unkin-agent
b355d6aafb
## Why mediamark needs a home in the cluster: it marks/organises media on the shared mediastore tree and drives the adult-tier sonarr/radarr through arrproxy's hash routes. This adds the full app to the `media` project, mirroring the watchstate two-host oauth2-proxy pattern and the arrstack static-CephFS + projected-API-keys patterns. ## How - Adds `apps/base/mediamark/`: namespace, VaultAuth (`k8s/au/syd1`, role `default`), three VaultStaticSecrets, static mediastore PV/PVC, the app Deployment, oauth2-proxy ConfigMap/Deployment, two Services, and internal + external Gateway/HTTPRoute pairs. - Binds a dedicated static PV (`mediamark-mediastore`, own `volumeHandle`, `claimRef`-pinned) to the same CephFS mediastore subvolume arrstack/fafflix/cheeztv use, RWX 10Ti Retain, mounted at `/media`. - Runs the app as 1000:1000 (deliberately not 65532) so it owns files on the shared media tree and hardlink/rename moves stay valid; read-only root filesystem, all caps dropped, no service-account token, `/livez` + `/readyz` probes. - Projects the sonarr/radarr API keys as one file per app under `/etc/mediamark/keys`, mirroring arrproxy's keys projection, with reloader annotations on both secrets. - Fronts both `mediamark.unkin.net` (traefik-external, reflected Let's Encrypt wildcard, no cert-manager annotations) and `mediamark.k8s.syd1.au.unkin.net` (traefik-internal, vault-issuer) with a single oauth2-proxy using a relative `/oauth2/callback` redirect; gated on `akP-mediamark-user` and passing identity to the app as `X-Forwarded-Groups` via `PASS_USER_HEADERS`. - Appends `mediamark` to the `wildcard-unkin-net` Certificate's two reflector namespace lists, and registers the app in `argocd/applicationsets/media.yaml` + `argocd/projects/media.yaml` with a passthrough `apps/overlays/au-syd1/mediamark` overlay. ## Prerequisite seeds (Ben, before pods go Ready) These KV paths must exist under `kv/kubernetes/namespace/mediamark/default/` — the `mediamark/default` templated policy already grants read, so no terraform-vault change is needed: - `oauth-credentials` — needs `client_id` and `cookie_secret` added alongside the existing `client_secret` (Authentik mediamark provider; both absolute callback URIs registered there). - `sonarr` — key `apitoken`. - `radarr` — key `apitoken`. ## Validation - `kustomize build --enable-helm apps/overlays/au-syd1/mediamark` (18 resources) and `.../cert-manager` both build. - kubeconform clean on both touched overlays. - `pre-commit run --all-files` passes. Reviewed-on: #441 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
46 lines
2.5 KiB
YAML
46 lines
2.5 KiB
YAML
---
|
|
# Non-secret oauth2-proxy configuration (client_id/secret/cookie_secret come
|
|
# from the oauth-credentials Secret). Single auth front for mediamark on both
|
|
# host names; access is gated here on the akP-mediamark-user Authentik group and
|
|
# re-checked by the app from X-Forwarded-Groups.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: mediamark-oauth2-env
|
|
namespace: mediamark
|
|
data:
|
|
OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
|
|
OAUTH2_PROXY_PROVIDER: "oidc"
|
|
OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/mediamark/"
|
|
# Relative (host-less) redirect URL: with reverse-proxy mode on, oauth2-proxy
|
|
# derives scheme+host per request from X-Forwarded-Proto/Host, so the same
|
|
# deployment serves BOTH the external mediamark.unkin.net and internal
|
|
# mediamark.k8s.syd1.au.unkin.net callbacks. Both absolute callback URIs are
|
|
# registered on the Authentik provider (terraform-authentik, separate PR).
|
|
OAUTH2_PROXY_REDIRECT_URL: "/oauth2/callback"
|
|
OAUTH2_PROXY_UPSTREAMS: "http://mediamark.mediamark.svc.cluster.local:8080/"
|
|
OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
|
|
# Populate session.Groups from the Authentik ak_groups claim; pass-user-headers
|
|
# then emits it as a single comma-joined X-Forwarded-Groups header.
|
|
OAUTH2_PROXY_OIDC_GROUPS_CLAIM: "ak_groups"
|
|
OAUTH2_PROXY_ALLOWED_GROUPS: "akP-mediamark-user"
|
|
# Forward identity + groups to mediamark as X-Forwarded-{User,Email,Groups}.
|
|
# NOTE: set-xauthrequest is intentionally NOT set -- it only populates
|
|
# auth_request *response* headers, which never reach a proxied upstream.
|
|
OAUTH2_PROXY_PASS_USER_HEADERS: "true"
|
|
OAUTH2_PROXY_EMAIL_DOMAINS: "*"
|
|
# Authentik hardcodes email_verified=false in the id_token; authorization is
|
|
# enforced via ak_groups, so accepting the unverified email is safe.
|
|
OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true"
|
|
OAUTH2_PROXY_COOKIE_SECURE: "true"
|
|
# One cookie domain per host (a single parent-domain cookie can't span
|
|
# unkin.net and k8s.syd1.au.unkin.net cleanly); oauth2-proxy picks the domain
|
|
# matching the request host. Whitelist both so post-auth `rd` redirects to
|
|
# either front door are honoured.
|
|
OAUTH2_PROXY_COOKIE_DOMAINS: "mediamark.unkin.net,mediamark.k8s.syd1.au.unkin.net"
|
|
OAUTH2_PROXY_WHITELIST_DOMAINS: "mediamark.unkin.net,mediamark.k8s.syd1.au.unkin.net"
|
|
OAUTH2_PROXY_REVERSE_PROXY: "true"
|
|
OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt"
|
|
OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256"
|
|
OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
|