unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

watchstate: deploy admin-gated jellyfin watch-state sync tool #419

Merged
benvin merged 1 commits from benvin/watchstate-deploy into main 2026-08-25 21:39:08 +10:00
Conversation 0 Commits 1 Files Changed 14
+458

1 Commits

Author SHA1 Message Date
unkin-agent 7db66455c9 watchstate: deploy admin-gated jellyfin watch-state sync tool
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details 
Adds WatchState (arabcoders/watchstate v1.10.3) as a new media-project app,
fronted 1:1 by the logviewer oauth2-proxy admin-gate pattern.

- ghcr.io/arabcoders/watchstate:v1.10.3 (canonical image; containerd mirrors
  route ghcr via artifactapi), replicas 1 + Recreate, single 5Gi cephrbd-fast-delete
  RWO PVC at /config (sqlite + in-container cron/redis are single-writer).
- oauth2-proxy fronts every path; Authentik OIDC issuer
  identity.k8s.syd1.au.unkin.net, authorization enforced Authentik-side
  (akR-global-admin only), so no oauth2-proxy group allowlist.
- Internal-only Gateway (traefik-internal) for watchstate.k8s.syd1.au.unkin.net,
  vault-issuer TLS leaf, external-dns to 198.18.200.4.
- VaultStaticSecret pulls the seeded OIDC creds; vault-ca-cert auto-reflects.
- Registered in the media ApplicationSet + AppProject.

No VMPodScrape: WatchState exposes no /metrics endpoint.
 2026-08-25 21:07:19 +10:00