traefik-internal: add ldaps :636 entrypoint for authentik LDAPS

Why: - traefik-internal has no 636 entrypoint, so the authentik-ldap Gateway's 636/TLS passthrough listeners are invalid and the whole Gateway is rejected (Accepted: False), taking LDAPS down. - The traefik-internal LoadBalancer only publishes 80/443, so nothing reaches the Authentik LDAP outpost on 636. How: - Add an `ldaps` entrypoint on :636 (raw TCP, no TLS termination) to the traefik-internal helm values so 636/TLS passthrough streams pass through to the LDAP outpost. - Expose 636 on the traefik-internal LoadBalancer via the port's `expose.default`, keeping the pinned 198.18.200.4 / common group.
2026-08-08 23:16:50 +10:00
31 changed files with 8 additions and 785 deletions
@@ -36,7 +36,7 @@ spec:
              mountPath: /combined-certs
      containers:
        - name: api
-          image: git.unkin.net/unkin/artifactapi:v3.8.0
+          image: git.unkin.net/unkin/artifactapi:v3.7.7
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8000
@@ -22,7 +22,7 @@ spec:
      automountServiceAccountToken: true
      containers:
        - name: ui
-          image: git.unkin.net/unkin/artifactapi-ui:v3.8.0
+          image: git.unkin.net/unkin/artifactapi-ui:v3.7.7
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80
@@ -11,7 +11,7 @@ metadata:
    argocd.argoproj.io/sync-wave: "1"
 spec:
  replicas: 1
-  image: git.unkin.net/unkin/kea-api:v0.1.3
+  image: git.unkin.net/unkin/kea-api:v0.1.2
  tokenSecretName: kea-api-token
  service:
    type: ClusterIP
@@ -11,7 +11,7 @@ metadata:
    argocd.argoproj.io/sync-wave: "1"
 spec:
  replicas: 2
-  image: git.unkin.net/unkin/kea:v0.1.3
+  image: git.unkin.net/unkin/kea:v0.1.2
  domainName: main.unkin.net
  defaultLeaseTime: 1200
  maxLeaseTime: 86400
@@ -21,7 +21,7 @@ spec:
        runAsNonRoot: true
      containers:
        - name: operator
-          image: git.unkin.net/unkin/kea-operator:v0.1.3
+          image: git.unkin.net/unkin/kea-operator:v0.1.2
          args:
            - --metrics-bind-address=:8080
            - --health-probe-bind-address=:8081
@@ -1,45 +0,0 @@
---
-# Ceph RGW (S3) backup target for the jellyfin CNPG cluster, provisioned by the
-# in-estate cephrgw-operator: one dedicated bucket + owner user. CNPG reads the
-# S3 credential Secret from its own namespace.
-apiVersion: ceph.unkin.net/v1alpha1
-kind: ObjectStoreUser
-metadata:
-  name: cnpg-jellyfin-backup
-  namespace: jellyfin
-spec:
-  displayName: "CNPG backup owner (jellyfin)"
-  uid: cnpg-jellyfin-backup
-  maxBuckets: 5
-  secretName: cnpg-jellyfin-backup-s3
-  retainOnDelete: true
---
-apiVersion: ceph.unkin.net/v1alpha1
-kind: Bucket
-metadata:
-  name: cnpg-jellyfin
-  namespace: jellyfin
-spec:
-  placementTarget: ec
-  bucketName: cnpg-jellyfin
-  ownerRef: cnpg-jellyfin-backup
-  versioning: false
-  tags:
-    app: jellyfin
-    purpose: cnpg-backup
-  retainOnDelete: true
---
-# Nightly base backup on top of always-on WAL archiving. Scheduled off-peak and
-# staggered from the other CNPG clusters (6-field cron, seconds first).
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: cnpg-jellyfin-nightly
-  namespace: jellyfin
-spec:
-  schedule: "0 35 3 * * *"
-  immediate: false
-  backupOwnerReference: self
-  method: barmanObjectStore
-  cluster:
-    name: jellyfin-postgres
@@ -1,119 +0,0 @@
---
-# Main Jellyfin database. The jellyfin-ha fork's experimental EF Core provider
-# moves the entire Jellyfin DB (incl. library items) off SQLite into PostgreSQL,
-# which is what makes a shared-nothing multi-replica deployment possible. No
-# bootstrap secret is given, so CNPG generates the jellyfin-postgres-app secret
-# (username/password/dbname) that the StatefulSet composes its DSN from.
