Up resource usage

RollingUpdate deadlocks on the ReadWriteOnce longhorn PVC: old and new
pods cannot both attach the volume. Recreate terminates the old pod first.

argocd/applications/arrstack.yaml

@@ -0,0 +1,23 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: arrstack
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git
+    path: arrstack
+    targetRevision: HEAD
+    directory:
+      recurse: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: arrstack
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - PruneLast=true

arrstack/arrstack-vpn-services-endpointslice.yaml

@@ -0,0 +1,38 @@
+# external-services-and-endpoints.yaml
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: arr-stack-endpoints
+  namespace: arrstack
+  labels:
+    kubernetes.io/service-name: arr-stack # This label now links to the Service
+addressType: IPv4
+ports:
+  - name: qbittorrent-port
+    protocol: TCP
+    port: 8080
+  - name: prowlarr-port
+    protocol: TCP
+    port: 9696
+endpoints:
+  - addresses:
+      - "10.8.13.2"
+    conditions:
+      ready: true
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: arr-stack # Service name now matches the label
+  namespace: arrstack
+spec:
+  ports:
+    - name: qbittorrent-port
+      protocol: TCP
+      port: 8080 
+      targetPort: 8080 
+    - name: prowlarr-port
+      protocol: TCP
+      port: 9696
+      targetPort: 9696
+  type: ClusterIP

arrstack/prowlarr-httproute.yaml

@@ -0,0 +1,46 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: prowlarr-route
+  namespace: arrstack
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: prowlarr
+  hostnames:
+    - "prowlarr.jsme.be"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            set:
+              - name: X-Forwarded-Host
+                value: "prowlarr.jsme.be"
+              - name: X-Forwarded-Proto
+                value: https
+        - type: ResponseHeaderModifier
+          responseHeaderModifier:
+            set:
+              - name: Strict-Transport-Security
+                value: "max-age=31536000; includeSubDomains"
+              - name: X-Content-Type-Options
+                value: nosniff
+              - name: X-Frame-Options
+                value: SAMEORIGIN
+              - name: Referrer-Policy
+                value: strict-origin-when-cross-origin
+              - name: Permissions-Policy
+                value: "camera=(), microphone=(), geolocation=(), payment=()"
+      backendRefs:
+        - name: arr-stack
+          port: 9696
+          kind: Service
+          group: ""
+          weight: 1

arrstack/radarr-httproute.yaml

@@ -0,0 +1,48 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: radarr-route
+  namespace: arrstack
+  # NOTE: original ingress had VPN IP whitelist (whitelist-source-range)
+  # Gateway API has no direct equivalent — handle with NetworkPolicy if needed
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: radarr
+  hostnames:
+    - "radarr.jsme.be"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            set:
+              - name: X-Forwarded-Host
+                value: "radarr.jsme.be"
+              - name: X-Forwarded-Proto
+                value: https
+        - type: ResponseHeaderModifier
+          responseHeaderModifier:
+            set:
+              - name: Strict-Transport-Security
+                value: "max-age=31536000; includeSubDomains"
+              - name: X-Content-Type-Options
+                value: nosniff
+              - name: X-Frame-Options
+                value: SAMEORIGIN
+              - name: Referrer-Policy
+                value: strict-origin-when-cross-origin
+              - name: Permissions-Policy
+                value: "camera=(), microphone=(), geolocation=(), payment=()"
+      backendRefs:
+        - name: radarr
+          port: 7878
+          kind: Service
+          group: ""
+          weight: 1

arrstack/radarr/radarr-pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: arrstack
+  name: radarr-config
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn-static
+  resources:
+    requests:
+      storage: 5Gi

arrstack/radarr/radarr-svc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: radarr
+  namespace: arrstack
+spec:
+  selector:
+    app: radarr
+  type: ClusterIP
+  ports:
+  - name: radarr
+    protocol: TCP
+    port: 7878
+    targetPort: 7878 

arrstack/radarr/radarr.yaml

@@ -0,0 +1,61 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata: 
+  name: radarr
+  namespace: arrstack
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: radarr
+  serviceName: radarr
+  template:
+    metadata:
+      labels:
+        app: radarr
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 60
+      securityContext:
+        fsGroup: 0 
+      containers:
+      - name: radarr
+        image: lscr.io/linuxserver/radarr:6.1.1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            cpu: 500m
+            memory: 512Mi
+        env: 
+          - name: PUID
+            value: "0"
+          - name: PGID
+            value: "0"
+        ports:
+          - containerPort: 7878 
+        volumeMounts:
+          - name: config
+            mountPath: /config
+          - name: media
+            subPath: "Anime Movies"
+            mountPath: /anime
+          - name: media
+            subPath: Movies
+            mountPath: /movies
+          - name: media
+            subPath: Nostalgia
+            mountPath: /nostalgia
+          - name: downloads
+            mountPath: /downloads
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: radarr-config
+        - name: media
+          persistentVolumeClaim:
+            claimName: smb-media
+        - name: downloads
+          persistentVolumeClaim:
+            claimName: smb-downloads

arrstack/smb-download.yaml

@@ -0,0 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: smb-downloads
+spec:
+  capacity:
+    storage: 5Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  csi:
+    driver: smb.csi.k8s.io
+    volumeHandle: smb-downloads 
+    volumeAttributes:
+      source: "//10.8.14.2/downloads" 
+    nodeStageSecretRef:
+      name: arrstack-secrets
+      namespace: arrstack
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: arrstack 
+  name: smb-downloads
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+  volumeName: smb-downloads
+  storageClassName: ""
+

