126 lines
4.0 KiB
YAML
126 lines
4.0 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: qbittorrent
|
|
namespace: qbittorrent
|
|
spec:
|
|
# qBittorrent has one writable configuration volume and one Proton port
|
|
# forwarding lease, so upgrades replace the Pod rather than overlap two.
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: qbittorrent
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: qbittorrent
|
|
spec:
|
|
# The SOPS-managed Secret is read-only, but Hotio writes Proton's current
|
|
# forwarded port beside wg0.conf. Copy the secret into a writable emptyDir
|
|
# without ever storing the plaintext WireGuard key in Git.
|
|
initContainers:
|
|
- name: prepare-wireguard-config
|
|
image: busybox:1.37.0
|
|
command:
|
|
- sh
|
|
- -ec
|
|
- >-
|
|
cp /vpn-secret/wg0.conf /wireguard/wg0.conf &&
|
|
chmod 0600 /wireguard/wg0.conf
|
|
volumeMounts:
|
|
- name: wireguard-secret
|
|
mountPath: /vpn-secret
|
|
readOnly: true
|
|
- name: wireguard-runtime
|
|
mountPath: /wireguard
|
|
containers:
|
|
- name: qbittorrent
|
|
image: ghcr.io/hotio/qbittorrent:release
|
|
imagePullPolicy: Always
|
|
securityContext:
|
|
# Hotio needs this capability to create the WireGuard interface,
|
|
# routes, firewall rules, and VPN kill switch inside the Pod.
|
|
capabilities:
|
|
add:
|
|
- NET_ADMIN
|
|
env:
|
|
- name: PUID
|
|
value: "1000"
|
|
- name: PGID
|
|
value: "1000"
|
|
- name: UMASK
|
|
value: "002"
|
|
- name: TZ
|
|
value: Europe/London
|
|
- name: WEBUI_PORTS
|
|
value: 8080/tcp
|
|
- name: VPN_ENABLED
|
|
value: "true"
|
|
- name: VPN_CONF
|
|
value: wg0
|
|
- name: VPN_PROVIDER
|
|
value: proton
|
|
# Permit the physical LAN to reach the Web UI/API without allowing
|
|
# ordinary internet traffic to bypass the VPN. Do not add the
|
|
# Kubernetes Pod CIDR here: Hotio detects the Pod's attached network
|
|
# itself and rejects an overlapping VPN_LAN_NETWORK route.
|
|
- name: VPN_LAN_NETWORK
|
|
value: 10.10.0.0/16
|
|
- name: VPN_LAN_LEAK_ENABLED
|
|
value: "false"
|
|
# Proton assigns a dynamic inbound port through NAT-PMP. Hotio
|
|
# renews it and updates qBittorrent's listening port automatically.
|
|
- name: VPN_AUTO_PORT_FORWARD
|
|
value: "true"
|
|
- name: VPN_HEALTHCHECK_ENABLED
|
|
value: "true"
|
|
- name: VPN_NAMESERVERS
|
|
value: wg
|
|
ports:
|
|
- name: http
|
|
containerPort: 8080
|
|
protocol: TCP
|
|
startupProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 5
|
|
timeoutSeconds: 3
|
|
failureThreshold: 36
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 30
|
|
timeoutSeconds: 10
|
|
failureThreshold: 3
|
|
volumeMounts:
|
|
- name: qbittorrent-config
|
|
mountPath: /config
|
|
- name: wireguard-runtime
|
|
mountPath: /config/wireguard
|
|
- name: torrents
|
|
mountPath: /data/torrents
|
|
volumes:
|
|
- name: qbittorrent-config
|
|
persistentVolumeClaim:
|
|
claimName: qbittorrent-config
|
|
- name: wireguard-secret
|
|
secret:
|
|
secretName: qbittorrent-wireguard
|
|
- name: wireguard-runtime
|
|
emptyDir: {}
|
|
- name: torrents
|
|
nfs:
|
|
server: nas.ahmza.com
|
|
path: /srv/media/torrents
|