Add cheeztv kids Jellyfin instance + fafflix kids mounts #413

Merged

benvin merged 5 commits from benvin/cheeztv into main 2026-08-25 19:59:09 +10:00

Conversation 1 Commits 5 Files Changed 26

+1070

unkin-agent commented 2026-08-24 22:08:32 +10:00

Member

Copy Link

Copy Source

Why

Kids need their own safe Jellyfin front (cheeztv.unkin.net) with a library that only ever exposes kids titles, while those same titles stay resumable in the existing adult instance (fafflix). The fafflix.unkin.net domain switch is deliberately out of scope.

How

• New cheeztv instance (apps/base/cheeztv): mirrors the fafflix HA Jellyfin stack 1:1 - same jellyfin-ha:v0.1.3 fork image, 2-replica StatefulSet, RWX transcode PVC + HA takeover, Intel iGPU transcode, CNPG Postgres + PgBouncer, Valkey transcode store, k8up config backup, VMPodScrape.
• Kids-only media: its own static PVs on the same shared movies/tv CephFS subvolumes, mounted with subPath: kids so it sees only movies/kids and tvshows/kids.
• Fully separate state: own namespace, config PVC, cheeztv-postgres cluster, cheeztv-valkey, and cnpg-cheeztv / cheeztv-config-backup RGW buckets - nothing shared with fafflix.
• DNS/cert: cheeztv.unkin.net via internal Traefik + external-dns (198.18.200.4) + cert-manager cheeztv-tls, matching logviewer.unkin.net; plus the cluster hostname cheeztv.k8s.syd1.au.unkin.net mirroring fafflix.
• fafflix change: ADDS movies/kids + tvshows/kids subPath mounts alongside its current media mounts so kids libraries are resumable there. Existing mounts, hostname and ingress untouched.
• Registers cheeztv in the media ApplicationSet generator and AppProject destinations.

Validation

kubeconform clean: cheeztv 28/28, jellyfin 25/25 valid. No arr/watchstate/domain changes.

Note: the k8up restic repo password must be seeded at kv/kubernetes/namespace/cheeztv/default/k8up-restic (same manual step as fafflix); templated Vault policy already grants read, no terraform-vault change needed.

## Why Kids need their own safe Jellyfin front (cheeztv.unkin.net) with a library that only ever exposes kids titles, while those same titles stay resumable in the existing adult instance (fafflix). The fafflix.unkin.net domain switch is deliberately out of scope. ## How - **New `cheeztv` instance** (`apps/base/cheeztv`): mirrors the fafflix HA Jellyfin stack 1:1 - same `jellyfin-ha:v0.1.3` fork image, 2-replica StatefulSet, RWX transcode PVC + HA takeover, Intel iGPU transcode, CNPG Postgres + PgBouncer, Valkey transcode store, k8up config backup, VMPodScrape. - **Kids-only media**: its own static PVs on the *same* shared movies/tv CephFS subvolumes, mounted with `subPath: kids` so it sees only `movies/kids` and `tvshows/kids`. - **Fully separate state**: own namespace, config PVC, `cheeztv-postgres` cluster, `cheeztv-valkey`, and `cnpg-cheeztv` / `cheeztv-config-backup` RGW buckets - nothing shared with fafflix. - **DNS/cert**: `cheeztv.unkin.net` via internal Traefik + external-dns (198.18.200.4) + cert-manager `cheeztv-tls`, matching logviewer.unkin.net; plus the cluster hostname `cheeztv.k8s.syd1.au.unkin.net` mirroring fafflix. - **fafflix change**: ADDS `movies/kids` + `tvshows/kids` subPath mounts alongside its current media mounts so kids libraries are resumable there. Existing mounts, hostname and ingress untouched. - Registers cheeztv in the media ApplicationSet generator and AppProject destinations. ## Validation kubeconform clean: cheeztv 28/28, jellyfin 25/25 valid. No arr/watchstate/domain changes. Note: the k8up restic repo password must be seeded at `kv/kubernetes/namespace/cheeztv/default/k8up-restic` (same manual step as fafflix); templated Vault policy already grants read, no terraform-vault change needed.

unkin-agent added 1 commit 2026-08-24 22:08:32 +10:00

Add cheeztv kids Jellyfin instance and fafflix kids mounts ... a4253f09cd

cheeztv is a second, kids-only Jellyfin instance in the media project. Kids
titles need a separate, safe library front (cheeztv.unkin.net) while staying
resumable in the existing adult instance (fafflix).

