refactor(apps): split monolithic apps Kustomization into dependency waves

Replaces the single `apps` Flux Kustomization with dependency-ordered waves (apps-wave-0..2) so a crashlooping workload isolates to its wave + downstream instead of stalling the entire app tier. Parallel within a wave, ordered across. - catalog/render.py: compute waves by longest dependency-path depth over the ServiceDefinition `dependencies:` edges (a `<svc>-db` is a leaf, so its consumer lands strictly higher — the "DB below consumer" rule falls out of longest-path, no special case). `--emit-waves` generates the per-wave kustomizations + Flux CRs; `--wave-layout` places renders into the right dir. wave 0: pihole gitea jackett plex qbittorrent nextcloud-db semaphore-db wave 1: sonarr radarr nextcloud semaphore gitea-actions wave 2: seerr - apps/*.yaml -> apps/wave-{0,1,2}/ (byte-identical moves; SOPS files intact). - clusters/base: apps.yaml removed; apps-wave-{0,1,2}.yaml added (dependsOn chain: platform-config -> wave-0 -> wave-1 -> wave-2, prune+wait each). - clusters/dev: one SOPS decryption patch per wave (load-bearing). - DESIGN-waves.md: wave table, topology, cutover runbook. Cutover: preceded by disabling prune on `apps` (1bfb0db) so removing that object here does not GC its resources; the wave Kustomizations SSA-adopt the byte-identical manifests in place (no restart, no PVC churn). Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-26 12:19:00 -05:00
1 parent 1bfb0db6f1
commit 36a1a4e1f9
@@ -0,0 +1,37 @@
+# Gitea Actions runner registration token (WS-GITOSS, Phase 6). SOPS-encrypted (age).
+# The in-cluster act_runner (ns gitea-actions) uses this INSTANCE-level registration
+# token (from POST /api/v1/admin/actions/runners/registration-token) to register once
+# against Gitea. Flux decrypts it via the sops-age key at reconcile (apps Kustomization
+# decryption is wired in clusters/dev/kustomization.yaml). Rotate by resetting the token
+# in Gitea (admin -> actions -> runners) and re-encrypting a fresh value here.
+# Recover/inspect: infra/devcontainer/dev.sh run sops -d apps/gitea-actions-runner-secret.sops.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+    name: gitea-actions-runner
+    namespace: gitea-actions
+    labels:
+        app.kubernetes.io/name: act-runner
+type: Opaque
+stringData:
+    token: ENC[AES256_GCM,data:W48mEtBqGeukX13lMhrhrer+zB21cLVp0acy3m1Xy/oo89DqO8FX/Q==,iv:wfTUU7RiFLdEc1fmEFS9DfE2SmGCFLPK17m0IKspft0=,tag:UhoXA47p7386KHcYNbPzCg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMYjhDVis5UzBvMWdjQUtk
+            T28wRTFZdjB6NFZOYmxQTGpOcksrb2pyK1RNCjZVdnFHU0IvOEcvcmRjZ05SQWI0
+            OTdEekJDYlc3cUxNU29OZU9YWlM5b00KLS0tIEtNeHlrV3NXUnhyNnJncW5vZmta
+            MDZLUE52QzJXbFlrNWxOcVhJbDNnY00KxCpFkbhhCuk4Fa8CC3C4+R9AcsUnaXQR
+            UjAfwKFoXAneXUih7TTXMbR/6+VgQBww5Bmwpn7jVLnzP0N0pIZVTA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T04:48:14Z"
+    mac: ENC[AES256_GCM,data:b99/zkL332RIT3FYBa1sR3o9+pwlmrUgKvVHawbjWYSJZ7ERUfO+LXuhKJ0HKrp6i1JfkurZlRO27iBcfrBisAXS9KLaqmsCJf4kKfFc4skANrmKCzprrXUmZexr1uiE8eDUzjNCLNxSCZfnFR6d/AkMXJqi6Hsj9/O+wH2lWsc=,iv:3DIPszSdxK81ERO3o/nTs33qQYHaAKLNcGP4qlZViFc=,tag:/B6VKkzMUwh0byNUicS5wQ==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.4
@@ -0,0 +1,185 @@
+---
+# Gitea Actions runner (act_runner) — Phase 6 CI/CD (WS-GITOSS).
+#
+# WHY A DEDICATED, NON-APP NAMESPACE:
+#   The runner's job executor is a Docker-in-Docker (DinD) sidecar that MUST run
+#   `privileged: true` (dockerd needs it). The Kyverno `restrict-host-namespaces`
+#   policy denies privileged containers, but it (and the egress-class / auth-mode /
+#   default-deny-baseline policies) scope ONLY to namespaces labeled
+#   homelab.keithjackson.dev/app-namespace: "true". This namespace deliberately does
+#   NOT carry that label — it is CI plumbing, not a user-facing app — so the privileged
+#   DinD sidecar is admitted WITHOUT a policy exception. (Verified: a privileged Pod in
+#   a non-app namespace passes server-side admission; Kyverno test fixture
+#   `platform-workload` is likewise Excluded from restrict-host-namespaces.)
