From 2a0794affc57c61ec75adfc67a7ba4ef3f169464 Mon Sep 17 00:00:00 2001
From: Astra Logical <booksandpi@gmail.com>
Date: Mon, 8 Jun 2026 10:16:03 -0400
Subject: [PATCH] Etcd revival

---
 services/jellyfin/jellyfin-ingress.yaml       | 28 +++++++++----------
 .../vault/keykeeper/keykeeper-deployment.yaml |  7 +++--
 services/vault/vault-statefulset.yaml         |  6 ++++
 3 files changed, 25 insertions(+), 16 deletions(-)

diff --git a/services/jellyfin/jellyfin-ingress.yaml b/services/jellyfin/jellyfin-ingress.yaml
index 9cd1b5c..a21b5d1 100644
--- a/services/jellyfin/jellyfin-ingress.yaml
+++ b/services/jellyfin/jellyfin-ingress.yaml
@@ -19,21 +19,21 @@ metadata:
     traefik.ingress.kubernetes.io/router.tls: "true"
     traefik.ingress.kubernetes.io/router.middlewares: default-jellyfin-proxy-headers@kubernetescrd
 spec:
-  tls:
-  - hosts:
-    - beak.mynest.love
-    secretName: jellyfin-tls
+  # tls:
+  # - hosts:
+  #   - beak.mynest.love
+  #   secretName: jellyfin-tls
   rules:
-  - host: beak.mynest.love
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: jellyfin
-            port:
-              name: http-web
+  # - host: beak.mynest.love
+  #   http:
+  #     paths:
+  #     - path: /
+  #       pathType: Prefix
+  #       backend:
+  #         service:
+  #           name: jellyfin
+  #           port:
+  #             name: http-web
   - host: jellyfin.k3s.home.nest
     http:
       paths:
diff --git a/services/vault/keykeeper/keykeeper-deployment.yaml b/services/vault/keykeeper/keykeeper-deployment.yaml
index d2d0c28..00e1d51 100644
--- a/services/vault/keykeeper/keykeeper-deployment.yaml
+++ b/services/vault/keykeeper/keykeeper-deployment.yaml
@@ -15,11 +15,14 @@ spec:
     spec:
       serviceAccountName: vault # Allows k8s auth for autounsealing
       nodeSelector:
-        app: keykeeper # Should be Robin/some non-server node with a /keykeeper local dir
+        app: keykeeper # Should be Robin/some non-server node with a /keykeeper local dir chowned by 100:100
       containers:
       - name: vault
         image: hashicorp/vault:latest
         args: ["server"]
+        securityContext:
+          capabilities:
+            add: ["IPC_LOCK"]
         env:
         - name: VAULT_LOCAL_CONFIG
           value: |
@@ -55,5 +58,5 @@ spec:
       volumes:
       - name: vault-data
         hostPath:
-          path: /vaultkeeper
+          path: /keykeeper
           type: DirectoryOrCreate
diff --git a/services/vault/vault-statefulset.yaml b/services/vault/vault-statefulset.yaml
index 93825f4..37641ab 100644
--- a/services/vault/vault-statefulset.yaml
+++ b/services/vault/vault-statefulset.yaml
@@ -53,6 +53,10 @@ spec:
               address=http://vault-keykeeper.vault.svc.cluster.local:80)
             
             sed "s/REPLACE_WITH_TOKEN/$TRANSIT_TOKEN/" /etc/vault/extraconfig-from-values.hcl > /vault/runtime/vault.hcl
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            add: ["IPC_LOCK"]
         env:
           - name: VAULT_ADDR
             value: "http://vault-keykeeper.vault.svc.cluster.local:80"
@@ -67,6 +71,8 @@ spec:
         args: ["server", "-config=/vault/runtime/vault.hcl"]
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            add: ["IPC_LOCK"]
         env:
         - name: POD_NAME
           valueFrom: