Up resource usage

Fix Env variables
Update version and addition zone name + Gotify support
2026-06-20 17:51:59 +02:00 · 2026-06-20 17:23:41 +02:00 · 2026-06-20 17:08:14 +02:00 · 2026-06-20 15:07:47 +00:00 · 2026-06-18 21:41:43 +02:00 · 2026-06-18 21:37:38 +02:00
27 changed files with 558 additions and 0 deletions
@@ -0,0 +1,23 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: arrstack
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git
+    path: arrstack
+    targetRevision: HEAD
+    directory:
+      recurse: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: arrstack
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - PruneLast=true
@@ -0,0 +1,38 @@
+# external-services-and-endpoints.yaml
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: arr-stack-endpoints
+  namespace: arrstack
+  labels:
+    kubernetes.io/service-name: arr-stack # This label now links to the Service
+addressType: IPv4
+ports:
+  - name: qbittorrent-port
+    protocol: TCP
+    port: 8080
+  - name: prowlarr-port
+    protocol: TCP
+    port: 9696
+endpoints:
+  - addresses:
+      - "10.8.13.2"
+    conditions:
+      ready: true
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: arr-stack # Service name now matches the label
+  namespace: arrstack
+spec:
+  ports:
+    - name: qbittorrent-port
+      protocol: TCP
+      port: 8080 
+      targetPort: 8080 
+    - name: prowlarr-port
+      protocol: TCP
+      port: 9696
+      targetPort: 9696
+  type: ClusterIP
@@ -0,0 +1,46 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: prowlarr-route
+  namespace: arrstack
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: prowlarr
+  hostnames:
+    - "prowlarr.jsme.be"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            set:
+              - name: X-Forwarded-Host
+                value: "prowlarr.jsme.be"
+              - name: X-Forwarded-Proto
+                value: https
+        - type: ResponseHeaderModifier
+          responseHeaderModifier:
+            set:
+              - name: Strict-Transport-Security
+                value: "max-age=31536000; includeSubDomains"
+              - name: X-Content-Type-Options
+                value: nosniff
+              - name: X-Frame-Options
+                value: SAMEORIGIN
+              - name: Referrer-Policy
+                value: strict-origin-when-cross-origin
+              - name: Permissions-Policy
+                value: "camera=(), microphone=(), geolocation=(), payment=()"
+      backendRefs:
+        - name: arr-stack
+          port: 9696
+          kind: Service
+          group: ""
+          weight: 1
@@ -0,0 +1,48 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: radarr-route
+  namespace: arrstack
+  # NOTE: original ingress had VPN IP whitelist (whitelist-source-range)
+  # Gateway API has no direct equivalent — handle with NetworkPolicy if needed
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: radarr
+  hostnames:
+    - "radarr.jsme.be"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            set:
+              - name: X-Forwarded-Host
+                value: "radarr.jsme.be"
+              - name: X-Forwarded-Proto
+                value: https
+        - type: ResponseHeaderModifier
+          responseHeaderModifier:
+            set:
+              - name: Strict-Transport-Security
+                value: "max-age=31536000; includeSubDomains"
+              - name: X-Content-Type-Options
+                value: nosniff
+              - name: X-Frame-Options
+                value: SAMEORIGIN
+              - name: Referrer-Policy
+                value: strict-origin-when-cross-origin
+              - name: Permissions-Policy
+                value: "camera=(), microphone=(), geolocation=(), payment=()"
+      backendRefs:
+        - name: radarr
+          port: 7878
+          kind: Service
+          group: ""
+          weight: 1
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: arrstack
+  name: radarr-config
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn-static
+  resources:
+    requests:
+      storage: 5Gi
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: radarr
+  namespace: arrstack
+spec:
+  selector:
+    app: radarr
+  type: ClusterIP
+  ports:
+  - name: radarr
+    protocol: TCP
+    port: 7878
+    targetPort: 7878 
@@ -0,0 +1,61 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata: 
+  name: radarr
+  namespace: arrstack
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: radarr
+  serviceName: radarr
+  template:
+    metadata:
+      labels:
+        app: radarr
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 60
+      securityContext:
+        fsGroup: 0 
+      containers:
+      - name: radarr
+        image: lscr.io/linuxserver/radarr:6.1.1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            cpu: 500m
+            memory: 512Mi
+        env: 
+          - name: PUID
+            value: "0"
+          - name: PGID
+            value: "0"
+        ports:
+          - containerPort: 7878 
+        volumeMounts:
+          - name: config
+            mountPath: /config
+          - name: media
+            subPath: "Anime Movies"
+            mountPath: /anime
+          - name: media
+            subPath: Movies
+            mountPath: /movies
+          - name: media
+            subPath: Nostalgia
+            mountPath: /nostalgia
+          - name: downloads
+            mountPath: /downloads
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: radarr-config
+        - name: media
+          persistentVolumeClaim:
+            claimName: smb-media
+        - name: downloads
+          persistentVolumeClaim:
+            claimName: smb-downloads
@@ -0,0 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: smb-downloads
+spec:
+  capacity:
+    storage: 5Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  csi:
+    driver: smb.csi.k8s.io
+    volumeHandle: smb-downloads 
+    volumeAttributes:
+      source: "//10.8.14.2/downloads" 
+    nodeStageSecretRef:
+      name: arrstack-secrets
+      namespace: arrstack
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: arrstack 
+  name: smb-downloads
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+  volumeName: smb-downloads
+  storageClassName: ""
+
@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: smb-media
+#  namespace: arrstack
+spec:
+  capacity:
+    storage: 20Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  csi:
+    driver: smb.csi.k8s.io
+    volumeHandle: smb-media
+    volumeAttributes:
+      source: "//10.8.14.2/Media" 
+    nodeStageSecretRef:
+      name: arrstack-secrets
+      namespace: arrstack
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: arrstack 
+  name: smb-media
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+  volumeName: smb-media
+  storageClassName: ""
@@ -0,0 +1,28 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: sonarr-route
+  namespace: arrstack
+  # NOTE: original ingress had VPN IP whitelist (whitelist-source-range)
+  # Gateway API has no direct equivalent — handle with NetworkPolicy if needed
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: sonarr
+  hostnames:
+    - "sonarr.jsme.be"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: sonarr
+          namespace: arrstack
+          port: 8989
+          kind: Service
+          group: ""
+          weight: 1
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: arrstack
+  name: sonarr-config
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn-static
+  resources:
+    requests:
+      storage: 10Gi
@@ -0,0 +1,67 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata: 
+  name: sonarr
+  namespace: arrstack
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sonarr
+  serviceName: sonarr
+  template:
+    metadata:
+      labels:
+        app: sonarr
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 60
+      securityContext: 
+        fsGroup: 0 
+      containers:
+      - name: sonarr
+        image: lscr.io/linuxserver/sonarr:4.0.17
