unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Reduce media PR to jellyfin-only in its own namespace
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details

Browse Source 
Why:
Jellyfin ships and gets validated first, ahead of the rest of the media stack.
Scoping this PR to jellyfin alone keeps the initial rollout small and lets the
HA fork prove out against the real library before the download and manager apps
follow.

How:
- Drop sonarr, radarr, prowlarr, bazarr, nzbget, and jellyseerr and their shared
  media-apps foundation from this PR; they land in later PRs.
- Move jellyfin into its own jellyfin namespace and fold the namespace and the
  static mediafs PV plus its RWX claim into the jellyfin base.
- Keep the static CephFS PV bound to the in-use mediafs library with
  reclaimPolicy Retain and staticVolume true so nothing can reclaim it, mounted
  into jellyfin by the movies and tvseries subPaths; keep redis, the fresh RWX
  transcode scratch, the intel iGPU nodeSelector and i915 request, gateway, and
  httproute.
- Scope the media AppProject and ApplicationSet to the single jellyfin
  namespace and app, extensible as the remaining apps are added.
This commit is contained in:
Ben Vincent
2026-08-09 21:08:12 +10:00
parent a52a419dfd
commit 54c25be828
69 changed files with 24 additions and 1679 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/base/bazarr/deployment.yaml
-61
View File
@@ -1,61 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: bazarr
namespace: media-apps
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: bazarr
template:
metadata:
labels:
app: bazarr
spec:
securityContext:
fsGroup: 1000
containers:
- name: bazarr
image: ghcr.io/home-operations/bazarr:rolling
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 6767
protocol: TCP
env:
- name: TZ
value: Australia/Sydney
- name: PUID
value: "1000"
- name: PGID
value: "1000"
resources:
requests:
cpu: 50m
memory: 256Mi
limits:
cpu: "1"
memory: 1Gi
livenessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 5
periodSeconds: 10
volumeMounts:
- name: config
mountPath: /config
volumes:
- name: config
persistentVolumeClaim:
claimName: bazarr-config
apps/base/bazarr/gateway.yaml
-37
View File
@@ -1,37 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
labels:
traefik.io/instance: internal
annotations:
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: bazarr.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
external-dns.alpha.kubernetes.io/hostname: bazarr.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.4
name: bazarr
namespace: media-apps
spec:
gatewayClassName: traefik-internal
listeners:
- allowedRoutes:
namespaces:
from: Same
hostname: bazarr.k8s.syd1.au.unkin.net
name: http
port: 80
protocol: HTTP
- allowedRoutes:
namespaces:
from: Same
hostname: bazarr.k8s.syd1.au.unkin.net
name: https
port: 443
protocol: HTTPS
tls:
certificateRefs:
- group: ""
kind: Secret
name: bazarr-tls
mode: Terminate
apps/base/bazarr/httproute.yaml
-49
View File
@@ -1,49 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: http-redirect
namespace: media-apps
spec:
hostnames:
- bazarr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: bazarr
sectionName: http
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301
matches:
- path:
type: PathPrefix
value: /
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: bazarr
namespace: media-apps
spec:
hostnames:
- bazarr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: bazarr
sectionName: https
rules:
- backendRefs:
- group: ""
kind: Service
name: bazarr
port: 6767
weight: 1
matches:
- path:
type: PathPrefix
value: /
apps/base/bazarr/kustomization.yaml
-10
View File
@@ -1,10 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- pvc.yaml
- deployment.yaml
- service.yaml
- gateway.yaml
- httproute.yaml
apps/base/bazarr/pvc.yaml
-14
View File
@@ -1,14 +0,0 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: bazarr-config
namespace: media-apps
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: cephrbd-fast-delete
volumeMode: Filesystem
apps/base/bazarr/service.yaml
-15
View File
@@ -1,15 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: bazarr
namespace: media-apps
spec:
type: ClusterIP
selector:
app: bazarr
ports:
- name: http
port: 6767
targetPort: http
protocol: TCP
apps/base/jellyfin/deployment.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ apiVersion: apps/v1
kind: Deployment
metadata:
name: jellyfin
namespace: media-apps
namespace: jellyfin
spec:
# Single-replica for now. The jellyfin-ha fork adds the Redis transcode store
# and RWX transcode scratch that make scaling to true HA a follow-up.
apps/base/jellyfin/gateway.yaml
+1 -1
View File
@@ -11,7 +11,7 @@ metadata:
external-dns.alpha.kubernetes.io/hostname: jellyfin.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.4
name: jellyfin
namespace: media-apps
namespace: jellyfin
spec:
gatewayClassName: traefik-internal
listeners:
apps/base/jellyfin/httproute.yaml
+2 -2
View File
@@ -3,7 +3,7 @@ apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: http-redirect
namespace: media-apps
namespace: jellyfin
spec:
hostnames:
- jellyfin.k8s.syd1.au.unkin.net
@@ -27,7 +27,7 @@ apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: jellyfin
namespace: media-apps
namespace: jellyfin
spec:
hostnames:
- jellyfin.k8s.syd1.au.unkin.net
apps/base/jellyfin/kustomization.yaml
+3
View File
@@ -3,6 +3,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- pv_media-library.yaml
- pvc_media-library.yaml
- pvc_config.yaml
- pvc_cache.yaml
- pvc_transcode.yaml
apps/base/media-apps/namespace.yaml → apps/base/jellyfin/namespace.yaml
+1 -1
View File
@@ -2,4 +2,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: media-apps
name: jellyfin
apps/base/media-apps/pv_media-library.yaml → apps/base/jellyfin/pv_media-library.yaml
+3 -3
View File
@@ -9,7 +9,7 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: media-apps-media-library
name: jellyfin-media-library
spec:
accessModes:
- ReadWriteMany
@@ -24,10 +24,10 @@ spec:
apiVersion: v1
kind: PersistentVolumeClaim
name: media-library
namespace: media-apps
namespace: jellyfin
csi:
driver: cephfs.csi.ceph.com
volumeHandle: media-apps-media-library-static
volumeHandle: jellyfin-media-library-static
nodeStageSecretRef:
name: csi-cephfs-secret
namespace: csi-cephfs
apps/base/jellyfin/pvc_cache.yaml
+1 -1
View File
@@ -4,7 +4,7 @@ apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: jellyfin-cache
namespace: media-apps
namespace: jellyfin
spec:
accessModes:
- ReadWriteOnce
apps/base/jellyfin/pvc_config.yaml
+1 -1
View File
@@ -4,7 +4,7 @@ apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: jellyfin-config
namespace: media-apps
namespace: jellyfin
spec:
accessModes:
- ReadWriteOnce
apps/base/media-apps/pvc_media-library.yaml → apps/base/jellyfin/pvc_media-library.yaml
+2 -2
View File
@@ -7,12 +7,12 @@ apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: media-library
namespace: media-apps
namespace: jellyfin
spec:
accessModes:
- ReadWriteMany
storageClassName: ""
volumeName: media-apps-media-library
volumeName: jellyfin-media-library
resources:
requests:
storage: 10Ti
apps/base/jellyfin/pvc_transcode.yaml
+1 -1
View File
@@ -6,7 +6,7 @@ apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: jellyfin-transcode
namespace: media-apps
namespace: jellyfin
spec:
accessModes:
- ReadWriteMany
apps/base/jellyfin/redis-deployment.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ apiVersion: apps/v1
kind: Deployment
metadata:
name: jellyfin-redis
namespace: media-apps
namespace: jellyfin
spec:
replicas: 1
strategy:
apps/base/jellyfin/redis-pvc.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: jellyfin-redis-data
namespace: media-apps
namespace: jellyfin
spec:
accessModes:
- ReadWriteOnce
apps/base/jellyfin/redis-service.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ apiVersion: v1
kind: Service
metadata:
name: jellyfin-redis
namespace: media-apps
namespace: jellyfin
spec:
type: ClusterIP
internalTrafficPolicy: Cluster
apps/base/jellyfin/service.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ apiVersion: v1
kind: Service
metadata:
name: jellyfin
namespace: media-apps
namespace: jellyfin
spec:
type: ClusterIP
internalTrafficPolicy: Cluster
apps/base/jellyseerr/deployment.yaml
-61
View File
@@ -1,61 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: jellyseerr
namespace: media-apps
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: jellyseerr
template:
metadata:
labels:
app: jellyseerr
spec:
securityContext:
fsGroup: 1000
containers:
- name: jellyseerr
image: ghcr.io/fallenbagel/jellyseerr:latest
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 5055
protocol: TCP
env:
- name: TZ
value: Australia/Sydney
- name: LOG_LEVEL
value: debug
- name: PORT
value: "5055"
