jellyfin-ha bakes the SSO auth plugin at image build time, but the CI
build network cannot reach github directly. Route it through the
artifactapi github proxy by allowlisting the SSO plugin release asset.
The iplocate patterns were added to mutable_patterns only, which tags TTL but
does not allowlist — requests 403'd 'access denied'. Verified: existing
mutable_patterns-only paths (branch archives, webadmin) also 403, while patterns
entries (uv) return 200. Add the iplocate patterns to patterns (the allowlist),
keeping them in mutable_patterns so the daily-updated DB stays mutable.
Add patterns to the github.com generic remote for the iplocate ip-to-asn /
ip-to-country databases rather than standing up a new remote. The files are
Git-LFS, so the /raw/ path redirects to media.githubusercontent.com; the github
remote already follows github's cross-host redirects (as it does for release
assets), and the raw path returns the real bytes (verified: 12MB zip / 78MB mmdb).
Marked mutable (branch content).
unkin-agent
unkinben
benvin