jakman85andClaude Opus 4.8
8392b52ee8
Add catalog/ ServiceDefinitions for qbittorrent and jackett and their rendered apps/ manifests, wired into apps/kustomization.yaml. Both are VPN-class (egress: vpn -> egress-class=vpn pod label steered by the CiliumEgressGatewayPolicy + host kill-switch, ADR-0015) and internal forward-auth UIs (oauth2-proxy -> Keycloak, group media-users). Config on 3-replica Longhorn. qBittorrent's bulk downloads volume is DEFERRED pending OQ-2 (non-provisioning bulk StorageClass stub), mirroring plex/arr. Traces: R-NET-05/06 (VPN egress + kill-switch), R-IDP-02/06 (forward-auth), R-STATE-02/03, R-OBS-01, R-UPD-01/03, R-GITOPS-02. Co-Authored-By: Claude Opus 4.8 <[email protected]>
45 lines
2.5 KiB
YAML
45 lines
2.5 KiB
YAML
# ServiceDefinition: jackett
|
|
# Source of truth: spec docs/13-service-catalog.md row 4; docs/03-networking-isolation-and-egress.md;
|
|
# docs/15-identity-and-access.md; decisions/adr-0015 (VPN egress steering).
|
|
# internal indexer proxy | egress VPN + kill-switch | config on Longhorn | auth forward-auth
|
|
# (bare web UI, no native OIDC).
|
|
#
|
|
# VPN-class (docs/13 row 4; docs/03 "VPN-class set"): Jackett scrapes public torrent indexers/trackers;
|
|
# that egress MUST leave via the node PIA tunnel, never the WAN. `egress: vpn` renders the
|
|
# homelab.keithjackson.dev/egress-class=vpn pod label the shared CiliumEgressGatewayPolicy
|
|
# (platform/vpn-egress/egress-steering.yaml) selects on to steer + kill-switch the traffic OUTSIDE the
|
|
# workload (R-NET-05/06/07). No independent egress path; fail-closed if tun0 is down.
|
|
#
|
|
# Inbound reachability (← sonarr, ← radarr) is an EAST-WEST allow rendered on the arr side when those
|
|
# services are onboarded. This service initiates nothing east-west, so dependencies is empty (reaches
|
|
# only DNS + VPN internet). Validates against schemas/servicedefinition.schema.json.
|
|
name: jackett
|
|
kind: container
|
|
source:
|
|
image: lscr.io/linuxserver/jackett:0.22.1327 # pinned stable tag (R-UPD-01); update.range governs advancement
|
|
exposure: internal # LAN-only web UI at jackett.home.keithjackson.dev (docs/13 row 4; R-DNS/R-NET)
|
|
egress: vpn # indexer scraping via node PIA tunnel + kill-switch (docs/03; ADR-0015; R-NET-05/06)
|
|
storage:
|
|
- name: config
|
|
size: 2Gi
|
|
class: longhorn # indexer definitions/API keys on 3-replica Longhorn (docs/04; R-STATE-02)
|
|
dependencies: [] # default-deny: reaches only DNS; arr reach it north of its own egress (docs/03; R-NET-01/02)
|
|
ingressRoutes:
|
|
- host: jackett.home.keithjackson.dev
|
|
port: 9117 # Jackett WebUI; protected at the Gateway by forward-auth (docs/09, docs/15)
|
|
auth:
|
|
mode: forward-auth # oauth2-proxy -> Keycloak; bare UI, no usable native OIDC (docs/15; R-IDP-02)
|
|
groups:
|
|
- media-users # authenticated AND in an authorized group (R-IDP-06)
|
|
update:
|
|
channel: stable # R-UPD-01
|
|
range: ">=0.22.0" # stay on the Jackett 0.22.x stable line
|
|
cadence: "0 4 * * *"
|
|
autoRollbackOnFailedHealth: true # R-UPD-03
|
|
observability:
|
|
metrics: true
|
|
slis:
|
|
- up # indexer proxy down -> alert (docs/10; R-OBS-01)
|
|
backup:
|
|
policy: daily-offcluster # indexer config/API keys backed up off-cluster (docs/04; R-STATE-03)
|