Skip to content

feat(music-arr): initial template for arr stack for music #71

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lucaam wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(music-arr): initial template for arr stack for music #71

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
72 changes: 72 additions & 0 deletions apps/aurral/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,72 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: aurral
namespace: media
labels:
app: aurral
app.kubernetes.io/name: aurral
spec:
replicas: 1
selector:
matchLabels:
app: aurral
app.kubernetes.io/name: aurral
template:
metadata:
labels:
app: aurral
app.kubernetes.io/name: aurral
spec:
securityContext:
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
containers:
- name: aurral
image: ghcr.io/lklynet/aurral:1.76.3
imagePullPolicy: IfNotPresent
securityContext:
allowPrivilegeEscalation: false
ports:
- containerPort: 8080
name: http
env:
- name: ADMIN_PASSWORD
valueFrom:
secretKeyRef:
name: aurral-secrets
key: admin_password
- name: APP_DOCS_URL
value: "https://github.com/lklynet/aurral"
volumeMounts:
- name: config-data
mountPath: /config
- name: media-data
mountPath: /media
Comment on lines +43 to +46

@coderabbitai coderabbitai Bot May 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Fix invalid indentation in volumeMounts (build-blocking YAML syntax error).

Line 44 and Line 45 are misindented, which causes the parser failure reported in CI and prevents Flux/Kustomize from building this app.

Proposed fix 
         volumeMounts:
-        - name: config-data
-            mountPath: /config
-          - name: media-data
-            mountPath: /media
+        - name: config-data
+          mountPath: /config
+        - name: media-data
+          mountPath: /media

As per coding guidelines, "apps/**: This is a Kubernetes (Talos) GitOps repository managed by Flux CD. Review Kubernetes manifests for correctness, security (no hardcoded secrets, proper RBAC), and best practices."

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: config-data
mountPath: /config
- name: media-data
mountPath: /media
- name: config-data
mountPath: /config
- name: media-data
mountPath: /media
🧰 Tools
🪛 GitHub Actions: Validate Flux Manifests / 1_Kustomize Build (apps).txt

[error] 44-44: kustomize build failed with MalformedYAMLError: yaml: line 44: mapping values are not allowed in this context while accumulating resources from 'aurral'.

🪛 GitHub Actions: Validate Flux Manifests / 3_YAML Lint.txt

[error] 44-44: yamllint: syntax error: mapping values are not allowed here (syntax)

🪛 GitHub Actions: Validate Flux Manifests / Kustomize Build (apps)

[error] 44-44: Kustomize build failed with MalformedYAMLError: yaml: line 44: mapping values are not allowed in this context (while accumulating resources).

🪛 GitHub Actions: Validate Flux Manifests / YAML Lint

[error] 44-44: Yamllint failed with syntax error: mapping values are not allowed here (syntax)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/aurral/deployment.yaml` around lines 43 - 46, The volumeMounts block has
incorrect indentation for the entries (the "name: config-data" and "mountPath:
/config" and similarly "name: media-data"/"mountPath: /media") causing invalid
YAML; fix by aligning each volumeMount item as a proper list entry under
volumeMounts (ensure a leading dash for each mount and consistent indentation),
e.g., make sure "volumeMounts:" is followed by "- name: config-data" /
"mountPath: /config" and "- name: media-data" / "mountPath: /media" so the
parser accepts the volumeMounts array (look for the volumeMounts section and the
name/mountPath entries to correct).

resources:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "512Mi"
cpu: "500m"
livenessProbe:
tcpSocket:
port: 8080
initialDelaySeconds: 60
periodSeconds: 30
failureThreshold: 3
readinessProbe:
tcpSocket:
port: 8080
initialDelaySeconds: 10
periodSeconds: 10
failureThreshold: 3
volumes:
- name: config-data
persistentVolumeClaim:
claimName: aurral-config
- name: media-data
persistentVolumeClaim:
claimName: media-shared
23 changes: 23 additions & 0 deletions apps/aurral/httproute.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
labels:
app.kubernetes.io/name: aurral
name: aurral-httproute
namespace: aurral
spec:
hostnames:
- aurral.${DOMAIN}
parentRefs:
- name: traefik-gateway
namespace: traefik
sectionName: websecure
rules:
- backendRefs:
- name: aurral
port: 80
matches:
- path:
type: PathPrefix
value: /