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: jellyfin-postgres
-  namespace: jellyfin
-spec:
-  affinity:
-    podAntiAffinityType: preferred
-  backup:
-    retentionPolicy: 30d
-    barmanObjectStore:
-      # Dedicated per-cluster Ceph RGW bucket (cephrgw-operator provisions it).
-      destinationPath: s3://cnpg-jellyfin
-      endpointURL: https://s3.ceph.unkin.net
-      endpointCA:
-        name: vault-ca-cert
-        key: ca.crt
-      s3Credentials:
-        accessKeyId:
-          name: cnpg-jellyfin-backup-s3
-          key: AWS_ACCESS_KEY_ID
-        secretAccessKey:
-          name: cnpg-jellyfin-backup-s3
-          key: AWS_SECRET_ACCESS_KEY
-      serverName: jellyfin
-      data:
-        compression: bzip2
-        jobs: 2
-      wal:
-        compression: zstd
-        maxParallel: 2
-  bootstrap:
-    initdb:
-      database: jellyfin
-      encoding: UTF8
-      localeCType: C
-      localeCollate: C
-      owner: jellyfin
-  enablePDB: true
-  enableSuperuserAccess: false
-  failoverDelay: 0
-  # PG 17 — accepted by the fork's Npgsql/EF Core provider (needs PG14+); the
-  # provider generates its own migrations on first start.
-  imageName: ghcr.io/cloudnative-pg/postgresql:17-system-trixie
-  instances: 3
-  logLevel: info
-  maxSyncReplicas: 0
-  minSyncReplicas: 0
-  monitoring:
-    customQueriesConfigMap:
-      - key: queries
-        name: cnpg-default-monitoring
-    disableDefaultQueries: false
-    enablePodMonitor: false
-  postgresql:
-    parameters:
-      archive_mode: "on"
-      archive_timeout: 5min
-      dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
-      full_page_writes: "on"
-      log_destination: csvlog
-      log_directory: /controller/log
-      log_filename: postgres
-      log_rotation_age: "0"
-      log_rotation_size: "0"
-      log_truncate_on_rotation: "false"
-      logging_collector: "on"
-      max_connections: "200"
-      max_parallel_workers: "16"
-      max_replication_slots: "16"
-      max_worker_processes: "16"
-      shared_buffers: 128MB
-      shared_memory_type: mmap
-      ssl_max_protocol_version: TLSv1.3
-      ssl_min_protocol_version: TLSv1.3
-      wal_keep_size: 256MB
-      wal_level: logical
-      wal_log_hints: "on"
-      wal_receiver_timeout: 5s
-      wal_sender_timeout: 5s
-    syncReplicaElectionConstraint:
-      enabled: false
-  primaryUpdateMethod: restart
-  primaryUpdateStrategy: unsupervised
-  probes:
-    liveness:
-      isolationCheck:
-        connectionTimeout: 1000
-        enabled: true
-        requestTimeout: 1000
-  replicationSlots:
-    highAvailability:
-      enabled: true
-      slotPrefix: _cnpg_
-    synchronizeReplicas:
-      enabled: true
-    updateInterval: 30
-  resources:
-    limits:
-      cpu: "1"
-      memory: 1Gi
-    requests:
-      cpu: 50m
-      memory: 512Mi
-  smartShutdownTimeout: 180
-  startDelay: 3600
-  stopDelay: 1800
-  storage:
-    resizeInUseVolumes: true
-    size: 10Gi
-    storageClass: cephrbd-fast-delete
-  switchoverDelay: 3600
@@ -1,36 +0,0 @@
---
-# PgBouncer pooler in front of the jellyfin-postgres cluster. Jellyfin connects
-# here (jellyfin-postgres-pooler:5432) rather than the -rw service so EF Core's
-# connection churn is absorbed by the pool.
