Initial commit

arrstack/arrstack-vpn-services-endpointslice.yaml

@@ -0,0 +1,38 @@
+# external-services-and-endpoints.yaml
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: arr-stack-endpoints
+  namespace: arrstack
+  labels:
+    kubernetes.io/service-name: arr-stack # This label now links to the Service
+addressType: IPv4
+ports:
+  - name: qbittorrent-port
+    protocol: TCP
+    port: 8080
+  - name: prowlarr-port
+    protocol: TCP
+    port: 9696
+endpoints:
+  - addresses:
+      - "10.8.13.2"
+    conditions:
+      ready: true
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: arr-stack # Service name now matches the label
+  namespace: arrstack
+spec:
+  ports:
+    - name: qbittorrent-port
+      protocol: TCP
+      port: 8080 
+      targetPort: 8080 
+    - name: prowlarr-port
+      protocol: TCP
+      port: 9696
+      targetPort: 9696
+  type: ClusterIP

arrstack/prowlarr-httproute.yaml

@@ -0,0 +1,46 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: prowlarr-route
+  namespace: arrstack
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: prowlarr
+  hostnames:
+    - "prowlarr.jsme.be"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            set:
+              - name: X-Forwarded-Host
+                value: "prowlarr.jsme.be"
+              - name: X-Forwarded-Proto
+                value: https
+        - type: ResponseHeaderModifier
+          responseHeaderModifier:
+            set:
+              - name: Strict-Transport-Security
+                value: "max-age=31536000; includeSubDomains"
+              - name: X-Content-Type-Options
+                value: nosniff
+              - name: X-Frame-Options
+                value: SAMEORIGIN
+              - name: Referrer-Policy
+                value: strict-origin-when-cross-origin
+              - name: Permissions-Policy
+                value: "camera=(), microphone=(), geolocation=(), payment=()"
+      backendRefs:
+        - name: arr-stack
+          port: 9696
+          kind: Service
+          group: ""
+          weight: 1

arrstack/radarr-httproute.yaml

@@ -0,0 +1,48 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: radarr-route
+  namespace: arrstack
+  # NOTE: original ingress had VPN IP whitelist (whitelist-source-range)
+  # Gateway API has no direct equivalent — handle with NetworkPolicy if needed
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: radarr
+  hostnames:
+    - "radarr.jsme.be"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            set:
+              - name: X-Forwarded-Host
+                value: "radarr.jsme.be"
+              - name: X-Forwarded-Proto
+                value: https
+        - type: ResponseHeaderModifier
+          responseHeaderModifier:
+            set:
+              - name: Strict-Transport-Security
+                value: "max-age=31536000; includeSubDomains"
+              - name: X-Content-Type-Options
+                value: nosniff
+              - name: X-Frame-Options
+                value: SAMEORIGIN
+              - name: Referrer-Policy
+                value: strict-origin-when-cross-origin
+              - name: Permissions-Policy
+                value: "camera=(), microphone=(), geolocation=(), payment=()"
+      backendRefs:
+        - name: radarr
+          port: 7878
+          kind: Service
+          group: ""
+          weight: 1

arrstack/radarr/radarr-pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: arrstack
+  name: radarr-config
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn-static
+  resources:
+    requests:
+      storage: 5Gi

arrstack/radarr/radarr-svc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: radarr
+  namespace: arrstack
+spec:
+  selector:
+    app: radarr
+  type: ClusterIP
+  ports:
+  - name: radarr
+    protocol: TCP
+    port: 7878
+    targetPort: 7878 

arrstack/radarr/radarr.yaml

@@ -0,0 +1,61 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata: 
+  name: radarr
+  namespace: arrstack
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: radarr
+  serviceName: radarr
+  template:
+    metadata:
+      labels:
+        app: radarr
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 60
+      securityContext:
+        fsGroup: 0 
+      containers:
+      - name: radarr
+        image: lscr.io/linuxserver/radarr:6.1.1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            cpu: 500m
+            memory: 512Mi
+        env: 
+          - name: PUID
+            value: "0"
+          - name: PGID
+            value: "0"
+        ports:
+          - containerPort: 7878 
+        volumeMounts:
+          - name: config
+            mountPath: /config
+          - name: media
+            subPath: "Anime Movies"
+            mountPath: /anime
+          - name: media
+            subPath: Movies
+            mountPath: /movies
+          - name: media
+            subPath: Nostalgia
+            mountPath: /nostalgia
+          - name: downloads
+            mountPath: /downloads
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: radarr-config
+        - name: media
+          persistentVolumeClaim:
+            claimName: smb-media
+        - name: downloads
+          persistentVolumeClaim:
+            claimName: smb-downloads

