unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Deploy jellyfin-ha to ArgoCD (jellyfin namespace, mediafs library) #348

Closed
unkinben wants to merge 3 commits from benvin/media-apps-argocd into main
pull from: benvin/media-apps-argocd
merge into: unkin:main
Conversation 0 Commits 3 Files Changed 19
+24 -1679
69 changed files with 24 additions and 1679 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 54c25be828 - Show all commits
apps/base/bazarr/deployment.yaml
-61
View File
@@ -1,61 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: bazarr
namespace: media-apps
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: bazarr
template:
metadata:
labels:
app: bazarr
spec:
securityContext:
fsGroup: 1000
containers:
- name: bazarr
image: ghcr.io/home-operations/bazarr:rolling
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 6767
protocol: TCP
env:
- name: TZ
value: Australia/Sydney
- name: PUID
value: "1000"
- name: PGID
value: "1000"
resources:
requests:
cpu: 50m
memory: 256Mi
limits:
cpu: "1"
memory: 1Gi
livenessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 5
periodSeconds: 10
volumeMounts:
- name: config
mountPath: /config
volumes:
- name: config
persistentVolumeClaim:
claimName: bazarr-config
apps/base/bazarr/gateway.yaml
-37
View File
@@ -1,37 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
labels:
traefik.io/instance: internal
annotations:
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: bazarr.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
external-dns.alpha.kubernetes.io/hostname: bazarr.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.4
name: bazarr
namespace: media-apps
spec:
gatewayClassName: traefik-internal
listeners:
- allowedRoutes:
namespaces:
from: Same
hostname: bazarr.k8s.syd1.au.unkin.net
name: http
port: 80
protocol: HTTP
- allowedRoutes:
namespaces:
from: Same
hostname: bazarr.k8s.syd1.au.unkin.net
name: https
port: 443
protocol: HTTPS
tls:
certificateRefs:
- group: ""
kind: Secret
name: bazarr-tls
mode: Terminate
apps/base/bazarr/httproute.yaml
-49
View File
@@ -1,49 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: http-redirect
namespace: media-apps
spec:
hostnames:
- bazarr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: bazarr
sectionName: http
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301
matches:
- path:
type: PathPrefix
value: /
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: bazarr
namespace: media-apps
spec:
hostnames:
- bazarr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: bazarr
sectionName: https
rules:
- backendRefs:
- group: ""
kind: Service
name: bazarr
port: 6767
weight: 1
matches:
- path:
type: PathPrefix
value: /
apps/base/bazarr/kustomization.yaml
-10
View File
@@ -1,10 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- pvc.yaml
- deployment.yaml
- service.yaml
- gateway.yaml
- httproute.yaml
apps/base/bazarr/pvc.yaml
-14
View File
@@ -1,14 +0,0 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: bazarr-config
namespace: media-apps
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: cephrbd-fast-delete
volumeMode: Filesystem
apps/base/bazarr/service.yaml
-15
View File
@@ -1,15 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: bazarr
namespace: media-apps
spec:
type: ClusterIP
selector:
app: bazarr
ports:
- name: http
port: 6767
targetPort: http
protocol: TCP
apps/base/jellyfin/deployment.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ apiVersion: apps/v1
kind: Deployment
metadata:
name: jellyfin
namespace: media-apps
namespace: jellyfin
spec:
