fix(paperclip): memory limit 32Gi

Headroom for many concurrent agents in the one container.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/superpowers/specs/2026-09-25-paperclip-design.md

@@ -16,7 +16,7 @@ credentials are out of scope (see "Deferred").
 |---|---|
 | Execution model | **B — server-local runs** (upstream default): agent CLIs are child processes of the server, in the server container. Trial only. |
 | Upgrade path | If Paperclip is kept: **C** — `@paperclipai/plugin-kubernetes` sandbox provider + kubernetes-sigs agent-sandbox controller (`agents.x-k8s.io`), per-run Pods and Secrets. Separate spec. |
-| Claude auth | **One shared subscription OAuth token** (`CLAUDE_CODE_OAUTH_TOKEN`, from `claude setup-token`) for all agents. |
+| Claude auth | **One shared Claude subscription AI connection**, created once via Paperclip's local sign-in (`claude auth login` into `ai-local-logins/<id>`); Paperclip stores and refreshes it. Server-env `CLAUDE_CODE_OAUTH_TOKEN` is not used: `stripAiAuthBindings` blanks it for managed runs, and upstream accepts no pasted setup-token (the device-code flow needs a Daytona sandbox). |
 | Bot credentials | Out of scope. Future "AIR-Manager" Paperclip role handles permission requests. |
 | Exposure | LAN-only, behind an Authentik forward-auth gate, then Paperclip's own login. |
 
@@ -25,8 +25,8 @@ credentials are out of scope (see "Deferred").
 Upstream `runChildProcess()` spawns every local adapter with
 `{...sanitizeInheritedPaperclipEnv(process.env), ...opts.env}`; the sanitizer strips only
 `PAPERCLIP_*` keys. Every agent therefore sees `DATABASE_URL`, `BETTER_AUTH_SECRET`,
-`CLAUDE_CODE_OAUTH_TOKEN`, the shared filesystem (including every other agent's
-workspace) and every agent-scoped secret it can read from disk. Under B, no bot may hold
+the shared filesystem (including every other agent's workspace and the
+`ai-local-logins` credentials) and every agent-scoped secret it can read from disk. Under B, no bot may hold
 a credential we would not tolerate any other bot using. Per-bot isolation is C's job.
 
 ## Architecture
@@ -79,6 +79,11 @@ All modeled on `kubernetes/apps/paperless/` unless stated.
     claim (`/bootstrap/claim`) requires an already signed-in Better Auth account.
     A follow-up flips it to `true`.
   - `PAPERCLIP_TELEMETRY_DISABLED=1` (read by `resolveTelemetryConfig`).
+  - `PAPERCLIP_API_URL=http://paperclip.paperclip.svc.cluster.local:3100` plus
+    `PAPERCLIP_ALLOWED_HOSTNAMES=paperclip.paperclip.svc.cluster.local`: upstream
+    otherwise hands agents the public URL, and the gate (`intercept_header_auth`)
+    rejects their bearer tokens. The Service name also works for sandbox pods under
+    option C; agent JWTs still authenticate each call.
   - `envFrom: secretRef paperclip-secrets`
 - Reloader: `secret.reloader.stakater.com/reload: paperclip-secrets`.
 
@@ -106,7 +111,6 @@ extract):
 - `PAPERCLIP_TOOL_ACTION_SIGNING_SECRET`
 - `PAPERCLIP_SECRETS_MASTER_KEY` (64-char hex). Held in OpenBao, not on the PVC, so
   encrypted agent secrets in Postgres survive PVC loss.
-- `CLAUDE_CODE_OAUTH_TOKEN` (shared subscription token)
 
 ### Ingress and SSO
 - Hostname `paperclip.renner.uno`, Traefik `Ingress`, `cert-manager.io/cluster-issuer:
@@ -152,10 +156,15 @@ available since v0.35.0). First use of digest reflection in this repo.
 - Nothing is granted under B that we would not tolerate any agent misusing.
 
