwXN9ACuMctLSZO+totQY0lx1aIFeog2kHeLCQoxnMZ/yuITFLiqyJZLmY5hhRmdcI2BinMBYDs8zTScjadMTna+9rhwfv1pwTWf29F3KVqcYA7hRUpEcUuUO7Zkr1ntgdR4EXD3S2CT27GhosA+NpUO3xlBvcbBHCDzk2sFnwJptUHPNwWwLNgM2txvXI9ttD2af8iR2P1TzP4w1R7FbsFY9lHnDaw9DqFLdF+H8B0K4ZS59bcq9rXUPO96DL1htGCeG3W81TrQruwdu2nDQ/3RuNjC5DjhtcIimNR/vHZvVk7SjZvD1qGk9y6XLyTI7F/cMVR0n6hdd/74h8B3FEU8AQfD4yEBT/9zHq6+PAG71/Po54FvHlAK07mG7TWhbO9knhpM48VqoNQ68DSUfIhNtLNl5DEz0HxITqzOpIWB4Nyo3erB+VOHndwHDBxd13vrmcumlpfIq7Zv3nYC4Cf0LUgFa6UHbafxICgWfuKw9+VoPF8ObbLQbTbSWzOiY8SjYJIcnC3hZ2/jFA26n1CYpbEbGYWi+uIuL5ovMCL4sSsuYPW2+ELeq+g12Bp7jJXhRVWkzC2NTJ3L7Owx03Xclk0A80//CWHtnafu1POy3Sxq/lgjwc8JsjqB6/AEd6KWpP82g1vdBM8sFxiHNzObs+qwqOamxcJtm2FKTjRXU6P7Z9IQbT7vpoE64iKu99rjKsuhHK90m59ElYn3uRLlw2NM+2sXQJfDx2tbXAF8FdvES6Gvb159x6BAvQUws5S5q3TQ76Kb7uqnuEHb0FVNQvVgPGBO3gPeYxBuQIf7WBoS8ZWNCeYnnOxnRg3CfDv29kIX7e53OMNijbT/YO6Dwxw97/XY4wmxGtWUX/wF8UK+AbjQAAA==
@@ -1,60 +0,0 @@
---
-apiVersion: grafana.integreatly.org/v1beta1
-kind: Grafana
-metadata:
-  name: grafana
-  namespace: grafana
-  labels:
-    dashboards: "grafana"
-spec:
-  deployment:
-    spec:
-      template:
-        spec:
-          containers:
-            - name: grafana
-              env:
-                # DB password + OAuth client secret injected from the
-                # Vault-synced secrets (GF_ env overrides grafana.ini).
-                - name: GF_DATABASE_PASSWORD
-                  valueFrom:
-                    secretKeyRef:
-                      name: postgres-credentials
-                      key: password
-                - name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
-                  valueFrom:
-                    secretKeyRef:
-                      name: oauth-credentials
-                      key: client_secret
-              resources:
-                requests:
-                  cpu: 100m
-                  memory: 256Mi
-                limits:
-                  cpu: "1"
-                  memory: 1Gi
-  config:
-    server:
-      root_url: "https://grafana.k8s.syd1.au.unkin.net"
-    database:
-      type: "postgres"
-      host: "postgres-pooler-rw.grafana.svc.cluster.local:5432"
-      name: "grafana"
-      user: "grafana"
-      ssl_mode: "require"
-    auth:
-      disable_login_form: "false"
-      oauth_auto_login: "false"
-    "auth.generic_oauth":
-      enabled: "true"
-      name: "Authentik"
-      allow_sign_up: "true"
-      use_pkce: "true"
-      client_id: "grafana"
-      scopes: "openid email profile"
-      auth_url: "https://identity.unkin.net/application/o/authorize/"
-      token_url: "https://identity.unkin.net/application/o/token/"
-      api_url: "https://identity.unkin.net/application/o/userinfo/"
-      # Authentik groups -> Grafana roles (adjust group name as needed).
-      role_attribute_path: "contains(groups[*], 'grafana-admins') && 'Admin' || 'Viewer'"
-      role_attribute_strict: "false"
@@ -1,22 +0,0 @@
---
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDatasource
-metadata:
-  name: victoriametrics
-  namespace: grafana
-spec:
-  instanceSelector:
-    matchLabels:
-      dashboards: "grafana"
-  # uid matches the previous default datasource so the imported dashboards
-  # (which hardcode this uid or use the default) resolve without edits.
