unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

arrstack: provision shared Ceph RGW bucket for media assets #387

Merged
benvin merged 1 commits from benvin/arrstack-media-bucket into main 2026-08-22 16:17:23 +10:00
Conversation 0 Commits 1 Files Changed 3
+72
unkin-agent commented 2026-08-22 15:26:59 +10:00
Member
Copy Link
Copy Source

Why

Servarr MediaCover assets (movie/series posters and fanart) and app backups currently live on each replica's local /config, which is an emptyDir. A poster the leader downloads is invisible to the other replicas behind the Service, so covers render inconsistently and backups are leader-local. This provisions a shared Ceph RGW (S3) bucket to hold those assets instead.

Changes

  • Add an arrstack-media ObjectStoreUser + Bucket (cephrgw-operator), mirroring the CNPG backup pattern. The operator mints the arrstack-media-s3 credential Secret in-namespace (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, S3_ENDPOINT), so no Vault KV seeding is required.
  • Wire the radarr Deployment to the bucket via Radarr__MediaCover__S3__* env (creds from the operator Secret; estate CA mounted at /etc/ssl/vault-ca/ca.crt for RGW TLS validation).

Notes

  • The env keys are unknown to the current -unkin2 image and are ignored by it; they activate once the -unkin3+ image (radarr MediaCover-S3 support, separate radarr PR) ships. sonarr/prowlarr wiring and backups-to-S3 follow in later PRs.
  • kubectl kustomize apps/base/arrstack builds clean.
## Why Servarr MediaCover assets (movie/series posters and fanart) and app backups currently live on each replica's local `/config`, which is an `emptyDir`. A poster the leader downloads is invisible to the other replicas behind the Service, so covers render inconsistently and backups are leader-local. This provisions a shared Ceph RGW (S3) bucket to hold those assets instead. ## Changes - Add an `arrstack-media` `ObjectStoreUser` + `Bucket` (cephrgw-operator), mirroring the CNPG backup pattern. The operator mints the `arrstack-media-s3` credential Secret in-namespace (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `S3_ENDPOINT`), so **no Vault KV seeding is required**. - Wire the radarr Deployment to the bucket via `Radarr__MediaCover__S3__*` env (creds from the operator Secret; estate CA mounted at `/etc/ssl/vault-ca/ca.crt` for RGW TLS validation). ## Notes - The env keys are unknown to the current `-unkin2` image and are ignored by it; they activate once the `-unkin3+` image (radarr MediaCover-S3 support, separate radarr PR) ships. sonarr/prowlarr wiring and backups-to-S3 follow in later PRs. - `kubectl kustomize apps/base/arrstack` builds clean.
unkin-agent added 1 commit 2026-08-22 15:26:59 +10:00
arrstack: provision shared Ceph RGW bucket for media assets
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
8847e20e0e 
Servarr MediaCover (posters/fanart) and backups currently live on each
replica's local /config, which is an emptyDir - so covers a leader downloads
are invisible to the other replicas behind the Service. Provision a shared S3
bucket to hold these assets instead.

- Add an arrstack-media ObjectStoreUser + Bucket (cephrgw-operator), mirroring
  the CNPG backup pattern; the operator mints the arrstack-media-s3 credential
  Secret in-namespace, so no Vault KV seeding is required.
- Wire the radarr Deployment to the bucket via Radarr__MediaCover__S3__* env
  (creds from the operator Secret, estate CA mounted for RGW TLS). Unknown to
  the current image and activated by the -unkin3+ MediaCover-S3 build; sonarr
  and prowlarr wiring follow.
benvin merged commit 9cdcdf62bc into main 2026-08-22 16:17:23 +10:00
benvin deleted branch benvin/arrstack-media-bucket 2026-08-22 16:17:24 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#387
Delete Branch "benvin/arrstack-media-bucket"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?