 ## Bootstrap (one-time)
-1. Place `apps/paperclip` values in OpenBao (generated secrets + shared OAuth token).
-2. Merge; Flux deploys.
-3. Claim the admin account via the `bootstrap-ceo` invite, add yourself to
-   "Paperclip Users" in Authentik.
+1. Place `apps/paperclip` values in OpenBao (the three generated secrets).
+2. Merge; Flux deploys with sign-up enabled.
+3. Sign up through the gate and claim the instance as admin; then set
+   `PAPERCLIP_AUTH_DISABLE_SIGN_UP=true`.
+4. In onboarding "Connect a model", choose Claude subscription and run the shown login
+   **as the node user** (the entrypoint makes exec sessions root, and root-owned 0600
+   credentials are unreadable to the server):
+   `kubectl exec -it -n paperclip deploy/paperclip -- gosu node sh -c 'export CLAUDE_CONFIG_DIR=<shown path> && mkdir -p "$CLAUDE_CONFIG_DIR" && claude auth login'`
+   Repeat after loss of the PVC or database.
 
 ## Verification
 - Flux Kustomization `paperclip` Ready; CNPG `pclp-pg` healthy; first ScheduledBackup
@@ -163,7 +172,7 @@ available since v0.35.0). First use of digest reflection in this repo.
 - `curl https://paperclip.renner.uno/api/health` through the gate returns healthy after
   Authentik login; unauthenticated request redirects to `auth.renner.uno`.
 - Direct pod access from another namespace is denied (CNP).
-- A test agent (claude-local) completes a trivial task using the shared OAuth token.
+- A test agent (claude-local) completes a trivial task using the shared Claude connection.
 - Flux ImagePolicy reports a `nightly@sha256:` digest.
 
 ## Deferred

kubernetes/apps/authentik/blueprints-configmap.yaml

@@ -1171,6 +1171,85 @@ data:
             kubernetes_ingress_secret_name: "authentik-outpost-tls"
             kubernetes_json_patches: null
 
+      # lidarr-gate: Lidarr runs with AuthenticationMethod=External, so the gate
+      # is its only access control.
+      - id: music-librarians-group
+        model: authentik_core.group
+        identifiers:
+          name: Music Librarians
+        state: present
+        attrs:
+          is_superuser: false
+          # Membership is owned here; blueprint apply reverts UI edits.
+          users:
+            - !Find [authentik_core.user, [username, k.renner]]
+
+      - id: lidarr-gate-provider
+        model: authentik_providers_proxy.proxyprovider
+        identifiers:
+          name: lidarr-gate
+        state: present
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          mode: proxy
+          internal_host: http://lidarr.navidrome.svc.cluster.local
+          internal_host_ssl_validation: false
+          external_host: https://lidarr.renner.uno
+          cookie_domain: renner.uno
+          access_token_validity: hours=24
+          refresh_token_validity: days=30
+          intercept_header_auth: true
+
+      - model: authentik_core.application
+        identifiers:
+          slug: lidarr-gate
+        state: present
+        attrs:
+          name: Lidarr
+          slug: lidarr-gate
+          provider: !KeyOf lidarr-gate-provider
+          meta_launch_url: https://lidarr.renner.uno
+          meta_description: "Music library gaps: discographies, Spotify artists"
+
+      - model: authentik_policies.policybinding
+        identifiers:
+          target: !Find [authentik_core.application, [slug, lidarr-gate]]
+          group: !KeyOf music-librarians-group
+          order: 0
+        state: present
+        attrs:
+          enabled: true
+          negate: false
+          failure_result: false
+
+      - model: authentik_outposts.outpost
+        identifiers:
+          name: lidarr-gate
+        state: present
+        attrs:
+          type: proxy
+          service_connection: !KeyOf k8s-conn
+          providers:
+            - !KeyOf lidarr-gate-provider
+          config:
+            log_level: info
+            authentik_host: "http://authentik-server.authentik.svc.cluster.local"
+            authentik_host_insecure: false
+            authentik_host_browser: "https://auth.renner.uno/"
+            refresh_interval: "minutes=5"
+            container_image: null
+            object_naming_template: "ak-outpost-%(name)s"
+            kubernetes_namespace: authentik
+            kubernetes_replicas: 1
+            kubernetes_service_type: ClusterIP
+            kubernetes_disabled_components: ["ingress"]
+            kubernetes_image_pull_secrets: []
+            kubernetes_ingress_annotations: {}
+            kubernetes_ingress_class_name: null
+            kubernetes_ingress_secret_name: "authentik-outpost-tls"
+            kubernetes_json_patches: null
+
       - model: authentik_outposts.outpost
         identifiers:
           name: authentik Embedded Outpost

