arrstack: repoint arrproxy oauth2-proxy image off ghcr

ghcr.io/oauth2-proxy/oauth2-proxy does not permit anonymous pulls (its
ghcr token endpoint returns DENIED), so artifactapi's anon-only ghcr
remote returns 401 and the sidecar is stuck in ImagePullBackOff. valkey-io
and other ghcr images work because they issue anon tokens.

Repoint the oauth2-proxy sidecar to the docker-internal local registry,
where the multi-arch v7.15.3 image (mirrored from quay.io, identical
digest sha256:10a11657...) is anon-pullable, restoring the arrproxy front
door.

apps/base/arrstack/arrproxy/api-deployment.yaml

@@ -0,0 +1,136 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: arrproxy-api
+  namespace: arrstack
+  annotations:
+    # Wave 2: serve only after the wave-1 migrate Job completes.
+    argocd.argoproj.io/sync-wave: "2"
+    secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-db-app,sonarr-apikey,radarr-apikey,prowlarr-apikey"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: arrproxy-api
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: arrproxy-api
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: api
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.1.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8080
+              name: http
+              protocol: TCP
+          env:
+            - name: ARRPROXY_ADDR
+              value: ":8080"
+            # oauth2-proxy --pass-user-headers forwards identity to the upstream as
+            # X-Forwarded-{User,Email,Groups} (a single comma-joined Groups value).
+            # Email/User already match the api defaults; override the groups header
+            # (default X-Auth-Request-Groups is auth_request-response-only and never
+            # reaches this upstream) so group-based authorization works.
+            - name: ARRPROXY_GROUPS_HEADER
+              value: X-Forwarded-Groups
+            # Real per-app *arr keys, projected one file per app under this dir
+            # (sourced from the existing <app>-apikey Secrets). The api injects
+            # them server-side and redacts them from every proxied response.
+            - name: ARRPROXY_KEYS_DIR
+              value: /etc/arrproxy/keys
+            - name: ARRPROXY_PEPPER
+              valueFrom:
+                secretKeyRef:
+                  name: arrproxy-pepper
+                  key: pepper
+            # DSN assembled from the CNPG-generated arrproxy-db-app Secret;
+            # $(VAR) expansion resolves the two env entries defined above it.
+            - name: ARRPROXY_DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: arrproxy-db-app
+                  key: username
+            - name: ARRPROXY_DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: arrproxy-db-app
+                  key: password
+            - name: DATABASE_URL
+              value: "postgres://$(ARRPROXY_DB_USER):$(ARRPROXY_DB_PASSWORD)@arrproxy-db-rw.arrstack.svc.cluster.local:5432/arrproxy?sslmode=require"
+          volumeMounts:
+            - name: arr-keys
+              mountPath: /etc/arrproxy/keys
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+          livenessProbe:
+            httpGet:
+              path: /livez
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: "1"
+              memory: 512Mi
+      volumes:
+        # Real *arr API keys, one file per app named exactly <app> so the api
+        # reads /etc/arrproxy/keys/{sonarr,radarr,prowlarr}. Reuses the same
+        # <app>-apikey Secrets the *arr Deployments already consume.
+        - name: arr-keys
+          projected:
+            sources:
+              - secret:
+                  name: sonarr-apikey
+                  items:
+                    - key: apitoken
+                      path: sonarr
+              - secret:
+                  name: radarr-apikey
+                  items:
+                    - key: apitoken
+                      path: radarr
+              - secret:
+                  name: prowlarr-apikey
+                  items:
+                    - key: apitoken
+                      path: prowlarr
+        - name: tmp
+          emptyDir:
+            sizeLimit: 64Mi
+      restartPolicy: Always

apps/base/arrstack/arrproxy/cnpg_backup.yaml

@@ -0,0 +1,51 @@
+---
+# Ceph RGW (S3) backup target for the arrproxy token-store CNPG cluster,
+# provisioned by the in-estate cephrgw-operator. One dedicated bucket + owner
+# user per cluster.
+apiVersion: ceph.unkin.net/v1alpha1
+kind: ObjectStoreUser
+metadata:
+  name: cnpg-arrproxy-backup
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  displayName: "CNPG backup owner (arrproxy)"
+  uid: cnpg-arrproxy-backup
+  maxBuckets: 5
+  secretName: cnpg-arrproxy-backup-s3
+  retainOnDelete: true
+---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: cnpg-arrproxy
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  placementTarget: ec
+  bucketName: cnpg-arrproxy
+  ownerRef: cnpg-arrproxy-backup
+  versioning: false
+  tags:
+    app: arrproxy
+    purpose: cnpg-backup
+  retainOnDelete: true
+---
+# Nightly base backup; continuous WAL archiving is always-on via the Cluster's
+# spec.backup.barmanObjectStore. Staggered off other clusters' schedules.
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: cnpg-arrproxy-nightly
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  schedule: "0 20 2 * * *"
+  immediate: false
+  backupOwnerReference: self
+  method: barmanObjectStore
+  cluster:
+    name: arrproxy-db

apps/base/arrstack/arrproxy/cnpg_cluster.yaml

@@ -0,0 +1,117 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: arrproxy-db
+  namespace: arrstack
+  annotations:
+    # Wave 0: DB (and the generated arrproxy-db-app Secret) must be Healthy before
+    # the wave-1 migrate Job runs. ArgoCD gates on the Cluster's health status.
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  affinity:
+    podAntiAffinityType: preferred
+  backup:
+    retentionPolicy: 30d
+    barmanObjectStore:
+      destinationPath: s3://cnpg-arrproxy
+      endpointURL: https://s3.ceph.unkin.net
+      endpointCA:
+        name: vault-ca-cert
+        key: ca.crt
+      s3Credentials:
+        accessKeyId:
+          name: cnpg-arrproxy-backup-s3
+          key: AWS_ACCESS_KEY_ID
+        secretAccessKey:
+          name: cnpg-arrproxy-backup-s3
+          key: AWS_SECRET_ACCESS_KEY
+      serverName: arrproxy
+      data:
+        compression: bzip2
+        jobs: 2
+      wal:
+        compression: zstd
+        maxParallel: 2
+  bootstrap:
+    initdb:
+      # No secret ref: CNPG mints the owner credentials and publishes them in the
+      # generated "arrproxy-db-app" Secret, which the api reads to build the DSN.
+      database: arrproxy
+      encoding: UTF8
+      localeCType: C
+      localeCollate: C
+      owner: arrproxy
+  enablePDB: true
+  enableSuperuserAccess: false
+  failoverDelay: 0
+  imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
+  instances: 2
+  logLevel: info
+  maxSyncReplicas: 0
+  minSyncReplicas: 0
+  monitoring:
+    customQueriesConfigMap:
+      - key: queries
+        name: cnpg-default-monitoring
+    disableDefaultQueries: false
+    enablePodMonitor: false
+  postgresql:
+    parameters:
+      archive_mode: "on"
+      archive_timeout: 5min
+      dynamic_shared_memory_type: posix
+      effective_cache_size: 256MB
+      full_page_writes: "on"
+      log_destination: csvlog
+      log_directory: /controller/log
+      log_filename: postgres
+      log_rotation_age: "0"
+      log_rotation_size: "0"
+      log_truncate_on_rotation: "false"
+      logging_collector: "on"
+      max_connections: "200"
+      max_parallel_workers: "16"
+      max_replication_slots: "16"
+      max_worker_processes: "16"
+      shared_buffers: 128MB
+      shared_memory_type: mmap
+      ssl_max_protocol_version: TLSv1.3
+      ssl_min_protocol_version: TLSv1.3
+      wal_keep_size: 256MB
+      wal_level: logical
+      wal_log_hints: "on"
+      wal_receiver_timeout: 5s
+      wal_sender_timeout: 5s
+    syncReplicaElectionConstraint:
+      enabled: false
+  primaryUpdateMethod: restart
+  primaryUpdateStrategy: unsupervised
+  probes:
+    liveness:
+      isolationCheck:
+        connectionTimeout: 1000
+        enabled: true
+        requestTimeout: 1000
+  replicationSlots:
+    highAvailability:
+      enabled: true
+      slotPrefix: _cnpg_
+    synchronizeReplicas:
+      enabled: true
+    updateInterval: 30
+  resources:
+    limits:
+      cpu: 500m
+      memory: 512Mi
+    requests:
+      cpu: 50m
+      memory: 256Mi
+  smartShutdownTimeout: 180
+  startDelay: 3600
+  stopDelay: 1800
+  storage:
+    resizeInUseVolumes: true
+    size: 10Gi
+    storageClass: cephrbd-fast-delete
+  switchoverDelay: 3600

apps/base/arrstack/arrproxy/gateway.yaml

@@ -0,0 +1,41 @@
+---
+# External (DMZ) front for the arrstack, served on arrstack.unkin.net via the
+# external Traefik (LB VIP 198.18.199.0). cert-manager mints arrproxy-gateway-tls
+# (CN arrstack.unkin.net) off the internal Vault-PKI CA. The apex arrstack.unkin.net
+# A record lives in the bind-operator unkin.net zone (bind-internal/authoritative),
+# NOT external-dns, so no external-dns annotation here.
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: external
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: arrstack.unkin.net
+    cert-manager.io/private-key-size: "4096"
+  name: arrproxy
+  namespace: arrstack
+spec:
+  gatewayClassName: traefik-external
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: arrstack.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: arrstack.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: arrproxy-gateway-tls

apps/base/arrstack/arrproxy/httproute.yaml

@@ -0,0 +1,58 @@
+---
+# Redirect plain HTTP to HTTPS.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: arrproxy-http-redirect
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  hostnames:
+    - arrstack.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: arrproxy
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+# All HTTPS traffic enters via oauth2-proxy (the arrproxy entry Service), which
+# authenticates and path-routes to arrproxy-ui / arrproxy-api. The UI-vs-api and
+# the /<app>/api oauth-bypass split is done inside oauth2-proxy (upstreams +
+# skip-auth-regex), so a single backend here is sufficient.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: arrproxy-route
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  hostnames:
+    - arrstack.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: arrproxy
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: arrproxy
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/arrstack/arrproxy/kustomization.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - cnpg_cluster.yaml
+  - cnpg_backup.yaml
+  - migrations-configmap.yaml
+  - migrate-job.yaml
+  - vaultstaticsecret.yaml
+  - oauth2-proxy-configmap.yaml
+  - oauth2-proxy-deployment.yaml
+  - api-deployment.yaml
+  - ui-deployment.yaml
+  - services.yaml
+  - gateway.yaml
+  - httproute.yaml

