unkin-agent
cd8e2c262f
Deploys arrproxy v0.1.0 (task 9 final integration) into the existing `arrstack` app: the external, Authentik-gated front door for sonarr/radarr/prowlarr with per-user API-key brokering. Manifests are wired to match the arrproxy v0.1.0 code (ports, routes, identity headers, keys dir), mirroring the ghp/artifactapi estate patterns.
## Topology (`apps/base/arrstack/arrproxy/`)
- **oauth2-proxy** Deployment + Service `arrproxy` is the single front (OIDC against the Authentik `arrstack` app). It path-routes via `--upstreams` to:
- `arrproxy-ui` for `/` and static SPA assets,
- `arrproxy-api` for `/api/*` (token API) and `/sonarr|/radarr|/prowlarr` (the *arr proxy).
- `--skip-auth-regex=^/[^/]+/api` bypasses oauth **only** for the *arr proxy API (`/sonarr/api...`), while `/api/tokens`, `/api/me` and the UI stay authenticated.
- Identity+groups reach the api via `--pass-user-headers` (`X-Forwarded-{User,Email,Groups}`). The api reads `ARRPROXY_GROUPS_HEADER=X-Forwarded-Groups` — `--set-xauthrequest` only populates auth_request *response* headers and never reaches an `--upstreams` backend, so it is intentionally not used.
- oauth2-proxy trusts `identity.unkin.net` (internal Vault-PKI CA) via a `combine-certs` initContainer (system roots + `vault-ca-cert`), same pattern as artifactapi.
## Data + secrets
- **CNPG** token store `arrproxy-db` (2 instances, cephrgw S3 backups + nightly ScheduledBackup). arrproxy-api does **not** self-migrate, so a wave-1 ArgoCD `Sync` hook Job applies `migrations/0001_init.sql` (mirrored into a ConfigMap) as the CNPG app user. DSN built from the generated `arrproxy-db-app` Secret.
- **VaultStaticSecrets** (arrstack `default` SA / templated role — no terraform-vault change): `arrproxy-pepper` (seeded) and `oauth-credentials`. The three real *arr keys are **reused** from the existing `<app>-apikey` Secrets, projected one file per app into `/etc/arrproxy/keys`.
## Exposure
- **Gateway** `traefik-external`, hostname `arrstack.unkin.net`, cert-manager `vault-issuer` TLS (`arrproxy-gateway-tls`); HTTPRoute → the oauth2-proxy entry Service (+ HTTP→HTTPS redirect).
- Adds the `arrstack.unkin.net` apex A record → external DMZ VIP `198.18.199.0` to the bind-operator `unkin.net` zone (`apps/base/bind-internal/authoritative/records.yaml`), mirroring the ghp/identity apex records.
## Validation
- `kustomize build --enable-helm apps/overlays/au-syd1/arrstack` renders cleanly; `kubeconform` = 51/51 valid; `pre-commit` passes (no plain Secrets).
## Prerequisites / flags for end-to-end function (NOT in this PR)
- **(a)** Each *arr must run with `UrlBase=/<app>` (path-based hosting) — arrproxy preserves the `/<app>` prefix upstream.
- **(b)** The Authentik `arrstack` OIDC app (terraform-authentik PR #18) must be applied, with redirect URI `https://arrstack.unkin.net/oauth2/callback` registered and the `ak_groups` scope emitted. Confirm the discovery slug matches `OAUTH2_PROXY_OIDC_ISSUER_URL` (`https://identity.unkin.net/application/o/arrstack/`).
- **(c)** Browser XHR to `/<app>/api` is oauth-**bypassed** (skip-auth-regex), so the SPA-driven proxy calls that rely on the session (no per-user token) will not carry identity on that path — expected per the arrproxy trust model; token-based *arr clients are unaffected.
- **NetworkPolicy:** the arrproxy-api Service is not exposed via any HTTPRoute and the api strips forged identity headers in-code, but the README recommends a NetworkPolicy restricting api ingress to oauth2-proxy. The estate currently has **zero** NetworkPolicies, so one was not added here to avoid being the first (and risking probe breakage) before the CNI’s policy/probe behavior is confirmed — flagged as follow-up hardening.