# Single-replica for now. The jellyfin-ha fork adds the Redis transcode store
# and RWX transcode scratch that make scaling to true HA a follow-up.
apps/base/jellyfin/gateway.yaml
+1 -1
View File
@@ -11,7 +11,7 @@ metadata:
external-dns.alpha.kubernetes.io/hostname: jellyfin.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.4
name: jellyfin
namespace: media-apps
namespace: jellyfin
spec:
gatewayClassName: traefik-internal
listeners:
apps/base/jellyfin/httproute.yaml
+2 -2
View File
@@ -3,7 +3,7 @@ apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: http-redirect
namespace: media-apps
namespace: jellyfin
spec:
hostnames:
- jellyfin.k8s.syd1.au.unkin.net
@@ -27,7 +27,7 @@ apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: jellyfin
namespace: media-apps
namespace: jellyfin
spec:
hostnames:
- jellyfin.k8s.syd1.au.unkin.net
apps/base/jellyfin/kustomization.yaml
+3
View File
@@ -3,6 +3,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- pv_media-library.yaml
- pvc_media-library.yaml
- pvc_config.yaml
- pvc_cache.yaml
- pvc_transcode.yaml
apps/base/media-apps/namespace.yaml → apps/base/jellyfin/namespace.yaml
+1 -1
View File
@@ -2,4 +2,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: media-apps
name: jellyfin
apps/base/media-apps/pv_media-library.yaml → apps/base/jellyfin/pv_media-library.yaml
+3 -3
View File
@@ -9,7 +9,7 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: media-apps-media-library
name: jellyfin-media-library
spec:
accessModes:
- ReadWriteMany
@@ -24,10 +24,10 @@ spec:
apiVersion: v1
kind: PersistentVolumeClaim
name: media-library
namespace: media-apps
namespace: jellyfin
csi:
driver: cephfs.csi.ceph.com
volumeHandle: media-apps-media-library-static
volumeHandle: jellyfin-media-library-static
nodeStageSecretRef:
name: csi-cephfs-secret
namespace: csi-cephfs
apps/base/jellyfin/pvc_cache.yaml
+1 -1
View File
@@ -4,7 +4,7 @@ apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: jellyfin-cache
namespace: media-apps
namespace: jellyfin
spec:
accessModes:
- ReadWriteOnce
apps/base/jellyfin/pvc_config.yaml
+1 -1
View File
@@ -4,7 +4,7 @@ apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: jellyfin-config
namespace: media-apps
namespace: jellyfin
spec:
accessModes:
- ReadWriteOnce
apps/base/media-apps/pvc_media-library.yaml → apps/base/jellyfin/pvc_media-library.yaml
+2 -2
View File
@@ -7,12 +7,12 @@ apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: media-library
namespace: media-apps
namespace: jellyfin
spec:
accessModes:
- ReadWriteMany
storageClassName: ""
volumeName: media-apps-media-library
volumeName: jellyfin-media-library
resources:
requests:
storage: 10Ti
apps/base/jellyfin/pvc_transcode.yaml
+1 -1
View File
@@ -6,7 +6,7 @@ apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: jellyfin-transcode
namespace: media-apps
namespace: jellyfin
spec:
accessModes:
- ReadWriteMany
apps/base/jellyfin/redis-deployment.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ apiVersion: apps/v1
kind: Deployment
metadata:
name: jellyfin-redis
namespace: media-apps
namespace: jellyfin
spec:
replicas: 1
strategy:
apps/base/jellyfin/redis-pvc.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: jellyfin-redis-data
namespace: media-apps
namespace: jellyfin
spec:
accessModes:
- ReadWriteOnce
apps/base/jellyfin/redis-service.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ apiVersion: v1
kind: Service
metadata:
name: jellyfin-redis
namespace: media-apps
namespace: jellyfin
spec:
type: ClusterIP
internalTrafficPolicy: Cluster
apps/base/jellyfin/service.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ apiVersion: v1
kind: Service
metadata:
name: jellyfin
namespace: media-apps
namespace: jellyfin
spec:
type: ClusterIP
internalTrafficPolicy: Cluster
apps/base/jellyseerr/deployment.yaml
-61
View File
@@ -1,61 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: jellyseerr
namespace: media-apps
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: jellyseerr
template:
metadata:
labels:
app: jellyseerr
spec:
securityContext:
fsGroup: 1000
containers:
- name: jellyseerr
image: ghcr.io/fallenbagel/jellyseerr:latest
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 5055
protocol: TCP
env:
- name: TZ
value: Australia/Sydney
- name: LOG_LEVEL
value: debug
- name: PORT
value: "5055"
