Add artifactapi remotes for jellyfin-ha auth plugins #39

2026-08-26T23:23:42+10:00

unkin-agent commented

2026-08-26 23:23:42 +10:00

Why

jellyfin-ha bakes the LDAP and SSO authentication plugins into its image at build time. Per policy, all outside artifacts must be fetched through artifactapi rather than pulled directly from upstream.

How

Add config/remote_generic/jellyfin.yaml, a new generic remote proxying https://repo.jellyfin.org, scoped (least-privilege) to the ldap-authentication plugin zip.
Add a pattern to the existing config/remote_generic/github.yaml remote for 9p4/jellyfin-plugin-sso release zips. GitHub redirects release downloads to objects.githubusercontent.com; the existing github remote already follows those redirects (it proxies many other release assets the same way).

Proxied URLs the Dockerfile will use afterwards

LDAP plugin: http://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/jellyfin/files/plugin/ldap-authentication/ldap-authentication_22.0.0.0.zip
SSO plugin: http://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/9p4/jellyfin-plugin-sso/releases/download/v4.0.0.4/sso-authentication_4.0.0.4.zip

Validation

yamllint (relaxed, repo pre-commit config) passes on both changed files.

## Why jellyfin-ha bakes the LDAP and SSO authentication plugins into its image at build time. Per policy, all outside artifacts must be fetched through artifactapi rather than pulled directly from upstream. ## How - Add `config/remote_generic/jellyfin.yaml`, a new generic remote proxying `https://repo.jellyfin.org`, scoped (least-privilege) to the ldap-authentication plugin zip. - Add a pattern to the existing `config/remote_generic/github.yaml` remote for `9p4/jellyfin-plugin-sso` release zips. GitHub redirects release downloads to `objects.githubusercontent.com`; the existing github remote already follows those redirects (it proxies many other release assets the same way). ## Proxied URLs the Dockerfile will use afterwards - LDAP plugin: `http://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/jellyfin/files/plugin/ldap-authentication/ldap-authentication_22.0.0.0.zip` - SSO plugin: `http://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/9p4/jellyfin-plugin-sso/releases/download/v4.0.0.4/sso-authentication_4.0.0.4.zip` ## Validation - `yamllint` (relaxed, repo pre-commit config) passes on both changed files.

unkin-agent added 1 commit 2026-08-26 23:23:42 +10:00

Add artifactapi remotes for jellyfin-ha auth plugins

ci/woodpecker/pr/plan Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

11c3059b05

jellyfin-ha bakes the LDAP and SSO auth plugins into its image, and all
outside artifacts must be fetched via artifactapi rather than direct.

- Add remote_generic/jellyfin.yaml proxying repo.jellyfin.org, scoped to
  the ldap-authentication plugin zip.
- Add a github.yaml pattern for 9p4/jellyfin-plugin-sso release zips
  (GitHub redirects release downloads to objects.githubusercontent.com,
  which the existing github remote already follows).

unkin-agent referenced this pull request

2026-08-26 23:37:49 +10:00

Allowlist jellyfin-plugin-sso in the github proxy #40

benvin merged commit 5a0c1fe814 into main

2026-08-29 11:52:23 +10:00

benvin deleted branch benvin/jellyfin-plugin-remotes

2026-08-29 11:52:24 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-artifactapi#39