From 54c25be828d27b4f4f186392d417e386caa29cb5 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 9 Aug 2026 21:08:12 +1000 Subject: [PATCH] Reduce media PR to jellyfin-only in its own namespace Why: Jellyfin ships and gets validated first, ahead of the rest of the media stack. Scoping this PR to jellyfin alone keeps the initial rollout small and lets the HA fork prove out against the real library before the download and manager apps follow. How: - Drop sonarr, radarr, prowlarr, bazarr, nzbget, and jellyseerr and their shared media-apps foundation from this PR; they land in later PRs. - Move jellyfin into its own jellyfin namespace and fold the namespace and the static mediafs PV plus its RWX claim into the jellyfin base. - Keep the static CephFS PV bound to the in-use mediafs library with reclaimPolicy Retain and staticVolume true so nothing can reclaim it, mounted into jellyfin by the movies and tvseries subPaths; keep redis, the fresh RWX transcode scratch, the intel iGPU nodeSelector and i915 request, gateway, and httproute. - Scope the media AppProject and ApplicationSet to the single jellyfin namespace and app, extensible as the remaining apps are added. --- apps/base/bazarr/deployment.yaml | 61 -------- apps/base/bazarr/gateway.yaml | 37 ----- apps/base/bazarr/httproute.yaml | 49 ------ apps/base/bazarr/kustomization.yaml | 10 -- apps/base/bazarr/pvc.yaml | 14 -- apps/base/bazarr/service.yaml | 15 -- apps/base/jellyfin/deployment.yaml | 2 +- apps/base/jellyfin/gateway.yaml | 2 +- apps/base/jellyfin/httproute.yaml | 4 +- apps/base/jellyfin/kustomization.yaml | 3 + .../{media-apps => jellyfin}/namespace.yaml | 2 +- .../pv_media-library.yaml | 6 +- apps/base/jellyfin/pvc_cache.yaml | 2 +- apps/base/jellyfin/pvc_config.yaml | 2 +- .../pvc_media-library.yaml | 4 +- apps/base/jellyfin/pvc_transcode.yaml | 2 +- apps/base/jellyfin/redis-deployment.yaml | 2 +- apps/base/jellyfin/redis-pvc.yaml | 2 +- apps/base/jellyfin/redis-service.yaml | 2 +- apps/base/jellyfin/service.yaml | 2 +- apps/base/jellyseerr/deployment.yaml | 61 -------- apps/base/jellyseerr/gateway.yaml | 37 ----- apps/base/jellyseerr/httproute.yaml | 49 ------ apps/base/jellyseerr/kustomization.yaml | 10 -- apps/base/jellyseerr/pvc.yaml | 14 -- apps/base/jellyseerr/service.yaml | 15 -- apps/base/media-apps/kustomization.yaml | 10 -- apps/base/media-apps/serviceaccount.yaml | 12 -- apps/base/media-apps/vaultauth.yaml | 18 --- apps/base/nzbget/deployment.yaml | 80 ---------- apps/base/nzbget/gateway.yaml | 37 ----- apps/base/nzbget/httproute.yaml | 49 ------ apps/base/nzbget/kustomization.yaml | 11 -- apps/base/nzbget/pvc.yaml | 14 -- apps/base/nzbget/service.yaml | 15 -- apps/base/nzbget/vaultstaticsecret.yaml | 18 --- apps/base/prowlarr/configmap.yaml | 25 ---- apps/base/prowlarr/deployment.yaml | 136 ----------------- apps/base/prowlarr/gateway.yaml | 37 ----- apps/base/prowlarr/httproute.yaml | 49 ------ apps/base/prowlarr/kustomization.yaml | 12 -- apps/base/prowlarr/pvc.yaml | 14 -- apps/base/prowlarr/service.yaml | 30 ---- apps/base/prowlarr/vaultstaticsecret.yaml | 18 --- apps/base/radarr/configmap.yaml | 25 ---- apps/base/radarr/deployment.yaml | 140 ------------------ apps/base/radarr/gateway.yaml | 37 ----- apps/base/radarr/httproute.yaml | 49 ------ apps/base/radarr/kustomization.yaml | 12 -- apps/base/radarr/pvc.yaml | 14 -- apps/base/radarr/service.yaml | 30 ---- apps/base/radarr/vaultstaticsecret.yaml | 18 --- apps/base/sonarr/configmap.yaml | 25 ---- apps/base/sonarr/deployment.yaml | 140 ------------------ apps/base/sonarr/gateway.yaml | 37 ----- apps/base/sonarr/httproute.yaml | 49 ------ apps/base/sonarr/kustomization.yaml | 12 -- apps/base/sonarr/pvc.yaml | 14 -- apps/base/sonarr/service.yaml | 30 ---- apps/base/sonarr/vaultstaticsecret.yaml | 18 --- .../au-syd1/bazarr/kustomization.yaml | 6 - .../au-syd1/jellyseerr/kustomization.yaml | 6 - .../au-syd1/media-apps/kustomization.yaml | 6 - .../au-syd1/nzbget/kustomization.yaml | 6 - .../au-syd1/prowlarr/kustomization.yaml | 6 - .../au-syd1/radarr/kustomization.yaml | 6 - .../au-syd1/sonarr/kustomization.yaml | 6 - argocd/applicationsets/media.yaml | 13 +- argocd/projects/media.yaml | 4 +- 69 files changed, 24 insertions(+), 1679 deletions(-) delete mode 100644 apps/base/bazarr/deployment.yaml delete mode 100644 apps/base/bazarr/gateway.yaml delete mode 100644 apps/base/bazarr/httproute.yaml delete mode 100644 apps/base/bazarr/kustomization.yaml delete mode 100644 apps/base/bazarr/pvc.yaml delete mode 100644 apps/base/bazarr/service.yaml rename apps/base/{media-apps => jellyfin}/namespace.yaml (70%) rename apps/base/{media-apps => jellyfin}/pv_media-library.yaml (92%) rename apps/base/{media-apps => jellyfin}/pvc_media-library.yaml (87%) delete mode 100644 apps/base/jellyseerr/deployment.yaml delete mode 100644 apps/base/jellyseerr/gateway.yaml delete mode 100644 apps/base/jellyseerr/httproute.yaml delete mode 100644 apps/base/jellyseerr/kustomization.yaml delete mode 100644 apps/base/jellyseerr/pvc.yaml delete mode 100644 apps/base/jellyseerr/service.yaml delete mode 100644 apps/base/media-apps/kustomization.yaml delete mode 100644 apps/base/media-apps/serviceaccount.yaml delete mode 100644 apps/base/media-apps/vaultauth.yaml delete mode 100644 apps/base/nzbget/deployment.yaml delete mode 100644 apps/base/nzbget/gateway.yaml delete mode 100644 apps/base/nzbget/httproute.yaml delete mode 100644 apps/base/nzbget/kustomization.yaml delete mode 100644 apps/base/nzbget/pvc.yaml delete mode 100644 apps/base/nzbget/service.yaml delete mode 100644 apps/base/nzbget/vaultstaticsecret.yaml delete mode 100644 apps/base/prowlarr/configmap.yaml delete mode 100644 apps/base/prowlarr/deployment.yaml delete mode 100644 apps/base/prowlarr/gateway.yaml delete mode 100644 apps/base/prowlarr/httproute.yaml delete mode 100644 apps/base/prowlarr/kustomization.yaml delete mode 100644 apps/base/prowlarr/pvc.yaml delete mode 100644 apps/base/prowlarr/service.yaml delete mode 100644 apps/base/prowlarr/vaultstaticsecret.yaml delete mode 100644 apps/base/radarr/configmap.yaml delete mode 100644 apps/base/radarr/deployment.yaml delete mode 100644 apps/base/radarr/gateway.yaml delete mode 100644 apps/base/radarr/httproute.yaml delete mode 100644 apps/base/radarr/kustomization.yaml delete mode 100644 apps/base/radarr/pvc.yaml delete mode 100644 apps/base/radarr/service.yaml delete mode 100644 apps/base/radarr/vaultstaticsecret.yaml delete mode 100644 apps/base/sonarr/configmap.yaml delete mode 100644 apps/base/sonarr/deployment.yaml delete mode 100644 apps/base/sonarr/gateway.yaml delete mode 100644 apps/base/sonarr/httproute.yaml delete mode 100644 apps/base/sonarr/kustomization.yaml delete mode 100644 apps/base/sonarr/pvc.yaml