unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

arrstack: S3 buckets + wiring for app backups and sonarr MediaCover #389

Merged
benvin merged 1 commits from benvin/arrstack-s3-buckets into main 2026-08-22 18:39:40 +10:00
Conversation 0 Commits 1 Files Changed 5
+172
unkin-agent commented 2026-08-22 18:21:27 +10:00
Member
Copy Link
Copy Source

Why

Servarr backups (periodic config+DB zips) and sonarr MediaCover posters still live on each replica's local /config emptyDir: backups are leader-local and lost on reschedule, and sonarr covers render inconsistently across the 3 active-active replicas. #387 moved radarr covers to a shared Ceph RGW bucket; this extends that pattern to backups for all three apps and to sonarr's covers.

Changes

  • Add an arrstack-backups ObjectStoreUser + Bucket (cephrgw-operator); the operator mints the arrstack-backups-s3 credential Secret in-namespace (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / S3_ENDPOINT), so no Vault KV seeding is required. Backups get their own bucket (not arrstack-media) because they carry secrets (Config.xml API keys, the DB) and warrant separate credentials/lifecycle from poster art; the three apps share it, isolated by a per-app key prefix.
  • Wire sonarr to the shared arrstack-media bucket via Sonarr__MediaCoverS3__* (prefix sonarr, partitioned from radarr's radarr prefix to avoid movie/series id collisions), plus the estate CA mount at /etc/ssl/vault-ca/ca.crt for RGW TLS validation.
  • Wire radarr/sonarr/prowlarr backups via <App>__BackupS3__* to arrstack-backups (per-app prefix); add the CA mount to sonarr and prowlarr.

Notes

  • Credentials come only from the operator-minted Secret via env; no secrets in manifests.
  • The env keys are consumed by the -unkin3+ images (separate app PRs) and ignored by older images, so this is safe to apply ahead of the image bump.
  • kubectl kustomize apps/base/arrstack builds clean.
## Why Servarr backups (periodic config+DB zips) and sonarr MediaCover posters still live on each replica's local `/config` emptyDir: backups are leader-local and lost on reschedule, and sonarr covers render inconsistently across the 3 active-active replicas. #387 moved radarr covers to a shared Ceph RGW bucket; this extends that pattern to backups for all three apps and to sonarr's covers. ## Changes - Add an `arrstack-backups` ObjectStoreUser + Bucket (cephrgw-operator); the operator mints the `arrstack-backups-s3` credential Secret in-namespace (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / S3_ENDPOINT), so no Vault KV seeding is required. Backups get their own bucket (not `arrstack-media`) because they carry secrets (Config.xml API keys, the DB) and warrant separate credentials/lifecycle from poster art; the three apps share it, isolated by a per-app key prefix. - Wire sonarr to the shared `arrstack-media` bucket via `Sonarr__MediaCoverS3__*` (prefix `sonarr`, partitioned from radarr's `radarr` prefix to avoid movie/series id collisions), plus the estate CA mount at `/etc/ssl/vault-ca/ca.crt` for RGW TLS validation. - Wire radarr/sonarr/prowlarr backups via `<App>__BackupS3__*` to `arrstack-backups` (per-app prefix); add the CA mount to sonarr and prowlarr. ## Notes - Credentials come only from the operator-minted Secret via env; no secrets in manifests. - The env keys are consumed by the -unkin3+ images (separate app PRs) and ignored by older images, so this is safe to apply ahead of the image bump. - `kubectl kustomize apps/base/arrstack` builds clean.
unkin-agent added 1 commit 2026-08-22 18:21:27 +10:00
arrstack: route app backups to S3 and wire sonarr MediaCover to the shared bucket
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
d795e22f3d 
## Why

Servarr backups (the periodic config+DB zips) and sonarr MediaCover posters
still live on each replica's local /config, which is an emptyDir. Backups are
leader-local and lost when the pod is rescheduled; sonarr covers render
inconsistently across the 3 active-active replicas. #387 already moved radarr
covers to a shared Ceph RGW bucket; this extends the same pattern to backups for
all three apps and to sonarr's covers.

## Changes

- Add an `arrstack-backups` ObjectStoreUser + Bucket (cephrgw-operator), minting
  the `arrstack-backups-s3` credential Secret in-namespace (no Vault KV seeding).
  Backups get their own bucket (not arrstack-media) because they carry secrets
  (Config.xml API keys, the DB) and warrant separate credentials/lifecycle from
  poster art; the three apps share it, isolated by a per-app key prefix.
- Wire sonarr to the shared `arrstack-media` bucket via `Sonarr__MediaCoverS3__*`
  (prefix `sonarr`, partitioned from radarr's `radarr` prefix), plus the estate
  CA mount at /etc/ssl/vault-ca/ca.crt for RGW TLS validation.
- Wire radarr/sonarr/prowlarr backups via `<App>__BackupS3__*` to
  `arrstack-backups` (per-app prefix); add the CA mount to sonarr and prowlarr.

## Notes

- The env keys are consumed by the -unkin3+ images (separate app PRs) and
  ignored by older images, so this is safe to apply ahead of the image bump.
- `kubectl kustomize apps/base/arrstack` builds clean.
benvin merged commit bdf6114794 into main 2026-08-22 18:39:40 +10:00
benvin deleted branch benvin/arrstack-s3-buckets 2026-08-22 18:39:40 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#389
Delete Branch "benvin/arrstack-s3-buckets"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?