Deploy read-only Copyparty with guarded arschrock media storage

2026-11-04 15:14:44 +01:00
1 parent 6d24ca7921
commit d6d3e013cf
@@ -0,0 +1,61 @@
+# Komposthaufen file browser
+
+Copyparty replaces arschrock's host Apache directory listing at
+`https://brunner.ninja/komposthaufen/`. The maintained community chart from
+https://github.com/erNail/copyparty-chart owns the Deployment, configuration,
+Service, ServiceAccount and index PVC. No separate homelab chart repository or
+image build is needed. `bootstrap/copyparty.yaml` pins the published chart.
+The temporary primary-image tag override in `values.yaml` follows the root
+policy for a latest chart that trails its application. Remove it when the chart
+catches up; keep its official image repository unchanged.
+
+Anonymous users receive only `r` (read/list/download) permission. No account
+has upload, move, delete or admin permission. The non-root container also mounts
+`/komposthaufen` recursively read-only. Symlinks cannot escape the exported
+volume. HTML is served as text and embedded directory prologues are disabled.
+The Traefik route preserves the URL prefix; Copyparty's `rp-loc` handles it.
+Direct downloads, HEAD and HTTP byte ranges retain their normal URL shape.
+
+The writable RBD PVC contains rebuildable SQLite search indexes, thumbnails and
+session state. Indexing scans on startup and hourly; file contents are not hashed
+and media tag extraction is not enabled. Search covers path/name, size and date.
+The authoritative files stay on the existing bcachefs bind mount; nothing is
+copied, renamed, chowned or deleted. The current backup owner in `apps/backup`
+does not cover this host library. **The library has an existing backup coverage
+gap.** The disposable index needs no historical backup: recreate it and let
+Copyparty rescan. Preserve the host data independently; Ceph replication and
+its existing backup mirrors are not historical backups of this library.
+
+## Host storage maintenance
+
+`../../scripts/media-storage-{offline,online}.sh` are the shared Plex, Jellyfin,
+Copyparty and Paper maintenance helpers. The existing scripts at
+`~/kubernetes/media-storage-{offline,online}.sh` on arschrock forward to these
+versioned helpers. `~/unmount.sh --stop` uses `bcachefs-maintenance.py` to cordon,
+stop filesystem holders, invoke the offline helper and verify mount namespaces
+before unmounting. `~/mount_binds.sh` restores and checks the bind mounts, calls
+the online helper to recreate consumers and restore the storage-ready labels,
+and restores scheduling. Copyparty uses the same component selector as Plex
+and Jellyfin. Never tolerate the unschedulable taint or bypass the ready label.
+
+After changing GitOps, update arschrock's checkout before storage maintenance:
+`git -C ~/kubernetes/homelab-gitops pull --ff-only`.
+
+The chart has readiness/liveness hooks but no startup-probe template; liveness
+has a startup grace period and does not wait for the background index scan.
+Configuration changes require a Deployment restart because this chart does not
+hash its ConfigMap into the pod template.
+
+## Recovery and legacy Apache
+
+Reconcile the Argo Application and its retained PVC to recover the service.
+For an index-only failure, stop Copyparty before rebuilding its disposable
+index; never remove anything under `/komposthaufen` to repair search.
+Apache's host unit is `httpd.service`; it is disabled/stopped after cutover.
+Its configuration remains intact, but currently has a missing hiredis library
+required by mod_auth_openidc. An Apache rollback would first require repairing
+that dependency, then enabling the service and reverting only the komposthaufen
+route to `legacy-apache-service`. The `youtube.brunner.ninja` route is intentionally
+retained for a separate migration and remains unavailable while Apache is off.
+No old dedicated source repository exists for this host Apache service; remote
+repository archival is not applicable.
@@ -0,0 +1,106 @@
+# Latest chart still bundles an older application. Remove this tag-only
+# override when a newer chart supplies this release or later.
+image:
+  tag: "1.20.26"
+strategy:
+  type: Recreate
+extraPodLabels:
+  app.kubernetes.io/component: server
+nodeSelector:
+  kubernetes.io/hostname: arschrock
+  media.brunner.ninja/multimedia-ready: "true"
+tolerations:
+- key: node-role.kubernetes.io/control-plane
+  operator: Exists
+  effect: NoSchedule
+serviceAccount:
+  name: copyparty
+  automount: false
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  runAsNonRoot: true
+  capabilities:
+    drop: [ALL]
+podSecurityContext:
+  seccompProfile:
+    type: RuntimeDefault
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
+    ephemeral-storage: 128Mi
+  limits:
+    cpu: null
+    memory: 2Gi
+    ephemeral-storage: 1Gi
+app:
+  env:
+  - name: XDG_CONFIG_HOME
+    value: /state
+  args: []
+configMap:
+  data:
+    config.conf: |
+      [global]
+        p: 3923
+        http-only
+        rp-loc: /komposthaufen
+        xff-src: 10.0.0.0/16
+        xff-hdr: x-real-ip
+        rproxy: 1
+        hist: /state/hist
+        e2dsa
+        no-hash: .*
+        re-maxage: 3600
+        no-del
+        no-mv
+        unpost: 0
+        xvol
+        no-logues
+        no-readme
+        no-html
+      [/]
+        /komposthaufen
+        accs:
+          r: *
+volumeConfig:
+  appData:
+    volumeMount:
+      mountPath: /state
+    persistence:
+      enabled: true
+      pvcName: copyparty-index
+      size: 10Gi
+      storageClass: rook-ceph-block
+      volume:
+        persistentVolumeClaim:
+          claimName: copyparty-index
+  userData:
+    volumeMount:
+      mountPath: /komposthaufen
+      readOnly: true
+      recursiveReadOnly: Enabled
+    volume:
+      emptyDir: null
+      hostPath:
+        path: /komposthaufen
+        type: Directory
+  copypartyConfig:
+    volumeMount:
+      readOnly: true
+    volume:
+      secret: null
+      configMap:
+        name: copyparty-config
+readinessProbe:
+  httpGet:
+    path: /komposthaufen/?h
+  timeoutSeconds: 5
+livenessProbe:
+  httpGet:
+    path: /komposthaufen/?h
+    port: http
+  initialDelaySeconds: 90
+  periodSeconds: 30
+  timeoutSeconds: 10
+  failureThreshold: 5