T

unkin-agent 94da740a9d Add cheeztv kids Jellyfin instance + fafflix kids mounts (#413 )

## Why
Kids need their own safe Jellyfin front (cheeztv.unkin.net) with a library that only ever exposes kids titles, while those same titles stay resumable in the existing adult instance (fafflix). The fafflix.unkin.net domain switch is deliberately out of scope.

## How
- **New `cheeztv` instance** (`apps/base/cheeztv`): mirrors the fafflix HA Jellyfin stack 1:1 - same `jellyfin-ha:v0.1.3` fork image, 2-replica StatefulSet, RWX transcode PVC + HA takeover, Intel iGPU transcode, CNPG Postgres + PgBouncer, Valkey transcode store, k8up config backup, VMPodScrape.
- **Kids-only media**: its own static PVs on the *same* shared movies/tv CephFS subvolumes, mounted with `subPath: kids` so it sees only `movies/kids` and `tvshows/kids`.
- **Fully separate state**: own namespace, config PVC, `cheeztv-postgres` cluster, `cheeztv-valkey`, and `cnpg-cheeztv` / `cheeztv-config-backup` RGW buckets - nothing shared with fafflix.
- **DNS/cert**: `cheeztv.unkin.net` via internal Traefik + external-dns (198.18.200.4) + cert-manager `cheeztv-tls`, matching logviewer.unkin.net; plus the cluster hostname `cheeztv.k8s.syd1.au.unkin.net` mirroring fafflix.
- **fafflix change**: ADDS `movies/kids` + `tvshows/kids` subPath mounts alongside its current media mounts so kids libraries are resumable there. Existing mounts, hostname and ingress untouched.
- Registers cheeztv in the media ApplicationSet generator and AppProject destinations.

## Validation
kubeconform clean: cheeztv 28/28, jellyfin 25/25 valid. No arr/watchstate/domain changes.

Note: the k8up restic repo password must be seeded at `kv/kubernetes/namespace/cheeztv/default/k8up-restic` (same manual step as fafflix); templated Vault policy already grants read, no terraform-vault change needed.
Reviewed-on: #413
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

2026-08-25 19:59:08 +10:00

.claude/commands

chore: bump almalinux9 image tags (#188 )

2026-06-07 00:35:12 +10:00

.woodpecker

Replace vector-archiver with logarchiver (#308 )

2026-07-29 21:07:20 +10:00

apps

Add cheeztv kids Jellyfin instance + fafflix kids mounts (#413 )

2026-08-25 19:59:08 +10:00

argocd

Add cheeztv kids Jellyfin instance + fafflix kids mounts (#413 )

2026-08-25 19:59:08 +10:00

certificates: restore the validly-signed intermediate in vault-ca-cert (#305 )

2026-07-28 23:14:14 +10:00

clusters/au-syd1

Ignore defaulted StatefulSet volumeClaimTemplates TypeMeta (#350 )

2026-08-09 20:53:49 +10:00

docs

Enable Reloader secret watching, scope existing auto to configmap-only (#326 ) (#339 )

2026-08-08 19:35:31 +10:00

schemas

Deploy kea DHCP operator to dhcp-system (#333 )

2026-08-03 00:18:05 +10:00

.gitignore

feat: add reloader (#6 )

2026-03-01 16:34:01 +11:00

.pre-commit-config.yaml

Add JSON schema generation for kubeconform CRD validation (#212 )

2026-06-28 17:26:08 +10:00

.yamllint.yaml

feat: add pre-commit configuration (#9 )

2026-03-02 00:09:21 +11:00

AGENTS.md

chore: bump almalinux9 image tags (#188 )

2026-06-07 00:35:12 +10:00

Makefile

Add JSON schema generation for kubeconform CRD validation (#212 )

2026-06-28 17:26:08 +10:00

migration.md

chore: bump almalinux9 image tags (#188 )

2026-06-07 00:35:12 +10:00

docs/README.md

argocd-apps docs

Operational notes for the manifests in this repo.

Doc	What it covers
cnpg-backups.md	How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured.
cnpg-restore.md	Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas.
authentik-rancher-sso.md	Manual runtime step to point Rancher's OIDC auth at the canonical `identity.unkin.net` issuer and trust the internal CA.
gitea-migration.md	Staged cutover of the git.unkin.net forge from the Puppet VM to the `gitea` namespace.
ca-rotation.md	Rolling the internal `unkin.net` PKI CA (`vault-ca-cert`): what Reloader restarts automatically vs. manual/CNPG restarts.