kubernetes/apps/authentik/kustomization.yaml

@@ -19,6 +19,7 @@ resources:
   - llama-gate-egress.yaml
   - wiki-gate-egress.yaml
   - navidrome-gate-egress.yaml
+  - lidarr-gate-egress.yaml
   - ldap-outpost-cert.yaml
   - ldap-outpost-lb.yaml
   - ldap-outpost-cnp.yaml

kubernetes/apps/authentik/lidarr-gate-egress.yaml

@@ -0,0 +1,20 @@
+# Lets the lidarr-gate outpost reach Lidarr; the matching ingress rule is in
+# network-policies/navidrome-ns.yaml.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: lidarr-gate-egress
+  namespace: authentik
+spec:
+  endpointSelector:
+    matchLabels:
+      goauthentik.io/outpost-name: lidarr-gate
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": navidrome
+            app.kubernetes.io/name: lidarr
+      toPorts:
+        - ports:
+            - port: "8686"
+              protocol: TCP

kubernetes/apps/monitoring-rules/probes-blackbox.yaml

@@ -88,6 +88,64 @@ spec:
         # /ready answers 200 unauthenticated and is in this namespace, so the
         # same intra-namespace allowance the two above rely on covers it.
         - http://loki.monitoring.svc.cluster.local:3100/ready
+        # APP-HEALTH probes for the two gated navidrome-namespace apps. Same
+        # rule as the block above (monitoring-vantage-point-rule), but these
+        # are the first targets here that leave the monitoring namespace.
+        #
+        # Both sit entirely behind an Authentik outpost — navidrome.renner.uno
+        # on ak-outpost-navidrome-gate (navidrome/ingress.yaml:21),
+        # lidarr.renner.uno on ak-outpost-lidarr-gate
+        # (navidrome/lidarr.yaml:218) — so an EXTERNAL probe of either name
+        # measures the gate, not the app, and stays green while the app behind
+        # a live gate is dead. That external signal is still wanted, and REN-2
+        # adds it from UptimeRobot; these are the other half of the pair.
+        #
+        # NO CiliumNetworkPolicy change is needed, unlike what a reading of
+        # cnp-cross-namespace-allow-apps-gatus-to-monitored-services suggests.
+        # That gotcha is about `apps`, where GATUS runs; the influxdb
+        # allow-list it describes already contained `monitoring`. The
+        # navidrome baseline CNP likewise already admits the whole monitoring
+        # namespace on every port
+        # (infrastructure/network-policies/navidrome-ns.yaml:25-27), which is
+        # where blackbox-exporter runs. Nothing in the navidrome namespace is
+        # edited by this change.
+        #
+        # /ping on both: unauthenticated, and already the pods' own kubelet
+        # probe path (navidrome/deployment.yaml:61-74,
+        # navidrome/lidarr.yaml:114-127). For lidarr that it is ungated is
+        # proven independently of the gate — lidarr.yaml:29 curls /ping in a
+        # loop BEFORE it has read the API key out of config.xml.
+        - http://navidrome.navidrome.svc.cluster.local:80/ping
+        - http://lidarr.navidrome.svc.cluster.local:80/ping
+        # APP-HEALTH probe for paperless. Same rule as the block above
+        # (monitoring-vantage-point-rule); the blind spot it closes is the one
+        # gatus already documents at apps/gatus/configmap.yaml:176-185 —
+        # through the paperless-gate outpost EVERY path, /api/ included,
+        # answers 302 to an unauthenticated caller, so no external probe of
+        # paperless.renner.uno can tell a live app from a live gate. That
+        # external signal is still wanted, and REN-2 adds it from UptimeRobot;
+        # this is the other half of the pair.
+        #
+        # That gatus comment says the in-cluster probe "needs a
+        # CiliumNetworkPolicy first". It does not, for THIS prober — the
+        # sentence was written for gatus, which runs in `apps`.
+        # paperless-ns.yaml:24-26 already admits the whole monitoring
+        # namespace, which is where blackbox-exporter runs, and Cilium unions
+        # the allow rules of every CNP selecting an endpoint (the mechanism
+        # apps/paperless/network-policy.yaml:8-12 relies on). Nothing in the
+        # paperless namespace is edited by this change.
+        #
+        # /accounts/login/ because paperless-ngx has no unauthenticated health
+        # endpoint at all. It is the app's own established "the webserver
+        # answers" signal — the same path its startup, liveness and readiness
+        # probes use (paperless.yaml:252-272) — and it renders a Django view
+        # rather than a static file. It does NOT cover the consumer/celery
+        # workers: see process-liveness-vs-protocol-liveness.
+        #
+        # The cluster-local Host header is accepted only because
+        # PAPERLESS_ALLOWED_HOSTS is "*" (paperless.yaml:27). Narrow that and
+        # Django answers 400 here and this probe goes permanently red.
+        - http://paperless.paperless.svc.cluster.local:80/accounts/login/
 # WAN-path probes of the public edge BY PROXY IP. The name-based
 # home.renner.uno probe above resolves in-cluster (CoreDNS/k8s_gateway)
 # and never leaves the LAN — the vantage-point blind spot that let the