-  datasource:
-    name: "VictoriaMetrics"
-    type: "prometheus"
-    uid: "det2y55dac4jkc"
-    access: "proxy"
-    url: "http://vmselect-main.observability.svc.cluster.local:8481/select/0/prometheus"
-    isDefault: true
-    jsonData:
-      timeInterval: "15s"
-      httpMethod: "POST"
@@ -1,28 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - cnpg_cluster.yaml
-  - cnpg_pooler.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-  - grafana.yaml
-  - grafanadatasource.yaml
-  - gateway.yaml
-  - httproute.yaml
-  - dashboards/bind9-exporter-dns.yaml
-  - dashboards/ceph-cluster.yaml
-  - dashboards/frr-ospf-route-metrics.yaml
-  - dashboards/gitea.yaml
-  - dashboards/haproxy.yaml
-  - dashboards/media-dashboard.yaml
-  - dashboards/node-exporter-full.yaml
-  - dashboards/nzbget.yaml
-  - dashboards/postgresql-database.yaml
-  - dashboards/puppet-report.yaml
-  - dashboards/victorialogs-cluster.yaml
-  - dashboards/victoriametrics-cluster.yaml
-  - dashboards/victoriametrics-vmagent.yaml
-  - dashboards/cloudnativepg.yaml
@@ -1,7 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app.kubernetes.io/name: grafana
-  name: grafana
@@ -1,18 +0,0 @@
---
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: grafana
-spec:
-  allowedNamespaces:
-    - grafana
-  kubernetes:
-    audiences:
-      - vault
-    role: default
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default
@@ -1,34 +0,0 @@
---
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: postgres-credentials
-  namespace: grafana
-spec:
-  destination:
-    create: true
-    name: postgres-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/grafana/default/postgres-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
---
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: oauth-credentials
-  namespace: grafana
-spec:
-  destination:
-    create: true
-    name: oauth-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/grafana/default/oauth-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
@@ -0,0 +1,45 @@
+---
+# Ceph RGW (S3) backup target for the jellyfin CNPG cluster, provisioned by the
+# in-estate cephrgw-operator: one dedicated bucket + owner user. CNPG reads the
+# S3 credential Secret from its own namespace.
+apiVersion: ceph.unkin.net/v1alpha1
+kind: ObjectStoreUser
+metadata:
+  name: cnpg-jellyfin-backup
+  namespace: jellyfin
+spec:
+  displayName: "CNPG backup owner (jellyfin)"
+  uid: cnpg-jellyfin-backup
+  maxBuckets: 5
+  secretName: cnpg-jellyfin-backup-s3
+  retainOnDelete: true
+---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: cnpg-jellyfin
+  namespace: jellyfin
+spec:
+  placementTarget: ec
+  bucketName: cnpg-jellyfin
+  ownerRef: cnpg-jellyfin-backup
+  versioning: false
+  tags:
+    app: jellyfin
+    purpose: cnpg-backup
+  retainOnDelete: true
+---
+# Nightly base backup on top of always-on WAL archiving. Scheduled off-peak and
+# staggered from the other CNPG clusters (6-field cron, seconds first).
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: cnpg-jellyfin-nightly
+  namespace: jellyfin
+spec:
+  schedule: "0 35 3 * * *"
+  immediate: false
+  backupOwnerReference: self
+  method: barmanObjectStore
+  cluster:
+    name: jellyfin-postgres
@@ -0,0 +1,119 @@
+---
+# Main Jellyfin database. The jellyfin-ha fork's experimental EF Core provider
+# moves the entire Jellyfin DB (incl. library items) off SQLite into PostgreSQL,
+# which is what makes a shared-nothing multi-replica deployment possible. No
+# bootstrap secret is given, so CNPG generates the jellyfin-postgres-app secret
+# (username/password/dbname) that the StatefulSet composes its DSN from.
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: jellyfin-postgres
+  namespace: jellyfin
+spec:
+  affinity:
+    podAntiAffinityType: preferred
+  backup:
+    retentionPolicy: 30d
+    barmanObjectStore:
+      # Dedicated per-cluster Ceph RGW bucket (cephrgw-operator provisions it).
