complete bazarr manifests for testing

apps/bazarr/deployment.yaml

@@ -8,10 +8,7 @@ spec:
   # not critical infrastructure a single pod should be sufficient
   replicas: 1
   strategy:
-    type: RollingUpdate
+    type: Recreate
-    rollingUpdate:
-      maxUnavailable: 0
-      maxSurge: 1
   selector:
     matchLabels:
       app: bazarr
@@ -20,4 +17,40 @@ spec:
       labels:
         app: bazarr
     spec:
-
+      containers:
+        - name: bazarr
+          image: ghcr.io/hotio/bazarr:release
+          imagePullPolicy: Always
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: UMASK
+              value: "002"
+            - name: TZ
+              value: "Europe/London"
+          ports:
+            - name: http
+              containerPort: 6767
+              protocol: TCP
+          volumeMounts:
+            - name: bazarr-config
+              mountPath: /config
+            - name: cryo-media
+              mountPath: /movies
+              subPath: Movies
+            - name: cryo-media
+              mountPath: /tv
+              subPath: TVShows
+            - name: cryo-media
+              mountPath: /anime
+              subPath: Anime
+      volumes:
+        - name: bazarr-config
+          persistentVolumeClaim:
+            claimName: bazarr-data
+        - name: cryo-media
+          nfs:
+            server: nas.ahmza.com
+            path: /srv/media

apps/bazarr/ingress.yaml

@@ -0,0 +1,25 @@
+# routes for bazarr.ahmza.com through ingress-nginx (docs/11-ingress.md)
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: bazarr
+  namespace: bazarr
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-staging
+spec:
+  tls:
+    - hosts:
+      - bazarr.ahmza.com
+      # cert-manager keeps this up to date. nothing to do by hand
+      secretName: bazarr-tls
+  rules:
+    - host: bazarr.ahmza.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: bazarr
+                port:
+                  number: 6767

apps/bazarr/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: bazarr

apps/bazarr/pvc.yaml

@@ -0,0 +1,12 @@
+# create a longhorn pvc for bazarr's config (see docs/06-longhorn.md)
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: bazarr-data
+  namespace: bazarr
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi

apps/bazarr/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: bazarr
+  namespace: bazarr
+spec:
+  selector:
+    app: bazarr
+  ports:
+    - name: http
+      port: 6767
+      targetPort: http

apps/seerr/Chart.yaml

@@ -0,0 +1,11 @@
+apiVersion: v2
+name: seerr-app
+description: Deploys Seerr using its official upstream helm chart
+type: application
+version: 0.1.0
+
+dependencies:
+  - name: seerr-chart
+    alias: seerr
+    version: "3.9.0"
+    repository: oci://ghcr.io/seerr-team/seerr

docs/network.md

@@ -67,7 +67,7 @@ Every real DNS record pointing at ingress-nginx's shared address
 | Hostname | App | Namespace | TLS | Source |
 |---|---|---|---|---|
 | `demo.ahmza.com` | Demo app | `demo` | Yes — `letsencrypt-prod`, real trusted cert (see [`docs/12-cert-manager.md`](12-cert-manager.md)) | [`apps/demo/ingress.yaml`](../apps/demo/ingress.yaml) |
-| `mc.ahmza.com` | Packwiz modpack files | `mcpacks` | Staging requested — promote to `letsencrypt-prod` after the staging Certificate is verified Ready | [`apps/mcpacks/ingress.yaml`](../apps/mcpacks/ingress.yaml) |
+| `mc.ahmza.com` | Packwiz modpack files | `mcpacks` | Yes — `letsencrypt-prod`, real trusted certificate | [`apps/mcpacks/ingress.yaml`](../apps/mcpacks/ingress.yaml) |
 
 Add a row here every time you point a new hostname at this cluster (see
 [`docs/11-ingress.md`](11-ingress.md)). The DNS record itself lives in