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: "1"
memory: 1Gi
livenessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 5
periodSeconds: 10
volumeMounts:
- name: config
mountPath: /app/config
volumes:
- name: config
persistentVolumeClaim:
claimName: jellyseerr-config
apps/base/jellyseerr/gateway.yaml
-37
View File
@@ -1,37 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
labels:
traefik.io/instance: internal
annotations:
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: jellyseerr.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
external-dns.alpha.kubernetes.io/hostname: jellyseerr.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.4
name: jellyseerr
namespace: media-apps
spec:
gatewayClassName: traefik-internal
listeners:
- allowedRoutes:
namespaces:
from: Same
hostname: jellyseerr.k8s.syd1.au.unkin.net
name: http
port: 80
protocol: HTTP
- allowedRoutes:
namespaces:
from: Same
hostname: jellyseerr.k8s.syd1.au.unkin.net
name: https
port: 443
protocol: HTTPS
tls:
certificateRefs:
- group: ""
kind: Secret
name: jellyseerr-tls
mode: Terminate
apps/base/jellyseerr/httproute.yaml
-49
View File
@@ -1,49 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: http-redirect
namespace: media-apps
spec:
hostnames:
- jellyseerr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: jellyseerr
sectionName: http
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301
matches:
- path:
type: PathPrefix
value: /
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: jellyseerr
namespace: media-apps
spec:
hostnames:
- jellyseerr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: jellyseerr
sectionName: https
rules:
- backendRefs:
- group: ""
kind: Service
name: jellyseerr
port: 5055
weight: 1
matches:
- path:
type: PathPrefix
value: /
apps/base/jellyseerr/kustomization.yaml
-10
View File
@@ -1,10 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- pvc.yaml
- deployment.yaml
- service.yaml
- gateway.yaml
- httproute.yaml
apps/base/jellyseerr/pvc.yaml
-14
View File
@@ -1,14 +0,0 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: jellyseerr-config
namespace: media-apps
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: cephrbd-fast-delete
volumeMode: Filesystem
apps/base/jellyseerr/service.yaml
-15
View File
@@ -1,15 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: jellyseerr
namespace: media-apps
spec:
type: ClusterIP
selector:
app: jellyseerr
ports:
- name: http
port: 5055
targetPort: http
protocol: TCP
apps/base/media-apps/kustomization.yaml
-10
View File
@@ -1,10 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- serviceaccount.yaml
- vaultauth.yaml
- pv_media-library.yaml
- pvc_media-library.yaml
apps/base/media-apps/serviceaccount.yaml
-12
View File
@@ -1,12 +0,0 @@
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: media-apps-vault-reader
namespace: media-apps
labels:
app.kubernetes.io/name: vault-reader
app.kubernetes.io/component: service-account
annotations:
vault.hashicorp.com/auth-method: kubernetes
automountServiceAccountToken: true
apps/base/media-apps/vaultauth.yaml
-18
View File
@@ -1,18 +0,0 @@
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
name: default
namespace: media-apps
spec:
allowedNamespaces:
- media-apps
kubernetes:
audiences:
- vault
role: media-apps
serviceAccount: media-apps-vault-reader
tokenExpirationSeconds: 600
method: kubernetes
mount: k8s/au/syd1
vaultConnectionRef: vso-system/default
apps/base/nzbget/deployment.yaml
-80
View File
@@ -1,80 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: nzbget
namespace: media-apps
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: nzbget
template:
metadata:
labels:
app: nzbget
spec:
securityContext:
fsGroup: 1000
containers:
- name: nzbget
image: ghcr.io/home-operations/nzbget:rolling
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 6789
protocol: TCP
env:
- name: TZ
value: Australia/Sydney
- name: PUID
value: "1000"
- name: PGID
value: "1000"
- name: NZBGET_USER
valueFrom:
secretKeyRef:
name: nzbget-secrets
key: NZBGET_USER
- name: NZBGET_PASS
valueFrom:
secretKeyRef:
name: nzbget-secrets
key: NZBGET_PASS
resources:
requests:
cpu: 100m
memory: 512Mi
limits:
cpu: "4"
memory: 8Gi
livenessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 5
periodSeconds: 10
volumeMounts:
- name: config
mountPath: /config
- name: media-library
mountPath: /mnt/movies
subPath: movies
- name: media-library
mountPath: /mnt/tvseries
subPath: tvseries
volumes:
- name: config
persistentVolumeClaim:
claimName: nzbget-config
- name: media-library
persistentVolumeClaim:
claimName: media-library
apps/base/nzbget/gateway.yaml
-37
View File
@@ -1,37 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
labels:
traefik.io/instance: internal
annotations:
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: nzbget.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
external-dns.alpha.kubernetes.io/hostname: nzbget.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.4
name: nzbget
namespace: media-apps
spec:
gatewayClassName: traefik-internal
listeners:
- allowedRoutes:
namespaces:
from: Same
hostname: nzbget.k8s.syd1.au.unkin.net
name: http
port: 80
protocol: HTTP
- allowedRoutes:
namespaces:
from: Same
hostname: nzbget.k8s.syd1.au.unkin.net
name: https
port: 443
protocol: HTTPS
tls:
certificateRefs:
- group: ""
kind: Secret
name: nzbget-tls
mode: Terminate
apps/base/nzbget/httproute.yaml
-49
View File
@@ -1,49 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: http-redirect
namespace: media-apps
spec:
hostnames:
- nzbget.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: nzbget
sectionName: http
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301
matches:
- path:
type: PathPrefix
value: /
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: nzbget
namespace: media-apps
spec:
hostnames:
- nzbget.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: nzbget
sectionName: https
rules:
- backendRefs:
- group: ""
kind: Service
name: nzbget
port: 6789
weight: 1
matches:
- path:
type: PathPrefix
value: /
apps/base/nzbget/kustomization.yaml
-11
View File
@@ -1,11 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- pvc.yaml
- vaultstaticsecret.yaml
- deployment.yaml
- service.yaml
- gateway.yaml
- httproute.yaml
apps/base/nzbget/pvc.yaml
-14
View File
@@ -1,14 +0,0 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nzbget-config
namespace: media-apps
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: cephrbd-fast-delete
volumeMode: Filesystem
apps/base/nzbget/service.yaml
-15
View File
@@ -1,15 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: nzbget
namespace: media-apps
spec:
type: ClusterIP
selector:
app: nzbget
ports:
- name: http
port: 6789
targetPort: http
protocol: TCP
apps/base/nzbget/vaultstaticsecret.yaml
-18
View File
@@ -1,18 +0,0 @@
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: nzbget
namespace: media-apps
spec:
destination:
create: true
name: nzbget-secrets
mount: kv
path: service/media-apps/nzbget
refreshAfter: 30s
type: kv-v2
vaultAuthRef: default
rolloutRestartTargets:
- kind: Deployment
name: nzbget
apps/base/prowlarr/configmap.yaml
-25
View File
@@ -1,25 +0,0 @@
---
apiVersion: v1
kind: ConfigMap
metadata:
name: prowlarr-config-xml
namespace: media-apps
data:
config.xml: |
<Config>
<BindAddress>*</BindAddress>
<Port>9696</Port>
<SslPort>9898</SslPort>
<EnableSsl>False</EnableSsl>
<LaunchBrowser>True</LaunchBrowser>
<ApiKey>{{API_KEY}}</ApiKey>
<AuthenticationMethod>External</AuthenticationMethod>
<AuthenticationRequired>Enabled</AuthenticationRequired>
<LogLevel>info</LogLevel>
<SslCertPath></SslCertPath>
<SslCertPassword></SslCertPassword>
<UrlBase></UrlBase>
<InstanceName>prowlarr</InstanceName>
<UpdateMechanism>Docker</UpdateMechanism>
<AnalyticsEnabled>False</AnalyticsEnabled>
</Config>
apps/base/prowlarr/deployment.yaml
-136
View File
@@ -1,136 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: prowlarr
namespace: media-apps
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: prowlarr
template:
metadata:
labels:
app: prowlarr
spec:
securityContext:
fsGroup: 1000
initContainers:
- name: config-template
image: busybox:latest
imagePullPolicy: IfNotPresent
command: ["/bin/sh"]
args:
- -c
- |
cp /config-template/config.xml /config/config.xml
sed -i "s/{{API_KEY}}/$API_KEY/g" /config/config.xml
env:
- name: API_KEY
valueFrom:
secretKeyRef:
name: prowlarr-secrets
key: apitoken
securityContext:
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
volumeMounts:
- name: config-template
mountPath: /config-template
- name: config
mountPath: /config
containers:
- name: prowlarr
image: ghcr.io/home-operations/prowlarr:rolling
