feat: Add holyarrs and use LDAP for jellyfin

chore(add-ons): Track redoost images with latest tags
chore(add-ons): Let Image Updater read GHCR
2026-11-10 22:27:54 +05:30 · 2026-11-08 17:04:28 +05:30 · 2026-11-05 22:44:24 +05:30 · 2026-11-05 22:44:24 +05:30 · 2026-11-05 22:44:24 +05:30 · 2026-11-05 22:44:24 +05:30
21 changed files with 435 additions and 3 deletions
@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
  - ghcr-sealedsecret.yaml
  - pixelos-applications.yaml
+  - redoost.yaml
@@ -1,13 +1,13 @@
 apiVersion: argocd-image-updater.argoproj.io/v1alpha1
 kind: ImageUpdater
 metadata:
-  name: applications
+  name: pixelos-applications
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
 spec:
  applicationRefs:
-    - namePattern: applications
+    - namePattern: pixelos-applications
      images:
        - alias: app
          imageName: ghcr.io/pixelos-ci/applications:latest
@@ -0,0 +1,27 @@
+apiVersion: argocd-image-updater.argoproj.io/v1alpha1
+kind: ImageUpdater
+metadata:
+  name: redoost
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  applicationRefs:
+    - namePattern: redoost
+      images:
+        - alias: api
+          imageName: ghcr.io/whyredfire/redoost-api:latest
+          commonUpdateSettings:
+            updateStrategy: digest
+          manifestTargets:
+            helm:
+              name: api.image.repository
+              tag: api.image.tag
+        - alias: frontend
+          imageName: ghcr.io/whyredfire/redoost-frontend:latest
+          commonUpdateSettings:
+            updateStrategy: digest
+          manifestTargets:
+            helm:
+              name: frontend.image.repository
+              tag: frontend.image.tag
@@ -0,0 +1,116 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-jellyfin-ldap
+  namespace: authentik
+data:
+  jellyfin-ldap.yaml: |
+    version: 1
+    metadata:
+      name: Jellyfin LDAP
+    entries:
+      - model: authentik_stages_password.passwordstage
+        id: ldap-password
+        identifiers:
+          name: ldap-authentication-password
+        attrs:
+          backends:
+            - authentik.core.auth.InbuiltBackend
+            - authentik.core.auth.TokenBackend
+      - model: authentik_stages_identification.identificationstage
+        id: ldap-identification
+        identifiers:
+          name: ldap-authentication-identification
+        attrs:
+          user_fields:
+            - username
+          password_stage: !KeyOf ldap-password
+      - model: authentik_stages_user_login.userloginstage
+        id: ldap-login
+        identifiers:
+          name: ldap-authentication-login
+      - model: authentik_flows.flow
+        id: ldap-flow
+        identifiers:
+          slug: ldap-authentication
+        attrs:
