Replace legacy jellyfin app with fafflix (adult, cheeztv pattern)

Rebuild the adult media instance as 'fafflix' following the same HA pattern
as the kids instance (cheeztv): Postgres-backed jellyfin-ha fork, Valkey
transcode-lease store, shared-RWX transcode, CNPG + k8up/restic backups,
static CephFS media PVs.

- Add apps/base/fafflix (namespace/labels/secrets/buckets/Vault path fafflix-*)
- fafflix mounts the shared movies/tv subvolumes' adult subtree at
  /media/{movies,tv} plus the kids subtree at /media/{movies,tv}-kids so it can
  resume kids content started on cheeztv; new unique static PV volumeHandles
- Keep serving the legacy hostname jellyfin.k8s.syd1.au.unkin.net (fafflix-tls);
  dedicated fafflix domain deferred, no new public host
- config PVC on cephfs-raid5-delete
- Remove apps/base/jellyfin + overlay; swap jellyfin->fafflix in the media
  ApplicationSet glob and AppProject namespace destination
- No data currently on the adult instance, so the wipe/replace is sanctioned

apps/base/arrstack/arrproxy/api-deployment.yaml

@@ -5,12 +5,9 @@ metadata:
   name: arrproxy-api
   namespace: arrstack
   annotations:
-    # Wave 2: start only after the wave-0 CNPG Cluster and VSO-synced Secrets
-    # exist. The api self-migrates at startup under a Postgres advisory lock and
-    # holds /readyz until the schema is current, so no migration ordering is needed.
+    # Wave 2: serve only after the wave-1 migrate Job completes.
     argocd.argoproj.io/sync-wave: "2"
-    secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-admin-token,arrproxy-db-app,sonarr-adult-apikey,radarr-adult-apikey,sonarr-kids-apikey,radarr-kids-apikey"
-    configmap.reloader.stakater.com/reload: "arrproxy-tiers"
+    secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-admin-token,arrproxy-db-app,sonarr-apikey,radarr-apikey,prowlarr-apikey"
 spec:
   replicas: 2
   selector:
@@ -36,7 +33,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.6.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.3.1
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080
@@ -52,18 +49,11 @@ spec:
             # reaches this upstream) so group-based authorization works.
             - name: ARRPROXY_GROUPS_HEADER
               value: X-Forwarded-Groups
-            # Real per-app *arr keys, projected one file per app under a per-tier
-            # subdir (<keyDir>/<app>) matching the tiers file: adult/{sonarr,radarr}
-            # and kids/{sonarr,radarr}. Sourced from the same <instance>-apikey
-            # Secrets the *arr Deployments consume. The api injects them server-side
-            # and redacts them from every proxied response.
+            # Real per-app *arr keys, projected one file per app under this dir
+            # (sourced from the existing <app>-apikey Secrets). The api injects
+            # them server-side and redacts them from every proxied response.
             - name: ARRPROXY_KEYS_DIR
               value: /etc/arrproxy/keys
-            # Tier topology (fafflix/cheeztv): upstreams, route hashes, key subdirs
-            # and group grants. Legacy unprefixed routes are retired in the file
-            # (legacyRoutes:false); see arrproxy-tiers ConfigMap.
-            - name: ARRPROXY_TIERS_FILE
-              value: /etc/arrproxy/tiers/tiers.json
             - name: ARRPROXY_PEPPER
               valueFrom:
                 secretKeyRef:
@@ -96,9 +86,6 @@ spec:
             - name: arr-keys
               mountPath: /etc/arrproxy/keys
               readOnly: true
-            - name: tiers
-              mountPath: /etc/arrproxy/tiers
-              readOnly: true
             - name: tmp
               mountPath: /tmp
           livenessProbe:
@@ -131,37 +118,27 @@ spec:
               cpu: "1"
               memory: 512Mi
       volumes:
-        # Real per-tier *arr API keys, projected as <keyDir>/<app> so the api
-        # reads /etc/arrproxy/keys/{adult,kids}/{sonarr,radarr} (matching the
-        # tiers file keyDir). Reuses the same <instance>-apikey Secrets the *arr
-        # Deployments already consume (seeded by their VaultStaticSecrets).
+        # Real *arr API keys, one file per app named exactly <app> so the api
+        # reads /etc/arrproxy/keys/{sonarr,radarr,prowlarr}. Reuses the same
+        # <app>-apikey Secrets the *arr Deployments already consume.
         - name: arr-keys
           projected:
             sources:
               - secret:
-                  name: sonarr-adult-apikey
+                  name: sonarr-apikey
                   items:
                     - key: apitoken
-                      path: adult/sonarr
+                      path: sonarr
               - secret:
-                  name: radarr-adult-apikey
+                  name: radarr-apikey
                   items:
                     - key: apitoken
-                      path: adult/radarr
+                      path: radarr
               - secret:
-                  name: sonarr-kids-apikey
+                  name: prowlarr-apikey
                   items:
                     - key: apitoken
-                      path: kids/sonarr
-              - secret:
-                  name: radarr-kids-apikey
-                  items:
-                    - key: apitoken
-                      path: kids/radarr
-        # Tier topology JSON (ARRPROXY_TIERS_FILE).
-        - name: tiers
-          configMap:
-            name: arrproxy-tiers
+                      path: prowlarr
         - name: tmp
           emptyDir:
             sizeLimit: 64Mi

apps/base/arrstack/arrproxy/gateway.yaml

@@ -1,11 +1,9 @@
 ---
 # External (DMZ) front for the arrstack, served on arrstack.unkin.net via the
-# external Traefik (LB VIP 198.18.199.0). The apex arrstack.unkin.net A record
-# lives in the bind-operator unkin.net zone (bind-internal/authoritative), NOT
-# external-dns, so no external-dns annotation here. Public TLS is terminated with
-# the real Let's Encrypt *.unkin.net wildcard, centrally minted once in the
-# cert-manager namespace (Certificate wildcard-unkin-net) and reflected into this
-# namespace by the emberstack reflector as wildcard-unkin-net-tls, not Vault PKI.
+# external Traefik (LB VIP 198.18.199.0). cert-manager mints arrproxy-gateway-tls
+# (CN arrstack.unkin.net) off the internal Vault-PKI CA. The apex arrstack.unkin.net
+# A record lives in the bind-operator unkin.net zone (bind-internal/authoritative),
+# NOT external-dns, so no external-dns annotation here.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -13,6 +11,9 @@ metadata:
     traefik.io/instance: external
   annotations:
     argocd.argoproj.io/sync-wave: "2"
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: arrstack.unkin.net
+    cert-manager.io/private-key-size: "4096"
   name: arrproxy
   namespace: arrstack
 spec:
@@ -37,4 +38,4 @@ spec:
         certificateRefs:
           - group: ""
             kind: Secret
-            name: wildcard-unkin-net-tls
+            name: arrproxy-gateway-tls

apps/base/arrstack/arrproxy/kustomization.yaml

@@ -5,8 +5,9 @@ kind: Kustomization
 resources:
   - cnpg_cluster.yaml
   - cnpg_backup.yaml
+  - migrations-configmap.yaml
+  - migrate-job.yaml
   - vaultstaticsecret.yaml
-  - tiers-configmap.yaml
   - oauth2-proxy-configmap.yaml
   - oauth2-proxy-deployment.yaml
   - api-deployment.yaml

apps/base/arrstack/arrproxy/migrate-job.yaml

@@ -0,0 +1,92 @@
+---
+# Applies the arrproxy schema once per sync, before the api rolls, so the serve
+# replicas never race migrations (arrproxy-api does not self-migrate). Runs as the
+# CNPG-minted app user so the tokens table is owned by that role.
+#
+# Sync-phase hook at wave 1 (NOT PreSync): the CNPG Cluster + generated
+# arrproxy-db-app Secret apply at wave 0 and ArgoCD waits for the Cluster to be
+# Healthy before starting wave 1, so Postgres exists before migrate connects.
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: arrproxy-migrate
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  backoffLimit: 6
+  ttlSecondsAfterFinished: 600
+  template:
+    metadata:
+      labels:
+        app: arrproxy-migrate
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: migrate
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:18-alpine
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: HOME
+              value: /tmp
+            - name: PGUSER
+              valueFrom:
+                secretKeyRef:
+                  name: arrproxy-db-app
+                  key: username
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: arrproxy-db-app
+                  key: password
+            - name: PGHOST
+              value: arrproxy-db-rw.arrstack.svc.cluster.local
+            - name: PGPORT
+              value: "5432"
+            - name: PGDATABASE
+              value: arrproxy
+            - name: PGSSLMODE
+              value: require
+          command:
+            - psql
+            - -v
+            - ON_ERROR_STOP=1
+            - -f
+            - /migrations/0001_init.sql
+          volumeMounts:
+            - name: migrations
+              mountPath: /migrations
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+      volumes:
+        - name: migrations
+          configMap:
+            name: arrproxy-migrations
+        - name: tmp
+          emptyDir:
+            sizeLimit: 64Mi

apps/base/arrstack/arrproxy/migrations-configmap.yaml

@@ -0,0 +1,29 @@
+---
+# arrproxy schema, mirrored from the arrproxy repo migrations/0001_init.sql
+# (v0.1.0). arrproxy-api does NOT self-migrate, so the wave-1 migrate Job applies
+# this once per sync as the app user. Keep in sync with the repo on schema bumps.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: arrproxy-migrations
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+data:
+  0001_init.sql: |
+    -- arrproxy token store. Only token hashes are persisted; plaintext is shown
+    -- once at mint time and never recoverable.
+    CREATE TABLE IF NOT EXISTS tokens (
+        id           TEXT PRIMARY KEY,
+        subject      TEXT        NOT NULL,
+        label        TEXT        NOT NULL DEFAULT '',
+        token_hash   TEXT        NOT NULL UNIQUE,
+        apps         TEXT[]      NOT NULL DEFAULT '{}',
+        created_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
+        expires_at   TIMESTAMPTZ,
+        disabled     BOOLEAN     NOT NULL DEFAULT false,
+        last_used_at TIMESTAMPTZ
+    );
+
+    CREATE INDEX IF NOT EXISTS tokens_subject_idx ON tokens (subject);
+    CREATE INDEX IF NOT EXISTS tokens_token_hash_idx ON tokens (token_hash);

apps/base/arrstack/arrproxy/oauth2-proxy-configmap.yaml

@@ -21,11 +21,9 @@ data:
   # application (terraform-authentik PR #18).
   OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/arrstack/"
   OAUTH2_PROXY_REDIRECT_URL: "https://arrstack.unkin.net/oauth2/callback"
-  # Longest-prefix wins: /api and the per-tier hash routes (/3aa168, /3df803) go
-  # to arrproxy-api, everything else (the SPA + static assets) to arrproxy-ui.
-  # Tier routes carry /<hash>/<app>/...; the bare /sonarr /radarr /prowlarr
-  # upstreams are retired (legacy routes off; prowlarr is served directly).
-  OAUTH2_PROXY_UPSTREAMS: "http://arrproxy-ui.arrstack.svc.cluster.local:8080/,http://arrproxy-api.arrstack.svc.cluster.local:8080/api/,http://arrproxy-api.arrstack.svc.cluster.local:8080/3aa168/,http://arrproxy-api.arrstack.svc.cluster.local:8080/3df803/"
+  # Longest-prefix wins: /api and /<app> go to arrproxy-api, everything else
+  # (the SPA + static assets) to arrproxy-ui.
+  OAUTH2_PROXY_UPSTREAMS: "http://arrproxy-ui.arrstack.svc.cluster.local:8080/,http://arrproxy-api.arrstack.svc.cluster.local:8080/api/,http://arrproxy-api.arrstack.svc.cluster.local:8080/sonarr/,http://arrproxy-api.arrstack.svc.cluster.local:8080/radarr/,http://arrproxy-api.arrstack.svc.cluster.local:8080/prowlarr/"
   OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
   # Populate session.Groups from the Authentik ak_groups claim; pass-user-headers
   # then emits it as a single comma-joined X-Forwarded-Groups header.
@@ -35,16 +33,14 @@ data:
   # set-xauthrequest is intentionally NOT set -- it only populates auth_request
   # *response* headers, which never reach an --upstreams-proxied backend.
   OAUTH2_PROXY_PASS_USER_HEADERS: "true"
-  # Bypass auth for the tier *arr proxy API (/<hash>/<app>/api...) and the
-  # machine-mint admin route (/api/admin/...). The first matches
-  # /3aa168/sonarr/api (two path segments before /api, since tier routes are
-  # hash-prefixed); the second matches /api/admin/ only -- both routed to the
-  # arrproxy-api upstream by the tier and catch-all /api/ prefixes above.
-  # /api/admin/ is protected by arrproxy's OWN ARRPROXY_ADMIN_TOKEN bearer
-  # (OpenBao on the VMs reaches it via the ingress), so it is intentionally
-  # oauth-skipped. /api/tokens and /api/me are NOT matched and stay
-  # oauth-authenticated.
-  OAUTH2_PROXY_SKIP_AUTH_REGEX: "^/[^/]+/[^/]+/api,^/api/admin/"
+  # Bypass auth for the *arr proxy API (/<app>/api...) and the machine-mint
+  # admin route (/api/admin/...). The first matches /sonarr/api; the second
+  # matches /api/admin/ only -- both routed to the arrproxy-api upstream by the
+  # catch-all /api/ prefix above. /api/admin/ is protected by arrproxy's OWN
+  # ARRPROXY_ADMIN_TOKEN bearer (OpenBao on the VMs reaches it via the ingress),
+  # so it is intentionally oauth-skipped. /api/tokens and /api/me are NOT
+  # matched and stay oauth-authenticated.
+  OAUTH2_PROXY_SKIP_AUTH_REGEX: "^/[^/]+/api,^/api/admin/"
   OAUTH2_PROXY_EMAIL_DOMAINS: "*"
   # Authentik hardcodes email_verified=false in the id_token; without this
   # oauth2-proxy rejects the session ("email ... isn't verified") -> 500 on

apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml

@@ -35,7 +35,7 @@ spec:
         # identity.unkin.net serves a Vault-PKI cert; combine the system roots
         # with the internal CA so oauth2-proxy's OIDC HTTP client trusts it.
         - name: combine-certs
-          image: docker.io/library/alpine:3
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3
           imagePullPolicy: IfNotPresent
           command:
             - sh