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: "1"
memory: 1Gi
livenessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 5
periodSeconds: 10
volumeMounts:
- name: config
mountPath: /app/config
volumes:
- name: config
persistentVolumeClaim:
claimName: jellyseerr-config
apps/base/jellyseerr/gateway.yaml
-37
View File
@@ -1,37 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
labels:
traefik.io/instance: internal
annotations:
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: jellyseerr.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
external-dns.alpha.kubernetes.io/hostname: jellyseerr.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.4
name: jellyseerr
namespace: media-apps
spec:
gatewayClassName: traefik-internal
listeners:
- allowedRoutes:
namespaces:
from: Same
hostname: jellyseerr.k8s.syd1.au.unkin.net
name: http
port: 80
protocol: HTTP
- allowedRoutes:
namespaces:
from: Same
hostname: jellyseerr.k8s.syd1.au.unkin.net
name: https
port: 443
protocol: HTTPS
tls:
certificateRefs:
- group: ""
kind: Secret
name: jellyseerr-tls
mode: Terminate
apps/base/jellyseerr/httproute.yaml
-49
View File
@@ -1,49 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: http-redirect
namespace: media-apps
spec:
hostnames:
- jellyseerr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: jellyseerr
sectionName: http
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301
matches:
- path:
type: PathPrefix
value: /
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: jellyseerr
namespace: media-apps
spec:
hostnames:
- jellyseerr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: jellyseerr
sectionName: https
rules:
- backendRefs:
- group: ""
kind: Service
name: jellyseerr
port: 5055
weight: 1
matches:
- path:
type: PathPrefix
value: /
apps/base/jellyseerr/kustomization.yaml
-10
View File
@@ -1,10 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- pvc.yaml
- deployment.yaml
- service.yaml
- gateway.yaml
- httproute.yaml
apps/base/jellyseerr/pvc.yaml
-14
View File
@@ -1,14 +0,0 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: jellyseerr-config
namespace: media-apps
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: cephrbd-fast-delete
volumeMode: Filesystem
apps/base/jellyseerr/service.yaml
-15
View File
@@ -1,15 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: jellyseerr
namespace: media-apps
spec:
type: ClusterIP
selector:
app: jellyseerr
ports:
- name: http
port: 5055
targetPort: http
protocol: TCP
apps/base/media-apps/kustomization.yaml
-10
View File
@@ -1,10 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- serviceaccount.yaml
- vaultauth.yaml
- pv_media-library.yaml
- pvc_media-library.yaml
apps/base/media-apps/serviceaccount.yaml
-12
View File
@@ -1,12 +0,0 @@
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: media-apps-vault-reader
namespace: media-apps
labels:
app.kubernetes.io/name: vault-reader
app.kubernetes.io/component: service-account
annotations:
vault.hashicorp.com/auth-method: kubernetes
automountServiceAccountToken: true
apps/base/media-apps/vaultauth.yaml
-18
View File
@@ -1,18 +0,0 @@
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
name: default
namespace: media-apps
spec:
allowedNamespaces:
- media-apps
kubernetes:
audiences:
- vault
role: media-apps
serviceAccount: media-apps-vault-reader
tokenExpirationSeconds: 600
method: kubernetes
mount: k8s/au/syd1
vaultConnectionRef: vso-system/default
apps/base/nzbget/deployment.yaml
-80
View File
@@ -1,80 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: nzbget
namespace: media-apps
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: nzbget
template:
metadata:
labels:
app: nzbget
spec:
securityContext:
fsGroup: 1000
containers:
- name: nzbget
image: ghcr.io/home-operations/nzbget:rolling
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 6789
protocol: TCP
env:
- name: TZ
value: Australia/Sydney
- name: PUID
value: "1000"
- name: PGID
value: "1000"
- name: NZBGET_USER
valueFrom:
secretKeyRef:
name: nzbget-secrets
key: NZBGET_USER
- name: NZBGET_PASS
valueFrom:
secretKeyRef:
name: nzbget-secrets
key: NZBGET_PASS
resources:
requests:
cpu: 100m
memory: 512Mi
limits:
cpu: "4"
memory: 8Gi
livenessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 5
periodSeconds: 10
volumeMounts:
- name: config
mountPath: /config