apps/base/arrstack/arrproxy/migrate-job.yaml

@@ -0,0 +1,92 @@
+---
+# Applies the arrproxy schema once per sync, before the api rolls, so the serve
+# replicas never race migrations (arrproxy-api does not self-migrate). Runs as the
+# CNPG-minted app user so the tokens table is owned by that role.
+#
+# Sync-phase hook at wave 1 (NOT PreSync): the CNPG Cluster + generated
+# arrproxy-db-app Secret apply at wave 0 and ArgoCD waits for the Cluster to be
+# Healthy before starting wave 1, so Postgres exists before migrate connects.
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: arrproxy-migrate
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  backoffLimit: 6
+  ttlSecondsAfterFinished: 600
+  template:
+    metadata:
+      labels:
+        app: arrproxy-migrate
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: migrate
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:18-alpine
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: HOME
+              value: /tmp
+            - name: PGUSER
+              valueFrom:
+                secretKeyRef:
+                  name: arrproxy-db-app
+                  key: username
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: arrproxy-db-app
+                  key: password
+            - name: PGHOST
+              value: arrproxy-db-rw.arrstack.svc.cluster.local
+            - name: PGPORT
+              value: "5432"
+            - name: PGDATABASE
+              value: arrproxy
+            - name: PGSSLMODE
+              value: require
+          command:
+            - psql
+            - -v
+            - ON_ERROR_STOP=1
+            - -f
+            - /migrations/0001_init.sql
+          volumeMounts:
+            - name: migrations
+              mountPath: /migrations
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+      volumes:
+        - name: migrations
+          configMap:
+            name: arrproxy-migrations
+        - name: tmp
+          emptyDir:
+            sizeLimit: 64Mi

apps/base/arrstack/arrproxy/migrations-configmap.yaml

@@ -0,0 +1,29 @@
+---
+# arrproxy schema, mirrored from the arrproxy repo migrations/0001_init.sql
+# (v0.1.0). arrproxy-api does NOT self-migrate, so the wave-1 migrate Job applies
+# this once per sync as the app user. Keep in sync with the repo on schema bumps.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: arrproxy-migrations
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+data:
+  0001_init.sql: |
+    -- arrproxy token store. Only token hashes are persisted; plaintext is shown
+    -- once at mint time and never recoverable.
+    CREATE TABLE IF NOT EXISTS tokens (
+        id           TEXT PRIMARY KEY,
+        subject      TEXT        NOT NULL,
+        label        TEXT        NOT NULL DEFAULT '',
+        token_hash   TEXT        NOT NULL UNIQUE,
+        apps         TEXT[]      NOT NULL DEFAULT '{}',
+        created_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
+        expires_at   TIMESTAMPTZ,
+        disabled     BOOLEAN     NOT NULL DEFAULT false,
+        last_used_at TIMESTAMPTZ
+    );
+
+    CREATE INDEX IF NOT EXISTS tokens_subject_idx ON tokens (subject);
+    CREATE INDEX IF NOT EXISTS tokens_token_hash_idx ON tokens (token_hash);

apps/base/arrstack/arrproxy/oauth2-proxy-configmap.yaml

@@ -0,0 +1,46 @@
+---
+# Non-secret oauth2-proxy configuration (client_id/secret/cookie_secret come from
+# the oauth-credentials Secret). oauth2-proxy is the single auth front for the
+# arrstack: it authenticates the UI and the token API against Authentik, and path-
+# routes to the arrproxy-ui / arrproxy-api upstreams. /<app>/api is exempted from
+# auth (SKIP_AUTH_REGEX) so *arr clients presenting a per-user token reach the api
+# directly; the api then validates the token. Everything else requires the oauth
+# session and receives identity via X-Forwarded-* / X-Auth-Request-* headers.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: arrproxy-oauth2-env
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+data:
+  OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
+  OAUTH2_PROXY_PROVIDER: "oidc"
+  # Authentik arrstack app discovery issuer (served by the internal unkin.net CA;
+  # trusted via PROVIDER_CA_FILES below). CONFIRM the slug matches the Authentik
+  # application (terraform-authentik PR #18).
+  OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/arrstack/"
+  OAUTH2_PROXY_REDIRECT_URL: "https://arrstack.unkin.net/oauth2/callback"
+  # Longest-prefix wins: /api and /<app> go to arrproxy-api, everything else
+  # (the SPA + static assets) to arrproxy-ui.
+  OAUTH2_PROXY_UPSTREAMS: "http://arrproxy-ui.arrstack.svc.cluster.local:8080/,http://arrproxy-api.arrstack.svc.cluster.local:8080/api/,http://arrproxy-api.arrstack.svc.cluster.local:8080/sonarr/,http://arrproxy-api.arrstack.svc.cluster.local:8080/radarr/,http://arrproxy-api.arrstack.svc.cluster.local:8080/prowlarr/"
+  OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
+  # Populate session.Groups from the Authentik ak_groups claim; pass-user-headers
+  # then emits it as a single comma-joined X-Forwarded-Groups header.
+  OAUTH2_PROXY_OIDC_GROUPS_CLAIM: "ak_groups"
+  # Forward identity + groups to arrproxy-api as X-Forwarded-{User,Email,Groups}
+  # (the api reads these; ARRPROXY_GROUPS_HEADER=X-Forwarded-Groups). NOTE:
+  # set-xauthrequest is intentionally NOT set -- it only populates auth_request
+  # *response* headers, which never reach an --upstreams-proxied backend.
+  OAUTH2_PROXY_PASS_USER_HEADERS: "true"
+  # Bypass auth ONLY for the *arr proxy API (/<app>/api...): this matches
+  # /sonarr/api but NOT /api/tokens or /api/me (which stay authenticated).
+  OAUTH2_PROXY_SKIP_AUTH_REGEX: "^/[^/]+/api"
+  OAUTH2_PROXY_EMAIL_DOMAINS: "*"
+  OAUTH2_PROXY_COOKIE_SECURE: "true"
+  OAUTH2_PROXY_COOKIE_DOMAINS: "arrstack.unkin.net"
+  OAUTH2_PROXY_WHITELIST_DOMAINS: "arrstack.unkin.net"
+  OAUTH2_PROXY_REVERSE_PROXY: "true"
+  OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt"
+  OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256"
+  OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"

apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml

@@ -0,0 +1,133 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: arrproxy-oauth2
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+    configmap.reloader.stakater.com/auto: "true"
+    secret.reloader.stakater.com/reload: "oauth-credentials,vault-ca-cert"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: arrproxy-oauth2
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: arrproxy-oauth2
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        # identity.unkin.net serves a Vault-PKI cert; combine the system roots
+        # with the internal CA so oauth2-proxy's OIDC HTTP client trusts it.
+        - name: combine-certs
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /custom-ca
+              readOnly: true
+            - name: combined-certs
+              mountPath: /combined-certs
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 50m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 64Mi
+      containers:
+        - name: oauth2-proxy
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/oauth2-proxy:v7.15.3
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 4180
+              name: http
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: arrproxy-oauth2-env
+                optional: false
+          env:
+            - name: OAUTH2_PROXY_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_id
+            - name: OAUTH2_PROXY_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_secret
+            - name: OAUTH2_PROXY_COOKIE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: cookie_secret
+          volumeMounts:
+            - name: combined-certs
+              mountPath: /etc/ssl/combined
+              readOnly: true
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: combined-certs
+          emptyDir: {}
+      restartPolicy: Always

apps/base/arrstack/arrproxy/services.yaml

@@ -0,0 +1,59 @@
+---
+# Front-door entry Service: the HTTPRoute for arrstack.unkin.net targets this.
+# All traffic (UI, token API, and the *arr proxy) enters via oauth2-proxy.
+apiVersion: v1
+kind: Service
+metadata:
+  name: arrproxy
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: arrproxy-oauth2
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: arrproxy-api
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 8080
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: arrproxy-api
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: arrproxy-ui
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 8080
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: arrproxy-ui
+  sessionAffinity: None
+  type: ClusterIP

apps/base/arrstack/arrproxy/ui-deployment.yaml

@@ -0,0 +1,72 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: arrproxy-ui
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: arrproxy-ui
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: arrproxy-ui
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: ui
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-ui:v0.1.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8080
+              name: http
+              protocol: TCP
+          env:
+            - name: ARRPROXY_UI_ADDR
+              value: ":8080"
+          livenessProbe:
+            httpGet:
+              path: /livez
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 50m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+      restartPolicy: Always

apps/base/arrstack/arrproxy/vaultstaticsecret.yaml

@@ -0,0 +1,49 @@
+---
+# Per-deployment token-hash pepper. Seeded (openssl rand) at
+# kv/kubernetes/namespace/arrstack/default/arrproxy-pepper (key: pepper); the
+# default k8s role's templated policy already grants read on
+# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
+# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
+# syncs it into the arrproxy-pepper Secret consumed by arrproxy-api as
+# ARRPROXY_PEPPER.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: arrproxy-pepper
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: arrproxy-pepper
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/arrproxy-pepper
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+# Authentik OIDC client for the arrstack front door (client_id, client_secret,
+# cookie_secret), created by terraform-authentik at
+# kv/kubernetes/namespace/arrstack/default/oauth-credentials. VSO syncs it into
+# the oauth-credentials Secret consumed by the oauth2-proxy Deployment.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: oauth-credentials
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: oauth-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/oauth-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/arrstack/kustomization.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - vaultauth.yaml
+  - pv-media-tv.yaml
+  - pv-media-movies.yaml
+  - pvc-media-tv.yaml
+  - pvc-media-movies.yaml
+  - sonarr
+  - radarr
+  - prowlarr
+  - nzbget
+  - arrproxy

apps/base/arrstack/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: arrstack

apps/base/arrstack/nzbget/deployment.yaml

@@ -0,0 +1,137 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nzbget
+  namespace: arrstack
+spec:
+  replicas: 1
+  strategy:
+    # RWO config PVC + single queue state: never run two pods at once.
+    type: Recreate
+  selector:
+    matchLabels:
+      app: nzbget
+  template:
+    metadata:
+      labels:
+        app: nzbget
+    spec:
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+      initContainers:
+        # Seed download layout onto the shared media PVCs (not /config or an
+        # emptyDir) so completed downloads land beside the arr libraries and
+        # imports are same-filesystem hardlink moves. Reuses the image's own
+        # template (inherits correct WebDir/ConfigTemplate) and appends the
+        # path/category overrides once; nzbget honours the last value for a
+        # repeated option, and the grep guard keeps re-runs idempotent so admin
+        # UI edits to the persisted /config/nzbget.conf survive restarts.
+        - name: seed-config
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/nzbget:version-v26.2
+          command:
+            - sh
+            - -c
+            - |
+              set -e
+              if [ ! -f /config/nzbget.conf ]; then
+                cp /app/nzbget/share/nzbget/nzbget.conf /config/nzbget.conf
+              fi
+              if ! grep -q '# arrstack-managed' /config/nzbget.conf; then
+                cat >> /config/nzbget.conf << 'CONF'
+
+              # arrstack-managed download layout (appended once; last value wins).
+              # Downloads land on the shared media PVCs by category so sonarr/radarr
+              # import with atomic hardlink moves (download dir + library share one
+              # filesystem per media type). InterDir is empty: nzbget writes each
+              # download straight into its category DestDir, so BOTH tv and movies
+              # stay on their own PVC with no cross-filesystem intermediate copy.
+              MainDir=/media/tv
+              InterDir=
+              DestDir=/media/tv/downloads
+              NzbDir=/config/nzb
+              QueueDir=/config/queue
+              TempDir=/config/tmp
+              ControlIP=0.0.0.0
+              ControlPort=6789
+              Category1.Name=tv
+              Category1.DestDir=/media/tv/downloads
+              Category2.Name=movies
+              Category2.DestDir=/media/movies/downloads
+              CONF
+              fi
+              mkdir -p /media/tv/series /media/tv/downloads /media/movies/films /media/movies/downloads
+              chown 1000:1000 /config/nzbget.conf \
+                /media/tv /media/tv/series /media/tv/downloads \
+                /media/movies /media/movies/films /media/movies/downloads
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: media-tv
+              mountPath: /media/tv
+            - name: media-movies
+              mountPath: /media/movies
+      containers:
+        - name: nzbget
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/nzbget:version-v26.2
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 6789
+              protocol: TCP
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: TZ
+              value: Australia/Sydney
+          livenessProbe:
+            # nzbget's root path requires auth (401); a TCP check is the
+            # dependency-free liveness signal for the web/JSON-RPC server.
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 200m
+              memory: 256Mi
+            limits:
+              # Headroom for par2 repair + unpack of large downloads.
+              cpu: "2"
+              memory: 2Gi
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: media-tv
+              mountPath: /media/tv
+            - name: media-movies
+              mountPath: /media/movies
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: nzbget-config
+        - name: media-tv
+          persistentVolumeClaim:
+            claimName: media-tv
+        - name: media-movies
+          persistentVolumeClaim:
+            claimName: media-movies

