Replace direct repo.jellyfin.org download with artifactapi.k8s.syd1.au.unkin.net
remote. SHA256 pin guarantees integrity over HTTP. Both plugins now consistent
in sourcing from artifactapi infrastructure.
The PR build failed at the plugins stage: the CI build network can reach
artifactapi and package mirrors (repo.jellyfin.org) but not github.com
directly, so the SSO plugin download from github failed (curl exit 7).
Route the SSO fetch through the artifactapi github remote proxy instead;
SSO_SHA256 still pins the exact bytes. LDAP is unchanged.
Phase-1 SSO/app-passwords for jellyfin needs the ldapauth and sso plugins
present without relying on the in-app catalog (which the plugins-baked PVC
would otherwise let drift). Pin the newest release of each whose targetAbi
is <= the pinned server version (10.11.6) and let the image own the version.
- Add a plugins build stage that downloads, sha256-verifies (matching each
release's published .sha256), and unpacks the plugin zips into versioned
dirs baked at /usr/share/jellyfin/plugins-baked.
- LDAP Authentication 22.0.0.0 (targetAbi 10.11.2.0; v23 needs 10.11.9).
- SSO Authentication 4.0.0.4 (targetAbi 10.11.0.0).
- Add docker-entrypoint.sh that syncs baked plugin dirs into /config/plugins
on every start, removing any stale versioned dir of the same plugin so the
image controls the version across restarts; preserves plugin configurations.
- Point ENTRYPOINT at the new script.
unkin-agent