+          designation: authentication
+          name: LDAP bind
+          title: LDAP bind
+      - model: authentik_flows.flowstagebinding
+        identifiers:
+          order: 10
+          stage: !KeyOf ldap-identification
+          target: !KeyOf ldap-flow
+      - model: authentik_flows.flowstagebinding
+        identifiers:
+          order: 30
+          stage: !KeyOf ldap-login
+          target: !KeyOf ldap-flow
+      - model: authentik_core.user
+        id: ldap-jellyfin
+        identifiers:
+          username: ldap-jellyfin
+        attrs:
+          name: Jellyfin LDAP bind
+          password: !Env JELLYFIN_LDAP_PASSWORD
+      - model: authentik_providers_ldap.ldapprovider
+        id: jellyfin-ldap-provider
+        identifiers:
+          name: jellyfin-ldap
+        attrs:
+          authorization_flow: !KeyOf ldap-flow
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
+          base_dn: dc=ldap,dc=goauthentik,dc=io
+          certificate: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          bind_mode: direct
+          search_mode: direct
+          mfa_support: false # else ";" in a password is read as a TOTP separator
+        permissions:
+          - permission: authentik_providers_ldap.search_full_directory
+            user: !KeyOf ldap-jellyfin
+      - model: authentik_core.application
+        id: jellyfin-ldap
+        identifiers:
+          slug: jellyfin-ldap
+        attrs:
+          name: Jellyfin LDAP
+          provider: !KeyOf jellyfin-ldap-provider
+          policy_engine_mode: any
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 0
+          target: !KeyOf jellyfin-ldap
+        attrs:
+          group: !Find [authentik_core.group, [name, admins]]
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 10
+          target: !KeyOf jellyfin-ldap
+        attrs:
+          user: !KeyOf ldap-jellyfin
+      - model: authentik_outposts.outpost
+        identifiers:
+          name: ldap
+        attrs:
+          type: ldap
+          service_connection: !Find [authentik_outposts.kubernetesserviceconnection, [name, Local Kubernetes Cluster]]
+          providers:
+            - !KeyOf jellyfin-ldap-provider
+          config:
+            authentik_host: http://authentik-server.authentik.svc.cluster.local
+      - model: authentik_core.user
+        identifiers:
+          username: whyredfire
+        attrs:
+          attributes:
+            jellyfinUsername: karan
+      - model: authentik_core.token
+        identifiers:
+          identifier: jellyfin-whyredfire
+        attrs:
+          user: !Find [authentik_core.user, [username, whyredfire]]
+          intent: app_password
+          key: !Env JELLYFIN_APP_PASSWORD
+          expiring: false