-apiVersion: postgresql.cnpg.io/v1
-kind: Pooler
-metadata:
-  name: jellyfin-postgres-pooler
-  namespace: jellyfin
-spec:
-  cluster:
-    name: jellyfin-postgres
-  instances: 2
-  pgbouncer:
-    parameters:
-      default_pool_size: "50"
-      max_client_conn: "200"
-    paused: false
-    poolMode: session
-  template:
-    metadata:
-      labels:
-        app: jellyfin-pooler
-    spec:
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchExpressions:
-                  - key: app
-                    operator: In
-                    values:
-                      - jellyfin-pooler
-              topologyKey: kubernetes.io/hostname
-      containers: []
-  type: rw
@@ -1,37 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: jellyfin.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: jellyfin.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: jellyfin
-  namespace: jellyfin
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: jellyfin.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: jellyfin.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: jellyfin-tls
-        mode: Terminate
@@ -1,49 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: http-redirect
-  namespace: jellyfin
-spec:
-  hostnames:
-    - jellyfin.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: jellyfin
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: jellyfin-route
-  namespace: jellyfin
-spec:
-  hostnames:
-    - jellyfin.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: jellyfin
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: jellyfin
-          port: 8096
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
@@ -1,20 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - cnpg_cluster.yaml
-  - cnpg_pooler.yaml
-  - cnpg_backup.yaml
-  - pvc-config.yaml
-  - pvc-transcode.yaml
-  - pvc-media.yaml
-  - statefulset.yaml
-  - pdb.yaml
-  - service.yaml
-  - redis-deployment.yaml
-  - redis-pvc.yaml
-  - redis-service.yaml
-  - gateway.yaml
-  - httproute.yaml
@@ -1,5 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: jellyfin
@@ -1,13 +0,0 @@
---
-# Keep at least one Jellyfin replica serving through voluntary disruptions
-# (node drains, rollouts) so active streams can fail over rather than drop.
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: jellyfin
-  namespace: jellyfin
-spec:
-  minAvailable: 1
-  selector:
-    matchLabels:
-      app: jellyfin
@@ -1,17 +0,0 @@
---
-# Jellyfin config: metadata images, plugins, subtitles and config XML. Shared
-# ReadWriteMany across replicas (all pods read/write the same library metadata);
-# the main library DB now lives in PostgreSQL, not here. Retain — this is state.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-config
-  namespace: jellyfin
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 20Gi
-  storageClassName: cephfs-raid5-retain
-  volumeMode: Filesystem
@@ -1,17 +0,0 @@
---
-# Media library, shared read-many across replicas. Retain — this holds the
-# actual media and must survive PVC deletion. Empty on first deploy; populating
-# it is out of scope for this app.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-media
-  namespace: jellyfin
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Ti
-  storageClassName: cephfs-raid6-retain
-  volumeMode: Filesystem
@@ -1,18 +0,0 @@
---
-# Shared transcode scratch. ReadWriteMany is the hard requirement for the HA
-# fork: a taking-over pod must read the in-flight HLS segments written by the
-# pod it replaces. Scratch data (delete reclaim); raid5 avoids the raid6
-# double-parity write penalty on the many small HLS segment writes.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-transcode
-  namespace: jellyfin
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 100Gi
-  storageClassName: cephfs-raid5-delete
-  volumeMode: Filesystem
@@ -1,66 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: redis
-  namespace: jellyfin
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: redis
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: redis
-    spec:
-      containers:
-        - name: redis
-          image: redis:7-alpine
-          imagePullPolicy: IfNotPresent
-          command:
-            - redis-server
-            - --save
-            - "20"
-            - "1"
-          ports:
-            - containerPort: 6379
-              name: redis
-              protocol: TCP
-          livenessProbe:
-            exec:
-              command:
-                - redis-cli
-                - ping
-            failureThreshold: 3
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 5
-          readinessProbe:
-            exec:
-              command:
-                - redis-cli
-                - ping
-            failureThreshold: 3
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          resources:
-            limits:
-              cpu: 500m
-              memory: 512Mi
-            requests:
-              cpu: 50m
-              memory: 128Mi
-          volumeMounts:
-            - mountPath: /data
-              name: data
-      restartPolicy: Always
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: jellyfin-redis-data
@@ -1,14 +0,0 @@
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-redis-data
-  namespace: jellyfin
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephrbd-fast-delete
-  volumeMode: Filesystem
@@ -1,17 +0,0 @@
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: redis
-  namespace: jellyfin
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: redis
-      port: 6379
-      protocol: TCP
-      targetPort: redis
-  selector:
-    app: redis
-  sessionAffinity: None
-  type: ClusterIP
@@ -1,18 +0,0 @@
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: jellyfin
-  namespace: jellyfin
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 8096
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: jellyfin
-  # Pin each client to one replica to reduce transcode-session churn/takeover.