arrstack/smb-download.yaml

@@ -0,0 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: smb-downloads
+spec:
+  capacity:
+    storage: 5Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  csi:
+    driver: smb.csi.k8s.io
+    volumeHandle: smb-downloads 
+    volumeAttributes:
+      source: "//10.8.14.2/downloads" 
+    nodeStageSecretRef:
+      name: arrstack-secrets
+      namespace: arrstack
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: arrstack 
+  name: smb-downloads
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+  volumeName: smb-downloads
+  storageClassName: ""
+

arrstack/smb-media.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: smb-media
+#  namespace: arrstack
+spec:
+  capacity:
+    storage: 20Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  csi:
+    driver: smb.csi.k8s.io
+    volumeHandle: smb-media
+    volumeAttributes:
+      source: "//10.8.14.2/Media" 
+    nodeStageSecretRef:
+      name: arrstack-secrets
+      namespace: arrstack
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: arrstack 
+  name: smb-media
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+  volumeName: smb-media
+  storageClassName: ""

arrstack/sonarr-httproute.yaml

@@ -0,0 +1,28 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: sonarr-route
+  namespace: arrstack
+  # NOTE: original ingress had VPN IP whitelist (whitelist-source-range)
+  # Gateway API has no direct equivalent — handle with NetworkPolicy if needed
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: sonarr
+  hostnames:
+    - "sonarr.jsme.be"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: sonarr
+          namespace: arrstack
+          port: 8989
+          kind: Service
+          group: ""
+          weight: 1

arrstack/sonarr/sonarr-pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: arrstack
+  name: sonarr-config
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn-static
+  resources:
+    requests:
+      storage: 10Gi

arrstack/sonarr/sonarr.yaml

@@ -0,0 +1,67 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata: 
+  name: sonarr
+  namespace: arrstack
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sonarr
+  serviceName: sonarr
+  template:
+    metadata:
+      labels:
+        app: sonarr
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 60
+      securityContext: 
+        fsGroup: 0 
+      containers:
+      - name: sonarr
+        image: lscr.io/linuxserver/sonarr:4.0.17
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+          limits:
+            cpu: 500m
+            memory: 1.5Gi
+        env: 
+          - name: PUID
+            value: "0"
+          - name: PGID
+            value: "0"
+        ports:
+          - containerPort: 8989
+        volumeMounts:
+          - name: config
+            mountPath: /config
+          - name: media
+            subPath: "Anime Series"
+            mountPath: /anime
+          - name: media
+            subPath: "Series"
+            mountPath: /series
+          - name: media
+            subPath: Cartoon
+            mountPath: /cartoon
+          - name: media
+            subPath: Nostalgia
+            mountPath: /nostalgia
+          - name: media
+            subPath: Kdrama
+            mountPath: /kdrama
+          - name: downloads
+            mountPath: /downloads
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: sonarr-config
+        - name: media
+          persistentVolumeClaim:
+            claimName: smb-media
+        - name: downloads
+          persistentVolumeClaim:
+            claimName: smb-downloads

arrstack/sonarr/sonarrr-svc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: sonarr
+  namespace: arrstack
+spec:
+  selector:
+    app: sonarr
+  type: ClusterIP
+  ports:
+  - name: sonarr
+    protocol: TCP
+    port: 8989
+    targetPort: 8989

arrstack/torrent-httproute.yaml

@@ -0,0 +1,46 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: torrent-route
+  namespace: arrstack
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: torrent
+  hostnames:
+    - "torrent.jsme.be"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            set:
+              - name: X-Forwarded-Host
+                value: "torrent.jsme.be"
+              - name: X-Forwarded-Proto
+                value: https
+        - type: ResponseHeaderModifier
+          responseHeaderModifier:
+            set:
+              - name: Strict-Transport-Security
+                value: "max-age=31536000; includeSubDomains"
+              - name: X-Content-Type-Options
+                value: nosniff
+              - name: X-Frame-Options
+                value: SAMEORIGIN
+              - name: Referrer-Policy
+                value: strict-origin-when-cross-origin
+              - name: Permissions-Policy
+                value: "camera=(), microphone=(), geolocation=(), payment=()"
+      backendRefs:
+        - name: arr-stack
+          port: 8080
+          kind: Service
+          group: ""
+          weight: 1