+#
+# EXECUTOR MODEL — Docker executor + DinD sidecar (privileged):
+#   act_runner runs each job step inside a container it launches via a Docker daemon.
+#   That daemon is the co-located `dind` sidecar (shared pod netns → tcp://localhost:2376,
+#   TLS via a shared emptyDir of certs). Tradeoff vs the host/self-hosted executor: DinD
+#   needs `privileged`, but it gives clean per-job isolation and lets the workflow pick its
+#   own job image (the pinned toolchain), which the host executor cannot. Privileged is
+#   contained to this CI-only namespace and the runner mounts NO ServiceAccount token
+#   (automountServiceAccountToken: false) — CI holds no cluster credentials (R-SEC-02).
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea-actions
+  labels:
+    # NOTE: intentionally NO homelab.keithjackson.dev/app-namespace label (see header).
+    homelab.keithjackson.dev/ci: act-runner
+---
+# Default-deny ingress; broad egress (a CI runner legitimately needs the internet:
+# ghcr.io / github.com / docker hub / dl.k8s.io / pypi for job images + pinned tools,
+# and the Gitea ingress VIP for registration + repo clone). Nothing connects INTO the
+# runner, so ingress is denied entirely.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-ingress-allow-egress
+  namespace: gitea-actions
+  labels:
+    homelab.keithjackson.dev/baseline: default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress:
+    # DNS (cluster + split-horizon resolution of gitea.home.keithjackson.dev).
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    # Everything else the runner + DinD need: Gitea VIP + internet registries/tool hosts.
+    - {}
+---
+# Runner state (config.yaml + the `.runner` registration file) persists here so the
+# runner registers exactly ONCE and reuses its identity across restarts (no duplicate
+# offline rows in Gitea). RWO → Deployment strategy must be Recreate (fix/recreate-strategy-rwo).
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: act-runner-data
+  namespace: gitea-actions
+  labels:
+    app.kubernetes.io/name: act-runner
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: act-runner
+  namespace: gitea-actions
+  labels:
+    app.kubernetes.io/name: act-runner
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: act-runner
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: act-runner
+    spec:
+      # CI holds no cluster credentials — do not mount a SA token into the runner or
+      # (via the shared netns) the job containers (R-SEC-02, docs/14).
+      automountServiceAccountToken: false
+      containers:
+        # ---- act_runner: registers with Gitea, dispatches jobs to the DinD daemon ----
+        - name: runner
+          image: gitea/act_runner:0.2.11
+          # Wait for the DinD sidecar to publish its TLS client certs into the shared
+          # emptyDir before starting the daemon — act_runner reads /certs/client/ca.pem at
+          # startup and hard-exits if it is missing (a startup race against the sidecar).
+          # Then exec the image's normal entrypoint (/sbin/tini -- /opt/act/run.sh), which
+          # registers-from-env on first boot and runs `act_runner daemon`.
+          command:
+            - /bin/sh
+            - -c
+            - |
+              i=0
+              until [ -f /certs/client/ca.pem ]; do
+                i=$((i + 1))
+                [ "$i" -ge 60 ] && { echo "dind certs never appeared" >&2; exit 1; }
+                echo "waiting for dind TLS certs ($i)"; sleep 1
+              done
+              exec /sbin/tini -- /opt/act/run.sh
+          env:
+            - name: GITEA_INSTANCE_URL
+              value: https://gitea.home.keithjackson.dev
+            - name: GITEA_RUNNER_REGISTRATION_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-actions-runner
+                  key: token
+            - name: GITEA_RUNNER_NAME
+              value: incluster-dind
+            # runs-on label -> job image. Both map to the catthehacker "act" image, which
+            # carries bash/git/curl/tar/python3+pip/node so .gitea/workflows scripts can
+            # install the pinned CI toolchain (ci/versions.env) and actions/checkout runs.
+            - name: GITEA_RUNNER_LABELS
+              value: "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-22.04,homelab:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
+            # Reach the DinD daemon over the shared pod network namespace, TLS-verified
+            # against the certs the sidecar drops into the shared /certs emptyDir.
+            - name: DOCKER_HOST
+              value: tcp://localhost:2376
+            - name: DOCKER_CERT_PATH
+              value: /certs/client
+            - name: DOCKER_TLS_VERIFY
+              value: "1"
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: certs
+              mountPath: /certs
+              readOnly: true
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              memory: 512Mi
+        # ---- Docker-in-Docker: the job executor daemon (privileged) ----
+        - name: dind
+          image: docker:27-dind
+          securityContext:
+            privileged: true
+          env:
+            # Generate + publish TLS certs into the shared emptyDir; dockerd then listens
+            # on tcp://0.0.0.0:2376 (TLS) which the runner reaches at localhost:2376.
+            - name: DOCKER_TLS_CERTDIR
+              value: /certs
+          volumeMounts:
+            - name: certs
+              mountPath: /certs
+            - name: dind-storage
+              mountPath: /var/lib/docker
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              memory: 2Gi
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: act-runner-data
+        - name: certs
+          emptyDir: {}
+        - name: dind-storage
+          emptyDir: {}
@@ -0,0 +1,16 @@
+---
+# Wave 1 of the app tier — GENERATED by `catalog/render.py --emit-waves`.
