From a0983157a0da7e187f6776ba5ef42729ea8909bd Mon Sep 17 00:00:00 2001
From: Ben Vin <neotheo@gmail.com>
Date: Sun, 5 Jul 2026 22:48:15 +1000
Subject: [PATCH 1/4] Add jellyfin-ha container build

Build-orchestration for the jellyfin-ha Jellyfin fork: pins an upstream
commit (UPSTREAM_REF), publishes the .NET 10 server, and builds/pushes the
runtime image to git.unkin.net/unkin/jellyfin-ha on v* tags.

- UPSTREAM_REF pinned to d4f9c12
- Dockerfile.runtime (vendored runtime-only image + jellyfin-web 10.11.6)
- .woodpecker/{build,docker}.yaml (publish + docker-buildx, k8s resources)
- Makefile (publish/build + patch/minor/major release tagging)
---
 .dockerignore           |  7 +++++
 .gitignore              |  2 ++
 .woodpecker/build.yaml  | 44 +++++++++++++++++++++++++++++++
 .woodpecker/docker.yaml | 50 ++++++++++++++++++++++++++++++++++++
 Dockerfile.runtime      | 57 +++++++++++++++++++++++++++++++++++++++++
 Makefile                | 39 ++++++++++++++++++++++++++++
 README.md               | 42 ++++++++++++++++++++++++++++--
 UPSTREAM_REF            |  1 +
 8 files changed, 240 insertions(+), 2 deletions(-)
 create mode 100644 .dockerignore
 create mode 100644 .gitignore
 create mode 100644 .woodpecker/build.yaml
 create mode 100644 .woodpecker/docker.yaml
 create mode 100644 Dockerfile.runtime
 create mode 100644 Makefile
 create mode 100644 UPSTREAM_REF