apps/base/arrstack/nzbget/gateway.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: nzbget.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: nzbget.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: nzbget
+  namespace: arrstack
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: nzbget.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: nzbget.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: nzbget-tls
+        mode: Terminate

apps/base/arrstack/nzbget/httproute.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: nzbget-http-redirect
+  namespace: arrstack
+spec:
+  hostnames:
+    - nzbget.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: nzbget
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: nzbget-route
+  namespace: arrstack
+spec:
+  hostnames:
+    - nzbget.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: nzbget
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: nzbget
+          port: 6789
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/arrstack/nzbget/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - pvc-config.yaml
+  - deployment.yaml
+  - service.yaml
+  - gateway.yaml
+  - httproute.yaml

apps/base/arrstack/nzbget/pvc-config.yaml

@@ -0,0 +1,16 @@
+---
+# NZBGet config + queue/temp state. RWO on cephrbd (block). Retain: this is
+# state. The download data itself lives on the shared media PVCs, not here.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nzbget-config
+  namespace: arrstack
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: cephrbd-fast-retain
+  volumeMode: Filesystem

apps/base/arrstack/nzbget/service.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nzbget
+  namespace: arrstack
+spec:
+  ports:
+    - name: http
+      port: 6789
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: nzbget
+  type: ClusterIP

apps/base/arrstack/prowlarr/deployment.yaml

@@ -0,0 +1,115 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: prowlarr
+  namespace: arrstack
+spec:
+  replicas: 1
+  strategy:
+    # RWO config PVC + single stateful SQLite DB: never run two pods at once.
+    type: Recreate
+  selector:
+    matchLabels:
+      app: prowlarr
+  template:
+    metadata:
+      labels:
+        app: prowlarr
+    spec:
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+      initContainers:
+        # Enforce the Vault-sourced API key in /config/config.xml before the app
+        # starts. Vault is source of truth (override bootstrap): the key is minted
+        # in Vault, synced by VSO into the prowlarr-apikey Secret, and written here.
+        # Runs as root to fix ownership; touches only the <ApiKey> element.
+        - name: apikey-init
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/busybox:1.37.0
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            runAsUser: 0
+          env:
+            - name: API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: prowlarr-apikey
+                  key: apitoken
+          command:
+            - sh
+            - -c
+            - |
+              set -eu
+              case "$API_KEY" in
+                "" | *[!0-9a-fA-F]*)
+                  echo "apikey-init: API_KEY missing or not hex; refusing" >&2
+                  exit 1
+                  ;;
+              esac
+              CFG=/config/config.xml
+              if [ ! -f "$CFG" ]; then
+                printf '<Config>\n  <ApiKey>%s</ApiKey>\n</Config>\n' "$API_KEY" > "$CFG"
+              elif grep -q '<ApiKey>' "$CFG"; then
+                sed -i "s|<ApiKey>[^<]*</ApiKey>|<ApiKey>${API_KEY}</ApiKey>|" "$CFG"
+              else
+                sed -i "s|<Config>|<Config>\n  <ApiKey>${API_KEY}</ApiKey>|" "$CFG"
+              fi
+              chown 1000:1000 "$CFG"
+              chmod 600 "$CFG"
+              echo "apikey-init: <ApiKey> enforced from Vault"
+          resources:
+            requests:
+              cpu: 50m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 64Mi
+          volumeMounts:
+            - name: config
+              mountPath: /config
+      containers:
+        - name: prowlarr
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/prowlarr:2.5.2
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 9696
+              protocol: TCP
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: TZ
+              value: Australia/Sydney
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: "1"
+              memory: 512Mi
+          volumeMounts:
+            - name: config
+              mountPath: /config
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: prowlarr-config

apps/base/arrstack/prowlarr/gateway.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: prowlarr.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: prowlarr.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: prowlarr
+  namespace: arrstack
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: prowlarr.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: prowlarr.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: prowlarr-tls
+        mode: Terminate

apps/base/arrstack/prowlarr/httproute.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: prowlarr-http-redirect
+  namespace: arrstack
+spec:
+  hostnames:
+    - prowlarr.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: prowlarr
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: prowlarr-route
+  namespace: arrstack
+spec:
+  hostnames:
+    - prowlarr.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: prowlarr
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: prowlarr
+          port: 9696
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/arrstack/prowlarr/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - pvc-config.yaml
+  - vaultstaticsecret.yaml
+  - deployment.yaml
+  - service.yaml
+  - gateway.yaml
+  - httproute.yaml

apps/base/arrstack/prowlarr/pvc-config.yaml

@@ -0,0 +1,16 @@
+---
+# Prowlarr config + SQLite DB. RWO on cephrbd (block) — the arr apps' SQLite
+# does not tolerate CephFS locking. Retain: this is state.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: prowlarr-config
+  namespace: arrstack
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: cephrbd-fast-retain
+  volumeMode: Filesystem

apps/base/arrstack/prowlarr/service.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: prowlarr
+  namespace: arrstack
+spec:
+  ports:
+    - name: http
+      port: 9696
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: prowlarr
+  type: ClusterIP

apps/base/arrstack/prowlarr/vaultstaticsecret.yaml

@@ -0,0 +1,25 @@
+---
+# prowlarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/prowlarr
+# (key: apitoken); the default k8s role's templated policy already grants read
+# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
+# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
+# syncs it into the prowlarr-apikey Secret that the apikey-init initContainer reads
+# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: prowlarr-apikey
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: prowlarr-apikey
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/prowlarr
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/arrstack/pv-media-movies.yaml

@@ -0,0 +1,31 @@
+---
+# Static PV for the shared MOVIES CephFS subvolume. Same rootPath as jellyfin's
+# movies PV so radarr/nzbget write and jellyfin reads the identical library
+# tree; each namespace gets its own PV (unique name + volumeHandle) pinned by
+# claimRef.
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: arrstack-media-movies
+spec:
+  capacity:
+    storage: 1Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  volumeMode: Filesystem
+  claimRef:
+    namespace: arrstack
+    name: media-movies
+  csi:
+    driver: cephfs.csi.ceph.com
+    volumeHandle: arrstack-media-movies-static
+    nodeStageSecretRef:
+      name: csi-cephfs-secret
+      namespace: csi-cephfs
+    volumeAttributes:
+      staticVolume: "true"
+      clusterID: cephfs_csi_ssd_ec_4_1
+      fsName: cephfs
+      rootPath: /volumes/csi_ssd_ec_4_1/media-movies/e95d8ace-c736-465a-acc3-0c3e46dcede9

apps/base/arrstack/pv-media-tv.yaml

@@ -0,0 +1,30 @@
+---
+# Static PV for the shared TV CephFS subvolume. Same rootPath as jellyfin's TV
+# PV so sonarr/nzbget write and jellyfin reads the identical library tree; each
+# namespace gets its own PV (unique name + volumeHandle) pinned by claimRef.
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: arrstack-media-tv
+spec:
+  capacity:
+    storage: 1Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  volumeMode: Filesystem
+  claimRef:
+    namespace: arrstack
+    name: media-tv
+  csi:
+    driver: cephfs.csi.ceph.com
+    volumeHandle: arrstack-media-tv-static
+    nodeStageSecretRef:
+      name: csi-cephfs-secret
+      namespace: csi-cephfs
+    volumeAttributes:
+      staticVolume: "true"
+      clusterID: cephfs_csi_ssd_ec_4_1
+      fsName: cephfs
+      rootPath: /volumes/csi_ssd_ec_4_1/media-tv/4692957d-f5df-4f72-b9c9-56e4ee6d1333

apps/base/arrstack/pvc-media-movies.yaml

@@ -0,0 +1,22 @@
+---
+# Movies library + downloads, shared RWX across radarr and nzbget. Statically
+# bound to the arrstack-media-movies PV (same CephFS subvolume jellyfin mounts
+# read-only). storageClassName "" + volumeName disables dynamic provisioning and
+# binds the pre-created static PV. Downloads and library live on one filesystem
+# so import is an atomic hardlink move.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: media-movies
+  namespace: arrstack
+  annotations:
+    k8up.io/backup: "false"
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Ti
+  storageClassName: ""
+  volumeName: arrstack-media-movies
+  volumeMode: Filesystem

apps/base/arrstack/pvc-media-tv.yaml

@@ -0,0 +1,22 @@
+---
+# TV library + downloads, shared RWX across sonarr and nzbget. Statically bound
+# to the arrstack-media-tv PV (same CephFS subvolume jellyfin mounts read-only).
+# storageClassName "" + volumeName disables dynamic provisioning and binds the
+# pre-created static PV. Downloads and library live on one filesystem so import
+# is an atomic hardlink move.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: media-tv
+  namespace: arrstack
+  annotations:
+    k8up.io/backup: "false"
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Ti
+  storageClassName: ""
+  volumeName: arrstack-media-tv
+  volumeMode: Filesystem

apps/base/arrstack/radarr/deployment.yaml

@@ -0,0 +1,120 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: radarr
+  namespace: arrstack
+spec:
+  replicas: 1
+  strategy:
+    # RWO config PVC + single stateful SQLite DB: never run two pods at once.
+    type: Recreate
+  selector:
+    matchLabels:
+      app: radarr
+  template:
+    metadata:
+      labels:
+        app: radarr
+    spec:
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+      initContainers:
+        # Enforce the Vault-sourced API key in /config/config.xml before the app
+        # starts. Vault is source of truth (override bootstrap): the key is minted
+        # in Vault, synced by VSO into the radarr-apikey Secret, and written here.
+        # Runs as root to fix ownership; touches only the <ApiKey> element.
+        - name: apikey-init
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/busybox:1.37.0
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            runAsUser: 0
+          env:
+            - name: API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: radarr-apikey
+                  key: apitoken
+          command:
+            - sh
+            - -c
+            - |
+              set -eu
+              case "$API_KEY" in
+                "" | *[!0-9a-fA-F]*)
+                  echo "apikey-init: API_KEY missing or not hex; refusing" >&2
+                  exit 1
+                  ;;
+              esac
+              CFG=/config/config.xml
+              if [ ! -f "$CFG" ]; then
+                printf '<Config>\n  <ApiKey>%s</ApiKey>\n</Config>\n' "$API_KEY" > "$CFG"
+              elif grep -q '<ApiKey>' "$CFG"; then
+                sed -i "s|<ApiKey>[^<]*</ApiKey>|<ApiKey>${API_KEY}</ApiKey>|" "$CFG"
+              else
+                sed -i "s|<Config>|<Config>\n  <ApiKey>${API_KEY}</ApiKey>|" "$CFG"
+              fi
+              chown 1000:1000 "$CFG"
+              chmod 600 "$CFG"
+              echo "apikey-init: <ApiKey> enforced from Vault"
+          resources:
+            requests:
+              cpu: 50m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 64Mi
+          volumeMounts:
+            - name: config
+              mountPath: /config
+      containers:
+        - name: radarr
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/radarr:6.3.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 7878
+              protocol: TCP
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: TZ
+              value: Australia/Sydney
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: "1"
+              memory: 1Gi
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: media-movies
+              mountPath: /media/movies
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: radarr-config
+        - name: media-movies
+          persistentVolumeClaim:
+            claimName: media-movies

apps/base/arrstack/radarr/gateway.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: radarr.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: radarr.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: radarr
+  namespace: arrstack
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: radarr.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: radarr.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: radarr-tls
+        mode: Terminate

apps/base/arrstack/radarr/httproute.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: radarr-http-redirect
+  namespace: arrstack
+spec:
+  hostnames:
+    - radarr.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: radarr
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: radarr-route
+  namespace: arrstack
+spec:
+  hostnames:
+    - radarr.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: radarr
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: radarr
+          port: 7878
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/arrstack/radarr/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - pvc-config.yaml
+  - vaultstaticsecret.yaml
+  - deployment.yaml
+  - service.yaml
+  - gateway.yaml
+  - httproute.yaml

apps/base/arrstack/radarr/pvc-config.yaml

@@ -0,0 +1,16 @@
+---
+# Radarr config + SQLite DB. RWO on cephrbd (block) — the arr apps' SQLite
+# does not tolerate CephFS locking. Retain: this is state.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: radarr-config
+  namespace: arrstack
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: cephrbd-fast-retain
+  volumeMode: Filesystem

apps/base/arrstack/radarr/service.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: radarr
+  namespace: arrstack
+spec:
+  ports:
+    - name: http
+      port: 7878
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: radarr
+  type: ClusterIP

apps/base/arrstack/radarr/vaultstaticsecret.yaml

@@ -0,0 +1,25 @@
+---
+# radarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/radarr
+# (key: apitoken); the default k8s role's templated policy already grants read
+# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
+# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
+# syncs it into the radarr-apikey Secret that the apikey-init initContainer reads
+# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: radarr-apikey
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: radarr-apikey
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/radarr
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/arrstack/sonarr/deployment.yaml

@@ -0,0 +1,123 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sonarr
+  namespace: arrstack
+spec:
+  replicas: 1
+  strategy:
+    # RWO config PVC + single stateful SQLite DB: never run two pods at once.
+    type: Recreate
+  selector:
+    matchLabels:
+      app: sonarr
+  template:
+    metadata:
+      labels:
+        app: sonarr
+    spec:
+      securityContext:
+        # LinuxServer images init as root via s6 then step down to PUID/PGID.
+        # fsGroup makes the shared CephFS group-writable for that user;
+        # OnRootMismatch avoids a recursive chown of the whole media tree.
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+      initContainers:
+        # Enforce the Vault-sourced API key in /config/config.xml before the app
+        # starts. Vault is source of truth (override bootstrap): the key is minted
+        # in Vault, synced by VSO into the sonarr-apikey Secret, and written here.
+        # Runs as root to fix ownership; touches only the <ApiKey> element.
+        - name: apikey-init
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/busybox:1.37.0
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            runAsUser: 0
+          env:
+            - name: API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: sonarr-apikey
+                  key: apitoken
+          command:
+            - sh
+            - -c
+            - |
+              set -eu
+              case "$API_KEY" in
+                "" | *[!0-9a-fA-F]*)
+                  echo "apikey-init: API_KEY missing or not hex; refusing" >&2
+                  exit 1
+                  ;;
+              esac
+              CFG=/config/config.xml
+              if [ ! -f "$CFG" ]; then
+                printf '<Config>\n  <ApiKey>%s</ApiKey>\n</Config>\n' "$API_KEY" > "$CFG"
+              elif grep -q '<ApiKey>' "$CFG"; then
+                sed -i "s|<ApiKey>[^<]*</ApiKey>|<ApiKey>${API_KEY}</ApiKey>|" "$CFG"
+              else
+                sed -i "s|<Config>|<Config>\n  <ApiKey>${API_KEY}</ApiKey>|" "$CFG"
+              fi
+              chown 1000:1000 "$CFG"
+              chmod 600 "$CFG"
+              echo "apikey-init: <ApiKey> enforced from Vault"
+          resources:
+            requests:
+              cpu: 50m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 64Mi
+          volumeMounts:
+            - name: config
+              mountPath: /config
+      containers:
+        - name: sonarr
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/sonarr:4.0.19
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8989
+              protocol: TCP
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: TZ
+              value: Australia/Sydney
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: "1"
+              memory: 1Gi
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: media-tv
+              mountPath: /media/tv
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: sonarr-config
+        - name: media-tv
+          persistentVolumeClaim:
+            claimName: media-tv

apps/base/arrstack/sonarr/gateway.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: sonarr.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: sonarr.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: sonarr
+  namespace: arrstack
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: sonarr.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: sonarr.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: sonarr-tls
+        mode: Terminate

apps/base/arrstack/sonarr/httproute.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: sonarr-http-redirect
+  namespace: arrstack
+spec:
+  hostnames:
+    - sonarr.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: sonarr
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: sonarr-route
+  namespace: arrstack
+spec:
+  hostnames:
+    - sonarr.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: sonarr
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: sonarr
+          port: 8989
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/arrstack/sonarr/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - pvc-config.yaml
+  - vaultstaticsecret.yaml
+  - deployment.yaml
+  - service.yaml
+  - gateway.yaml
+  - httproute.yaml

apps/base/arrstack/sonarr/pvc-config.yaml

@@ -0,0 +1,16 @@
+---
+# Sonarr config + SQLite DB. RWO on cephrbd (block) — the arr apps' SQLite
+# does not tolerate CephFS locking. Retain: this is state.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sonarr-config
+  namespace: arrstack
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: cephrbd-fast-retain
+  volumeMode: Filesystem

apps/base/arrstack/sonarr/service.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: sonarr
+  namespace: arrstack
+spec:
+  ports:
+    - name: http
+      port: 8989
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: sonarr
+  type: ClusterIP

apps/base/arrstack/sonarr/vaultstaticsecret.yaml

@@ -0,0 +1,25 @@
+---
+# sonarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/sonarr
+# (key: apitoken); the default k8s role's templated policy already grants read
+# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
+# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
+# syncs it into the sonarr-apikey Secret that the apikey-init initContainer reads
+# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: sonarr-apikey
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: sonarr-apikey
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/sonarr
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/arrstack/vaultauth.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  allowedNamespaces:
+    - arrstack
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default

apps/base/artifactapi/api-deployment.yaml

@@ -36,7 +36,7 @@ spec:
               mountPath: /combined-certs
       containers:
         - name: api
-          image: git.unkin.net/unkin/artifactapi:v3.7.7
+          image: git.unkin.net/unkin/artifactapi:v3.11.1
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000

apps/base/artifactapi/ui-deployment.yaml

@@ -22,7 +22,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: ui
-          image: git.unkin.net/unkin/artifactapi-ui:v3.7.7
+          image: git.unkin.net/unkin/artifactapi-ui:v3.11.1
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80

apps/base/bind-internal/authoritative/records.yaml

@@ -88,3 +88,32 @@ spec:
   ttl: 600
   values:
     - 103.216.191.185
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: ghp-dns-internal
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: ghp
+  type: A
+  ttl: 600
+  values:
+    # traefik-internal gateway VIP; the ghp Gateway serves ghp.unkin.net there.
+    - 198.18.200.4
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: arrstack-dns-internal
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: arrstack
+  type: A
+  ttl: 600
+  values:
+    # traefik-EXTERNAL (DMZ) gateway VIP; the arrproxy Gateway serves the
+    # arrstack.unkin.net front door (oauth2-proxy) there.
+    - 198.18.199.0

apps/base/dhcp-system/cr/keaapi.yaml

@@ -11,7 +11,7 @@ metadata:
     argocd.argoproj.io/sync-wave: "1"
 spec:
   replicas: 1
-  image: git.unkin.net/unkin/kea-api:v0.1.2
+  image: git.unkin.net/unkin/kea-api:v0.1.3
   tokenSecretName: kea-api-token
   service:
     type: ClusterIP

apps/base/dhcp-system/cr/keacluster.yaml

@@ -11,7 +11,7 @@ metadata:
     argocd.argoproj.io/sync-wave: "1"
 spec:
   replicas: 2
-  image: git.unkin.net/unkin/kea:v0.1.2
+  image: git.unkin.net/unkin/kea:v0.1.3
   domainName: main.unkin.net
   defaultLeaseTime: 1200
   maxLeaseTime: 86400

apps/base/dhcp-system/deployment.yaml

@@ -21,7 +21,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: git.unkin.net/unkin/kea-operator:v0.1.2
+          image: git.unkin.net/unkin/kea-operator:v0.1.3
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081

apps/base/ghp/certificate.yaml

@@ -0,0 +1,28 @@
+---
+# Serving cert off the internal Vault-PKI CA (agents already trust vault-ca-cert).
+# SANs cover the GitHub endpoints ghp impersonates plus its own management host.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ghp-tls
+  namespace: ghp
+  labels:
+    app.kubernetes.io/name: ghp
+    app.kubernetes.io/instance: ghp
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  secretName: ghp-tls
+  issuerRef:
+    kind: ClusterIssuer
+    name: vault-issuer
+  commonName: ghp.k8s.syd1.au.unkin.net
+  dnsNames:
+    - github.com
+    - api.github.com
+    - codeload.github.com
+    - "*.githubcopilot.com"
+    - ghp.k8s.syd1.au.unkin.net
+  privateKey:
+    algorithm: RSA
+    size: 4096

apps/base/ghp/cnpg_backup.yaml

@@ -0,0 +1,50 @@
+---
+# Ceph RGW (S3) backup target for the ghp CNPG cluster, provisioned by the
+# in-estate cephrgw-operator. One dedicated bucket + owner user per cluster.
+apiVersion: ceph.unkin.net/v1alpha1
+kind: ObjectStoreUser
+metadata:
+  name: cnpg-ghp-backup
+  namespace: ghp
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  displayName: "CNPG backup owner (ghp)"
+  uid: cnpg-ghp-backup
+  maxBuckets: 5
+  secretName: cnpg-ghp-backup-s3
+  retainOnDelete: true
+---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: cnpg-ghp
+  namespace: ghp
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  placementTarget: ec
+  bucketName: cnpg-ghp
+  ownerRef: cnpg-ghp-backup
+  versioning: false
+  tags:
+    app: ghp
+    purpose: cnpg-backup
+  retainOnDelete: true
+---
+# Nightly base backup; continuous WAL archiving is always-on via the Cluster's
+# spec.backup.barmanObjectStore. Staggered off other clusters' schedules.
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: cnpg-ghp-nightly
+  namespace: ghp
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  schedule: "0 50 1 * * *"
+  immediate: false
+  backupOwnerReference: self
+  method: barmanObjectStore
+  cluster:
+    name: postgres