apps/base/arrstack/arrproxy/tiers-configmap.yaml

@@ -1,53 +0,0 @@
----
-# arrproxy v0.4.0 tier topology (ARRPROXY_TIERS_FILE). Two isolated instance
-# tiers, each with its own *arr backends, real-key subdir, and group grants:
-#   fafflix (adult, /3aa168/*) and cheeztv (kids, /3df803/*).
-# arrproxy strips the /<hash> route prefix and proxies "/<app>/..." upstream, so
-# each app's upstream URL carries the "/<hash>" path segment: the joined upstream
-# path (/3aa168/sonarr/...) then matches the *arr's own UrlBase (/3aa168/sonarr).
-# Access: the adult group reaches BOTH tiers with any method; the kids group
-# reaches ONLY the cheeztv tier and only GET/HEAD. Groups arrive on the
-# hierarchical Authentik ak_groups claim, forwarded by oauth2-proxy as
-# X-Forwarded-Groups. Legacy unprefixed routes are retired (legacyRoutes:false);
-# the old bare sonarr/radarr Services no longer exist.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: arrproxy-tiers
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-data:
-  tiers.json: |
-    {
-      "legacyTier": "fafflix",
-      "legacyRoutes": false,
-      "tiers": [
-        {
-          "name": "fafflix",
-          "hash": "3aa168",
-          "keyDir": "adult",
-          "grants": [
-            { "group": "akP-media-fafflix" }
-          ],
-          "apps": [
-            { "name": "sonarr", "upstream": "http://sonarr-adult.arrstack.svc.cluster.local:8989/3aa168", "urlBase": "/3aa168/sonarr" },
-            { "name": "radarr", "upstream": "http://radarr-adult.arrstack.svc.cluster.local:7878/3aa168", "urlBase": "/3aa168/radarr" }
-          ]
-        },
-        {
-          "name": "cheeztv",
-          "hash": "3df803",
-          "keyDir": "kids",
-          "readOnly": true,
-          "grants": [
-            { "group": "akP-media-fafflix" },
-            { "group": "akP-media-cheeztv", "methods": ["GET", "HEAD"] }
-          ],
-          "apps": [
-            { "name": "sonarr", "upstream": "http://sonarr-kids.arrstack.svc.cluster.local:8989/3df803", "urlBase": "/3df803/sonarr" },
-            { "name": "radarr", "upstream": "http://radarr-kids.arrstack.svc.cluster.local:7878/3df803", "urlBase": "/3df803/radarr" }
-          ]
-        }
-      ]
-    }

apps/base/arrstack/arrproxy/ui-deployment.yaml

@@ -31,7 +31,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: ui
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-ui:v0.6.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-ui:v0.3.1
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

apps/base/arrstack/kustomization.yaml

@@ -8,22 +8,19 @@ resources:
   - pv-media-tv.yaml
   - pv-media-movies.yaml
   - pv-mediafs.yaml
-  - pv-mediastore.yaml
   - pvc-media-tv.yaml
   - pvc-media-movies.yaml
   - pvc-mediafs.yaml
-  - pvc-mediastore.yaml
-  - mediastore-bootstrap-job.yaml
   - media-bucket.yaml
   - backups-bucket.yaml
   - postgres
   - valkey
+  - sonarr
+  - radarr
   - prowlarr
+  - nzbget
   - sonarr-kids
   - radarr-kids
   - nzbget-kids
-  - sonarr-adult
-  - radarr-adult
-  - nzbget-adult
   - arrproxy
   - mediamover

apps/base/arrstack/mediastore-bootstrap-job.yaml

@@ -1,74 +0,0 @@
----
-# Seeds the directory skeleton on the freshly created mediastore subvolume so
-# the arrs, nzbget and both jellyfins mount subPaths that already exist and are
-# owned by uid/gid 1000 (the uid every arrstack media pod runs as). mkdir -p is
-# idempotent, so re-running it on every sync is harmless and self-heals a tree
-# someone deleted by hand.
-#
-# Sync hook with BeforeHookCreation delete: ArgoCD replaces the completed Job
-# each sync instead of failing on the immutable pod template. No sync-wave is
-# needed -- the PVC applies in the same wave and the pod simply stays Pending
-# until it binds.
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: mediastore-bootstrap
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/hook: Sync
-    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
-spec:
-  backoffLimit: 6
-  ttlSecondsAfterFinished: 600
-  template:
-    metadata:
-      labels:
-        app: mediastore-bootstrap
-    spec:
-      serviceAccountName: default
-      automountServiceAccountToken: false
-      restartPolicy: Never
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-        fsGroupChangePolicy: OnRootMismatch
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: mkdir
-          image: docker.io/library/alpine:3
-          imagePullPolicy: IfNotPresent
-          command:
-            - sh
-            - -c
-            - |
-              set -eu
-              mkdir -p \
-                /media/fafflix/tvseries \
-                /media/fafflix/movies \
-                /media/cheeztv/tvseries \
-                /media/cheeztv/movies \
-                /media/nzbget/downloads/complete
-              ls -la /media
-          volumeMounts:
-            - name: mediastore
-              mountPath: /media
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 128Mi
-      volumes:
-        - name: mediastore
-          persistentVolumeClaim:
-            claimName: mediastore

apps/base/arrstack/nzbget-adult/pvc-config.yaml

@@ -1,16 +0,0 @@
----
-# NZBGet (adult) config + queue/temp state. RWO on cephrbd (block, fast-delete).
-# The download data itself lives on the shared media PVCs, not here.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: nzbget-adult-config
-  namespace: arrstack
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephrbd-fast-delete
-  volumeMode: Filesystem

apps/base/arrstack/nzbget/deployment.yaml

@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: nzbget-adult
+  name: nzbget
   namespace: arrstack
 spec:
   replicas: 1
@@ -11,25 +11,25 @@ spec:
     type: Recreate
   selector:
     matchLabels:
-      app: nzbget-adult
+      app: nzbget
   template:
     metadata:
       labels:
-        app: nzbget-adult
+        app: nzbget
     spec:
       securityContext:
         fsGroup: 1000
         fsGroupChangePolicy: OnRootMismatch
       initContainers:
-        # Seed download layout onto the adult media subtrees (not /config or an
-        # emptyDir) so completed adult downloads land beside the adult arr libraries
-        # and imports are same-filesystem hardlink moves. The media mounts use the
-        # tvshows/adult and movies/adult subPaths, so the in-container paths match
-        # the kids nzbget while the data stays scoped to the adult subtree. Reuses
-        # the image's own template and appends the path/category overrides once;
-        # the grep guard keeps re-runs idempotent so admin UI edits survive.
+        # Seed download layout onto the shared media PVCs (not /config or an
+        # emptyDir) so completed downloads land beside the arr libraries and
+        # imports are same-filesystem hardlink moves. Reuses the image's own
+        # template (inherits correct WebDir/ConfigTemplate) and appends the
+        # path/category overrides once; nzbget honours the last value for a
+        # repeated option, and the grep guard keeps re-runs idempotent so admin
+        # UI edits to the persisted /config/nzbget.conf survive restarts.
         - name: seed-config
-          image: docker.io/linuxserver/nzbget:version-v26.2
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/nzbget:version-v26.2
           command:
             - sh
             - -c
@@ -42,12 +42,11 @@ spec:
                 cat >> /config/nzbget.conf << 'CONF'
 
               # arrstack-managed download layout (appended once; last value wins).
-              # Downloads land on the shared media PVCs by category so sonarr-adult/
-              # radarr-adult import with atomic hardlink moves (download dir +
-              # library share one filesystem per media type). InterDir is empty:
-              # nzbget writes each download straight into its category DestDir, so
-              # BOTH tv and movies stay on their own PVC with no cross-filesystem
-              # intermediate copy.
+              # Downloads land on the shared media PVCs by category so sonarr/radarr
+              # import with atomic hardlink moves (download dir + library share one
+              # filesystem per media type). InterDir is empty: nzbget writes each
+              # download straight into its category DestDir, so BOTH tv and movies
+              # stay on their own PVC with no cross-filesystem intermediate copy.
               MainDir=/media/tv
               InterDir=
               DestDir=/media/tv/downloads
@@ -78,13 +77,11 @@ spec:
               mountPath: /config
             - name: media-tv
               mountPath: /media/tv
-              subPath: tvshows/adult
             - name: media-movies
               mountPath: /media/movies
-              subPath: movies/adult
       containers:
         - name: nzbget
-          image: docker.io/linuxserver/nzbget:version-v26.2
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/nzbget:version-v26.2
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
@@ -126,14 +123,12 @@ spec:
               mountPath: /config
             - name: media-tv
               mountPath: /media/tv
-              subPath: tvshows/adult
             - name: media-movies
               mountPath: /media/movies
-              subPath: movies/adult
       volumes:
         - name: config
           persistentVolumeClaim:
-            claimName: nzbget-adult-config
+            claimName: nzbget-config
         - name: media-tv
           persistentVolumeClaim:
             claimName: media-tv

apps/base/arrstack/nzbget/gateway.yaml

@@ -1,5 +1,4 @@
 ---
-# Internal front for mediamark (cf. watchstate).
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -7,26 +6,26 @@ metadata:
     traefik.io/instance: internal
   annotations:
     cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: mediamark.k8s.syd1.au.unkin.net
+    cert-manager.io/common-name: nzbget.k8s.syd1.au.unkin.net
     cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: mediamark.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/hostname: nzbget.k8s.syd1.au.unkin.net
     external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: mediamark
-  namespace: mediamark
+  name: nzbget
+  namespace: arrstack
 spec:
   gatewayClassName: traefik-internal
   listeners:
     - allowedRoutes:
         namespaces:
           from: Same
-      hostname: mediamark.k8s.syd1.au.unkin.net
+      hostname: nzbget.k8s.syd1.au.unkin.net
       name: http
       port: 80
       protocol: HTTP
     - allowedRoutes:
         namespaces:
           from: Same
-      hostname: mediamark.k8s.syd1.au.unkin.net
+      hostname: nzbget.k8s.syd1.au.unkin.net
       name: https
       port: 443
       protocol: HTTPS
@@ -34,5 +33,5 @@ spec:
         certificateRefs:
           - group: ""
             kind: Secret
-            name: mediamark-tls
+            name: nzbget-tls
         mode: Terminate

apps/base/arrstack/nzbget/httproute.yaml

@@ -2,15 +2,15 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: mediamark-http-redirect
-  namespace: mediamark
+  name: nzbget-http-redirect
+  namespace: arrstack
 spec:
   hostnames:
-    - mediamark.k8s.syd1.au.unkin.net
+    - nzbget.k8s.syd1.au.unkin.net
   parentRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
-      name: mediamark
+      name: nzbget
       sectionName: http
   rules:
     - filters:
@@ -26,22 +26,22 @@ spec:
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: mediamark
-  namespace: mediamark
+  name: nzbget-route
+  namespace: arrstack
 spec:
   hostnames:
-    - mediamark.k8s.syd1.au.unkin.net
+    - nzbget.k8s.syd1.au.unkin.net
   parentRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
-      name: mediamark
+      name: nzbget
       sectionName: https
   rules:
     - backendRefs:
         - group: ""
           kind: Service
-          name: mediamark-oauth2
-          port: 4180
+          name: nzbget
+          port: 6789
           weight: 1
       matches:
         - path:

apps/base/arrstack/nzbget/kustomization.yaml

@@ -6,3 +6,5 @@ resources:
   - pvc-config.yaml
   - deployment.yaml
   - service.yaml
+  - gateway.yaml
+  - httproute.yaml

apps/base/arrstack/nzbget/pvc-config.yaml

@@ -0,0 +1,16 @@
+---
+# NZBGet config + queue/temp state. RWO on cephrbd (block). Retain: this is
+# state. The download data itself lives on the shared media PVCs, not here.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nzbget-config
+  namespace: arrstack
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: cephrbd-fast-retain
+  volumeMode: Filesystem

apps/base/arrstack/nzbget/service.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: nzbget-adult
+  name: nzbget
   namespace: arrstack
 spec:
   ports:
@@ -11,5 +11,5 @@ spec:
       protocol: TCP
       targetPort: http
   selector:
-    app: nzbget-adult
+    app: nzbget
   type: ClusterIP

apps/base/arrstack/postgres/cnpg_cluster.yaml

@@ -50,6 +50,30 @@ spec:
       owner: app
   managed:
     roles:
+      - name: sonarr
+        ensure: present
+        comment: Sonarr application role (owns sonarr-main)
+        login: true
+        superuser: false
+        createdb: false
+        createrole: false
+        inherit: true
+        replication: false
+        connectionLimit: -1
+        passwordSecret:
+          name: sonarr-db
+      - name: radarr
+        ensure: present
+        comment: Radarr application role (owns radarr-main)
+        login: true
+        superuser: false
+        createdb: false
+        createrole: false
+        inherit: true
+        replication: false
+        connectionLimit: -1
+        passwordSecret:
+          name: radarr-db
       - name: prowlarr
         ensure: present
         comment: Prowlarr application role (owns prowlarr-main)
@@ -86,30 +110,6 @@ spec:
         connectionLimit: -1
         passwordSecret:
           name: radarr-kids-db
-      - name: sonarr-adult
-        ensure: present
-        comment: Sonarr (adult) application role (owns sonarr-adult-main)
-        login: true
-        superuser: false
-        createdb: false
-        createrole: false
-        inherit: true
-        replication: false
-        connectionLimit: -1
-        passwordSecret:
-          name: sonarr-adult-db
-      - name: radarr-adult
-        ensure: present
-        comment: Radarr (adult) application role (owns radarr-adult-main)
-        login: true
-        superuser: false
-        createdb: false
-        createrole: false
-        inherit: true
-        replication: false
-        connectionLimit: -1
-        passwordSecret:
-          name: radarr-adult-db
   enablePDB: true
   enableSuperuserAccess: false
   failoverDelay: 0

apps/base/arrstack/postgres/database-radarr-adult.yaml

@@ -1,15 +0,0 @@
----
-# Per-app database owned by the radarr-adult managed role. The fork's provider
-# runs its own schema migrations on first start (advisory-locked, so only one
-# replica migrates). retain: the database survives a Database CRD delete.
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: radarr-adult-main
-  namespace: arrstack
-spec:
-  cluster:
-    name: arrstack-postgres
-  name: radarr-adult-main
-  owner: radarr-adult
-  databaseReclaimPolicy: retain

apps/base/arrstack/postgres/database-radarr.yaml

@@ -0,0 +1,15 @@
+---
+# Per-app database owned by the radarr managed role. The fork's provider runs its
+# own schema migrations on first start (advisory-locked, so only one replica
+# migrates). retain: the database survives a Database CRD delete.
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: radarr-main
+  namespace: arrstack
+spec:
+  cluster:
+    name: arrstack-postgres
+  name: radarr-main
+  owner: radarr
+  databaseReclaimPolicy: retain

apps/base/arrstack/postgres/database-sonarr-adult.yaml

@@ -1,15 +0,0 @@
----
-# Per-app database owned by the sonarr-adult managed role. The fork's provider
-# runs its own schema migrations on first start (advisory-locked, so only one
-# replica migrates). retain: the database survives a Database CRD delete.
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: sonarr-adult-main
-  namespace: arrstack
-spec:
-  cluster:
-    name: arrstack-postgres
-  name: sonarr-adult-main
-  owner: sonarr-adult
-  databaseReclaimPolicy: retain

apps/base/arrstack/postgres/database-sonarr.yaml

@@ -0,0 +1,15 @@
+---
+# Per-app database owned by the sonarr managed role. The fork's provider runs its
+# own schema migrations on first start (advisory-locked, so only one replica
+# migrates). retain: the database survives a Database CRD delete.
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: sonarr-main
+  namespace: arrstack
+spec:
+  cluster:
+    name: arrstack-postgres
+  name: sonarr-main
+  owner: sonarr
+  databaseReclaimPolicy: retain

apps/base/arrstack/postgres/kustomization.yaml

@@ -6,8 +6,8 @@ resources:
   - vaultstaticsecret.yaml
   - cnpg_cluster.yaml
   - cnpg_backup.yaml
+  - database-sonarr.yaml
+  - database-radarr.yaml
   - database-prowlarr.yaml
   - database-sonarr-kids.yaml
   - database-radarr-kids.yaml
-  - database-sonarr-adult.yaml
-  - database-radarr-adult.yaml

apps/base/arrstack/postgres/vaultstaticsecret.yaml

@@ -10,6 +10,40 @@
 # (wave 1) reconciles the roles.
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
+metadata:
+  name: sonarr-db
+  namespace: arrstack
+spec:
+  destination:
+    create: true
+    name: sonarr-db
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/sonarr-db
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: radarr-db
+  namespace: arrstack
+spec:
+  destination:
+    create: true
+    name: radarr-db
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/radarr-db
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
 metadata:
   name: prowlarr-db
   namespace: arrstack
@@ -58,37 +92,3 @@ spec:
   refreshAfter: 5m
   type: kv-v2
   vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: sonarr-adult-db
-  namespace: arrstack
-spec:
-  destination:
-    create: true
-    name: sonarr-adult-db
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/sonarr-adult-db
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: radarr-adult-db
-  namespace: arrstack
-spec:
-  destination:
-    create: true
-    name: radarr-adult-db
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/radarr-adult-db
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/arrstack/pv-mediastore.yaml