+          description: Jellyfin
@@ -6,6 +6,7 @@ resources:
  - blueprint-garage-ui.yaml
  - blueprint-google-login.yaml
  - blueprint-grafana.yaml
+  - blueprint-jellyfin-ldap.yaml
  - blueprint-outpost.yaml
  - blueprint-pgweb.yaml
  - blueprint-qbittorrent.yaml
@@ -12,6 +12,8 @@ spec:
    GOOGLE_CLIENT_ID: AgDOTuDt2E53pPy4ZL+VC6Gvb1I+kuL6ziDjOwWM+CkDpxuBSNxdsCOZap+TWMjOUhxgxev9mhijBTN1DuTtcnLNZopX0Rm2ZtVIq+k3Mm0a6cI6AZCi4nBbiAsNXCx1fUHz00b7meG/hVi6UB4skPR1VFdIu5LZ3QZo3GS5cZ7PMRmCq0UIrP74Hhvlz9CpC2nTPYRx/SsBbbcjYh/DIS6FWiwm8GuIE60Mt9tiiG3Yntb5YF0ZibmEcPzcFfNdxD2uEqTMNOPR0PwbEjdd83LOLLI37/OyW5C0uZIMofjeIx6JuipSaG758kLRfBWXewWSN0BPJIUrKBD7xbZaJ9l25UbpJSB1dZX5nKNh4cRi3xpbdzS4JqhNcytmUgO43NglV0AkiEY2PGzuqj0RiZPlDu0lAEh14cI5SYXAVzlapxE/Zq/DCYBdUYN4Qg6G4hTLNv1wsA/UK8O7KExQ4JqgEfQYyhykMlFdXHERdY1AvhapcTO+KbX1wvU+gVg1GgBz1V+iCWeuxzFwvNDoepCc8rsPUVRr86MCDIKT/I4RTwLNsFyG2Igcj+C1GcoPwMJEY7pJorVBFLYd7Czp2PVm1t1s4Tk+ad+hkURYLnOenOAmSAgUUIYKDxAyxAzzKLOQYxtYKrXw1QmSlaIgz70TAWsBUIimu5/5mC9C6rBcm6soi9hBm207kAkS4h1TlsHdigstJOLggO3ajZMrEqTN0IQFQKP0/SlO7qaHD2R0VW+J8D1C3XhKTeH+XJNIH+JyCD18iDfLXINJ2frfWcvtDPCVzKQMJtM=
    GOOGLE_CLIENT_SECRET: AgDYAawB7EWhFwOTmRWP8MBjhslEZr9iq+wkOFbYmsDAnW3ADa9g7JILJn33eWG6jTjTE3SH/K0vmhqE+cppCyUtR9qk1vV+lSxuhrqb68l6J5tYPPY45bwq9Ol5Osar6PjuwX5eFLFZwi2hKy61aGH6SzoqJ606hBhMTQijI4X0IYHoEagEg52Fug5y+qEn09CV9Nq9QmaBPJTI8IQfbxqzAVe3E7XMEmjwBBd5pLprOkZAe0cZKFFUx9yRphf8zT8YcxBS+GoiN/Q1lLdQr8fMBWJ3kw5uwmaJwwsGDGyvac9IKGujhlduIba51AfXQ6qels7bqpvN67MmoL5f+j5vT7pB4c3fNNyqkx9Bu8d1dhoZqpaWEa75c2hIlwSMZYOSB1p8lwulzFIyehkuRgGeJqosjmKw0cIspLM/wLXV3MSeGG32opltOW2CtyaK4B7JPDvOhS7M8vjhsP/FxpAfkeQO4GIVS7WbM7sN5i9oAVit/RRhoN1IkZ8+8KEl1B1AkOu6vOCfgMyd0wM3E1EfIN21HyaGZGR5gBLyLl1vKv0TtmH5RJgOkwKmEi5yUL7pyhHLeGuDprtQmt2+l+hFn1xAEN7SHhrynUBFu4ZXfa18q1wcr83trbbl940OB3Xpcu6E2/QgWLAnSDioYyqQXaXXJ9HMddydbSHrYe4/yo2N3katZ3YuZQLZOyl/4eLduWN7jcKMexKU/eLl3Aa9+16mg/g4iMk1WbZTpKGL1GSwAQ==
    GRAFANA_CLIENT_SECRET: AgCuqXVJoaIdMAoQTjSTLM1kVCvi5k+M8sVtg7cBGjMR2/Bry2FdU2fji/ND4A5w2FfSLLHOmC7J704krMzdKkH9+wsmhGoKbZG4Ur4ImBPiDdApE4JPOOrMWtpxnyGmNkPBv16ztmWj+3Q0pyo0fb1+0l2Gg9XnSG8O0vJXTt28IhfuROzh9r5rRaMilUKnIgEnWybgsPbxYUfqPJE7g5wvZIVxOcpiYlJxFC6MkjEkwkUO7TKCqSNbeSeRvhjRbxAd0ZHkrKGZ0LSLpKDBp7ZfRXBasuUy1sfhLTZNtGWS8YhC5YfoizUs13iafFE3acbkJz/DVJ8at0nsJKrxrfjYOv6kce9RSc4j41mBm8NTv8lhNc/qygxKu+BmNWi5go93PPpA1kno6OonwNNy36rSU0PyElXKUmMegsVXnu7sfDjQfld+VzJPQiDK6gdj090mJ7p2LyBmN1QbSJNvGQ0vNGvqxNjiXHlGantMaA/U6Od2B7AYHu447kJNHnya9KWel3eBWaLC12sfSEfwn5EmWe+7w0wyQd6Frgv9BP/EXQ35SQp7p2dA5WJxSI/2vtue98F3bfnvaJLLrPRiZg/Mqz4DSS875ojPtJc2iEyWprziHehk84zIDC/MuxhmJxj8Xh7zh/zHK6qdFEE8NKLtKlfpFbEzs/p2qtkzQUtCXm618rHOQ+7Rh7JI7u/P7tG11NWmKX15dbmT/Z20MLKsUXq+ymfT0nty8h0FbNAfXaiBENEDpMRCLNu+mCMND5nSqATghSvwFGMgaTbbu3OW99fpn/cK5iMNxXIunai7VA==