- apps/base/cheeztv: mirror the jellyfin (fafflix) HA stack 1:1 - same
  jellyfin-ha:v0.1.3 fork image, 2-replica StatefulSet, RWX transcode PVC,
  Intel iGPU transcode, CNPG Postgres + PgBouncer, Valkey transcode store,
  k8up config backup, VMPodScrape. Media mounts subPath kids on the shared
  movies/tv CephFS subvolumes so cheeztv sees only the kids trees.
- Separate state: own namespace, config PVC, cheeztv-postgres cluster,
  cheeztv-valkey, and cnpg-cheeztv / cheeztv-config-backup buckets - nothing
  shared with fafflix.
- Ingress/DNS: cheeztv.unkin.net (internal Traefik + external-dns at
  198.18.200.4, cert-manager cheeztv-tls) plus the cluster hostname variant
  cheeztv.k8s.syd1.au.unkin.net, matching how fafflix and logviewer.unkin.net
  are wired.
- fafflix: add movies/kids and tvshows/kids subPath mounts alongside its
  existing media mounts so kids libraries are browsable/resumable there; its
  existing mounts, hostname and ingress are untouched.
- Register cheeztv in the media ApplicationSet generator and AppProject
  destinations.

unkinben added 1 commit 2026-08-24 22:26:06 +10:00

fix: convert third-party image URLs from artifactapi proxies to upstream registries ... a7a96bd879

- valkey: docker.io/valkey/valkey (was artifactapi/dockerhub)
- redis_exporter: docker.io/oliver006/redis_exporter (was artifactapi/dockerhub)

Kept docker-internal images unchanged per policy.

unkin-agent commented 2026-08-24 22:28:47 +10:00

Author

Member

Copy Link

Copy Source

Delta commit a7a96bd (image URL swap) looks correct — docker.io/valkey/valkey:9.0.0 and docker.io/oliver006/redis_exporter:v1.89.0 in apps/base/cheeztv/valkey.yaml, tags unchanged, no other edits. CI green on a7a96bd (vector-test, pre-commit, kubeconform all success).

One nit: the comment block directly above the exporter image (lines ~29-32 of valkey.yaml) is now stale — it still says the image was overridden 'to the artifactapi-proxied pin', but it now points at canonical docker.io/oliver006/redis_exporter:v1.89.0 instead. Worth a quick wording fix so the comment doesn't mislead future readers into thinking this is still artifactapi-proxied.

Delta commit a7a96bd (image URL swap) looks correct — `docker.io/valkey/valkey:9.0.0` and `docker.io/oliver006/redis_exporter:v1.89.0` in `apps/base/cheeztv/valkey.yaml`, tags unchanged, no other edits. CI green on a7a96bd (vector-test, pre-commit, kubeconform all success). One nit: the comment block directly above the exporter image (lines ~29-32 of valkey.yaml) is now stale — it still says the image was overridden 'to the artifactapi-proxied pin', but it now points at canonical `docker.io/oliver006/redis_exporter:v1.89.0` instead. Worth a quick wording fix so the comment doesn't mislead future readers into thinking this is still artifactapi-proxied.

unkin-agent added 1 commit 2026-08-24 22:30:23 +10:00

Fix stale artifactapi comment in redis_exporter config b4f3491b18

unkinben added 1 commit 2026-08-24 22:42:47 +10:00

Fix storage class: cephfs-raid5-retain → cephfs-raid5-delete (cheeztv-config) f272a1dccb

unkin-agent referenced this pull request 2026-08-24 22:50:48 +10:00

Replace legacy jellyfin app with fafflix (adult, cheeztv pattern) #415

unkin-agent added 1 commit 2026-08-24 22:58:12 +10:00

Fix fafflix mount path references in cheeztv statefulset comment bf51e5056d

benvin merged commit 94da740a9d into main 2026-08-25 19:59:09 +10:00

benvin deleted branch benvin/cheeztv 2026-08-25 19:59:09 +10:00

benvin referenced this issue from a commit 2026-08-25 20:06:58 +10:00

Replace legacy jellyfin app with fafflix (adult, cheeztv pattern) (#415)

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/argocd-apps#413