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 9696
protocol: TCP
env:
- name: TZ
value: Australia/Sydney
- name: PUID
value: "1000"
- name: PGID
value: "1000"
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: "1"
memory: 1Gi
livenessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 5
periodSeconds: 10
volumeMounts:
- name: config
mountPath: /config
- name: exportarr
image: ghcr.io/onedr0p/exportarr:latest
imagePullPolicy: IfNotPresent
args: ["prowlarr"]
ports:
- name: metrics
containerPort: 9707
protocol: TCP
env:
- name: TZ
value: Australia/Sydney
- name: PORT
value: "9707"
- name: URL
value: "http://localhost:9696"
- name: API_KEY
valueFrom:
secretKeyRef:
name: prowlarr-secrets
key: apitoken
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: 250m
memory: 256Mi
securityContext:
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
livenessProbe:
httpGet:
path: /metrics
port: metrics
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /metrics
port: metrics
initialDelaySeconds: 5
periodSeconds: 10
volumeMounts:
- name: config
mountPath: /config
readOnly: true
volumes:
- name: config
persistentVolumeClaim:
claimName: prowlarr-config
- name: config-template
configMap:
name: prowlarr-config-xml
apps/base/prowlarr/gateway.yaml
-37
View File
@@ -1,37 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
labels:
traefik.io/instance: internal
annotations:
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: prowlarr.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
external-dns.alpha.kubernetes.io/hostname: prowlarr.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.4
name: prowlarr
namespace: media-apps
spec:
gatewayClassName: traefik-internal
listeners:
- allowedRoutes:
namespaces:
from: Same
hostname: prowlarr.k8s.syd1.au.unkin.net
name: http
port: 80
protocol: HTTP
- allowedRoutes:
namespaces:
from: Same
hostname: prowlarr.k8s.syd1.au.unkin.net
name: https
port: 443
protocol: HTTPS
tls:
certificateRefs:
- group: ""
kind: Secret
name: prowlarr-tls
mode: Terminate
apps/base/prowlarr/httproute.yaml
-49
View File
@@ -1,49 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: http-redirect
namespace: media-apps
spec:
hostnames:
- prowlarr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: prowlarr
sectionName: http
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301
matches:
- path:
type: PathPrefix
value: /
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: prowlarr
namespace: media-apps
spec:
hostnames:
- prowlarr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: prowlarr
sectionName: https
rules:
- backendRefs:
- group: ""
kind: Service
name: prowlarr
port: 9696
weight: 1
matches:
- path:
type: PathPrefix
value: /
apps/base/prowlarr/kustomization.yaml
-12
View File
@@ -1,12 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- pvc.yaml
- configmap.yaml
- vaultstaticsecret.yaml
- deployment.yaml
- service.yaml
- gateway.yaml
- httproute.yaml
apps/base/prowlarr/pvc.yaml
-14
View File
@@ -1,14 +0,0 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: prowlarr-config
namespace: media-apps
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: cephrbd-fast-delete
volumeMode: Filesystem
apps/base/prowlarr/service.yaml
-30
View File
@@ -1,30 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: prowlarr
namespace: media-apps
spec:
type: ClusterIP
selector:
app: prowlarr
ports:
- name: http
port: 9696
targetPort: http
protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
name: prowlarr-metrics
namespace: media-apps
spec:
type: ClusterIP
selector:
app: prowlarr
ports:
- name: metrics
port: 9707
targetPort: metrics
protocol: TCP
apps/base/prowlarr/vaultstaticsecret.yaml
-18
View File
@@ -1,18 +0,0 @@
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: prowlarr
namespace: media-apps
spec:
destination:
create: true
name: prowlarr-secrets
mount: kv
path: service/media-apps/prowlarr
refreshAfter: 30s
type: kv-v2
vaultAuthRef: default
rolloutRestartTargets:
- kind: Deployment
name: prowlarr
apps/base/radarr/configmap.yaml
-25
View File
@@ -1,25 +0,0 @@
---
apiVersion: v1
kind: ConfigMap
metadata:
name: radarr-config-xml
namespace: media-apps
data:
config.xml: |
<Config>
<BindAddress>*</BindAddress>
<Port>7878</Port>
<SslPort>9898</SslPort>
<EnableSsl>False</EnableSsl>
