---
# Shared Ceph RGW (S3) bucket for arrstack media assets (Servarr MediaCover
# posters/fanart and, later, application backups), provisioned by the in-estate
# cephrgw-operator. Moving these off each replica's local /config (an emptyDir)
# lets any radarr/sonarr/prowlarr replica serve covers and store backups without
# leader-local state. The operator mints the S3 credential Secret
# (arrstack-media-s3) in this namespace with keys AWS_ACCESS_KEY_ID,
# AWS_SECRET_ACCESS_KEY and S3_ENDPOINT, so no Vault KV seeding is required.
apiVersion: ceph.unkin.net/v1alpha1
kind: ObjectStoreUser
metadata:
  name: arrstack-media
  namespace: arrstack
spec:
  displayName: "arrstack media assets owner"
  uid: arrstack-media
  maxBuckets: 5
  secretName: arrstack-media-s3
  retainOnDelete: true
---
apiVersion: ceph.unkin.net/v1alpha1
kind: Bucket
metadata:
  name: arrstack-media
  namespace: arrstack
spec:
  placementTarget: ec
  bucketName: arrstack-media
  ownerRef: arrstack-media
  versioning: false
  tags:
    app: arrstack
    purpose: media-assets
  retainOnDelete: true