unkin-agent
5ea193b957
Adds the mediamark app (Go single binary) to the media project: an oauth2-proxy-fronted service that reads the shared mediastore CephFS tree and talks to the adult-tier sonarr/radarr through arrproxy's hash routes. - Add apps/base/mediamark: namespace, VaultAuth, three VaultStaticSecrets, static mediastore PV/PVC, the app Deployment, oauth2-proxy ConfigMap/Deployment, two Services, and the internal + external Gateway/HTTPRoute pairs. - Run the app as 1000:1000 so it owns files on the shared media tree (hardlink/rename safe), with a read-only root filesystem, all caps dropped and no service-account token. - Project the sonarr/radarr API keys as one file per app under /etc/mediamark/keys, mirroring arrproxy's keys projection, with reloader annotations on both secrets. - Front both mediamark.unkin.net (traefik-external, reflected LE wildcard) and mediamark.k8s.syd1.au.unkin.net (traefik-internal, vault-issuer) with one oauth2-proxy using a relative redirect URL, gated on akP-mediamark-user and passing X-Forwarded-Groups to the app. - Append mediamark to the wildcard-unkin-net reflector namespace lists and register the app in the media ApplicationSet and AppProject.
50 lines
1.0 KiB
YAML
50 lines
1.0 KiB
YAML
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: mediamark-http-redirect
|
|
namespace: mediamark
|
|
spec:
|
|
hostnames:
|
|
- mediamark.k8s.syd1.au.unkin.net
|
|
parentRefs:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: mediamark
|
|
sectionName: http
|
|
rules:
|
|
- filters:
|
|
- type: RequestRedirect
|
|
requestRedirect:
|
|
scheme: https
|
|
statusCode: 301
|
|
matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: mediamark
|
|
namespace: mediamark
|
|
spec:
|
|
hostnames:
|
|
- mediamark.k8s.syd1.au.unkin.net
|
|
parentRefs:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: mediamark
|
|
sectionName: https
|
|
rules:
|
|
- backendRefs:
|
|
- group: ""
|
|
kind: Service
|
|
name: mediamark-oauth2
|
|
port: 4180
|
|
weight: 1
|
|
matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|