-  sessionAffinity: ClientIP
-  type: ClusterIP
@@ -1,199 +0,0 @@
---
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: jellyfin
-  namespace: jellyfin
-spec:
-  # HA: two replicas coordinate transcode session ownership through Redis and
-  # resume each other's HLS segments off the shared RWX transcode PVC. Stable
-  # pod names (jellyfin-0/1) are the lease owner identity, hence StatefulSet.
-  replicas: 2
-  serviceName: jellyfin
-  podManagementPolicy: Parallel
-  updateStrategy:
-    type: RollingUpdate
-  selector:
-    matchLabels:
-      app: jellyfin
-  template:
-    metadata:
-      labels:
-        app: jellyfin
-    spec:
-      securityContext:
-        # Group-write the shared RWX volumes and grant the render/video groups so
-        # the runAsUser 1000 process can open the Intel DRI render node injected
-        # by the device plugin.
-        fsGroup: 1000
-        supplementalGroups:
-          - 44
-          - 105
-          - 109
-        seccompProfile:
-          type: RuntimeDefault
-      affinity:
-        # Spread the two replicas across nodes for node-level HA. Soft so a
-        # single-GPU-node cluster still schedules both (i915 has 4 shared slots).
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              podAffinityTerm:
-                labelSelector:
-                  matchLabels:
-                    app: jellyfin
-                topologyKey: kubernetes.io/hostname
-      initContainers:
-        # Select the fork's experimental PostgreSQL provider by writing
-        # database.xml before Jellyfin starts. Runs as root to chown into the
-        # shared config volume; mirrors the fork Helm chart's inject-db-config.
-        - name: inject-db-config
-          image: busybox:1.37.0
-          command:
-            - sh
-            - -c
-            - |
-              mkdir -p /config/config
-              chown 1000:1000 /config/config
-              chmod 775 /config/config
-              cat > /config/config/database.xml << 'DBEOF'
-              <?xml version="1.0" encoding="utf-8"?>
-              <DatabaseConfigurationOptions>
-                <DatabaseType>Jellyfin-PostgreSQL</DatabaseType>
-                <LockingBehavior>NoLock</LockingBehavior>
-              </DatabaseConfigurationOptions>
-              DBEOF
-              chown 1000:1000 /config/config/database.xml
-              chmod 664 /config/config/database.xml
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-            limits:
-              cpu: 100m
-              memory: 64Mi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-      containers:
-        - name: jellyfin
-          image: git.unkin.net/unkin/jellyfin-ha:v0.1.0
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 8096
-              protocol: TCP
-          env:
-            # Pod identity for the Redis transcode lease owner. The fork reads
-            # JELLYFIN_INSTANCE_ID (falling back to MachineName); the stable
-            # StatefulSet pod name gives each replica a unique lease identity so
-            # takeover can target a dead replica. JELLYFIN_HA_POD_NAME is set for
-            # parity with the fork Helm chart (nothing currently reads it).
-            - name: JELLYFIN_INSTANCE_ID
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: JELLYFIN_HA_POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            # Multiple replicas must not each answer UDP auto-discovery.
-            - name: JELLYFIN_Network__AutoDiscovery
-              value: "false"
-            # Config dir must differ from the data root (Jellyfin sanity check).
-            - name: JELLYFIN_CONFIG_DIR
-              value: /config/config
-            # Distributed transcode session store (jellyfin-ha additions).