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..58ed9c4
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,7 @@
+# Keep the docker build context small: only publish-output + Dockerfile.runtime
+# are needed. The upstream source clone lives under src/ and must not be sent.
+src/
+.git/
+.woodpecker/
+*.md
+Makefile
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..fd118b0
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+/src/
+/publish-output/
diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml
new file mode 100644
index 0000000..50584c2
--- /dev/null
+++ b/.woodpecker/build.yaml
@@ -0,0 +1,44 @@
+when:
+  - event: pull_request
+
+steps:
+  # Clone the pinned upstream jellyfin-ha source and publish the .NET server
+  # into ./publish-output (consumed by Dockerfile.runtime).
+  - name: publish
+    image: mcr.microsoft.com/dotnet/sdk:10.0
+    commands:
+      - |
+        REF=$$(cat UPSTREAM_REF)
+        git clone https://github.com/ZoltyMat/jellyfin-ha.git src
+        git -C src checkout "$$REF"
+        dotnet publish src/Jellyfin.Server/Jellyfin.Server.csproj \
+          -c Release -r linux-x64 --self-contained false -o ./publish-output
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 2Gi
+            cpu: 2
+          limits:
+            memory: 6Gi
+            cpu: 4
+
+  # Validate the runtime image builds (no push on PRs).
+  - name: docker-build
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      repo: git.unkin.net/unkin/jellyfin-ha
+      dockerfile: Dockerfile.runtime
+      dry_run: true
+    depends_on: [publish]
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 1
+          limits:
+            memory: 4Gi
+            cpu: 2
diff --git a/.woodpecker/docker.yaml b/.woodpecker/docker.yaml
new file mode 100644
index 0000000..1154c52
--- /dev/null
+++ b/.woodpecker/docker.yaml
@@ -0,0 +1,50 @@
+when:
+  - event: tag
+    ref: refs/tags/v*
+
+steps:
+  # Same publish step as the PR pipeline: clone pinned upstream + dotnet publish.
+  - name: publish
+    image: mcr.microsoft.com/dotnet/sdk:10.0
+    commands:
+      - |
+        REF=$$(cat UPSTREAM_REF)
+        git clone https://github.com/ZoltyMat/jellyfin-ha.git src
+        git -C src checkout "$$REF"
+        dotnet publish src/Jellyfin.Server/Jellyfin.Server.csproj \
+          -c Release -r linux-x64 --self-contained false -o ./publish-output
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 2Gi
+            cpu: 2
+          limits:
+            memory: 6Gi
+            cpu: 4
+
+  # Build the runtime image and push it to the Gitea registry.
+  - name: docker
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      registry: git.unkin.net
+      repo: git.unkin.net/unkin/jellyfin-ha
+      dockerfile: Dockerfile.runtime
+      username: droneci
+      password:
+        from_secret: DRONECI_PASSWORD
+      tags:
+        - ${CI_COMMIT_TAG}
+        - latest
+    depends_on: [publish]
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 1
+          limits:
+            memory: 4Gi
+            cpu: 2
diff --git a/Dockerfile.runtime b/Dockerfile.runtime
new file mode 100644
index 0000000..23bc9fc
--- /dev/null
+++ b/Dockerfile.runtime
@@ -0,0 +1,57 @@
+# syntax=docker/dockerfile:1
+# Runtime-only image for the jellyfin-ha fork.
+#
+# The .NET publish step runs on the CI host (see .woodpecker/*.yaml) and drops
+# its output into ./publish-output, which is COPYed in below. This file is a
+# vendored copy of upstream's Dockerfile.runtime so we control the pinned
+# jellyfin-web version and base image; bump alongside UPSTREAM_REF.
+
+# ── Web client stage ──────────────────────────────────────────────────────────
+# Install jellyfin-web via the official Jellyfin apt repo (prebuilt, no npm).
+# Web assets land at /usr/share/jellyfin/web/.
+FROM --platform=linux/amd64 debian:bookworm-slim AS webclient
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends curl gnupg ca-certificates \
+ && curl -fsSL https://repo.jellyfin.org/jellyfin_team.gpg.key \
+    | gpg --dearmor -o /usr/share/keyrings/jellyfin.gpg \
+ && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/jellyfin.gpg] https://repo.jellyfin.org/debian bookworm main" \
+    > /etc/apt/sources.list.d/jellyfin.list \
+ && apt-get update \
+ && apt-get install -y --no-install-recommends "jellyfin-web=10.11.6+deb12" \
+ && rm -rf /var/lib/apt/lists/*
+
+# ── Runtime stage ─────────────────────────────────────────────────────────────
+FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/aspnet:10.0
+
+# FFmpeg and the native deps required by SkiaSharp and fontconfig.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      ffmpeg \
+      fontconfig \
+      libfontconfig1 \
+      libfreetype6 \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /jellyfin
+
+# Pre-built publish output produced by `dotnet publish` on the CI host.
+COPY publish-output/ .
+# jellyfin-web client assets from the webclient stage.
+COPY --from=webclient /usr/share/jellyfin/web ./jellyfin-web/
+
+# Jellyfin default ports
+EXPOSE 8096
+EXPOSE 8920
+
+# Data / config volumes
+VOLUME ["/config", "/cache", "/media"]
+
+ENV JELLYFIN_DATA_DIR=/config \
+    JELLYFIN_CACHE_DIR=/cache \
+    JELLYFIN_LOG_DIR=/config/log
+
+ENTRYPOINT ["./jellyfin", \
+            "--datadir", "/config", \
+            "--cachedir", "/cache", \
+            "--webdir", "/jellyfin/jellyfin-web"]
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..ff981a2
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,39 @@
+.PHONY: publish build clean patch minor major
+
+IMAGE   ?= git.unkin.net/unkin/jellyfin-ha
+VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo "0.0.0-dev")
+REF     := $(shell cat UPSTREAM_REF)
+
+# Clone the pinned upstream source and publish the .NET server into
+# ./publish-output (consumed by Dockerfile.runtime). Mirrors CI.
+publish:
+	rm -rf src publish-output
+	git clone https://github.com/ZoltyMat/jellyfin-ha.git src
+	git -C src checkout $(REF)
+	dotnet publish src/Jellyfin.Server/Jellyfin.Server.csproj \
+		-c Release -r linux-x64 --self-contained false -o ./publish-output
+
+build: publish
+	docker build -f Dockerfile.runtime -t $(IMAGE):$(VERSION) .
+
+clean:
+	rm -rf src publish-output
+	docker rmi $(IMAGE):$(VERSION) 2>/dev/null || true
+
+_LATEST := $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1)
+_BASE   := $(if $(_LATEST),$(_LATEST),v0.0.0)
+_MAJ    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f1)
+_MIN    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f2)
+_PAT    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f3)
+
+patch:
+	@NEW=v$(_MAJ).$(_MIN).$(shell expr $(_PAT) + 1); \
+	git tag $$NEW && echo "Tagged $$NEW" && git push origin $$NEW
+
+minor:
+	@NEW=v$(_MAJ).$(shell expr $(_MIN) + 1).0; \
+	git tag $$NEW && echo "Tagged $$NEW" && git push origin $$NEW
+
+major:
+	@NEW=v$(shell expr $(_MAJ) + 1).0.0; \
+	git tag $$NEW && echo "Tagged $$NEW" && git push origin $$NEW
diff --git a/README.md b/README.md
index ba7881e..78d3a65 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,41 @@
-# jellyfin-ha
+# jellyfin-ha (container build)
 