+      destinationPath: s3://cnpg-jellyfin
+      endpointURL: https://s3.ceph.unkin.net
+      endpointCA:
+        name: vault-ca-cert
+        key: ca.crt
+      s3Credentials:
+        accessKeyId:
+          name: cnpg-jellyfin-backup-s3
+          key: AWS_ACCESS_KEY_ID
+        secretAccessKey:
+          name: cnpg-jellyfin-backup-s3
+          key: AWS_SECRET_ACCESS_KEY
+      serverName: jellyfin
+      data:
+        compression: bzip2
+        jobs: 2
+      wal:
+        compression: zstd
+        maxParallel: 2
+  bootstrap:
+    initdb:
+      database: jellyfin
+      encoding: UTF8
+      localeCType: C
+      localeCollate: C
+      owner: jellyfin
+  enablePDB: true
+  enableSuperuserAccess: false
+  failoverDelay: 0
+  # PG 17 — accepted by the fork's Npgsql/EF Core provider (needs PG14+); the
+  # provider generates its own migrations on first start.
+  imageName: ghcr.io/cloudnative-pg/postgresql:17-system-trixie
+  instances: 3
+  logLevel: info
+  maxSyncReplicas: 0
+  minSyncReplicas: 0
+  monitoring:
+    customQueriesConfigMap:
+      - key: queries
+        name: cnpg-default-monitoring
+    disableDefaultQueries: false
+    enablePodMonitor: false
+  postgresql:
+    parameters:
+      archive_mode: "on"
+      archive_timeout: 5min
+      dynamic_shared_memory_type: posix
+      effective_cache_size: 256MB
+      full_page_writes: "on"
+      log_destination: csvlog
+      log_directory: /controller/log
+      log_filename: postgres
+      log_rotation_age: "0"
+      log_rotation_size: "0"
+      log_truncate_on_rotation: "false"
+      logging_collector: "on"
+      max_connections: "200"
+      max_parallel_workers: "16"
+      max_replication_slots: "16"
+      max_worker_processes: "16"
+      shared_buffers: 128MB
+      shared_memory_type: mmap
+      ssl_max_protocol_version: TLSv1.3
+      ssl_min_protocol_version: TLSv1.3
+      wal_keep_size: 256MB
+      wal_level: logical
+      wal_log_hints: "on"
+      wal_receiver_timeout: 5s
+      wal_sender_timeout: 5s
+    syncReplicaElectionConstraint:
+      enabled: false
+  primaryUpdateMethod: restart
+  primaryUpdateStrategy: unsupervised
+  probes:
+    liveness:
+      isolationCheck:
+        connectionTimeout: 1000
+        enabled: true
+        requestTimeout: 1000
+  replicationSlots:
+    highAvailability:
+      enabled: true
+      slotPrefix: _cnpg_
+    synchronizeReplicas:
+      enabled: true
+    updateInterval: 30
+  resources:
+    limits:
+      cpu: "1"
+      memory: 1Gi
+    requests:
+      cpu: 50m
+      memory: 512Mi
+  smartShutdownTimeout: 180
+  startDelay: 3600
+  stopDelay: 1800
+  storage:
+    resizeInUseVolumes: true
+    size: 10Gi
+    storageClass: cephrbd-fast-delete
+  switchoverDelay: 3600
@@ -1,12 +1,15 @@
 ---
+# PgBouncer pooler in front of the jellyfin-postgres cluster. Jellyfin connects
+# here (jellyfin-postgres-pooler:5432) rather than the -rw service so EF Core's
+# connection churn is absorbed by the pool.