-            - name: Jellyfin__TranscodeStore__RedisConnectionString
-              value: "redis:6379,abortConnect=false"
-            - name: Jellyfin__TranscodeStore__LeaseDurationSeconds
-              value: "30"
-            # PostgreSQL main DB via the CNPG-generated app secret, routed through
-            # the PgBouncer pooler. Composed with $(VAR) expansion so the password
-            # is never rendered into the manifest; CNPG passwords are URL-safe.
-            - name: PGUSER
-              valueFrom:
-                secretKeyRef:
-                  name: jellyfin-postgres-app
-                  key: username
-            - name: PGPASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: jellyfin-postgres-app
-                  key: password
-            - name: PGDB
-              valueFrom:
-                secretKeyRef:
-                  name: jellyfin-postgres-app
-                  key: dbname
-            - name: POSTGRES_CONNECTION_STRING
-              value: "postgresql://$(PGUSER):$(PGPASSWORD)@jellyfin-postgres-pooler:5432/$(PGDB)"
-            - name: DATABASE_URL
-              value: "postgresql://$(PGUSER):$(PGPASSWORD)@jellyfin-postgres-pooler:5432/$(PGDB)"
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: "1"
-              memory: 1Gi
-              gpu.intel.com/i915: "1"
-            limits:
-              cpu: "4"
-              memory: 6Gi
-              # Intel iGPU (QSV/VA-API) slot. Requesting it pins the pod to a
-              # GPU-labelled node and injects /dev/dri/renderD* automatically, so
-              # no /dev/dri hostPath or privileged container is needed. Enable
-              # QSV/VA-API once in the Jellyfin admin UI; it persists to /config.
-              gpu.intel.com/i915: "1"
-          securityContext:
-            runAsUser: 1000
-            runAsGroup: 1000
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: transcode
-              # Fork's real transcode temp path. RWX so a surviving pod reads the
-              # in-flight .ts/.m3u8 segments of the pod it takes over. A per-pod
-              # volume here silently breaks HA takeover.
-              mountPath: /config/transcodes
-            - name: cache
-              mountPath: /cache
-            - name: media
-              mountPath: /media
-              readOnly: true
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: jellyfin-config
-        - name: transcode
-          persistentVolumeClaim:
-            claimName: jellyfin-transcode
-        - name: media
-          persistentVolumeClaim:
-            claimName: jellyfin-media
-  volumeClaimTemplates:
-    # Per-pod scratch cache — RWO, disposable, one PVC per replica.
-    - metadata:
-        name: cache
-      spec:
-        accessModes:
-          - ReadWriteOnce
-        resources:
-          requests:
-            storage: 30Gi
-        storageClassName: cephrbd-fast-delete
-        volumeMode: Filesystem
@@ -19,13 +19,7 @@ spec:
  type: kv-v2
  vaultAuthRef: default
 ---
-# Config secret. Keys:
-#   secret_key         : Django SECRET_KEY (50+ random chars). One-time Vault seed.
-#   api_token_peppers  : JSON object {"1": "<50+ char random>"} used to HMAC-hash
-#                        v2 API tokens. One-time Vault seed — rotating a pepper
-#                        invalidates existing v2 tokens, so set it once.
-# VSO syncs every key at the path into the destination Secret, and the NetBox
-# chart mounts both keys from it (existingSecret) — no explicit key mapping needed.
+# Django SECRET_KEY (key: secret_key). One-time Vault seed.
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
 metadata:
@@ -4,8 +4,6 @@ metadata:
  annotations:
    configmap.reloader.stakater.com/auto: "true"
    secret.reloader.stakater.com/reload: "vault-ca-cert"
-    # Replace clears the stale, API-server-defaulted spec.strategy.rollingUpdate that SSA cannot drop, which otherwise makes Recreate invalid.
