T

unkin-agent 9db52c5e26 arrstack: rebuild adult tier on the shared-Postgres pattern (#414 )

## Why
Rebuild the ADULT arr tier on the same shared-Postgres, active-active pattern the kids tier now uses, replacing the legacy adult sonarr/radarr/nzbget. The old adult apps hold **no data**, so the wipe is sanctioned.

**Stacked on** `benvin/arrstack-kids` (#412) — review/merge that first.

## How
- **Add** `sonarr-adult` / `radarr-adult` / `nzbget-adult` (copies of the `*-kids` dirs, `s/kids/adult`):
  - own DBs `sonarr-adult-main` / `radarr-adult-main`, Vault paths `.../default/{sonarr,radarr}-adult(+-db)`
  - S3 prefixes `sonarr-adult` / `radarr-adult`; UrlBase + probe + exportarr URLs `/3aa168/{sonarr,radarr}` (adult hash)
  - media subPaths `tvshows/adult` + `movies/adult`; nzbget config PVC on `cephrbd-fast-delete`
- **postgres**: add managed roles `sonarr-adult`/`radarr-adult`, Database CRDs `{sonarr,radarr}-adult-main`, VaultStaticSecrets `{sonarr,radarr}-adult-db`
- **Remove** legacy `sonarr`/`radarr`/`nzbget` dirs (incl. their gateway/httproute), managed roles `sonarr`/`radarr`, databases `{sonarr,radarr}-main`, VSS `{sonarr,radarr}-db`, and all kustomization entries
- Third-party images stay canonical upstream; in-house images stay explicit `docker-internal`

`prowlarr`, `arrproxy`, and everything else untouched. arrproxy path re-wiring is a later PR.

Verified: `kustomize build` + `kubeconform` (87/87 valid), no dangling refs to removed apps, no `3df803` in adult files.
Reviewed-on: #414
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

2026-08-25 20:06:39 +10:00

.claude/commands

chore: bump almalinux9 image tags (#188 )

2026-06-07 00:35:12 +10:00

.woodpecker

Replace vector-archiver with logarchiver (#308 )

2026-07-29 21:07:20 +10:00

apps

arrstack: rebuild adult tier on the shared-Postgres pattern (#414 )

2026-08-25 20:06:39 +10:00

argocd

Add cheeztv kids Jellyfin instance + fafflix kids mounts (#413 )

2026-08-25 19:59:08 +10:00

certificates: restore the validly-signed intermediate in vault-ca-cert (#305 )

2026-07-28 23:14:14 +10:00

clusters/au-syd1

Ignore defaulted StatefulSet volumeClaimTemplates TypeMeta (#350 )

2026-08-09 20:53:49 +10:00

docs

Enable Reloader secret watching, scope existing auto to configmap-only (#326 ) (#339 )

2026-08-08 19:35:31 +10:00

schemas

Deploy kea DHCP operator to dhcp-system (#333 )

2026-08-03 00:18:05 +10:00

.gitignore

feat: add reloader (#6 )

2026-03-01 16:34:01 +11:00

.pre-commit-config.yaml

Add JSON schema generation for kubeconform CRD validation (#212 )

2026-06-28 17:26:08 +10:00

.yamllint.yaml

feat: add pre-commit configuration (#9 )

2026-03-02 00:09:21 +11:00

AGENTS.md

chore: bump almalinux9 image tags (#188 )

2026-06-07 00:35:12 +10:00

Makefile

Add JSON schema generation for kubeconform CRD validation (#212 )

2026-06-28 17:26:08 +10:00

migration.md

chore: bump almalinux9 image tags (#188 )

2026-06-07 00:35:12 +10:00

docs/README.md

argocd-apps docs

Operational notes for the manifests in this repo.

Doc	What it covers
cnpg-backups.md	How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured.
cnpg-restore.md	Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas.
authentik-rancher-sso.md	Manual runtime step to point Rancher's OIDC auth at the canonical `identity.unkin.net` issuer and trust the internal CA.
gitea-migration.md	Staged cutover of the git.unkin.net forge from the Puppet VM to the `gitea` namespace.
ca-rotation.md	Rolling the internal `unkin.net` PKI CA (`vault-ca-cert`): what Reloader restarts automatically vs. manual/CNPG restarts.