 apiVersion: postgresql.cnpg.io/v1
 kind: Pooler
 metadata:
-  name: postgres-pooler-rw
-  namespace: grafana
+  name: jellyfin-postgres-pooler
+  namespace: jellyfin
 spec:
  cluster:
-    name: postgres
+    name: jellyfin-postgres
  instances: 2
  pgbouncer:
    parameters:
@@ -17,7 +20,7 @@ spec:
  template:
    metadata:
      labels:
-        app: pooler-rw
+        app: jellyfin-pooler
    spec:
      affinity:
        podAntiAffinity:
@@ -27,7 +30,7 @@ spec:
                  - key: app
                    operator: In
                    values:
-                      - pooler-rw
+                      - jellyfin-pooler
              topologyKey: kubernetes.io/hostname
      containers: []
  type: rw
@@ -2,38 +2,36 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
-  name: grafana
-  namespace: grafana
  labels:
-    app.kubernetes.io/name: grafana
-    app.kubernetes.io/instance: grafana
    traefik.io/instance: internal
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: grafana.k8s.syd1.au.unkin.net
+    cert-manager.io/common-name: jellyfin.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: grafana.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/hostname: jellyfin.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: jellyfin
+  namespace: jellyfin
 spec:
  gatewayClassName: traefik-internal
  listeners:
-    - name: http
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: jellyfin.k8s.syd1.au.unkin.net
+      name: http
      port: 80
      protocol: HTTP
-      hostname: grafana.k8s.syd1.au.unkin.net
-      allowedRoutes:
+    - allowedRoutes:
        namespaces:
          from: Same
-    - name: https
+      hostname: jellyfin.k8s.syd1.au.unkin.net
+      name: https
      port: 443
      protocol: HTTPS
-      hostname: grafana.k8s.syd1.au.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
      tls:
-        mode: Terminate
        certificateRefs:
          - group: ""
            kind: Secret
-            name: grafana-tls
+            name: jellyfin-tls
+        mode: Terminate
@@ -2,18 +2,15 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: grafana-http-redirect
-  namespace: grafana
-  labels:
-    app.kubernetes.io/name: grafana
-    app.kubernetes.io/instance: grafana
+  name: http-redirect
+  namespace: jellyfin
 spec:
  hostnames:
-    - grafana.k8s.syd1.au.unkin.net
+    - jellyfin.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
-      name: grafana
+      name: jellyfin
      sectionName: http
  rules:
    - filters:
@@ -29,25 +26,22 @@ spec:
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: grafana
-  namespace: grafana
-  labels:
-    app.kubernetes.io/name: grafana
-    app.kubernetes.io/instance: grafana
+  name: jellyfin-route
+  namespace: jellyfin
 spec:
  hostnames:
-    - grafana.k8s.syd1.au.unkin.net
+    - jellyfin.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
-      name: grafana
+      name: jellyfin
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
-          name: grafana-service
-          port: 3000
+          name: jellyfin
+          port: 8096
          weight: 1
      matches:
        - path:
@@ -0,0 +1,20 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - cnpg_cluster.yaml
+  - cnpg_pooler.yaml
+  - cnpg_backup.yaml
+  - pvc-config.yaml
+  - pvc-transcode.yaml
+  - pvc-media.yaml
+  - statefulset.yaml
+  - pdb.yaml
+  - service.yaml
+  - redis-deployment.yaml
+  - redis-pvc.yaml
+  - redis-service.yaml
+  - gateway.yaml
+  - httproute.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: jellyfin
@@ -0,0 +1,13 @@
+---
+# Keep at least one Jellyfin replica serving through voluntary disruptions
+# (node drains, rollouts) so active streams can fail over rather than drop.
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: jellyfin
+  namespace: jellyfin
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: jellyfin
@@ -0,0 +1,17 @@
+---
+# Jellyfin config: metadata images, plugins, subtitles and config XML. Shared
+# ReadWriteMany across replicas (all pods read/write the same library metadata);
+# the main library DB now lives in PostgreSQL, not here. Retain — this is state.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-config
+  namespace: jellyfin
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 20Gi
+  storageClassName: cephfs-raid5-retain
+  volumeMode: Filesystem
@@ -0,0 +1,17 @@
+---
+# Media library, shared read-many across replicas. Retain — this holds the
+# actual media and must survive PVC deletion. Empty on first deploy; populating
+# it is out of scope for this app.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-media
+  namespace: jellyfin
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Ti
+  storageClassName: cephfs-raid6-retain
+  volumeMode: Filesystem
@@ -0,0 +1,18 @@
+---
+# Shared transcode scratch. ReadWriteMany is the hard requirement for the HA
+# fork: a taking-over pod must read the in-flight HLS segments written by the
+# pod it replaces. Scratch data (delete reclaim); raid5 avoids the raid6
+# double-parity write penalty on the many small HLS segment writes.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-transcode
+  namespace: jellyfin
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 100Gi
+  storageClassName: cephfs-raid5-delete
+  volumeMode: Filesystem
@@ -0,0 +1,66 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  namespace: jellyfin
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+        - name: redis
+          image: redis:7-alpine
+          imagePullPolicy: IfNotPresent
+          command:
+            - redis-server
+            - --save
+            - "20"
+            - "1"
+          ports:
+            - containerPort: 6379
+              name: redis
+              protocol: TCP
+          livenessProbe:
+            exec:
+              command:
+                - redis-cli
+                - ping
+            failureThreshold: 3
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 5
+          readinessProbe:
+            exec:
+              command:
+                - redis-cli
+                - ping
+            failureThreshold: 3
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          resources:
+            limits:
+              cpu: 500m
+              memory: 512Mi
+            requests:
+              cpu: 50m
+              memory: 128Mi
+          volumeMounts:
+            - mountPath: /data
+              name: data
+      restartPolicy: Always
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: jellyfin-redis-data
@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-redis-data
+  namespace: jellyfin
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: cephrbd-fast-delete
+  volumeMode: Filesystem
@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  namespace: jellyfin
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: redis
+      port: 6379
+      protocol: TCP
+      targetPort: redis
+  selector:
+    app: redis
+  sessionAffinity: None
+  type: ClusterIP
@@ -0,0 +1,18 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: jellyfin
+  namespace: jellyfin
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 8096
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: jellyfin
+  # Pin each client to one replica to reduce transcode-session churn/takeover.
