Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 2 Pull Requests 5 Actions Packages Projects Releases Wiki Activity
447 Commits 139 Branches 0 Tags
574088dfebf4d51f167cf8a97bce4b65a724faea
Commit Graph
3 Commits
Author SHA1 Message Date
jakman85andClaude Opus 4.8 7b8777c1e1 fix(seerr): add fsGroup podSecurityContext to resolve non-root PVC CrashLoop 
Seerr v3.4.1 (ghcr.io/seerr-team/seerr) runs as the non-root user node:node
(UID/GID 1000), unlike the old root-running sctx/overseerr image. Its root-owned
Longhorn RWO config PVC at /app/config was not writable by UID 1000, so the pod
CrashLoopBackOff'd with:

  Error: EACCES: permission denied, mkdir '/app/config/logs/'

Add a podSecurityContext with fsGroup=1000 (plus runAsUser/runAsGroup/runAsNonRoot)
to the seerr ServiceDefinition — the same schema 1.3.0 mechanism semaphore uses.
Longhorn's CSIDriver fsGroupPolicy: ReadWriteOnceWithFSType applies fsGroup to this
RWO filesystem volume, group-owning the PVC to GID 1000 so the process can write.
Re-rendered apps/wave-2/seerr.yaml from the catalog source.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
 2026-08-27 16:58:17 -05:00
jakman85andClaude Opus 4.8 8b0dcbf33b fix(seerr): move to maintained Seerr image and correct config mountPath 
Two operator-flagged defects in the seerr ServiceDefinition, fixed at source
(catalog/seerr.yaml) and re-rendered into apps/wave-2/seerr.yaml:

- Image: sctx/overseerr:latest (original Overseerr, unmaintained) ->
  ghcr.io/seerr-team/seerr:v3.4.1. Overseerr and Jellyseerr have merged into
  the actively maintained Seerr project (seerr-team/seerr, docs.seerr.dev);
  ghcr.io/seerr-team/seerr is the officially recommended image. Pinned to the
  current stable tag v3.4.1 per the arr-stack convention (sonarr/radarr/
  qbittorrent/gitea pin explicit tags; R-UPD-01). update.range bumped
  ">=1.33.0" -> ">=3.4.0" to track the Seerr 3.x line. Plex-native (native
  auth) support is retained.

- Config mountPath: /data/config -> /app/config. Overseerr/Jellyseerr/Seerr
  store settings + request/cache DB at /app/config; the previous /data/config
  left the config PVC effectively unused (config not persisted across
  restarts). Set via the schema-supported storage[].mountPath field.

Dependencies (sonarr:8989, radarr:7878, plex:32400), NetworkPolicies,
public exposure, and native auth are unchanged. Render == golden verified;
lint, schema, and L1 render checks green.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
 2026-08-27 16:15:00 -05:00
jakman85andClaude Opus 4.8 b6f72eab0c feat(apps): onboard seerr (Overseerr request UI) — completes arr↔seerr↔plex graph 
Phase 6: add the seerr ServiceDefinition and its rendered manifests. seerr is the
final missing node in the media dependency graph (docs/13 row 5; docs/03 allow rules).

- catalog/seerr.yaml: public | egress internet | config on longhorn (5Gi) |
  auth native (Plex accounts, documented SSO exception, docs/15) | 3 explicit egress
  deps: sonarr:8989, radarr:7878, plex:32400. No bulk volume (OQ-2 unresolved).
- apps/seerr.yaml: rendered via catalog/render.py --no-image-automation (default-deny
  DNS-only baseline + 3 dep CiliumNetworkPolicies + gateway-ingress + internet world
  egress + HTTPRoute seerr.home.keithjackson.dev:5055 + ServiceMonitor + alerts).
- apps/kustomization.yaml: add seerr.yaml (with the arr/media stack).

Gates: render --selftest PASS; ci lint PASS; L0 kyverno 17/17 (schema + default-deny +
egress-class + auth-mode + host-ns); L1 render 3/3. Other apps byte-identical.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
 2026-08-26 00:27:47 -05:00