apps/base/ghp/cnpg_cluster.yaml

@@ -0,0 +1,117 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: postgres
+  namespace: ghp
+  annotations:
+    # Wave 0: DB (and the generated postgres-app Secret) must be Healthy before
+    # the wave-1 migrate Job runs. ArgoCD gates on the Cluster's health status.
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  affinity:
+    podAntiAffinityType: preferred
+  backup:
+    retentionPolicy: 30d
+    barmanObjectStore:
+      destinationPath: s3://cnpg-ghp
+      endpointURL: https://s3.ceph.unkin.net
+      endpointCA:
+        name: vault-ca-cert
+        key: ca.crt
+      s3Credentials:
+        accessKeyId:
+          name: cnpg-ghp-backup-s3
+          key: AWS_ACCESS_KEY_ID
+        secretAccessKey:
+          name: cnpg-ghp-backup-s3
+          key: AWS_SECRET_ACCESS_KEY
+      serverName: ghp
+      data:
+        compression: bzip2
+        jobs: 2
+      wal:
+        compression: zstd
+        maxParallel: 2
+  bootstrap:
+    initdb:
+      # No secret ref: CNPG mints the owner credentials and publishes them in the
+      # generated "postgres-app" Secret, which the Deployment reads to build the DSN.
+      database: ghp
+      encoding: UTF8
+      localeCType: C
+      localeCollate: C
+      owner: ghp
+  enablePDB: true
+  enableSuperuserAccess: false
+  failoverDelay: 0
+  imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
+  instances: 3
+  logLevel: info
+  maxSyncReplicas: 0
+  minSyncReplicas: 0
+  monitoring:
+    customQueriesConfigMap:
+      - key: queries
+        name: cnpg-default-monitoring
+    disableDefaultQueries: false
+    enablePodMonitor: false
+  postgresql:
+    parameters:
+      archive_mode: "on"
+      archive_timeout: 5min
+      dynamic_shared_memory_type: posix
+      effective_cache_size: 256MB
+      full_page_writes: "on"
+      log_destination: csvlog
+      log_directory: /controller/log
+      log_filename: postgres
+      log_rotation_age: "0"
+      log_rotation_size: "0"
+      log_truncate_on_rotation: "false"
+      logging_collector: "on"
+      max_connections: "200"
+      max_parallel_workers: "16"
+      max_replication_slots: "16"
+      max_worker_processes: "16"
+      shared_buffers: 128MB
+      shared_memory_type: mmap
+      ssl_max_protocol_version: TLSv1.3
+      ssl_min_protocol_version: TLSv1.3
+      wal_keep_size: 256MB
+      wal_level: logical
+      wal_log_hints: "on"
+      wal_receiver_timeout: 5s
+      wal_sender_timeout: 5s
+    syncReplicaElectionConstraint:
+      enabled: false
+  primaryUpdateMethod: restart
+  primaryUpdateStrategy: unsupervised
+  probes:
+    liveness:
+      isolationCheck:
+        connectionTimeout: 1000
+        enabled: true
+        requestTimeout: 1000
+  replicationSlots:
+    highAvailability:
+      enabled: true
+      slotPrefix: _cnpg_
+    synchronizeReplicas:
+      enabled: true
+    updateInterval: 30
+  resources:
+    limits:
+      cpu: 500m
+      memory: 512Mi
+    requests:
+      cpu: 50m
+      memory: 256Mi
+  smartShutdownTimeout: 180
+  startDelay: 3600
+  stopDelay: 1800
+  storage:
+    resizeInUseVolumes: true
+    size: 20Gi
+    storageClass: cephrbd-fast-delete
+  switchoverDelay: 3600

apps/base/ghp/configmap.yaml

@@ -0,0 +1,34 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ghp-env
+  namespace: ghp
+data:
+  GHP_DATABASE_DRIVER: postgres
+  # ghp runs in plain-HTTP reverse-proxy mode: the traefik gateway terminates TLS
+  # for ghp.unkin.net and forwards cleartext to container :8080, where ghp SERVES
+  # the full app (mgmt UI + API) via GHP_SERVER_LISTEN.
+  #
+  # Do NOT set GHP_SERVER_HTTPS_LISTEN here. Any non-empty https_listen flips ghp
+  # into TLS-only mode (server.go Run(): hasTLS -> serveTLS): the app is served on
+  # :8443 and http_listen becomes a 308 http->https REDIRECT listener, while
+  # GHP_SERVER_LISTEN is ignored entirely. The gateway forwarding cleartext into
+  # that redirect listener on :8080 was the ghp.unkin.net -> ghp.unkin.net 308 loop.
+  #
+  # nonroot cannot bind <1024; listen high and remap in the Service.
+  GHP_SERVER_LISTEN: ":8080"
+  # Behind the TLS-terminating gateway: trust its X-Forwarded-* / Forwarded headers
+  # for scheme/host when generating absolute URLs (GHP_SERVER_BASE_URL is also set).
+  GHP_SERVER_TRUST_PROXY_HEADERS: "true"
+  GHP_METRICS_LISTEN: ":9136"
+  GHP_METRICS_ENABLED: "true"
+  GHP_SERVER_BASE_URL: https://ghp.unkin.net
+  GHP_SERVER_MANAGEMENT_HOST: ghp.unkin.net
+  # private_key key from the ghp-github-app Secret, mounted as a file.
+  GHP_GITHUB_PRIVATE_KEY_FILE: /etc/ghp/github-app/private_key
+  # cert-manager Certificate ghp-tls, mounted from the ghp-tls Secret.
+  GHP_TLS_CERT_FILE: /etc/ghp/tls/tls.crt
+  GHP_TLS_KEY_FILE: /etc/ghp/tls/tls.key
+  # PLACEHOLDER: set to Ben's GitHub username before ghp will admit an admin.
+  GHP_ADMINS: "neoloc"

apps/base/ghp/deployment.yaml

@@ -0,0 +1,162 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ghp
+  namespace: ghp
+  annotations:
+    # Wave 2: serve only after the wave-1 migrate Job completes.
+    argocd.argoproj.io/sync-wave: "2"
+    configmap.reloader.stakater.com/auto: "true"
+    secret.reloader.stakater.com/reload: "ghp-github-app,ghp-app,ghp-tls,postgres-app"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: ghp
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: ghp
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: true
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: ghp
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/ghp:v0.20.0-unkin4
+          imagePullPolicy: IfNotPresent
+          # Drop the image's default --migrate so replicas never race migrations;
+          # schema is applied by the wave-1 migrate hook Job instead.
+          command: ["/ghp", "serve"]
+          ports:
+            - containerPort: 8443
+              name: https
+              protocol: TCP
+            - containerPort: 8080
+              name: http
+              protocol: TCP
+            - containerPort: 9136
+              name: metrics
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: ghp-env
+                optional: false
+          env:
+            # DSN assembled from the CNPG-generated postgres-app Secret; $(VAR)
+            # expansion resolves the two env entries defined above it.
+            - name: GHP_DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-app
+                  key: username
+            - name: GHP_DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-app
+                  key: password
+            - name: GHP_DATABASE_DSN
+              value: "postgres://$(GHP_DB_USER):$(GHP_DB_PASSWORD)@postgres-rw.ghp.svc:5432/ghp?sslmode=require"
+            - name: GHP_GITHUB_APP_ID
+              valueFrom:
+                secretKeyRef:
+                  name: ghp-github-app
+                  key: app_id
+            - name: GHP_GITHUB_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: ghp-github-app
+                  key: client_id
+            - name: GHP_GITHUB_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: ghp-github-app
+                  key: client_secret
+            - name: GHP_ENCRYPTION_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: ghp-app
+                  key: encryption_key
+            # Static admin service token for machine callers (the Vault ghp
+            # secrets engine authenticates with it to mint scoped tokens).
+            # optional: ghp runs fine without it until Ben seeds `service_token`
+            # into kv/kubernetes/namespace/ghp/default/app; the ghp-app reloader
+            # annotation then rolls this Deployment to pick it up.
+            - name: GHP_AUTH_SERVICE_TOKENS
+              valueFrom:
+                secretKeyRef:
+                  name: ghp-app
+                  key: service_token
+                  optional: true
+          volumeMounts:
+            - name: github-app
+              mountPath: /etc/ghp/github-app
+              readOnly: true
+            - name: tls
+              mountPath: /etc/ghp/tls
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+          livenessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /metrics
+              port: metrics
+              # Plain HTTP: ghp only serves metrics over TLS in TLS mode
+              # (hasTLS). In reverse-proxy/plain mode the metrics server is
+              # cleartext, so probe with HTTP.
+              scheme: HTTP
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 5
+          readinessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /metrics
+              port: metrics
+              # Plain HTTP: ghp only serves metrics over TLS in TLS mode
+              # (hasTLS). In reverse-proxy/plain mode the metrics server is
+              # cleartext, so probe with HTTP.
+              scheme: HTTP
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            successThreshold: 1
+            timeoutSeconds: 5
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            limits:
+              cpu: "2"
+              memory: 2Gi
+            requests:
+              cpu: "1"
+              memory: 512Mi
+      volumes:
+        - name: github-app
+          secret:
+            secretName: ghp-github-app
+        - name: tls
+          secret:
+            secretName: ghp-tls
+        # Writable scratch: root FS is read-only. Disk-backed (not memory medium)
+        # so codeload tarball staging doesn't count against the pod memory limit.
+        - name: tmp
+          emptyDir:
+            sizeLimit: 2Gi
+      restartPolicy: Always

apps/base/ghp/gateway.yaml

@@ -0,0 +1,69 @@
+---
+# HTTPS front for ghp, served on two names via the internal Traefik:
+#   ghp.unkin.net              — canonical/primary (apex, bind-operator zone)
+#   ghp.k8s.syd1.au.unkin.net  — admin/internal route (external-dns k8s.syd1 zone)
+# The cert-manager annotations below make cert-manager mint the ghp-gateway-tls
+# Secret with CN ghp.unkin.net and a DNS SAN for each TLS listener hostname
+# automatically. This is a SEPARATE Secret from ghp-tls (certificate.yaml), which
+# carries the GitHub impersonation SANs and is mounted by ghp itself — the two
+# never share a Secret, so cert-manager does not fight over either.
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: ghp.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    # Only the k8s admin route is published by external-dns (it owns just the
+    # k8s.syd1.au.unkin.net zone). ghp.unkin.net lives in the apex zone and is
+    # served by the bind-operator DNSRecord — NOT managed here.
+    external-dns.alpha.kubernetes.io/hostname: ghp.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: ghp
+  namespace: ghp
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - name: http-primary
+      port: 80
+      protocol: HTTP
+      hostname: ghp.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https-primary
+      port: 443
+      protocol: HTTPS
+      hostname: ghp.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: ghp-gateway-tls
+    - name: http-admin
+      port: 80
+      protocol: HTTP
+      hostname: ghp.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https-admin
+      port: 443
+      protocol: HTTPS
+      hostname: ghp.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: ghp-gateway-tls

apps/base/ghp/httproute.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: ghp-route
+  namespace: ghp
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  hostnames:
+    - ghp.unkin.net
+    - ghp.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: ghp
+      sectionName: http-primary
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: ghp
+      sectionName: http-admin
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: ghp
+      sectionName: https-primary
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: ghp
+      sectionName: https-admin
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: ghp
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/ghp/kustomization.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - configmap.yaml
+  - cnpg_cluster.yaml
+  - cnpg_backup.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+  - certificate.yaml
+  - deployment.yaml
+  - migrate-job.yaml
+  - service.yaml
+  - pdb.yaml
+  - vmservicescrape.yaml
+  - gateway.yaml
+  - httproute.yaml