- name: media-library
mountPath: /mnt/movies
subPath: movies
- name: media-library
mountPath: /mnt/tvseries
subPath: tvseries
volumes:
- name: config
persistentVolumeClaim:
claimName: nzbget-config
- name: media-library
persistentVolumeClaim:
claimName: media-library
apps/base/nzbget/gateway.yaml
-37
View File
@@ -1,37 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
labels:
traefik.io/instance: internal
annotations:
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: nzbget.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
external-dns.alpha.kubernetes.io/hostname: nzbget.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.4
name: nzbget
namespace: media-apps
spec:
gatewayClassName: traefik-internal
listeners:
- allowedRoutes:
namespaces:
from: Same
hostname: nzbget.k8s.syd1.au.unkin.net
name: http
port: 80
protocol: HTTP
- allowedRoutes:
namespaces:
from: Same
hostname: nzbget.k8s.syd1.au.unkin.net
name: https
port: 443
protocol: HTTPS
tls:
certificateRefs:
- group: ""
kind: Secret
name: nzbget-tls
mode: Terminate
apps/base/nzbget/httproute.yaml
-49
View File
@@ -1,49 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: http-redirect
namespace: media-apps
spec:
hostnames:
- nzbget.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: nzbget
sectionName: http
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301
matches:
- path:
type: PathPrefix
value: /
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: nzbget
namespace: media-apps
spec:
hostnames:
- nzbget.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: nzbget
sectionName: https
rules:
- backendRefs:
- group: ""
kind: Service
name: nzbget
port: 6789
weight: 1
matches:
- path:
type: PathPrefix
value: /
apps/base/nzbget/kustomization.yaml
-11
View File
@@ -1,11 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- pvc.yaml
- vaultstaticsecret.yaml
- deployment.yaml
- service.yaml
- gateway.yaml
- httproute.yaml
apps/base/nzbget/pvc.yaml
-14
View File
@@ -1,14 +0,0 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nzbget-config
namespace: media-apps
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: cephrbd-fast-delete
volumeMode: Filesystem
apps/base/nzbget/service.yaml
-15
View File
@@ -1,15 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: nzbget
namespace: media-apps
spec:
type: ClusterIP
selector:
app: nzbget
ports:
- name: http
port: 6789
targetPort: http
protocol: TCP
apps/base/nzbget/vaultstaticsecret.yaml
-18
View File
@@ -1,18 +0,0 @@
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: nzbget
namespace: media-apps
spec:
destination:
create: true
name: nzbget-secrets
mount: kv
path: service/media-apps/nzbget
refreshAfter: 30s
type: kv-v2
vaultAuthRef: default
rolloutRestartTargets:
- kind: Deployment
name: nzbget
apps/base/prowlarr/configmap.yaml
-25
View File
@@ -1,25 +0,0 @@
---
apiVersion: v1
kind: ConfigMap
metadata:
name: prowlarr-config-xml
namespace: media-apps
data:
config.xml: |
<Config>
<BindAddress>*</BindAddress>
<Port>9696</Port>
<SslPort>9898</SslPort>
<EnableSsl>False</EnableSsl>
<LaunchBrowser>True</LaunchBrowser>
<ApiKey>{{API_KEY}}</ApiKey>
<AuthenticationMethod>External</AuthenticationMethod>
<AuthenticationRequired>Enabled</AuthenticationRequired>
<LogLevel>info</LogLevel>
<SslCertPath></SslCertPath>
<SslCertPassword></SslCertPassword>
<UrlBase></UrlBase>
<InstanceName>prowlarr</InstanceName>
<UpdateMechanism>Docker</UpdateMechanism>
<AnalyticsEnabled>False</AnalyticsEnabled>
</Config>
apps/base/prowlarr/deployment.yaml
-136
View File
@@ -1,136 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: prowlarr
namespace: media-apps
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: prowlarr
template:
metadata:
labels:
app: prowlarr
spec:
securityContext:
fsGroup: 1000
initContainers:
- name: config-template
image: busybox:latest
imagePullPolicy: IfNotPresent
command: ["/bin/sh"]
args:
- -c
- |
cp /config-template/config.xml /config/config.xml
sed -i "s/{{API_KEY}}/$API_KEY/g" /config/config.xml
env:
- name: API_KEY
valueFrom:
secretKeyRef:
name: prowlarr-secrets
key: apitoken
securityContext:
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
volumeMounts:
- name: config-template
mountPath: /config-template
- name: config
mountPath: /config
containers:
- name: prowlarr
image: ghcr.io/home-operations/prowlarr:rolling