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+          limits:
+            cpu: 500m
+            memory: 1.5Gi
+        env: 
+          - name: PUID
+            value: "0"
+          - name: PGID
+            value: "0"
+        ports:
+          - containerPort: 8989
+        volumeMounts:
+          - name: config
+            mountPath: /config
+          - name: media
+            subPath: "Anime Series"
+            mountPath: /anime
+          - name: media
+            subPath: "Series"
+            mountPath: /series
+          - name: media
+            subPath: Cartoon
+            mountPath: /cartoon
+          - name: media
+            subPath: Nostalgia
+            mountPath: /nostalgia
+          - name: media
+            subPath: Kdrama
+            mountPath: /kdrama
+          - name: downloads
+            mountPath: /downloads
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: sonarr-config
+        - name: media
+          persistentVolumeClaim:
+            claimName: smb-media
+        - name: downloads
+          persistentVolumeClaim:
+            claimName: smb-downloads
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: sonarr
+  namespace: arrstack
+spec:
+  selector:
+    app: sonarr
+  type: ClusterIP
+  ports:
+  - name: sonarr
+    protocol: TCP
+    port: 8989
+    targetPort: 8989
@@ -0,0 +1,46 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: torrent-route
+  namespace: arrstack
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: torrent
+  hostnames:
+    - "torrent.jsme.be"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            set:
+              - name: X-Forwarded-Host
+                value: "torrent.jsme.be"
+              - name: X-Forwarded-Proto
+                value: https
+        - type: ResponseHeaderModifier
+          responseHeaderModifier:
+            set:
+              - name: Strict-Transport-Security
+                value: "max-age=31536000; includeSubDomains"
+              - name: X-Content-Type-Options
+                value: nosniff
+              - name: X-Frame-Options
+                value: SAMEORIGIN
+              - name: Referrer-Policy
+                value: strict-origin-when-cross-origin
+              - name: Permissions-Policy
+                value: "camera=(), microphone=(), geolocation=(), payment=()"
+      backendRefs:
+        - name: arr-stack
+          port: 8080
+          kind: Service
+          group: ""
+          weight: 1
@@ -0,0 +1,30 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: radarr-ingress
+  namespace: arrstack         
+  annotations:
+    cert-manager.io/cluster-issuer: azure-dns
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    nginx.ingress.kubernetes.io/use-forwarded-headers: "true"
+    nginx.ingress.kubernetes.io/proxy-real-ip-cidr: "0.0.0.0/0"
+    nginx.ingress.kubernetes.io/whitelist-source-range: "10.8.69.0/24,10.8.3.2/32,10.8.4.0/24,10.8.13.2/32"
+spec:
+  ingressClassName: nginx         
+  tls:
+  - hosts:
+    - radarr.jsme.be
+    secretName: radarr-tls     
+  rules:
+  - host: radarr.jsme.be
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: radarr  
+            port:
+              number: 7878
+
@@ -0,0 +1,30 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: sonarr-ingress
+  namespace: arrstack         
+  annotations:
+    cert-manager.io/cluster-issuer: azure-dns
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    nginx.ingress.kubernetes.io/use-forwarded-headers: "true"
+    nginx.ingress.kubernetes.io/proxy-real-ip-cidr: "0.0.0.0/0"
+    nginx.ingress.kubernetes.io/whitelist-source-range: "10.8.69.0/24,10.8.3.2/32,10.8.4.0/24,10.8.13.2/32"
+spec:
+  ingressClassName: nginx         
+  tls:
+  - hosts:
+    - sonarr.jsme.be
+    secretName: sonarr-tls     
+  rules:
+  - host: sonarr.jsme.be
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: sonarr  
+            port:
+              number: 8989 
+