@@ -1,32 +0,0 @@
----
-# Static PV for the shared MEDIASTORE CephFS subvolume: one 10Ti filesystem
-# holding every library plus the nzbget download tree, so arr imports are
-# same-filesystem hardlink moves across tv AND movies. Same rootPath as the
-# fafflix/cheeztv mediastore PVs; each namespace gets its own PV (unique name +
-# volumeHandle) pinned by claimRef.
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: arrstack-mediastore
-spec:
-  capacity:
-    storage: 10Ti
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: ""
-  volumeMode: Filesystem
-  claimRef:
-    namespace: arrstack
-    name: mediastore
-  csi:
-    driver: cephfs.csi.ceph.com
-    volumeHandle: arrstack-mediastore-static
-    nodeStageSecretRef:
-      name: csi-cephfs-secret
-      namespace: csi-cephfs
-    volumeAttributes:
-      staticVolume: "true"
-      clusterID: cephfs_csi_ssd_ec_4_1
-      fsName: cephfs
-      rootPath: /volumes/csi_ssd_ec_4_1/mediastore/a0152dac-a51b-4b95-ac5e-ecdd99bfe3f1

apps/base/arrstack/pvc-mediastore.yaml

@@ -1,22 +0,0 @@
----
-# Whole media tree (/fafflix, /cheeztv, /nzbget) on one RWX filesystem, shared
-# across the sonarr/radarr/nzbget pods. Statically bound to the
-# arrstack-mediastore PV (the same CephFS subvolume fafflix and cheeztv mount).
-# storageClassName "" + volumeName disables dynamic provisioning and binds the
-# pre-created static PV.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: mediastore
-  namespace: arrstack
-  annotations:
-    k8up.io/backup: "false"
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Ti
-  storageClassName: ""
-  volumeName: arrstack-mediastore
-  volumeMode: Filesystem

apps/base/arrstack/radarr-adult/configmap.yaml

@@ -1,25 +0,0 @@
----
-# Non-secret env for the -unkin2 fork (adult tier). Identical mechanism to the
-# kids radarr, pointed at its own shared-Postgres database (radarr-adult-main)
-# and its own UrlBase (/3aa168/radarr) so arrproxy path-routing reaches the adult
-# instance separately. Shares the one arrstack Valkey (keys namespaced by the
-# fork's radarr:ratelimit: prefix). User/Password/ApiKey come from Secrets (see
-# deployment.yaml), not here.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: radarr-adult-env
-  namespace: arrstack
-data:
-  Radarr__Postgres__Host: arrstack-postgres-rw.arrstack.svc.cluster.local
-  Radarr__Postgres__Port: "5432"
-  Radarr__Postgres__MainDb: radarr-adult-main
-  Radarr__Log__DbEnabled: "false"
-  Radarr__Auth__Method: External
-  Radarr__Auth__Required: DisabledForLocalAddresses
-  Radarr__App__InstanceName: Radarr
-  Radarr__Server__Port: "7878"
-  Radarr__Server__UrlBase: /3aa168/radarr
-  Radarr__Update__Mechanism: External
-  Radarr__Redis__Host: valkey-arrstack-valkey.arrstack.svc.cluster.local
-  Radarr__Redis__Port: "6379"

apps/base/arrstack/radarr-adult/vaultstaticsecret.yaml

@@ -1,25 +0,0 @@
----
-# radarr-adult API key. Seeded out-of-band at
-# kv/kubernetes/namespace/arrstack/default/radarr-adult (key: apitoken); the
-# default k8s role's templated policy already grants read on
-# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
-# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
-# syncs it into the radarr-adult-apikey Secret consumed by the Deployment.
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: radarr-adult-apikey
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  destination:
-    create: true
-    name: radarr-adult-apikey
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/radarr-adult
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/arrstack/radarr/configmap.yaml

@@ -0,0 +1,33 @@
+---
+# Non-secret env for the -unkin2 fork. The fork reads Servarr config from
+# Radarr__<Section>__<Key> env (no config.xml edits, no s6/PUID). Postgres wiring
+# points every replica at the same shared DB (arrstack-postgres-rw / radarr-main);
+# Auth__Method=External defers UI auth to arrproxy/oauth2-proxy; Server__UrlBase
+# keeps the /radarr prefix so arrproxy path-routing works; App__InstanceName is
+# identical across replicas (shared session-cookie name). User/Password/ApiKey
+# come from Secrets (see deployment.yaml), not here.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: radarr-env
+  namespace: arrstack
+data:
+  Radarr__Postgres__Host: arrstack-postgres-rw.arrstack.svc.cluster.local
+  Radarr__Postgres__Port: "5432"
+  Radarr__Postgres__MainDb: radarr-main
+  Radarr__Log__DbEnabled: "false"
+  Radarr__Auth__Method: External
+  Radarr__Auth__Required: DisabledForLocalAddresses
+  Radarr__App__InstanceName: Radarr
+  Radarr__Server__Port: "7878"
+  Radarr__Server__UrlBase: /radarr
+  Radarr__Update__Mechanism: External
+  # Shared arrstack Valkey (valkey-operator). Setting Host is what activates the
+  # fork's #14 Redis features (SignalR backplane, cross-replica cache-invalidation
+  # bus, distributed rate limiter): RedisOptions.IsConfigured gates purely on a
+  # non-empty Host, so there is no separate Enabled flag. The operator leaves the
+  # default user passwordless (jellyfin parity), so no Password/Ssl is wired.
+  # Channels/keys are namespaced by this fork's radarr:ratelimit: prefix, so the
+  # one cluster is safe to share with sonarr/prowlarr.
+  Radarr__Redis__Host: valkey-arrstack-valkey.arrstack.svc.cluster.local
+  Radarr__Redis__Port: "6379"

apps/base/arrstack/radarr/deployment.yaml

@@ -2,40 +2,43 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: radarr-adult
+  name: radarr
   namespace: arrstack
   annotations:
-    # Reloader rolls the Deployment when radarr-adult-env changes (plain envFrom
-    # ConfigMap does not trigger a rollout on its own).
+    # radarr-env is a plain (unhashed) ConfigMap consumed by fixed-name envFrom,
+    # so editing it does not roll the Deployment on its own. Reloader watches the
+    # referenced ConfigMap and triggers a rolling restart on change, so adding the
+    # Redis env activates the #14 features on the next ArgoCD sync without a manual
+    # `rollout restart`.
     configmap.reloader.stakater.com/auto: "true"
 spec:
   # Active-active: the -unkin2 fork keeps all state in the shared Postgres
   # (arrstack-postgres) and coordinates via Postgres advisory locks, so N
-  # replicas run concurrently behind the radarr-adult Service. RollingUpdate is
-  # safe — no SQLite, no RWO lock.
+  # replicas run concurrently behind the radarr Service. RollingUpdate is safe —
+  # no SQLite, no RWO lock.
   replicas: 3
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app: radarr-adult
+      app: radarr
   template:
     metadata:
       labels:
-        app: radarr-adult
+        app: radarr
     spec:
       securityContext:
-        # Fork image has no USER; pin it to a non-root UID and group-write the
-        # shared RWX CephFS media subtree. OnRootMismatch avoids a recursive
-        # chown of the whole media tree.
+        # Fork image has no USER (runs as root by default); pin it to a non-root
+        # UID and group-write the shared RWX CephFS /config (MediaCover etc.).
+        # OnRootMismatch avoids a recursive chown of the whole media tree.
         runAsUser: 1000
         runAsGroup: 1000
         fsGroup: 1000
         fsGroupChangePolicy: OnRootMismatch
       initContainers:
-        # Gate the app on its own Postgres database+role being reachable.
-        # waitfordb reads the PG* env as a libpq fallback, so the password never
-        # lands in argv.
+        # Gate the app on its own Postgres database+role being reachable, instead
+        # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
+        # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv.
         - name: wait-for-db
           image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
           env:
@@ -48,16 +51,16 @@ spec:
             - name: PGPORT
               value: "5432"
             - name: PGDATABASE
-              value: radarr-adult-main
+              value: radarr-main
             - name: PGUSER
               valueFrom:
                 secretKeyRef:
-                  name: radarr-adult-db
+                  name: radarr-db
                   key: username
             - name: PGPASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: radarr-adult-db
+                  name: radarr-db
                   key: password
           resources:
             requests:
@@ -75,8 +78,9 @@ spec:
           args:
             - -nobrowser
             - -data=/config
-            # Bypass the single-instance guard so multiple replicas can share one
-            # /config. Cross-replica safety is the Postgres layer, not a lock file.
+            # Required: bypass the single-instance guard so multiple replicas
+            # can share one /config. Cross-replica safety is the Postgres layer,
+            # not a local lock file.
             - -nosingleinstancecheck
           ports:
             - name: http
@@ -84,25 +88,27 @@ spec:
               protocol: TCP
           envFrom:
             - configMapRef:
-                name: radarr-adult-env
+                name: radarr-env
           env:
             - name: Radarr__Postgres__User
               valueFrom:
                 secretKeyRef:
-                  name: radarr-adult-db
+                  name: radarr-db
                   key: username
             - name: Radarr__Postgres__Password
               valueFrom:
                 secretKeyRef:
-                  name: radarr-adult-db
+                  name: radarr-db
                   key: password
             - name: Radarr__Auth__ApiKey
               valueFrom:
                 secretKeyRef:
-                  name: radarr-adult-apikey
+                  name: radarr-apikey
                   key: apitoken
-            # MediaCover object store (shared arrstack-media Ceph RGW bucket,
-            # partitioned by the radarr-adult key prefix).
+            # MediaCover object store (shared Ceph RGW bucket). Serves posters/fanart
+            # from S3 so any replica can render them instead of the leader-local
+            # emptyDir /config. Consumed by the -unkin3+ image; older images ignore
+            # these unknown config keys. Creds Secret is minted by cephrgw-operator.
             - name: Radarr__MediaCover__S3__Endpoint
               valueFrom:
                 secretKeyRef:
@@ -121,13 +127,14 @@ spec:
             - name: Radarr__MediaCover__S3__Bucket
               value: arrstack-media
             - name: Radarr__MediaCover__S3__Prefix
-              value: radarr-adult
+              value: radarr
             - name: Radarr__MediaCover__S3__ForcePathStyle
               value: "true"
             - name: Radarr__MediaCover__S3__CaCertPath
               value: /etc/ssl/vault-ca/ca.crt
             # Backup object store (shared arrstack-backups Ceph RGW bucket,
-            # partitioned by the radarr-adult key prefix).
+            # per-app key prefix). Routes the periodic config+DB zip backups off
+            # the ephemeral /config so any replica can write and restore them.
             - name: Radarr__BackupS3__Endpoint
               valueFrom:
                 secretKeyRef:
@@ -146,14 +153,14 @@ spec:
             - name: Radarr__BackupS3__Bucket
               value: arrstack-backups
             - name: Radarr__BackupS3__Prefix
-              value: radarr-adult
+              value: radarr
             - name: Radarr__BackupS3__ForcePathStyle
               value: "true"
             - name: Radarr__BackupS3__CaCertPath
               value: /etc/ssl/vault-ca/ca.crt
           livenessProbe:
             httpGet:
-              path: /3aa168/radarr/ping
+              path: /radarr/ping
               port: http
             initialDelaySeconds: 30
             periodSeconds: 30
@@ -161,7 +168,7 @@ spec:
             failureThreshold: 3
           readinessProbe:
             httpGet:
-              path: /3aa168/radarr/ping
+              path: /radarr/ping
               port: http
             initialDelaySeconds: 10
             periodSeconds: 10
@@ -177,31 +184,28 @@ spec:
           volumeMounts:
             - name: config
               mountPath: /config
-            # Adult movies subtree of the shared media-movies PVC (same CephFS
-            # subvolume the kids radarr writes and jellyfin reads).
             - name: media-movies
               mountPath: /media/movies
-              subPath: movies/adult
             - name: vault-ca
               mountPath: /etc/ssl/vault-ca
               readOnly: true
         # exportarr sidecar: polls the local replica's API and exposes Prometheus
-        # metrics on :9708 (scraped by the radarr-adult-exportarr VMPodScrape).
+        # metrics on :9708 (scraped by the radarr-exportarr VMPodScrape).
         - name: exportarr
-          image: ghcr.io/onedr0p/exportarr:v2.3.0
+          image: artifactapi.k8s.syd1.au.unkin.net/ghcr/onedr0p/exportarr:v2.3.0
           imagePullPolicy: IfNotPresent
           args:
             - radarr
           env:
             - name: PORT
               value: "9708"
-            # URL includes the /3aa168/radarr UrlBase (Radarr__Server__UrlBase).
+            # URL includes the /radarr UrlBase (Radarr__Server__UrlBase).
             - name: URL
-              value: http://localhost:7878/3aa168/radarr
+              value: http://localhost:7878/radarr
             - name: APIKEY
               valueFrom:
                 secretKeyRef:
-                  name: radarr-adult-apikey
+                  name: radarr-apikey
                   key: apitoken
           ports:
             - name: metrics

apps/base/arrstack/radarr/gateway.yaml

@@ -1,5 +1,4 @@
 ---
-# Internal front for repospawner (cf. mediamark).
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -7,26 +6,26 @@ metadata:
     traefik.io/instance: internal
   annotations:
     cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: repospawner.k8s.syd1.au.unkin.net
+    cert-manager.io/common-name: radarr.k8s.syd1.au.unkin.net
     cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: repospawner.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/hostname: radarr.k8s.syd1.au.unkin.net
     external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: repospawner
-  namespace: repospawner
+  name: radarr
+  namespace: arrstack
 spec:
   gatewayClassName: traefik-internal
   listeners:
     - allowedRoutes:
         namespaces:
           from: Same
-      hostname: repospawner.k8s.syd1.au.unkin.net
+      hostname: radarr.k8s.syd1.au.unkin.net
       name: http
       port: 80
       protocol: HTTP
     - allowedRoutes:
         namespaces:
           from: Same
-      hostname: repospawner.k8s.syd1.au.unkin.net
+      hostname: radarr.k8s.syd1.au.unkin.net
       name: https
       port: 443
       protocol: HTTPS
@@ -34,5 +33,5 @@ spec:
         certificateRefs:
           - group: ""
             kind: Secret
-            name: repospawner-tls
+            name: radarr-tls
         mode: Terminate

