added soulsync 3.5.3

apps/soulsync.yaml

@@ -0,0 +1,26 @@
+# This ArgoCD application deploys soulsync to manage media discovery.
+# The Deployment pins a reviewed SoulSync release for repeatable GitOps syncs.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: soulsync
+  namespace: argocd
+  # skipping resources-finalizer.argocd.argoproj.io as soulsync will create configs
+spec:
+  project: default
+
+  source:
+    repoURL: https://tea.ahmza.com/ahmza.com/k8s-starter-pack.git
+    targetRevision: main
+    path: apps/soulsync
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: soulsync
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

apps/soulsync/deployment.yaml

@@ -0,0 +1,129 @@
+# Pin SoulSync so an upstream `latest` update cannot change the running app
+# without a reviewed Git commit.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: soulsync
+  namespace: soulsync
+spec:
+  # not critical infra, a single pod should suffice
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: soulsync
+  template:
+    metadata:
+      labels:
+        app: soulsync
+    spec:
+      containers:
+        - name: soulsync
+          image: boulderbadgedad/soulsync:3.5.3
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: UMASK
+              value: "022"
+            - name: PYTHONPATH
+              value: "/app"
+            - name: SOULSYNC_CONFIG_PATH
+              value: "/app/config/config.json"
+            - name: TZ
+              value: "Europe/London"
+          ports:
+            # HTTPS terminates at ingress-nginx, which forwards the UI and both
+            # OAuth callback paths to SoulSync's main web server on this port.
+            - name: http
+              containerPort: 8008
+              protocol: TCP
+          # Kubernetes ignores the Docker image's HEALTHCHECK, so define probes
+          # here to keep traffic away until SoulSync has actually started and to
+          # restart it if its web server later stops responding.
+          startupProbe:
+            httpGet:
+              path: /
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 24
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            periodSeconds: 30
+            timeoutSeconds: 10
+            failureThreshold: 3
+          # Match the upstream Compose defaults: scheduling reserves enough for
+          # normal operation while limits protect the rest of the cluster.
+          resources:
+            requests:
+              cpu: 500m
+              memory: 512Mi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+          volumeMounts:
+            - name: soulsync-db
+              mountPath: /app/data
+            - name: soulsync-config
+              mountPath: /app/config
+            - name: soulsync-logs
+              mountPath: /app/logs
+            - name: downloads
+              mountPath: /app/downloads
+            - name: music
+              mountPath: /app/Transfer
+            - name: podcasts
+              mountPath: /app/podcasts
+            - name: audiobooks
+              mountPath: /app/audiobooks
+            - name: movies
+              mountPath: /media/movies
+            - name: tvshows
+              mountPath: /media/tv
+      volumes:
+        - name: soulsync-db
+          persistentVolumeClaim:
+            claimName: soulsync-db
+        - name: soulsync-config
+          persistentVolumeClaim:
+            claimName: soulsync-config
+        - name: soulsync-logs
+          persistentVolumeClaim:
+            claimName: soulsync-logs
+        - name: downloads
+          nfs:
+            server: nas.ahmza.com
+            path: /srv/media/torrents
+        - name: music
+          nfs:
+            server: nas.ahmza.com
+            path: /srv/media/Music
+        - name: podcasts
+          nfs:
+            server: nas.ahmza.com
+            path: /srv/media/Podcasts
+        - name: audiobooks
+          nfs:
+            server: nas.ahmza.com
+            path: /srv/media/Audiobooks
+        - name: movies
+          nfs:
+            server: nas.ahmza.com
+            path: /srv/media/Movies
+        - name: tvshows
+          nfs:
+            server: nas.ahmza.com
+            path: /srv/media/TVShows

apps/soulsync/ingress.yaml

@@ -0,0 +1,28 @@
+# routes for soulsync.ahmza.com through ingress-nginx (docs/11-ingress.md)
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: soulsync
+  namespace: soulsync
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  # Select ingress-nginx explicitly rather than relying on whichever ingress
+  # controller happens to be configured as the cluster-wide default.
+  ingressClassName: nginx
+  tls:
+    - hosts:
+      - soulsync.ahmza.com
+        # cert-manager keeps this up to date. nothing to do by hand
+      secretName: soulsync-tls
+  rules:
+    - host: soulsync.ahmza.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: soulsync
+                port:
+                  number: 8008

apps/soulsync/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: soulsync

apps/soulsync/pvc.yaml

@@ -0,0 +1,41 @@
+# Keep SoulSync's databases and downloaded artwork on Longhorn so they survive
+# Pod replacement (see docs/06-longhorn.md).
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: soulsync-db
+  namespace: soulsync
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+---
+# Configuration can contain connection settings and OAuth tokens, so persist it
+# without putting those credentials in this public Git repository.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: soulsync-config
+  namespace: soulsync
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+---
+# Persistent logs remain available when the container is recreated and make
+# failures that happened before a restart easier to diagnose.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: soulsync-logs
+  namespace: soulsync
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi

apps/soulsync/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: soulsync
+  namespace: soulsync
+spec:
+  selector:
+    app: soulsync
+  ports:
+    - name: http
+      port: 8008
+      targetPort: http