kubernetes/apps/navidrome/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - deployment.yaml
   - gate-service.yaml
   - ingress.yaml
+  - lidarr.yaml

kubernetes/apps/navidrome/lidarr.yaml

@@ -0,0 +1,224 @@
+# Lidarr as a read-mostly "what is missing" view over the Navidrome library.
+# No download client or indexer is configured.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: lidarr-config
+  namespace: navidrome
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: ceph-block
+  resources:
+    requests:
+      storage: 5Gi
+---
+# Applied on every pod start, before the root folder exists: no renames, no tag
+# writes, no deletes. Adding /music as root folder starts Lidarr's library import.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: lidarr-reconcile
+  namespace: navidrome
+data:
+  reconcile.sh: |
+    set -eu
+    API=http://localhost:8686/api/v1
+    until curl -sf http://localhost:8686/ping >/dev/null; do sleep 5; done
+    KEY=$(sed -n 's:.*<ApiKey>\(.*\)</ApiKey>.*:\1:p' /config/config.xml)
+    if [ -z "$KEY" ]; then
+      echo "FATAL: no ApiKey in /config/config.xml" >&2
+      exit 1
+    fi
+    H="X-Api-Key: $KEY"
+
+    put() {
+      cur=$(curl -sf -H "$H" "$API/$1")
+      id=$(printf '%s' "$cur" | jq -r '.id')
+      printf '%s' "$cur" | jq -c "$2" \
+        | curl -sf -X PUT -H "$H" -H 'Content-Type: application/json' -d @- "$API/$1/$id" >/dev/null
+      echo "reconciled $1"
+    }
+
+    put config/naming '.renameTracks = false'
+    put config/metadataprovider '.writeAudioTags = "no" | .scrubAudioTags = false | .embedCoverArt = false'
+    put config/mediamanagement '.deleteEmptyFolders = false | .createEmptyArtistFolders = false
+      | .recycleBin = "" | .setPermissionsLinux = false | .importExtraFiles = false
+      | .skipFreeSpaceCheckWhenImporting = true'
+
+    roots=$(curl -sf -H "$H" "$API/rootfolder" | jq '[.[] | select(.path == "/music")] | length')
+    if [ "$roots" = "0" ]; then
+      qp=$(curl -sf -H "$H" "$API/qualityprofile" | jq '.[0].id')
+      mp=$(curl -sf -H "$H" "$API/metadataprofile" | jq '([.[] | select(.name == "Standard")][0].id) // .[0].id')
+      jq -nc --argjson qp "$qp" --argjson mp "$mp" '{
+          name: "Music", path: "/music",
+          defaultQualityProfileId: $qp, defaultMetadataProfileId: $mp,
+          defaultMonitorOption: "all", defaultNewItemMonitorOption: "all",
+          defaultTags: []
+        }' \
+        | curl -sf -X POST -H "$H" -H 'Content-Type: application/json' -d @- "$API/rootfolder" >/dev/null
+      echo "added root folder /music"
+    fi
+
+    echo "reconcile done"
+    while true; do sleep 3600; done
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lidarr
+  namespace: navidrome
+  labels:
+    app.kubernetes.io/name: lidarr
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: lidarr
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: lidarr
+    spec:
+      enableServiceLinks: false
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: lidarr
+          image: lscr.io/linuxserver/lidarr:3.1.0.4875-ls42 # {"$imagepolicy": "flux-system:lidarr"}
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: TZ
+              value: Europe/Berlin
+            # Identity is enforced by the lidarr-gate outpost.
+            - name: LIDARR__AUTH__METHOD
+              value: External
+          ports:
+            - name: http
+              containerPort: 8686
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: music
+              mountPath: /music
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            timeoutSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 5
+          resources:
+            requests:
+              cpu: 100m
+              memory: 512Mi
+            limits:
+              memory: 4Gi
+          securityContext:
+            runAsNonRoot: false
+            allowPrivilegeEscalation: true
+            capabilities:
+              drop: ["ALL"]
+              add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID"]
+        - name: reconcile
+          image: lscr.io/linuxserver/lidarr:3.1.0.4875-ls42 # {"$imagepolicy": "flux-system:lidarr"}
+          command: ["sh", "/scripts/reconcile.sh"]
+          volumeMounts:
+            - name: config
+              mountPath: /config
+              readOnly: true
+            - name: reconcile
+              mountPath: /scripts
+              readOnly: true
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              memory: 64Mi
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            runAsGroup: 1000
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: lidarr-config
+        - name: music
+          persistentVolumeClaim:
+            claimName: navidrome-music-bulk
+        - name: reconcile
+          configMap:
+            name: lidarr-reconcile
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: lidarr
+  namespace: navidrome
+spec:
+  selector:
+    app.kubernetes.io/name: lidarr
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ak-outpost-lidarr-gate
+  namespace: navidrome
+spec:
+  type: ExternalName
+  externalName: ak-outpost-lidarr-gate.authentik.svc.cluster.local
+  ports:
+    - port: 9000
+      targetPort: 9000
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: lidarr
+  namespace: navidrome
+  labels:
+    dns.renner.uno/public: "true"
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: lidarr.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ak-outpost-lidarr-gate
+                port:
+                  number: 9000
+  tls:
+    - secretName: lidarr-tls
+      hosts:
+        - lidarr.renner.uno

kubernetes/apps/paperclip/network-policy.yaml

@@ -55,6 +55,15 @@ spec:
         - ports:
             - port: "8443"
               protocol: TCP
+    # Notes wiki API, authenticated by the paperclip API key.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ai
+            app.kubernetes.io/name: wiki
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
     - toEntities:
         - kube-apiserver
       toPorts:

kubernetes/apps/paperclip/paperclip.yaml

@@ -29,7 +29,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: paperclip
-          image: ghcr.io/paperclipai/paperclip:nightly@sha256:5766cc727c7855359cf86d0d4fc422464f12ccb7b555b0432fe5918d6267a14b # {"$imagepolicy": "flux-system:paperclip"}
+          image: ghcr.io/paperclipai/paperclip:nightly@sha256:9222efbf11863160669e13d5559e6a1be881886dd1758650b74c3993dc3ef2a6 # {"$imagepolicy": "flux-system:paperclip"}
           ports:
             - name: http
               containerPort: 3100
@@ -49,9 +49,13 @@ spec:
               value: private
             - name: PAPERCLIP_PUBLIC_URL
               value: https://paperclip.renner.uno
-            # Sign-up stays open until the first admin is claimed; the gate restricts who reaches it.
+            # Agents reach the API via the Service, not through the Authentik gate.
+            - name: PAPERCLIP_API_URL
+              value: http://paperclip.paperclip.svc.cluster.local:3100
+            - name: PAPERCLIP_ALLOWED_HOSTNAMES
+              value: paperclip.paperclip.svc.cluster.local
             - name: PAPERCLIP_AUTH_DISABLE_SIGN_UP
-              value: "false"
+              value: "true"
             - name: PAPERCLIP_TELEMETRY_DISABLED
               value: "1"
           envFrom:
@@ -86,12 +90,13 @@ spec:
                   value: localhost
             periodSeconds: 10
             timeoutSeconds: 5
+          # Every concurrent agent (Claude Code + MCP helpers) runs inside this container.
           resources:
             requests:
               cpu: 250m
-              memory: 1Gi
+              memory: 2Gi
             limits:
-              memory: 4Gi
+              memory: 32Gi
           # Entrypoint remaps the node user and chowns /paperclip as root, then drops to it via gosu.
           securityContext:
             runAsNonRoot: false

kubernetes/apps/wiki/externalsecrets.yaml

@@ -42,6 +42,10 @@ spec:
       remoteRef:
         key: apps/ai/wiki-api-keys
         property: workstation
+    - secretKey: Auth__ApiKeys__paperclip
+      remoteRef:
+        key: apps/ai/wiki-api-keys
+        property: paperclip
 ---
 # TypeSafe System One key for the judge adapter (Wiki:Judges:Models:typesafe).
 apiVersion: external-secrets.io/v1

kubernetes/infrastructure/image-automation/kustomization.yaml

@@ -9,6 +9,7 @@ resources:
   - gotenberg.yaml
   - home-assistant.yaml
   - immich.yaml
+  - lidarr.yaml
   - matter-server.yaml
   - mmwave-configurator.yaml
   - music-assistant.yaml

kubernetes/infrastructure/image-automation/lidarr.yaml

@@ -0,0 +1,24 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: lidarr
+  namespace: flux-system
+spec:
+  image: lscr.io/linuxserver/lidarr
+  interval: 1h
+---
+# Tags are <major>.<minor>.<patch>.<build>-ls<n>; the build number is monotonic.
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: lidarr
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: lidarr
+  filterTags:
+    pattern: '^\d+\.\d+\.\d+\.(?P<build>\d+)-ls\d+$'
+    extract: '$build'
+  policy:
+    numerical:
+      order: asc

kubernetes/infrastructure/network-policies/ai-ns.yaml

@@ -150,8 +150,8 @@ spec:
               protocol: TCP
 ---
 # wiki: the wiki-gate outpost (humans, after Authentik), Traefik (the machine
-# door wiki-index.renner.uno, BasicAuth with X-Authentik-Username stripped) and
-# Gitea (push webhook) may reach it. Gitea and wiki-embed are reached through
+# door wiki-index.renner.uno, BasicAuth with X-Authentik-Username stripped),
+# Gitea (push webhook) and Paperclip agents (API key) may reach it. Gitea and wiki-embed are reached through
 # the namespace egress above; no OpenBao access.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
@@ -173,6 +173,9 @@ spec:
         - matchLabels:
             "k8s:io.kubernetes.pod.namespace": gitea
             app.kubernetes.io/name: gitea
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": paperclip
+            app.kubernetes.io/name: paperclip
       toPorts:
         - ports:
             - port: "8080"

kubernetes/infrastructure/network-policies/navidrome-ns.yaml

@@ -18,6 +18,10 @@ spec:
         - matchLabels:
             "k8s:io.kubernetes.pod.namespace": authentik
             goauthentik.io/outpost-name: navidrome-gate
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": authentik
+            goauthentik.io/outpost-name: lidarr-gate
     - fromEndpoints:
         - matchLabels:
             "k8s:io.kubernetes.pod.namespace": monitoring