apps/base/ghp/migrate-job.yaml

@@ -0,0 +1,78 @@
+---
+# Runs the schema migration once per sync, before the Deployment rolls, so the
+# serve replicas never race migrations. Deleted before each re-create so a new
+# image/version re-runs it.
+#
+# Sync-phase hook at wave 1 (NOT PreSync): the CNPG Cluster + generated
+# postgres-app Secret apply at wave 0 and ArgoCD waits for the Cluster to be
+# Healthy before starting wave 1, so on a fresh install Postgres exists before
+# migrate connects. (A PreSync hook would run before the Sync phase that creates
+# the DB, deadlocking the first install.)
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: ghp-migrate
+  namespace: ghp
+  annotations:
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  backoffLimit: 6
+  ttlSecondsAfterFinished: 600
+  template:
+    metadata:
+      labels:
+        app: ghp-migrate
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: true
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: migrate
+          image: ghcr.io/goodtune/ghp:0.20.0
+          imagePullPolicy: IfNotPresent
+          command: ["/ghp", "migrate"]
+          env:
+            - name: GHP_DATABASE_DRIVER
+              value: postgres
+            - name: GHP_DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-app
+                  key: username
+            - name: GHP_DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-app
+                  key: password
+            - name: GHP_DATABASE_DSN
+              value: "postgres://$(GHP_DB_USER):$(GHP_DB_PASSWORD)@postgres-rw.ghp.svc:5432/ghp?sslmode=require"
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            limits:
+              cpu: "1"
+              memory: 512Mi
+            requests:
+              cpu: 250m
+              memory: 256Mi
+      volumes:
+        # Writable scratch: root FS is read-only, so give the migrator a /tmp.
+        - name: tmp
+          emptyDir:
+            sizeLimit: 256Mi

apps/base/ghp/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ghp

apps/base/ghp/pdb.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: ghp
+  namespace: ghp
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: ghp

apps/base/ghp/service.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ghp
+  namespace: ghp
+  labels:
+    app: ghp
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: https
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: http
+    - name: metrics
+      port: 9136
+      protocol: TCP
+      targetPort: metrics
+  selector:
+    app: ghp
+  sessionAffinity: None
+  type: ClusterIP

apps/base/ghp/vaultauth.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: ghp
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  allowedNamespaces:
+    - ghp
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default

apps/base/ghp/vaultstaticsecret.yaml

@@ -0,0 +1,44 @@
+---
+# GitHub App credentials (app_id, client_id, client_secret, private_key). Ben
+# populates kv/kubernetes/namespace/ghp/default/github-app via the runbook; the
+# default k8s role's templated policy already grants read here, so no
+# terraform-vault change is needed. VSO syncs it into the ghp-github-app Secret.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: ghp-github-app
+  namespace: ghp
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: ghp-github-app
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/ghp/default/github-app
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+# Application encryption key (encryption_key) from
+# kv/kubernetes/namespace/ghp/default/app.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: ghp-app
+  namespace: ghp
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: ghp-app
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/ghp/default/app
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/ghp/vmservicescrape.yaml

@@ -0,0 +1,21 @@
+---
+# Scrape ghp's Prometheus metrics endpoint. Picked up by the observability
+# VMAgent (selectAllByDefault). Estate uses VictoriaMetrics, so VMServiceScrape
+# rather than a prometheus-operator ServiceMonitor.
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: ghp
+  namespace: ghp
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  selector:
+    matchLabels:
+      app: ghp
+  endpoints:
+    - port: metrics
+      path: /metrics
+      # ghp runs in plain reverse-proxy mode (no GHP_SERVER_HTTPS_LISTEN), so the
+      # metrics server is cleartext HTTP rather than TLS. Scrape over http.
+      scheme: http

apps/base/jellyfin/cephrgw-config-backup.yaml

@@ -0,0 +1,32 @@
+---
+# Second Ceph RGW (S3) bucket owned by the existing jellyfin backup user
+# (cnpg-jellyfin-backup, defined in cnpg_backup.yaml) — one user, two buckets:
+# the CNPG barman bucket plus this one, which k8up uses to hold restic backups
+# of the jellyfin-config PVC. The BucketAccess emits read-write S3 creds into a
+# Secret the k8up Schedule consumes.
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: jellyfin-config-backup
+  namespace: jellyfin
+spec:
+  placementTarget: ec
+  bucketName: jellyfin-config-backup
+  ownerRef: cnpg-jellyfin-backup
+  versioning: false
+  tags:
+    app: jellyfin
+    purpose: config-backup
+  retainOnDelete: true
+---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: BucketAccess
+metadata:
+  name: jellyfin-config-backup
+  namespace: jellyfin
+spec:
+  bucketRef: jellyfin-config-backup
+  level: read-write
+  # Operator writes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (+ S3_ENDPOINT,
+  # BUCKET_NAME) into this Secret; the k8up Schedule reads the access keys.
+  secretName: jellyfin-config-backup-s3

apps/base/jellyfin/cnpg_backup.yaml

@@ -0,0 +1,45 @@
+---
+# Ceph RGW (S3) backup target for the jellyfin CNPG cluster, provisioned by the
+# in-estate cephrgw-operator: one dedicated bucket + owner user. CNPG reads the
+# S3 credential Secret from its own namespace.
+apiVersion: ceph.unkin.net/v1alpha1
+kind: ObjectStoreUser
+metadata:
+  name: cnpg-jellyfin-backup
+  namespace: jellyfin
+spec:
+  displayName: "CNPG backup owner (jellyfin)"
+  uid: cnpg-jellyfin-backup
+  maxBuckets: 5
+  secretName: cnpg-jellyfin-backup-s3
+  retainOnDelete: true
+---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: cnpg-jellyfin
+  namespace: jellyfin
+spec:
+  placementTarget: ec
+  bucketName: cnpg-jellyfin
+  ownerRef: cnpg-jellyfin-backup
+  versioning: false
+  tags:
+    app: jellyfin
+    purpose: cnpg-backup
+  retainOnDelete: true
+---
+# Nightly base backup on top of always-on WAL archiving. Scheduled off-peak and
+# staggered from the other CNPG clusters (6-field cron, seconds first).
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: cnpg-jellyfin-nightly
+  namespace: jellyfin
+spec:
+  schedule: "0 35 3 * * *"
+  immediate: false
+  backupOwnerReference: self
+  method: barmanObjectStore
+  cluster:
+    name: jellyfin-postgres

apps/base/jellyfin/cnpg_cluster.yaml

@@ -0,0 +1,126 @@
+---
+# Main Jellyfin database. The jellyfin-ha fork's experimental EF Core provider
+# moves the entire Jellyfin DB (incl. library items) off SQLite into PostgreSQL,
+# which is what makes a shared-nothing multi-replica deployment possible. No
+# bootstrap secret is given, so CNPG generates the jellyfin-postgres-app secret
+# (username/password/dbname) that the StatefulSet composes its DSN from.
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: jellyfin-postgres
+  namespace: jellyfin
+spec:
+  # Exclude the operator-managed data PVCs (jellyfin-postgres-N) from the
+  # jellyfin-config k8up Schedule (skipWithoutAnnotation is false cluster-wide,
+  # so unannotated PVCs are swept in). Postgres has its own barmanObjectStore
+  # backup below; restic must not touch the raw RWO data volumes.
+  inheritedMetadata:
+    annotations:
+      k8up.io/backup: "false"
+  affinity:
+    podAntiAffinityType: preferred
+  backup:
+    retentionPolicy: 30d
+    barmanObjectStore:
+      # Dedicated per-cluster Ceph RGW bucket (cephrgw-operator provisions it).
+      destinationPath: s3://cnpg-jellyfin
+      endpointURL: https://s3.ceph.unkin.net
+      endpointCA:
+        name: vault-ca-cert
+        key: ca.crt
+      s3Credentials:
+        accessKeyId:
+          name: cnpg-jellyfin-backup-s3
+          key: AWS_ACCESS_KEY_ID
+        secretAccessKey:
+          name: cnpg-jellyfin-backup-s3
+          key: AWS_SECRET_ACCESS_KEY
+      serverName: jellyfin
+      data:
+        compression: bzip2
+        jobs: 2
+      wal:
+        compression: zstd
+        maxParallel: 2
+  bootstrap:
+    initdb:
+      database: jellyfin
+      encoding: UTF8
+      localeCType: C
+      localeCollate: C
+      owner: jellyfin
+  enablePDB: true
+  enableSuperuserAccess: false
+  failoverDelay: 0
+  # PG 17 — accepted by the fork's Npgsql/EF Core provider (needs PG14+); the
+  # provider generates its own migrations on first start.
+  imageName: ghcr.io/cloudnative-pg/postgresql:17-system-trixie
+  instances: 3
+  logLevel: info
+  maxSyncReplicas: 0
+  minSyncReplicas: 0
+  monitoring:
+    customQueriesConfigMap:
+      - key: queries
+        name: cnpg-default-monitoring
+    disableDefaultQueries: false
+    enablePodMonitor: false
+  postgresql:
+    parameters:
+      archive_mode: "on"
+      archive_timeout: 5min
+      dynamic_shared_memory_type: posix
+      effective_cache_size: 256MB
+      full_page_writes: "on"
+      log_destination: csvlog
+      log_directory: /controller/log
+      log_filename: postgres
+      log_rotation_age: "0"
+      log_rotation_size: "0"
+      log_truncate_on_rotation: "false"
+      logging_collector: "on"
+      max_connections: "200"
+      max_parallel_workers: "16"
+      max_replication_slots: "16"
+      max_worker_processes: "16"
+      shared_buffers: 128MB
+      shared_memory_type: mmap
+      ssl_max_protocol_version: TLSv1.3
+      ssl_min_protocol_version: TLSv1.3
+      wal_keep_size: 256MB
+      wal_level: logical
+      wal_log_hints: "on"
+      wal_receiver_timeout: 5s
+      wal_sender_timeout: 5s
+    syncReplicaElectionConstraint:
+      enabled: false
+  primaryUpdateMethod: restart
+  primaryUpdateStrategy: unsupervised
+  probes:
+    liveness:
+      isolationCheck:
+        connectionTimeout: 1000
+        enabled: true
+        requestTimeout: 1000
+  replicationSlots:
+    highAvailability:
+      enabled: true
+      slotPrefix: _cnpg_
+    synchronizeReplicas:
+      enabled: true
+    updateInterval: 30
+  resources:
+    limits:
+      cpu: "1"
+      memory: 1Gi
+    requests:
+      cpu: 50m
+      memory: 512Mi
+  smartShutdownTimeout: 180
+  startDelay: 3600
+  stopDelay: 1800
+  storage:
+    resizeInUseVolumes: true
+    size: 10Gi
+    storageClass: cephrbd-fast-delete
+  switchoverDelay: 3600

