From 98081ed54c305575c595cb2b024d714698f06a56 Mon Sep 17 00:00:00 2001 From: Karan Parashar Date: Tue, 10 Nov 2026 20:30:10 +0530 Subject: [PATCH] feat: Add holyarrs and use LDAP for jellyfin --- .../authentik/blueprint-jellyfin-ldap.yaml | 116 ++++++++++++++++++ add-ons/authentik/kustomization.yaml | 1 + add-ons/authentik/sealed-secret.yaml | 2 + apps/holyarrs/deployment.yaml | 74 +++++++++++ apps/holyarrs/httproute.yaml | 23 ++++ apps/holyarrs/kustomization.yaml | 8 ++ apps/holyarrs/networkpolicy.yaml | 62 ++++++++++ apps/holyarrs/pvc.yaml | 11 ++ apps/holyarrs/service.yaml | 12 ++ apps/jellyfin/kustomization.yaml | 2 + apps/jellyfin/networkpolicy-holyarrs.yaml | 25 ++++ apps/jellyfin/networkpolicy-ldap.yaml | 25 ++++ apps/qbit/networkpolicy.yaml | 11 ++ argocd-apps/add-ons/authentik.yaml | 1 + argocd-apps/apps/holyarrs.yaml | 24 ++++ argocd-apps/apps/kustomization.yaml | 1 + 16 files changed, 398 insertions(+) create mode 100644 add-ons/authentik/blueprint-jellyfin-ldap.yaml create mode 100644 apps/holyarrs/deployment.yaml create mode 100644 apps/holyarrs/httproute.yaml create mode 100644 apps/holyarrs/kustomization.yaml create mode 100644 apps/holyarrs/networkpolicy.yaml create mode 100644 apps/holyarrs/pvc.yaml create mode 100644 apps/holyarrs/service.yaml create mode 100644 apps/jellyfin/networkpolicy-holyarrs.yaml create mode 100644 apps/jellyfin/networkpolicy-ldap.yaml create mode 100644 argocd-apps/apps/holyarrs.yaml diff --git a/add-ons/authentik/blueprint-jellyfin-ldap.yaml b/add-ons/authentik/blueprint-jellyfin-ldap.yaml new file mode 100644 index 0000000..d143275 --- /dev/null +++ b/add-ons/authentik/blueprint-jellyfin-ldap.yaml @@ -0,0 +1,116 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: blueprint-jellyfin-ldap + namespace: authentik +data: + jellyfin-ldap.yaml: | + version: 1 + metadata: + name: Jellyfin LDAP + entries: + - model: authentik_stages_password.passwordstage + id: ldap-password + identifiers: + name: ldap-authentication-password + attrs: + backends: + - authentik.core.auth.InbuiltBackend + - authentik.core.auth.TokenBackend + - model: authentik_stages_identification.identificationstage + id: ldap-identification + identifiers: + name: ldap-authentication-identification + attrs: + user_fields: + - username + password_stage: !KeyOf ldap-password + - model: authentik_stages_user_login.userloginstage + id: ldap-login + identifiers: + name: ldap-authentication-login + - model: authentik_flows.flow + id: ldap-flow + identifiers: + slug: ldap-authentication + attrs: + designation: authentication + name: LDAP bind + title: LDAP bind + - model: authentik_flows.flowstagebinding + identifiers: + order: 10 + stage: !KeyOf ldap-identification + target: !KeyOf ldap-flow + - model: authentik_flows.flowstagebinding + identifiers: + order: 30 + stage: !KeyOf ldap-login + target: !KeyOf ldap-flow + - model: authentik_core.user + id: ldap-jellyfin + identifiers: + username: ldap-jellyfin + attrs: + name: Jellyfin LDAP bind + password: !Env JELLYFIN_LDAP_PASSWORD + - model: authentik_providers_ldap.ldapprovider + id: jellyfin-ldap-provider + identifiers: + name: jellyfin-ldap + attrs: + authorization_flow: !KeyOf ldap-flow + invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]] + base_dn: dc=ldap,dc=goauthentik,dc=io + certificate: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]] + bind_mode: direct + search_mode: direct + mfa_support: false # else ";" in a password is read as a TOTP separator + permissions: + - permission: authentik_providers_ldap.search_full_directory + user: !KeyOf ldap-jellyfin + - model: authentik_core.application + id: jellyfin-ldap + identifiers: + slug: jellyfin-ldap + attrs: + name: Jellyfin LDAP + provider: !KeyOf jellyfin-ldap-provider + policy_engine_mode: any + - model: authentik_policies.policybinding + identifiers: + order: 0 + target: !KeyOf jellyfin-ldap + attrs: + group: !Find [authentik_core.group, [name, admins]] + - model: authentik_policies.policybinding + identifiers: + order: 10 + target: !KeyOf jellyfin-ldap + attrs: + user: !KeyOf ldap-jellyfin + - model: authentik_outposts.outpost + identifiers: + name: ldap + attrs: + type: ldap + service_connection: !Find [authentik_outposts.kubernetesserviceconnection, [name, Local Kubernetes Cluster]] + providers: + - !KeyOf jellyfin-ldap-provider + config: + authentik_host: http://authentik-server.authentik.svc.cluster.local + - model: authentik_core.user + identifiers: + username: whyredfire + attrs: + attributes: + jellyfinUsername: karan + - model: authentik_core.token + identifiers: + identifier: jellyfin-whyredfire + attrs: + user: !Find [authentik_core.user, [username, whyredfire]] + intent: app_password + key: !Env JELLYFIN_APP_PASSWORD + expiring: false + description: Jellyfin diff --git a/add-ons/authentik/kustomization.yaml b/add-ons/authentik/kustomization.yaml index edcba9a..e814365 100644 --- a/add-ons/authentik/kustomization.yaml +++ b/add-ons/authentik/kustomization.yaml @@ -6,6 +6,7 @@ resources: - blueprint-garage-ui.yaml - blueprint-google-login.yaml - blueprint-grafana.yaml + - blueprint-jellyfin-ldap.yaml - blueprint-outpost.yaml - blueprint-pgweb.yaml - blueprint-qbittorrent.yaml diff --git a/add-ons/authentik/sealed-secret.yaml b/add-ons/authentik/sealed-secret.yaml index e4c4ccd..050cca5 100644 --- a/add-ons/authentik/sealed-secret.yaml +++ b/add-ons/authentik/sealed-secret.yaml @@ -12,6 +12,8 @@ spec: GOOGLE_CLIENT_ID: AgDOTuDt2E53pPy4ZL+VC6Gvb1I+kuL6ziDjOwWM+CkDpxuBSNxdsCOZap+TWMjOUhxgxev9mhijBTN1DuTtcnLNZopX0Rm2ZtVIq+k3Mm0a6cI6AZCi4nBbiAsNXCx1fUHz00b7meG/hVi6UB4skPR1VFdIu5LZ3QZo3GS5cZ7PMRmCq0UIrP74Hhvlz9CpC2nTPYRx/SsBbbcjYh/DIS6FWiwm8GuIE60Mt9tiiG3Yntb5YF0ZibmEcPzcFfNdxD2uEqTMNOPR0PwbEjdd83LOLLI37/OyW5C0uZIMofjeIx6JuipSaG758kLRfBWXewWSN0BPJIUrKBD7xbZaJ9l25UbpJSB1dZX5nKNh4cRi3xpbdzS4JqhNcytmUgO43NglV0AkiEY2PGzuqj0RiZPlDu0lAEh14cI5SYXAVzlapxE/Zq/DCYBdUYN4Qg6G4hTLNv1wsA/UK8O7KExQ4JqgEfQYyhykMlFdXHERdY1AvhapcTO+KbX1wvU+gVg1GgBz1V+iCWeuxzFwvNDoepCc8rsPUVRr86MCDIKT/I4RTwLNsFyG2Igcj+C1GcoPwMJEY7pJorVBFLYd7Czp2PVm1t1s4Tk+ad+hkURYLnOenOAmSAgUUIYKDxAyxAzzKLOQYxtYKrXw1QmSlaIgz70TAWsBUIimu5/5mC9C6rBcm6soi9hBm207kAkS4h1TlsHdigstJOLggO3ajZMrEqTN0IQFQKP0/SlO7qaHD2R0VW+J8D1C3XhKTeH+XJNIH+JyCD18iDfLXINJ2frfWcvtDPCVzKQMJtM= GOOGLE_CLIENT_SECRET: AgDYAawB7EWhFwOTmRWP8MBjhslEZr9iq+wkOFbYmsDAnW3ADa9g7JILJn33eWG6jTjTE3SH/K0vmhqE+cppCyUtR9qk1vV+lSxuhrqb68l6J5tYPPY45bwq9Ol5Osar6PjuwX5eFLFZwi2hKy61aGH6SzoqJ606hBhMTQijI4X0IYHoEagEg52Fug5y+qEn09CV9Nq9QmaBPJTI8IQfbxqzAVe3E7XMEmjwBBd5pLprOkZAe0cZKFFUx9yRphf8zT8YcxBS+GoiN/Q1lLdQr8fMBWJ3kw5uwmaJwwsGDGyvac9IKGujhlduIba51AfXQ6qels7bqpvN67MmoL5f+j5vT7pB4c3fNNyqkx9Bu8d1dhoZqpaWEa75c2hIlwSMZYOSB1p8lwulzFIyehkuRgGeJqosjmKw0cIspLM/wLXV3MSeGG32opltOW2CtyaK4B7JPDvOhS7M8vjhsP/FxpAfkeQO4GIVS7WbM7sN5i9oAVit/RRhoN1IkZ8+8KEl1B1AkOu6vOCfgMyd0wM3E1EfIN21HyaGZGR5gBLyLl1vKv0TtmH5RJgOkwKmEi5yUL7pyhHLeGuDprtQmt2+l+hFn1xAEN7SHhrynUBFu4ZXfa18q1wcr83trbbl940OB3Xpcu6E2/QgWLAnSDioYyqQXaXXJ9HMddydbSHrYe4/yo2N3katZ3YuZQLZOyl/4eLduWN7jcKMexKU/eLl3Aa9+16mg/g4iMk1WbZTpKGL1GSwAQ== GRAFANA_CLIENT_SECRET: AgCuqXVJoaIdMAoQTjSTLM1kVCvi5k+M8sVtg7cBGjMR2/Bry2FdU2fji/ND4A5w2FfSLLHOmC7J704krMzdKkH9+wsmhGoKbZG4Ur4ImBPiDdApE4JPOOrMWtpxnyGmNkPBv16ztmWj+3Q0pyo0fb1+0l2Gg9XnSG8O0vJXTt28IhfuROzh9r5rRaMilUKnIgEnWybgsPbxYUfqPJE7g5wvZIVxOcpiYlJxFC6MkjEkwkUO7TKCqSNbeSeRvhjRbxAd0ZHkrKGZ0LSLpKDBp7ZfRXBasuUy1sfhLTZNtGWS8YhC5YfoizUs13iafFE3acbkJz/DVJ8at0nsJKrxrfjYOv6kce9RSc4j41mBm8NTv8lhNc/qygxKu+BmNWi5go93PPpA1kno6OonwNNy36rSU0PyElXKUmMegsVXnu7sfDjQfld+VzJPQiDK6gdj090mJ7p2LyBmN1QbSJNvGQ0vNGvqxNjiXHlGantMaA/U6Od2B7AYHu447kJNHnya9KWel3eBWaLC12sfSEfwn5EmWe+7w0wyQd6Frgv9BP/EXQ35SQp7p2dA5WJxSI/2vtue98F3bfnvaJLLrPRiZg/Mqz4DSS875ojPtJc2iEyWprziHehk84zIDC/MuxhmJxj8Xh7zh/zHK6qdFEE8NKLtKlfpFbEzs/p2qtkzQUtCXm618rHOQ+7Rh7JI7u/P7tG11NWmKX15dbmT/Z20MLKsUXq+ymfT0nty8h0FbNAfXaiBENEDpMRCLNu+mCMND5nSqATghSvwFGMgaTbbu3OW99fpn/cK5iMNxXIunai7VA== + JELLYFIN_APP_PASSWORD: AgCzqHmMF80Bh4OcOl0OStJb/zQk0BKzCjIblpELwMLsAuBtIOO0OK/IYrjlCO0T8Vn9jd00LQI1m7R5d+vCxcwbQVNhyw1zHDFg1MI28irvdJmp7439Si7R/T+gObB1I2Vww8d9OZJj5Zm9ngQoM+Oh5ne7c/+W7Qc9xgpWBDtcseCX5QDA1Uu4TJH1cShDQMPb3+KLq7MlKgoWw5uJZA/dJspdR1eqFyaXGHh+rceMZmzwG8sNz43KtVWKN0u7KrN+OE9RYdreQGCw09Yet8FwYA4+z4pAFbOIhyCfqdEW0uWA95f9PA27Z7GgO/CG2vonv73V7nvItIArPchdzdMwD+/UimLllH70tPB6GfZqMsU4FnwdhAyl/UhVO4/PILNZFyyku3SfWtIc2GAf8w0i7KB/zSZoo+HdrGsG8i5020XOG9lIqH/vNTeU4zPBWROEtCKzPjmewBdR2CmGtDu4RrN3XHK5sljwXU3o5QucrD9k8RZ+TjQh6dk/cp373xB1ywMAF9+NmFalnIy4RXJSvjh2H5NLrFFty2vxLqsrVNYdlc8UjNOB06pCnugMBBCx9UIc92ntfoMCmdK7EsUguYB7KWbygbBMfVZ/PusWNMFpmqca5LzcQnoYVKtExRzfofftws9yd0zyQ1MnrEHAC28GlJjYKoIfP/8Tkvah68w9dIoiJ2cIgwkU41JiJ9tjRDIYdvIDBZUPKl3gDF6hbb1K+XbjrEHP5FAZ3Dul0uts2BxRbxBi + JELLYFIN_LDAP_PASSWORD: AgAmgR2Br9bWrqKtnUmcbicWUqVPcgVGLOgTkEhiC5rQPr2W/VXQDecb5ErIfl7XmvhyjMh/4lVymaUntpvD7tYGh0F5IeFTe9NVGL1ssanH7YqY4vQAfDdgQYOWUzl4cC5Lo79bUQcNk31YuJkqDlEiHXWv8W7u0L7X3ijbMvFcgkMwPgZuHPAwJGB9Uok2odtAeSCIQDZ/ri+TfSAqD4rBqKbvueP1o+bkNXN8qai1obvTtPH7NrTy4Qi0JAGQUu43RtTzjxoSaqr3Xq7Z9l+HvYJTxqRUhrNkME378OvNqcH6ob0J6siFyiMJnzfGw2BzhzJ11Y9PEVnzL8c3fC/VtF7bErhid/x9OzFf4qBs9ba1S/710P5BB1cqI8MmqGvc1vIHeH/J8AyWkbWGPqLdsqLZ4k5lcwDJ67R6RwMQIivc2oaUQJnBU2IEzT+EydAyzSMO/Obfc32UFuk64B0IigsXKii274r1tAxa3Ua8lvpi1rQkqhx6Fe8Nwkvxe116gLjWKqBiJ6dTPMuwvt3OkRjMpKBs9AH9V8t90lWqO4cBGd1kZYKTcAHyQkIM8XqIiOuwyzjuW8Kxjl7skT9DuV+X6GLWoUnZNpo16Vu4OUigWb7uuNuMcp1bI7fX0U0CR1H58h1dAUfLRGP06tOK8xakrmmsC/QCu8ErC2broAPOWKLsFQVRafiSjRcvQ7z2OcN/JHLAPeJUJcFVhdTJSpVQa41KW3MX9uFO8oXLLyQSrFFrKF7Y WIREGUARD_CLIENT_SECRET: AgChVcZeF7KFvb0r9dkUg+53Rx7owhpI+ttOsTZ2Bd6h8Luike/g2Fj0wbBJqOeIqQIHGCHXB+lZ1wZHG8kL4BeDseMt5v22w8WOffZpfwcFtx9AYKjvKeNldFuFnaQjQbSigYJY1fFZXObn7tMB0zppSHb93G1q7r3/JsseXIrsBGFY2cHakE1gu+NC9glIdQLByxQzTrdHF/92bHsOcLa1Bqqtihxrfy2wBAykZloiyNIj+bhD1EIpCjHB2Dx5Cu5Sqz+lguHOIAs1jOaxA1NGjQJADo0+w5prtUhuB57nNHQrOLFzZyJqHr59ENYjsrz6jmroCuffbjyI0aKsCn/82oWfJzoSKvMGI9PnS9CzoGC+mKu2FWvDvdTvultGy0lk4m6pvNQIxUz+PPNUeagS43e6xiGgHKKaBZf0r5cWqFtbSrYl8hn0Fw7u3A0c+7N5/lx2//icrwFfajvF1Rguay1vvhKn1Wl9OSvo9F+Prtm85r4Gu4qsds42TpmTMr7d+fsL4hftGZg4KUdpqAca02uTURkS+3RiSYmTL/D9RrNy34oGuq8KkW4feLfHOub92J7GK/6febePsdyuTE6NCaikWekTPUEtmJAKMgRfZWkc2fL81pLT2QrMq/9DwTelrTLrAA8rtxT5TkN0aIfF+Gn3n1fOhTjYAqzMeKKRyrhODF8D+MKsi3knau2SFPDAJaXTvgInHImqtIL2RBtzv6DvIP8bUkaFLlMiOz0y5tcegzFcsp9HCQ8YjwQcJJb3tavZLe/VWJqOPrRP1+ti template: metadata: diff --git a/apps/holyarrs/deployment.yaml b/apps/holyarrs/deployment.yaml new file mode 100644 index 0000000..2bcaf33 --- /dev/null +++ b/apps/holyarrs/deployment.yaml @@ -0,0 +1,74 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: holyarrs + namespace: holyarrs +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: holyarrs + strategy: + type: Recreate + template: + metadata: + labels: + app.kubernetes.io/name: holyarrs + spec: + containers: + - env: + - name: TZ + value: Etc/UTC + - name: HOLYARRS_ALLOWED_HOSTS + value: holyarrs.whyredfire.dev + # Traefik's pods + - name: HOLYARRS_TRUSTED_PROXIES + value: 10.42.0.0/16 + image: holyarrs/holyarrs:1.0.9@sha256:3d941aa8a78d4474cc016a0d994b2531aa8692015aaad487cbdee136e8dd4226 + livenessProbe: + httpGet: + path: /healthz + port: http + initialDelaySeconds: 10 + periodSeconds: 30 + name: holyarrs + ports: + - containerPort: 6262 + name: http + readinessProbe: + httpGet: + path: /healthz + port: http + resources: + limits: + cpu: 1000m + memory: 1Gi + requests: + cpu: 50m + memory: 192Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + volumeMounts: + - mountPath: /config + name: config + # Same path as Jellyfin; one mount so imports hardlink instead of copy + - mountPath: /media + name: media + # Owner of /srv/media, same as qBittorrent + securityContext: + fsGroup: 1000 + runAsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + volumes: + - name: config + persistentVolumeClaim: + claimName: holyarrs-config + - hostPath: + path: /srv/media + name: media diff --git a/apps/holyarrs/httproute.yaml b/apps/holyarrs/httproute.yaml new file mode 100644 index 0000000..bbe70ec --- /dev/null +++ b/apps/holyarrs/httproute.yaml @@ -0,0 +1,23 