# L1 fixture: an internet-class ServiceDefinition. BYTE-IDENTICAL to svcdef-egress-vpn.yaml
# EXCEPT `egress: internet`. The two renders must differ ONLY in the egress path (R-NET-07):
# the internet render carries NO vpn steering label. Validates against the schema.
name: sonarr
kind: container
source:
  image: linuxserver/sonarr
exposure: internal
egress: internet
storage:
  - name: config
    size: 2Gi
    class: longhorn
ingressRoutes:
  - host: sonarr.home.keithjackson.dev
    port: 8989
auth:
  mode: forward-auth
  groups:
    - media-admins
update:
  channel: stable
  cadence: "0 4 * * *"
  autoRollbackOnFailedHealth: true
observability:
  metrics: true
  slis:
    - up
backup:
  policy: daily-offcluster