jklein
78d7020dab
MediathekArr fakes a Usenet indexer towards Prowlarr and a SABnzbd downloader towards Sonarr/Radarr and fetches from the ARD and ZDF media libraries. Both consumers already share gluetun's network namespace, so they reach it over 127.0.0.1 - no service, no DNS, no ingress detour. Purely additive: the flag defaults to false and a default render is byte-identical to 3.0.5 (verified against the previous chart for both the default values and the CI values). The four things that fail silently without them: - A START GATE on gluetun. MediathekArr fetches its ruleset once at start and never retries; started before the tunnel it answers every Newznab search with 0 results while the container is up, Ready and quiet. Kubernetes cannot order two regular containers and an initContainer would deadlock, so the wait sits in front of the image entrypoint: poll gluetun's health server on 127.0.0.1:9999 and exec the entrypoint afterwards; on timeout the container exits rather than starting blind, because a crash loop is visible and an empty indexer is not. The startup probe budget (300s) deliberately outlasts the gate (180s). - incomplete/ AND complete/ ON THE SHARED DOWNLOADS CLAIM, not in an emptyDir. An emptyDir counts against the container's ephemeral-storage limit, and one large download would have the kubelet evict the whole pod with all ten containers - the trap ytdlp-web-player documents. - THE COMPLETE PATH SONARR SEES. The claim is mounted at /downloads exactly as sonarr/radarr mount it, and the chart sets DOWNLOAD_COMPLETE_PATH itself, so the SABnzbd complete_dir it reports is the same absolute path on both sides. - TWO PORTS: 5007 (SABnzbd role and UI, primary) and 5008 (Newznab role for Prowlarr), both declared to gluetun's firewall and both on one Service. The SABnzbd API is at /download/api - /api on 5007 answers with a misleading Newznab validation error. Further details: - Image pinned by digest (tag + digest): "latest" is a 2024 build, "beta" moves. Single-arch linux/amd64. The built-in helm-values manager cannot follow that pair, so renovate.json5 gets the chart's first customManagers block; verified by dry-run with two fixtures, since a matching and a broken rule look identical while the pin is current. - Hardened as measured: non-root, uid/gid from puid/pgid, readOnlyRootFilesystem: true, all capabilities dropped, no PUID/PGID. - Probes on measured 200 endpoints (there is no health endpoint): readiness and startup on /download/, liveness as an exec covering BOTH ports, because one container runs two processes and a wedged Newznab half is exactly what makes searches come back empty. - No ingress by default: the UI links its assets with root-absolute paths, so it can only be served at the root of a host; on the shared domain that root belongs to seerr. A sub-path fails the render instead of producing a broken UI. - values.yaml and NOTES.txt document the geo MARKER PROCEDURE (not a table of series), the escape route of a German exit and its price for the whole stack, the fail_message: null trap, and the HLS question as an open question. - CI: mediathekarr enabled in ci/freesailarr/test-values.yaml, install timeout raised to 1200s for the extra image and the gate. Fixes #245
48 lines
2.2 KiB
YAML
48 lines
2.2 KiB
YAML
# freesailarr: the whole stack in one pod - gluetun plus nine app containers
|
|
# that share its network namespace and sit behind its kill switch. Nothing here
|
|
# is a shortcut around that: the install-test brings up a real Wireguard tunnel
|
|
# with a CI-only Mullvad key (see ci/freesailarr/fixtures.env.yaml), because a
|
|
# gluetun without a handshake keeps every app container from becoming Ready.
|
|
#
|
|
# Release name is ci, so the chart looks for the gluetun credentials in the
|
|
# Secret ci-freesailarr-gluetun-secret, which the fixtures create. The chart's
|
|
# own OnePasswordItem CR applies against the stub CRD and stays unreconciled -
|
|
# there is no 1Password operator in the CI cluster.
|
|
secrets:
|
|
# Required by the chart. Only the CR's itemPath, never resolved in CI.
|
|
gluetunSecretRef: op://ci/freesailarr-gluetun
|
|
|
|
media:
|
|
# The three media claims are pre-created in fixtures.yaml (one claim per
|
|
# category, no subPath - the shared-claim layout is a values question, not a
|
|
# startup question). local-path hands out its directories mode 0777, so the
|
|
# claim roots are writable for PUID/PGID as the chart requires.
|
|
downloads:
|
|
existingClaim: ci-freesailarr-downloads
|
|
movies:
|
|
existingClaim: ci-freesailarr-movies
|
|
tv:
|
|
existingClaim: ci-freesailarr-tv
|
|
|
|
gluetun:
|
|
vpn:
|
|
# Without this the kill switch drops cluster-internal egress as well, and
|
|
# the very first DNS lookup against cluster DNS fails. k3s defaults:
|
|
# 10.42.0.0/16 pods, 10.43.0.0/16 services.
|
|
firewallOutboundSubnets: "10.42.0.0/16,10.43.0.0/16"
|
|
|
|
ingress:
|
|
# Shared-domain mode with a placeholder host: the Ingress objects only have to
|
|
# be accepted by the API server. There is no ingress-nginx and no cert-manager
|
|
# in the CI cluster, and the install-test checks readiness, not routing.
|
|
host: freesailarr.example.com
|
|
clusterIssuer: ci
|
|
|
|
mediathekarr:
|
|
# On in CI although it is off by default, so the install-test actually covers
|
|
# the tenth container: its digest-pinned image (single-arch amd64, ~850 MB),
|
|
# its start gate against gluetun's health server, and its probes on the two
|
|
# ports. Its ingress stays off - MediathekArr can only be served at the root
|
|
# of a host, and the root of the shared host above belongs to seerr.
|
|
enabled: true
|