-Container build for the jellyfin-ha (HA transcoding) Jellyfin fork
\ No newline at end of file
+Build-orchestration repo for [ZoltyMat/jellyfin-ha](https://github.com/ZoltyMat/jellyfin-ha) — a Jellyfin fork
+that adds distributed, Redis-backed transcoding for multi-pod Kubernetes (lease-aware cleanup, HA session
+takeover, optional PostgreSQL).
+
+This repo does **not** vendor the fork's source. It pins an upstream commit, builds the .NET 10 server, and
+produces a runtime container image pushed to the Gitea registry.
+
+## What it produces
+
+`git.unkin.net/unkin/jellyfin-ha:<tag>` — an `mcr.microsoft.com/dotnet/aspnet:10.0` based image with ffmpeg and
+the prebuilt `jellyfin-web` client, running the published `jellyfin-ha` server.
+
+## Layout
+
+| File | Purpose |
+|------|---------|
+| `UPSTREAM_REF` | Pinned upstream commit SHA. Bumping the fork = edit this + cut a release. |
+| `Dockerfile.runtime` | Runtime-only image; `COPY`s the CI-produced `publish-output/` and the web client. |
+| `Makefile` | Local `make publish` / `make build`; `make patch\|minor\|major` to tag + push a release. |
+| `.woodpecker/build.yaml` | PR pipeline: `dotnet publish` + docker `dry_run`. |
+| `.woodpecker/docker.yaml` | Tag (`v*`) pipeline: `dotnet publish` + build & push to the Gitea registry. |
+
+## Releasing
+
+1. To track a newer upstream, update `UPSTREAM_REF` to the desired commit SHA and merge via PR.
+2. Cut a release: `make patch` (or `minor` / `major`) tags `vX.Y.Z` and pushes it, which triggers
+   `.woodpecker/docker.yaml` to build and push `git.unkin.net/unkin/jellyfin-ha:vX.Y.Z` + `:latest`.
+
+## Local build
+
+```bash
+make build            # clones pinned upstream, dotnet publish, docker build
+```
+
+Requires the .NET 10 SDK and Docker. `make publish` runs just the clone + publish into `./publish-output`.
+
+## Deployment
+
+Deployed to Kubernetes via ArgoCD — see `argocd-apps` (`apps/base/jellyfin`, `media` ApplicationSet/project).
diff --git a/UPSTREAM_REF b/UPSTREAM_REF
new file mode 100644
index 0000000..cc8921c
--- /dev/null
+++ b/UPSTREAM_REF
@@ -0,0 +1 @@
+d4f9c12c22d3a640f3b0a3622b23b8cd01d044ad

From 84f9158e9b4fd2f2983dc1e7e31395c1912f7db6 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Thu, 30 Jul 2026 00:34:59 +1000
Subject: [PATCH 2/4] ci: push images to artifactapi registry instead of gitea