apps/base/jellyfin/cnpg_pooler.yaml

@@ -0,0 +1,36 @@
+---
+# PgBouncer pooler in front of the jellyfin-postgres cluster. Jellyfin connects
+# here (jellyfin-postgres-pooler:5432) rather than the -rw service so EF Core's
+# connection churn is absorbed by the pool.
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  name: jellyfin-postgres-pooler
+  namespace: jellyfin
+spec:
+  cluster:
+    name: jellyfin-postgres
+  instances: 2
+  pgbouncer:
+    parameters:
+      default_pool_size: "50"
+      max_client_conn: "200"
+    paused: false
+    poolMode: session
+  template:
+    metadata:
+      labels:
+        app: jellyfin-pooler
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - jellyfin-pooler
+              topologyKey: kubernetes.io/hostname
+      containers: []
+  type: rw

apps/base/jellyfin/gateway.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: jellyfin.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: jellyfin.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: jellyfin
+  namespace: jellyfin
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: jellyfin.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: jellyfin.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: jellyfin-tls
+        mode: Terminate

apps/base/jellyfin/httproute.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-redirect
+  namespace: jellyfin
+spec:
+  hostnames:
+    - jellyfin.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: jellyfin
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: jellyfin-route
+  namespace: jellyfin
+spec:
+  hostnames:
+    - jellyfin.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: jellyfin
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: jellyfin
+          port: 8096
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/jellyfin/kustomization.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - cnpg_cluster.yaml
+  - cnpg_pooler.yaml
+  - cnpg_backup.yaml
+  - cephrgw-config-backup.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+  - schedule.yaml
+  - pvc-config.yaml
+  - pvc-transcode.yaml
+  - pv-media-tv.yaml
+  - pv-media-movies.yaml
+  - pvc-media-tv.yaml
+  - pvc-media-movies.yaml
+  - statefulset.yaml
+  - pdb.yaml
+  - service.yaml
+  - valkey.yaml
+  - gateway.yaml
+  - httproute.yaml

apps/base/jellyfin/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: jellyfin

apps/base/jellyfin/pdb.yaml

@@ -0,0 +1,13 @@
+---
+# Keep at least one Jellyfin replica serving through voluntary disruptions
+# (node drains, rollouts) so active streams can fail over rather than drop.
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: jellyfin
+  namespace: jellyfin
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: jellyfin

apps/base/jellyfin/pv-media-movies.yaml

@@ -0,0 +1,30 @@
+---
+# Static PV for the shared MOVIES CephFS subvolume. Same rootPath as arrstack's
+# movies PV so radarr writes and jellyfin reads the identical library tree; each
+# namespace gets its own PV (unique name + volumeHandle) pinned by claimRef.
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: jellyfin-media-movies
+spec:
+  capacity:
+    storage: 1Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  volumeMode: Filesystem
+  claimRef:
+    namespace: jellyfin
+    name: jellyfin-media-movies
+  csi:
+    driver: cephfs.csi.ceph.com
+    volumeHandle: jellyfin-media-movies-static
+    nodeStageSecretRef:
+      name: csi-cephfs-secret
+      namespace: csi-cephfs
+    volumeAttributes:
+      staticVolume: "true"
+      clusterID: cephfs_csi_ssd_ec_4_1
+      fsName: cephfs
+      rootPath: /volumes/csi_ssd_ec_4_1/media-movies/e95d8ace-c736-465a-acc3-0c3e46dcede9

apps/base/jellyfin/pv-media-tv.yaml

@@ -0,0 +1,30 @@
+---
+# Static PV for the shared TV CephFS subvolume. Same rootPath as arrstack's
+# TV PV so sonarr writes and jellyfin reads the identical library tree; each
+# namespace gets its own PV (unique name + volumeHandle) pinned by claimRef.
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: jellyfin-media-tv
+spec:
+  capacity:
+    storage: 1Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  volumeMode: Filesystem
+  claimRef:
+    namespace: jellyfin
+    name: jellyfin-media-tv
+  csi:
+    driver: cephfs.csi.ceph.com
+    volumeHandle: jellyfin-media-tv-static
+    nodeStageSecretRef:
+      name: csi-cephfs-secret
+      namespace: csi-cephfs
+    volumeAttributes:
+      staticVolume: "true"
+      clusterID: cephfs_csi_ssd_ec_4_1
+      fsName: cephfs
+      rootPath: /volumes/csi_ssd_ec_4_1/media-tv/4692957d-f5df-4f72-b9c9-56e4ee6d1333

apps/base/jellyfin/pvc-config.yaml

@@ -0,0 +1,17 @@
+---
+# Jellyfin config: metadata images, plugins, subtitles and config XML. Shared
+# ReadWriteMany across replicas (all pods read/write the same library metadata);
+# the main library DB now lives in PostgreSQL, not here. Retain — this is state.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-config
+  namespace: jellyfin
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 20Gi
+  storageClassName: cephfs-raid5-retain
+  volumeMode: Filesystem

apps/base/jellyfin/pvc-media-movies.yaml

@@ -0,0 +1,24 @@
+---
+# Movie library, shared read-many across replicas. Statically bound to the
+# jellyfin-media-movies PV (shared CephFS subvolume also used by arrstack/radarr).
+# storageClassName "" + volumeName disables dynamic provisioning and binds the
+# pre-created static PV.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-media-movies
+  namespace: jellyfin
+  annotations:
+    # Exclude from the jellyfin-config k8up Schedule (skipWithoutAnnotation is
+    # false cluster-wide, so unannotated PVCs are swept in). Only jellyfin-config
+    # is backed up; the media library is not restic-backup material.
+    k8up.io/backup: "false"
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Ti
+  storageClassName: ""
+  volumeName: jellyfin-media-movies
+  volumeMode: Filesystem

apps/base/jellyfin/pvc-media-tv.yaml

@@ -0,0 +1,24 @@
+---
+# TV library, shared read-many across replicas. Statically bound to the
+# jellyfin-media-tv PV (shared CephFS subvolume also used by arrstack/sonarr).
+# storageClassName "" + volumeName disables dynamic provisioning and binds the
+# pre-created static PV.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-media-tv
+  namespace: jellyfin
+  annotations:
+    # Exclude from the jellyfin-config k8up Schedule (skipWithoutAnnotation is
+    # false cluster-wide, so unannotated PVCs are swept in). Only jellyfin-config
+    # is backed up; the media library is not restic-backup material.
+    k8up.io/backup: "false"
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Ti
+  storageClassName: ""
+  volumeName: jellyfin-media-tv
+  volumeMode: Filesystem

apps/base/jellyfin/pvc-transcode.yaml

@@ -0,0 +1,23 @@
+---
+# Shared transcode scratch. ReadWriteMany is the hard requirement for the HA
+# fork: a taking-over pod must read the in-flight HLS segments written by the
+# pod it replaces. Scratch data (delete reclaim); raid5 avoids the raid6
+# double-parity write penalty on the many small HLS segment writes.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-transcode
+  namespace: jellyfin
+  annotations:
+    # Exclude from the jellyfin-config k8up Schedule (skipWithoutAnnotation is
+    # false cluster-wide, so unannotated PVCs are swept in). Transcode is RWX
+    # scratch — nothing to back up.
+    k8up.io/backup: "false"
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 100Gi
+  storageClassName: cephfs-raid5-delete
+  volumeMode: Filesystem

apps/base/jellyfin/schedule.yaml

@@ -0,0 +1,58 @@
+---
+# k8up Schedule: restic backups of the jellyfin-config PVC (library metadata,
+# plugins, config XML) to the dedicated Ceph RGW config-backup bucket. S3 creds
+# come from the cephrgw BucketAccess Secret (jellyfin-config-backup-s3); the
+# restic repo password comes from Vault via the jellyfin-k8up-restic Secret.
+#
+# s3.ceph.unkin.net presents the internal unkin.net CA, which the k8up/restic
+# image does not trust by default, so the reflected vault-ca-cert Secret is
+# mounted into every job pod and pointed at via backend.tlsOptions.caCert.
+apiVersion: k8up.io/v1
+kind: Schedule
+metadata:
+  name: jellyfin-config
+  namespace: jellyfin
+spec:
+  backend:
+    repoPasswordSecretRef:
+      name: jellyfin-k8up-restic
+      key: password
+    s3:
+      endpoint: https://s3.ceph.unkin.net
+      bucket: jellyfin-config-backup
+      accessKeyIDSecretRef:
+        name: jellyfin-config-backup-s3
+        key: AWS_ACCESS_KEY_ID
+      secretAccessKeySecretRef:
+        name: jellyfin-config-backup-s3
+        key: AWS_SECRET_ACCESS_KEY
+    tlsOptions:
+      caCert: /etc/k8up/ca/ca.crt
+    volumeMounts:
+      - name: vault-ca
+        mountPath: /etc/k8up/ca
+        readOnly: true
+  backup:
+    schedule: "0 2 * * *"
+    failedJobsHistoryLimit: 3
+    successfulJobsHistoryLimit: 3
+    volumes:
+      - name: vault-ca
+        secret:
+          secretName: vault-ca-cert
+  prune:
+    schedule: "0 3 * * 0"
+    retention:
+      keepDaily: 14
+      keepWeekly: 8
+      keepMonthly: 12
+    volumes:
+      - name: vault-ca
+        secret:
+          secretName: vault-ca-cert
+  check:
+    schedule: "0 4 * * 0"
+    volumes:
+      - name: vault-ca
+        secret:
+          secretName: vault-ca-cert

apps/base/jellyfin/service.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: jellyfin
+  namespace: jellyfin
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 8096
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: jellyfin
+  # Pin each client to one replica to reduce transcode-session churn/takeover.
+  sessionAffinity: ClientIP
+  type: ClusterIP

