authelia: Update to 4.39.6

This hacky work-around is no longer necessary, as I've figured out why
the players don't (always) get rediscovered when the server restarts.
It turns out, Avahi on the firewall was caching responses to the mDNS PTR
requests Music Assistant makes.  Rather than forward the requests to the
other VLANs, it would respond with its cached information, but in a way
that Music Assistant didn't understand.  Setting `cache-entries-max` to
`0` in `avahi-daemon.conf` on the firewall resolved the issue.

This reverts commit 42a7964991.

calico/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+labels:
+- pairs:
+    app.kubernetes.io/instance: calico
+
+resources:
+- https://raw.githubusercontent.com/projectcalico/calico/v3.30.2/manifests/operator-crds.yaml
+- https://raw.githubusercontent.com/projectcalico/calico/v3.30.2/manifests/tigera-operator.yaml

dch-webhooks/jenkins.yaml

@@ -0,0 +1,28 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: jenkins.dch-webhooks
+rules:
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    resourceNames:
+    - dch-webhooks
+    verbs:
+    - get
+    - patch
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: jenkins.dch-webhooks
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: jenkins.dch-webhooks
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: jenkins-jobs

music-assistant/ingress.yaml

@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: music-assistant
+  labels:
+    app.kubernetes.io/name: music-assistant
+    app.kubernetes.io/component: music-assistant
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: music.pyrocufflink.blue
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: music-assistant
+            port:
+              name: http

music-assistant/kustomization.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: music-assistant
+
+labels:
+- pairs:
+    app.kubernetes.io/instance: music-assistant
+  includeSelectors: true
+- pairs:
+    app.kubernetes.io/part-of: music-assistant
+  includeTemplates: true
+
+resources:
+- namespace.yaml
+- music-assistant.yaml
+- ingress.yaml
+
+images:
+- name: ghcr.io/music-assistant/server
+  newTag: 2.6.0b18

music-assistant/music-assistant.yaml

@@ -0,0 +1,78 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: music-assistant
+  labels: &labels
+    app.kubernetes.io/name: music-assistant
+    app.kubernetes.io/component: music-assistant
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: music-assistant
+  labels: &labels
+    app.kubernetes.io/name: music-assistant
+    app.kubernetes.io/component: music-assistant
+spec:
+  ports:
+  - port: 8095
+    name: http
+  selector: *labels
+
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: music-assistant
+  labels: &labels
+    app.kubernetes.io/name: music-assistant
+    app.kubernetes.io/component: music-assistant
+spec:
+  serviceName: music-assistant
+  selector:
+    matchLabels: *labels
+  template:
+    metadata:
+      labels: *labels
+    spec:
+      containers:
+      - name: music-assistant
+        image: ghcr.io/music-assistant/server
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 8095
+          name: http
+        readinessProbe: &probe
+          httpGet:
+            port: http
+            path: /
+          failureThreshold: 3
+          periodSeconds: 60
+          successThreshold: 1
+          timeoutSeconds: 1
+        startupProbe:
+          <<: *probe
+          failureThreshold: 90
+          periodSeconds: 1
+        volumeMounts:
+          - mountPath: /data
+            name: music-assistant-data
+            subPath: data
+      dnsPolicy: ClusterFirstWithHostNet
+      hostNetwork: true
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 8095
+        runAsGroup: 8095
+        fsGroup: 8095
+      volumes:
+      - name: music-assistant-data
+        persistentVolumeClaim:
+          claimName: music-assistant

music-assistant/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: music-assistant
+  labels:
+    app.kubernetes.io/name: music-assistant