apps/base/arrstack/radarr/httproute.yaml

@@ -2,15 +2,15 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: watchstate-http-redirect
-  namespace: watchstate
+  name: radarr-http-redirect
+  namespace: arrstack
 spec:
   hostnames:
-    - watchstate.k8s.syd1.au.unkin.net
+    - radarr.k8s.syd1.au.unkin.net
   parentRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
-      name: watchstate
+      name: radarr
       sectionName: http
   rules:
     - filters:
@@ -26,22 +26,22 @@ spec:
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: watchstate
-  namespace: watchstate
+  name: radarr-route
+  namespace: arrstack
 spec:
   hostnames:
-    - watchstate.k8s.syd1.au.unkin.net
+    - radarr.k8s.syd1.au.unkin.net
   parentRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
-      name: watchstate
+      name: radarr
       sectionName: https
   rules:
     - backendRefs:
         - group: ""
           kind: Service
-          name: watchstate-oauth2
-          port: 80
+          name: radarr
+          port: 7878
           weight: 1
       matches:
         - path:

apps/base/arrstack/radarr/kustomization.yaml

@@ -7,4 +7,6 @@ resources:
   - configmap.yaml
   - deployment.yaml
   - service.yaml
+  - gateway.yaml
+  - httproute.yaml
   - vmpodscrape.yaml

apps/base/arrstack/radarr/pvc-config.yaml

@@ -0,0 +1,17 @@
+---
+# Radarr /config. RWX on CephFS so all replicas share it (the -unkin2 fork keeps
+# the database in Postgres; /config now holds only config.xml + MediaCover, which
+# tolerate — and want — shared access). Retain: this is state.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: radarr-config
+  namespace: arrstack
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: cephfs-raid5-retain
+  volumeMode: Filesystem

apps/base/arrstack/radarr/service.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: radarr-adult
+  name: radarr
   namespace: arrstack
 spec:
   ports:
@@ -11,5 +11,5 @@ spec:
       protocol: TCP
       targetPort: http
   selector:
-    app: radarr-adult
+    app: radarr
   type: ClusterIP

apps/base/arrstack/radarr/vaultstaticsecret.yaml

@@ -0,0 +1,25 @@
+---
+# radarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/radarr
+# (key: apitoken); the default k8s role's templated policy already grants read
+# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
+# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
+# syncs it into the radarr-apikey Secret that the apikey-init initContainer reads
+# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: radarr-apikey
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: radarr-apikey
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/radarr
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/arrstack/radarr/vmpodscrape.yaml

@@ -1,16 +1,16 @@
 ---
-# Scrape the exportarr sidecar (:9707) on every sonarr-adult pod. Picked up by the
+# Scrape the exportarr sidecar (:9708) on every radarr pod. Picked up by the
 # observability VMAgent (selectAllByDefault). Pod-level rather than
-# VMServiceScrape because the sonarr-adult Service doesn't expose the metrics port.
+# VMServiceScrape because the radarr Service doesn't expose the metrics port.
 apiVersion: operator.victoriametrics.com/v1beta1
 kind: VMPodScrape
 metadata:
-  name: sonarr-adult-exportarr
+  name: radarr-exportarr
   namespace: arrstack
 spec:
   selector:
     matchLabels:
-      app: sonarr-adult
+      app: radarr
   podMetricsEndpoints:
     - port: metrics
       path: /metrics

apps/base/arrstack/sonarr-adult/configmap.yaml

@@ -1,25 +0,0 @@
----
-# Non-secret env for the -unkin2 fork (adult tier). Identical mechanism to the
-# kids sonarr, pointed at its own shared-Postgres database (sonarr-adult-main)
-# and its own UrlBase (/3aa168/sonarr) so arrproxy path-routing reaches the adult
-# instance separately. Shares the one arrstack Valkey (keys namespaced by the
-# fork's sonarr:ratelimit: prefix). User/Password/ApiKey come from Secrets (see
-# deployment.yaml), not here.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: sonarr-adult-env
-  namespace: arrstack
-data:
-  Sonarr__Postgres__Host: arrstack-postgres-rw.arrstack.svc.cluster.local
-  Sonarr__Postgres__Port: "5432"
-  Sonarr__Postgres__MainDb: sonarr-adult-main
-  Sonarr__Log__DbEnabled: "false"
-  Sonarr__Auth__Method: External
-  Sonarr__Auth__Required: DisabledForLocalAddresses
-  Sonarr__App__InstanceName: Sonarr
-  Sonarr__Server__Port: "8989"
-  Sonarr__Server__UrlBase: /3aa168/sonarr
-  Sonarr__Update__Mechanism: External
-  Sonarr__Redis__Host: valkey-arrstack-valkey.arrstack.svc.cluster.local
-  Sonarr__Redis__Port: "6379"

apps/base/arrstack/sonarr-adult/vaultstaticsecret.yaml

@@ -1,25 +0,0 @@
----
-# sonarr-adult API key. Seeded out-of-band at
-# kv/kubernetes/namespace/arrstack/default/sonarr-adult (key: apitoken); the
-# default k8s role's templated policy already grants read on
-# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
-# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
-# syncs it into the sonarr-adult-apikey Secret consumed by the Deployment.
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: sonarr-adult-apikey
-  namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  destination:
-    create: true
-    name: sonarr-adult-apikey
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/sonarr-adult
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/arrstack/sonarr/configmap.yaml

@@ -0,0 +1,33 @@
+---
+# Non-secret env for the -unkin2 fork. The fork reads Servarr config from
+# Sonarr__<Section>__<Key> env (no config.xml edits, no s6/PUID). Postgres wiring
+# points every replica at the same shared DB (arrstack-postgres-rw / sonarr-main);
+# Auth__Method=External defers UI auth to arrproxy/oauth2-proxy; Server__UrlBase
+# keeps the /sonarr prefix so arrproxy path-routing works; App__InstanceName is
+# identical across replicas (shared session-cookie name). User/Password/ApiKey
+# come from Secrets (see deployment.yaml), not here.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: sonarr-env
+  namespace: arrstack
+data:
+  Sonarr__Postgres__Host: arrstack-postgres-rw.arrstack.svc.cluster.local
+  Sonarr__Postgres__Port: "5432"
+  Sonarr__Postgres__MainDb: sonarr-main
+  Sonarr__Log__DbEnabled: "false"
+  Sonarr__Auth__Method: External
+  Sonarr__Auth__Required: DisabledForLocalAddresses
+  Sonarr__App__InstanceName: Sonarr
+  Sonarr__Server__Port: "8989"
+  Sonarr__Server__UrlBase: /sonarr
+  Sonarr__Update__Mechanism: External
+  # Shared arrstack Valkey (valkey-operator). Setting Host is what activates the
+  # fork's #14 Redis features (SignalR backplane, cross-replica cache-invalidation
+  # bus, distributed rate limiter): RedisOptions.IsConfigured gates purely on a
+  # non-empty Host, so there is no separate Enabled flag. The operator leaves the
+  # default user passwordless (jellyfin parity), so no Password/Ssl is wired.
+  # Channels/keys are namespaced by this fork's sonarr:ratelimit: prefix, so the
+  # one cluster is safe to share with radarr/prowlarr.
+  Sonarr__Redis__Host: valkey-arrstack-valkey.arrstack.svc.cluster.local
+  Sonarr__Redis__Port: "6379"

apps/base/arrstack/sonarr/deployment.yaml

@@ -2,40 +2,43 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: sonarr-adult
+  name: sonarr
   namespace: arrstack
   annotations:
-    # Reloader rolls the Deployment when sonarr-adult-env changes (plain envFrom
-    # ConfigMap does not trigger a rollout on its own).
+    # sonarr-env is a plain (unhashed) ConfigMap consumed by fixed-name envFrom,
+    # so editing it does not roll the Deployment on its own. Reloader watches the
+    # referenced ConfigMap and triggers a rolling restart on change, so adding the
+    # Redis env activates the #14 features on the next ArgoCD sync without a manual
+    # `rollout restart`.
     configmap.reloader.stakater.com/auto: "true"
 spec:
   # Active-active: the -unkin2 fork keeps all state in the shared Postgres
   # (arrstack-postgres) and coordinates via Postgres advisory locks, so N
-  # replicas run concurrently behind the sonarr-adult Service. RollingUpdate is
-  # safe — no SQLite, no RWO lock.
+  # replicas run concurrently behind the sonarr Service. RollingUpdate is safe —
+  # no SQLite, no RWO lock.
   replicas: 3
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app: sonarr-adult
+      app: sonarr
   template:
     metadata:
       labels:
-        app: sonarr-adult
+        app: sonarr
     spec:
       securityContext:
-        # Fork image has no USER; pin it to a non-root UID and group-write the
-        # shared RWX CephFS media subtree. OnRootMismatch avoids a recursive
-        # chown of the whole media tree.
+        # Fork image has no USER (runs as root by default); pin it to a non-root
+        # UID and group-write the shared RWX CephFS /config (MediaCover etc.).
+        # OnRootMismatch avoids a recursive chown of the whole media tree.
         runAsUser: 1000
         runAsGroup: 1000
         fsGroup: 1000
         fsGroupChangePolicy: OnRootMismatch
       initContainers:
-        # Gate the app on its own Postgres database+role being reachable.
-        # waitfordb reads the PG* env as a libpq fallback, so the password never
-        # lands in argv.
+        # Gate the app on its own Postgres database+role being reachable, instead
+        # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
+        # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv.
         - name: wait-for-db
           image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
           env:
@@ -48,16 +51,16 @@ spec:
             - name: PGPORT
               value: "5432"
             - name: PGDATABASE
-              value: sonarr-adult-main
+              value: sonarr-main
             - name: PGUSER
               valueFrom:
                 secretKeyRef:
-                  name: sonarr-adult-db
+                  name: sonarr-db
                   key: username
             - name: PGPASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: sonarr-adult-db
+                  name: sonarr-db
                   key: password
           resources:
             requests:
@@ -75,8 +78,9 @@ spec:
           args:
             - -nobrowser
             - -data=/config
-            # Bypass the single-instance guard so multiple replicas can share one
-            # /config. Cross-replica safety is the Postgres layer, not a lock file.
+            # Required: bypass the single-instance guard so multiple replicas
+            # can share one /config. Cross-replica safety is the Postgres layer,
+            # not a local lock file.
             - -nosingleinstancecheck
           ports:
             - name: http
@@ -84,25 +88,29 @@ spec:
               protocol: TCP
           envFrom:
             - configMapRef:
-                name: sonarr-adult-env
+                name: sonarr-env
           env:
             - name: Sonarr__Postgres__User
               valueFrom:
                 secretKeyRef:
-                  name: sonarr-adult-db
+                  name: sonarr-db
                   key: username
             - name: Sonarr__Postgres__Password
               valueFrom:
                 secretKeyRef:
-                  name: sonarr-adult-db
+                  name: sonarr-db
                   key: password
             - name: Sonarr__Auth__ApiKey
               valueFrom:
                 secretKeyRef:
-                  name: sonarr-adult-apikey
+                  name: sonarr-apikey
                   key: apitoken
             # MediaCover object store (shared arrstack-media Ceph RGW bucket,
-            # partitioned by the sonarr-adult key prefix).
+            # partitioned from radarr by the sonarr key prefix). Serves
+            # posters/fanart from S3 so any replica renders them instead of the
+            # leader-local emptyDir /config. Consumed by the -unkin3+ image;
+            # older images ignore these unknown config keys. Creds Secret minted
+            # by cephrgw-operator.
             - name: Sonarr__MediaCoverS3__Endpoint
               valueFrom:
                 secretKeyRef:
@@ -121,13 +129,14 @@ spec:
             - name: Sonarr__MediaCoverS3__Bucket
               value: arrstack-media
             - name: Sonarr__MediaCoverS3__Prefix
-              value: sonarr-adult
+              value: sonarr
             - name: Sonarr__MediaCoverS3__ForcePathStyle
               value: "true"
             - name: Sonarr__MediaCoverS3__CaCertPath
               value: /etc/ssl/vault-ca/ca.crt
             # Backup object store (shared arrstack-backups Ceph RGW bucket,
-            # partitioned by the sonarr-adult key prefix).
+            # per-app key prefix). Routes the periodic config+DB zip backups off
+            # the ephemeral /config so any replica can write and restore them.
             - name: Sonarr__BackupS3__Endpoint
               valueFrom:
                 secretKeyRef:
@@ -146,14 +155,14 @@ spec:
             - name: Sonarr__BackupS3__Bucket
               value: arrstack-backups
             - name: Sonarr__BackupS3__Prefix
-              value: sonarr-adult
+              value: sonarr
             - name: Sonarr__BackupS3__ForcePathStyle
               value: "true"
             - name: Sonarr__BackupS3__CaCertPath
               value: /etc/ssl/vault-ca/ca.crt
           livenessProbe:
             httpGet:
-              path: /3aa168/sonarr/ping
+              path: /sonarr/ping
               port: http
             initialDelaySeconds: 30
             periodSeconds: 30
@@ -161,7 +170,7 @@ spec:
             failureThreshold: 3
           readinessProbe:
             httpGet:
-              path: /3aa168/sonarr/ping
+              path: /sonarr/ping
               port: http
             initialDelaySeconds: 10
             periodSeconds: 10
@@ -177,31 +186,28 @@ spec:
           volumeMounts:
             - name: config
               mountPath: /config
-            # Adult TV subtree of the shared media-tv PVC (same CephFS subvolume
-            # the kids sonarr writes and jellyfin reads).
             - name: media-tv
               mountPath: /media/tv
-              subPath: tvshows/adult
             - name: vault-ca
               mountPath: /etc/ssl/vault-ca
               readOnly: true
         # exportarr sidecar: polls the local replica's API and exposes Prometheus
-        # metrics on :9707 (scraped by the sonarr-adult-exportarr VMPodScrape).
+        # metrics on :9707 (scraped by the sonarr-exportarr VMPodScrape).
         - name: exportarr
-          image: ghcr.io/onedr0p/exportarr:v2.3.0
+          image: artifactapi.k8s.syd1.au.unkin.net/ghcr/onedr0p/exportarr:v2.3.0
           imagePullPolicy: IfNotPresent
           args:
             - sonarr
           env:
             - name: PORT
               value: "9707"
-            # URL includes the /3aa168/sonarr UrlBase (Sonarr__Server__UrlBase).
+            # URL includes the /sonarr UrlBase (Sonarr__Server__UrlBase).
             - name: URL
-              value: http://localhost:8989/3aa168/sonarr
+              value: http://localhost:8989/sonarr
             - name: APIKEY
               valueFrom:
                 secretKeyRef:
-                  name: sonarr-adult-apikey
+                  name: sonarr-apikey
                   key: apitoken
           ports:
             - name: metrics