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 9696
protocol: TCP
env:
- name: TZ
value: Australia/Sydney
- name: PUID
value: "1000"
- name: PGID
value: "1000"
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: "1"
memory: 1Gi
livenessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 5
periodSeconds: 10
volumeMounts:
- name: config
mountPath: /config
- name: exportarr
image: ghcr.io/onedr0p/exportarr:latest
imagePullPolicy: IfNotPresent
args: ["prowlarr"]
ports:
- name: metrics
containerPort: 9707
protocol: TCP
env:
- name: TZ
value: Australia/Sydney
- name: PORT
value: "9707"
- name: URL
value: "http://localhost:9696"
- name: API_KEY
valueFrom:
secretKeyRef:
name: prowlarr-secrets
key: apitoken
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: 250m
memory: 256Mi
securityContext:
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
livenessProbe:
httpGet:
path: /metrics
port: metrics
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /metrics
port: metrics
initialDelaySeconds: 5
periodSeconds: 10
volumeMounts:
- name: config
mountPath: /config
readOnly: true
volumes:
- name: config
persistentVolumeClaim:
claimName: prowlarr-config
- name: config-template
configMap:
name: prowlarr-config-xml
apps/base/prowlarr/gateway.yaml
-37
View File
@@ -1,37 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
labels:
traefik.io/instance: internal
annotations:
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: prowlarr.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
external-dns.alpha.kubernetes.io/hostname: prowlarr.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.4
name: prowlarr
namespace: media-apps
spec:
gatewayClassName: traefik-internal
listeners:
- allowedRoutes:
namespaces:
from: Same
hostname: prowlarr.k8s.syd1.au.unkin.net
name: http
port: 80
protocol: HTTP
- allowedRoutes:
namespaces:
from: Same
hostname: prowlarr.k8s.syd1.au.unkin.net
name: https
port: 443
protocol: HTTPS
tls:
certificateRefs:
- group: ""
kind: Secret
name: prowlarr-tls
mode: Terminate
apps/base/prowlarr/httproute.yaml
-49
View File
@@ -1,49 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: http-redirect
namespace: media-apps
spec:
hostnames:
- prowlarr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: prowlarr
sectionName: http
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301
matches:
- path:
type: PathPrefix
value: /
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: prowlarr
namespace: media-apps
spec:
hostnames:
- prowlarr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: prowlarr
sectionName: https
rules:
- backendRefs:
- group: ""
kind: Service
name: prowlarr
port: 9696
weight: 1
matches:
- path:
type: PathPrefix
value: /
apps/base/prowlarr/kustomization.yaml
-12
View File
@@ -1,12 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- pvc.yaml
- configmap.yaml
- vaultstaticsecret.yaml
- deployment.yaml
- service.yaml
- gateway.yaml
- httproute.yaml
apps/base/prowlarr/pvc.yaml
-14
View File
@@ -1,14 +0,0 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: prowlarr-config
namespace: media-apps
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: cephrbd-fast-delete
volumeMode: Filesystem
apps/base/prowlarr/service.yaml
-30
View File
@@ -1,30 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: prowlarr
namespace: media-apps
spec:
type: ClusterIP
selector:
app: prowlarr
ports:
- name: http
port: 9696
targetPort: http
protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
name: prowlarr-metrics
namespace: media-apps
spec:
type: ClusterIP
selector:
app: prowlarr
ports:
- name: metrics
port: 9707
targetPort: metrics
protocol: TCP
apps/base/prowlarr/vaultstaticsecret.yaml
-18
View File
@@ -1,18 +0,0 @@
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: prowlarr
namespace: media-apps
spec:
destination:
create: true
name: prowlarr-secrets
mount: kv
path: service/media-apps/prowlarr
refreshAfter: 30s
type: kv-v2
vaultAuthRef: default
rolloutRestartTargets:
- kind: Deployment
name: prowlarr
apps/base/radarr/configmap.yaml
-25
View File
@@ -1,25 +0,0 @@
---
apiVersion: v1
kind: ConfigMap
metadata:
name: radarr-config-xml
namespace: media-apps
data:
config.xml: |
<Config>
<BindAddress>*</BindAddress>
<Port>7878</Port>
<SslPort>9898</SslPort>
<EnableSsl>False</EnableSsl>
