Keep arr health probes working with hostname restrictions

[MrStarktastic]

After the full cluster rebuild, Sonarr and Radarr RU repeatedly restarted despite completing database initialization and starting their HTTP servers. Their retained AllowedHosts settings rejected the pod-IP hostname used by Kubernetes probes: /ping returned HTTP 400, while the same pod-IP request with Host: localhost returned HTTP 200.

Both apps have since recovered after the user changed their live AllowedHosts settings to *. This PR is no longer an emergency recovery dependency; it lets health checks work with hostname restrictions enabled.

Set that stable Host header in the shared *arr startup, readiness and liveness probes. The pinned app-template chart only supports custom headers through custom: true, so the five base services move their existing numeric ports into spec.httpGet.port; Sonarr RU and Radarr RU continue inheriting their base values. Application hostname restrictions remain in place. A merge rolls out Sonarr, Sonarr RU, Radarr, Radarr RU, Lidarr, Prowlarr and Bazarr.

Validation:

• Rendered all seven applications with app-template 5.2.1 and their complete value layers. After normalizing Kubernetes defaults, all 21 probes differ only by the added Host header; ports, timing and every other rendered resource remain unchanged.
• Live endpoint checks confirm HTTP 200 with the header for all seven applications, including the two failing probes.
• Server-side dry-run admission accepted all seven Deployments; no live changes were applied.
• Pre-commit formatting/lint hooks and targeted yamllint passed.
• GitHub formatting, validation, ArgoCD diff preview and report checks all passed.

This corrects a hostname-filtering recovery failure; it does not establish that the separate SQLite-on-NFS issues are resolved.

[github-actions]

Static Validation

✅ YAML Lint: Passed
✅ Kubeconform: Passed

Summary

./infrastructure/system/crowdsec/manifests/crowdsec-secrets.yaml - SealedSecret crowdsec-secrets is valid
./infrastructure/controllers/authentik/manifests/ldap-outpost-service.yaml - Service ak-outpost-ldap-outpost is valid
./infrastructure/controllers/authentik/manifests/ldap-outpost-deployment.yaml - Deployment ak-outpost-ldap-outpost is valid
./infrastructure/system/intel-device-operator/manifests/gpu-device-plugin.yaml - intel-gpu GpuDevicePlugin skipped
Summary: 85 resources found in 78 files - Valid: 84, Invalid: 0, Errors: 0, Skipped: 1

✅ Homepage Coverage: Passed
✅ Alert Policy: Passed

---

Argo CD Diff Preview

Summary:

Modified (7):
± bazarr (+9|-9)
± lidarr (+9|-9)
± prowlarr (+9|-9)
± radarr (+9|-9)
± radarr-ru (+9|-9)
± sonarr (+9|-9)
± sonarr-ru (+9|-9)

bazarr (bootstrap/appsets/cluster-apps.yaml)

Deployment: media/bazarr

             name: bazarr-secret
         image: lscr.io/linuxserver/bazarr:v1.6.1-ls364@sha256:d24bd0048c759a468970989e9df11a6b96a7628d556d00f923e60a35ba59237b
         livenessProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 6767
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 10
           timeoutSeconds: 5
         name: main
         readinessProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 6767
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 10
           timeoutSeconds: 5
         resources:
           requests:
             cpu: 10m
             memory: 64Mi
         startupProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 6767
-            scheme: HTTP
-          initialDelaySeconds: 0
           periodSeconds: 5
-          timeoutSeconds: 1
         volumeMounts:
         - mountPath: /config
           name: config
         - mountPath: /data
           name: media

lidarr (bootstrap/appsets/cluster-apps.yaml)

Deployment: media/lidarr

           value: Asia/Jerusalem
         image: lscr.io/linuxserver/lidarr:3.1.0.4875-ls41@sha256:8ab0fd370b604ae034d9a9c261a9d8d873bece33d9736852e7ce4f3566e4a35d
         livenessProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 8686
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 10
           timeoutSeconds: 5
         name: main
         readinessProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 8686
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 10
           timeoutSeconds: 5
         resources:
           requests:
             cpu: 10m
             memory: 64Mi
         startupProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 8686
-            scheme: HTTP
-          initialDelaySeconds: 0
           periodSeconds: 5
-          timeoutSeconds: 1
         volumeMounts:
         - mountPath: /config
           name: config
         - mountPath: /data
           name: media

prowlarr (bootstrap/appsets/cluster-apps.yaml)