delete mode 100644 apps/base/sonarr/service.yaml delete mode 100644 apps/base/sonarr/vaultstaticsecret.yaml delete mode 100644 apps/overlays/au-syd1/bazarr/kustomization.yaml delete mode 100644 apps/overlays/au-syd1/jellyseerr/kustomization.yaml delete mode 100644 apps/overlays/au-syd1/media-apps/kustomization.yaml delete mode 100644 apps/overlays/au-syd1/nzbget/kustomization.yaml delete mode 100644 apps/overlays/au-syd1/prowlarr/kustomization.yaml delete mode 100644 apps/overlays/au-syd1/radarr/kustomization.yaml delete mode 100644 apps/overlays/au-syd1/sonarr/kustomization.yaml diff --git a/apps/base/bazarr/deployment.yaml b/apps/base/bazarr/deployment.yaml deleted file mode 100644 index 171c86b..0000000 --- a/apps/base/bazarr/deployment.yaml +++ /dev/null @@ -1,61 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: bazarr - namespace: media-apps -spec: - replicas: 1 - strategy: - type: Recreate - selector: - matchLabels: - app: bazarr - template: - metadata: - labels: - app: bazarr - spec: - securityContext: - fsGroup: 1000 - containers: - - name: bazarr - image: ghcr.io/home-operations/bazarr:rolling - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 6767 - protocol: TCP - env: - - name: TZ - value: Australia/Sydney - - name: PUID - value: "1000" - - name: PGID - value: "1000" - resources: - requests: - cpu: 50m - memory: 256Mi - limits: - cpu: "1" - memory: 1Gi - livenessProbe: - httpGet: - path: / - port: http - initialDelaySeconds: 30 - periodSeconds: 30 - readinessProbe: - httpGet: - path: / - port: http - initialDelaySeconds: 5 - periodSeconds: 10 - volumeMounts: - - name: config - mountPath: /config - volumes: - - name: config - persistentVolumeClaim: - claimName: bazarr-config diff --git a/apps/base/bazarr/gateway.yaml b/apps/base/bazarr/gateway.yaml deleted file mode 100644 index 6adf69d..0000000 --- a/apps/base/bazarr/gateway.yaml +++ /dev/null @@ -1,37 +0,0 @@ ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: Gateway -metadata: - labels: - traefik.io/instance: internal - annotations: - cert-manager.io/cluster-issuer: vault-issuer - cert-manager.io/common-name: bazarr.k8s.syd1.au.unkin.net - cert-manager.io/private-key-size: "4096" - external-dns.alpha.kubernetes.io/hostname: bazarr.k8s.syd1.au.unkin.net - external-dns.alpha.kubernetes.io/target: 198.18.200.4 - name: bazarr - namespace: media-apps -spec: - gatewayClassName: traefik-internal - listeners: - - allowedRoutes: - namespaces: - from: Same - hostname: bazarr.k8s.syd1.au.unkin.net - name: http - port: 80 - protocol: HTTP - - allowedRoutes: - namespaces: - from: Same - hostname: bazarr.k8s.syd1.au.unkin.net - name: https - port: 443 - protocol: HTTPS - tls: - certificateRefs: - - group: "" - kind: Secret - name: bazarr-tls - mode: Terminate diff --git a/apps/base/bazarr/httproute.yaml b/apps/base/bazarr/httproute.yaml deleted file mode 100644 index 01de102..0000000 --- a/apps/base/bazarr/httproute.yaml +++ /dev/null @@ -1,49 +0,0 @@ ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: http-redirect - namespace: media-apps -spec: - hostnames: - - bazarr.k8s.syd1.au.unkin.net - parentRefs: - - group: gateway.networking.k8s.io - kind: Gateway - name: bazarr - sectionName: http - rules: - - filters: - - type: RequestRedirect - requestRedirect: - scheme: https - statusCode: 301 - matches: - - path: - type: PathPrefix - value: / ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: bazarr - namespace: media-apps -spec: - hostnames: - - bazarr.k8s.syd1.au.unkin.net - parentRefs: - - group: gateway.networking.k8s.io - kind: Gateway - name: bazarr - sectionName: https - rules: - - backendRefs: - - group: "" - kind: Service - name: bazarr - port: 6767 - weight: 1 - matches: - - path: - type: PathPrefix - value: / diff --git a/apps/base/bazarr/kustomization.yaml b/apps/base/bazarr/kustomization.yaml deleted file mode 100644 index 75755b6..0000000 --- a/apps/base/bazarr/kustomization.yaml +++ /dev/null @@ -1,10 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - pvc.yaml - - deployment.yaml - - service.yaml - - gateway.yaml - - httproute.yaml diff --git a/apps/base/bazarr/pvc.yaml b/apps/base/bazarr/pvc.yaml deleted file mode 100644 index ac449c5..0000000 --- a/apps/base/bazarr/pvc.yaml +++ /dev/null @@ -1,14 +0,0 @@ ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: bazarr-config - namespace: media-apps -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - storageClassName: cephrbd-fast-delete - volumeMode: Filesystem diff --git a/apps/base/bazarr/service.yaml b/apps/base/bazarr/service.yaml deleted file mode 100644 index 2dfa0e4..0000000 --- a/apps/base/bazarr/service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: bazarr - namespace: media-apps -spec: - type: ClusterIP - selector: - app: bazarr - ports: - - name: http - port: 6767 - targetPort: http - protocol: TCP diff --git a/apps/base/jellyfin/deployment.yaml b/apps/base/jellyfin/deployment.yaml index 2ac8c23..e139b0b 100644 --- a/apps/base/jellyfin/deployment.yaml +++ b/apps/base/jellyfin/deployment.yaml @@ -3,7 +3,7 @@ apiVersion: apps/v1 kind: Deployment metadata: name: jellyfin - namespace: media-apps + namespace: jellyfin spec: # Single-replica for now. The jellyfin-ha fork adds the Redis transcode store # and RWX transcode scratch that make scaling to true HA a follow-up. diff --git a/apps/base/jellyfin/gateway.yaml b/apps/base/jellyfin/gateway.yaml index 1ed5c15..a491519 100644 --- a/apps/base/jellyfin/gateway.yaml +++ b/apps/base/jellyfin/gateway.yaml @@ -11,7 +11,7 @@ metadata: external-dns.alpha.kubernetes.io/hostname: jellyfin.k8s.syd1.au.unkin.net external-dns.alpha.kubernetes.io/target: 198.18.200.4 name: jellyfin - namespace: media-apps + namespace: jellyfin spec: gatewayClassName: traefik-internal listeners: diff --git a/apps/base/jellyfin/httproute.yaml b/apps/base/jellyfin/httproute.yaml index b6e98a8..538947d 100644 --- a/apps/base/jellyfin/httproute.yaml +++ b/apps/base/jellyfin/httproute.yaml @@ -3,7 +3,7 @@ apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: http-redirect - namespace: media-apps + namespace: jellyfin spec: hostnames: - jellyfin.k8s.syd1.au.unkin.net @@ -27,7 +27,7 @@ apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: jellyfin - namespace: media-apps + namespace: jellyfin spec: hostnames: - jellyfin.k8s.syd1.au.unkin.net diff --git a/apps/base/jellyfin/kustomization.yaml b/apps/base/jellyfin/kustomization.yaml index 219982c..ba9b0f8 100644 --- a/apps/base/jellyfin/kustomization.yaml +++ b/apps/base/jellyfin/kustomization.yaml @@ -3,6 +3,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: + - namespace.yaml + - pv_media-library.yaml + - pvc_media-library.yaml - pvc_config.yaml - pvc_cache.yaml - pvc_transcode.yaml diff --git a/apps/base/media-apps/namespace.yaml b/apps/base/jellyfin/namespace.yaml similarity index 70% rename from apps/base/media-apps/namespace.yaml rename to apps/base/jellyfin/namespace.yaml index f55cc8e..3122e11 100644 --- a/apps/base/media-apps/namespace.yaml +++ b/apps/base/jellyfin/namespace.yaml @@ -2,4 +2,4 @@ apiVersion: v1 kind: Namespace metadata: - name: media-apps + name: jellyfin diff --git a/apps/base/media-apps/pv_media-library.yaml b/apps/base/jellyfin/pv_media-library.yaml similarity index 92% rename from apps/base/media-apps/pv_media-library.yaml rename to apps/base/jellyfin/pv_media-library.yaml index 0243e24..463e5ab 100644 --- a/apps/base/media-apps/pv_media-library.yaml +++ b/apps/base/jellyfin/pv_media-library.yaml @@ -9,7 +9,7 @@ apiVersion: v1 kind: PersistentVolume metadata: - name: media-apps-media-library + name: jellyfin-media-library spec: accessModes: - ReadWriteMany @@ -24,10 +24,10 @@ spec: apiVersion: v1 kind: PersistentVolumeClaim name: media-library - namespace: media-apps + namespace: jellyfin csi: driver: cephfs.csi.ceph.com - volumeHandle: media-apps-media-library-static + volumeHandle: jellyfin-media-library-static nodeStageSecretRef: name: csi-cephfs-secret namespace: csi-cephfs diff --git a/apps/base/jellyfin/pvc_cache.yaml b/apps/base/jellyfin/pvc_cache.yaml index c412c5d..26a78b8 100644 --- a/apps/base/jellyfin/pvc_cache.yaml +++ b/apps/base/jellyfin/pvc_cache.yaml @@ -4,7 +4,7 @@ apiVersion: v1 kind: PersistentVolumeClaim metadata: name: jellyfin-cache - namespace: media-apps + namespace: jellyfin spec: accessModes: - ReadWriteOnce diff --git a/apps/base/jellyfin/pvc_config.yaml b/apps/base/jellyfin/pvc_config.yaml index 0e23c33..71467d0 100644 --- a/apps/base/jellyfin/pvc_config.yaml +++ b/apps/base/jellyfin/pvc_config.yaml @@ -4,7 +4,7 @@ apiVersion: v1 kind: PersistentVolumeClaim metadata: name: jellyfin-config - namespace: media-apps + namespace: jellyfin spec: accessModes: - ReadWriteOnce diff --git a/apps/base/media-apps/pvc_media-library.yaml b/apps/base/jellyfin/pvc_media-library.yaml similarity index 87% rename from apps/base/media-apps/pvc_media-library.yaml rename to apps/base/jellyfin/pvc_media-library.yaml index 49d0652..2e100ce 100644 --- a/apps/base/media-apps/pvc_media-library.yaml +++ b/apps/base/jellyfin/pvc_media-library.yaml @@ -7,12 +7,12 @@ apiVersion: v1 kind: PersistentVolumeClaim metadata: name: media-library - namespace: media-apps + namespace: jellyfin spec: accessModes: - ReadWriteMany storageClassName: "" - volumeName: media-apps-media-library + volumeName: jellyfin-media-library resources: requests: storage: 10Ti diff --git a/apps/base/jellyfin/pvc_transcode.yaml b/apps/base/jellyfin/pvc_transcode.yaml index 7c25b61..4f8c891 100644 --- a/apps/base/jellyfin/pvc_transcode.yaml +++ b/apps/base/jellyfin/pvc_transcode.yaml @@ -6,7 +6,7 @@ apiVersion: v1 kind: PersistentVolumeClaim metadata: name: jellyfin-transcode - namespace: media-apps + namespace: jellyfin spec: accessModes: - ReadWriteMany diff --git a/apps/base/jellyfin/redis-deployment.yaml b/apps/base/jellyfin/redis-deployment.yaml index 141a95b..4a61e3c 100644 --- a/apps/base/jellyfin/redis-deployment.yaml +++ b/apps/base/jellyfin/redis-deployment.yaml @@ -3,7 +3,7 @@ apiVersion: apps/v1 kind: Deployment metadata: name: jellyfin-redis - namespace: media-apps + namespace: jellyfin spec: replicas: 1 strategy: diff --git a/apps/base/jellyfin/redis-pvc.yaml b/apps/base/jellyfin/redis-pvc.yaml index 0916f96..36a4315 100644 --- a/apps/base/jellyfin/redis-pvc.yaml +++ b/apps/base/jellyfin/redis-pvc.yaml @@ -3,7 +3,7 @@ apiVersion: v1 kind: PersistentVolumeClaim metadata: name: jellyfin-redis-data - namespace: media-apps + namespace: jellyfin spec: accessModes: - ReadWriteOnce diff --git a/apps/base/jellyfin/redis-service.yaml b/apps/base/jellyfin/redis-service.yaml index d1e2181..2867750 100644 --- a/apps/base/jellyfin/redis-service.yaml +++ b/apps/base/jellyfin/redis-service.yaml @@ -3,7 +3,7 @@ apiVersion: v1 kind: Service metadata: name: jellyfin-redis - namespace: media-apps + namespace: jellyfin spec: type: ClusterIP internalTrafficPolicy: Cluster diff --git a/apps/base/jellyfin/service.yaml b/apps/base/jellyfin/service.yaml index 2722963..65b86d4 100644 --- a/apps/base/jellyfin/service.yaml +++ b/apps/base/jellyfin/service.yaml @@ -3,7 +3,7 @@ apiVersion: v1 kind: Service metadata: name: jellyfin - namespace: media-apps + namespace: jellyfin spec: type: ClusterIP internalTrafficPolicy: Cluster diff --git a/apps/base/jellyseerr/deployment.yaml b/apps/base/jellyseerr/deployment.yaml deleted file mode 100644 index 3ff94ad..0000000 --- a/apps/base/jellyseerr/deployment.yaml +++ /dev/null @@ -1,61 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: jellyseerr - namespace: media-apps -spec: - replicas: 1 - strategy: - type: Recreate - selector: - matchLabels: - app: jellyseerr - template: - metadata: - labels: - app: jellyseerr - spec: - securityContext: - fsGroup: 1000 - containers: - - name: jellyseerr - image: ghcr.io/fallenbagel/jellyseerr:latest - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 5055 - protocol: TCP - env: - - name: TZ - value: Australia/Sydney - - name: LOG_LEVEL - value: debug - - name: PORT - value: "5055" - resources: - requests: - cpu: 50m - memory: 128Mi - limits: - cpu: "1" - memory: 1Gi - livenessProbe: - httpGet: - path: / - port: http - initialDelaySeconds: 30 - periodSeconds: 30 - readinessProbe: - httpGet: - path: / - port: http - initialDelaySeconds: 5 - periodSeconds: 10 - volumeMounts: - - name: config - mountPath: /app/config - volumes: - - name: config - persistentVolumeClaim: - claimName: jellyseerr-config diff --git a/apps/base/jellyseerr/gateway.yaml b/apps/base/jellyseerr/gateway.yaml deleted file mode 100644 index 01ea213..0000000 --- a/apps/base/jellyseerr/gateway.yaml +++ /dev/null @@ -1,37 +0,0 @@ ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: Gateway -metadata: - labels: - traefik.io/instance: internal - annotations: - cert-manager.io/cluster-issuer: vault-issuer - cert-manager.io/common-name: jellyseerr.k8s.syd1.au.unkin.net - cert-manager.io/private-key-size: "4096" - external-dns.alpha.kubernetes.io/hostname: jellyseerr.k8s.syd1.au.unkin.net - external-dns.alpha.kubernetes.io/target: 198.18.200.4 - name: jellyseerr - namespace: media-apps -spec: - gatewayClassName: traefik-internal - listeners: - - allowedRoutes: - namespaces: - from: Same - hostname: jellyseerr.k8s.syd1.au.unkin.net - name: http - port: 80 - protocol: HTTP - - allowedRoutes: - namespaces: - from: Same - hostname: jellyseerr.k8s.syd1.au.unkin.net - name: https - port: 443 - protocol: HTTPS - tls: - certificateRefs: - - group: "" - kind: Secret - name: jellyseerr-tls - mode: Terminate diff --git a/apps/base/jellyseerr/httproute.yaml b/apps/base/jellyseerr/httproute.yaml deleted file mode 100644 index 7f3d770..0000000 --- a/apps/base/jellyseerr/httproute.yaml +++ /dev/null @@ -1,49 +0,0 @@ ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: http-redirect - namespace: media-apps -spec: - hostnames: - - jellyseerr.k8s.syd1.au.unkin.net - parentRefs: - - group: gateway.networking.k8s.io - kind: Gateway - name: jellyseerr - sectionName: http - rules: - - filters: - - type: RequestRedirect - requestRedirect: - scheme: https - statusCode: 301 - matches: - - path: - type: PathPrefix - value: / ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: jellyseerr - namespace: media-apps -spec: - hostnames: - - jellyseerr.k8s.syd1.au.unkin.net - parentRefs: - - group: gateway.networking.k8s.io - kind: Gateway - name: jellyseerr - sectionName: https - rules: - - backendRefs: - - group: "" - kind: Service - name: jellyseerr - port: 5055 - weight: 1 - matches: - - path: - type: PathPrefix - value: / diff --git a/apps/base/jellyseerr/kustomization.yaml b/apps/base/jellyseerr/kustomization.yaml deleted file mode 100644 index 75755b6..0000000 --- a/apps/base/jellyseerr/kustomization.yaml +++ /dev/null @@ -1,10 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - pvc.yaml - - deployment.yaml - - service.yaml - - gateway.yaml - - httproute.yaml diff --git a/apps/base/jellyseerr/pvc.yaml b/apps/base/jellyseerr/pvc.yaml deleted file mode 100644 index 8ad62e5..0000000 --- a/apps/base/jellyseerr/pvc.yaml +++ /dev/null @@ -1,14 +0,0 @@ ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: jellyseerr-config - namespace: media-apps -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - storageClassName: cephrbd-fast-delete - volumeMode: Filesystem diff --git a/apps/base/jellyseerr/service.yaml b/apps/base/jellyseerr/service.yaml deleted file mode 100644 index 5df32ae..0000000 --- a/apps/base/jellyseerr/service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: jellyseerr - namespace: media-apps -spec: - type: ClusterIP - selector: - app: jellyseerr - ports: - - name: http - port: 5055 - targetPort: http - protocol: TCP diff --git a/apps/base/media-apps/kustomization.yaml b/apps/base/media-apps/kustomization.yaml deleted file mode 100644 index 0969cf0..0000000 --- a/apps/base/media-apps/kustomization.yaml +++ /dev/null @@ -1,10 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - namespace.yaml - - serviceaccount.yaml - - vaultauth.yaml - - pv_media-library.yaml - - pvc_media-library.yaml diff --git a/apps/base/media-apps/serviceaccount.yaml b/apps/base/media-apps/serviceaccount.yaml deleted file mode 100644 index 5713b6d..0000000 --- a/apps/base/media-apps/serviceaccount.yaml +++ /dev/null @@ -1,12 +0,0 @@ ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: media-apps-vault-reader - namespace: media-apps - labels: - app.kubernetes.io/name: vault-reader - app.kubernetes.io/component: service-account - annotations: - vault.hashicorp.com/auth-method: kubernetes -automountServiceAccountToken: true diff --git a/apps/base/media-apps/vaultauth.yaml b/apps/base/media-apps/vaultauth.yaml deleted file mode 100644 index 492e2f2..0000000 --- a/apps/base/media-apps/vaultauth.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -apiVersion: secrets.hashicorp.com/v1beta1 -kind: VaultAuth -metadata: - name: default - namespace: media-apps -spec: - allowedNamespaces: - - media-apps - kubernetes: - audiences: - - vault - role: media-apps - serviceAccount: media-apps-vault-reader - tokenExpirationSeconds: 600 - method: kubernetes - mount: k8s/au/syd1 - vaultConnectionRef: vso-system/default diff --git a/apps/base/nzbget/deployment.yaml b/apps/base/nzbget/deployment.yaml deleted file mode 100644 index 46bffe9..0000000 --- a/apps/base/nzbget/deployment.yaml +++ /dev/null @@ -1,80 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: nzbget - namespace: media-apps -spec: - replicas: 1 - strategy: - type: Recreate - selector: - matchLabels: - app: nzbget - template: - metadata: - labels: - app: nzbget - spec: - securityContext: - fsGroup: 1000 - containers: - - name: nzbget - image: ghcr.io/home-operations/nzbget:rolling - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 6789 - protocol: TCP - env: - - name: TZ - value: Australia/Sydney - - name: PUID - value: "1000" - - name: PGID - value: "1000" - - name: NZBGET_USER - valueFrom: - secretKeyRef: - name: nzbget-secrets - key: NZBGET_USER - - name: NZBGET_PASS - valueFrom: - secretKeyRef: - name: nzbget-secrets - key: NZBGET_PASS - resources: - requests: - cpu: 100m - memory: 512Mi - limits: - cpu: "4" - memory: 8Gi - livenessProbe: - httpGet: - path: / - port: http - initialDelaySeconds: 30 - periodSeconds: 30 - readinessProbe: - httpGet: - path: / - port: http - initialDelaySeconds: 5 - periodSeconds: 10 - volumeMounts: - - name: config - mountPath: /config - - name: media-library - mountPath: /mnt/movies - subPath: movies - - name: media-library - mountPath: /mnt/tvseries - subPath: tvseries - volumes: - - name: config - persistentVolumeClaim: - claimName: nzbget-config - - name: media-library - persistentVolumeClaim: - claimName: media-library diff --git a/apps/base/nzbget/gateway.yaml b/apps/base/nzbget/gateway.yaml deleted file mode 100644 index 0ce61ec..0000000 --- a/apps/base/nzbget/gateway.yaml +++ /dev/null @@ -1,37 +0,0 @@ ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: Gateway -metadata: - labels: - traefik.io/instance: internal - annotations: - cert-manager.io/cluster-issuer: vault-issuer - cert-manager.io/common-name: nzbget.k8s.syd1.au.unkin.net - cert-manager.io/private-key-size: "4096" - external-dns.alpha.kubernetes.io/hostname: nzbget.k8s.syd1.au.unkin.net - external-dns.alpha.kubernetes.io/target: 198.18.200.4 - name: nzbget - namespace: media-apps -spec: - gatewayClassName: traefik-internal - listeners: - - allowedRoutes: - namespaces: - from: Same - hostname: nzbget.k8s.syd1.au.unkin.net - name: http - port: 80 - protocol: HTTP - - allowedRoutes: - namespaces: - from: Same - hostname: nzbget.k8s.syd1.au.unkin.net - name: https - port: 443 - protocol: HTTPS - tls: - certificateRefs: - - group: "" - kind: Secret - name: nzbget-tls - mode: Terminate diff --git a/apps/base/nzbget/httproute.yaml b/apps/base/nzbget/httproute.yaml deleted file mode 100644 index 492d89d..0000000 --- a/apps/base/nzbget/httproute.yaml +++ /dev/null @@ -1,49 +0,0 @@ ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: http-redirect - namespace: media-apps -spec: - hostnames: - - nzbget.k8s.syd1.au.unkin.net - parentRefs: - - group: gateway.networking.k8s.io - kind: Gateway - name: nzbget - sectionName: http - rules: - - filters: - - type: RequestRedirect - requestRedirect: - scheme: https - statusCode: 301 - matches: - - path: - type: PathPrefix - value: / ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: nzbget - namespace: media-apps -spec: - hostnames: - - nzbget.k8s.syd1.au.unkin.net - parentRefs: - - group: gateway.networking.k8s.io - kind: Gateway - name: nzbget - sectionName: https - rules: - - backendRefs: - - group: "" - kind: Service - name: nzbget - port: 6789 - weight: 1 - matches: - - path: - type: PathPrefix - value: / diff --git a/apps/base/nzbget/kustomization.yaml b/apps/base/nzbget/kustomization.yaml deleted file mode 100644 index 2e2d281..0000000 --- a/apps/base/nzbget/kustomization.yaml +++ /dev/null @@ -1,11 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - pvc.yaml - - vaultstaticsecret.yaml - - deployment.yaml - - service.yaml - - gateway.yaml - - httproute.yaml diff --git a/apps/base/nzbget/pvc.yaml b/apps/base/nzbget/pvc.yaml deleted file mode 100644 index 5b48cc6..0000000 --- a/apps/base/nzbget/pvc.yaml +++ /dev/null @@ -1,14 +0,0 @@ ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: nzbget-config - namespace: media-apps -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - storageClassName: cephrbd-fast-delete - volumeMode: Filesystem diff --git a/apps/base/nzbget/service.yaml b/apps/base/nzbget/service.yaml deleted file mode 100644 index 405db96..0000000 --- a/apps/base/nzbget/service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: nzbget - namespace: media-apps -spec: - type: ClusterIP - selector: - app: nzbget - ports: - - name: http - port: 6789 - targetPort: http - protocol: TCP diff --git a/apps/base/nzbget/vaultstaticsecret.yaml b/apps/base/nzbget/vaultstaticsecret.yaml deleted file mode 100644 index 495fd09..0000000 --- a/apps/base/nzbget/vaultstaticsecret.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -apiVersion: secrets.hashicorp.com/v1beta1 -kind: VaultStaticSecret -metadata: - name: nzbget - namespace: media-apps -spec: - destination: - create: true - name: nzbget-secrets - mount: kv - path: service/media-apps/nzbget - refreshAfter: 30s - type: kv-v2 - vaultAuthRef: default - rolloutRestartTargets: - - kind: Deployment - name: nzbget diff --git a/apps/base/prowlarr/configmap.yaml b/apps/base/prowlarr/configmap.yaml deleted file mode 100644 index 49aa186..0000000 --- a/apps/base/prowlarr/configmap.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: prowlarr-config-xml - namespace: media-apps -data: - config.xml: | - - * - 9696 - 9898 - False - True - {{API_KEY}} - External - Enabled - info - - - - prowlarr - Docker - False - diff --git a/apps/base/prowlarr/deployment.yaml b/apps/base/prowlarr/deployment.yaml deleted file mode 100644 index 6f30cab..0000000 --- a/apps/base/prowlarr/deployment.yaml +++ /dev/null @@ -1,136 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: prowlarr - namespace: media-apps -spec: - replicas: 1 - strategy: - type: Recreate - selector: - matchLabels: - app: prowlarr - template: - metadata: - labels: - app: prowlarr - spec: - securityContext: - fsGroup: 1000 - initContainers: - - name: config-template - image: busybox:latest - imagePullPolicy: IfNotPresent - command: ["/bin/sh"] - args: - - -c - - | - cp /config-template/config.xml /config/config.xml - sed -i "s/{{API_KEY}}/$API_KEY/g" /config/config.xml - env: - - name: API_KEY - valueFrom: - secretKeyRef: - name: prowlarr-secrets - key: apitoken - securityContext: - runAsUser: 1000 - runAsGroup: 1000 - runAsNonRoot: true - volumeMounts: - - name: config-template - mountPath: /config-template - - name: config - mountPath: /config - containers: - - name: prowlarr - image: ghcr.io/home-operations/prowlarr:rolling - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 9696 - protocol: TCP - env: - - name: TZ - value: Australia/Sydney - - name: PUID - value: "1000" - - name: PGID - value: "1000" - resources: - requests: - cpu: 50m - memory: 128Mi - limits: - cpu: "1" - memory: 1Gi - livenessProbe: - httpGet: - path: / - port: http - initialDelaySeconds: 30 - periodSeconds: 30 - readinessProbe: - httpGet: - path: / - port: http - initialDelaySeconds: 5 - periodSeconds: 10 - volumeMounts: - - name: config - mountPath: /config - - name: exportarr - image: ghcr.io/onedr0p/exportarr:latest - imagePullPolicy: IfNotPresent - args: ["prowlarr"] - ports: - - name: metrics - containerPort: 9707 - protocol: TCP - env: - - name: TZ - value: Australia/Sydney - - name: PORT - value: "9707" - - name: URL - value: "http://localhost:9696" - - name: API_KEY - valueFrom: - secretKeyRef: - name: prowlarr-secrets - key: apitoken - resources: - requests: - cpu: 50m - memory: 128Mi - limits: - cpu: 250m - memory: 256Mi - securityContext: - runAsUser: 1000 - runAsGroup: 1000 - runAsNonRoot: true - livenessProbe: - httpGet: - path: /metrics - port: metrics - initialDelaySeconds: 30 - periodSeconds: 30 - readinessProbe: - httpGet: - path: /metrics - port: metrics - initialDelaySeconds: 5 - periodSeconds: 10 - volumeMounts: - - name: config - mountPath: /config - readOnly: true - volumes: - - name: config - persistentVolumeClaim: - claimName: prowlarr-config - - name: config-template - configMap: - name: prowlarr-config-xml diff --git a/apps/base/prowlarr/gateway.yaml b/apps/base/prowlarr/gateway.yaml deleted file mode 100644 index fcd558c..0000000 --- a/apps/base/prowlarr/gateway.yaml +++ /dev/null @@ -1,37 +0,0 @@ ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: Gateway -metadata: - labels: - traefik.io/instance: internal - annotations: - cert-manager.io/cluster-issuer: vault-issuer - cert-manager.io/common-name: prowlarr.k8s.syd1.au.unkin.net - cert-manager.io/private-key-size: "4096" - external-dns.alpha.kubernetes.io/hostname: prowlarr.k8s.syd1.au.unkin.net - external-dns.alpha.kubernetes.io/target: 198.18.200.4 - name: prowlarr - namespace: media-apps -spec: - gatewayClassName: traefik-internal - listeners: - - allowedRoutes: - namespaces: - from: Same - hostname: prowlarr.k8s.syd1.au.unkin.net - name: http - port: 80 - protocol: HTTP - - allowedRoutes: - namespaces: - from: Same - hostname: prowlarr.k8s.syd1.au.unkin.net - name: https - port: 443 - protocol: HTTPS - tls: - certificateRefs: - - group: "" - kind: Secret - name: prowlarr-tls - mode: Terminate diff --git a/apps/base/prowlarr/httproute.yaml b/apps/base/prowlarr/httproute.yaml deleted file mode 100644 index b93cf1c..0000000 --- a/apps/base/prowlarr/httproute.yaml +++ /dev/null @@ -1,49 +0,0 @@ ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: http-redirect - namespace: media-apps -spec: - hostnames: - - prowlarr.k8s.syd1.au.unkin.net - parentRefs: - - group: gateway.networking.k8s.io - kind: Gateway - name: prowlarr - sectionName: http - rules: - - filters: - - type: RequestRedirect - requestRedirect: - scheme: https - statusCode: 301 - matches: - - path: - type: PathPrefix - value: / ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: prowlarr - namespace: media-apps -spec: - hostnames: - - prowlarr.k8s.syd1.au.unkin.net - parentRefs: - - group: gateway.networking.k8s.io - kind: Gateway - name: prowlarr - sectionName: https - rules: - - backendRefs: - - group: "" - kind: Service - name: prowlarr - port: 9696 - weight: 1 - matches: - - path: - type: PathPrefix - value: / diff --git a/apps/base/prowlarr/kustomization.yaml b/apps/base/prowlarr/kustomization.yaml deleted file mode 100644 index 7552699..0000000 --- a/apps/base/prowlarr/kustomization.yaml +++ /dev/null @@ -1,12 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - pvc.yaml - - configmap.yaml - - vaultstaticsecret.yaml - - deployment.yaml - - service.yaml - - gateway.yaml - - httproute.yaml diff --git a/apps/base/prowlarr/pvc.yaml b/apps/base/prowlarr/pvc.yaml deleted file mode 100644 index 7e9f7c8..0000000 --- a/apps/base/prowlarr/pvc.yaml +++ /dev/null @@ -1,14 +0,0 @@ ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: prowlarr-config - namespace: media-apps -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - storageClassName: cephrbd-fast-delete - volumeMode: Filesystem diff --git a/apps/base/prowlarr/service.yaml b/apps/base/prowlarr/service.yaml deleted file mode 100644 index 6e41bd7..0000000 --- a/apps/base/prowlarr/service.yaml +++ /dev/null @@ -1,30 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: prowlarr - namespace: media-apps -spec: - type: ClusterIP - selector: - app: prowlarr - ports: - - name: http - port: 9696 - targetPort: http - protocol: TCP ---- -apiVersion: v1 -kind: Service -metadata: - name: prowlarr-metrics - namespace: media-apps -spec: - type: ClusterIP - selector: - app: prowlarr - ports: - - name: metrics - port: 9707 - targetPort: metrics - protocol: TCP diff --git a/apps/base/prowlarr/vaultstaticsecret.yaml b/apps/base/prowlarr/vaultstaticsecret.yaml deleted file mode 100644 index e029fec..0000000 --- a/apps/base/prowlarr/vaultstaticsecret.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -apiVersion: secrets.hashicorp.com/v1beta1 -kind: VaultStaticSecret -metadata: - name: prowlarr - namespace: media-apps -spec: - destination: - create: true - name: prowlarr-secrets - mount: kv - path: service/media-apps/prowlarr - refreshAfter: 30s - type: kv-v2 - vaultAuthRef: default - rolloutRestartTargets: - - kind: Deployment - name: prowlarr diff --git a/apps/base/radarr/configmap.yaml b/apps/base/radarr/configmap.yaml deleted file mode 100644 index 143e36f..0000000 --- a/apps/base/radarr/configmap.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: radarr-config-xml - namespace: media-apps -data: - config.xml: | - - * - 7878 - 9898 - False - True - {{API_KEY}} - External - Enabled - debug - - - - Radarr - Docker - False - diff --git a/apps/base/radarr/deployment.yaml b/apps/base/radarr/deployment.yaml deleted file mode 100644 index 9ee837c..0000000 --- a/apps/base/radarr/deployment.yaml +++ /dev/null @@ -1,140 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: radarr - namespace: media-apps -spec: - replicas: 1 - strategy: - type: Recreate - selector: - matchLabels: - app: radarr - template: - metadata: - labels: - app: radarr - spec: - securityContext: - fsGroup: 1000 - initContainers: - - name: config-template - image: busybox:latest - imagePullPolicy: IfNotPresent - command: ["/bin/sh"] - args: - - -c - - | - cp /config-template/config.xml /config/config.xml - sed -i "s/{{API_KEY}}/$API_KEY/g" /config/config.xml - env: - - name: API_KEY - valueFrom: - secretKeyRef: - name: radarr-secrets - key: apitoken - securityContext: - runAsUser: 1000 - runAsGroup: 1000 - runAsNonRoot: true - volumeMounts: - - name: config-template - mountPath: /config-template - - name: config - mountPath: /config - containers: - - name: radarr - image: ghcr.io/home-operations/radarr:rolling - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 7878 - protocol: TCP - env: - - name: TZ - value: Australia/Sydney - - name: PORT - value: "7878" - resources: - requests: - cpu: 50m - memory: 128Mi - limits: - cpu: "1" - memory: 1Gi - livenessProbe: - httpGet: - path: / - port: http - initialDelaySeconds: 30 - periodSeconds: 30 - readinessProbe: - httpGet: - path: / - port: http - initialDelaySeconds: 5 - periodSeconds: 10 - volumeMounts: - - name: config - mountPath: /config - - name: media-library - mountPath: /mnt/movies - subPath: movies - - name: exportarr - image: ghcr.io/onedr0p/exportarr:latest - imagePullPolicy: IfNotPresent - args: ["radarr"] - ports: - - name: metrics - containerPort: 9707 - protocol: TCP - env: - - name: TZ - value: Australia/Sydney - - name: PORT - value: "9707" - - name: URL - value: "http://localhost:7878" - - name: API_KEY - valueFrom: - secretKeyRef: - name: radarr-secrets - key: apitoken - resources: - requests: - cpu: 50m - memory: 128Mi - limits: - cpu: 250m - memory: 256Mi - securityContext: - runAsUser: 1000 - runAsGroup: 1000 - runAsNonRoot: true - livenessProbe: - httpGet: - path: /metrics - port: metrics - initialDelaySeconds: 30 - periodSeconds: 30 - readinessProbe: - httpGet: - path: /metrics - port: metrics - initialDelaySeconds: 5 - periodSeconds: 10 - volumeMounts: - - name: config - mountPath: /config - readOnly: true - volumes: - - name: config - persistentVolumeClaim: - claimName: radarr-config - - name: config-template - configMap: - name: radarr-config-xml - - name: media-library - persistentVolumeClaim: - claimName: media-library diff --git a/apps/base/radarr/gateway.yaml b/apps/base/radarr/gateway.yaml deleted file mode 100644 index 78b76a0..0000000 --- a/apps/base/radarr/gateway.yaml +++ /dev/null @@ -1,37 +0,0 @@ ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: Gateway -metadata: - labels: - traefik.io/instance: internal - annotations: - cert-manager.io/cluster-issuer: vault-issuer - cert-manager.io/common-name: radarr.k8s.syd1.au.unkin.net - cert-manager.io/private-key-size: "4096" - external-dns.alpha.kubernetes.io/hostname: radarr.k8s.syd1.au.unkin.net - external-dns.alpha.kubernetes.io/target: 198.18.200.4 - name: radarr - namespace: media-apps -spec: - gatewayClassName: traefik-internal - listeners: - - allowedRoutes: - namespaces: - from: Same - hostname: radarr.k8s.syd1.au.unkin.net - name: http - port: 80 - protocol: HTTP - - allowedRoutes: - namespaces: - from: Same - hostname: radarr.k8s.syd1.au.unkin.net - name: https - port: 443 - protocol: HTTPS - tls: - certificateRefs: - - group: "" - kind: Secret - name: radarr-tls - mode: Terminate diff --git a/apps/base/radarr/httproute.yaml b/apps/base/radarr/httproute.yaml deleted file mode 100644 