feat: install qbittorrent

willianpaixao · May 9, 2024 · 579c2a3 · 579c2a3
1 parent f643af7
commit 579c2a3
Show file tree

Hide file tree

Showing 7 changed files with 200 additions and 11 deletions.
diff --git a/kubernetes/apps/media/jellyfin/app/helmrelease.yaml b/kubernetes/apps/media/jellyfin/app/helmrelease.yaml
@@ -1,21 +1,21 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/app-template-3.1.0/charts/other/app-template/values.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: &app jellyfin
   namespace: &namespace media
 spec:
-  interval: 15m
+  interval: 30m
   chart:
     spec:
       chart: app-template
+      interval: 30m
       version: 3.1.0
       sourceRef:
         kind: HelmRepository
         name: bjw-s
         namespace: flux-system
-      interval: 15m
   install:
     remediation:
       retries: 3
@@ -29,13 +29,11 @@ spec:
       jellyfin:
         pod:
           securityContext:
-            runAsUser: 568
-            runAsGroup: 568
-            fsGroup: 568
-            fsGroupChangePolicy: OnRootMismatch
-            supplementalGroups:
-              - 44
-              - 109
+            runAsUser: 2000
+            runAsGroup: 2000
+            runAsNonRoot: true
+            fsGroup: 2000
+            fsGroupChangePolicy: "OnRootMismatch"
         containers:
           main:
             image:

diff --git a/kubernetes/apps/media/kustomization.yaml b/kubernetes/apps/media/kustomization.yaml
@@ -5,4 +5,5 @@ resources:
   - ./namespace.yaml
   - ./jellyfin/ks.yaml
   - ./prowlarr/ks.yaml
+  - ./qbittorrent/ks.yaml
   - ./radarr/ks.yaml
diff --git a/kubernetes/apps/media/qbittorrent/app/helmrelease.yaml b/kubernetes/apps/media/qbittorrent/app/helmrelease.yaml
@@ -0,0 +1,125 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  name: &app qbittorrent
+  namespace: &namespace media
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.1.0
+      interval: 30m
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      qbittorrent:
+        pod:
+          securityContext:
+            fsGroup: 2000
+            fsGroupChangePolicy: "OnRootMismatch"
+        containers:
+          app:
+            nameOverride: qbittorrent
+            image:
+              repository: ghcr.io/onedr0p/qbittorrent
+              tag: 4.6.4@sha256:b9af0f2173572a69d2c02eab8f701ef7b04f61689efe1c5338b96445d528dec4
+            env:
+              QBITTORRENT__PORT: &port 8080
+              QBITTORRENT__BT_PORT: &bittorrentPort 50413
+              TZ: ${TIMEZONE}
+              UMASK: "022"
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+              startup:
+                enabled: true
+                spec:
+                  failureThreshold: 30
+                  periodSeconds: 5
+            resources:
+              requests:
+                memory: 1Gi
+              limits:
+                memory: 4Gi
+            securityContext:
+              runAsUser: 2000
+              runAsGroup: 2000
+              runAsNonRoot: true
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities:
+                drop:
+                  - ALL
+          gluetun:
+            image:
+              repository: ghcr.io/qdm12/gluetun
+              tag: v3.38.0
+            env:
+              DOT: "off"
+              DNS_ADDRESS: 4.4.4.4
+              FIREWALL_INPUT_PORTS: 8080
+              FIREWALL_OUTBOUND_SUBNETS: 10.96.0.0/16 # Allow access to k8s subnets
+              SERVER_CATEGORIES: P2P
+              SERVER_COUNTRIES: Sweden
+              VPN_SERVICE_PROVIDER: nordvpn
+              VPN_TYPE: openvpn
+            envFrom:
+              - secretRef:
+                  name: qbittorrent-secret
+            securityContext:
+              capabilities:
+                add:
+                  - NET_ADMIN
+                  - SYS_MODULE
+    service:
+      app:
+        controller: qbittorrent
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        className: internal
+        hosts:
+          - host: &host qbittorrent.${SECRET_DOMAIN}
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+    persistence:
+      config:
+        enabled: true
+        type: emptyDir
+        advancedMounts:
+          qbittorrent:
+            app:
+              - path: /config
+      movies:
+        enabled: true
+        type: nfs
+        server: ${NFS_SERVER}
+        path: /movies
+        advancedMounts:
+          qbittorrent:
+            app:
+              - path: /media/movies
diff --git a/kubernetes/apps/media/qbittorrent/app/kustomization.yaml b/kubernetes/apps/media/qbittorrent/app/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
diff --git a/kubernetes/apps/media/qbittorrent/app/qbittorrent-secret.sops.yaml b/kubernetes/apps/media/qbittorrent/app/qbittorrent-secret.sops.yaml
@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: qbittorrent-secret
+    namespace: media
+type: Opaque
+data:
+    OPENVPN_USER: ENC[AES256_GCM,data:HNGNkhQZ3M6QBhYobO4xkVgr50qDPoIvdPXVWjDKNwI=,iv:7x2bQkzpe4DMVhrCICU3k2oIwnzT+HApMgVcvPJLzgo=,tag:wC1I+KyPUg4FF4nJ0MajhA==,type:str]
+    OPENVPN_PASSWORD: ENC[AES256_GCM,data:7f979TM15JeLnAE5ULu5/QH+SNF4+wWXLf2hWQNSizc=,iv:27CQ1ul2xtHOaQIuwbkycdq7fLPeXphm6k9XtDcX8FE=,tag:l0mk8DQpT7XZnq0cUXGaeg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age17ary36xtm566uptguuhsj7xmuqzyz06ce54tcf6p3mge2thphqfs3gln40
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhTDFibUdsTm1wcGo0K28v
+            TmY2WW1VT2lRTmRzSjVNc0JGS01IdElQYmh3CjJOMm9OaWhSdWdpS0g2QzVUenFW
+            TGdaN0d6WHFlREMzTXN3WklzT3FKNWsKLS0tIFpYRG1aYkJLZ0JuVnZvVHZXVm9N
+            VVpvRURjRy9vRnNlM2FpeFRhcnNLQ0kKQS07UEDVbd/O3xFudxAqY8Ie49WT3tH+
+            7/1kbNFdJza+KsyS67KM6ihITMCDNrytkcCf2KuXMnbvMX2Kfp6lDg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-05-09T13:54:30Z"
+    mac: ENC[AES256_GCM,data:JnxMnK9VL0B0ZExSIqA27gWt8eUP4Zrwj4PHNZ6aPnYNIgwIr5HmJIGLlFntjAphyh5Nnp24Lrk4MzFQWW4zAcFkwBceWJmuWWuM43NpP0DXEWSeEqfPlsJiBLSAdKcOIsI0RmIT7yFsYuJK0Ap8bCZTRWRo0RN+LTeM8L7T4Yk=,iv:0DH6toYp1rzVjvXxZXyovN7NEwi/exxPj9e5v997I1w=,tag:fCAmvtHnrfM6s2WSgS2mkw==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3
diff --git a/kubernetes/apps/media/qbittorrent/ks.yaml b/kubernetes/apps/media/qbittorrent/ks.yaml
@@ -0,0 +1,21 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app qbittorrent
+  namespace: flux-system
+spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/media/qbittorrent/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 15m
diff --git a/kubernetes/apps/media/radarr/app/helmrelease.yaml b/kubernetes/apps/media/radarr/app/helmrelease.yaml
@@ -3,7 +3,8 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
-  name: radarr
+  name: &app radarr
+  namespace: &namespace media
 spec:
   interval: 30m
   chart:
@@ -15,6 +16,14 @@ spec:
         kind: HelmRepository
         name: bjw-s
         namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
   values:
     controllers:
       radarr: