feat(aiometadata): add optional poster reverse-proxy cache

[IbbyLabs]

Summary

Adds the optional poster reverse-proxy cache from AIOMetadata (upstream docs) to the existing aiometadata app. An nginx:alpine sidecar caches poster images on disk so repeated requests skip upstream latency; with AIOMetadata's cache warming, posters are served straight from disk. It exposes /health, /stats (cache size + image count) and /purge.

Everything lives inside apps/aiometadata/ (part of the same service) and is fully opt-in. It is wired through Authelia with page-specific protection — the same approach the template already uses for Stremio addon hosts:

• poster-cache service on its own poster-cache profile; its Traefik router carries the authelia@docker middleware.
• Authelia ACL (apps/authelia/compose.yaml + config/configuration.yml): /purge and /stats require two_factor, every other path (image fetches, /health) is bypass so Stremio can load posters without a login.
• DNS: POSTER_CACHE_HOSTNAME added to the root .env and to the cloudflare-ddns DOMAINS list.
• Sidecars poster-cache-nginx.conf, poster-cache-stats.sh, poster-cache-purge-handler.sh (the two scripts are committed executable — the entrypoint runs them via /stats.sh & and nc -lk -p 9888 -e /purge-handler.sh).
• The four POSTER_* addon vars are added commented-out in apps/aiometadata/.env; behaviour is unchanged unless the user opts in.

Enabling it

1. Add poster-cache to COMPOSE_PROFILES in the root .env.
2. Uncomment the POSTER_* vars in apps/aiometadata/.env.
3. docker compose up -d — DDNS publishes poster-cache.${DOMAIN}; Traefik + Authelia pick up the new host automatically.

Test plan

Validated locally on a fresh first deploy (wiped data dir):

poster-cache service (docker compose --profile poster-cache up -d)

• Starts clean (0 errors / 0 warnings); Docker healthcheck → healthy
• GET /health → 200 ok
• Caching: 1st request X-Cache-Status: MISS, 2nd HIT, identical 1.46 MB payload; cache persists to ${DOCKER_DATA_DIR}/poster-cache (levels=1:2, owned by nginx)
• Traefik double-slash handling: collapsed /https:/host/… resolves to the same cache entry as /https://host/…
• GET /stats → valid JSON, correct byte accounting; GET /purge → success (exercises the nc -e handler) and clears the cache

Authelia integration (full required stack up)

• Authelia starts healthy with the new ACL — config validates, no regression for required deployments
• forward-auth decisions for poster-cache.${DOMAIN}: /purge → 302 (2FA), /stats → 302 (2FA), /health → 200, /https://image… → 200, /purgexx → 200 (confirms ^/purge$ is exact-anchored, so only the real admin endpoints are protected)

Config

• docker compose config parses under required, aiometadata, cloudflare-ddns and poster-cache profiles; poster-cache is gated to poster-cache/all only

More details can be found here

Summary by CodeRabbit

• New Features
  • Added an optional, disk-cached poster delivery layer with persistent caching.
  • Enabled cache stats and manual purge endpoints for monitoring and maintenance.
  • Introduced POSTER_CACHE_HOSTNAME and documented poster reverse-proxy cache routing/warm-up options.
• Security
  • Extended access control so stats and purge endpoints are protected on the cache hostname.
• Operational Changes
  • Updated automated DNS updates to include the new poster-cache hostname.
  • Expanded the Redis service to include the additional all profile.