claude-botandClaude Opus 5.5
01213d6ee0
paperless, shelly-manager, zone-configurator, esphome, zigbee2mqtt, alertmanager, prometheus, wiki, paperclip, navidrome, lidarr and wordpress now gate through authentik-gate-sync: each source Ingress names its real backend and carries the old provider's settings as annotations (group, login-flow, authorization-flow where it was implicit consent, paperless' skip-path). Removed per gate: the ExternalName Service, the egress CNP in authentik, the namespace CNP rule admitting the old outpost, and the blueprint provider/application/binding/outpost (state: absent, outpost -> application -> provider). Groups stay declared without users lists; membership is managed in Authentik. Per-gate specifics: - paperless: the docs.renner.uno alias backends the generated paperless-gate Service (its middleware redirects before the backend); the auth.renner.uno/outpost.goauthentik.io route is removed, proxy outposts take their callback on the app host. - alertmanager / prometheus: source Ingresses renamed to alertmanager / prometheus; the controller generates the *-gate route Ingresses. - wordpress-admin: gains a tls block for www.renner.uno (wordpress-tls, certificate still owned by the public Ingress), so the gate's external host stays https. - wiki, paperclip: only the gate peer/rule leaves their shared CNPs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
129 lines
4.0 KiB
YAML
129 lines
4.0 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: navidrome-config
|
|
namespace: navidrome
|
|
data:
|
|
TZ: "Europe/Berlin"
|
|
ND_LOGLEVEL: "info"
|
|
ND_SCANNER_SCHEDULE: "0 * * * *"
|
|
ND_ENABLEINSIGHTSCOLLECTOR: "false"
|
|
# Identity from the gate outpost (ingress class authentik-gate). Traefik strips this header on
|
|
# the ungated /rest and /share routes.
|
|
#
|
|
# ND_EXTAUTH_TRUSTEDSOURCES BELOW IS NOT A NARROWING. fd10:244::/48 plus
|
|
# 10.244.0.0/16 is the entire cluster pod CIDR, so navidrome's own
|
|
# reverse-proxy trust check accepts X-Authentik-Username from ANY pod.
|
|
# The CiliumNetworkPolicy is the only real boundary, and it is wider than
|
|
# "the outpost and Traefik" — default-deny-ingress in
|
|
# kubernetes/infrastructure/network-policies/navidrome-ns.yaml uses
|
|
# `endpointSelector: {}` and admits, on every port:
|
|
# - the navidrome namespace, every port
|
|
# - traefik, every port
|
|
# - host / remote-node, every port - the kubelet sources the HTTP probes
|
|
# from the host netns, so this one can never be removed while the pod
|
|
# has HTTP probes
|
|
# - blackbox-exporter on :4533 and :8686 only
|
|
# The whole-monitoring-namespace admit that used to be in this list was
|
|
# narrowed to blackbox-exporter on those two ports in REN-28. Rules are
|
|
# cited by what they admit, not by line number, so this list cannot go
|
|
# stale the next time that file is edited.
|
|
# The value stays at the pod CIDR ON PURPOSE - see REN-28. The address
|
|
# navidrome sees is the outpost's POD IP, which is not stable across
|
|
# reschedules, so a narrower literal here fails open-ended and silently
|
|
# the next time that pod moves. Tightening the CNP is the control that
|
|
# would actually do work.
|
|
ND_EXTAUTH_USERHEADER: "X-Authentik-Username"
|
|
ND_EXTAUTH_TRUSTEDSOURCES: "fd10:244::/48,10.244.0.0/16"
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: navidrome
|
|
namespace: navidrome
|
|
labels:
|
|
app.kubernetes.io/name: navidrome
|
|
annotations:
|
|
configmap.reloader.stakater.com/reload: navidrome-config
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: navidrome
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: navidrome
|
|
spec:
|
|
enableServiceLinks: false
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: navidrome
|
|
image: deluan/navidrome:0.64.2 # {"$imagepolicy": "flux-system:navidrome"}
|
|
ports:
|
|
- name: http
|
|
containerPort: 4533
|
|
envFrom:
|
|
- configMapRef:
|
|
name: navidrome-config
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /data
|
|
- name: music
|
|
mountPath: /music
|
|
readOnly: true
|
|
# anchor: kubelet-probes
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /ping
|
|
port: http
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
timeoutSeconds: 10
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /ping
|
|
port: http
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 1Gi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: navidrome-data
|
|
- name: music
|
|
persistentVolumeClaim:
|
|
claimName: navidrome-music-bulk
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: navidrome
|
|
namespace: navidrome
|
|
spec:
|
|
selector:
|
|
app.kubernetes.io/name: navidrome
|
|
ports:
|
|
- name: http
|
|
port: 80
|
|
targetPort: http
|