<LaunchBrowser>True</LaunchBrowser>
<ApiKey>{{API_KEY}}</ApiKey>
<AuthenticationMethod>External</AuthenticationMethod>
<AuthenticationRequired>Enabled</AuthenticationRequired>
<LogLevel>debug</LogLevel>
<SslCertPath></SslCertPath>
<SslCertPassword></SslCertPassword>
<UrlBase></UrlBase>
<InstanceName>Radarr</InstanceName>
<UpdateMechanism>Docker</UpdateMechanism>
<AnalyticsEnabled>False</AnalyticsEnabled>
</Config>
apps/base/radarr/deployment.yaml
-140
View File
@@ -1,140 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: radarr
namespace: media-apps
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: radarr
template:
metadata:
labels:
app: radarr
spec:
securityContext:
fsGroup: 1000
initContainers:
- name: config-template
image: busybox:latest
imagePullPolicy: IfNotPresent
command: ["/bin/sh"]
args:
- -c
- |
cp /config-template/config.xml /config/config.xml
sed -i "s/{{API_KEY}}/$API_KEY/g" /config/config.xml
env:
- name: API_KEY
valueFrom:
secretKeyRef:
name: radarr-secrets
key: apitoken
securityContext:
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
volumeMounts:
- name: config-template
mountPath: /config-template
- name: config
mountPath: /config
containers:
- name: radarr
image: ghcr.io/home-operations/radarr:rolling
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 7878
protocol: TCP
env:
- name: TZ
value: Australia/Sydney
- name: PORT
value: "7878"
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: "1"
memory: 1Gi
livenessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 5
periodSeconds: 10
volumeMounts:
- name: config
mountPath: /config
- name: media-library
mountPath: /mnt/movies
subPath: movies
- name: exportarr
image: ghcr.io/onedr0p/exportarr:latest
imagePullPolicy: IfNotPresent
args: ["radarr"]
ports:
- name: metrics
containerPort: 9707
protocol: TCP
env:
- name: TZ
value: Australia/Sydney
- name: PORT
value: "9707"
- name: URL
value: "http://localhost:7878"
- name: API_KEY
valueFrom:
secretKeyRef:
name: radarr-secrets
key: apitoken
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: 250m
memory: 256Mi
securityContext:
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
livenessProbe:
httpGet:
path: /metrics
port: metrics
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /metrics
port: metrics
initialDelaySeconds: 5
periodSeconds: 10
volumeMounts:
- name: config
mountPath: /config
readOnly: true
volumes:
- name: config
persistentVolumeClaim:
claimName: radarr-config
- name: config-template
configMap:
name: radarr-config-xml
- name: media-library
persistentVolumeClaim:
claimName: media-library
apps/base/radarr/gateway.yaml
-37
View File
@@ -1,37 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
labels:
traefik.io/instance: internal
annotations:
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: radarr.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
external-dns.alpha.kubernetes.io/hostname: radarr.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.4
name: radarr
namespace: media-apps
spec:
gatewayClassName: traefik-internal
listeners:
- allowedRoutes:
namespaces:
from: Same
hostname: radarr.k8s.syd1.au.unkin.net
name: http
port: 80
protocol: HTTP
- allowedRoutes:
namespaces:
from: Same
hostname: radarr.k8s.syd1.au.unkin.net
name: https
port: 443
protocol: HTTPS
tls:
certificateRefs:
- group: ""
kind: Secret
name: radarr-tls
mode: Terminate
apps/base/radarr/httproute.yaml
-49
View File
@@ -1,49 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: http-redirect
namespace: media-apps
spec:
hostnames:
- radarr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: radarr
sectionName: http
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301
matches:
- path:
type: PathPrefix
value: /
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: radarr
namespace: media-apps
spec:
hostnames:
- radarr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: radarr
sectionName: https
rules:
- backendRefs:
- group: ""
kind: Service
name: radarr
port: 7878
weight: 1
matches:
- path:
type: PathPrefix
value: /
apps/base/radarr/kustomization.yaml
-12
View File
@@ -1,12 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- pvc.yaml
- configmap.yaml
- vaultstaticsecret.yaml
- deployment.yaml
- service.yaml
- gateway.yaml
- httproute.yaml
apps/base/radarr/pvc.yaml
-14
View File