+# Reconciled by the Flux Kustomization `apps-wave-1` (clusters/base/apps-wave-1.yaml), which dependsOn `apps-wave-0` and health-gates
+# (wait:true) ONLY this wave — a crashloop here cannot stall an earlier wave.
+# DO NOT hand-edit: re-run `render.py --emit-waves` after onboarding a service.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- gitea-actions-runner-secret.sops.yaml
+- gitea-actions.yaml
+- nextcloud-bootstrap-secret.sops.yaml
+- nextcloud.yaml
+- radarr.yaml
+- semaphore-bootstrap-secret.sops.yaml
+- semaphore.yaml
+- sonarr.yaml
@@ -0,0 +1,36 @@
+# Nextcloud break-glass admin + DB password (WS-APPS, Phase 6). SOPS-encrypted (age).
+# admin-*: break-glass local admin (docs/15 availability caveat), created on first-boot install.
+# db-password: MIRRORS nextcloud-db-app/password (ns nextcloud-db) so the app can read the DB
+# credential from its own namespace. Recover: infra/devcontainer/dev.sh run sops -d apps/nextcloud-bootstrap-secret.sops.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+    name: nextcloud-bootstrap
+    namespace: nextcloud
+    labels:
+        app.kubernetes.io/name: nextcloud
+type: Opaque
+stringData:
+    admin-username: ENC[AES256_GCM,data:GVvF2Q6ymg==,iv:z0aNezBuAit4nZU0o8C5vd0V0eqFV27Ly6BX6EHA/QQ=,tag:mX17Bc5uC/HMH1d4uA3WGw==,type:str]
+    admin-password: ENC[AES256_GCM,data:kdP3lOEMKTOrefDNYY0m9b2JsVEWF0cwYHhpizFRvN0tA8nYv0blgvYmS16KvuUI,iv:9bbntbUewcayR3RgdeieThaFxt0UwFYHIqQoD1VSHHo=,tag:E1DHYb5TuNLl/WVFRuDCtw==,type:str]
+    db-password: ENC[AES256_GCM,data:Xh62RMSTEv9uS4UYhL63qclbRWFhHtUZn9/YCEbBHwkYtImYNSgKltt9d5ntUeKk,iv:ITCJE3J1eSdIzBEnWh3q2BGW3O82fqqRZ+GnWodFh78=,tag:f9MsOPPTec3dGCXweFUetQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3bVlRZXNLZmZROHQ2czM0
+            OTdXQzczTmcvYWlMdDJDQkttMnJwZ21Ka2djCjZpMTN5WUxCcDhOT0Z2bnk3eXU0
+            aHg3N3Vvdk9Yc2xSNXJFamZLMnVsYkEKLS0tIEJGK2xyd2lKVjdXOERCMURIR2ZV
+            SDdoWXhVRi9DR0RzL0dlM0dtcTlFQlEKNVBukqVCZ7ZjREYAl2xK/YxuJVKEgESh
+            ToKuzCgydEaxW3NoKWMvZxJUM5vnGI1rPxSZdGgXDjcpI4Q4iTYmZA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T06:30:08Z"
+    mac: ENC[AES256_GCM,data:INbmOvfiZFll97zz3Dfq4xFpbBWpNUoW4LOERUSQ2jBy2UBGO8wSNf0r8F328mlO1GqFXFs0a0LD11pDgC2wAhF/bQWYsPFAYNEQFgU3FpxCNnLNPUN9nS58CE9C1sMIs5WaAaOzFBudRXEYulQNRKuLPGOF7UKytxkzmgIggT4=,iv:JuzQ7scb+CQg0kOtwzTqNe0D8V90sQSpiNA/2lMsJr8=,tag:1ICb7zPIqvonmEgEfYdGqA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.4
@@ -0,0 +1,264 @@
+---
+# Namespace (trust zone; default-deny + policies apply)
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nextcloud
+  labels:
+    homelab.keithjackson.dev/app-namespace: 'true'
+    gateway-access: shared
+  annotations:
+    homelab.keithjackson.dev/backup-policy: daily-offcluster
+---
+# Default-deny baseline (R-NET-01): deny all, allow only DNS
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: nextcloud
+  labels:
+    homelab.keithjackson.dev/baseline: default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress: []
+  egress:
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - protocol: UDP
+      port: 53
+    - protocol: TCP
+      port: 53
+---
+# PVC nextcloud-data (R-STATE)
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-data
+  namespace: nextcloud
+  labels:
+    app.kubernetes.io/name: nextcloud
+spec:
+  accessModes:
+  - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 20Gi
+---
+# Deployment (R-PLAT-02)
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nextcloud
+  namespace: nextcloud
+  labels:
+    app.kubernetes.io/name: nextcloud
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: nextcloud
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: nextcloud
+        homelab.keithjackson.dev/egress-class: internet
+        homelab.keithjackson.dev/auth-mode: oidc
+      annotations:
+        homelab.keithjackson.dev/auth-mode: oidc
+        homelab.keithjackson.dev/auth-groups: platform-admins
+    spec:
+      containers:
+      - name: nextcloud
+        image: nextcloud:31-apache
+        ports:
+        - containerPort: 80
+        env:
+        - name: POSTGRES_HOST
