Deploy qBittorrent through Proton VPN

2026-11-01 13:16:14 +00:00
1 parent ef4655086f
commit b0c3d44c78
@@ -0,0 +1,124 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: qbittorrent
+  namespace: qbittorrent
+spec:
+  # qBittorrent has one writable configuration volume and one Proton port
+  # forwarding lease, so upgrades replace the Pod rather than overlap two.
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: qbittorrent
+  template:
+    metadata:
+      labels:
+        app: qbittorrent
+    spec:
+      # The SOPS-managed Secret is read-only, but Hotio writes Proton's current
+      # forwarded port beside wg0.conf. Copy the secret into a writable emptyDir
+      # without ever storing the plaintext WireGuard key in Git.
+      initContainers:
+        - name: prepare-wireguard-config
+          image: busybox:1.37.0
+          command:
+            - sh
+            - -ec
+            - >-
+              cp /vpn-secret/wg0.conf /wireguard/wg0.conf &&
+              chmod 0600 /wireguard/wg0.conf
+          volumeMounts:
+            - name: wireguard-secret
+              mountPath: /vpn-secret
+              readOnly: true
+            - name: wireguard-runtime
+              mountPath: /wireguard
+      containers:
+        - name: qbittorrent
+          image: ghcr.io/hotio/qbittorrent:release
+          imagePullPolicy: Always
+          securityContext:
+            # Hotio needs this capability to create the WireGuard interface,
+            # routes, firewall rules, and VPN kill switch inside the Pod.
+            capabilities:
+              add:
+                - NET_ADMIN
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: UMASK
+              value: "002"
+            - name: TZ
+              value: Europe/London
+            - name: WEBUI_PORTS
+              value: 8080/tcp
+            - name: VPN_ENABLED
+              value: "true"
+            - name: VPN_CONF
+              value: wg0
+            - name: VPN_PROVIDER
+              value: proton
+            # Permit ingress-nginx and the media application Pods to reach the
+            # Web UI/API without allowing ordinary internet traffic to bypass
+            # the VPN. The LAN range is also retained for cluster-local access.
+            - name: VPN_LAN_NETWORK
+              value: 10.10.0.0/16,10.244.0.0/21
+            - name: VPN_LAN_LEAK_ENABLED
+              value: "false"
+            # Proton assigns a dynamic inbound port through NAT-PMP. Hotio
+            # renews it and updates qBittorrent's listening port automatically.
+            - name: VPN_AUTO_PORT_FORWARD
+              value: "true"
+            - name: VPN_HEALTHCHECK_ENABLED
+              value: "true"
+            - name: VPN_NAMESERVERS
+              value: wg
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          startupProbe:
+            httpGet:
+              path: /
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 36
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            periodSeconds: 30
+            timeoutSeconds: 10
+            failureThreshold: 3
+          volumeMounts:
+            - name: qbittorrent-config
+              mountPath: /config
+            - name: wireguard-runtime
+              mountPath: /config/wireguard
+            - name: torrents
+              mountPath: /data/torrents
+      volumes:
+        - name: qbittorrent-config
+          persistentVolumeClaim:
+            claimName: qbittorrent-config
+        - name: wireguard-secret
+          secret:
+            secretName: qbittorrent-wireguard
+        - name: wireguard-runtime
+          emptyDir: {}
+        - name: torrents
+          nfs:
+            server: nas.ahmza.com
+            path: /srv/media/torrents