Hard switch of the docker push target from the Gitea registry to the
artifactapi local docker registry (docker-internal); the Gitea VM and its
registry are being retired. Drops the droneci/DRONECI_PASSWORD creds since
artifactapi accepts unauthenticated in-cluster pushes. Also repoints the Makefile IMAGE and README image paths.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
---
 .woodpecker/build.yaml  | 2 +-
 .woodpecker/docker.yaml | 9 +++------
 Makefile                | 2 +-
 README.md               | 4 ++--
 4 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml
index 50584c2..4fb4c71 100644
--- a/.woodpecker/build.yaml
+++ b/.woodpecker/build.yaml
@@ -28,7 +28,7 @@ steps:
   - name: docker-build
     image: woodpeckerci/plugin-docker-buildx
     settings:
-      repo: git.unkin.net/unkin/jellyfin-ha
+      repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha
       dockerfile: Dockerfile.runtime
       dry_run: true
     depends_on: [publish]
diff --git a/.woodpecker/docker.yaml b/.woodpecker/docker.yaml
index 1154c52..ee2067b 100644
--- a/.woodpecker/docker.yaml
+++ b/.woodpecker/docker.yaml
@@ -24,16 +24,13 @@ steps:
             memory: 6Gi
             cpu: 4
 
-  # Build the runtime image and push it to the Gitea registry.
+  # Build the runtime image and push it to the artifactapi local docker registry.
   - name: docker
     image: woodpeckerci/plugin-docker-buildx
     settings:
-      registry: git.unkin.net
-      repo: git.unkin.net/unkin/jellyfin-ha
+      registry: artifactapi.k8s.syd1.au.unkin.net
+      repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha
       dockerfile: Dockerfile.runtime
-      username: droneci
-      password:
-        from_secret: DRONECI_PASSWORD
       tags:
         - ${CI_COMMIT_TAG}
         - latest
diff --git a/Makefile b/Makefile
index ff981a2..34df43b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 .PHONY: publish build clean patch minor major
 
-IMAGE   ?= git.unkin.net/unkin/jellyfin-ha
+IMAGE   ?= artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha
 VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo "0.0.0-dev")
 REF     := $(shell cat UPSTREAM_REF)
 
diff --git a/README.md b/README.md
index 78d3a65..cb90dde 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@ produces a runtime container image pushed to the Gitea registry.
 
 ## What it produces
 
-`git.unkin.net/unkin/jellyfin-ha:<tag>` — an `mcr.microsoft.com/dotnet/aspnet:10.0` based image with ffmpeg and
+`artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:<tag>` — an `mcr.microsoft.com/dotnet/aspnet:10.0` based image with ffmpeg and
 the prebuilt `jellyfin-web` client, running the published `jellyfin-ha` server.
 
 ## Layout
@@ -26,7 +26,7 @@ the prebuilt `jellyfin-web` client, running the published `jellyfin-ha` server.
 
 1. To track a newer upstream, update `UPSTREAM_REF` to the desired commit SHA and merge via PR.
 2. Cut a release: `make patch` (or `minor` / `major`) tags `vX.Y.Z` and pushes it, which triggers
-   `.woodpecker/docker.yaml` to build and push `git.unkin.net/unkin/jellyfin-ha:vX.Y.Z` + `:latest`.
+   `.woodpecker/docker.yaml` to build and push `artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:vX.Y.Z` + `:latest`.
 
 ## Local build
 

From 9f8d9014d338d4fe807905fff41384c9d23f2570 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Tue, 11 Aug 2026 07:25:03 +1000
Subject: [PATCH 3/4] build: source from the unkin jellyfin-ha-src fork

Why:
- The build should pull from our own source fork so local HA patches can be
  carried and pinned, rather than cloning the upstream GitHub tree directly.