+          value: nextcloud-db-rw.nextcloud-db.svc.cluster.local
+        - name: POSTGRES_DB
+          value: nextcloud
+        - name: POSTGRES_USER
+          value: nextcloud
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: nextcloud-bootstrap
+              key: db-password
+        - name: NEXTCLOUD_ADMIN_USER
+          valueFrom:
+            secretKeyRef:
+              name: nextcloud-bootstrap
+              key: admin-username
+        - name: NEXTCLOUD_ADMIN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: nextcloud-bootstrap
+              key: admin-password
+        - name: NEXTCLOUD_TRUSTED_DOMAINS
+          value: nextcloud.home.keithjackson.dev
+        - name: OVERWRITEHOST
+          value: nextcloud.home.keithjackson.dev
+        - name: OVERWRITEPROTOCOL
+          value: https
+        - name: OVERWRITECLIURL
+          value: https://nextcloud.home.keithjackson.dev
+        volumeMounts:
+        - name: data
+          mountPath: /var/www/html
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: nextcloud-data
+---
+# Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud
+  namespace: nextcloud
+  labels:
+    app.kubernetes.io/name: nextcloud
+spec:
+  selector:
+    app.kubernetes.io/name: nextcloud
+  ports:
+  - name: port-80
+    port: 80
+    targetPort: 80
+---
+# CiliumNetworkPolicy egress allow (R-NET-02): nextcloud-allow-nextcloud-db-5432
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: nextcloud-allow-nextcloud-db-5432
+  namespace: nextcloud
+  labels:
+    app.kubernetes.io/name: nextcloud
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: nextcloud
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        app.kubernetes.io/name: nextcloud-db
+        k8s:io.kubernetes.pod.namespace: nextcloud-db
+    toPorts:
+    - ports:
+      - port: '5432'
+        protocol: TCP
+---
+# CiliumNetworkPolicy gateway-ingress allow (R-NET-01/02): nextcloud-allow-gateway-ingress
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: nextcloud-allow-gateway-ingress
+  namespace: nextcloud
+  labels:
+    app.kubernetes.io/name: nextcloud
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: nextcloud
+  ingress:
+  - fromEntities:
+    - ingress
+    toPorts:
+    - ports:
+      - port: '80'
+        protocol: TCP
+---
+# CiliumNetworkPolicy world egress allow (egress class governs the path; R-NET-05): nextcloud-allow-internet-egress
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: nextcloud-allow-internet-egress
+  namespace: nextcloud
+  labels:
+    app.kubernetes.io/name: nextcloud
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: nextcloud
+  egress:
+  - toEntities:
+    - world
+---
+# HTTPRoute nextcloud-80 (R-TLS/R-DNS)
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: nextcloud-80
+  namespace: nextcloud
+  labels:
+    app.kubernetes.io/name: nextcloud
+  annotations:
+    homelab.keithjackson.dev/auth-mode: oidc
+    homelab.keithjackson.dev/auth-groups: platform-admins
+spec:
+  parentRefs:
+  - name: shared
+    namespace: gateway
+    sectionName: https
+  hostnames:
+  - nextcloud.home.keithjackson.dev
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - name: nextcloud
+      port: 80
+---
+# ServiceMonitor (R-OBS-01)
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: nextcloud
+  namespace: nextcloud
+  labels:
+    release: kube-prometheus-stack
+    app.kubernetes.io/name: nextcloud
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: nextcloud
+  namespaceSelector:
+    matchNames:
+    - nextcloud
+  endpoints:
+  - port: metrics
+    interval: 30s
+---
+# PrometheusRule SLI alerts (R-OBS-01)
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: nextcloud-slis
+  namespace: nextcloud
+  labels:
+    release: kube-prometheus-stack
+    app.kubernetes.io/name: nextcloud
+spec:
+  groups:
+  - name: nextcloud.slis
+    rules:
+    - alert: nextcloud-down
+      expr: up{job="nextcloud"} == 0
+      for: 5m
+      labels:
+        severity: critical
+        service: nextcloud
+      annotations:
+        summary: nextcloud is down
+        description: 'nextcloud has been unreachable for 5m (SLI: up).'