- Please confirm: CNPG size (2 instances / 10Gi), backups on, hostname/VIP, and UI theme.
ARRPROXY_PEPPER was seeded via the agents AppRole at `kv/kubernetes/namespace/arrstack/default/arrproxy-pepper` (key `pepper`).
Reviewed-on: #377
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
120 lines
3.3 KiB
YAML
120 lines
3.3 KiB
YAML
# Individually-managed authoritative records for the unkin.net zone.
|
|
# DNSRecords must live in the same namespace as their BindZone (the operator
|
|
# resolves zoneRef/clusterRef/updateKeyRef within the record's namespace), so
|
|
# these sit alongside the zone in bind-internal, not in the app namespace.
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
# "internal" in the name distinguishes this from the external DNS that
|
|
# Authentik will manage its own records from later.
|
|
name: identity-dns-internal
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: unkin-net
|
|
name: identity
|
|
type: A
|
|
ttl: 600
|
|
values:
|
|
# traefik-internal gateway VIP; the authentik Gateway serves the
|
|
# identity.unkin.net hostname there.
|
|
- 198.18.200.4
|
|
---
|
|
# PRODUCTION CUTOVER RECORD — intentionally commented out.
|
|
# git.unkin.net currently resolves to the LIVE VM forge (HAProxy VRRP VIP
|
|
# 198.18.19.17), which holds every repo the estate depends on. Uncommenting this
|
|
# repoints the whole org's git.unkin.net at the new k8s Gitea gateway VIP, so it
|
|
# is the FINAL step of the forge migration — gated on the data migration (gitea
|
|
# dump/restore + SECRET_KEY copy) in argocd-apps docs/gitea-migration.md.
|
|
# NOTE: the live git.unkin.net answer is served by the puppet DNS master today
|
|
# (profiles::dns::master, records from PuppetDB); this k8s apex zone holds only
|
|
# SOA+NS + a few DNSRecords so far. Confirm the k8s bind cluster is the live
|
|
# authority for unkin.net (or update the puppet record instead) before relying
|
|
# on this CR at cutover.
|
|
# ---
|
|
# apiVersion: bind.unkin.net/v1alpha1
|
|
# kind: DNSRecord
|
|
# metadata:
|
|
# name: git-dns-internal
|
|
# namespace: bind-internal
|
|
# spec:
|
|
# zoneRef: unkin-net
|
|
# name: git
|
|
# type: A
|
|
# ttl: 600
|
|
# values:
|
|
# # traefik-internal gateway VIP; the gitea Gateway serves git.unkin.net there.
|
|
# - 198.18.200.4
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
name: s3-ceph-cname
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: ceph-unkin-net
|
|
name: s3
|
|
type: CNAME
|
|
ttl: 600
|
|
values:
|
|
# radosgw S3 endpoint. Points at the Consul service for now; the real
|
|
# target will be changed later.
|
|
- radosgw.service.consul.
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
name: dashboard-ceph-cname
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: ceph-unkin-net
|
|
name: dashboard
|
|
type: CNAME
|
|
ttl: 600
|
|
values:
|
|
# Ceph mgr dashboard, reached via lb1. Lets in-cluster clients (the
|
|
# cephrgw-operator) resolve dashboard.ceph.unkin.net.
|
|
- lb1.unkin.net.
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
name: lb1-unkin-net
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: unkin-net
|
|
name: lb1
|
|
type: A
|
|
ttl: 600
|
|
values:
|
|
- 103.216.191.185
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
name: ghp-dns-internal
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: unkin-net
|
|
name: ghp
|
|
type: A
|
|
ttl: 600
|
|
values:
|
|
# traefik-internal gateway VIP; the ghp Gateway serves ghp.unkin.net there.
|
|
- 198.18.200.4
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
name: arrstack-dns-internal
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: unkin-net
|
|
name: arrstack
|
|
type: A
|
|
ttl: 600
|
|
values:
|
|
# traefik-EXTERNAL (DMZ) gateway VIP; the arrproxy Gateway serves the
|
|
# arrstack.unkin.net front door (oauth2-proxy) there.
|
|
- 198.18.199.0
|