unkin-agent
af52c5df2b
The old bare sonarr/radarr Services are gone; arrproxy still ran the v0.3.x
default topology pointing at non-existent upstreams and dead sonarr/radarr
apikey Secrets. Cut the front door over to arrproxy v0.4.0 tier routing so the
adult (fafflix, /3aa168) and kids (cheeztv, /3df803) *arr instances are reachable
again with per-tier group authorization.
- Bump arrproxy-api and arrproxy-ui images to v0.4.0.
- Add arrproxy-tiers ConfigMap (ARRPROXY_TIERS_FILE): fafflix + cheeztv tiers,
each with sonarr/radarr upstreams, route hash, key subdir and group grants.
Adults (akP-media-fafflix) reach both tiers all methods; kids
(akP-media-cheeztv) reach only cheeztv, GET/HEAD. legacyRoutes:false retires
the unprefixed routes. arrproxy strips /<hash> and proxies /<app>/..., so each
upstream URL carries the /<hash> path segment to line up with the *arr's own
UrlBase (/3aa168/sonarr etc.).
- Mount the tiers file and rework the projected keys volume to the real
per-instance {sonarr,radarr}-{adult,kids}-apikey Secrets under <keyDir>/<app>
(adult/*, kids/*); refresh the reloader annotations.
- oauth2-proxy: route /3aa168 and /3df803 to arrproxy-api (drop dead
/sonarr /radarr /prowlarr; prowlarr is served directly), and widen
SKIP_AUTH_REGEX to ^/[^/]+/[^/]+/api for the hash-prefixed tier api paths.
54 lines
2.1 KiB
YAML
54 lines
2.1 KiB
YAML
---
|
|
# arrproxy v0.4.0 tier topology (ARRPROXY_TIERS_FILE). Two isolated instance
|
|
# tiers, each with its own *arr backends, real-key subdir, and group grants:
|
|
# fafflix (adult, /3aa168/*) and cheeztv (kids, /3df803/*).
|
|
# arrproxy strips the /<hash> route prefix and proxies "/<app>/..." upstream, so
|
|
# each app's upstream URL carries the "/<hash>" path segment: the joined upstream
|
|
# path (/3aa168/sonarr/...) then matches the *arr's own UrlBase (/3aa168/sonarr).
|
|
# Access: the adult group reaches BOTH tiers with any method; the kids group
|
|
# reaches ONLY the cheeztv tier and only GET/HEAD. Groups arrive on the
|
|
# hierarchical Authentik ak_groups claim, forwarded by oauth2-proxy as
|
|
# X-Forwarded-Groups. Legacy unprefixed routes are retired (legacyRoutes:false);
|
|
# the old bare sonarr/radarr Services no longer exist.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: arrproxy-tiers
|
|
namespace: arrstack
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "2"
|
|
data:
|
|
tiers.json: |
|
|
{
|
|
"legacyTier": "fafflix",
|
|
"legacyRoutes": false,
|
|
"tiers": [
|
|
{
|
|
"name": "fafflix",
|
|
"hash": "3aa168",
|
|
"keyDir": "adult",
|
|
"grants": [
|
|
{ "group": "akP-media-fafflix" }
|
|
],
|
|
"apps": [
|
|
{ "name": "sonarr", "upstream": "http://sonarr-adult.arrstack.svc.cluster.local:8989/3aa168", "urlBase": "/3aa168/sonarr" },
|
|
{ "name": "radarr", "upstream": "http://radarr-adult.arrstack.svc.cluster.local:7878/3aa168", "urlBase": "/3aa168/radarr" }
|
|
]
|
|
},
|
|
{
|
|
"name": "cheeztv",
|
|
"hash": "3df803",
|
|
"keyDir": "kids",
|
|
"readOnly": true,
|
|
"grants": [
|
|
{ "group": "akP-media-fafflix" },
|
|
{ "group": "akP-media-cheeztv", "methods": ["GET", "HEAD"] }
|
|
],
|
|
"apps": [
|
|
{ "name": "sonarr", "upstream": "http://sonarr-kids.arrstack.svc.cluster.local:8989/3df803", "urlBase": "/3df803/sonarr" },
|
|
{ "name": "radarr", "upstream": "http://radarr-kids.arrstack.svc.cluster.local:7878/3df803", "urlBase": "/3df803/radarr" }
|
|
]
|
|
}
|
|
]
|
|
}
|