---
# arrproxy v0.4.0 tier topology (ARRPROXY_TIERS_FILE). Two isolated instance
# tiers, each with its own *arr backends, real-key subdir, and group grants:
#   fafflix (adult, /3aa168/*) and cheeztv (kids, /3df803/*).
# arrproxy strips the /<hash> route prefix and proxies "/<app>/..." upstream, so
# each app's upstream URL carries the "/<hash>" path segment: the joined upstream
# path (/3aa168/sonarr/...) then matches the *arr's own UrlBase (/3aa168/sonarr).
# Access: the adult group reaches BOTH tiers with any method; the kids group
# reaches ONLY the cheeztv tier and only GET/HEAD. Groups arrive on the
# hierarchical Authentik ak_groups claim, forwarded by oauth2-proxy as
# X-Forwarded-Groups. Legacy unprefixed routes are retired (legacyRoutes:false);
# the old bare sonarr/radarr Services no longer exist.
apiVersion: v1
kind: ConfigMap
metadata:
  name: arrproxy-tiers
  namespace: arrstack
  annotations:
    argocd.argoproj.io/sync-wave: "2"
data:
  tiers.json: |
    {
      "legacyTier": "fafflix",
      "legacyRoutes": false,
      "tiers": [
        {
          "name": "fafflix",
          "hash": "3aa168",
          "keyDir": "adult",
          "grants": [
            { "group": "akP-media-fafflix" }
          ],
          "apps": [
            { "name": "sonarr", "upstream": "http://sonarr-adult.arrstack.svc.cluster.local:8989/3aa168", "urlBase": "/3aa168/sonarr" },
            { "name": "radarr", "upstream": "http://radarr-adult.arrstack.svc.cluster.local:7878/3aa168", "urlBase": "/3aa168/radarr" }
          ]
        },
        {
          "name": "cheeztv",
          "hash": "3df803",
          "keyDir": "kids",
          "readOnly": true,
          "grants": [
            { "group": "akP-media-fafflix" },
            { "group": "akP-media-cheeztv", "methods": ["GET", "HEAD"] }
          ],
          "apps": [
            { "name": "sonarr", "upstream": "http://sonarr-kids.arrstack.svc.cluster.local:8989/3df803", "urlBase": "/3df803/sonarr" },
            { "name": "radarr", "upstream": "http://radarr-kids.arrstack.svc.cluster.local:7878/3df803", "urlBase": "/3df803/radarr" }
          ]
        }
      ]
    }