unkin-agent
1ecba543aa
## Why
The old bare `sonarr`/`radarr` Services are gone, but arrproxy still ran the v0.3.x built-in default topology pointing at non-existent `sonarr`/`radarr` upstreams and mounted dead `sonarr-apikey`/`radarr-apikey` Secrets. This cuts the front door over to arrproxy v0.4.0 tier routing so the adult (fafflix, `/3aa168`) and kids (cheeztv, `/3df803`) *arr instances are reachable again, with per-tier group authorization.
## Changes
- Bump `arrproxy-api` and `arrproxy-ui` images to `v0.4.0`.
- Add `arrproxy-tiers` ConfigMap (`ARRPROXY_TIERS_FILE`): `fafflix` + `cheeztv` tiers, each with sonarr/radarr upstreams, route hash, key subdir and group grants. Adults (`akP-media-fafflix`) reach both tiers all methods; kids (`akP-media-cheeztv`) reach only cheeztv, GET/HEAD. `legacyRoutes:false` retires the unprefixed routes.
- Because arrproxy strips `/<hash>` and proxies `/<app>/...`, each upstream URL carries the `/<hash>` path segment so the joined upstream path (`/3aa168/sonarr/...`) matches the *arr's own UrlBase.
- Mount the tiers file and rework the projected keys volume to the real per-instance `{sonarr,radarr}-{adult,kids}-apikey` Secrets under `<keyDir>/<app>` (`adult/*`, `kids/*`); refresh reloader annotations.
- oauth2-proxy: route `/3aa168` and `/3df803` to arrproxy-api (drop dead `/sonarr` `/radarr` `/prowlarr`; prowlarr is served directly), and widen `SKIP_AUTH_REGEX` to `^/[^/]+/[^/]+/api` for the hash-prefixed tier api paths.
Group headers keep flowing via the existing Authentik `ak_groups` claim -> oauth2-proxy `X-Forwarded-Groups` mechanism. Validated with `kustomize build` + repo kubeconform (88/88 valid). No new Vault seeds required — the per-instance apikey Secrets already exist.
Reviewed-on: #416
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
54 lines
2.1 KiB
YAML
54 lines
2.1 KiB
YAML
---
|
|
# arrproxy v0.4.0 tier topology (ARRPROXY_TIERS_FILE). Two isolated instance
|
|
# tiers, each with its own *arr backends, real-key subdir, and group grants:
|
|
# fafflix (adult, /3aa168/*) and cheeztv (kids, /3df803/*).
|
|
# arrproxy strips the /<hash> route prefix and proxies "/<app>/..." upstream, so
|
|
# each app's upstream URL carries the "/<hash>" path segment: the joined upstream
|
|
# path (/3aa168/sonarr/...) then matches the *arr's own UrlBase (/3aa168/sonarr).
|
|
# Access: the adult group reaches BOTH tiers with any method; the kids group
|
|
# reaches ONLY the cheeztv tier and only GET/HEAD. Groups arrive on the
|
|
# hierarchical Authentik ak_groups claim, forwarded by oauth2-proxy as
|
|
# X-Forwarded-Groups. Legacy unprefixed routes are retired (legacyRoutes:false);
|
|
# the old bare sonarr/radarr Services no longer exist.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: arrproxy-tiers
|
|
namespace: arrstack
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "2"
|
|
data:
|
|
tiers.json: |
|
|
{
|
|
"legacyTier": "fafflix",
|
|
"legacyRoutes": false,
|
|
"tiers": [
|
|
{
|
|
"name": "fafflix",
|
|
"hash": "3aa168",
|
|
"keyDir": "adult",
|
|
"grants": [
|
|
{ "group": "akP-media-fafflix" }
|
|
],
|
|
"apps": [
|
|
{ "name": "sonarr", "upstream": "http://sonarr-adult.arrstack.svc.cluster.local:8989/3aa168", "urlBase": "/3aa168/sonarr" },
|
|
{ "name": "radarr", "upstream": "http://radarr-adult.arrstack.svc.cluster.local:7878/3aa168", "urlBase": "/3aa168/radarr" }
|
|
]
|
|
},
|
|
{
|
|
"name": "cheeztv",
|
|
"hash": "3df803",
|
|
"keyDir": "kids",
|
|
"readOnly": true,
|
|
"grants": [
|
|
{ "group": "akP-media-fafflix" },
|
|
{ "group": "akP-media-cheeztv", "methods": ["GET", "HEAD"] }
|
|
],
|
|
"apps": [
|
|
{ "name": "sonarr", "upstream": "http://sonarr-kids.arrstack.svc.cluster.local:8989/3df803", "urlBase": "/3df803/sonarr" },
|
|
{ "name": "radarr", "upstream": "http://radarr-kids.arrstack.svc.cluster.local:7878/3df803", "urlBase": "/3df803/radarr" }
|
|
]
|
|
}
|
|
]
|
|
}
|