Deployment: media/prowlarr

           value: Asia/Jerusalem
         image: lscr.io/linuxserver/prowlarr:2.6.5.5623-ls161@sha256:c96b56d94d116a9f4de94bc23d3381689492e6c3cfb7435320e8d982e406f99a
         livenessProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 9696
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 10
           timeoutSeconds: 5
         name: main
         readinessProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 9696
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 10
           timeoutSeconds: 5
         resources:
           requests:
             cpu: 10m
             memory: 64Mi
         startupProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 9696
-            scheme: HTTP
-          initialDelaySeconds: 0
           periodSeconds: 5
-          timeoutSeconds: 1
         volumeMounts:
         - mountPath: /config
           name: config
       dnsPolicy: ClusterFirst
       enableServiceLinks: false

radarr (bootstrap/appsets/cluster-apps.yaml)

Deployment: media/radarr

           value: Asia/Jerusalem
         image: lscr.io/linuxserver/radarr:6.4.4.10685-ls317@sha256:c960f2b52ec6542dbe6707c5a21e696a7c74fd8b17997454f4d10a55dacee133
         livenessProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 7878
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 10
           timeoutSeconds: 5
         name: main
         readinessProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 7878
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 10
           timeoutSeconds: 5
         resources:
           requests:
             cpu: 10m
             memory: 64Mi
         startupProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 7878
-            scheme: HTTP
-          initialDelaySeconds: 0
           periodSeconds: 5
-          timeoutSeconds: 1
         volumeMounts:
         - mountPath: /config
           name: config
         - mountPath: /data
           name: media

radarr-ru (bootstrap/appsets/cluster-apps.yaml)

Deployment: media/radarr-ru

           value: Asia/Jerusalem
         image: lscr.io/linuxserver/radarr:6.4.4.10685-ls317@sha256:c960f2b52ec6542dbe6707c5a21e696a7c74fd8b17997454f4d10a55dacee133
         livenessProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 7878
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 10
           timeoutSeconds: 5
         name: main
         readinessProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 7878
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 10
           timeoutSeconds: 5
         resources:
           requests:
             cpu: 10m
             memory: 64Mi
         startupProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 7878
-            scheme: HTTP
-          initialDelaySeconds: 0
           periodSeconds: 5
-          timeoutSeconds: 1
         volumeMounts:
         - mountPath: /config
           name: config
         - mountPath: /data
           name: media

sonarr (bootstrap/appsets/cluster-apps.yaml)

Deployment: media/sonarr

           value: Asia/Jerusalem
         image: lscr.io/linuxserver/sonarr:4.0.20.3014-ls325@sha256:a5c1a5fecbef946927ab90ad68df319ac5fe644057e5fc18cd993f01ac07b2b2
         livenessProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 8989
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 10
           timeoutSeconds: 5
         name: main
         readinessProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 8989
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 10
           timeoutSeconds: 5
         resources:
           requests:
             cpu: 10m
             memory: 64Mi
         startupProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 8989
-            scheme: HTTP
-          initialDelaySeconds: 0
           periodSeconds: 5
-          timeoutSeconds: 1
         volumeMounts:
         - mountPath: /config
           name: config
         - mountPath: /data
           name: media

sonarr-ru (bootstrap/appsets/cluster-apps.yaml)

Deployment: media/sonarr-ru

           value: Asia/Jerusalem
         image: lscr.io/linuxserver/sonarr:4.0.20.3014-ls325@sha256:a5c1a5fecbef946927ab90ad68df319ac5fe644057e5fc18cd993f01ac07b2b2
         livenessProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 8989
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 10
           timeoutSeconds: 5
         name: main
         readinessProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 8989
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 10
           timeoutSeconds: 5
         resources:
           requests:
             cpu: 10m
             memory: 64Mi
         startupProbe:
           failureThreshold: 30
           httpGet:
+            httpHeaders:
+            - name: Host
+              value: localhost
             path: /ping
             port: 8989
-            scheme: HTTP
-          initialDelaySeconds: 0
           periodSeconds: 5
-          timeoutSeconds: 1
         volumeMounts:
         - mountPath: /config
           name: config
         - mountPath: /data
           name: media

Stats:
[Applications: 148], [Full Run: 1m46s], [Rendering: 48s], [Cluster: 21s], [Argo CD: 37s]