@@ -0,0 +1,278 @@
+---
+# Namespace (trust zone; default-deny + policies apply)
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: radarr
+  labels:
+    homelab.keithjackson.dev/app-namespace: 'true'
+    gateway-access: shared
+  annotations:
+    homelab.keithjackson.dev/backup-policy: daily-offcluster
+---
+# Default-deny baseline (R-NET-01): deny all, allow only DNS
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: radarr
+  labels:
+    homelab.keithjackson.dev/baseline: default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress: []
+  egress:
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - protocol: UDP
+      port: 53
+    - protocol: TCP
+      port: 53
+---
+# PVC radarr-config (R-STATE)
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: radarr-config
+  namespace: radarr
+  labels:
+    app.kubernetes.io/name: radarr
+spec:
+  accessModes:
+  - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 5Gi
+---
+# Deployment (R-PLAT-02)
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: radarr
+  namespace: radarr
+  labels:
+    app.kubernetes.io/name: radarr
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: radarr
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: radarr
+        homelab.keithjackson.dev/egress-class: vpn
+        homelab.keithjackson.dev/auth-mode: forward-auth
+      annotations:
+        homelab.keithjackson.dev/auth-mode: forward-auth
+        homelab.keithjackson.dev/auth-groups: media-users
+    spec:
+      containers:
+      - name: radarr
+        image: lscr.io/linuxserver/radarr:5.21.1
+        ports:
+        - containerPort: 7878
+        volumeMounts:
+        - name: config
+          mountPath: /data/config
+      volumes:
+      - name: config
+        persistentVolumeClaim:
+          claimName: radarr-config
+---
+# Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: radarr
+  namespace: radarr
+  labels:
+    app.kubernetes.io/name: radarr
+spec:
+  selector:
+    app.kubernetes.io/name: radarr
+  ports:
+  - name: port-7878
+    port: 7878
+    targetPort: 7878
+---
+# CiliumNetworkPolicy egress allow (R-NET-02): radarr-allow-qbittorrent-8080
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: radarr-allow-qbittorrent-8080
+  namespace: radarr
+  labels:
+    app.kubernetes.io/name: radarr
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: radarr
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        app.kubernetes.io/name: qbittorrent
+        k8s:io.kubernetes.pod.namespace: qbittorrent
+    toPorts:
+    - ports:
+      - port: '8080'
+        protocol: TCP
+---
+# CiliumNetworkPolicy egress allow (R-NET-02): radarr-allow-jackett-9117
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: radarr-allow-jackett-9117
+  namespace: radarr
+  labels:
+    app.kubernetes.io/name: radarr
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: radarr
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        app.kubernetes.io/name: jackett
+        k8s:io.kubernetes.pod.namespace: jackett
+    toPorts:
+    - ports:
+      - port: '9117'
+        protocol: TCP
+---
+# CiliumNetworkPolicy reciprocal ingress allow (R-NET-02): radarr-allow-seerr-7878
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: radarr-allow-seerr-7878
+  namespace: radarr
+  labels:
+    app.kubernetes.io/name: radarr
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: radarr
+  ingress:
+  - fromEndpoints:
+    - matchLabels:
+        app.kubernetes.io/name: seerr
+        k8s:io.kubernetes.pod.namespace: seerr
+    toPorts:
+    - ports:
+      - port: '7878'
+        protocol: TCP
+---
+# CiliumNetworkPolicy gateway-ingress allow (R-NET-01/02): radarr-allow-gateway-ingress
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: radarr-allow-gateway-ingress
+  namespace: radarr
+  labels:
+    app.kubernetes.io/name: radarr
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: radarr
+  ingress:
+  - fromEntities:
+    - ingress
+    toPorts:
+    - ports:
+      - port: '7878'
+        protocol: TCP
+---
+# CiliumNetworkPolicy world egress allow (egress class governs the path; R-NET-05): radarr-allow-internet-egress
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: radarr-allow-internet-egress
+  namespace: radarr
+  labels:
+    app.kubernetes.io/name: radarr
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: radarr
+  egress:
+  - toEntities:
+    - world
+---
+# HTTPRoute radarr-7878 (R-TLS/R-DNS)
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: radarr-7878
+  namespace: radarr
+  labels:
+    app.kubernetes.io/name: radarr
+  annotations:
+    homelab.keithjackson.dev/auth-mode: forward-auth
+    homelab.keithjackson.dev/auth-groups: media-users
+spec:
+  parentRefs:
+  - name: shared
+    namespace: gateway
+    sectionName: https
+  hostnames:
+  - radarr.home.keithjackson.dev
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - name: radarr
+      port: 7878
+---
+# ServiceMonitor (R-OBS-01)
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: radarr
+  namespace: radarr
+  labels:
+    release: kube-prometheus-stack
+    app.kubernetes.io/name: radarr
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: radarr
+  namespaceSelector:
+    matchNames:
+    - radarr
+  endpoints:
+  - port: metrics
+    interval: 30s
+---
+# PrometheusRule SLI alerts (R-OBS-01)
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: radarr-slis
+  namespace: radarr
+  labels:
+    release: kube-prometheus-stack
+    app.kubernetes.io/name: radarr
+spec:
+  groups:
+  - name: radarr.slis
+    rules:
+    - alert: radarr-down
+      expr: up{job="radarr"} == 0
+      for: 5m
+      labels:
+        severity: critical
+        service: radarr
+      annotations:
+        summary: radarr is down
+        description: 'radarr has been unreachable for 5m (SLI: up).'
@@ -0,0 +1,41 @@
+# Semaphore break-glass admin + DB password + access-key encryption key (WS-APPS, Phase 6).
+# SOPS-encrypted (age).
+# admin-*: break-glass local admin (docs/15 availability caveat), created on first-boot.