apps/base/arrstack/sonarr/gateway.yaml

@@ -1,5 +1,4 @@
 ---
-# Internal-only front for the WatchState admin UI (cf. pdbmux/logviewer).
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -7,26 +6,26 @@ metadata:
     traefik.io/instance: internal
   annotations:
     cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: watchstate.k8s.syd1.au.unkin.net
+    cert-manager.io/common-name: sonarr.k8s.syd1.au.unkin.net
     cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: watchstate.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/hostname: sonarr.k8s.syd1.au.unkin.net
     external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: watchstate
-  namespace: watchstate
+  name: sonarr
+  namespace: arrstack
 spec:
   gatewayClassName: traefik-internal
   listeners:
     - allowedRoutes:
         namespaces:
           from: Same
-      hostname: watchstate.k8s.syd1.au.unkin.net
+      hostname: sonarr.k8s.syd1.au.unkin.net
       name: http
       port: 80
       protocol: HTTP
     - allowedRoutes:
         namespaces:
           from: Same
-      hostname: watchstate.k8s.syd1.au.unkin.net
+      hostname: sonarr.k8s.syd1.au.unkin.net
       name: https
       port: 443
       protocol: HTTPS
@@ -34,5 +33,5 @@ spec:
         certificateRefs:
           - group: ""
             kind: Secret
-            name: watchstate-tls
+            name: sonarr-tls
         mode: Terminate

apps/base/arrstack/sonarr/httproute.yaml

@@ -2,15 +2,15 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: mediamark-external-http-redirect
-  namespace: mediamark
+  name: sonarr-http-redirect
+  namespace: arrstack
 spec:
   hostnames:
-    - mediamark.unkin.net
+    - sonarr.k8s.syd1.au.unkin.net
   parentRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
-      name: mediamark-external
+      name: sonarr
       sectionName: http
   rules:
     - filters:
@@ -26,22 +26,22 @@ spec:
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: mediamark-external
-  namespace: mediamark
+  name: sonarr-route
+  namespace: arrstack
 spec:
   hostnames:
-    - mediamark.unkin.net
+    - sonarr.k8s.syd1.au.unkin.net
   parentRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
-      name: mediamark-external
+      name: sonarr
       sectionName: https
   rules:
     - backendRefs:
         - group: ""
           kind: Service
-          name: mediamark-oauth2
-          port: 4180
+          name: sonarr
+          port: 8989
           weight: 1
       matches:
         - path:

apps/base/arrstack/sonarr/kustomization.yaml

@@ -7,4 +7,6 @@ resources:
   - configmap.yaml
   - deployment.yaml
   - service.yaml
+  - gateway.yaml
+  - httproute.yaml
   - vmpodscrape.yaml

apps/base/arrstack/sonarr/pvc-config.yaml

@@ -0,0 +1,17 @@
+---
+# Sonarr /config. RWX on CephFS so all replicas share it (the -unkin2 fork keeps
+# the database in Postgres; /config now holds only config.xml + MediaCover, which
+# tolerate — and want — shared access). Retain: this is state.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sonarr-config
+  namespace: arrstack
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: cephfs-raid5-retain
+  volumeMode: Filesystem

apps/base/arrstack/sonarr/service.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: sonarr-adult
+  name: sonarr
   namespace: arrstack
 spec:
   ports:
@@ -11,5 +11,5 @@ spec:
       protocol: TCP
       targetPort: http
   selector:
-    app: sonarr-adult
+    app: sonarr
   type: ClusterIP

apps/base/arrstack/sonarr/vaultstaticsecret.yaml

@@ -0,0 +1,25 @@
+---
+# sonarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/sonarr
+# (key: apitoken); the default k8s role's templated policy already grants read
+# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
+# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
+# syncs it into the sonarr-apikey Secret that the apikey-init initContainer reads
+# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: sonarr-apikey
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: sonarr-apikey
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/sonarr
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/arrstack/sonarr/vmpodscrape.yaml

@@ -1,16 +1,16 @@
 ---
-# Scrape the exportarr sidecar (:9708) on every radarr-adult pod. Picked up by the
+# Scrape the exportarr sidecar (:9707) on every sonarr pod. Picked up by the
 # observability VMAgent (selectAllByDefault). Pod-level rather than
-# VMServiceScrape because the radarr-adult Service doesn't expose the metrics port.
+# VMServiceScrape because the sonarr Service doesn't expose the metrics port.
 apiVersion: operator.victoriametrics.com/v1beta1
 kind: VMPodScrape
 metadata:
-  name: radarr-adult-exportarr
+  name: sonarr-exportarr
   namespace: arrstack
 spec:
   selector:
     matchLabels:
-      app: radarr-adult
+      app: sonarr
   podMetricsEndpoints:
     - port: metrics
       path: /metrics

apps/base/arrstack/valkey/valkeycluster.yaml

@@ -28,7 +28,7 @@ metadata:
 spec:
   shards: 1
   replicas: 2
-  image: docker.io/valkey/valkey:9.0.0
+  image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/valkey/valkey:9.0.0
   exporter:
     enabled: false
   scheduling:

apps/base/artifactapi/redis-deployment.yaml

@@ -54,7 +54,7 @@ spec:
             successThreshold: 1
             timeoutSeconds: 5
         - name: metrics-exporter
-          image: docker.io/oliver006/redis_exporter:v1.89.0
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 9121

apps/base/authentik/gateway.yaml

@@ -1,47 +1,4 @@
 ---
-# External (DMZ) front for public identity.unkin.net, served via the external
-# Traefik (LB VIP 198.18.199.0). The apex identity.unkin.net A record lives in
-# the bind-operator unkin.net zone (bind-internal/authoritative), NOT
-# external-dns, so no external-dns annotation here. Public TLS is terminated with
-# the real Let's Encrypt *.unkin.net wildcard, centrally minted once in the
-# cert-manager namespace (Certificate wildcard-unkin-net) and reflected into this
-# namespace by the emberstack reflector as wildcard-unkin-net-tls, not Vault PKI.
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: external
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: authentik
-  namespace: authentik
-spec:
-  gatewayClassName: traefik-external
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: identity.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: identity.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: wildcard-unkin-net-tls
-        mode: Terminate
----
-# Cluster hostname variant, identity.k8s.syd1.au.unkin.net. Internal Traefik,
-# external-dns at 198.18.200.4. Own leaf from the Vault PKI issuer via the
-# cert-manager gateway-shim; the common-name keys off this cluster host.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -49,11 +6,11 @@ metadata:
     traefik.io/instance: internal
   annotations:
     cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: identity.k8s.syd1.au.unkin.net
+    cert-manager.io/common-name: identity.unkin.net
     cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: identity.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/hostname: identity.unkin.net,identity.k8s.syd1.au.unkin.net
     external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: authentik-internal
+  name: authentik
   namespace: authentik
 spec:
   gatewayClassName: traefik-internal
@@ -61,14 +18,14 @@ spec:
     - allowedRoutes:
         namespaces:
           from: Same
-      hostname: identity.k8s.syd1.au.unkin.net
+      hostname: identity.unkin.net
       name: http
       port: 80
       protocol: HTTP
     - allowedRoutes:
         namespaces:
           from: Same
-      hostname: identity.k8s.syd1.au.unkin.net
+      hostname: identity.unkin.net
       name: https
       port: 443
       protocol: HTTPS
@@ -78,3 +35,23 @@ spec:
             kind: Secret
             name: authentik-tls
         mode: Terminate
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: identity.k8s.syd1.au.unkin.net
+      name: http-internal
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: identity.k8s.syd1.au.unkin.net
+      name: https-internal
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: authentik-tls
+        mode: Terminate

apps/base/authentik/httproute.yaml

@@ -7,11 +7,16 @@ metadata:
 spec:
   hostnames:
     - identity.unkin.net
+    - identity.k8s.syd1.au.unkin.net
   parentRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
       name: authentik
       sectionName: http
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik
+      sectionName: http-internal
   rules:
     - filters:
         - type: RequestRedirect
@@ -31,60 +36,16 @@ metadata:
 spec:
   hostnames:
     - identity.unkin.net
+    - identity.k8s.syd1.au.unkin.net
   parentRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
       name: authentik
       sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: authentik-server
-          port: 80
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: authentik-http-redirect-internal
-  namespace: authentik
-spec:
-  hostnames:
-    - identity.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: authentik-internal
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: authentik-internal
-  namespace: authentik
-spec:
-  hostnames:
-    - identity.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: authentik-internal
-      sectionName: https
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik
+      sectionName: https-internal
   rules:
     - backendRefs:
         - group: ""

apps/base/authentik/kustomization.yaml

@@ -10,9 +10,6 @@ resources:
   - httproute.yaml
   - ldap-gateway.yaml
   - ldap-httproute.yaml
-  - ldap-outpost-deployment.yaml
-  - ldap-outpost-vaultstaticsecret.yaml
-  - ldap-outpost-vmpodscrape.yaml
   - ldap-service.yaml
   - ldap-tlsroute.yaml
   - namespace.yaml

apps/base/authentik/ldap-outpost-deployment.yaml

@@ -1,104 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: authentik-ldap-outpost
-  namespace: authentik
-  labels:
-    app.kubernetes.io/name: authentik
-    app.kubernetes.io/component: ldap
-spec:
-  # Outposts are stateless; run two replicas for availability.
-  replicas: 2
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: authentik
-      app.kubernetes.io/component: ldap
-  template:
-    metadata:
-      annotations:
-        secret.reloader.stakater.com/reload: "authentik-ldap-outpost-token,vault-ca-cert"
-      labels:
-        app.kubernetes.io/name: authentik
-        app.kubernetes.io/component: ldap
-    spec:
-      # The outpost validates the authentik core cert (identity.k8s.syd1.au.unkin.net,
-      # signed by the internal unkin.net CA). Combine the base image's public roots
-      # with the reflected vault-ca-cert into one bundle that SSL_CERT_FILE points at,
-      # so AUTHENTIK_INSECURE stays false.
-      initContainers:
-        - name: combine-certs
-          image: alpine:3
-          command:
-            - sh
-            - -c
-            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
-          volumeMounts:
-            - name: vault-ca-cert
-              mountPath: /custom-ca
-              readOnly: true
-            - name: combined-certs
-              mountPath: /combined-certs
-          resources:
-            limits:
-              cpu: 100m
-              memory: 64Mi
-            requests:
-              cpu: 25m
-              memory: 32Mi
-      containers:
-        - name: ldap
-          image: ghcr.io/goauthentik/ldap:2026.5.3
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: AUTHENTIK_HOST
-              value: https://identity.k8s.syd1.au.unkin.net
-            - name: AUTHENTIK_INSECURE
-              value: "false"
-            - name: SSL_CERT_FILE
-              value: /etc/ssl/combined/ca-certificates.crt
-            - name: AUTHENTIK_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-ldap-outpost-token
-                  key: token
-          ports:
-            - containerPort: 3389
-              name: ldap
-              protocol: TCP
-            - containerPort: 6636
-              name: ldaps
-              protocol: TCP
-            - containerPort: 9300
-              name: metrics
-              protocol: TCP
-          livenessProbe:
-            tcpSocket:
-              port: ldap
-            initialDelaySeconds: 10
-            periodSeconds: 15
-          readinessProbe:
-            tcpSocket:
-              port: ldap
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          resources:
-            limits:
-              cpu: "1"
-              memory: 512Mi
-            requests:
-              cpu: 50m
-              memory: 128Mi
-          volumeMounts:
-            - name: combined-certs
-              mountPath: /etc/ssl/combined
-              readOnly: true
-      volumes:
-        - name: vault-ca-cert
-          secret:
-            secretName: vault-ca-cert
-            items:
-              - key: ca.crt
-                path: ca.crt
-        - name: combined-certs
-          emptyDir: {}

apps/base/authentik/ldap-outpost-vaultstaticsecret.yaml

@@ -1,20 +0,0 @@
----
-# Outpost API token, issued by authentik for the LDAP outpost and seeded into
-# Vault by the terraform-authentik apply. The KV value must exist at this path
-# with a `token` key before the outpost can connect.
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: authentik-ldap-outpost-token
-  namespace: authentik
-spec:
-  destination:
-    create: true
-    name: authentik-ldap-outpost-token
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/authentik/default/outpost-token
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/authentik/ldap-outpost-vmpodscrape.yaml

@@ -1,16 +0,0 @@
----
-# Scrape the LDAP outpost's Prometheus endpoint (:9300). Picked up by the
-# observability VMAgent (selectAllByDefault).
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VMPodScrape
-metadata:
-  name: authentik-ldap-outpost
-  namespace: authentik
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: authentik
-      app.kubernetes.io/component: ldap
-  podMetricsEndpoints:
-    - port: metrics
-      path: /metrics

apps/base/authentik/ldap-service.yaml

@@ -7,10 +7,6 @@ metadata:
 spec:
   internalTrafficPolicy: Cluster
   ports:
-    - name: ldap
-      port: 3389
-      protocol: TCP
-      targetPort: 3389
     - name: ldaps
       port: 6636
       protocol: TCP

apps/base/authentik/redis-deployment.yaml

@@ -53,7 +53,7 @@ spec:
             - mountPath: /data
               name: redis-data
         - name: metrics-exporter
-          image: docker.io/oliver006/redis_exporter:v1.89.0
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 9121

apps/base/bind-internal/authoritative/records.yaml

@@ -16,9 +16,9 @@ spec:
   type: A
   ttl: 600
   values:
-    # traefik-EXTERNAL (DMZ) gateway VIP; the authentik Gateway serves the
+    # traefik-internal gateway VIP; the authentik Gateway serves the
     # identity.unkin.net hostname there.
-    - 198.18.199.0
+    - 198.18.200.4
 ---
 # PRODUCTION CUTOVER RECORD — intentionally commented out.
 # git.unkin.net currently resolves to the LIVE VM forge (HAProxy VRRP VIP
@@ -132,33 +132,3 @@ spec:
     # traefik-internal gateway VIP; the logviewer Gateway serves
     # logviewer.unkin.net there.
     - 198.18.200.4
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: cheeztv-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: cheeztv
-  type: A
-  ttl: 600
-  values:
-    # traefik-internal gateway VIP; the cheeztv Gateway serves cheeztv.unkin.net
-    # there.
-    - 198.18.200.4
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: watchstate-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: watchstate
-  type: A
-  ttl: 600
-  values:
-    # traefik-EXTERNAL (DMZ) gateway VIP; the watchstate-external Gateway serves
-    # the watchstate.unkin.net front door (oauth2-proxy) there.
-    - 198.18.199.0

apps/base/cert-manager/certificate_wildcard-unkin-net.yaml

@@ -1,27 +0,0 @@
----
-# Single, centrally-managed Let's Encrypt *.unkin.net wildcard. DNS-01 validates
-# once against the delegated _acme-challenge.unkin.net CNAME, so consumers get a
-# real public leaf without per-host challenge records. The minted secret carries
-# emberstack reflector annotations (via secretTemplate) so it is auto-reflected
-# into consumer namespaces; append future consumers to the *-namespaces lists.
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: wildcard-unkin-net
-  namespace: cert-manager
-spec:
-  secretName: wildcard-unkin-net-tls
-  secretTemplate:
-    annotations:
-      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner"
-      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner"
-  privateKey:
-    size: 4096
-  dnsNames:
-    - "*.unkin.net"
-  issuerRef:
-    name: letsencrypt
-    kind: ClusterIssuer
-    group: cert-manager.io