How:
- Point the clone URL in the Makefile and both Woodpecker pipelines at
  https://git.unkin.net/unkin/jellyfin-ha-src.git.
- Keep UPSTREAM_REF at d4f9c12c22d3a640f3b0a3622b23b8cd01d044ad, which is the
  seeded fork main, so the produced image is byte-identical for now; the
  feature bump is a later change.
---
 .woodpecker/build.yaml  | 2 +-
 .woodpecker/docker.yaml | 2 +-
 Makefile                | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml
index 4fb4c71..6afcb26 100644
--- a/.woodpecker/build.yaml
+++ b/.woodpecker/build.yaml
@@ -9,7 +9,7 @@ steps:
     commands:
       - |
         REF=$$(cat UPSTREAM_REF)
-        git clone https://github.com/ZoltyMat/jellyfin-ha.git src
+        git clone https://git.unkin.net/unkin/jellyfin-ha-src.git src
         git -C src checkout "$$REF"
         dotnet publish src/Jellyfin.Server/Jellyfin.Server.csproj \
           -c Release -r linux-x64 --self-contained false -o ./publish-output
diff --git a/.woodpecker/docker.yaml b/.woodpecker/docker.yaml
index ee2067b..f45b536 100644
--- a/.woodpecker/docker.yaml
+++ b/.woodpecker/docker.yaml
@@ -9,7 +9,7 @@ steps:
     commands:
       - |
         REF=$$(cat UPSTREAM_REF)
-        git clone https://github.com/ZoltyMat/jellyfin-ha.git src
+        git clone https://git.unkin.net/unkin/jellyfin-ha-src.git src
         git -C src checkout "$$REF"
         dotnet publish src/Jellyfin.Server/Jellyfin.Server.csproj \
           -c Release -r linux-x64 --self-contained false -o ./publish-output
diff --git a/Makefile b/Makefile
index 34df43b..4ccc853 100644
--- a/Makefile
+++ b/Makefile
@@ -8,7 +8,7 @@ REF     := $(shell cat UPSTREAM_REF)
 # ./publish-output (consumed by Dockerfile.runtime). Mirrors CI.
 publish:
 	rm -rf src publish-output
-	git clone https://github.com/ZoltyMat/jellyfin-ha.git src
+	git clone https://git.unkin.net/unkin/jellyfin-ha-src.git src
 	git -C src checkout $(REF)
 	dotnet publish src/Jellyfin.Server/Jellyfin.Server.csproj \
 		-c Release -r linux-x64 --self-contained false -o ./publish-output

From 26e57c8655cf01df89c0300cd75154aed9deeb4b Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Tue, 11 Aug 2026 07:34:30 +1000
Subject: [PATCH 4/4] ci: pin .NET SDK image to 9.0 to match global.json

The pinned jellyfin-ha-src fork sets global.json sdk 9.0.0 (rollForward
latestMinor), so the publish steps in build.yaml and docker.yaml must run
on the .NET 9 SDK. They referenced sdk:10.0, which fails the pinned build.
Repoint both publish steps to mcr.microsoft.com/dotnet/sdk:9.0.
---
 .woodpecker/build.yaml  | 2 +-
 .woodpecker/docker.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml
index 6afcb26..1db1e3f 100644
--- a/.woodpecker/build.yaml
+++ b/.woodpecker/build.yaml
@@ -5,7 +5,7 @@ steps:
   # Clone the pinned upstream jellyfin-ha source and publish the .NET server
   # into ./publish-output (consumed by Dockerfile.runtime).
   - name: publish
-    image: mcr.microsoft.com/dotnet/sdk:10.0
+    image: mcr.microsoft.com/dotnet/sdk:9.0
     commands:
       - |
         REF=$$(cat UPSTREAM_REF)
diff --git a/.woodpecker/docker.yaml b/.woodpecker/docker.yaml
index f45b536..e611658 100644
--- a/.woodpecker/docker.yaml
+++ b/.woodpecker/docker.yaml
@@ -5,7 +5,7 @@ when:
 steps:
   # Same publish step as the PR pipeline: clone pinned upstream + dotnet publish.
   - name: publish
-    image: mcr.microsoft.com/dotnet/sdk:10.0
+    image: mcr.microsoft.com/dotnet/sdk:9.0
     commands:
       - |
         REF=$$(cat UPSTREAM_REF)