+  sessionAffinity: ClientIP
+  type: ClusterIP
@@ -0,0 +1,199 @@
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: jellyfin
+  namespace: jellyfin
+spec:
+  # HA: two replicas coordinate transcode session ownership through Redis and
+  # resume each other's HLS segments off the shared RWX transcode PVC. Stable
+  # pod names (jellyfin-0/1) are the lease owner identity, hence StatefulSet.
+  replicas: 2
+  serviceName: jellyfin
+  podManagementPolicy: Parallel
+  updateStrategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app: jellyfin
+  template:
+    metadata:
+      labels:
+        app: jellyfin
+    spec:
+      securityContext:
+        # Group-write the shared RWX volumes and grant the render/video groups so
+        # the runAsUser 1000 process can open the Intel DRI render node injected
+        # by the device plugin.
+        fsGroup: 1000
+        supplementalGroups:
+          - 44
+          - 105
+          - 109
+        seccompProfile:
+          type: RuntimeDefault
+      affinity:
+        # Spread the two replicas across nodes for node-level HA. Soft so a
+        # single-GPU-node cluster still schedules both (i915 has 4 shared slots).
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app: jellyfin
+                topologyKey: kubernetes.io/hostname
+      initContainers:
+        # Select the fork's experimental PostgreSQL provider by writing
+        # database.xml before Jellyfin starts. Runs as root to chown into the
+        # shared config volume; mirrors the fork Helm chart's inject-db-config.
+        - name: inject-db-config
+          image: busybox:1.37.0
+          command:
+            - sh
+            - -c
+            - |
+              mkdir -p /config/config
+              chown 1000:1000 /config/config
+              chmod 775 /config/config
+              cat > /config/config/database.xml << 'DBEOF'
+              <?xml version="1.0" encoding="utf-8"?>
+              <DatabaseConfigurationOptions>
+                <DatabaseType>Jellyfin-PostgreSQL</DatabaseType>
+                <LockingBehavior>NoLock</LockingBehavior>
+              </DatabaseConfigurationOptions>
+              DBEOF
+              chown 1000:1000 /config/config/database.xml
+              chmod 664 /config/config/database.xml
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+          volumeMounts:
+            - name: config
+              mountPath: /config
+      containers:
+        - name: jellyfin
+          image: git.unkin.net/unkin/jellyfin-ha:v0.1.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8096
+              protocol: TCP
+          env:
+            # Pod identity for the Redis transcode lease owner. The fork reads
+            # JELLYFIN_INSTANCE_ID (falling back to MachineName); the stable
+            # StatefulSet pod name gives each replica a unique lease identity so
+            # takeover can target a dead replica. JELLYFIN_HA_POD_NAME is set for
+            # parity with the fork Helm chart (nothing currently reads it).
+            - name: JELLYFIN_INSTANCE_ID
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: JELLYFIN_HA_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            # Multiple replicas must not each answer UDP auto-discovery.
+            - name: JELLYFIN_Network__AutoDiscovery
+              value: "false"
+            # Config dir must differ from the data root (Jellyfin sanity check).
+            - name: JELLYFIN_CONFIG_DIR
+              value: /config/config
+            # Distributed transcode session store (jellyfin-ha additions).