+    JELLYFIN_APP_PASSWORD: AgCzqHmMF80Bh4OcOl0OStJb/zQk0BKzCjIblpELwMLsAuBtIOO0OK/IYrjlCO0T8Vn9jd00LQI1m7R5d+vCxcwbQVNhyw1zHDFg1MI28irvdJmp7439Si7R/T+gObB1I2Vww8d9OZJj5Zm9ngQoM+Oh5ne7c/+W7Qc9xgpWBDtcseCX5QDA1Uu4TJH1cShDQMPb3+KLq7MlKgoWw5uJZA/dJspdR1eqFyaXGHh+rceMZmzwG8sNz43KtVWKN0u7KrN+OE9RYdreQGCw09Yet8FwYA4+z4pAFbOIhyCfqdEW0uWA95f9PA27Z7GgO/CG2vonv73V7nvItIArPchdzdMwD+/UimLllH70tPB6GfZqMsU4FnwdhAyl/UhVO4/PILNZFyyku3SfWtIc2GAf8w0i7KB/zSZoo+HdrGsG8i5020XOG9lIqH/vNTeU4zPBWROEtCKzPjmewBdR2CmGtDu4RrN3XHK5sljwXU3o5QucrD9k8RZ+TjQh6dk/cp373xB1ywMAF9+NmFalnIy4RXJSvjh2H5NLrFFty2vxLqsrVNYdlc8UjNOB06pCnugMBBCx9UIc92ntfoMCmdK7EsUguYB7KWbygbBMfVZ/PusWNMFpmqca5LzcQnoYVKtExRzfofftws9yd0zyQ1MnrEHAC28GlJjYKoIfP/8Tkvah68w9dIoiJ2cIgwkU41JiJ9tjRDIYdvIDBZUPKl3gDF6hbb1K+XbjrEHP5FAZ3Dul0uts2BxRbxBi
+    JELLYFIN_LDAP_PASSWORD: AgAmgR2Br9bWrqKtnUmcbicWUqVPcgVGLOgTkEhiC5rQPr2W/VXQDecb5ErIfl7XmvhyjMh/4lVymaUntpvD7tYGh0F5IeFTe9NVGL1ssanH7YqY4vQAfDdgQYOWUzl4cC5Lo79bUQcNk31YuJkqDlEiHXWv8W7u0L7X3ijbMvFcgkMwPgZuHPAwJGB9Uok2odtAeSCIQDZ/ri+TfSAqD4rBqKbvueP1o+bkNXN8qai1obvTtPH7NrTy4Qi0JAGQUu43RtTzjxoSaqr3Xq7Z9l+HvYJTxqRUhrNkME378OvNqcH6ob0J6siFyiMJnzfGw2BzhzJ11Y9PEVnzL8c3fC/VtF7bErhid/x9OzFf4qBs9ba1S/710P5BB1cqI8MmqGvc1vIHeH/J8AyWkbWGPqLdsqLZ4k5lcwDJ67R6RwMQIivc2oaUQJnBU2IEzT+EydAyzSMO/Obfc32UFuk64B0IigsXKii274r1tAxa3Ua8lvpi1rQkqhx6Fe8Nwkvxe116gLjWKqBiJ6dTPMuwvt3OkRjMpKBs9AH9V8t90lWqO4cBGd1kZYKTcAHyQkIM8XqIiOuwyzjuW8Kxjl7skT9DuV+X6GLWoUnZNpo16Vu4OUigWb7uuNuMcp1bI7fX0U0CR1H58h1dAUfLRGP06tOK8xakrmmsC/QCu8ErC2broAPOWKLsFQVRafiSjRcvQ7z2OcN/JHLAPeJUJcFVhdTJSpVQa41KW3MX9uFO8oXLLyQSrFFrKF7Y
    WIREGUARD_CLIENT_SECRET: AgChVcZeF7KFvb0r9dkUg+53Rx7owhpI+ttOsTZ2Bd6h8Luike/g2Fj0wbBJqOeIqQIHGCHXB+lZ1wZHG8kL4BeDseMt5v22w8WOffZpfwcFtx9AYKjvKeNldFuFnaQjQbSigYJY1fFZXObn7tMB0zppSHb93G1q7r3/JsseXIrsBGFY2cHakE1gu+NC9glIdQLByxQzTrdHF/92bHsOcLa1Bqqtihxrfy2wBAykZloiyNIj+bhD1EIpCjHB2Dx5Cu5Sqz+lguHOIAs1jOaxA1NGjQJADo0+w5prtUhuB57nNHQrOLFzZyJqHr59ENYjsrz6jmroCuffbjyI0aKsCn/82oWfJzoSKvMGI9PnS9CzoGC+mKu2FWvDvdTvultGy0lk4m6pvNQIxUz+PPNUeagS43e6xiGgHKKaBZf0r5cWqFtbSrYl8hn0Fw7u3A0c+7N5/lx2//icrwFfajvF1Rguay1vvhKn1Wl9OSvo9F+Prtm85r4Gu4qsds42TpmTMr7d+fsL4hftGZg4KUdpqAca02uTURkS+3RiSYmTL/D9RrNy34oGuq8KkW4feLfHOub92J7GK/6febePsdyuTE6NCaikWekTPUEtmJAKMgRfZWkc2fL81pLT2QrMq/9DwTelrTLrAA8rtxT5TkN0aIfF+Gn3n1fOhTjYAqzMeKKRyrhODF8D+MKsi3knau2SFPDAJaXTvgInHImqtIL2RBtzv6DvIP8bUkaFLlMiOz0y5tcegzFcsp9HCQ8YjwQcJJb3tavZLe/VWJqOPrRP1+ti
  template:
    metadata:
@@ -0,0 +1,74 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: holyarrs
+  namespace: holyarrs
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: holyarrs
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: holyarrs
+    spec:
+      containers:
+        - env:
+            - name: TZ
+              value: Etc/UTC
+            - name: HOLYARRS_ALLOWED_HOSTS