apps/base/cert-manager/kustomization.yaml

@@ -11,4 +11,3 @@ resources:
   - vmservicescrape.yaml
   - clusterissuer_letsencrypt.yaml
   - clusterissuer_letsencrypt-staging.yaml
-  - certificate_wildcard-unkin-net.yaml

apps/base/cheeztv/gateway.yaml

@@ -1,17 +1,17 @@
 ---
 # Friendly public hostname for the kids instance, cheeztv.unkin.net. Same
 # internal-Traefik + external-dns pattern as logviewer.unkin.net: external-dns
-# publishes the A record at the internal LB VIP (198.18.200.4). Public TLS is
-# terminated with the real Let's Encrypt *.unkin.net wildcard, centrally minted
-# once in the cert-manager namespace (Certificate wildcard-unkin-net) and
-# reflected into this namespace by the emberstack reflector as the secret
-# wildcard-unkin-net-tls, not the Vault PKI issuer.
+# publishes the A record at the internal LB VIP (198.18.200.4) and cert-manager
+# mints cheeztv-tls (CN cheeztv.unkin.net) off the Vault-PKI cluster issuer.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
   labels:
     traefik.io/instance: internal
   annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: cheeztv.unkin.net
+    cert-manager.io/private-key-size: "4096"
     external-dns.alpha.kubernetes.io/hostname: cheeztv.unkin.net
     external-dns.alpha.kubernetes.io/target: 198.18.200.4
   name: cheeztv
@@ -37,7 +37,7 @@ spec:
         certificateRefs:
           - group: ""
             kind: Secret
-            name: wildcard-unkin-net-tls
+            name: cheeztv-tls
         mode: Terminate
 ---
 # Cluster hostname variant, mirroring fafflix's jellyfin.k8s.syd1.au.unkin.net

apps/base/cheeztv/kustomization.yaml

@@ -15,12 +15,9 @@ resources:
   - pvc-transcode.yaml
   - pv-media-tv.yaml
   - pv-media-movies.yaml
-  - pv-mediastore.yaml
   - pvc-media-tv.yaml
   - pvc-media-movies.yaml
-  - pvc-mediastore.yaml
   - statefulset.yaml
-  - plugin-configmap.yaml
   - pdb.yaml
   - service.yaml
   - valkey.yaml

apps/base/cheeztv/plugin-configmap.yaml

@@ -1,97 +0,0 @@
----
-# Declarative config for the browser-auth plugins bundled in the jellyfin-ha
-# image (jellyfin-plugin-sso, jellyfin-plugin-ldapauth). Rendered into
-# /config/plugins/configurations/ by the inject-plugin-config initContainer,
-# which substitutes the OidSecret / LdapBindPassword placeholders from the
-# VSO-synced oauth-credentials Secret so no secret is committed here. The SSO
-# provider key "authentik" must match the redirect path segment registered on
-# the shared Authentik "jellyfin" OAuth2 client. Roles/AdminRoles are matched
-# against the hierarchical Authentik groups claim (akP-jellyfin-user grants
-# login, akP-jellyfin-admin grants Jellyfin admin; global admins inherit the
-# latter via akR-global-admin).
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: cheeztv-plugin-config
-  namespace: cheeztv
-data:
-  SSO-Auth.xml: |
-    <?xml version="1.0" encoding="utf-8"?>
-    <PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
-      <SamlConfigs />
-      <OidConfigs>
-        <item>
-          <key>
-            <string>authentik</string>
-          </key>
-          <value>
-            <PluginConfiguration>
-              <OidEndpoint>https://identity.k8s.syd1.au.unkin.net/application/o/jellyfin/</OidEndpoint>
-              <OidClientId>jellyfin</OidClientId>
-              <OidSecret>@@CLIENT_SECRET@@</OidSecret>
-              <Enabled>true</Enabled>
-              <EnableAuthorization>true</EnableAuthorization>
-              <EnableAllFolders>true</EnableAllFolders>
-              <EnabledFolders />
-              <AdminRoles>
-                <string>akP-jellyfin-admin</string>
-              </AdminRoles>
-              <Roles>
-                <string>akP-jellyfin-user</string>
-                <string>akP-jellyfin-admin</string>
-              </Roles>
-              <EnableFolderRoles>false</EnableFolderRoles>
-              <EnableLiveTvRoles>false</EnableLiveTvRoles>
-              <EnableLiveTv>false</EnableLiveTv>
-              <EnableLiveTvManagement>false</EnableLiveTvManagement>
-              <LiveTvRoles />
-              <LiveTvManagementRoles />
-              <FolderRoleMappings />
-              <RoleClaim>ak_groups</RoleClaim>
-              <OidScopes>
-                <string>openid</string>
-                <string>profile</string>
-                <string>email</string>
-                <string>ak_groups</string>
-              </OidScopes>
-              <CanonicalLinks></CanonicalLinks>
-              <DisableHttps>false</DisableHttps>
-              <DoNotValidateEndpoints>false</DoNotValidateEndpoints>
-              <DoNotValidateIssuerName>false</DoNotValidateIssuerName>
-              <SchemeOverride>https</SchemeOverride>
-            </PluginConfiguration>
-          </value>
-        </item>
-      </OidConfigs>
-    </PluginConfiguration>
-  LDAP-Auth.xml: |
-    <?xml version="1.0" encoding="utf-8"?>
-    <PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
-      <LdapServer>authentik-ldap.authentik.svc.cluster.local</LdapServer>
-      <LdapPort>6636</LdapPort>
-      <UseSsl>true</UseSsl>
-      <UseStartTls>false</UseStartTls>
-      <SkipSslVerify>true</SkipSslVerify>
-      <LdapBindUser>cn=jellyfin-ldap,ou=users,DC=ldap,DC=goauthentik,DC=io</LdapBindUser>
-      <LdapBindPassword>@@LDAP_BIND_PASSWORD@@</LdapBindPassword>
-      <LdapBaseDn>ou=users,DC=ldap,DC=goauthentik,DC=io</LdapBaseDn>
-      <LdapSearchFilter>(objectClass=user)</LdapSearchFilter>
-      <LdapAdminBaseDn>ou=users,DC=ldap,DC=goauthentik,DC=io</LdapAdminBaseDn>
-      <LdapAdminFilter>(memberOf=cn=akP-jellyfin-admin,ou=groups,DC=ldap,DC=goauthentik,DC=io)</LdapAdminFilter>
-      <EnableLdapAdminFilterMemberUid>false</EnableLdapAdminFilterMemberUid>
-      <LdapSearchAttributes>uid, cn, mail, displayName</LdapSearchAttributes>
-      <CreateUsersFromLdap>true</CreateUsersFromLdap>
-      <AllowPassChange>false</AllowPassChange>
-      <LdapUidAttribute>cn</LdapUidAttribute>
-      <LdapUsernameAttribute>cn</LdapUsernameAttribute>
-      <LdapPasswordAttribute>userPassword</LdapPasswordAttribute>
-      <EnableAllFolders>true</EnableAllFolders>
-      <EnabledFolders />
-    </PluginConfiguration>
-  branding.xml: |
-    <?xml version="1.0" encoding="utf-8"?>
-    <BrandingOptions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
-      <LoginDisclaimer>&lt;p style="text-align:center"&gt;&lt;a href="/sso/OID/start/authentik"&gt;Sign in with SSO&lt;/a&gt;&lt;/p&gt;</LoginDisclaimer>
-      <CustomCss></CustomCss>
-      <SplashscreenEnabled>false</SplashscreenEnabled>
-    </BrandingOptions>

apps/base/cheeztv/pv-mediastore.yaml

@@ -1,31 +0,0 @@
----
-# Static PV for the shared MEDIASTORE CephFS subvolume. Same rootPath as
-# arrstack's mediastore PV so the arrs write and cheeztv reads the identical
-# library tree (cheeztv scans /cheeztv/{tvseries,movies}); each namespace gets
-# its own PV (unique name + volumeHandle) pinned by claimRef.
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: cheeztv-mediastore
-spec:
-  capacity:
-    storage: 10Ti
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: ""
-  volumeMode: Filesystem
-  claimRef:
-    namespace: cheeztv
-    name: cheeztv-mediastore
-  csi:
-    driver: cephfs.csi.ceph.com
-    volumeHandle: cheeztv-mediastore-static
-    nodeStageSecretRef:
-      name: csi-cephfs-secret
-      namespace: csi-cephfs
-    volumeAttributes:
-      staticVolume: "true"
-      clusterID: cephfs_csi_ssd_ec_4_1
-      fsName: cephfs
-      rootPath: /volumes/csi_ssd_ec_4_1/mediastore/a0152dac-a51b-4b95-ac5e-ecdd99bfe3f1

apps/base/cheeztv/pvc-mediastore.yaml

@@ -1,24 +0,0 @@
----
-# Shared media tree, read-many across replicas. Statically bound to the
-# cheeztv-mediastore PV (the CephFS subvolume also used by arrstack and
-# fafflix). storageClassName "" + volumeName disables dynamic provisioning and
-# binds the pre-created static PV.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: cheeztv-mediastore
-  namespace: cheeztv
-  annotations:
-    # Exclude from the cheeztv-config k8up Schedule (skipWithoutAnnotation is
-    # false cluster-wide, so unannotated PVCs are swept in). Only cheeztv-config
-    # is backed up; the media library is not restic-backup material.
-    k8up.io/backup: "false"
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Ti
-  storageClassName: ""
-  volumeName: cheeztv-mediastore
-  volumeMode: Filesystem

apps/base/cheeztv/statefulset.yaml

@@ -109,60 +109,9 @@ spec:
           volumeMounts:
             - name: config
               mountPath: /config
-        # Render the SSO/LDAP plugin configs into the shared config volume,
-        # substituting the client secret and LDAP bind password from the
-        # VSO-synced oauth-credentials Secret (never committed). Plugin configs
-        # are fully managed here so they are overwritten every start; the login
-        # button branding is written only when absent so admin edits survive.
-        - name: inject-plugin-config
-          image: busybox:1.37.0
-          command:
-            - sh
-            - -c
-            - |
-              mkdir -p /config/plugins/configurations /config/config
-              chown 1000:1000 /config/plugins /config/plugins/configurations /config/config
-              esc() { printf '%s' "$1" | sed -e 's/[&|\\]/\\&/g'; }
-              cs=$(esc "${CLIENT_SECRET}")
-              lp=$(esc "${LDAP_BIND_PASSWORD}")
-              sed "s|@@CLIENT_SECRET@@|${cs}|" /templates/SSO-Auth.xml > /config/plugins/configurations/SSO-Auth.xml
-              sed "s|@@LDAP_BIND_PASSWORD@@|${lp}|" /templates/LDAP-Auth.xml > /config/plugins/configurations/LDAP-Auth.xml
-              chown 1000:1000 /config/plugins/configurations/SSO-Auth.xml /config/plugins/configurations/LDAP-Auth.xml
-              chmod 600 /config/plugins/configurations/SSO-Auth.xml /config/plugins/configurations/LDAP-Auth.xml
-              if [ ! -e /config/config/branding.xml ]; then
-                cp /templates/branding.xml /config/config/branding.xml
-                chown 1000:1000 /config/config/branding.xml
-                chmod 664 /config/config/branding.xml
-              fi
-          env:
-            - name: CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: oauth-credentials
-                  key: client_secret
-                  optional: true
-            - name: LDAP_BIND_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: oauth-credentials
-                  key: ldap_bind_password
-                  optional: true
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-            limits:
-              cpu: 100m
-              memory: 64Mi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: plugin-config
-              mountPath: /templates
-              readOnly: true
       containers:
         - name: cheeztv
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.2.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.1.3
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
@@ -273,9 +222,6 @@ spec:
               subPath: kids
               readOnly: true
       volumes:
-        - name: plugin-config
-          configMap:
-            name: cheeztv-plugin-config
         - name: config
           persistentVolumeClaim:
             claimName: cheeztv-config

apps/base/cheeztv/vaultstaticsecret.yaml

@@ -22,27 +22,3 @@ spec:
   refreshAfter: 5m
   type: kv-v2
   vaultAuthRef: default
----
-# Shared Authentik "jellyfin" OAuth2 client secret (key: client_secret) plus the
-# LDAP outpost bind password (key: ldap_bind_password) for the auth plugins.
-# The default k8s role's templated policy is namespace-scoped
-# (kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*), so each instance
-# reads its own namespace path; the SAME shared values must be seeded at both
-# fafflix and cheeztv paths. VSO syncs into the oauth-credentials Secret, whose
-# keys the inject-plugin-config initContainer substitutes into the plugin XML.
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: oauth-credentials
-  namespace: cheeztv
-spec:
-  destination:
-    create: true
-    name: oauth-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/cheeztv/default/oauth-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/dhcp-system/deployment.yaml

@@ -21,7 +21,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: git.unkin.net/unkin/kea-operator:v0.1.5
+          image: git.unkin.net/unkin/kea-operator:v0.1.3
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081

apps/base/fafflix/kustomization.yaml

@@ -15,12 +15,9 @@ resources:
   - pvc-transcode.yaml
   - pv-media-tv.yaml
   - pv-media-movies.yaml
-  - pv-mediastore.yaml
   - pvc-media-tv.yaml
   - pvc-media-movies.yaml
-  - pvc-mediastore.yaml
   - statefulset.yaml
-  - plugin-configmap.yaml
   - pdb.yaml
   - service.yaml
   - valkey.yaml

