From ef4655086fb7a507ee0024855980e9e222c657f9 Mon Sep 17 00:00:00 2001 From: ahmza Date: Sun, 1 Nov 2026 12:57:42 +0000 Subject: [PATCH] Deploy Prowlarr --- apps/prowlarr.yaml | 26 +++++++++++++++++++++ apps/prowlarr/deployment.yaml | 43 +++++++++++++++++++++++++++++++++++ apps/prowlarr/ingress.yaml | 24 +++++++++++++++++++ apps/prowlarr/namespace.yaml | 4 ++++ apps/prowlarr/pvc.yaml | 13 +++++++++++ apps/prowlarr/service.yaml | 14 ++++++++++++ docs/network.md | 1 + 7 files changed, 125 insertions(+) create mode 100644 apps/prowlarr.yaml create mode 100644 apps/prowlarr/deployment.yaml create mode 100644 apps/prowlarr/ingress.yaml create mode 100644 apps/prowlarr/namespace.yaml create mode 100644 apps/prowlarr/pvc.yaml create mode 100644 apps/prowlarr/service.yaml diff --git a/apps/prowlarr.yaml b/apps/prowlarr.yaml new file mode 100644 index 0000000..95c7563 --- /dev/null +++ b/apps/prowlarr.yaml @@ -0,0 +1,26 @@ +# This Argo CD Application deploys Prowlarr, which manages indexers for the +# media applications. Prowlarr runs without a VPN; the torrent client will +# receive its own Proton VPN connection instead. +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: prowlarr + namespace: argocd +spec: + project: default + + source: + repoURL: https://tea.ahmza.com/ahmza.com/k8s-starter-pack.git + targetRevision: main + path: apps/prowlarr + + destination: + server: https://kubernetes.default.svc + namespace: prowlarr + + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/apps/prowlarr/deployment.yaml b/apps/prowlarr/deployment.yaml new file mode 100644 index 0000000..66b8a79 --- /dev/null +++ b/apps/prowlarr/deployment.yaml @@ -0,0 +1,43 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: prowlarr + namespace: prowlarr +spec: + # Prowlarr stores its state in one ReadWriteOnce volume, so run one Pod and + # replace it during upgrades rather than briefly starting a second writer. + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + app: prowlarr + template: + metadata: + labels: + app: prowlarr + spec: + containers: + - name: prowlarr + image: ghcr.io/hotio/prowlarr:release + imagePullPolicy: Always + env: + - name: PUID + value: "1000" + - name: PGID + value: "1000" + - name: UMASK + value: "002" + - name: TZ + value: Europe/London + ports: + - name: http + containerPort: 9696 + protocol: TCP + volumeMounts: + - name: prowlarr-config + mountPath: /config + volumes: + - name: prowlarr-config + persistentVolumeClaim: + claimName: prowlarr-config diff --git a/apps/prowlarr/ingress.yaml b/apps/prowlarr/ingress.yaml new file mode 100644 index 0000000..1cfb6e9 --- /dev/null +++ b/apps/prowlarr/ingress.yaml @@ -0,0 +1,24 @@ +# Routes prowlarr.ahmza.com through the cluster's shared ingress-nginx IP. +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: prowlarr + namespace: prowlarr + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod +spec: + tls: + - hosts: + - prowlarr.ahmza.com + secretName: prowlarr-tls + rules: + - host: prowlarr.ahmza.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: prowlarr + port: + number: 9696 diff --git a/apps/prowlarr/namespace.yaml b/apps/prowlarr/namespace.yaml new file mode 100644 index 0000000..eabaca0 --- /dev/null +++ b/apps/prowlarr/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: prowlarr diff --git a/apps/prowlarr/pvc.yaml b/apps/prowlarr/pvc.yaml new file mode 100644 index 0000000..ffd81cf --- /dev/null +++ b/apps/prowlarr/pvc.yaml @@ -0,0 +1,13 @@ +# Prowlarr's database and configuration must survive Pod replacements. +# No storageClassName is set, so the cluster's default Longhorn class is used. +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: prowlarr-config + namespace: prowlarr +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 2Gi diff --git a/apps/prowlarr/service.yaml b/apps/prowlarr/service.yaml new file mode 100644 index 0000000..eff2444 --- /dev/null +++ b/apps/prowlarr/service.yaml @@ -0,0 +1,14 @@ +# A ClusterIP is reachable only inside the cluster. ingress-nginx provides +# the external HTTPS entry point defined in ingress.yaml. +apiVersion: v1 +kind: Service +metadata: + name: prowlarr + namespace: prowlarr +spec: + selector: + app: prowlarr + ports: + - name: http + port: 9696 + targetPort: http diff --git a/docs/network.md b/docs/network.md index 63c7bf8..0db0037 100644 --- a/docs/network.md +++ b/docs/network.md @@ -89,6 +89,7 @@ Cloudflare; internal overrides are served by Technitium where noted. | `blog.ahmza.com` | Hugo blog | `blog-ahmza-com` | Yes — `letsencrypt-prod`, certificate Ready. LAN DNS resolves to `10.10.60.12`; internal ingress and the public NetBird entry `72.62.6.42` both return HTTPS 200 with valid certificates and matching homepage content. Caddy on `ingress1` forwards to `10.10.60.12:443` with the blog hostname preserved for Host/SNI | [`apps/blog-ahmza-com/ingress.yaml`](../apps/blog-ahmza-com/ingress.yaml) | | `mc.ahmza.com` | Packwiz modpack files | `mcpacks` | Yes — `letsencrypt-prod`, real trusted certificate | [`apps/mcpacks/ingress.yaml`](../apps/mcpacks/ingress.yaml) | | `bazarr.ahmza.com` | Bazarr subtitle manager | `bazarr` | Yes — `letsencrypt-prod`, real trusted certificate; Technitium overrides Cloudflare's NetBird route on the LAN | [`apps/bazarr/ingress.yaml`](../apps/bazarr/ingress.yaml) | +| `prowlarr.ahmza.com` | Prowlarr indexer manager | `prowlarr` | Configured for `letsencrypt-prod`; DNS and the certificate must be verified after the first deployment | [`apps/prowlarr/ingress.yaml`](../apps/prowlarr/ingress.yaml) | | `soulsync.ahmza.com` | SoulSync media discovery | `soulsync` | Configured for `letsencrypt-prod`; verify the certificate after the first deployment; Technitium routes LAN clients to `10.10.60.12` | [`apps/soulsync/ingress.yaml`](../apps/soulsync/ingress.yaml) | Add a row here every time you point a new hostname at this cluster (see