+            - name: Jellyfin__TranscodeStore__RedisConnectionString
+              value: "redis:6379,abortConnect=false"
+            - name: Jellyfin__TranscodeStore__LeaseDurationSeconds
+              value: "30"
+            # PostgreSQL main DB via the CNPG-generated app secret, routed through
+            # the PgBouncer pooler. Composed with $(VAR) expansion so the password
+            # is never rendered into the manifest; CNPG passwords are URL-safe.
+            - name: PGUSER
+              valueFrom:
+                secretKeyRef:
+                  name: jellyfin-postgres-app
+                  key: username
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: jellyfin-postgres-app
+                  key: password
+            - name: PGDB
+              valueFrom:
+                secretKeyRef:
+                  name: jellyfin-postgres-app
+                  key: dbname
+            - name: POSTGRES_CONNECTION_STRING
+              value: "postgresql://$(PGUSER):$(PGPASSWORD)@jellyfin-postgres-pooler:5432/$(PGDB)"
+            - name: DATABASE_URL
+              value: "postgresql://$(PGUSER):$(PGPASSWORD)@jellyfin-postgres-pooler:5432/$(PGDB)"
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: "1"
+              memory: 1Gi
+              gpu.intel.com/i915: "1"
+            limits:
+              cpu: "4"
+              memory: 6Gi
+              # Intel iGPU (QSV/VA-API) slot. Requesting it pins the pod to a
+              # GPU-labelled node and injects /dev/dri/renderD* automatically, so
+              # no /dev/dri hostPath or privileged container is needed. Enable
+              # QSV/VA-API once in the Jellyfin admin UI; it persists to /config.
+              gpu.intel.com/i915: "1"
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: transcode
+              # Fork's real transcode temp path. RWX so a surviving pod reads the
+              # in-flight .ts/.m3u8 segments of the pod it takes over. A per-pod
+              # volume here silently breaks HA takeover.
+              mountPath: /config/transcodes
+            - name: cache
+              mountPath: /cache
+            - name: media
+              mountPath: /media
+              readOnly: true
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: jellyfin-config
+        - name: transcode
+          persistentVolumeClaim:
+            claimName: jellyfin-transcode
+        - name: media
+          persistentVolumeClaim:
+            claimName: jellyfin-media
+  volumeClaimTemplates:
+    # Per-pod scratch cache — RWO, disposable, one PVC per replica.
+    - metadata:
+        name: cache
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 30Gi
+        storageClassName: cephrbd-fast-delete
+        volumeMode: Filesystem
@@ -79,7 +79,7 @@ spec:
      cpu: "1"
      memory: 1Gi
    requests:
-      cpu: 50m
+      cpu: 250m
      memory: 512Mi
  smartShutdownTimeout: 180
  startDelay: 3600
@@ -8,4 +8,3 @@ resources:
  - vmagent.yaml
  - gateway.yaml
  - httproute.yaml
-  - vmpodscrape-cnpg.yaml
@@ -16,7 +16,7 @@ spec:
    - url: http://vminsert-main.observability.svc.cluster.local:8480/insert/0/prometheus/
  resources:
    requests:
-      cpu: 250m
+      cpu: 500m
      memory: 512Mi
    limits:
      cpu: "1"
@@ -99,10 +99,6 @@ spec:
      consul_sd_configs:
        - server: consul.service.consul:443
          scheme: https
-          # Set datacenter explicitly so VM does not call /v1/agent/self
-          # (which needs agent:read that the anonymous token lacks); catalog
-          # and health reads work anonymously.
-          datacenter: au-syd1
          tls_config:
            ca_file: /etc/vmagent-tls/ca.crt
      relabel_configs:
@@ -23,7 +23,7 @@ spec:
              storage: 200Gi
    resources:
      requests:
-        cpu: 250m
+        cpu: "1"
        memory: 2Gi
      limits:
        cpu: "2"
@@ -1,17 +0,0 @@
---
-# Scrape metrics (:9187) from every CloudNativePG postgres instance pod in any
-# namespace. Picked up by the observability VMAgent (selectAllByDefault).