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + annotations: + argocd.argoproj.io/sync-wave: "2" + name: holyarrs + namespace: holyarrs +spec: + hostnames: + - holyarrs.whyredfire.dev + parentRefs: + - kind: Gateway + name: traefik-gateway + namespace: traefik + sectionName: websecure + rules: + - backendRefs: + - name: holyarrs + port: 6262 + matches: + - path: + type: PathPrefix + value: / diff --git a/apps/holyarrs/kustomization.yaml b/apps/holyarrs/kustomization.yaml new file mode 100644 index 0000000..d5e7205 --- /dev/null +++ b/apps/holyarrs/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - pvc.yaml + - deployment.yaml + - service.yaml + - httproute.yaml + - networkpolicy.yaml diff --git a/apps/holyarrs/networkpolicy.yaml b/apps/holyarrs/networkpolicy.yaml new file mode 100644 index 0000000..7b56dba --- /dev/null +++ b/apps/holyarrs/networkpolicy.yaml @@ -0,0 +1,62 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: holyarrs + namespace: holyarrs +spec: + # Metadata and indexers are on the internet; in the cluster it only talks + # to Jellyfin and qBittorrent + egress: + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + k8s-app: kube-dns + - ports: + - port: 8096 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: jellyfin + podSelector: + matchLabels: + app.kubernetes.io/name: jellyfin + - ports: + - port: 8080 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: qbit + podSelector: + matchLabels: + app.kubernetes.io/name: qbittorrent + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + ports: + - port: 6262 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: holyarrs + policyTypes: + - Ingress + - Egress diff --git a/apps/holyarrs/pvc.yaml b/apps/holyarrs/pvc.yaml new file mode 100644 index 0000000..2cb425b --- /dev/null +++ b/apps/holyarrs/pvc.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: holyarrs-config + namespace: holyarrs +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi diff --git a/apps/holyarrs/service.yaml b/apps/holyarrs/service.yaml new file mode 100644 index 0000000..d036086 --- /dev/null +++ b/apps/holyarrs/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: holyarrs + namespace: holyarrs +spec: + ports: + - name: http + port: 6262 + targetPort: http + selector: + app.kubernetes.io/name: holyarrs diff --git a/apps/jellyfin/kustomization.yaml b/apps/jellyfin/kustomization.yaml index dcb0595..6b3a094 100644 --- a/apps/jellyfin/kustomization.yaml +++ b/apps/jellyfin/kustomization.yaml @@ -3,3 +3,5 @@ kind: Kustomization resources: - httproute-local.yaml - httproute.yaml + - networkpolicy-holyarrs.yaml + - networkpolicy-ldap.yaml diff --git a/apps/jellyfin/networkpolicy-holyarrs.yaml b/apps/jellyfin/networkpolicy-holyarrs.yaml new file mode 100644 index 0000000..5038ed2 --- /dev/null +++ b/apps/jellyfin/networkpolicy-holyarrs.yaml @@ -0,0 +1,25 @@ +# Lets HolyArrs ask Jellyfin to rescan after imports and sign people in. +# Adds to the chart's policy, which only admits traefik. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: jellyfin-from-holyarrs + namespace: jellyfin +spec: + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: holyarrs + podSelector: + matchLabels: + app.kubernetes.io/name: holyarrs + ports: + - port: 8096 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: jellyfin + app.kubernetes.io/instance: jellyfin + policyTypes: + - Ingress diff --git a/apps/jellyfin/networkpolicy-ldap.yaml b/apps/jellyfin/networkpolicy-ldap.yaml new file mode 100644 index 0000000..a1e45e0 --- /dev/null +++ b/apps/jellyfin/networkpolicy-ldap.yaml @@ -0,0 +1,25 @@ +# Lets Jellyfin's LDAP plugin reach authentik's LDAP outpost (LDAPS). +# Adds to the chart's policy, which keeps Jellyfin off the cluster network. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: jellyfin-to-ldap + namespace: jellyfin +spec: + egress: + - ports: + - port: 6636 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: authentik + podSelector: + matchLabels: + goauthentik.io/outpost-name: ldap + podSelector: + matchLabels: + app.kubernetes.io/name: jellyfin + app.kubernetes.io/instance: jellyfin + policyTypes: + - Egress diff --git a/apps/qbit/networkpolicy.yaml b/apps/qbit/networkpolicy.yaml index ab2dd6e..7cb2ce0 100644 --- a/apps/qbit/networkpolicy.yaml +++ b/apps/qbit/networkpolicy.yaml @@ -20,6 +20,17 @@ spec: ports: - port: 8080 protocol: TCP + # HolyArrs sends releases and follows downloads through the Web API + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: holyarrs + podSelector: + matchLabels: + app.kubernetes.io/name: holyarrs + ports: + - port: 8080 + protocol: TCP podSelector: matchLabels: app.kubernetes.io/name: qbittorrent diff --git a/argocd-apps/add-ons/authentik.yaml b/argocd-apps/add-ons/authentik.yaml index f5bdffd..ec7dfb4 100644 --- a/argocd-apps/add-ons/authentik.yaml +++ b/argocd-apps/add-ons/authentik.yaml @@ -32,6 +32,7 @@ spec: - blueprint-garage-ui - blueprint-google-login - blueprint-grafana + - blueprint-jellyfin-ldap - blueprint-outpost - blueprint-pgweb - blueprint-qbittorrent diff --git a/argocd-apps/apps/holyarrs.yaml b/argocd-apps/apps/holyarrs.yaml new file mode 100644 index 0000000..d6f5657 --- /dev/null +++ b/argocd-apps/apps/holyarrs.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + annotations: + argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller + argocd.argoproj.io/sync-wave: "3" + name: holyarrs + namespace: argocd +spec: + destination: + namespace: holyarrs + server: https://kubernetes.default.svc + project: default + source: + path: apps/holyarrs + repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git + targetRevision: main + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/argocd-apps/apps/kustomization.yaml b/argocd-apps/apps/kustomization.yaml index 20f89b7..f2578fa 100644 --- a/argocd-apps/apps/kustomization.yaml +++ b/argocd-apps/apps/kustomization.yaml @@ -6,6 +6,7 @@ resources: - betterslcm.yaml - garage.yaml - garage-ui.yaml + - holyarrs.yaml - jellyfin.yaml - pgweb.yaml - pixelos-applications.yaml