<LaunchBrowser>True</LaunchBrowser>
<ApiKey>{{API_KEY}}</ApiKey>
<AuthenticationMethod>External</AuthenticationMethod>
<AuthenticationRequired>Enabled</AuthenticationRequired>
<LogLevel>debug</LogLevel>
<SslCertPath></SslCertPath>
<SslCertPassword></SslCertPassword>
<UrlBase></UrlBase>
<InstanceName>Radarr</InstanceName>
<UpdateMechanism>Docker</UpdateMechanism>
<AnalyticsEnabled>False</AnalyticsEnabled>
</Config>
apps/base/radarr/deployment.yaml
-140
View File
@@ -1,140 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: radarr
namespace: media-apps
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: radarr
template:
metadata:
labels:
app: radarr
spec:
securityContext:
fsGroup: 1000
initContainers:
- name: config-template
image: busybox:latest
imagePullPolicy: IfNotPresent
command: ["/bin/sh"]
args:
- -c
- |
cp /config-template/config.xml /config/config.xml
sed -i "s/{{API_KEY}}/$API_KEY/g" /config/config.xml
env:
- name: API_KEY
valueFrom:
secretKeyRef:
name: radarr-secrets
key: apitoken
securityContext:
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
volumeMounts:
- name: config-template
mountPath: /config-template
- name: config
mountPath: /config
containers:
- name: radarr
image: ghcr.io/home-operations/radarr:rolling
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 7878
protocol: TCP
env:
- name: TZ
value: Australia/Sydney
- name: PORT
value: "7878"
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: "1"
memory: 1Gi
livenessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 5
periodSeconds: 10
volumeMounts:
- name: config
mountPath: /config
- name: media-library
mountPath: /mnt/movies
subPath: movies
- name: exportarr
image: ghcr.io/onedr0p/exportarr:latest
imagePullPolicy: IfNotPresent
args: ["radarr"]
ports:
- name: metrics
containerPort: 9707
protocol: TCP
env:
- name: TZ
value: Australia/Sydney
- name: PORT
value: "9707"
- name: URL
value: "http://localhost:7878"
- name: API_KEY
valueFrom:
secretKeyRef:
name: radarr-secrets
key: apitoken
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: 250m
memory: 256Mi
securityContext:
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
livenessProbe:
httpGet:
path: /metrics
port: metrics
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /metrics
port: metrics
initialDelaySeconds: 5
periodSeconds: 10
volumeMounts:
- name: config
mountPath: /config
readOnly: true
volumes:
- name: config
persistentVolumeClaim:
claimName: radarr-config
- name: config-template
configMap:
name: radarr-config-xml
- name: media-library
persistentVolumeClaim:
claimName: media-library
apps/base/radarr/gateway.yaml
-37
View File
@@ -1,37 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
labels:
traefik.io/instance: internal
annotations:
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: radarr.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
external-dns.alpha.kubernetes.io/hostname: radarr.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.4
name: radarr
namespace: media-apps
spec:
gatewayClassName: traefik-internal
listeners:
- allowedRoutes:
namespaces:
from: Same
hostname: radarr.k8s.syd1.au.unkin.net
name: http
port: 80
protocol: HTTP
- allowedRoutes:
namespaces:
from: Same
hostname: radarr.k8s.syd1.au.unkin.net
name: https
port: 443
protocol: HTTPS
tls:
certificateRefs:
- group: ""
kind: Secret
name: radarr-tls
mode: Terminate
apps/base/radarr/httproute.yaml
-49
View File
@@ -1,49 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: http-redirect
namespace: media-apps
spec:
hostnames:
- radarr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: radarr
sectionName: http
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301
matches:
- path:
type: PathPrefix
value: /
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: radarr
namespace: media-apps
spec:
hostnames:
- radarr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: radarr
sectionName: https
rules:
- backendRefs:
- group: ""
kind: Service
name: radarr
port: 7878
weight: 1
matches:
- path:
type: PathPrefix
value: /
apps/base/radarr/kustomization.yaml
-12
View File
@@ -1,12 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- pvc.yaml
- configmap.yaml
- vaultstaticsecret.yaml
- deployment.yaml
- service.yaml
- gateway.yaml
- httproute.yaml
apps/base/radarr/pvc.yaml
-14
View File