+# db-password: MIRRORS semaphore-db-app/password (ns semaphore-db) so the app can read the DB
+#   credential from its own namespace (a Pod cannot read a Secret in another namespace).
+# access-key-encryption: FIXED base64 32-byte AES key Semaphore uses to encrypt stored SSH keys /
+#   credentials; MUST stay stable across restarts or stored secrets become undecryptable.
+# Recover: infra/devcontainer/dev.sh run sops -d apps/semaphore-bootstrap-secret.sops.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+    name: semaphore-bootstrap
+    namespace: semaphore
+    labels:
+        app.kubernetes.io/name: semaphore
+type: Opaque
+stringData:
+    admin-username: ENC[AES256_GCM,data:uD/vO9A9MjerFg==,iv:i/NAqVD6rWg9oWWSGBrRkxzwcPp2IW1HLIKY0pdcPPg=,tag:r27tKLAJ+ydE7Ty3ccMNUw==,type:str]
+    admin-password: ENC[AES256_GCM,data:544nWY1UmBnlsdPJAQZJMXRumu4W9X7UXZvZ6vHN/ArjRgLXKTArOe5JkT/nNrNw,iv:AC1DDbZj2HfpU19EjzA7T+WpIaR4nZc3PNN61y8bAzU=,tag:r28LFi5w6ZeCCaRaX2jRdg==,type:str]
+    db-password: ENC[AES256_GCM,data:ySkdvaGRCW9fMQqChs5l8dY4zCG19i4HOEinRC48mgLuh9WOrjd16T6jwFgiwB55,iv:+1gztJ22HbwgQJiolZMMWOcKIsxrBJpnruJdtxdooOU=,tag:8CfJGwyPTjDGyr0CvalXMQ==,type:str]
+    access-key-encryption: ENC[AES256_GCM,data:1YAMLo1nVkpJWZc+KBZ7B4ia+Y8P+xMyOhHMcEGGJOXd3o+WC5FqirLBVh4=,iv:j28ozeaDhGWDjoaxFOhn2t9YbYE7L3ah/Mfi+i2DWwY=,tag:czG9Wxc/7Nsuh1W5iATOww==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuRDlqRFJ0dk14UHluSGRP
+            S1pESy9PWlpMakU0aTkzNVhqUGdtbWNEdTJjCm5RNG14azJHc28rdEJ4L0RzR0xO
+            MGRocGZ1V1JZTENWQkN3VGZzamp2eTgKLS0tIGt6QkNNaW5hdTBJVHY0SVo5d3JX
+            elp0SWxHcjg0RWF3aW9mWTJHZ0lhcUEKc0rU5VilAVDleCwqq4SOF+Y9sniu1Pka
+            w/MGDA9THSB0b+YgWRWiX/KiimFqp0ZFODOJ9cHVwFGY71+VadPwOg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T06:45:19Z"
+    mac: ENC[AES256_GCM,data:5XhhTZ9BGQTIdHPNrFUxwgPRm0hOqyzdsjc2ACVSJofBho+3j7XiExGTXTyblSmT5Kv+BEym0rgOjxgKKF59CAnjEMhIoZ/3mYWegQGF8HZhVqDdPgjHmxFF93D6tLK5mQGimXILmDAYcAMRAvQoJGF16BDo4v5YeVZ1bAJZ4Ug=,iv:33cmv3YaskhbUQ+K+dcJQI9LYHKZDCtDjd2NgR5yvts=,tag:CRh/ZsPggCmqyePQe5Q0gw==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.4
@@ -0,0 +1,276 @@
+---
+# Namespace (trust zone; default-deny + policies apply)
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: semaphore
+  labels:
+    homelab.keithjackson.dev/app-namespace: 'true'
+    gateway-access: shared
+  annotations:
+    homelab.keithjackson.dev/backup-policy: daily-offcluster
+---
+# Default-deny baseline (R-NET-01): deny all, allow only DNS
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: semaphore
+  labels:
+    homelab.keithjackson.dev/baseline: default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress: []
+  egress:
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - protocol: UDP
+      port: 53
+    - protocol: TCP
+      port: 53
+---
+# PVC semaphore-config (R-STATE)
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: semaphore-config
+  namespace: semaphore
+  labels:
+    app.kubernetes.io/name: semaphore
+spec:
+  accessModes:
+  - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 1Gi
+---
+# Deployment (R-PLAT-02)
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: semaphore
+  namespace: semaphore
+  labels:
+    app.kubernetes.io/name: semaphore
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: semaphore
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: semaphore
+        homelab.keithjackson.dev/egress-class: internet
+        homelab.keithjackson.dev/auth-mode: oidc
+      annotations:
+        homelab.keithjackson.dev/auth-mode: oidc
+        homelab.keithjackson.dev/auth-groups: platform-admins
+    spec:
+      containers:
+      - name: semaphore
+        image: semaphoreui/semaphore:v2.19.10
+        ports:
+        - containerPort: 3000
+        env:
+        - name: SEMAPHORE_DB_DIALECT
+          value: postgres
+        - name: SEMAPHORE_DB_HOST
+          value: semaphore-db-rw.semaphore-db.svc.cluster.local
+        - name: SEMAPHORE_DB_PORT
+          value: '5432'
+        - name: SEMAPHORE_DB
+          value: semaphore
+        - name: SEMAPHORE_DB_USER
+          value: semaphore
+        - name: SEMAPHORE_DB_PASS
+          valueFrom:
+            secretKeyRef:
+              name: semaphore-bootstrap
+              key: db-password
+        - name: SEMAPHORE_ADMIN
+          valueFrom:
+            secretKeyRef:
+              name: semaphore-bootstrap
+              key: admin-username
+        - name: SEMAPHORE_ADMIN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: semaphore-bootstrap
+              key: admin-password
+        - name: SEMAPHORE_ADMIN_NAME
+          value: Semaphore Admin
+        - name: SEMAPHORE_ADMIN_EMAIL
+          value: [email protected]
+        - name: SEMAPHORE_ACCESS_KEY_ENCRYPTION
+          valueFrom:
+            secretKeyRef:
+              name: semaphore-bootstrap
+              key: access-key-encryption
+        - name: SEMAPHORE_PORT
+          value: :3000
+        volumeMounts:
+        - name: config
+          mountPath: /etc/semaphore
+      securityContext:
+        runAsUser: 1001
+        runAsGroup: 0
+        runAsNonRoot: true
+        fsGroup: 1001
+      volumes:
+      - name: config
+        persistentVolumeClaim:
+          claimName: semaphore-config
+---
+# Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: semaphore
+  namespace: semaphore
+  labels:
+    app.kubernetes.io/name: semaphore
+spec:
+  selector:
+    app.kubernetes.io/name: semaphore
+  ports:
+  - name: port-3000
+    port: 3000
+    targetPort: 3000
+---
+# CiliumNetworkPolicy egress allow (R-NET-02): semaphore-allow-semaphore-db-5432
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: semaphore-allow-semaphore-db-5432
+  namespace: semaphore
+  labels:
+    app.kubernetes.io/name: semaphore
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: semaphore
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        app.kubernetes.io/name: semaphore-db
+        k8s:io.kubernetes.pod.namespace: semaphore-db
+    toPorts:
+    - ports:
+      - port: '5432'
+        protocol: TCP
+---
+# CiliumNetworkPolicy gateway-ingress allow (R-NET-01/02): semaphore-allow-gateway-ingress
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: semaphore-allow-gateway-ingress
+  namespace: semaphore
+  labels:
+    app.kubernetes.io/name: semaphore
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: semaphore
+  ingress:
+  - fromEntities:
+    - ingress
+    toPorts:
+    - ports:
+      - port: '3000'
+        protocol: TCP
+---
+# CiliumNetworkPolicy world egress allow (egress class governs the path; R-NET-05): semaphore-allow-internet-egress
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: semaphore-allow-internet-egress
+  namespace: semaphore
+  labels:
+    app.kubernetes.io/name: semaphore
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: semaphore
+  egress:
+  - toEntities:
+    - world
+---
+# HTTPRoute semaphore-3000 (R-TLS/R-DNS)
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: semaphore-3000
+  namespace: semaphore
+  labels:
+    app.kubernetes.io/name: semaphore
+  annotations:
+    homelab.keithjackson.dev/auth-mode: oidc
+    homelab.keithjackson.dev/auth-groups: platform-admins
+spec:
+  parentRefs:
+  - name: shared
+    namespace: gateway
+    sectionName: https
+  hostnames:
+  - semaphore.home.keithjackson.dev
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - name: semaphore
+      port: 3000
+---
+# ServiceMonitor (R-OBS-01)
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: semaphore
+  namespace: semaphore
+  labels:
+    release: kube-prometheus-stack
+    app.kubernetes.io/name: semaphore
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: semaphore
+  namespaceSelector:
+    matchNames:
+    - semaphore
+  endpoints:
+  - port: metrics
+    interval: 30s
+---
+# PrometheusRule SLI alerts (R-OBS-01)
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: semaphore-slis
+  namespace: semaphore
+  labels:
+    release: kube-prometheus-stack
+    app.kubernetes.io/name: semaphore
+spec:
+  groups:
+  - name: semaphore.slis
+    rules:
+    - alert: semaphore-down
+      expr: up{job="semaphore"} == 0
+      for: 5m
+      labels:
+        severity: critical
+        service: semaphore
+      annotations:
+        summary: semaphore is down
+        description: 'semaphore has been unreachable for 5m (SLI: up).'