apps/base/fafflix/plugin-configmap.yaml

@@ -1,97 +0,0 @@
----
-# Declarative config for the browser-auth plugins bundled in the jellyfin-ha
-# image (jellyfin-plugin-sso, jellyfin-plugin-ldapauth). Rendered into
-# /config/plugins/configurations/ by the inject-plugin-config initContainer,
-# which substitutes the OidSecret / LdapBindPassword placeholders from the
-# VSO-synced oauth-credentials Secret so no secret is committed here. The SSO
-# provider key "authentik" must match the redirect path segment registered on
-# the shared Authentik "jellyfin" OAuth2 client. Roles/AdminRoles are matched
-# against the hierarchical Authentik groups claim (akP-jellyfin-user grants
-# login, akP-jellyfin-admin grants Jellyfin admin; global admins inherit the
-# latter via akR-global-admin).
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: fafflix-plugin-config
-  namespace: fafflix
-data:
-  SSO-Auth.xml: |
-    <?xml version="1.0" encoding="utf-8"?>
-    <PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
-      <SamlConfigs />
-      <OidConfigs>
-        <item>
-          <key>
-            <string>authentik</string>
-          </key>
-          <value>
-            <PluginConfiguration>
-              <OidEndpoint>https://identity.k8s.syd1.au.unkin.net/application/o/jellyfin/</OidEndpoint>
-              <OidClientId>jellyfin</OidClientId>
-              <OidSecret>@@CLIENT_SECRET@@</OidSecret>
-              <Enabled>true</Enabled>
-              <EnableAuthorization>true</EnableAuthorization>
-              <EnableAllFolders>true</EnableAllFolders>
-              <EnabledFolders />
-              <AdminRoles>
-                <string>akP-jellyfin-admin</string>
-              </AdminRoles>
-              <Roles>
-                <string>akP-jellyfin-user</string>
-                <string>akP-jellyfin-admin</string>
-              </Roles>
-              <EnableFolderRoles>false</EnableFolderRoles>
-              <EnableLiveTvRoles>false</EnableLiveTvRoles>
-              <EnableLiveTv>false</EnableLiveTv>
-              <EnableLiveTvManagement>false</EnableLiveTvManagement>
-              <LiveTvRoles />
-              <LiveTvManagementRoles />
-              <FolderRoleMappings />
-              <RoleClaim>ak_groups</RoleClaim>
-              <OidScopes>
-                <string>openid</string>
-                <string>profile</string>
-                <string>email</string>
-                <string>ak_groups</string>
-              </OidScopes>
-              <CanonicalLinks></CanonicalLinks>
-              <DisableHttps>false</DisableHttps>
-              <DoNotValidateEndpoints>false</DoNotValidateEndpoints>
-              <DoNotValidateIssuerName>false</DoNotValidateIssuerName>
-              <SchemeOverride>https</SchemeOverride>
-            </PluginConfiguration>
-          </value>
-        </item>
-      </OidConfigs>
-    </PluginConfiguration>
-  LDAP-Auth.xml: |
-    <?xml version="1.0" encoding="utf-8"?>
-    <PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
-      <LdapServer>authentik-ldap.authentik.svc.cluster.local</LdapServer>
-      <LdapPort>6636</LdapPort>
-      <UseSsl>true</UseSsl>
-      <UseStartTls>false</UseStartTls>
-      <SkipSslVerify>true</SkipSslVerify>
-      <LdapBindUser>cn=jellyfin-ldap,ou=users,DC=ldap,DC=goauthentik,DC=io</LdapBindUser>
-      <LdapBindPassword>@@LDAP_BIND_PASSWORD@@</LdapBindPassword>
-      <LdapBaseDn>ou=users,DC=ldap,DC=goauthentik,DC=io</LdapBaseDn>
-      <LdapSearchFilter>(objectClass=user)</LdapSearchFilter>
-      <LdapAdminBaseDn>ou=users,DC=ldap,DC=goauthentik,DC=io</LdapAdminBaseDn>
-      <LdapAdminFilter>(memberOf=cn=akP-jellyfin-admin,ou=groups,DC=ldap,DC=goauthentik,DC=io)</LdapAdminFilter>
-      <EnableLdapAdminFilterMemberUid>false</EnableLdapAdminFilterMemberUid>
-      <LdapSearchAttributes>uid, cn, mail, displayName</LdapSearchAttributes>
-      <CreateUsersFromLdap>true</CreateUsersFromLdap>
-      <AllowPassChange>false</AllowPassChange>
-      <LdapUidAttribute>cn</LdapUidAttribute>
-      <LdapUsernameAttribute>cn</LdapUsernameAttribute>
-      <LdapPasswordAttribute>userPassword</LdapPasswordAttribute>
-      <EnableAllFolders>true</EnableAllFolders>
-      <EnabledFolders />
-    </PluginConfiguration>
-  branding.xml: |
-    <?xml version="1.0" encoding="utf-8"?>
-    <BrandingOptions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
-      <LoginDisclaimer>&lt;p style="text-align:center"&gt;&lt;a href="/sso/OID/start/authentik"&gt;Sign in with SSO&lt;/a&gt;&lt;/p&gt;</LoginDisclaimer>
-      <CustomCss></CustomCss>
-      <SplashscreenEnabled>false</SplashscreenEnabled>
-    </BrandingOptions>

apps/base/fafflix/pv-mediastore.yaml

@@ -1,31 +0,0 @@
----
-# Static PV for the shared MEDIASTORE CephFS subvolume. Same rootPath as
-# arrstack's mediastore PV so the arrs write and fafflix reads the identical
-# library tree (fafflix scans /fafflix/{tvseries,movies}); each namespace gets
-# its own PV (unique name + volumeHandle) pinned by claimRef.
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: fafflix-mediastore
-spec:
-  capacity:
-    storage: 10Ti
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: ""
-  volumeMode: Filesystem
-  claimRef:
-    namespace: fafflix
-    name: fafflix-mediastore
-  csi:
-    driver: cephfs.csi.ceph.com
-    volumeHandle: fafflix-mediastore-static
-    nodeStageSecretRef:
-      name: csi-cephfs-secret
-      namespace: csi-cephfs
-    volumeAttributes:
-      staticVolume: "true"
-      clusterID: cephfs_csi_ssd_ec_4_1
-      fsName: cephfs
-      rootPath: /volumes/csi_ssd_ec_4_1/mediastore/a0152dac-a51b-4b95-ac5e-ecdd99bfe3f1

apps/base/fafflix/pvc-mediastore.yaml

@@ -1,24 +0,0 @@
----
-# Shared media tree, read-many across replicas. Statically bound to the
-# fafflix-mediastore PV (the CephFS subvolume also used by arrstack and
-# cheeztv). storageClassName "" + volumeName disables dynamic provisioning and
-# binds the pre-created static PV.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: fafflix-mediastore
-  namespace: fafflix
-  annotations:
-    # Exclude from the fafflix-config k8up Schedule (skipWithoutAnnotation is
-    # false cluster-wide, so unannotated PVCs are swept in). Only fafflix-config
-    # is backed up; the media library is not restic-backup material.
-    k8up.io/backup: "false"
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Ti
-  storageClassName: ""
-  volumeName: fafflix-mediastore
-  volumeMode: Filesystem

apps/base/fafflix/statefulset.yaml

@@ -109,60 +109,9 @@ spec:
           volumeMounts:
             - name: config
               mountPath: /config
-        # Render the SSO/LDAP plugin configs into the shared config volume,
-        # substituting the client secret and LDAP bind password from the
-        # VSO-synced oauth-credentials Secret (never committed). Plugin configs
-        # are fully managed here so they are overwritten every start; the login
-        # button branding is written only when absent so admin edits survive.
-        - name: inject-plugin-config
-          image: busybox:1.37.0
-          command:
-            - sh
-            - -c
-            - |
-              mkdir -p /config/plugins/configurations /config/config
-              chown 1000:1000 /config/plugins /config/plugins/configurations /config/config
-              esc() { printf '%s' "$1" | sed -e 's/[&|\\]/\\&/g'; }
-              cs=$(esc "${CLIENT_SECRET}")
-              lp=$(esc "${LDAP_BIND_PASSWORD}")
-              sed "s|@@CLIENT_SECRET@@|${cs}|" /templates/SSO-Auth.xml > /config/plugins/configurations/SSO-Auth.xml
-              sed "s|@@LDAP_BIND_PASSWORD@@|${lp}|" /templates/LDAP-Auth.xml > /config/plugins/configurations/LDAP-Auth.xml
-              chown 1000:1000 /config/plugins/configurations/SSO-Auth.xml /config/plugins/configurations/LDAP-Auth.xml
-              chmod 600 /config/plugins/configurations/SSO-Auth.xml /config/plugins/configurations/LDAP-Auth.xml
-              if [ ! -e /config/config/branding.xml ]; then
-                cp /templates/branding.xml /config/config/branding.xml
-                chown 1000:1000 /config/config/branding.xml
-                chmod 664 /config/config/branding.xml
-              fi
-          env:
-            - name: CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: oauth-credentials
-                  key: client_secret
-                  optional: true
-            - name: LDAP_BIND_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: oauth-credentials
-                  key: ldap_bind_password
-                  optional: true
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-            limits:
-              cpu: 100m
-              memory: 64Mi
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: plugin-config
-              mountPath: /templates
-              readOnly: true
       containers:
         - name: fafflix
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.2.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.1.3
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
@@ -287,9 +236,6 @@ spec:
               subPath: kids
               readOnly: true
       volumes:
-        - name: plugin-config
-          configMap:
-            name: fafflix-plugin-config
         - name: config
           persistentVolumeClaim:
             claimName: fafflix-config

apps/base/fafflix/vaultstaticsecret.yaml

@@ -22,27 +22,3 @@ spec:
   refreshAfter: 5m
   type: kv-v2
   vaultAuthRef: default
----
-# Shared Authentik "jellyfin" OAuth2 client secret (key: client_secret) plus the
-# LDAP outpost bind password (key: ldap_bind_password) for the auth plugins.
-# The default k8s role's templated policy is namespace-scoped
-# (kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*), so each instance
-# reads its own namespace path; the SAME shared values must be seeded at both
-# fafflix and cheeztv paths. VSO syncs into the oauth-credentials Secret, whose
-# keys the inject-plugin-config initContainer substitutes into the plugin XML.
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: oauth-credentials
-  namespace: fafflix
-spec:
-  destination:
-    create: true
-    name: oauth-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/fafflix/default/oauth-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/gitea/valkey-deployment.yaml

@@ -83,7 +83,7 @@ spec:
             - mountPath: /data
               name: data
         - name: metrics-exporter
-          image: docker.io/oliver006/redis_exporter:v1.89.0
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 9121

apps/base/grafana/grafana.yaml

@@ -26,6 +26,13 @@ spec:
                     secretKeyRef:
                       name: oauth-credentials
                       key: client_secret
+              # identity.unkin.net is served by the internal unkin.net CA, which
+              # the stock Grafana image doesn't trust. Mount the reflected
+              # vault-ca-cert and point generic_oauth's tls_client_ca at it.
+              volumeMounts:
+                - name: vault-ca-cert
+                  mountPath: /etc/grafana/vault-ca
+                  readOnly: true
               resources:
                 requests:
                   cpu: 100m
@@ -33,6 +40,13 @@ spec:
                 limits:
                   cpu: "1"
                   memory: 1Gi
+          volumes:
+            - name: vault-ca-cert
+              secret:
+                secretName: vault-ca-cert
+                items:
+                  - key: ca.crt
+                    path: ca.crt
   config:
     server:
       root_url: "https://grafana.k8s.syd1.au.unkin.net"
@@ -57,6 +71,9 @@ spec:
       auth_url: "https://identity.unkin.net/application/o/authorize/"
       token_url: "https://identity.unkin.net/application/o/token/"
       api_url: "https://identity.unkin.net/application/o/userinfo/"
+      # Trust the internal unkin.net CA that signs identity.unkin.net's cert
+      # (mounted from the reflected vault-ca-cert Secret).
+      tls_client_ca: "/etc/grafana/vault-ca/ca.crt"
       # Authentik permission groups -> Grafana roles. akP-grafana-admin is granted
       # to akR-global-admin members (and direct members) via terraform-authentik.
       role_attribute_path: "contains(ak_groups[*], 'akP-grafana-admin') && 'Admin' || 'Viewer'"

apps/base/litellm/redis-deployment.yaml

@@ -61,7 +61,7 @@ spec:
               mountPropagation: None
               name: data
         - name: metrics-exporter
-          image: docker.io/oliver006/redis_exporter:v1.89.0
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 9121

apps/base/logging/clickhouseinstallation.yaml

@@ -87,7 +87,7 @@ spec:
             runAsGroup: 101
           containers:
             - name: clickhouse
-              image: docker.io/clickhouse/clickhouse-server:24.8
+              image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/clickhouse/clickhouse-server:24.8
               resources:
                 requests:
                   cpu: 500m

apps/base/logging/job_clickhouse-schema.yaml

@@ -32,7 +32,7 @@ spec:
         runAsGroup: 101
       containers:
         - name: clickhouse-schema
-          image: docker.io/clickhouse/clickhouse-server:24.8
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/clickhouse/clickhouse-server:24.8
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

apps/base/logging/logviewer/oauth2-proxy-deployment.yaml

@@ -34,7 +34,7 @@ spec:
         # identity.unkin.net serves a Vault-PKI cert; combine the system roots
         # with the internal CA so oauth2-proxy's OIDC HTTP client trusts it.
         - name: combine-certs
-          image: docker.io/library/alpine:3
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3
           imagePullPolicy: IfNotPresent
           command:
             - sh

apps/base/logging/nats-bootstrap-job.yaml

@@ -58,7 +58,7 @@ spec:
         runAsGroup: 1000
       containers:
         - name: nats-bootstrap
-          image: docker.io/natsio/nats-box:0.18.0
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/natsio/nats-box:0.18.0
           # nats CLI stats the working directory when loading its response
           # schemas; under readOnlyRootFilesystem + runAsUser 1000 the image's
           # default WORKDIR is not accessible ("stat .: permission denied"), so

apps/base/mediamark/deployment.yaml

@@ -1,114 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mediamark
-  namespace: mediamark
-  annotations:
-    secret.reloader.stakater.com/reload: "arrstack-virtual-key"
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: mediamark
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: mediamark
-    spec:
-      serviceAccountName: default
-      automountServiceAccountToken: false
-      securityContext:
-        runAsNonRoot: true
-        # 1000:1000 matches the media tree ownership on the shared mediastore
-        # subvolume; mediamark hardlinks/renames files the *arr apps own, so it
-        # deliberately does NOT run as the usual 65532.
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: mediamark
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/mediamark:v0.1.0
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 8080
-              name: http
-              protocol: TCP
-          env:
-            - name: MEDIAMARK_MEDIA_ROOT
-              value: /media
-            - name: MEDIAMARK_KEYS_DIR
-              value: /etc/mediamark/keys
-            # Virtual keys are only honoured by arrproxy, which validates the
-            # machine token and injects the real per-app key upstream; the
-            # sonarr/radarr Services would reject them.
-            - name: MEDIAMARK_SONARR_URL
-              value: http://arrproxy-api.arrstack.svc.cluster.local:8080/3aa168/sonarr
-            - name: MEDIAMARK_RADARR_URL
-              value: http://arrproxy-api.arrstack.svc.cluster.local:8080/3aa168/radarr
-            # oauth2-proxy --pass-user-headers forwards the Authentik groups as a
-            # comma-joined X-Forwarded-Groups; X-Auth-Request-Groups is
-            # auth_request-response-only and never reaches a proxied upstream.
-            - name: MEDIAMARK_GROUPS_HEADER
-              value: X-Forwarded-Groups
-            - name: MEDIAMARK_ALLOWED_GROUPS
-              value: akP-mediamark-user
-          volumeMounts:
-            - name: mediastore
-              mountPath: /media
-            - name: arr-keys
-              mountPath: /etc/mediamark/keys
-              readOnly: true
-          livenessProbe:
-            httpGet:
-              path: /livez
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-      volumes:
-        - name: mediastore
-          persistentVolumeClaim:
-            claimName: mediamark-mediastore
-        # One ephemeral virtual key covers both apps, so the same token lands on
-        # both per-app files under MEDIAMARK_KEYS_DIR; mediamark re-reads the
-        # file per request, so lease renewal rotates in place.
-        - name: arr-keys
-          projected:
-            sources:
-              - secret:
-                  name: arrstack-virtual-key
-                  items:
-                    - key: token
-                      path: sonarr
-                    - key: token
-                      path: radarr
-      restartPolicy: Always