+              value: holyarrs.whyredfire.dev
+            # Traefik's pods
+            - name: HOLYARRS_TRUSTED_PROXIES
+              value: 10.42.0.0/16
+          image: holyarrs/holyarrs:1.0.9@sha256:3d941aa8a78d4474cc016a0d994b2531aa8692015aaad487cbdee136e8dd4226
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          name: holyarrs
+          ports:
+            - containerPort: 6262
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+          resources:
+            limits:
+              cpu: 1000m
+              memory: 1Gi
+            requests:
+              cpu: 50m
+              memory: 192Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - mountPath: /config
+              name: config
+            # Same path as Jellyfin; one mount so imports hardlink instead of copy
+            - mountPath: /media
+              name: media
+      # Owner of /srv/media, same as qBittorrent
+      securityContext:
+        fsGroup: 1000
+        runAsGroup: 1000
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: holyarrs-config
+        - hostPath:
+            path: /srv/media
+          name: media
@@ -0,0 +1,23 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: holyarrs
+  namespace: holyarrs
+spec:
+  hostnames:
+    - holyarrs.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: holyarrs
+          port: 6262
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - httproute.yaml
+  - networkpolicy.yaml
@@ -0,0 +1,62 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: holyarrs
+  namespace: holyarrs
+spec:
+  # Metadata and indexers are on the internet; in the cluster it only talks
+  # to Jellyfin and qBittorrent
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+    - ports:
+        - port: 8096
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: jellyfin
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: jellyfin
+    - ports:
+        - port: 8080
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: qbit
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: qbittorrent
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 6262
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: holyarrs
+  policyTypes:
+    - Ingress
+    - Egress
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: holyarrs-config
+  namespace: holyarrs
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: holyarrs
+  namespace: holyarrs
+spec:
+  ports:
+    - name: http
+      port: 6262
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: holyarrs
@@ -3,3 +3,5 @@ kind: Kustomization
 resources:
  - httproute-local.yaml
  - httproute.yaml
+  - networkpolicy-holyarrs.yaml
+  - networkpolicy-ldap.yaml
@@ -0,0 +1,25 @@
+# Lets HolyArrs ask Jellyfin to rescan after imports and sign people in.
