# L1 fixture: a vpn-class ServiceDefinition. Identical to svcdef-egress-internet.yaml
# EXCEPT `egress: vpn`, so the render diff isolates the egress path (R-NET-05/07).
# sonarr is in the normative vpn-class set (docs/03/13). Validates against
# schemas/servicedefinition.schema.json.
name: sonarr
kind: container
source:
  image: linuxserver/sonarr
exposure: internal
egress: vpn
storage:
  - name: config
    size: 2Gi
    class: longhorn
ingressRoutes:
  - host: sonarr.home.keithjackson.dev
    port: 8989
auth:
  mode: forward-auth
  groups:
    - media-admins
update:
  channel: stable
  cadence: "0 4 * * *"
  autoRollbackOnFailedHealth: true
observability:
  metrics: true
  slis:
    - up
backup:
  policy: daily-offcluster