🔧 chore(deploy): co-deploy opds-sync in calibre-web namespace

Drop Authentik prereq, drop separate ingress (path-routed under CWA's
existing Ingress on ebooks.theficos.dedyn.io). Postgres renamed to
postgres-opds-sync to avoid namespace collisions. Operations doc replaced.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: vitofico

deploy/k8s/opds-sync/README.md

@@ -1,6 +1,16 @@
 # opds-sync deploy
 
-Apply order on first deploy:
+Co-deployed with Calibre-Web-Automated in the `calibre-web` namespace.
+opds-sync proxies user authentication to CWA.
+
+## Prerequisites
+
+- CWA running in the `calibre-web` namespace, exposing port 8083 to the
+  `app: calibre-web` pod label.
+- The Android client uses the same Basic credentials for CWA OPDS and
+  for opds-sync; no separate sign-in.
+
+## Apply order
 
 1. Create the encrypted secret (SOPS) and apply it:
 
@@ -15,19 +25,19 @@ Apply order on first deploy:
 
 3. Verify:
 
-       kubectl -n opds-sync rollout status deploy/opds-sync
-       curl https://sync.theficos.dedyn.io/sync/v1/healthz
-
-## Authentik prerequisite
+       kubectl -n calibre-web rollout status deploy/opds-sync
+       curl https://ebooks.theficos.dedyn.io/sync/v1/healthz
 
-Create an OAuth2 application in Authentik **before** deploying:
+## Adding the path rule to CWA's Ingress
 
-- Name: Quire
-- Slug: quire
-- Provider type: OAuth2/OpenID
-- Client type: **Public**
-- PKCE: required
-- Redirect URIs: `quire://oauth`
-- Audience: `quire`
+opds-sync is served by CWA's existing Ingress at `ebooks.theficos.dedyn.io`.
+Add this path rule to the CWA Ingress (in `theficos-cluster/applications/calibre-web/ingress.yaml`)
+**before** the catch-all `/` rule:
 
-The audience must match `OPDS_SYNC_AUTHENTIK_AUDIENCE`.
+    - path: /sync/
+      pathType: Prefix
+      backend:
+        service:
+          name: opds-sync
+          port:
+            number: 80

deploy/k8s/opds-sync/deployment.yaml

@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: opds-sync
-  namespace: opds-sync
+  namespace: calibre-web
 spec:
   replicas: 1
   selector:
@@ -28,10 +28,8 @@ spec:
           env:
             - name: OPDS_SYNC_DATABASE_URL
               valueFrom: { secretKeyRef: { name: opds-sync-secrets, key: database-url } }
-            - name: OPDS_SYNC_AUTHENTIK_ISSUER
-              valueFrom: { secretKeyRef: { name: opds-sync-secrets, key: authentik-issuer } }
-            - name: OPDS_SYNC_AUTHENTIK_AUDIENCE
-              valueFrom: { secretKeyRef: { name: opds-sync-secrets, key: authentik-audience } }
+            - name: OPDS_SYNC_CWA_BASE_URL
+              value: http://calibre-web.calibre-web.svc.cluster.local:8083
             - name: OPDS_SYNC_LOG_LEVEL
               value: INFO
           readinessProbe:

deploy/k8s/opds-sync/ingress.yaml

@@ -1,15 +1,13 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: opds-sync
+namespace: calibre-web
 
 resources:
-  - namespace.yaml
   - postgres-pvc.yaml
   - postgres-service.yaml
   - postgres-statefulset.yaml
   - service.yaml
   - deployment.yaml
-  - ingress.yaml
   - network-policies.yaml
 
 images:

deploy/k8s/opds-sync/kustomization.yaml

@@ -1,17 +1,8 @@
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
-metadata:
-  name: deny-all-default
-  namespace: opds-sync
-spec:
-  podSelector: {}
-  policyTypes: [Ingress, Egress]
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
 metadata:
   name: opds-sync-allow
-  namespace: opds-sync
+  namespace: calibre-web
 spec:
   podSelector:
     matchLabels:
@@ -28,24 +19,31 @@ spec:
     - to:
         - podSelector:
             matchLabels:
-              app: postgres
+              app: postgres-opds-sync
       ports:
         - port: 5432
+    # Talk to CWA in the same namespace.
+    - to:
+        - podSelector:
+            matchLabels:
+              app: calibre-web
+      ports:
+        - port: 8083
+    # DNS
     - to: []
       ports:
         - port: 53
           protocol: UDP
-        - port: 443
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
-  name: postgres-allow
-  namespace: opds-sync
+  name: postgres-opds-sync-allow
+  namespace: calibre-web
 spec:
   podSelector:
     matchLabels:
-      app: postgres
+      app: postgres-opds-sync
   policyTypes: [Ingress]
   ingress:
     - from:

deploy/k8s/opds-sync/namespace.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: opds-sync-postgres
-  namespace: opds-sync
+  namespace: calibre-web
 spec:
   accessModes: ["ReadWriteOnce"]
   resources:

deploy/k8s/opds-sync/network-policies.yaml

@@ -1,12 +1,12 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: postgres
-  namespace: opds-sync
+  name: postgres-opds-sync
+  namespace: calibre-web
 spec:
   type: ClusterIP
   selector:
-    app: postgres
+    app: postgres-opds-sync
   ports:
     - port: 5432
       targetPort: 5432

deploy/k8s/opds-sync/postgres-pvc.yaml

@@ -1,18 +1,18 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: postgres
-  namespace: opds-sync
+  name: postgres-opds-sync
+  namespace: calibre-web
 spec:
-  serviceName: postgres
+  serviceName: postgres-opds-sync
   replicas: 1
   selector:
     matchLabels:
-      app: postgres
+      app: postgres-opds-sync
   template:
     metadata:
       labels:
-        app: postgres
+        app: postgres-opds-sync
     spec:
       containers:
         - name: postgres

deploy/k8s/opds-sync/postgres-service.yaml

@@ -1,14 +1,12 @@
 # Template. Copy to secret.yaml, fill in, then `sops --encrypt --in-place secret.yaml`.
-# Apply manually: kubectl apply -f secret.yaml
+# Apply manually: sops --decrypt secret.yaml | kubectl apply -f -
 apiVersion: v1
 kind: Secret
 metadata:
   name: opds-sync-secrets
-  namespace: opds-sync
+  namespace: calibre-web
 type: Opaque
 stringData:
   postgres-user: opds_sync
   postgres-password: REPLACE_ME
-  database-url: postgresql+asyncpg://opds_sync:REPLACE_ME@postgres.opds-sync.svc.cluster.local:5432/opds_sync
-  authentik-issuer: https://auth.theficos.dedyn.io/application/o/quire/
-  authentik-audience: quire
+  database-url: postgresql+asyncpg://opds_sync:REPLACE_ME@postgres-opds-sync.calibre-web.svc.cluster.local:5432/opds_sync