+# Adds to the chart's policy, which only admits traefik.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: jellyfin-from-holyarrs
+  namespace: jellyfin
+spec:
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: holyarrs
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: holyarrs
+      ports:
+        - port: 8096
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: jellyfin
+      app.kubernetes.io/instance: jellyfin
+  policyTypes:
+    - Ingress
@@ -0,0 +1,25 @@
+# Lets Jellyfin's LDAP plugin reach authentik's LDAP outpost (LDAPS).
+# Adds to the chart's policy, which keeps Jellyfin off the cluster network.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: jellyfin-to-ldap
+  namespace: jellyfin
+spec:
+  egress:
+    - ports:
+        - port: 6636
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: authentik
+          podSelector:
+            matchLabels:
+              goauthentik.io/outpost-name: ldap
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: jellyfin
+      app.kubernetes.io/instance: jellyfin
+  policyTypes:
+    - Egress
@@ -20,6 +20,17 @@ spec:
      ports:
        - port: 8080
          protocol: TCP
+    # HolyArrs sends releases and follows downloads through the Web API
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: holyarrs
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: holyarrs
+      ports:
+        - port: 8080
+          protocol: TCP
  podSelector:
    matchLabels:
      app.kubernetes.io/name: qbittorrent
@@ -32,6 +32,7 @@ spec:
              - blueprint-garage-ui
              - blueprint-google-login
              - blueprint-grafana
+              - blueprint-jellyfin-ldap
              - blueprint-outpost
              - blueprint-pgweb
              - blueprint-qbittorrent
@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
+    argocd.argoproj.io/sync-wave: "3"
+  name: holyarrs
+  namespace: argocd
+spec:
+  destination:
+    namespace: holyarrs
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    path: apps/holyarrs
+    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+    targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
@@ -6,6 +6,7 @@ resources:
  - betterslcm.yaml
  - garage.yaml
  - garage-ui.yaml
+  - holyarrs.yaml
  - jellyfin.yaml
  - pgweb.yaml
  - pixelos-applications.yaml
@@ -4,7 +4,7 @@ metadata:
  annotations:
    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
    argocd.argoproj.io/sync-wave: "3"
-  name: applications
+  name: pixelos-applications
  namespace: argocd
 spec:
  destination:
@@ -18,6 +18,12 @@ spec:
      helm:
        values: |
          appOrigin: https://redoost.whyredfire.dev
+          api:
+            image:
+              tag: latest
+          frontend:
+            image:
+              tag: latest
          sitesOrigin: https://whyredfire.dpdns.org
          httpRoute:
            annotations:
Author	SHA1	Message	Date
whyredfire	98081ed54c	feat: Add holyarrs and use LDAP for jellyfin	2026-11-10 22:27:54 +05:30
whyredfire	e22907125d	chore(add-ons): Track redoost images with latest tags	2026-11-08 17:04:28 +05:30
whyredfire	658296205f	chore(add-ons): Let Image Updater read GHCR	2026-11-05 22:44:24 +05:30
whyredfire	a2536f4a3a	chore(apps): Add the deploy key for the applications repo	2026-11-05 22:44:24 +05:30
whyredfire	ba022ddccc	chore(traefik): Serve *.pixelos.net with a wildcard certificate	2026-11-05 22:44:24 +05:30
whyredfire	ed9f485b88	chore(apps): Add PixelOS applications, rolled out by Image Updater	2026-11-05 22:44:24 +05:30