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VMPodScrape
-metadata:
-  name: cnpg-clusters
-  namespace: observability
-spec:
-  namespaceSelector:
-    any: true
-  selector:
-    matchLabels:
-      cnpg.io/podRole: instance
-  podMetricsEndpoints:
-    - port: metrics
-      path: /metrics
@@ -79,7 +79,7 @@ spec:
      cpu: 500m
      memory: 512Mi
    requests:
-      cpu: 50m
+      cpu: 250m
      memory: 256Mi
  smartShutdownTimeout: 180
  startDelay: 3600
@@ -100,7 +100,7 @@ spec:
      cpu: 500m
      memory: 512Mi
    requests:
-      cpu: 50m
+      cpu: 250m
      memory: 256Mi
  smartShutdownTimeout: 180
  startDelay: 3600
@@ -47,7 +47,7 @@ spec:
                  cpu: 300m
                  memory: 1Gi
                requests:
-                  cpu: 50m
+                  cpu: 200m
                  memory: 512Mi
              securityContext:
                runAsUser: 0
@@ -148,7 +148,7 @@ spec:
          resources:
            requests:
              memory: 350Mi
-              cpu: 50m
+              cpu: 100m
            limits:
              memory: 1024Mi
              cpu: 500m
@@ -38,8 +38,8 @@ spec:
              cpu: 1
              memory: 1536Mi
            requests:
-              cpu: 50m
-              memory: 768Mi
+              cpu: 250m
+              memory: 512Mi
          ports:
            - containerPort: 8080
              name: pdb-http
@@ -34,7 +34,7 @@ spec:
            cpu: 2
            memory: 3072Mi
          requests:
-            cpu: 200m
+            cpu: 500m
            memory: 1024Mi
        ports:
        - containerPort: 8140
@@ -38,7 +38,7 @@ spec:
              cpu: 2
              memory: 3500Mi
            requests:
-              cpu: 100m
+              cpu: 250m
              memory: 1024Mi
          ports:
            - containerPort: 8140
@@ -83,7 +83,7 @@ server:
      cpu: "2"
      memory: 2Gi
    requests:
-      cpu: 50m
+      cpu: 250m
      memory: 512Mi

 worker:
@@ -95,7 +95,7 @@ worker:
      cpu: "2"
      memory: 2Gi
    requests:
-      cpu: 100m
+      cpu: 250m
      memory: 512Mi

 postgresql:
@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

 resources:
-  - tsig-api.yaml
+  - ../../../base/jellyfin
@@ -2,7 +2,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

-namespace: grafana
-
 resources:
-  - ../../../base/grafana
+  - ../../../base/paperclip
@@ -15,7 +15,7 @@ agent:
    reloader.stakater.com/auto: "true"
  resources:
    requests:
-      cpu: 50m
+      cpu: 100m
    limits:
      memory: 128Mi

@@ -4,6 +4,7 @@ kind: Kustomization

 resources:
  - aitooling.yaml
+  - media.yaml
  - observability.yaml
  - platform.yaml
  - storage.yaml
@@ -0,0 +1,31 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: media-apps
+  namespace: argocd
+spec:
+  generators:
+  - git:
+      repoURL: https://git.unkin.net/unkin/argocd-apps
+      revision: HEAD
+      directories:
+      - path: apps/overlays/*/jellyfin
+  template:
+    metadata:
+      name: 'media-{{path[3]}}'
+    spec:
+      project: media
+      source:
+        repoURL: https://git.unkin.net/unkin/argocd-apps
+        targetRevision: HEAD
+        path: '{{path}}'
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: '{{path[3]}}'
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+        - ServerSideApply=true
@@ -11,7 +11,6 @@ spec:
      revision: HEAD
      directories:
      - path: apps/overlays/*/observability
-      - path: apps/overlays/*/grafana
  template:
    metadata:
      name: 'observability-{{path[3]}}'
@@ -4,6 +4,7 @@ kind: Kustomization

 resources:
  - aitooling.yaml
+  - media.yaml
  - observability.yaml
  - platform.yaml
  - storage.yaml
@@ -0,0 +1,19 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: media
+  namespace: argocd
+spec:
+  description: Media services
+  sourceRepos:
+    - https://git.unkin.net/unkin/argocd-apps
+  destinations:
+    - namespace: 'jellyfin'
+      server: https://kubernetes.default.svc
+  clusterResourceWhitelist:
+    - group: ''
+      kind: Namespace
+  namespaceResourceWhitelist:
+    - group: '*'
+      kind: '*'
@@ -11,8 +11,6 @@ spec:
  destinations:
    - namespace: 'observability'
      server: https://kubernetes.default.svc
-    - namespace: 'grafana'
-      server: https://kubernetes.default.svc
  clusterResourceWhitelist:
    - group: ''
      kind: Namespace
@@ -1,207 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "properties": {
-    "apiVersion": {
-      "type": "string"
-    },
-    "kind": {
-      "type": "string"
-    },
-    "metadata": {
-      "type": "object"
-    },
-    "spec": {
-      "properties": {
-        "env": {
-          "additionalProperties": {
-            "type": "string"
-          },
-          "type": "object"
-        },
-        "image": {
-          "default": "git.unkin.net/unkin/bind-tsig-api:latest",