arrstack/smb-media.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: smb-media
+#  namespace: arrstack
+spec:
+  capacity:
+    storage: 20Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  csi:
+    driver: smb.csi.k8s.io
+    volumeHandle: smb-media
+    volumeAttributes:
+      source: "//10.8.14.2/Media" 
+    nodeStageSecretRef:
+      name: arrstack-secrets
+      namespace: arrstack
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: arrstack 
+  name: smb-media
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+  volumeName: smb-media
+  storageClassName: ""

arrstack/sonarr-httproute.yaml

@@ -0,0 +1,28 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: sonarr-route
+  namespace: arrstack
+  # NOTE: original ingress had VPN IP whitelist (whitelist-source-range)
+  # Gateway API has no direct equivalent — handle with NetworkPolicy if needed
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: sonarr
+  hostnames:
+    - "sonarr.jsme.be"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: sonarr
+          namespace: arrstack
+          port: 8989
+          kind: Service
+          group: ""
+          weight: 1

arrstack/sonarr/sonarr-pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: arrstack
+  name: sonarr-config
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn-static
+  resources:
+    requests:
+      storage: 10Gi

arrstack/sonarr/sonarr.yaml

@@ -0,0 +1,67 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata: 
+  name: sonarr
+  namespace: arrstack
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sonarr
+  serviceName: sonarr
+  template:
+    metadata:
+      labels:
+        app: sonarr
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 60
+      securityContext: 
+        fsGroup: 0 
+      containers:
+      - name: sonarr
+        image: lscr.io/linuxserver/sonarr:4.0.17
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+          limits:
+            cpu: 500m
+            memory: 1.5Gi
+        env: 
+          - name: PUID
+            value: "0"
+          - name: PGID
+            value: "0"
+        ports:
+          - containerPort: 8989
+        volumeMounts:
+          - name: config
+            mountPath: /config
+          - name: media
+            subPath: "Anime Series"
+            mountPath: /anime
+          - name: media
+            subPath: "Series"
+            mountPath: /series
+          - name: media
+            subPath: Cartoon
+            mountPath: /cartoon
+          - name: media
+            subPath: Nostalgia
+            mountPath: /nostalgia
+          - name: media
+            subPath: Kdrama
+            mountPath: /kdrama
+          - name: downloads
+            mountPath: /downloads
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: sonarr-config
+        - name: media
+          persistentVolumeClaim:
+            claimName: smb-media
+        - name: downloads
+          persistentVolumeClaim:
+            claimName: smb-downloads

arrstack/sonarr/sonarrr-svc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: sonarr
+  namespace: arrstack
+spec:
+  selector:
+    app: sonarr
+  type: ClusterIP
+  ports:
+  - name: sonarr
+    protocol: TCP
+    port: 8989
+    targetPort: 8989

arrstack/torrent-httproute.yaml

@@ -0,0 +1,46 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: torrent-route
+  namespace: arrstack
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: torrent
+  hostnames:
+    - "torrent.jsme.be"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            set:
+              - name: X-Forwarded-Host
+                value: "torrent.jsme.be"
+              - name: X-Forwarded-Proto
+                value: https
+        - type: ResponseHeaderModifier
+          responseHeaderModifier:
+            set:
+              - name: Strict-Transport-Security
+                value: "max-age=31536000; includeSubDomains"
+              - name: X-Content-Type-Options
+                value: nosniff
+              - name: X-Frame-Options
+                value: SAMEORIGIN
+              - name: Referrer-Policy
+                value: strict-origin-when-cross-origin
+              - name: Permissions-Policy
+                value: "camera=(), microphone=(), geolocation=(), payment=()"
+      backendRefs:
+        - name: arr-stack
+          port: 8080
+          kind: Service
+          group: ""
+          weight: 1

deprecated/nginx-ingress-controller/radarr-ingress.yaml

@@ -0,0 +1,30 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: radarr-ingress
+  namespace: arrstack         
+  annotations:
+    cert-manager.io/cluster-issuer: azure-dns
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    nginx.ingress.kubernetes.io/use-forwarded-headers: "true"
+    nginx.ingress.kubernetes.io/proxy-real-ip-cidr: "0.0.0.0/0"
+    nginx.ingress.kubernetes.io/whitelist-source-range: "10.8.69.0/24,10.8.3.2/32,10.8.4.0/24,10.8.13.2/32"
+spec:
+  ingressClassName: nginx         
+  tls:
+  - hosts:
+    - radarr.jsme.be
+    secretName: radarr-tls     
+  rules:
+  - host: radarr.jsme.be
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: radarr  
+            port:
+              number: 7878
+

deprecated/nginx-ingress-controller/sonarr-ingress.yaml

@@ -0,0 +1,30 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: sonarr-ingress
+  namespace: arrstack         
+  annotations:
+    cert-manager.io/cluster-issuer: azure-dns
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    nginx.ingress.kubernetes.io/use-forwarded-headers: "true"
+    nginx.ingress.kubernetes.io/proxy-real-ip-cidr: "0.0.0.0/0"
+    nginx.ingress.kubernetes.io/whitelist-source-range: "10.8.69.0/24,10.8.3.2/32,10.8.4.0/24,10.8.13.2/32"
+spec:
+  ingressClassName: nginx         
+  tls:
+  - hosts:
+    - sonarr.jsme.be
+    secretName: sonarr-tls     
+  rules:
+  - host: sonarr.jsme.be
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: sonarr  
+            port:
+              number: 8989 
+

infisical/Infisical-secrets/arrstack.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: arrstack-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/arrstack"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: arrstack-secrets
+    secretNamespace: arrstack
+    secretType: Opaque