14 changes: 14 additions & 0 deletions apps/aurral/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- secret-aurral.sops.yaml
- pvc.yaml
- deployment.yaml
- service.yaml
- httproute.yaml
metadata:
name: aurral
labels:
app.kubernetes.io/name: aurral

6 changes: 6 additions & 0 deletions apps/aurral/namespace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
apiVersion: v1
kind: Namespace
metadata:
name: aurral
labels:
app.kubernetes.io/name: aurral
44 changes: 44 additions & 0 deletions apps/aurral/pvc.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: aurral-config
namespace: aurral
labels:
app.kubernetes.io/name: aurral-config
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 5Gi
storageClassName: nfs-flash
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: aurral-media
namespace: aurral
labels:
app.kubernetes.io/name: aurral-media
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 200Gi
storageClassName: nfs-spacex
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: aurral-storage
namespace: aurral
labels:
app.kubernetes.io/name: aurral-storage
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 10Gi
storageClassName: nfs-flash
14 changes: 14 additions & 0 deletions apps/aurral/secret-aurral.sops.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
apiVersion: v1
kind: Secret
metadata:
name: aurral-secrets
namespace: aurral
labels:
app.kubernetes.io/name: aurral-secrets
type: Opaque
stringData:
# TODO: replace with real secrets and encrypt with sops
admin_password: ""
api_key: ""
sops:
version: "3.11.0"
17 changes: 17 additions & 0 deletions apps/aurral/service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
apiVersion: v1
kind: Service
metadata:
name: aurral
namespace: aurral
labels:
app.kubernetes.io/name: aurral
spec:
type: ClusterIP
ports:
- name: http
port: 80
targetPort: 8080
protocol: TCP
selector:
app: aurral
app.kubernetes.io/name: aurral
29 changes: 29 additions & 0 deletions apps/flaresolverr/helm-release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: flaresolverr
namespace: flaresolverr
labels:
app.kubernetes.io/name: flaresolverr
spec:
interval: 1h
chart:
spec:
chart: ./charts/flaresolverr
sourceRef:
kind: GitRepository
name: media-servarr
namespace: flux-system
targetNamespace: flaresolverr
values:
podSecurityContext:
fsGroup: 1000
securityContext:
runAsUser: 1000
resources:
requests:
cpu: "50m"
memory: "64Mi"
limits:
cpu: "250m"
memory: "256Mi"
22 changes: 22 additions & 0 deletions apps/flaresolverr/httproute.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: flaresolverr-httproute
namespace: flaresolverr
labels:
app.kubernetes.io/name: flaresolverr
spec:
hostnames:
- "flaresolverr.${DOMAIN}"
parentRefs:
- name: traefik-gateway
namespace: traefik
sectionName: websecure
rules:
- matches:
- path:
type: PathPrefix
value: /
backendRefs:
- name: flaresolverr
port: 8191
11 changes: 11 additions & 0 deletions apps/flaresolverr/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- helm-release.yaml
- secret-flaresolverr.sops.yaml
- httproute.yaml
metadata:
name: flaresolverr
labels:
app.kubernetes.io/name: flaresolverr
6 changes: 6 additions & 0 deletions apps/flaresolverr/namespace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
apiVersion: v1
kind: Namespace
metadata:
name: flaresolverr
labels:
app.kubernetes.io/name: flaresolverr
13 changes: 13 additions & 0 deletions apps/flaresolverr/secret-flaresolverr.sops.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
apiVersion: v1
kind: Secret
metadata:
name: flaresolverr-secrets
namespace: flaresolverr
labels:
app.kubernetes.io/name: flaresolverr-secrets
type: Opaque
stringData:
# TODO: encrypt with sops
api_key: ""
sops:
version: "3.11.0"
Comment on lines +9 to +13

@coderabbitai coderabbitai Bot May 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Secret is not properly encrypted with SOPS.

The sops metadata block is incomplete and the secret data is in plaintext. Properly SOPS-encrypted files must contain encrypted_regex, kms or age key configuration, and mac fields. The current state suggests this file has not been encrypted yet, violating the GitOps security requirement that secrets must be encrypted at rest.