@@ -1,14 +0,0 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: radarr-config
namespace: media-apps
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: cephrbd-fast-delete
volumeMode: Filesystem
apps/base/radarr/service.yaml
-30
View File
@@ -1,30 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: radarr
namespace: media-apps
spec:
type: ClusterIP
selector:
app: radarr
ports:
- name: http
port: 7878
targetPort: http
protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
name: radarr-metrics
namespace: media-apps
spec:
type: ClusterIP
selector:
app: radarr
ports:
- name: metrics
port: 9707
targetPort: metrics
protocol: TCP
apps/base/radarr/vaultstaticsecret.yaml
-18
View File
@@ -1,18 +0,0 @@
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: radarr
namespace: media-apps
spec:
destination:
create: true
name: radarr-secrets
mount: kv
path: service/media-apps/radarr
refreshAfter: 30s
type: kv-v2
vaultAuthRef: default
rolloutRestartTargets:
- kind: Deployment
name: radarr
apps/base/sonarr/configmap.yaml
-25
View File
@@ -1,25 +0,0 @@
---
apiVersion: v1
kind: ConfigMap
metadata:
name: sonarr-config-xml
namespace: media-apps
data:
config.xml: |
<Config>
<BindAddress>*</BindAddress>
<Port>8989</Port>
<SslPort>9898</SslPort>
<EnableSsl>False</EnableSsl>
<LaunchBrowser>True</LaunchBrowser>
<ApiKey>{{API_KEY}}</ApiKey>
<AuthenticationMethod>External</AuthenticationMethod>
<AuthenticationRequired>Enabled</AuthenticationRequired>
<LogLevel>info</LogLevel>
<SslCertPath></SslCertPath>
<SslCertPassword></SslCertPassword>
<UrlBase></UrlBase>
<InstanceName>Sonarr</InstanceName>
<UpdateMechanism>Docker</UpdateMechanism>
<AnalyticsEnabled>False</AnalyticsEnabled>
</Config>
apps/base/sonarr/deployment.yaml
-140
View File
@@ -1,140 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: sonarr
namespace: media-apps
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: sonarr
template:
metadata:
labels:
app: sonarr
spec:
securityContext:
fsGroup: 1000
initContainers:
- name: config-template
image: busybox:latest
imagePullPolicy: IfNotPresent
command: ["/bin/sh"]
args:
- -c
- |
cp /config-template/config.xml /config/config.xml
sed -i "s/{{API_KEY}}/$API_KEY/g" /config/config.xml
env:
- name: API_KEY
valueFrom:
secretKeyRef:
name: sonarr-secrets
key: apitoken
securityContext:
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
volumeMounts:
- name: config-template
mountPath: /config-template
- name: config
mountPath: /config
containers:
- name: sonarr
image: ghcr.io/home-operations/sonarr:rolling
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 8989
protocol: TCP
env:
- name: TZ
value: Australia/Sydney
- name: PORT
value: "8989"
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: "1"
memory: 1Gi
livenessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 5
periodSeconds: 10
volumeMounts:
- name: config
mountPath: /config
- name: media-library
mountPath: /mnt/tvseries
subPath: tvseries
- name: exportarr
image: ghcr.io/onedr0p/exportarr:latest
imagePullPolicy: IfNotPresent
args: ["sonarr"]
ports:
- name: metrics
containerPort: 9707
protocol: TCP
env:
- name: TZ
value: Australia/Sydney
- name: PORT
value: "9707"
- name: URL
value: "http://localhost:8989"
- name: API_KEY
valueFrom:
secretKeyRef:
name: sonarr-secrets
key: apitoken
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: 250m
memory: 256Mi
securityContext:
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
livenessProbe:
httpGet:
path: /metrics
port: metrics
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /metrics
port: metrics
initialDelaySeconds: 5
periodSeconds: 10
volumeMounts:
- name: config
mountPath: /config
readOnly: true
volumes:
- name: config
persistentVolumeClaim:
claimName: sonarr-config
- name: config-template
configMap:
name: sonarr-config-xml
- name: media-library
persistentVolumeClaim:
claimName: media-library
apps/base/sonarr/gateway.yaml
-37
View File
@@ -1,37 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
labels:
traefik.io/instance: internal
annotations:
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: sonarr.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
external-dns.alpha.kubernetes.io/hostname: sonarr.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.4
name: sonarr
namespace: media-apps
spec:
gatewayClassName: traefik-internal