-    argocd.argoproj.io/sync-options: Replace=true
  labels:
    app.kubernetes.io/component: puppetserver
    app.kubernetes.io/instance: puppetserver
@@ -5,7 +5,7 @@ config:
  apiVersion: controller.config.cert-manager.io/v1alpha1
  kind: ControllerConfiguration
  enableGatewayAPI: true
-  acmeDNS01Config:
+  acmeDNS01:
    recursiveNameservers:
      - "8.8.8.8:53"
      - "1.1.1.1:53"
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/jellyfin
@@ -13,24 +13,13 @@ image:
 # Two web replicas for zero-downtime rollouts (media is RWX, see below).
 replicaCount: 2

-# Config secret. Must contain key: secret_key (Django SECRET_KEY). Also carries
-# api_token_peppers — a JSON object {"1": "<50+ char random>"} the chart mounts
-# (optional file) into API_TOKEN_PEPPERS; NetBox 4.6 refuses to save v2 tokens
-# without it. The chart only auto-generates a pepper when it creates this secret
-# itself, which it does NOT do while existingSecret is set — so the pepper is
-# seeded into Vault alongside secret_key (see base/vaultstaticsecret.yaml).
+# Django SECRET_KEY — existingSecret must contain key: secret_key.
 existingSecret: netbox-secret-key

 # Bootstrap superuser — existingSecret keys: username, password, email, api_token.
 superuser:
  existingSecret: netbox-superuser

-# Roll NetBox (web + worker) when the config secret changes, so a Vault-seeded
-# api_token_peppers (or a rotated secret_key) is picked up without a manual
-# restart. commonAnnotations lands on Deployment metadata, where reloader reads it.
-commonAnnotations:
-  secret.reloader.stakater.com/reload: netbox-secret-key
-
 # Disable the bundled Bitnami subcharts; we bring our own Postgres and Valkey.
 postgresql:
  enabled: false
@@ -5,7 +5,6 @@ kind: Kustomization
 resources:
  - aitooling.yaml
  - logging.yaml
-  - media.yaml
  - observability.yaml
  - platform.yaml
  - storage.yaml
@@ -1,31 +0,0 @@
---
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: media-apps
-  namespace: argocd
-spec:
-  generators:
-  - git:
-      repoURL: https://git.unkin.net/unkin/argocd-apps
-      revision: HEAD
-      directories:
-      - path: apps/overlays/*/jellyfin
-  template:
-    metadata:
-      name: 'media-{{path[3]}}'
-    spec:
-      project: media
-      source:
-        repoURL: https://git.unkin.net/unkin/argocd-apps
-        targetRevision: HEAD
-        path: '{{path}}'
-      destination:
-        server: https://kubernetes.default.svc
-        namespace: '{{path[3]}}'
-      syncPolicy:
-        automated:
-          prune: true
-          selfHeal: true
-        syncOptions:
-        - ServerSideApply=true
@@ -5,7 +5,6 @@ kind: Kustomization
 resources:
  - aitooling.yaml
  - logging.yaml
-  - media.yaml
  - observability.yaml
  - platform.yaml
  - storage.yaml
@@ -1,19 +0,0 @@
---
-apiVersion: argoproj.io/v1alpha1
-kind: AppProject
-metadata:
-  name: media
-  namespace: argocd
-spec:
-  description: Media services
-  sourceRepos:
-    - https://git.unkin.net/unkin/argocd-apps
-  destinations:
-    - namespace: 'jellyfin'
-      server: https://kubernetes.default.svc
-  clusterResourceWhitelist:
-    - group: ''
-      kind: Namespace
-  namespaceResourceWhitelist:
-    - group: '*'
-      kind: '*'
@@ -6,16 +6,6 @@ metadata:
  namespace: argocd
 data:
  kustomize.buildOptions: "--enable-helm"
-  # Kubernetes defaults apiVersion/kind onto every StatefulSet
-  # volumeClaimTemplates entry, but neither the raw manifests nor the helm
-  # charts emit them, so live StatefulSets carry TypeMeta that git lacks.
-  # volumeClaimTemplates are immutable on an existing StatefulSet, so ArgoCD
-  # can never reconcile the removal and the resource stays perpetually
-  # OutOfSync. Ignore the defaulted TypeMeta fleet-wide.
-  resource.customizations.ignoreDifferences.apps_StatefulSet: |
-    jqPathExpressions:
-      - '.spec.volumeClaimTemplates[]?.apiVersion'
-      - '.spec.volumeClaimTemplates[]?.kind'
  # External URL ArgoCD serves on (TLS terminated at the traefik-internal gateway).
  url: https://argocd.k8s.syd1.au.unkin.net
  # OIDC login via Authentik. The client secret is seeded in Vault out of band