🔐 How to encrypt with SOPS

After filling in the api_key value, encrypt the file with:

sops --encrypt --in-place apps/flaresolverr/secret-flaresolverr.sops.yaml

Ensure your .sops.yaml configuration file is properly set up with age or KMS keys before encrypting.

As per coding guidelines: "Review Kubernetes manifests for correctness, security (no hardcoded secrets, proper RBAC), and best practices."

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/flaresolverr/secret-flaresolverr.sops.yaml` around lines 9 - 13, The
secret file contains plaintext under stringData.api_key and an incomplete sops
metadata block; populate the real api_key value (not checked into git in
plaintext), then run SOPS encryption to replace the plaintext and emit full
metadata (including kms/age or encrypted_regex entries and mac) by executing
your project's SOPS workflow (e.g., use your configured age/KMS key and run sops
--encrypt --in-place on the file), and confirm the resulting sops block includes
kms or age entries and a mac field so the secret is stored encrypted rather than
as plain stringData.api_key.

30 changes: 30 additions & 0 deletions apps/jellyfin/helm-release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: jellyfin
namespace: jellyfin
labels:
app.kubernetes.io/name: jellyfin
spec:
interval: 1h
chart:
spec:
chart: ./charts/jellyfin
sourceRef:
kind: GitRepository
name: media-servarr
namespace: flux-system
targetNamespace: jellyfin
values:
podSecurityContext:
fsGroup: 1000
securityContext:
runAsUser: 1000
persistence:
config:
enabled: true
existingClaim: jellyfin-config
media:
enabled: true
existingClaim: jellyfin-media
# transcode/cache: consider emptyDir for performance, or create a small fast PVC

@coderabbitai coderabbitai Bot May 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Align the trailing comment indentation to satisfy yamllint.

Line 30 is flagged by CI (comments-indentation). Align it with the surrounding nested block indentation to clear lint warnings.

🧰 Tools
🪛 GitHub Actions: Validate Flux Manifests / 3_YAML Lint.txt

[warning] 30-30: yamllint: comment not indented like content (comments-indentation)

🪛 GitHub Actions: Validate Flux Manifests / YAML Lint

[warning] 30-30: Yamllint warning: comment not indented like content (comments-indentation)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/jellyfin/helm-release.yaml` at line 30, The trailing inline comment
"transcode/cache: consider emptyDir for performance, or create a small fast PVC"
is mis-indented and triggers yamllint's comments-indentation rule; fix it by
aligning the comment to the same indentation level as the surrounding nested
block keys in helm-release.yaml so it matches the parent block's indentation
(adjust the leading spaces before the "#" to match neighboring lines).

22 changes: 22 additions & 0 deletions apps/jellyfin/httproute.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: jellyfin-httproute
namespace: jellyfin
labels:
app.kubernetes.io/name: jellyfin
spec:
hostnames:
- "jellyfin.${DOMAIN}"
parentRefs:
- name: traefik-gateway
namespace: traefik
sectionName: websecure
rules:
- matches:
- path:
type: PathPrefix
value: /
backendRefs:
- name: jellyfin
port: 8096
12 changes: 12 additions & 0 deletions apps/jellyfin/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- helm-release.yaml
- pvc.yaml
- secret-jellyfin.sops.yaml
- httproute.yaml
metadata:
name: jellyfin
labels:
app.kubernetes.io/name: jellyfin
6 changes: 6 additions & 0 deletions apps/jellyfin/namespace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
apiVersion: v1
kind: Namespace
metadata:
name: jellyfin
labels:
app.kubernetes.io/name: jellyfin
33 changes: 33 additions & 0 deletions apps/jellyfin/pvc.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: jellyfin-config
namespace: jellyfin
labels:
app.kubernetes.io/name: jellyfin-config
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 5Gi
storageClassName: nfs-flash
# Use `nfs-flash` for small config/DB-like storage.
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: jellyfin-media
namespace: jellyfin
labels:
app.kubernetes.io/name: jellyfin-media
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 500Gi
storageClassName: nfs-spacex
# Use `nfs-spacex` for large media libraries.
# For transcodes/cache prefer an `emptyDir` or a small fast PVC; persistent transcode
# state is optional and may be slower on NFS.
Loading
Loading