@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: arrstack-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/arrstack"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: arrstack-secrets
+    secretNamespace: arrstack
+    secretType: Opaque
Author	SHA1	Message	Date
Jeffrey	2ca49f25ae	Up resource usage	2026-06-20 17:51:59 +02:00
Jeffrey	2ef89621be	Fix Env variables	2026-06-20 17:23:41 +02:00
Jeffrey	16bc9f9403	Update version and addition zone name + Gotify support	2026-06-20 17:08:14 +02:00
Gitea CI	4c66eb4be8	ci: update azure-ddns-python image to 1.1	2026-06-20 15:07:47 +00:00
Jeffrey	5d25a0849d	victoria-metrics: use Recreate strategy for grafana (single RWO PVC) RollingUpdate deadlocks on the ReadWriteOnce longhorn PVC: old and new pods cannot both attach the volume. Recreate terminates the old pod first.	2026-06-18 21:41:43 +02:00
Jeffrey	734b10a8db	victoria-metrics: fix grafana admin secret to use existingSecret Resolves duplicate GF_SECURITY_ADMIN_PASSWORD env (chart default + envValueFrom) that broke ArgoCD diff and left the grafana Deployment unable to sync.	2026-06-18 21:37:38 +02:00
Jeffrey	52cf8033c8	envoy-gateway: add seerr-test.jsme.be listener + cert (OIDC preview test) Temporary listener/cert for the seerr-test instance running the preview-new-oidc build. Remove along with the seerr-test workload when testing is done.	2026-06-14 12:45:53 +02:00
Jeffrey	5b36bcc81d	docs: update README with affine, harbor, pelican, stable-diffusion	2026-06-07 01:03:39 +02:00
Jeffrey	869d8f5200	add Pelican panel manifests	2026-06-07 00:51:34 +02:00
Jeffrey	03e25996a4	Remove useClientProtocol from MinIO BackendTrafficPolicy to fix HTTP/2 protocol error	2026-06-03 16:40:20 +02:00
Jeffrey	59a303e34f	Add BackendTrafficPolicy for MinIO console and API to fix download timeouts	2026-06-03 16:32:33 +02:00
Jeffrey	0c4b73d499	Add ClientTrafficPolicy for MinIO console listener to fix download timeouts	2026-06-03 16:24:42 +02:00
Jeffrey	ba56edeb87	envoy-gateway: add ClientTrafficPolicy for minio-aistor to support large file transfers	2026-06-03 16:17:58 +02:00
Jeffrey	a35c26c7e4	authentik: upgrade to 2026.5.2	2026-06-03 12:18:29 +02:00
Jeffrey	3fbd4e500b	pelican: remove endpointslice, switch service to pod selector, use dynamic longhorn for mariadb	2026-06-03 10:22:12 +02:00
Jeffrey	4fdbdb0d8e	pelican: add infisical secret	2026-06-03 09:55:13 +02:00
Jeffrey	d64161d48b	pelican: add cdnjs.cloudflare.com to style-src and font-src for Monaco editor	2026-06-03 08:12:43 +02:00
Jeffrey	db01fd5551	pelican: allow cdnjs.cloudflare.com in CSP for Monaco editor	2026-06-03 08:06:59 +02:00
Jeffrey	c6a35feaa6	Add wings.jsme.be to panel CSP connect-src to allow file uploads	2026-06-02 23:42:27 +02:00
Jeffrey	63d48cf66c	Restrict Wings listener ALPN to http/1.1 to fix Guzzle broken pipe	2026-06-02 23:22:11 +02:00
Jeffrey	aa13b62d40	Add Wings ClientTrafficPolicy to envoy-gateway kustomization	2026-06-02 22:50:41 +02:00
Jeffrey	354bcaf3d9	Move Wings ClientTrafficPolicy to envoy-gateway dir	2026-06-02 22:49:08 +02:00
Jeffrey	eff222811d	Add Wings ClientTrafficPolicy for upload timeout	2026-06-02 22:47:50 +02:00
Jeffrey	f33cc2fc94	Remove Wings BackendTrafficPolicy	2026-06-02 22:41:57 +02:00
Jeffrey	da828f2447	Fix Wings BackendTrafficPolicy: remove useClientProtocol	2026-06-02 22:38:15 +02:00
Jeffrey	d9b467e5aa	Add Wings BackendTrafficPolicy for WebSocket support	2026-06-02 22:35:25 +02:00
Jeffrey	55da4fcbfa	Add Wings HTTPS proxy via Envoy Gateway	2026-06-02 22:29:17 +02:00
Jeffrey	0d567d9cca	Update pelican/httproute.yaml	2026-06-02 19:41:40 +00:00
Jeffrey	077afc938b	Update pelican/httproute.yaml	2026-06-02 19:35:00 +00:00
Jeffrey	4949c72661	Fix kustomization: remove shelfmark/docuseal, recreate affine gateway files	2026-06-02 19:32:03 +02:00
Jeffrey	d2f697b3df	Add Pelican panel — EndpointSlice, HTTPRoute, certificate, gateway listener	2026-06-02 19:25:18 +02:00
Jeffrey	97516059df	Remove hardcoded volumeName from searxng PVC	2026-06-01 11:12:26 +02:00
Jeffrey	9109e5724d	Reset git history for making manifests public	2026-06-01 11:06:25 +02:00