apps/base/mediamark/gateway-external.yaml

@@ -1,39 +0,0 @@
----
-# External (DMZ) front for mediamark on mediamark.unkin.net via the external
-# Traefik (LB VIP 198.18.199.0). TLS terminates with the real Let's Encrypt
-# *.unkin.net wildcard (Certificate wildcard-unkin-net in cert-manager,
-# reflected into this namespace as wildcard-unkin-net-tls by the emberstack
-# reflector), so there is no cert-manager annotation here. The apex
-# mediamark.unkin.net A record lives in the bind-operator unkin.net zone, NOT
-# external-dns, so no external-dns annotation either. oauth2-proxy fronts both
-# hostnames.
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: external
-  name: mediamark-external
-  namespace: mediamark
-spec:
-  gatewayClassName: traefik-external
-  listeners:
-    - name: http
-      port: 80
-      protocol: HTTP
-      hostname: mediamark.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-    - name: https
-      port: 443
-      protocol: HTTPS
-      hostname: mediamark.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-      tls:
-        mode: Terminate
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: wildcard-unkin-net-tls

apps/base/mediamark/kustomization.yaml

@@ -1,19 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-  - vaultdynamicsecret.yaml
-  - pv-mediastore.yaml
-  - pvc-mediastore.yaml
-  - deployment.yaml
-  - oauth2-proxy-configmap.yaml
-  - oauth2-proxy-deployment.yaml
-  - service.yaml
-  - gateway.yaml
-  - httproute.yaml
-  - gateway-external.yaml
-  - httproute-external.yaml

apps/base/mediamark/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app.kubernetes.io/name: mediamark
-  name: mediamark

apps/base/mediamark/oauth2-proxy-configmap.yaml

@@ -1,45 +0,0 @@
----
-# Non-secret oauth2-proxy configuration (client_id/secret/cookie_secret come
-# from the oauth-credentials Secret). Single auth front for mediamark on both
-# host names; access is gated here on the akP-mediamark-user Authentik group and
-# re-checked by the app from X-Forwarded-Groups.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: mediamark-oauth2-env
-  namespace: mediamark
-data:
-  OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
-  OAUTH2_PROXY_PROVIDER: "oidc"
-  OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/mediamark/"
-  # Relative (host-less) redirect URL: with reverse-proxy mode on, oauth2-proxy
-  # derives scheme+host per request from X-Forwarded-Proto/Host, so the same
-  # deployment serves BOTH the external mediamark.unkin.net and internal
-  # mediamark.k8s.syd1.au.unkin.net callbacks. Both absolute callback URIs are
-  # registered on the Authentik provider (terraform-authentik, separate PR).
-  OAUTH2_PROXY_REDIRECT_URL: "/oauth2/callback"
-  OAUTH2_PROXY_UPSTREAMS: "http://mediamark.mediamark.svc.cluster.local:8080/"
-  OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
-  # Populate session.Groups from the Authentik ak_groups claim; pass-user-headers
-  # then emits it as a single comma-joined X-Forwarded-Groups header.
-  OAUTH2_PROXY_OIDC_GROUPS_CLAIM: "ak_groups"
-  OAUTH2_PROXY_ALLOWED_GROUPS: "akP-mediamark-user"
-  # Forward identity + groups to mediamark as X-Forwarded-{User,Email,Groups}.
-  # NOTE: set-xauthrequest is intentionally NOT set -- it only populates
-  # auth_request *response* headers, which never reach a proxied upstream.
-  OAUTH2_PROXY_PASS_USER_HEADERS: "true"
-  OAUTH2_PROXY_EMAIL_DOMAINS: "*"
-  # Authentik hardcodes email_verified=false in the id_token; authorization is
-  # enforced via ak_groups, so accepting the unverified email is safe.
-  OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true"
-  OAUTH2_PROXY_COOKIE_SECURE: "true"
-  # One cookie domain per host (a single parent-domain cookie can't span
-  # unkin.net and k8s.syd1.au.unkin.net cleanly); oauth2-proxy picks the domain
-  # matching the request host. Whitelist both so post-auth `rd` redirects to
-  # either front door are honoured.
-  OAUTH2_PROXY_COOKIE_DOMAINS: "mediamark.unkin.net,mediamark.k8s.syd1.au.unkin.net"
-  OAUTH2_PROXY_WHITELIST_DOMAINS: "mediamark.unkin.net,mediamark.k8s.syd1.au.unkin.net"
-  OAUTH2_PROXY_REVERSE_PROXY: "true"
-  OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt"
-  OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256"
-  OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"

apps/base/mediamark/oauth2-proxy-deployment.yaml

@@ -1,133 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mediamark-oauth2
-  namespace: mediamark
-  annotations:
-    configmap.reloader.stakater.com/auto: "true"
-    secret.reloader.stakater.com/reload: "oauth-credentials,vault-ca-cert"
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: mediamark-oauth2
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: mediamark-oauth2
-    spec:
-      serviceAccountName: default
-      automountServiceAccountToken: false
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        fsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      initContainers:
-        # The Authentik issuer is served behind the internal unkin.net CA;
-        # combine the system roots with it so oauth2-proxy's OIDC HTTP client
-        # trusts the discovery endpoint.
-        - name: combine-certs
-          image: docker.io/library/alpine:3
-          imagePullPolicy: IfNotPresent
-          command:
-            - sh
-            - -c
-            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
-          volumeMounts:
-            - name: vault-ca-cert
-              mountPath: /custom-ca
-              readOnly: true
-            - name: combined-certs
-              mountPath: /combined-certs
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 50m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 64Mi
-      containers:
-        - name: oauth2-proxy
-          image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 4180
-              name: http
-              protocol: TCP
-          envFrom:
-            - configMapRef:
-                name: mediamark-oauth2-env
-                optional: false
-          env:
-            - name: OAUTH2_PROXY_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: oauth-credentials
-                  key: client_id
-            - name: OAUTH2_PROXY_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: oauth-credentials
-                  key: client_secret
-            - name: OAUTH2_PROXY_COOKIE_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: oauth-credentials
-                  key: cookie_secret
-          volumeMounts:
-            - name: combined-certs
-              mountPath: /etc/ssl/combined
-              readOnly: true
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-      volumes:
-        - name: vault-ca-cert
-          secret:
-            secretName: vault-ca-cert
-            items:
-              - key: ca.crt
-                path: ca.crt
-        - name: combined-certs
-          emptyDir: {}
-      restartPolicy: Always

apps/base/mediamark/pv-mediastore.yaml

@@ -1,32 +0,0 @@
----
-# Static PV for the shared MEDIASTORE CephFS subvolume, same rootPath as the
-# arrstack/fafflix/cheeztv mediastore PVs. Each namespace gets its own PV
-# (unique name + volumeHandle) pinned by claimRef; mediamark reads and rewrites
-# the same library tree the *arr apps import into, so it must be the same
-# filesystem (hardlink-safe).
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: mediamark-mediastore
-spec:
-  capacity:
-    storage: 10Ti
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: ""
-  volumeMode: Filesystem
-  claimRef:
-    namespace: mediamark
-    name: mediamark-mediastore
-  csi:
-    driver: cephfs.csi.ceph.com
-    volumeHandle: mediamark-mediastore-static
-    nodeStageSecretRef:
-      name: csi-cephfs-secret
-      namespace: csi-cephfs
-    volumeAttributes:
-      staticVolume: "true"
-      clusterID: cephfs_csi_ssd_ec_4_1
-      fsName: cephfs
-      rootPath: /volumes/csi_ssd_ec_4_1/mediastore/a0152dac-a51b-4b95-ac5e-ecdd99bfe3f1

apps/base/mediamark/pvc-mediastore.yaml

@@ -1,20 +0,0 @@
----
-# Statically bound to the mediamark-mediastore PV; storageClassName "" +
-# volumeName disables dynamic provisioning. Not backed up here -- the media tree
-# is backed up once from arrstack.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: mediamark-mediastore
-  namespace: mediamark
-  annotations:
-    k8up.io/backup: "false"
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Ti
-  storageClassName: ""
-  volumeName: mediamark-mediastore
-  volumeMode: Filesystem

apps/base/mediamark/service.yaml

@@ -1,36 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: mediamark
-  namespace: mediamark
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 8080
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: mediamark
-  sessionAffinity: None
-  type: ClusterIP
----
-# Front-door entry Service: both HTTPRoutes target this; all traffic enters via
-# oauth2-proxy.
-apiVersion: v1
-kind: Service
-metadata:
-  name: mediamark-oauth2
-  namespace: mediamark
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 4180
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: mediamark-oauth2
-  sessionAffinity: None
-  type: ClusterIP

apps/base/mediamark/vaultauth.yaml

@@ -1,38 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: mediamark
-spec:
-  allowedNamespaces:
-    - mediamark
-  kubernetes:
-    audiences:
-      - vault
-    role: default
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default
----
-# Separate auth for the arrstack secrets engine: the `mediamark` k8s role is the
-# only one whose policy grants arrstack/creds/mediamark.
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: arrstack-creds
-  namespace: mediamark
-spec:
-  allowedNamespaces:
-    - mediamark
-  kubernetes:
-    audiences:
-      - vault
-    role: mediamark
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default

apps/base/mediamark/vaultdynamicsecret.yaml

@@ -1,21 +0,0 @@
----
-# Ephemeral arrstack virtual key. The engine mints one machine token covering
-# both radarr and sonarr; it is only honoured by arrproxy, which validates it and
-# swaps in the real per-app key upstream. Role ttl is 60s, so VSO renews the
-# lease continuously (renewalPercent default 67) and rewrites the secret; the
-# reloader annotation restarts pods when the token actually changes.
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultDynamicSecret
-metadata:
-  name: arrstack-virtual-key
-  namespace: mediamark
-spec:
-  allowStaticCreds: false
-  destination:
-    create: true
-    name: arrstack-virtual-key
-    overwrite: true
-  mount: arrstack
-  path: creds/mediamark
-  revoke: true
-  vaultAuthRef: arrstack-creds

apps/base/mediamark/vaultstaticsecret.yaml

@@ -1,22 +0,0 @@
----
-# Authentik OIDC client for the mediamark front door (client_id, client_secret,
-# cookie_secret) at kv/kubernetes/namespace/mediamark/default/oauth-credentials.
-# The default k8s role's templated policy already grants read on
-# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*, so no
-# terraform-vault change is needed.
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: oauth-credentials
-  namespace: mediamark
-spec:
-  destination:
-    create: true
-    name: oauth-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/mediamark/default/oauth-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/netbox/valkey-deployment.yaml

@@ -83,7 +83,7 @@ spec:
             - mountPath: /data
               name: data
         - name: metrics-exporter
-          image: docker.io/oliver006/redis_exporter:v1.89.0
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 9121

apps/base/repospawner/deployment.yaml

@@ -1,123 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: repospawner
-  namespace: repospawner
-  annotations:
-    secret.reloader.stakater.com/reload: "repospawner-woodpecker"
-spec:
-  # Request state lives in memory and is rebuilt from Job labels on startup, so
-  # exactly one replica may exist at a time.
-  replicas: 1
-  selector:
-    matchLabels:
-      app: repospawner
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: repospawner
-    spec:
-      serviceAccountName: repospawner
-      automountServiceAccountToken: true
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        fsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: repospawner
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/repospawner:v0.1.1
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 8080
-              name: http
-              protocol: TCP
-          env:
-            - name: REPOSPAWNER_NAMESPACE
-              value: repospawner
-            # The server passes its own image down to the Jobs, so this must
-            # match the image above exactly.
-            - name: REPOSPAWNER_IMAGE
-              value: artifactapi.k8s.syd1.au.unkin.net/docker-internal/repospawner:v0.1.1
-            - name: REPOSPAWNER_JOB_SERVICE_ACCOUNT
-              value: repospawner
-            - name: GITEA_URL
-              value: https://git.unkin.net
-            - name: REPOSPAWNER_TFGIT_REPO
-              value: unkin/terraform-git
-            - name: VAULT_ADDR
-              value: https://vault.service.consul:8200
-            - name: WOODPECKER_SERVER
-              value: https://ci.k8s.syd1.au.unkin.net
-            # Name only: the enablement Job mounts this Secret itself.
-            - name: REPOSPAWNER_WOODPECKER_SECRET
-              value: repospawner-woodpecker
-            - name: REPOSPAWNER_WOODPECKER_TOKEN_FILE
-              value: /etc/repospawner/woodpecker/token
-            # oauth2-proxy --pass-user-headers forwards the Authentik groups as a
-            # comma-joined X-Forwarded-Groups; X-Auth-Request-Groups is
-            # auth_request-response-only and never reaches a proxied upstream.
-            - name: REPOSPAWNER_GROUPS_HEADER
-              value: X-Forwarded-Groups
-            - name: REPOSPAWNER_ALLOWED_GROUPS
-              value: akP-repospawner-admin
-          volumeMounts:
-            - name: vault-token
-              mountPath: /var/run/secrets/vault
-              readOnly: true
-            - name: woodpecker-token
-              mountPath: /etc/repospawner/woodpecker
-              readOnly: true
-          livenessProbe:
-            httpGet:
-              path: /livez
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 300m
-              memory: 256Mi
-      volumes:
-        # Native Vault kubernetes login: the default kubernetes.io token has the
-        # wrong audience, so the app reads this audience-vault projection.
-        - name: vault-token
-          projected:
-            sources:
-              - serviceAccountToken:
-                  path: token
-                  audience: vault
-                  expirationSeconds: 600
-        # Optional: absent, the server starts and refuses woodpecker requests.
-        - name: woodpecker-token
-          secret:
-            secretName: repospawner-woodpecker
-            optional: true
-            items:
-              - key: token
-                path: token
-      restartPolicy: Always

apps/base/repospawner/gateway-external.yaml

@@ -1,39 +0,0 @@
----
-# External (DMZ) front for repospawner on repospawner.unkin.net via the external
-# Traefik (LB VIP 198.18.199.0). TLS terminates with the real Let's Encrypt
-# *.unkin.net wildcard (Certificate wildcard-unkin-net in cert-manager,
-# reflected into this namespace as wildcard-unkin-net-tls by the emberstack
-# reflector), so there is no cert-manager annotation here. The apex
-# repospawner.unkin.net A record lives in the bind-operator unkin.net zone, NOT
-# external-dns, so no external-dns annotation either. oauth2-proxy fronts both
-# hostnames.
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: external
-  name: repospawner-external
-  namespace: repospawner
-spec:
-  gatewayClassName: traefik-external
-  listeners:
-    - name: http
-      port: 80
-      protocol: HTTP
-      hostname: repospawner.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-    - name: https
-      port: 443
-      protocol: HTTPS
-      hostname: repospawner.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-      tls:
-        mode: Terminate
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: wildcard-unkin-net-tls

apps/base/repospawner/httproute-external.yaml

@@ -1,49 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: repospawner-external-http-redirect
-  namespace: repospawner
-spec:
-  hostnames:
-    - repospawner.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: repospawner-external
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: repospawner-external
-  namespace: repospawner
-spec:
-  hostnames:
-    - repospawner.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: repospawner-external
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: repospawner-oauth2
-          port: 4180
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/repospawner/httproute.yaml

@@ -1,49 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: repospawner-http-redirect
-  namespace: repospawner
-spec:
-  hostnames:
-    - repospawner.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: repospawner
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: repospawner
-  namespace: repospawner
-spec:
-  hostnames:
-    - repospawner.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: repospawner
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: repospawner-oauth2
-          port: 4180
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /