feat: add Transmission with Gluetun VPN sidecar

Reviewed-on: #103

deployments/apps/khalisio/deployment.yaml

@@ -0,0 +1,54 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: khalisio
+  namespace: apps
+  labels:
+    app: khalisio
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: khalisio
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  template:
+    metadata:
+      labels:
+        app: khalisio
+    spec:
+      imagePullSecrets:
+        - name: ghcr-pull-secret
+      nodeSelector:
+        kubernetes.io/arch: amd64
+      containers:
+        - name: web
+          image: ghcr.io/richard-callis/portfolio:latest
+          imagePullPolicy: Always
+          ports:
+            - name: http
+              containerPort: 8080
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+          readinessProbe:
+            httpGet: { path: /, port: http }
+            initialDelaySeconds: 2
+            periodSeconds: 5
+          livenessProbe:
+            httpGet: { path: /, port: http }
+            initialDelaySeconds: 5
+            periodSeconds: 30
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 101
+            capabilities:
+              drop: ["ALL"]

deployments/apps/khalisio/ingress.yaml

@@ -0,0 +1,35 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: khalisio
+  namespace: apps
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+spec:
+  tls:
+    - hosts:
+        - khalisio.com
+        - www.khalisio.com
+      secretName: khalisio-tls
+  rules:
+    - host: khalisio.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: khalisio
+                port:
+                  number: 80
+    - host: www.khalisio.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: khalisio
+                port:
+                  number: 80

deployments/apps/khalisio/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: khalisio
+  namespace: apps
+spec:
+  selector:
+    app: khalisio
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 8080
+  type: ClusterIP

deployments/media/transmission/deployment.yaml

@@ -0,0 +1,113 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: transmission
+  namespace: media
+  labels:
+    app: transmission
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: transmission
+  template:
+    metadata:
+      labels:
+        app: transmission
+    spec:
+      securityContext:
+        capabilities:
+          add:
+            - NET_ADMIN
+      containers:
+        - name: gluetun
+          image: qmcgaw/gluetun:latest
+          env:
+            - name: VPN_SERVICE_PROVIDER
+              value: protonvpn
+            - name: REGION
+              value: "New York"
+            - name: OPENVPN_USER
+              valueFrom:
+                secretKeyRef:
+                  name: transmission-vpn-secret
+                  key: VPN_USERNAME
+            - name: OPENVPN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: transmission-vpn-secret
+                  key: VPN_PASSWORD
+            - name: WIREGUARD_PRIVATE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: transmission-vpn-secret
+                  key: WIREGUARD_PRIVATE_KEY
+            - name: FIREWALL_OUTBOUND_SUBNET
+              value: ""
+            - name: UPNP_ENABLED
+              value: "true"
+            - name: DOT
+              value: "true"
+          volumeMounts:
+            - name: config
+              mountPath: /gluetun
+        - name: transmission
+          image: lscr.io/linuxserver/transmission:latest
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: TZ
+              value: "America/New_York"
+            - name: USER
+              valueFrom:
+                secretKeyRef:
+                  name: transmission-vpn-secret
+                  key: TRANS_USERNAME
+            - name: PASS
+              valueFrom:
+                secretKeyRef:
+                  name: transmission-vpn-secret
+                  key: TRANS_PASSWORD
+            - name: WHITELIST
+              value: "*"
+            - name: HOST_WHITELIST
+              value: "transmission.khalis.corp"
+            - name: PEER_PORT
+              value: "51413"
+            - name: NVM_CONFIGDIR
+              value: "/config"
+            - name: NVM_DATAROOT
+              value: "/downloads"
+          ports:
+            - containerPort: 9091
+              name: http
+            - containerPort: 51413
+              protocol: TCP
+              name: peer-tcp
+            - containerPort: 51413
+              protocol: UDP
+              name: peer-udp
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: media
+              mountPath: /downloads
+            - name: downloads
+              mountPath: /downloads
+            - name: watch
+              mountPath: /watch
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: transmission-config
+        - name: media
+          persistentVolumeClaim:
+            claimName: media-data
+        - name: downloads
+          persistentVolumeClaim:
+            claimName: media-data
+        - name: watch
+          persistentVolumeClaim:
+            claimName: media-data

deployments/media/transmission/ingress.yaml

@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: transmission
+  namespace: media
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  rules:
+    - host: transmission.khalis.corp
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: transmission
+                port:
+                  number: 9091

deployments/media/transmission/pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: transmission-config
+  namespace: media
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 10Gi

deployments/media/transmission/service.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: transmission
+  namespace: media
+spec:
+  selector:
+    app: transmission
+  ports:
+    - protocol: TCP
+      port: 9091
+      targetPort: 9091
+      name: http
+    - protocol: TCP
+      port: 51413
+      targetPort: 51413
+      name: peer-tcp
+    - protocol: UDP
+      port: 51413
+      targetPort: 51413
+      name: peer-udp
+  type: ClusterIP