unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

deploy arrproxy (oauth2-gated *arr proxy + per-user API keys) #377

Merged
benvin merged 1 commits from benvin/arrproxy-deploy into main 2026-08-16 22:26:21 +10:00
Conversation 0 Commits 1 Files Changed 15
+916
unkin-agent commented 2026-08-16 21:45:49 +10:00
Member
Copy Link
Copy Source

Deploys arrproxy v0.1.0 (task 9 final integration) into the existing arrstack app: the external, Authentik-gated front door for sonarr/radarr/prowlarr with per-user API-key brokering. Manifests are wired to match the arrproxy v0.1.0 code (ports, routes, identity headers, keys dir), mirroring the ghp/artifactapi estate patterns.

Topology (apps/base/arrstack/arrproxy/)

  • oauth2-proxy Deployment + Service arrproxy is the single front (OIDC against the Authentik arrstack app). It path-routes via --upstreams to:
    • arrproxy-ui for / and static SPA assets,
    • arrproxy-api for /api/* (token API) and /sonarr|/radarr|/prowlarr (the *arr proxy).
    • --skip-auth-regex=^/[^/]+/api bypasses oauth only for the *arr proxy API (/sonarr/api...), while /api/tokens, /api/me and the UI stay authenticated.
  • Identity+groups reach the api via --pass-user-headers (X-Forwarded-{User,Email,Groups}). The api reads ARRPROXY_GROUPS_HEADER=X-Forwarded-Groups — --set-xauthrequest only populates auth_request response headers and never reaches an --upstreams backend, so it is intentionally not used.
  • oauth2-proxy trusts identity.unkin.net (internal Vault-PKI CA) via a combine-certs initContainer (system roots + vault-ca-cert), same pattern as artifactapi.

Data + secrets

  • CNPG token store arrproxy-db (2 instances, cephrgw S3 backups + nightly ScheduledBackup). arrproxy-api does not self-migrate, so a wave-1 ArgoCD Sync hook Job applies migrations/0001_init.sql (mirrored into a ConfigMap) as the CNPG app user. DSN built from the generated arrproxy-db-app Secret.
  • VaultStaticSecrets (arrstack default SA / templated role — no terraform-vault change): arrproxy-pepper (seeded) and oauth-credentials. The three real *arr keys are reused from the existing <app>-apikey Secrets, projected one file per app into /etc/arrproxy/keys.

Exposure

  • Gateway traefik-external, hostname arrstack.unkin.net, cert-manager vault-issuer TLS (arrproxy-gateway-tls); HTTPRoute → the oauth2-proxy entry Service (+ HTTP→HTTPS redirect).
  • Adds the arrstack.unkin.net apex A record → external DMZ VIP 198.18.199.0 to the bind-operator unkin.net zone (apps/base/bind-internal/authoritative/records.yaml), mirroring the ghp/identity apex records.

Validation

  • kustomize build --enable-helm apps/overlays/au-syd1/arrstack renders cleanly; kubeconform = 51/51 valid; pre-commit passes (no plain Secrets).

Prerequisites / flags for end-to-end function (NOT in this PR)

  • (a) Each *arr must run with UrlBase=/<app> (path-based hosting) — arrproxy preserves the /<app> prefix upstream.
  • (b) The Authentik arrstack OIDC app (terraform-authentik PR #18) must be applied, with redirect URI https://arrstack.unkin.net/oauth2/callback registered and the ak_groups scope emitted. Confirm the discovery slug matches OAUTH2_PROXY_OIDC_ISSUER_URL (https://identity.unkin.net/application/o/arrstack/).
  • (c) Browser XHR to /<app>/api is oauth-bypassed (skip-auth-regex), so the SPA-driven proxy calls that rely on the session (no per-user token) will not carry identity on that path — expected per the arrproxy trust model; token-based *arr clients are unaffected.
  • NetworkPolicy: the arrproxy-api Service is not exposed via any HTTPRoute and the api strips forged identity headers in-code, but the README recommends a NetworkPolicy restricting api ingress to oauth2-proxy. The estate currently has zero NetworkPolicies, so one was not added here to avoid being the first (and risking probe breakage) before the CNI’s policy/probe behavior is confirmed — flagged as follow-up hardening.
  • Please confirm: CNPG size (2 instances / 10Gi), backups on, hostname/VIP, and UI theme.

ARRPROXY_PEPPER was seeded via the agents AppRole at kv/kubernetes/namespace/arrstack/default/arrproxy-pepper (key pepper).