@@ -0,0 +1,278 @@
+---
+# Namespace (trust zone; default-deny + policies apply)
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: sonarr
+  labels:
+    homelab.keithjackson.dev/app-namespace: 'true'
+    gateway-access: shared
+  annotations:
+    homelab.keithjackson.dev/backup-policy: daily-offcluster
+---
+# Default-deny baseline (R-NET-01): deny all, allow only DNS
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: sonarr
+  labels:
+    homelab.keithjackson.dev/baseline: default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress: []
+  egress:
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - protocol: UDP
+      port: 53
+    - protocol: TCP
+      port: 53
+---
+# PVC sonarr-config (R-STATE)
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sonarr-config
+  namespace: sonarr
+  labels:
+    app.kubernetes.io/name: sonarr
+spec:
+  accessModes:
+  - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 5Gi
+---
+# Deployment (R-PLAT-02)
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sonarr
+  namespace: sonarr
+  labels:
+    app.kubernetes.io/name: sonarr
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: sonarr
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: sonarr
+        homelab.keithjackson.dev/egress-class: vpn
+        homelab.keithjackson.dev/auth-mode: forward-auth
+      annotations:
+        homelab.keithjackson.dev/auth-mode: forward-auth
+        homelab.keithjackson.dev/auth-groups: media-users
+    spec:
+      containers:
+      - name: sonarr
+        image: lscr.io/linuxserver/sonarr:4.0.15
+        ports:
+        - containerPort: 8989
+        volumeMounts:
+        - name: config
+          mountPath: /data/config
+      volumes:
+      - name: config
+        persistentVolumeClaim:
+          claimName: sonarr-config
+---
+# Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: sonarr
+  namespace: sonarr
+  labels:
+    app.kubernetes.io/name: sonarr
+spec:
+  selector:
+    app.kubernetes.io/name: sonarr
+  ports:
+  - name: port-8989
+    port: 8989
+    targetPort: 8989
+---
+# CiliumNetworkPolicy egress allow (R-NET-02): sonarr-allow-qbittorrent-8080
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: sonarr-allow-qbittorrent-8080
+  namespace: sonarr
+  labels:
+    app.kubernetes.io/name: sonarr
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: sonarr
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        app.kubernetes.io/name: qbittorrent
+        k8s:io.kubernetes.pod.namespace: qbittorrent
+    toPorts:
+    - ports:
+      - port: '8080'
+        protocol: TCP
+---
+# CiliumNetworkPolicy egress allow (R-NET-02): sonarr-allow-jackett-9117
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: sonarr-allow-jackett-9117
+  namespace: sonarr
+  labels:
+    app.kubernetes.io/name: sonarr
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: sonarr
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        app.kubernetes.io/name: jackett
+        k8s:io.kubernetes.pod.namespace: jackett
+    toPorts:
+    - ports:
+      - port: '9117'
+        protocol: TCP
+---
+# CiliumNetworkPolicy reciprocal ingress allow (R-NET-02): sonarr-allow-seerr-8989
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: sonarr-allow-seerr-8989
+  namespace: sonarr
+  labels:
+    app.kubernetes.io/name: sonarr
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: sonarr
+  ingress:
+  - fromEndpoints:
+    - matchLabels:
+        app.kubernetes.io/name: seerr
+        k8s:io.kubernetes.pod.namespace: seerr
+    toPorts:
+    - ports:
+      - port: '8989'
+        protocol: TCP
+---
+# CiliumNetworkPolicy gateway-ingress allow (R-NET-01/02): sonarr-allow-gateway-ingress
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: sonarr-allow-gateway-ingress
+  namespace: sonarr
+  labels:
+    app.kubernetes.io/name: sonarr
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: sonarr
+  ingress:
+  - fromEntities:
+    - ingress
+    toPorts:
+    - ports:
+      - port: '8989'
+        protocol: TCP
+---
+# CiliumNetworkPolicy world egress allow (egress class governs the path; R-NET-05): sonarr-allow-internet-egress
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: sonarr-allow-internet-egress
+  namespace: sonarr
+  labels:
+    app.kubernetes.io/name: sonarr
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: sonarr
+  egress:
+  - toEntities:
+    - world
+---
+# HTTPRoute sonarr-8989 (R-TLS/R-DNS)
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: sonarr-8989
+  namespace: sonarr
+  labels:
+    app.kubernetes.io/name: sonarr
+  annotations:
+    homelab.keithjackson.dev/auth-mode: forward-auth
+    homelab.keithjackson.dev/auth-groups: media-users
+spec:
+  parentRefs:
+  - name: shared
+    namespace: gateway
+    sectionName: https
+  hostnames:
+  - sonarr.home.keithjackson.dev
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - name: sonarr
+      port: 8989
+---
+# ServiceMonitor (R-OBS-01)
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: sonarr
+  namespace: sonarr
+  labels:
+    release: kube-prometheus-stack
+    app.kubernetes.io/name: sonarr
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: sonarr
+  namespaceSelector:
+    matchNames:
+    - sonarr
+  endpoints:
+  - port: metrics
+    interval: 30s
+---
+# PrometheusRule SLI alerts (R-OBS-01)
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: sonarr-slis
+  namespace: sonarr
+  labels:
+    release: kube-prometheus-stack
+    app.kubernetes.io/name: sonarr
+spec:
+  groups:
+  - name: sonarr.slis
+    rules:
+    - alert: sonarr-down
+      expr: up{job="sonarr"} == 0
+      for: 5m
+      labels:
+        severity: critical
+        service: sonarr
+      annotations:
+        summary: sonarr is down
+        description: 'sonarr has been unreachable for 5m (SLI: up).'