index 684cfea..0000000 --- a/apps/base/radarr/httproute.yaml +++ /dev/null @@ -1,49 +0,0 @@ ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: http-redirect - namespace: media-apps -spec: - hostnames: - - radarr.k8s.syd1.au.unkin.net - parentRefs: - - group: gateway.networking.k8s.io - kind: Gateway - name: radarr - sectionName: http - rules: - - filters: - - type: RequestRedirect - requestRedirect: - scheme: https - statusCode: 301 - matches: - - path: - type: PathPrefix - value: / ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: radarr - namespace: media-apps -spec: - hostnames: - - radarr.k8s.syd1.au.unkin.net - parentRefs: - - group: gateway.networking.k8s.io - kind: Gateway - name: radarr - sectionName: https - rules: - - backendRefs: - - group: "" - kind: Service - name: radarr - port: 7878 - weight: 1 - matches: - - path: - type: PathPrefix - value: / diff --git a/apps/base/radarr/kustomization.yaml b/apps/base/radarr/kustomization.yaml deleted file mode 100644 index 7552699..0000000 --- a/apps/base/radarr/kustomization.yaml +++ /dev/null @@ -1,12 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - pvc.yaml - - configmap.yaml - - vaultstaticsecret.yaml - - deployment.yaml - - service.yaml - - gateway.yaml - - httproute.yaml diff --git a/apps/base/radarr/pvc.yaml b/apps/base/radarr/pvc.yaml deleted file mode 100644 index 557d93b..0000000 --- a/apps/base/radarr/pvc.yaml +++ /dev/null @@ -1,14 +0,0 @@ ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: radarr-config - namespace: media-apps -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - storageClassName: cephrbd-fast-delete - volumeMode: Filesystem diff --git a/apps/base/radarr/service.yaml b/apps/base/radarr/service.yaml deleted file mode 100644 index 86bc821..0000000 --- a/apps/base/radarr/service.yaml +++ /dev/null @@ -1,30 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: radarr - namespace: media-apps -spec: - type: ClusterIP - selector: - app: radarr - ports: - - name: http - port: 7878 - targetPort: http - protocol: TCP ---- -apiVersion: v1 -kind: Service -metadata: - name: radarr-metrics - namespace: media-apps -spec: - type: ClusterIP - selector: - app: radarr - ports: - - name: metrics - port: 9707 - targetPort: metrics - protocol: TCP diff --git a/apps/base/radarr/vaultstaticsecret.yaml b/apps/base/radarr/vaultstaticsecret.yaml deleted file mode 100644 index 6b1cfc4..0000000 --- a/apps/base/radarr/vaultstaticsecret.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -apiVersion: secrets.hashicorp.com/v1beta1 -kind: VaultStaticSecret -metadata: - name: radarr - namespace: media-apps -spec: - destination: - create: true - name: radarr-secrets - mount: kv - path: service/media-apps/radarr - refreshAfter: 30s - type: kv-v2 - vaultAuthRef: default - rolloutRestartTargets: - - kind: Deployment - name: radarr diff --git a/apps/base/sonarr/configmap.yaml b/apps/base/sonarr/configmap.yaml deleted file mode 100644 index 820b2fc..0000000 --- a/apps/base/sonarr/configmap.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: sonarr-config-xml - namespace: media-apps -data: - config.xml: | - - * - 8989 - 9898 - False - True - {{API_KEY}} - External - Enabled - info - - - - Sonarr - Docker - False - diff --git a/apps/base/sonarr/deployment.yaml b/apps/base/sonarr/deployment.yaml deleted file mode 100644 index 840fb34..0000000 --- a/apps/base/sonarr/deployment.yaml +++ /dev/null @@ -1,140 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: sonarr - namespace: media-apps -spec: - replicas: 1 - strategy: - type: Recreate - selector: - matchLabels: - app: sonarr - template: - metadata: - labels: - app: sonarr - spec: - securityContext: - fsGroup: 1000 - initContainers: - - name: config-template - image: busybox:latest - imagePullPolicy: IfNotPresent - command: ["/bin/sh"] - args: - - -c - - | - cp /config-template/config.xml /config/config.xml - sed -i "s/{{API_KEY}}/$API_KEY/g" /config/config.xml - env: - - name: API_KEY - valueFrom: - secretKeyRef: - name: sonarr-secrets - key: apitoken - securityContext: - runAsUser: 1000 - runAsGroup: 1000 - runAsNonRoot: true - volumeMounts: - - name: config-template - mountPath: /config-template - - name: config - mountPath: /config - containers: - - name: sonarr - image: ghcr.io/home-operations/sonarr:rolling - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 8989 - protocol: TCP - env: - - name: TZ - value: Australia/Sydney - - name: PORT - value: "8989" - resources: - requests: - cpu: 50m - memory: 128Mi - limits: - cpu: "1" - memory: 1Gi - livenessProbe: - httpGet: - path: / - port: http - initialDelaySeconds: 30 - periodSeconds: 30 - readinessProbe: - httpGet: - path: / - port: http - initialDelaySeconds: 5 - periodSeconds: 10 - volumeMounts: - - name: config - mountPath: /config - - name: media-library - mountPath: /mnt/tvseries - subPath: tvseries - - name: exportarr - image: ghcr.io/onedr0p/exportarr:latest - imagePullPolicy: IfNotPresent - args: ["sonarr"] - ports: - - name: metrics - containerPort: 9707 - protocol: TCP - env: - - name: TZ - value: Australia/Sydney - - name: PORT - value: "9707" - - name: URL - value: "http://localhost:8989" - - name: API_KEY - valueFrom: - secretKeyRef: - name: sonarr-secrets - key: apitoken - resources: - requests: - cpu: 50m - memory: 128Mi - limits: - cpu: 250m - memory: 256Mi - securityContext: - runAsUser: 1000 - runAsGroup: 1000 - runAsNonRoot: true - livenessProbe: - httpGet: - path: /metrics - port: metrics - initialDelaySeconds: 30 - periodSeconds: 30 - readinessProbe: - httpGet: - path: /metrics - port: metrics - initialDelaySeconds: 5 - periodSeconds: 10 - volumeMounts: - - name: config - mountPath: /config - readOnly: true - volumes: - - name: config - persistentVolumeClaim: - claimName: sonarr-config - - name: config-template - configMap: - name: sonarr-config-xml - - name: media-library - persistentVolumeClaim: - claimName: media-library diff --git a/apps/base/sonarr/gateway.yaml b/apps/base/sonarr/gateway.yaml deleted file mode 100644 index 0a53e06..0000000 --- a/apps/base/sonarr/gateway.yaml +++ /dev/null @@ -1,37 +0,0 @@ ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: Gateway -metadata: - labels: - traefik.io/instance: internal - annotations: - cert-manager.io/cluster-issuer: vault-issuer - cert-manager.io/common-name: sonarr.k8s.syd1.au.unkin.net - cert-manager.io/private-key-size: "4096" - external-dns.alpha.kubernetes.io/hostname: sonarr.k8s.syd1.au.unkin.net - external-dns.alpha.kubernetes.io/target: 198.18.200.4 - name: sonarr - namespace: media-apps -spec: - gatewayClassName: traefik-internal - listeners: - - allowedRoutes: - namespaces: - from: Same - hostname: sonarr.k8s.syd1.au.unkin.net - name: http - port: 80 - protocol: HTTP - - allowedRoutes: - namespaces: - from: Same - hostname: sonarr.k8s.syd1.au.unkin.net - name: https - port: 443 - protocol: HTTPS - tls: - certificateRefs: - - group: "" - kind: Secret - name: sonarr-tls - mode: Terminate diff --git a/apps/base/sonarr/httproute.yaml b/apps/base/sonarr/httproute.yaml deleted file mode 100644 index 8ab7ddc..0000000 --- a/apps/base/sonarr/httproute.yaml +++ /dev/null @@ -1,49 +0,0 @@ ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: http-redirect - namespace: media-apps -spec: - hostnames: - - sonarr.k8s.syd1.au.unkin.net - parentRefs: - - group: gateway.networking.k8s.io - kind: Gateway - name: sonarr - sectionName: http - rules: - - filters: - - type: RequestRedirect - requestRedirect: - scheme: https - statusCode: 301 - matches: - - path: - type: PathPrefix - value: / ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: sonarr - namespace: media-apps -spec: - hostnames: - - sonarr.k8s.syd1.au.unkin.net - parentRefs: - - group: gateway.networking.k8s.io - kind: Gateway - name: sonarr - sectionName: https - rules: - - backendRefs: - - group: "" - kind: Service - name: sonarr - port: 8989 - weight: 1 - matches: - - path: - type: PathPrefix - value: / diff --git a/apps/base/sonarr/kustomization.yaml b/apps/base/sonarr/kustomization.yaml deleted file mode 100644 index 7552699..0000000 --- a/apps/base/sonarr/kustomization.yaml +++ /dev/null @@ -1,12 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - pvc.yaml - - configmap.yaml - - vaultstaticsecret.yaml - - deployment.yaml - - service.yaml - - gateway.yaml - - httproute.yaml diff --git a/apps/base/sonarr/pvc.yaml b/apps/base/sonarr/pvc.yaml deleted file mode 100644 index 2d6d1b5..0000000 --- a/apps/base/sonarr/pvc.yaml +++ /dev/null @@ -1,14 +0,0 @@ ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: sonarr-config - namespace: media-apps -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - storageClassName: cephrbd-fast-delete - volumeMode: Filesystem diff --git a/apps/base/sonarr/service.yaml b/apps/base/sonarr/service.yaml deleted file mode 100644 index e829137..0000000 --- a/apps/base/sonarr/service.yaml +++ /dev/null @@ -1,30 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: sonarr - namespace: media-apps -spec: - type: ClusterIP - selector: - app: sonarr - ports: - - name: http - port: 8989 - targetPort: http - protocol: TCP ---- -apiVersion: v1 -kind: Service -metadata: - name: sonarr-metrics - namespace: media-apps -spec: - type: ClusterIP - selector: - app: sonarr - ports: - - name: metrics - port: 9707 - targetPort: metrics - protocol: TCP diff --git a/apps/base/sonarr/vaultstaticsecret.yaml b/apps/base/sonarr/vaultstaticsecret.yaml deleted file mode 100644 index 596f1c6..0000000 --- a/apps/base/sonarr/vaultstaticsecret.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -apiVersion: secrets.hashicorp.com/v1beta1 -kind: VaultStaticSecret -metadata: - name: sonarr - namespace: media-apps -spec: - destination: - create: true - name: sonarr-secrets - mount: kv - path: service/media-apps/sonarr - refreshAfter: 30s - type: kv-v2 - vaultAuthRef: default - rolloutRestartTargets: - - kind: Deployment - name: sonarr diff --git a/apps/overlays/au-syd1/bazarr/kustomization.yaml b/apps/overlays/au-syd1/bazarr/kustomization.yaml deleted file mode 100644 index 7a4eb40..0000000 --- a/apps/overlays/au-syd1/bazarr/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - ../../../base/bazarr diff --git a/apps/overlays/au-syd1/jellyseerr/kustomization.yaml b/apps/overlays/au-syd1/jellyseerr/kustomization.yaml deleted file mode 100644 index daf1683..0000000 --- a/apps/overlays/au-syd1/jellyseerr/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - ../../../base/jellyseerr diff --git a/apps/overlays/au-syd1/media-apps/kustomization.yaml b/apps/overlays/au-syd1/media-apps/kustomization.yaml deleted file mode 100644 index 68cf968..0000000 --- a/apps/overlays/au-syd1/media-apps/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - ../../../base/media-apps diff --git a/apps/overlays/au-syd1/nzbget/kustomization.yaml b/apps/overlays/au-syd1/nzbget/kustomization.yaml deleted file mode 100644 index 8f2c9ae..0000000 --- a/apps/overlays/au-syd1/nzbget/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - ../../../base/nzbget diff --git a/apps/overlays/au-syd1/prowlarr/kustomization.yaml b/apps/overlays/au-syd1/prowlarr/kustomization.yaml deleted file mode 100644 index c2b0fc3..0000000 --- a/apps/overlays/au-syd1/prowlarr/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - ../../../base/prowlarr diff --git a/apps/overlays/au-syd1/radarr/kustomization.yaml b/apps/overlays/au-syd1/radarr/kustomization.yaml deleted file mode 100644 index be3218a..0000000 --- a/apps/overlays/au-syd1/radarr/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - ../../../base/radarr diff --git a/apps/overlays/au-syd1/sonarr/kustomization.yaml b/apps/overlays/au-syd1/sonarr/kustomization.yaml deleted file mode 100644 index 9e686f0..0000000 --- a/apps/overlays/au-syd1/sonarr/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - ../../../base/sonarr diff --git a/argocd/applicationsets/media.yaml b/argocd/applicationsets/media.yaml index f1e5955..f600938 100644 --- a/argocd/applicationsets/media.yaml +++ b/argocd/applicationsets/media.yaml @@ -10,16 +10,8 @@ spec: repoURL: https://git.unkin.net/unkin/argocd-apps revision: HEAD directories: - # Shared foundation: media-apps namespace, vault-reader SA, VaultAuth, - # and the RWX movies/tvseries library PVCs the whole stack mounts. - - path: apps/overlays/*/media-apps + # jellyfin only for now; downloads/managers apps join in later PRs. - path: apps/overlays/*/jellyfin - - path: apps/overlays/*/sonarr - - path: apps/overlays/*/radarr - - path: apps/overlays/*/prowlarr - - path: apps/overlays/*/bazarr - - path: apps/overlays/*/nzbget - - path: apps/overlays/*/jellyseerr template: metadata: name: 'media-{{path[3]}}' @@ -31,8 +23,7 @@ spec: path: '{{path}}' destination: server: https://kubernetes.default.svc - # All media apps share the media-apps namespace (not the dir name). - namespace: media-apps + namespace: jellyfin syncPolicy: automated: prune: true diff --git a/argocd/projects/media.yaml b/argocd/projects/media.yaml index 3982035..4bb0421 100644 --- a/argocd/projects/media.yaml +++ b/argocd/projects/media.yaml @@ -5,11 +5,11 @@ metadata: name: media namespace: argocd spec: - description: Media services (jellyfin + *arr stack) + description: Media services (jellyfin; downloads/managers namespaces to follow) sourceRepos: - https://git.unkin.net/unkin/argocd-apps destinations: - - namespace: media-apps + - namespace: jellyfin server: https://kubernetes.default.svc clusterResourceWhitelist: - group: ''