listeners:
- allowedRoutes:
namespaces:
from: Same
hostname: sonarr.k8s.syd1.au.unkin.net
name: http
port: 80
protocol: HTTP
- allowedRoutes:
namespaces:
from: Same
hostname: sonarr.k8s.syd1.au.unkin.net
name: https
port: 443
protocol: HTTPS
tls:
certificateRefs:
- group: ""
kind: Secret
name: sonarr-tls
mode: Terminate
apps/base/sonarr/httproute.yaml
-49
View File
@@ -1,49 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: http-redirect
namespace: media-apps
spec:
hostnames:
- sonarr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: sonarr
sectionName: http
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301
matches:
- path:
type: PathPrefix
value: /
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: sonarr
namespace: media-apps
spec:
hostnames:
- sonarr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: sonarr
sectionName: https
rules:
- backendRefs:
- group: ""
kind: Service
name: sonarr
port: 8989
weight: 1
matches:
- path:
type: PathPrefix
value: /
apps/base/sonarr/kustomization.yaml
-12
View File
@@ -1,12 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- pvc.yaml
- configmap.yaml
- vaultstaticsecret.yaml
- deployment.yaml
- service.yaml
- gateway.yaml
- httproute.yaml
apps/base/sonarr/pvc.yaml
-14
View File
@@ -1,14 +0,0 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: sonarr-config
namespace: media-apps
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: cephrbd-fast-delete
volumeMode: Filesystem
apps/base/sonarr/service.yaml
-30
View File
@@ -1,30 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: sonarr
namespace: media-apps
spec:
type: ClusterIP
selector:
app: sonarr
ports:
- name: http
port: 8989
targetPort: http
protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
name: sonarr-metrics
namespace: media-apps
spec:
type: ClusterIP
selector:
app: sonarr
ports:
- name: metrics
port: 9707
targetPort: metrics
protocol: TCP
apps/base/sonarr/vaultstaticsecret.yaml
-18
View File
@@ -1,18 +0,0 @@
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: sonarr
namespace: media-apps
spec:
destination:
create: true
name: sonarr-secrets
mount: kv
path: service/media-apps/sonarr
refreshAfter: 30s
type: kv-v2
vaultAuthRef: default
rolloutRestartTargets:
- kind: Deployment
name: sonarr
apps/overlays/au-syd1/bazarr/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../base/bazarr
apps/overlays/au-syd1/jellyseerr/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../base/jellyseerr
apps/overlays/au-syd1/media-apps/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../base/media-apps
apps/overlays/au-syd1/nzbget/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../base/nzbget
apps/overlays/au-syd1/prowlarr/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../base/prowlarr
apps/overlays/au-syd1/radarr/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../base/radarr
apps/overlays/au-syd1/sonarr/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../base/sonarr
argocd/applicationsets/media.yaml
+2 -11
View File
@@ -10,16 +10,8 @@ spec:
repoURL: https://git.unkin.net/unkin/argocd-apps
revision: HEAD
directories:
# Shared foundation: media-apps namespace, vault-reader SA, VaultAuth,
# and the RWX movies/tvseries library PVCs the whole stack mounts.
- path: apps/overlays/*/media-apps
# jellyfin only for now; downloads/managers apps join in later PRs.
- path: apps/overlays/*/jellyfin
- path: apps/overlays/*/sonarr
- path: apps/overlays/*/radarr
- path: apps/overlays/*/prowlarr
- path: apps/overlays/*/bazarr
- path: apps/overlays/*/nzbget
- path: apps/overlays/*/jellyseerr
template:
metadata:
name: 'media-{{path[3]}}'
@@ -31,8 +23,7 @@ spec:
path: '{{path}}'
destination:
server: https://kubernetes.default.svc
# All media apps share the media-apps namespace (not the dir name).
namespace: media-apps
namespace: jellyfin
syncPolicy:
automated:
prune: true
argocd/projects/media.yaml
+2 -2
View File
@@ -5,11 +5,11 @@ metadata:
name: media
namespace: argocd
spec:
description: Media services (jellyfin + *arr stack)
description: Media services (jellyfin; downloads/managers namespaces to follow)
sourceRepos:
- https://git.unkin.net/unkin/argocd-apps
destinations:
- namespace: media-apps
- namespace: jellyfin
server: https://kubernetes.default.svc
clusterResourceWhitelist:
- group: ''