Deploys arrproxy v0.1.0 (task 9 final integration) into the existing `arrstack` app: the external, Authentik-gated front door for sonarr/radarr/prowlarr with per-user API-key brokering. Manifests are wired to match the arrproxy v0.1.0 code (ports, routes, identity headers, keys dir), mirroring the ghp/artifactapi estate patterns. ## Topology (`apps/base/arrstack/arrproxy/`) - **oauth2-proxy** Deployment + Service `arrproxy` is the single front (OIDC against the Authentik `arrstack` app). It path-routes via `--upstreams` to: - `arrproxy-ui` for `/` and static SPA assets, - `arrproxy-api` for `/api/*` (token API) and `/sonarr|/radarr|/prowlarr` (the *arr proxy). - `--skip-auth-regex=^/[^/]+/api` bypasses oauth **only** for the *arr proxy API (`/sonarr/api...`), while `/api/tokens`, `/api/me` and the UI stay authenticated. - Identity+groups reach the api via `--pass-user-headers` (`X-Forwarded-{User,Email,Groups}`). The api reads `ARRPROXY_GROUPS_HEADER=X-Forwarded-Groups` — `--set-xauthrequest` only populates auth_request *response* headers and never reaches an `--upstreams` backend, so it is intentionally not used. - oauth2-proxy trusts `identity.unkin.net` (internal Vault-PKI CA) via a `combine-certs` initContainer (system roots + `vault-ca-cert`), same pattern as artifactapi. ## Data + secrets - **CNPG** token store `arrproxy-db` (2 instances, cephrgw S3 backups + nightly ScheduledBackup). arrproxy-api does **not** self-migrate, so a wave-1 ArgoCD `Sync` hook Job applies `migrations/0001_init.sql` (mirrored into a ConfigMap) as the CNPG app user. DSN built from the generated `arrproxy-db-app` Secret. - **VaultStaticSecrets** (arrstack `default` SA / templated role — no terraform-vault change): `arrproxy-pepper` (seeded) and `oauth-credentials`. The three real *arr keys are **reused** from the existing `<app>-apikey` Secrets, projected one file per app into `/etc/arrproxy/keys`. ## Exposure - **Gateway** `traefik-external`, hostname `arrstack.unkin.net`, cert-manager `vault-issuer` TLS (`arrproxy-gateway-tls`); HTTPRoute → the oauth2-proxy entry Service (+ HTTP→HTTPS redirect). - Adds the `arrstack.unkin.net` apex A record → external DMZ VIP `198.18.199.0` to the bind-operator `unkin.net` zone (`apps/base/bind-internal/authoritative/records.yaml`), mirroring the ghp/identity apex records. ## Validation - `kustomize build --enable-helm apps/overlays/au-syd1/arrstack` renders cleanly; `kubeconform` = 51/51 valid; `pre-commit` passes (no plain Secrets). ## Prerequisites / flags for end-to-end function (NOT in this PR) - **(a)** Each *arr must run with `UrlBase=/<app>` (path-based hosting) — arrproxy preserves the `/<app>` prefix upstream. - **(b)** The Authentik `arrstack` OIDC app (terraform-authentik PR #18) must be applied, with redirect URI `https://arrstack.unkin.net/oauth2/callback` registered and the `ak_groups` scope emitted. Confirm the discovery slug matches `OAUTH2_PROXY_OIDC_ISSUER_URL` (`https://identity.unkin.net/application/o/arrstack/`). - **(c)** Browser XHR to `/<app>/api` is oauth-**bypassed** (skip-auth-regex), so the SPA-driven proxy calls that rely on the session (no per-user token) will not carry identity on that path — expected per the arrproxy trust model; token-based *arr clients are unaffected. - **NetworkPolicy:** the arrproxy-api Service is not exposed via any HTTPRoute and the api strips forged identity headers in-code, but the README recommends a NetworkPolicy restricting api ingress to oauth2-proxy. The estate currently has **zero** NetworkPolicies, so one was not added here to avoid being the first (and risking probe breakage) before the CNI’s policy/probe behavior is confirmed — flagged as follow-up hardening. - Please confirm: CNPG size (2 instances / 10Gi), backups on, hostname/VIP, and UI theme. ARRPROXY_PEPPER was seeded via the agents AppRole at `kv/kubernetes/namespace/arrstack/default/arrproxy-pepper` (key `pepper`).
unkin-agent added 1 commit 2026-08-16 21:45:49 +10:00
deploy arrproxy (oauth2-gated *arr proxy + per-user API keys)
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
20c603dd84 
Adds the arrproxy front door to the arrstack app: the external, oauth-gated
entry to sonarr/radarr/prowlarr with per-user API-key brokering, wired to match
the arrproxy v0.1.0 code (ports, routes, identity headers, keys dir).

Topology (apps/base/arrstack/arrproxy):
- oauth2-proxy Deployment/Service is the single front (Authentik OIDC), path-
  routing via --upstreams to arrproxy-ui (/, static SPA) and arrproxy-api
  (/api token API + /<app> proxy). skip-auth-regex ^/[^/]+/api bypasses auth
  only for the *arr proxy API (/sonarr/api...), keeping /api/tokens + /api/me
  and the UI authenticated.
- Identity+groups reach the api via --pass-user-headers (X-Forwarded-*); the api
  reads ARRPROXY_GROUPS_HEADER=X-Forwarded-Groups (set-xauthrequest is
  auth_request-response-only and never reaches an upstream).
- oauth2-proxy trusts identity.unkin.net's internal-CA cert via a combine-certs
  initContainer (system roots + vault-ca-cert).
- CNPG token store (arrproxy-db, 2 instances, cephrgw backups); a wave-1 Sync
  hook Job applies the schema (arrproxy-api does not self-migrate).
- VaultStaticSecrets for the seeded ARRPROXY_PEPPER and the oauth-credentials;
  the real *arr keys reuse the existing <app>-apikey Secrets (projected one file
  per app into /etc/arrproxy/keys).
- External Gateway (traefik-external, arrstack.unkin.net, vault-issuer TLS) +
  HTTPRoute to the oauth2-proxy entry.

Also adds the arrstack.unkin.net apex A record (-> external DMZ VIP 198.18.199.0)
to the bind-operator unkin.net zone.
benvin merged commit cd8e2c262f into main 2026-08-16 22:26:21 +10:00
benvin deleted branch benvin/arrproxy-deploy 2026-08-16 22:26:21 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#377
Delete Branch "benvin/arrproxy-deploy"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?