unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

arrstack: wire arrproxy v0.4.0 tier routing (fafflix/cheeztv) #416

Merged
benvin merged 1 commits from benvin/arrproxy-tier-wiring into main 2026-08-25 20:49:05 +10:00
Conversation 0 Commits 1 Files Changed 5
+105 -26
unkin-agent commented 2026-08-25 20:31:05 +10:00
Member
Copy Link
Copy Source

Why

The old bare sonarr/radarr Services are gone, but arrproxy still ran the v0.3.x built-in default topology pointing at non-existent sonarr/radarr upstreams and mounted dead sonarr-apikey/radarr-apikey Secrets. This cuts the front door over to arrproxy v0.4.0 tier routing so the adult (fafflix, /3aa168) and kids (cheeztv, /3df803) *arr instances are reachable again, with per-tier group authorization.

Changes

  • Bump arrproxy-api and arrproxy-ui images to v0.4.0.
  • Add arrproxy-tiers ConfigMap (ARRPROXY_TIERS_FILE): fafflix + cheeztv tiers, each with sonarr/radarr upstreams, route hash, key subdir and group grants. Adults (akP-media-fafflix) reach both tiers all methods; kids (akP-media-cheeztv) reach only cheeztv, GET/HEAD. legacyRoutes:false retires the unprefixed routes.
  • Because arrproxy strips /<hash> and proxies /<app>/..., each upstream URL carries the /<hash> path segment so the joined upstream path (/3aa168/sonarr/...) matches the *arr's own UrlBase.
  • Mount the tiers file and rework the projected keys volume to the real per-instance {sonarr,radarr}-{adult,kids}-apikey Secrets under <keyDir>/<app> (adult/*, kids/*); refresh reloader annotations.
  • oauth2-proxy: route /3aa168 and /3df803 to arrproxy-api (drop dead /sonarr /radarr /prowlarr; prowlarr is served directly), and widen SKIP_AUTH_REGEX to ^/[^/]+/[^/]+/api for the hash-prefixed tier api paths.

Group headers keep flowing via the existing Authentik ak_groups claim -> oauth2-proxy X-Forwarded-Groups mechanism. Validated with kustomize build + repo kubeconform (88/88 valid). No new Vault seeds required — the per-instance apikey Secrets already exist.

## Why The old bare `sonarr`/`radarr` Services are gone, but arrproxy still ran the v0.3.x built-in default topology pointing at non-existent `sonarr`/`radarr` upstreams and mounted dead `sonarr-apikey`/`radarr-apikey` Secrets. This cuts the front door over to arrproxy v0.4.0 tier routing so the adult (fafflix, `/3aa168`) and kids (cheeztv, `/3df803`) *arr instances are reachable again, with per-tier group authorization. ## Changes - Bump `arrproxy-api` and `arrproxy-ui` images to `v0.4.0`. - Add `arrproxy-tiers` ConfigMap (`ARRPROXY_TIERS_FILE`): `fafflix` + `cheeztv` tiers, each with sonarr/radarr upstreams, route hash, key subdir and group grants. Adults (`akP-media-fafflix`) reach both tiers all methods; kids (`akP-media-cheeztv`) reach only cheeztv, GET/HEAD. `legacyRoutes:false` retires the unprefixed routes. - Because arrproxy strips `/<hash>` and proxies `/<app>/...`, each upstream URL carries the `/<hash>` path segment so the joined upstream path (`/3aa168/sonarr/...`) matches the *arr's own UrlBase. - Mount the tiers file and rework the projected keys volume to the real per-instance `{sonarr,radarr}-{adult,kids}-apikey` Secrets under `<keyDir>/<app>` (`adult/*`, `kids/*`); refresh reloader annotations. - oauth2-proxy: route `/3aa168` and `/3df803` to arrproxy-api (drop dead `/sonarr` `/radarr` `/prowlarr`; prowlarr is served directly), and widen `SKIP_AUTH_REGEX` to `^/[^/]+/[^/]+/api` for the hash-prefixed tier api paths. Group headers keep flowing via the existing Authentik `ak_groups` claim -> oauth2-proxy `X-Forwarded-Groups` mechanism. Validated with `kustomize build` + repo kubeconform (88/88 valid). No new Vault seeds required — the per-instance apikey Secrets already exist.
unkin-agent added 1 commit 2026-08-25 20:31:05 +10:00
arrstack: wire arrproxy v0.4.0 tier routing (fafflix/cheeztv)
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
af52c5df2b 
The old bare sonarr/radarr Services are gone; arrproxy still ran the v0.3.x
default topology pointing at non-existent upstreams and dead sonarr/radarr
apikey Secrets. Cut the front door over to arrproxy v0.4.0 tier routing so the
adult (fafflix, /3aa168) and kids (cheeztv, /3df803) *arr instances are reachable
again with per-tier group authorization.

- Bump arrproxy-api and arrproxy-ui images to v0.4.0.
- Add arrproxy-tiers ConfigMap (ARRPROXY_TIERS_FILE): fafflix + cheeztv tiers,
  each with sonarr/radarr upstreams, route hash, key subdir and group grants.
  Adults (akP-media-fafflix) reach both tiers all methods; kids
  (akP-media-cheeztv) reach only cheeztv, GET/HEAD. legacyRoutes:false retires
  the unprefixed routes. arrproxy strips /<hash> and proxies /<app>/..., so each
  upstream URL carries the /<hash> path segment to line up with the *arr's own
  UrlBase (/3aa168/sonarr etc.).
- Mount the tiers file and rework the projected keys volume to the real
  per-instance {sonarr,radarr}-{adult,kids}-apikey Secrets under <keyDir>/<app>
  (adult/*, kids/*); refresh the reloader annotations.
- oauth2-proxy: route /3aa168 and /3df803 to arrproxy-api (drop dead
  /sonarr /radarr /prowlarr; prowlarr is served directly), and widen
  SKIP_AUTH_REGEX to ^/[^/]+/[^/]+/api for the hash-prefixed tier api paths.
benvin merged commit 1ecba543aa into main 2026-08-25 20:49:05 +10:00
benvin deleted branch benvin/arrproxy-tier-wiring 2026-08-25 20:49:05 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#416
Delete Branch "benvin/arrproxy-tier-wiring"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?