unkin-agent
48632eb9f9
## Why Deploy WatchState (arabcoders/watchstate), the Jellyfin/Plex/Emby watch-state sync tool, as an internal admin tool. It gets an admin-only web UI/API gated the same way as logviewer: an oauth2-proxy front backed by Authentik OIDC. ## What - New `watchstate` namespace + media-project app; base at `apps/base/watchstate`, overlay at `apps/overlays/au-syd1/watchstate`. - Image `ghcr.io/arabcoders/watchstate:v1.10.3` (current release; canonical upstream name, containerd mirrors route ghcr via artifactapi). - `replicas: 1`, `strategy: Recreate`, single `5Gi` `cephrbd-fast-delete` RWO PVC at `/config` — sqlite + the in-container cron/redis are single-writer. - `runAsUser/runAsGroup/fsGroup: 1000` (image's rootless user); liveness/readiness `GET /v1/api/system/healthcheck` on 8080 (route confirmed in upstream `src/API/System/HealthCheck.php`, no auth guard). - oauth2-proxy (mirrors logviewer 1:1) fronts every path. Authentik issuer `identity.k8s.syd1.au.unkin.net`, redirect `https://watchstate.k8s.syd1.au.unkin.net/oauth2/callback`. Authorization is enforced Authentik-side (akR-global-admin only), so no oauth2-proxy group allowlist is configured. - Internal-only Gateway (`traefik-internal`) for `watchstate.k8s.syd1.au.unkin.net`, `vault-issuer` TLS leaf, external-dns to `198.18.200.4`. HTTP -> HTTPS redirect. - `VaultStaticSecret` pulls OIDC creds from `kv/kubernetes/namespace/watchstate/default/oauth-credentials`; `vault-ca-cert` auto-reflects into the namespace. - Registered in the media `ApplicationSet` + `AppProject`. ## Scrape decision No `VMPodScrape`: WatchState exposes no Prometheus/`/metrics` endpoint. ## Follow-ups - **Seed check:** the VaultStaticSecret expects `client_id`, `client_secret`, and `cookie_secret` keys at the kv path. Only `client_secret` was confirmed seeded; `client_id` and a generated `cookie_secret` must also be present or the oauth2-proxy pod will not start. - **Webhook ingestion:** the Jellyfin webhook endpoint (`/v1/api/webhook`) currently sits behind oauth2-proxy like everything else. When sync is wired up, the jellyfins pushing webhooks will need an auth-bypass or an apikey route for that path. Reviewed-on: #419 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
82 lines
2.1 KiB
YAML
82 lines
2.1 KiB
YAML
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: watchstate
|
|
namespace: watchstate
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: watchstate
|
|
strategy:
|
|
# sqlite + the in-container cron/redis single-writer; never run two pods.
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: watchstate
|
|
spec:
|
|
serviceAccountName: default
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: watchstate
|
|
# Canonical upstream image; containerd mirrors route ghcr.io via
|
|
# artifactapi (do NOT prefix with the artifactapi host).
|
|
image: ghcr.io/arabcoders/watchstate:v1.10.3
|
|
imagePullPolicy: IfNotPresent
|
|
ports:
|
|
- containerPort: 8080
|
|
name: http
|
|
protocol: TCP
|
|
env:
|
|
- name: WS_UID
|
|
value: "1000"
|
|
- name: WS_GID
|
|
value: "1000"
|
|
- name: WS_TZ
|
|
value: Australia/Sydney
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /config
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /v1/api/system/healthcheck
|
|
port: http
|
|
initialDelaySeconds: 20
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /v1/api/system/healthcheck
|
|
port: http
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
volumes:
|
|
- name: config
|
|
persistentVolumeClaim:
|
|
claimName: watchstate-config
|
|
restartPolicy: Always
|