-          "type": "string"
-        },
-        "imagePullPolicy": {
-          "type": "string"
-        },
-        "port": {
-          "default": 8443,
-          "format": "int32",
-          "type": "integer"
-        },
-        "replicas": {
-          "default": 1,
-          "format": "int32",
-          "type": "integer"
-        },
-        "resources": {
-          "properties": {
-            "claims": {
-              "items": {
-                "properties": {
-                  "name": {
-                    "type": "string"
-                  },
-                  "request": {
-                    "type": "string"
-                  }
-                },
-                "required": [
-                  "name"
-                ],
-                "type": "object"
-              },
-              "type": "array",
-              "x-kubernetes-list-map-keys": [
-                "name"
-              ],
-              "x-kubernetes-list-type": "map"
-            },
-            "limits": {
-              "additionalProperties": {
-                "anyOf": [
-                  {
-                    "type": "integer"
-                  },
-                  {
-                    "type": "string"
-                  }
-                ],
-                "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                "x-kubernetes-int-or-string": true
-              },
-              "type": "object"
-            },
-            "requests": {
-              "additionalProperties": {
-                "anyOf": [
-                  {
-                    "type": "integer"
-                  },
-                  {
-                    "type": "string"
-                  }
-                ],
-                "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                "x-kubernetes-int-or-string": true
-              },
-              "type": "object"
-            }
-          },
-          "type": "object"
-        },
-        "service": {
-          "properties": {
-            "annotations": {
-              "additionalProperties": {
-                "type": "string"
-              },
-              "type": "object"
-            },
-            "externalTrafficPolicy": {
-              "enum": [
-                "Cluster",
-                "Local"
-              ],
-              "type": "string"
-            },
-            "loadBalancerIP": {
-              "type": "string"
-            },
-            "type": {
-              "enum": [
-                "ClusterIP",
-                "LoadBalancer",
-                "NodePort"
-              ],
-              "type": "string"
-            }
-          },
-          "type": "object"
-        },
-        "targetNamespace": {
-          "type": "string"
-        },
-        "tokenSecretName": {
-          "type": "string"
-        }
-      },
-      "type": "object"
-    },
-    "status": {
-      "properties": {
-        "conditions": {
-          "items": {
-            "properties": {
-              "lastTransitionTime": {
-                "format": "date-time",
-                "type": "string"
-              },
-              "message": {
-                "maxLength": 32768,
-                "type": "string"
-              },
-              "observedGeneration": {
-                "format": "int64",
-                "minimum": 0,
-                "type": "integer"
-              },
-              "reason": {
-                "maxLength": 1024,
-                "minLength": 1,
-                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
-                "type": "string"
-              },
-              "status": {
-                "enum": [
-                  "True",
-                  "False",
-                  "Unknown"
-                ],
-                "type": "string"
-              },
-              "type": {
-                "maxLength": 316,
-                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
-                "type": "string"
-              }
-            },
-            "required": [
-              "lastTransitionTime",
-              "message",
-              "reason",
-              "status",
-              "type"
-            ],
-            "type": "object"
-          },
-          "type": "array",
-          "x-kubernetes-list-map-keys": [
-            "type"
-          ],
-          "x-kubernetes-list-type": "map"
-        },
-        "endpoint": {
-          "type": "string"
-        },
-        "observedGeneration": {
-          "format": "int64",
-          "type": "integer"
-        },
-        "phase": {
-          "type": "string"
-        },
-        "readyReplicas": {
-          "format": "int32",
-          "type": "integer"
-        },
-        "tokenSecret": {
-          "type": "string"
-        }
-      },
-      "type": "object"
-    }
-  },
-  "type": "object"
-}