Ben Vincent
54c25be828
Why: Jellyfin ships and gets validated first, ahead of the rest of the media stack. Scoping this PR to jellyfin alone keeps the initial rollout small and lets the HA fork prove out against the real library before the download and manager apps follow. How: - Drop sonarr, radarr, prowlarr, bazarr, nzbget, and jellyseerr and their shared media-apps foundation from this PR; they land in later PRs. - Move jellyfin into its own jellyfin namespace and fold the namespace and the static mediafs PV plus its RWX claim into the jellyfin base. - Keep the static CephFS PV bound to the in-use mediafs library with reclaimPolicy Retain and staticVolume true so nothing can reclaim it, mounted into jellyfin by the movies and tvseries subPaths; keep redis, the fresh RWX transcode scratch, the intel iGPU nodeSelector and i915 request, gateway, and httproute. - Scope the media AppProject and ApplicationSet to the single jellyfin namespace and app, extensible as the remaining apps are added.
argocd-apps docs
Operational notes for the manifests in this repo.
| Doc | What it covers |
|---|---|
| cnpg-backups.md | How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured. |
| cnpg-restore.md | Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas. |
| authentik-rancher-sso.md | Manual runtime step to point Rancher's OIDC auth at the canonical identity.unkin.net issuer and trust the internal CA. |
| gitea-migration.md | Staged cutover of the git.unkin.net forge from the Puppet VM to the gitea namespace. |
| ca-rotation.md | Rolling the internal unkin.net PKI CA (vault-ca-cert): what Reloader restarts automatically vs. manual/CNPG restarts. |