jklein
7003f3674c
Collapses the eight open Renovate PRs for this stack into one change, and answers what two of them turned out to carry. The eight tags: qbittorrent 5.2.3 -> 5.2.4, bazarr 1.6.0 -> 1.6.2, sonarr 4.0.19 -> 4.0.20, flaresolverr v3.5.0 -> v3.5.2, recyclarr 8.7.1 -> 8.7.3, prowlarr 2.5.2 -> 2.6.5, radarr 6.3.0 -> 6.4.4, seerr v3.4.1 -> v3.5.0. gluetun, the busybox init image and the digest-pinned mediathekarr have no update pending and are untouched. Major rather than patch, because prowlarr 2.6.3 and radarr 6.4.3 are not plain bumps: they removed the hard-coded trusted proxy networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7, fe80::/10, read in Startup.cs at the previously pinned tags) and replaced them with a TrustedNetworks setting whose own default is string.Empty - ForwardedHeadersConfigurator returns before registering a single KnownNetwork while it is empty. Behind an in-cluster ingress controller that means the forwarded headers are ignored: the client address the app reports is the controller's pod IP, the scheme reads as http behind TLS termination, and under "Disabled for Local Addresses" a proxied request stops counting as local. So a <app>.trustedNetworks value is added for prowlarr, radarr AND sonarr, rendered as <APP>__SERVER__TRUSTEDNETWORKS and only when non-empty - an empty variable cannot be told apart from an unset one by the app, but looks handled to a reader of the manifest. The env form was verified per app rather than inferred: all three bind ServerOptions to <App>:Server next to a plain AddEnvironmentVariables(). A helper suppresses the chart's entry when the app's own env block already carries the variable, for the reason the UrlBase helper states - two identically named variables in one container are not a defined state. sonarr is included because it is already in the empty state: 4.0.19, the version this chart shipped before, has no hard-coded networks either. It arrived in what the convention classes as a plain app-version bump, so nothing reviewed or documented it. Repairing two and knowingly leaving the third would be the same silent pattern. The default is empty, and this therefore does NOT restore the behaviour from before the upgrade. That is deliberate and follows upstream's reason - trusting X-Forwarded-For from any private network is a spoofing vector - and it is made visible instead of reinstated: NOTES.txt warns in exactly the combination that costs something, the app published through an Ingress or an HTTPRoute and the value empty, and stays quiet otherwise. AllowedHosts, added by the same upstream releases, is deliberately not exposed. Its default is string.Empty as well and the app then accepts any host, so there is nothing to repair; the trap is documented instead, because if it is ever set the app appends only localhost, 127.0.0.1, [::1] and its own hostname - neither the pod IP nor the Service DNS name - and the kubelet probes the pod by IP, which an incomplete list answers with HTTP 400. At default values the rendered manifest changes in exactly eight lines, the image tags; the new value renders nothing until it is set.
27 lines
1.4 KiB
YAML
27 lines
1.4 KiB
YAML
apiVersion: v2
|
|
name: freesailarr
|
|
description: A Helm chart to deploy a Wireguard-tunneled media automation stack on Kubernetes - a VPN gateway with indexer, downloader, library managers, subtitle fetcher, request front end and an optional public-broadcaster indexer in one pod, all reaching the internet only through the tunnel
|
|
# No icon on purpose: the stack has no single upstream, and every other chart's
|
|
# icon is its one project's logo. Picking any of the ten here would suggest
|
|
# the same false "main app" the versioning deliberately avoids. The field is
|
|
# optional, so it is omitted rather than filled with an arbitrary choice.
|
|
|
|
type: application
|
|
|
|
version: 4.0.0+up1.0.0
|
|
# The chart's own version marker, freely chosen and tied to no upstream. The
|
|
# stack bundles ten independently versioned projects (nine of them on by
|
|
# default), so there is no single "app version" to track here.
|
|
#
|
|
# It is NOT the source of any image tag: all ten images are pinned in
|
|
# values.yaml, where Renovate's helm-values manager proposes them - except
|
|
# mediathekarr, which is pinned by digest and has its own customManagers block
|
|
# in renovate.json5, because its tags carry no version. Nothing rewrites this
|
|
# field automatically - the chart has no app-version block in renovate.json5
|
|
# and is not in the change-app-version.yml choice list. Raise it by hand when
|
|
# you want to mark a new edition of the chart as a whole.
|
|
appVersion: "1.0.0"
|
|
|
|
maintainers:
|
|
- name: jklein
|