apps/base/jellyfin/statefulset.yaml

@@ -0,0 +1,245 @@
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: jellyfin
+  namespace: jellyfin
+spec:
+  # HA: two replicas coordinate transcode session ownership through Valkey and
+  # resume each other's HLS segments off the shared RWX transcode PVC. Stable
+  # pod names (jellyfin-0/1) are the lease owner identity, hence StatefulSet.
+  replicas: 2
+  serviceName: jellyfin
+  podManagementPolicy: Parallel
+  updateStrategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app: jellyfin
+  template:
+    metadata:
+      labels:
+        app: jellyfin
+    spec:
+      securityContext:
+        # Group-write the shared RWX volumes and grant the render/video groups so
+        # the runAsUser 1000 process can open the Intel DRI render node injected
+        # by the device plugin.
+        fsGroup: 1000
+        supplementalGroups:
+          - 44
+          - 105
+          - 109
+        seccompProfile:
+          type: RuntimeDefault
+      affinity:
+        # Spread the two replicas across nodes for node-level HA. Soft so a
+        # single-GPU-node cluster still schedules both (i915 has 4 shared slots).
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app: jellyfin
+                topologyKey: kubernetes.io/hostname
+      initContainers:
+        # Seed the fork's PostgreSQL provider (database.xml) and Intel iGPU
+        # hardware transcode settings (encoding.xml) before Jellyfin starts.
+        # Runs as root to chown into the shared config volume; mirrors the fork
+        # Helm chart's inject-db-config. Each file is written only when absent so
+        # admin changes persisted to the shared RWX /config survive pod restarts.
+        - name: inject-config
+          image: busybox:1.37.0
+          command:
+            - sh
+            - -c
+            - |
+              mkdir -p /config/config
+              chown 1000:1000 /config/config
+              chmod 775 /config/config
+              if [ ! -e /config/config/database.xml ]; then
+                cat > /config/config/database.xml << 'DBEOF'
+              <?xml version="1.0" encoding="utf-8"?>
+              <DatabaseConfigurationOptions>
+                <DatabaseType>Jellyfin-PostgreSQL</DatabaseType>
+                <LockingBehavior>NoLock</LockingBehavior>
+              </DatabaseConfigurationOptions>
+              DBEOF
+                chown 1000:1000 /config/config/database.xml
+                chmod 664 /config/config/database.xml
+              fi
+              # VAAPI on the Intel render node the device plugin injects
+              # (/dev/dri/renderD128 — ffmpeg's default DRM node, reachable via
+              # the render/video supplementalGroups). Without this the attached
+              # iGPU is idle and every transcode runs in software. Omitted
+              # elements fall back to the fork's EncodingOptions defaults.
+              if [ ! -e /config/config/encoding.xml ]; then
+                cat > /config/config/encoding.xml << 'ENCEOF'
+              <?xml version="1.0" encoding="utf-8"?>
+              <EncodingOptions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+                <EncodingThreadCount>-1</EncodingThreadCount>
+                <HardwareAccelerationType>vaapi</HardwareAccelerationType>
+                <VaapiDevice>/dev/dri/renderD128</VaapiDevice>
+                <EnableHardwareEncoding>true</EnableHardwareEncoding>
+                <AllowHevcEncoding>true</AllowHevcEncoding>
+                <AllowAv1Encoding>false</AllowAv1Encoding>
+                <EnableIntelLowPowerH264HwEncoder>false</EnableIntelLowPowerH264HwEncoder>
+                <EnableIntelLowPowerHevcHwEncoder>false</EnableIntelLowPowerHevcHwEncoder>
+                <EnableTonemapping>false</EnableTonemapping>
+                <EnableVppTonemapping>false</EnableVppTonemapping>
+                <HardwareDecodingCodecs>
+                  <string>h264</string>
+                  <string>hevc</string>
+                  <string>vc1</string>
+                  <string>vp9</string>
+                </HardwareDecodingCodecs>
+              </EncodingOptions>
+              ENCEOF
+                chown 1000:1000 /config/config/encoding.xml
+                chmod 664 /config/config/encoding.xml
+              fi
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+          volumeMounts:
+            - name: config
+              mountPath: /config
+      containers:
+        - name: jellyfin
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.1.3
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8096
+              protocol: TCP
+          env:
+            # Pod identity for the Valkey transcode lease owner. The fork reads
+            # JELLYFIN_INSTANCE_ID (falling back to MachineName); the stable
+            # StatefulSet pod name gives each replica a unique lease identity so
+            # takeover can target a dead replica. JELLYFIN_HA_POD_NAME is set for
+            # parity with the fork Helm chart (nothing currently reads it).
+            - name: JELLYFIN_INSTANCE_ID
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: JELLYFIN_HA_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            # Multiple replicas must not each answer UDP auto-discovery.
+            - name: JELLYFIN_Network__AutoDiscovery
+              value: "false"
+            # Config dir must differ from the data root (Jellyfin sanity check).
+            - name: JELLYFIN_CONFIG_DIR
+              value: /config/config
+            # Distributed transcode session store (jellyfin-ha additions).
+            - name: Jellyfin__TranscodeStore__RedisConnectionString
+              value: "valkey-jellyfin-valkey:6379,abortConnect=false"
+            - name: Jellyfin__TranscodeStore__LeaseDurationSeconds
+              value: "30"
+            # PostgreSQL main DB via the CNPG-generated app secret, routed through
+            # the PgBouncer pooler. Composed with $(VAR) expansion so the password
+            # is never rendered into the manifest; CNPG passwords are URL-safe.
+            - name: PGUSER
+              valueFrom:
+                secretKeyRef:
+                  name: jellyfin-postgres-app
+                  key: username
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: jellyfin-postgres-app
+                  key: password
+            - name: PGDB
+              valueFrom:
+                secretKeyRef:
+                  name: jellyfin-postgres-app
+                  key: dbname
+            - name: POSTGRES_CONNECTION_STRING
+              value: "postgresql://$(PGUSER):$(PGPASSWORD)@jellyfin-postgres-pooler:5432/$(PGDB)"
+            - name: DATABASE_URL
+              value: "postgresql://$(PGUSER):$(PGPASSWORD)@jellyfin-postgres-pooler:5432/$(PGDB)"
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: "1"
+              memory: 1Gi
+              gpu.intel.com/i915: "1"
+            limits:
+              cpu: "4"
+              memory: 6Gi
+              # Intel iGPU (QSV/VA-API) slot. Requesting it pins the pod to a
+              # GPU-labelled node and injects /dev/dri/renderD* automatically, so
+              # no /dev/dri hostPath or privileged container is needed. VA-API is
+              # pre-enabled via the seeded encoding.xml (see inject-config), so
+              # transcodes use the iGPU on first boot with no manual UI step.
+              gpu.intel.com/i915: "1"
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: transcode
+              # Fork's real transcode temp path. RWX so a surviving pod reads the
+              # in-flight .ts/.m3u8 segments of the pod it takes over. A per-pod
+              # volume here silently breaks HA takeover.
+              mountPath: /config/transcodes
+            - name: cache
+              mountPath: /cache
+            - name: media-tv
+              mountPath: /media/tv
+              readOnly: true
+            - name: media-movies
+              mountPath: /media/movies
+              readOnly: true
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: jellyfin-config
+        - name: transcode
+          persistentVolumeClaim:
+            claimName: jellyfin-transcode
+        - name: media-tv
+          persistentVolumeClaim:
+            claimName: jellyfin-media-tv
+        - name: media-movies
+          persistentVolumeClaim:
+            claimName: jellyfin-media-movies
+  volumeClaimTemplates:
+    # Per-pod scratch cache — RWO, disposable, one PVC per replica.
+    - metadata:
+        name: cache
+        annotations:
+          # Exclude the per-pod cache PVCs from the jellyfin-config k8up Schedule
+          # (skipWithoutAnnotation is false cluster-wide). Cache is disposable and
+          # RWO — it would also fail to mount into the backup pod while in use.
+          k8up.io/backup: "false"
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 30Gi
+        storageClassName: cephrbd-fast-delete
+        volumeMode: Filesystem

apps/base/jellyfin/valkey.yaml

@@ -0,0 +1,43 @@
+---
+# HA Valkey managed by valkey-operator as Jellyfin's distributed transcode-session
+# store. shards:1 + replicas:2 is one primary with two replicas in a single shard
+# group (three ValkeyNodes total): losing the primary triggers an automatic
+# failover to a replica, so a node/pod loss no longer drops the shared transcode
+# lease state the two Jellyfin replicas coordinate through. The operator always
+# runs Valkey cluster-mode-enabled with protected-mode off and leaves the built-in
+# `default` user passwordless, so clients connect with no auth/TLS (parity with the
+# old open redis); StackExchange.Redis seeds off the single headless service and
+# auto-discovers the topology plus failovers, so the connection string is
+# unchanged. scheduling.node.spread.shard:Required renders pod anti-affinity that
+# keeps the three nodes on distinct hosts (kubernetes.io/hostname), so one host
+# loss removes at most one node. podDisruptionBudget.mode:Cluster lets the operator
+# manage a quorum-aware PDB. Persistence stays omitted so /data is an emptyDir:
+# lease state is ephemeral (30s TTLs), replication+failover already provide
+# redundancy and a replaced node re-syncs from the primary, and an operator-managed
+# PVC cannot carry the k8up.io/backup:"false" annotation the namespace's
+# cluster-wide k8up Schedule needs to skip in-use RWO volumes.
+apiVersion: valkey.io/v1alpha1
+kind: ValkeyCluster
+metadata:
+  name: jellyfin-valkey
+  namespace: jellyfin
+spec:
+  shards: 1
+  replicas: 2
+  image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/valkey/valkey:9.0.0
+  exporter:
+    enabled: false
+  scheduling:
+    node:
+      spread:
+        shard:
+          mode: Required
+  podDisruptionBudget:
+    mode: Cluster
+  resources:
+    requests:
+      cpu: 50m
+      memory: 128Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi

apps/base/jellyfin/vaultauth.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: jellyfin
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  allowedNamespaces:
+    - jellyfin
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default

apps/base/jellyfin/vaultstaticsecret.yaml

@@ -0,0 +1,24 @@
+---
+# restic repository password for the k8up jellyfin-config backups. Seeded at
+# kv/kubernetes/namespace/jellyfin/default/k8up-restic (key: password); the
+# default k8s role's templated policy already grants read here, so no
+# terraform-vault change is needed. VSO syncs it into the jellyfin-k8up-restic
+# Secret that the Schedule references via backend.repoPasswordSecretRef.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: jellyfin-k8up-restic
+  namespace: jellyfin
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: jellyfin-k8up-restic
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/jellyfin/default/k8up-restic
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/k8up-system/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml

apps/base/k8up-system/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: k8up-system

apps/base/netbox/vaultstaticsecret.yaml

@@ -19,7 +19,13 @@ spec:
   type: kv-v2
   vaultAuthRef: default
 ---
-# Django SECRET_KEY (key: secret_key). One-time Vault seed.
+# Config secret. Keys:
+#   secret_key         : Django SECRET_KEY (50+ random chars). One-time Vault seed.
+#   api_token_peppers  : JSON object {"1": "<50+ char random>"} used to HMAC-hash
+#                        v2 API tokens. One-time Vault seed — rotating a pepper
+#                        invalidates existing v2 tokens, so set it once.
+# VSO syncs every key at the path into the destination Secret, and the NetBox
+# chart mounts both keys from it (existingSecret) — no explicit key mapping needed.
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
 metadata:

apps/base/puppet/deployment_puppetserver-master.yaml

@@ -4,6 +4,8 @@ metadata:
   annotations:
     configmap.reloader.stakater.com/auto: "true"
     secret.reloader.stakater.com/reload: "vault-ca-cert"
+    # Replace clears the stale, API-server-defaulted spec.strategy.rollingUpdate that SSA cannot drop, which otherwise makes Recreate invalid.
+    argocd.argoproj.io/sync-options: Replace=true
   labels:
     app.kubernetes.io/component: puppetserver
     app.kubernetes.io/instance: puppetserver

apps/base/valkey-operator-system/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml

apps/base/valkey-operator-system/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: valkey-operator-system

apps/base/woodpecker/kustomization.yaml

@@ -7,7 +7,12 @@ resources:
   - cnpg_cluster.yaml
   - cnpg_backup.yaml
   - cnpg_pooler.yaml
+  - serviceaccount_arrproxy_ci.yaml
+  - serviceaccount_autobackup_operator_ci.yaml
+  - serviceaccount_ghp.yaml
   - serviceaccount_kea_operator_ci.yaml
+  - serviceaccount_plugin_docker_buildx.yaml
+  - serviceaccount_jellyfin_ha_src.yaml
   - serviceaccount_terraform_artifactapi.yaml
   - serviceaccount_terraform_authentik.yaml
   - serviceaccount_terraform_enc.yaml

apps/base/woodpecker/serviceaccount_arrproxy_ci.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: arrproxy-ci
+  namespace: woodpecker

apps/base/woodpecker/serviceaccount_autobackup_operator_ci.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: autobackup-operator-ci
+  namespace: woodpecker

apps/base/woodpecker/serviceaccount_ghp.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ghp
+  namespace: woodpecker

apps/base/woodpecker/serviceaccount_jellyfin_ha_src.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: jellyfin-ha-src
+  namespace: woodpecker