@@ -1,14 +0,0 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: radarr-config
namespace: media-apps
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: cephrbd-fast-delete
volumeMode: Filesystem
apps/base/radarr/service.yaml
-30
View File
@@ -1,30 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: radarr
namespace: media-apps
spec:
type: ClusterIP
selector:
app: radarr
ports:
- name: http
port: 7878
targetPort: http
protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
name: radarr-metrics
namespace: media-apps
spec:
type: ClusterIP
selector:
app: radarr
ports:
- name: metrics
port: 9707
targetPort: metrics
protocol: TCP
apps/base/radarr/vaultstaticsecret.yaml
-18
View File
@@ -1,18 +0,0 @@
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: radarr
namespace: media-apps
spec:
destination:
create: true
name: radarr-secrets
mount: kv
path: service/media-apps/radarr
refreshAfter: 30s
type: kv-v2
vaultAuthRef: default
rolloutRestartTargets:
- kind: Deployment
name: radarr
apps/base/sonarr/configmap.yaml
-25
View File
@@ -1,25 +0,0 @@
---
apiVersion: v1
kind: ConfigMap
metadata:
name: sonarr-config-xml
namespace: media-apps
data:
config.xml: |
<Config>
<BindAddress>*</BindAddress>
<Port>8989</Port>
<SslPort>9898</SslPort>
<EnableSsl>False</EnableSsl>
<LaunchBrowser>True</LaunchBrowser>
<ApiKey>{{API_KEY}}</ApiKey>
<AuthenticationMethod>External</AuthenticationMethod>
<AuthenticationRequired>Enabled</AuthenticationRequired>
<LogLevel>info</LogLevel>
<SslCertPath></SslCertPath>
<SslCertPassword></SslCertPassword>
<UrlBase></UrlBase>
<InstanceName>Sonarr</InstanceName>
<UpdateMechanism>Docker</UpdateMechanism>
<AnalyticsEnabled>False</AnalyticsEnabled>
</Config>
apps/base/sonarr/deployment.yaml
-140
View File
@@ -1,140 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: sonarr
namespace: media-apps
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: sonarr
template:
metadata:
labels:
app: sonarr
spec:
securityContext:
fsGroup: 1000
initContainers:
- name: config-template
image: busybox:latest
imagePullPolicy: IfNotPresent
command: ["/bin/sh"]
args:
- -c
- |
cp /config-template/config.xml /config/config.xml
sed -i "s/{{API_KEY}}/$API_KEY/g" /config/config.xml
env:
- name: API_KEY
valueFrom:
secretKeyRef:
name: sonarr-secrets
key: apitoken
securityContext:
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
volumeMounts:
- name: config-template
mountPath: /config-template
- name: config
mountPath: /config
containers:
- name: sonarr
image: ghcr.io/home-operations/sonarr:rolling
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 8989
protocol: TCP
env:
- name: TZ
value: Australia/Sydney
- name: PORT
value: "8989"
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: "1"
memory: 1Gi
livenessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 5
periodSeconds: 10
volumeMounts:
- name: config
mountPath: /config
- name: media-library
mountPath: /mnt/tvseries
subPath: tvseries
- name: exportarr
image: ghcr.io/onedr0p/exportarr:latest
imagePullPolicy: IfNotPresent
args: ["sonarr"]
ports:
- name: metrics
containerPort: 9707
protocol: TCP
env:
- name: TZ
value: Australia/Sydney
- name: PORT
value: "9707"
- name: URL
value: "http://localhost:8989"
- name: API_KEY
valueFrom:
secretKeyRef:
name: sonarr-secrets
key: apitoken
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: 250m
memory: 256Mi
securityContext:
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
livenessProbe:
httpGet:
path: /metrics
port: metrics
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /metrics
port: metrics
initialDelaySeconds: 5
periodSeconds: 10
volumeMounts:
- name: config
mountPath: /config
readOnly: true
volumes:
- name: config
persistentVolumeClaim:
claimName: sonarr-config
- name: config-template
configMap:
name: sonarr-config-xml
- name: media-library
persistentVolumeClaim:
claimName: media-library
apps/base/sonarr/gateway.yaml
-37
View File
@@ -1,37 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
labels:
traefik.io/instance: internal
annotations:
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: sonarr.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
external-dns.alpha.kubernetes.io/hostname: sonarr.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.4
name: sonarr
namespace: media-apps
spec:
gatewayClassName: traefik-internal
listeners:
- allowedRoutes:
namespaces:
from: Same
hostname: sonarr.k8s.syd1.au.unkin.net
name: http
port: 80
protocol: HTTP
- allowedRoutes:
namespaces:
from: Same
hostname: sonarr.k8s.syd1.au.unkin.net
name: https
port: 443
protocol: HTTPS
tls:
certificateRefs:
- group: ""
kind: Secret
name: sonarr-tls
mode: Terminate
apps/base/sonarr/httproute.yaml
-49
View File
@@ -1,49 +0,0 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: http-redirect
namespace: media-apps
spec:
hostnames:
- sonarr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: sonarr
sectionName: http
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301
matches:
- path:
type: PathPrefix
value: /
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: sonarr
namespace: media-apps
spec:
hostnames:
- sonarr.k8s.syd1.au.unkin.net
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: sonarr
sectionName: https
rules:
- backendRefs:
- group: ""
kind: Service
name: sonarr
port: 8989
weight: 1
matches:
- path:
type: PathPrefix
value: /
apps/base/sonarr/kustomization.yaml
-12
View File
@@ -1,12 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- pvc.yaml
- configmap.yaml
- vaultstaticsecret.yaml
- deployment.yaml
- service.yaml
- gateway.yaml
- httproute.yaml
apps/base/sonarr/pvc.yaml
-14
View File
@@ -1,14 +0,0 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: sonarr-config
namespace: media-apps
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: cephrbd-fast-delete
volumeMode: Filesystem
apps/base/sonarr/service.yaml
-30
View File
@@ -1,30 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: sonarr
namespace: media-apps
spec:
type: ClusterIP
selector:
app: sonarr
ports:
- name: http
port: 8989
targetPort: http
protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
name: sonarr-metrics
namespace: media-apps
spec:
type: ClusterIP
selector:
app: sonarr
ports:
- name: metrics
port: 9707
targetPort: metrics
protocol: TCP
apps/base/sonarr/vaultstaticsecret.yaml
-18
View File
@@ -1,18 +0,0 @@
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: sonarr
namespace: media-apps
spec:
destination:
create: true
name: sonarr-secrets
mount: kv
path: service/media-apps/sonarr
refreshAfter: 30s
type: kv-v2
vaultAuthRef: default
rolloutRestartTargets:
- kind: Deployment
name: sonarr
apps/overlays/au-syd1/bazarr/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../base/bazarr
apps/overlays/au-syd1/jellyseerr/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../base/jellyseerr
apps/overlays/au-syd1/media-apps/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../base/media-apps
apps/overlays/au-syd1/nzbget/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../base/nzbget
apps/overlays/au-syd1/prowlarr/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../base/prowlarr
apps/overlays/au-syd1/radarr/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../base/radarr
apps/overlays/au-syd1/sonarr/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../base/sonarr
argocd/applicationsets/media.yaml
+2 -11
View File
@@ -10,16 +10,8 @@ spec:
repoURL: https://git.unkin.net/unkin/argocd-apps
revision: HEAD
directories:
# Shared foundation: media-apps namespace, vault-reader SA, VaultAuth,
# and the RWX movies/tvseries library PVCs the whole stack mounts.
- path: apps/overlays/*/media-apps
# jellyfin only for now; downloads/managers apps join in later PRs.
- path: apps/overlays/*/jellyfin
- path: apps/overlays/*/sonarr
- path: apps/overlays/*/radarr
- path: apps/overlays/*/prowlarr
- path: apps/overlays/*/bazarr
- path: apps/overlays/*/nzbget
- path: apps/overlays/*/jellyseerr
template:
metadata:
name: 'media-{{path[3]}}'
@@ -31,8 +23,7 @@ spec:
path: '{{path}}'
destination:
server: https://kubernetes.default.svc
# All media apps share the media-apps namespace (not the dir name).
namespace: media-apps
namespace: jellyfin
syncPolicy:
automated:
prune: true
argocd/projects/media.yaml
+2 -2
View File
@@ -5,11 +5,11 @@ metadata:
name: media
namespace: argocd
spec:
description: Media services (jellyfin + *arr stack)
description: Media services (jellyfin; downloads/managers namespaces to follow)
sourceRepos:
- https://git.unkin.net/unkin/argocd-apps
destinations:
- namespace: media-apps
- namespace: jellyfin
server: https://kubernetes.default.svc
clusterResourceWhitelist:
- group: ''