apiVersion: apps/v1
kind: Deployment
metadata:
  name: qbit
spec:
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app: qbit
  replicas: 1
  template:
    metadata:
      labels:
        app: qbit
    spec:
      volumes:
        - name: config
          persistentVolumeClaim:
            claimName: configs-local-pvc
        - name: downloads
          persistentVolumeClaim:
            claimName: downloads-nfs
      imagePullSecrets:
        - name: regcred
      containers:
        - name: openvpn
          # Config
          # https://github.com/qdm12/gluetun-wiki/blob/main/setup/providers/surfshark.md
          image: mirror.gcr.io/qmcgaw/gluetun:latest
          securityContext:
            runAsUser: 0
            privileged: true
            capabilities:
              add: ["NET_ADMIN"]
          imagePullPolicy: IfNotPresent
          env:
            - name: VPN_TYPE
              value: "wireguard"
            - name: WIREGUARD_ADDRESSES
              value: 10.14.0.2/16
            - name: SERVER_HOSTNAMES
              value: au-mel.prod.surfshark.com,au-syd.prod.surfshark.com
            - name: WIREGUARD_PRIVATE_KEY
              valueFrom:
                secretKeyRef:
                  name: surfshark-wireguard
                  key: private_key
            - name: VPN_SERVICE_PROVIDER
              value: "surfshark"
            - name: TZ
              value: Australia/Melbourne
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 200m
              memory: 256Mi
        - name: qbit
          image:  mirror.gcr.io/linuxserver/qbittorrent:version-5.1.2-r4
          securityContext:
            runAsUser: 0
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8001
              name: web-port
              protocol: TCP
            - containerPort: 6881
              name: qbit-port
              protocol: TCP
            - containerPort: 6881
              name: udp-qbit-port
              protocol: UDP
          env:
            - name: TZ
              value: Australia/Melbourne
            - name: PUID
              value: "1000"
            - name: PGID
              value: "1000"
            - name: DELUGE_LOGLEVEL
              value: error
            - name: WEBUI_PORT
              value: "8001"
          volumeMounts:
            - name: config
              mountPath: /config
              subPath: qbit_new
            - name: downloads
              mountPath: /downloads
          resources:
            requests:
              cpu: 100m
              memory: 512Mi
            limits:
              cpu: 300m
              memory: 1024Mi
          # livenessProbe:
          #   exec:
          #     command:
          #      - curl
          #      - http://localhost:8001
          #   initialDelaySeconds: 60
          #   periodSeconds: 60
        # - name: youtube-dl
        #   image:  modenaf360/youtube-dl-nas
        #   securityContext:
        #     runAsUser: 0
        #   imagePullPolicy: IfNotPresent
        #   ports:
        #     - containerPort: 8080
        #       name: youtube-dl-port
        #       protocol: TCP
        #   env:
        #     - name: TZ
        #       value: Australia/Melbourne
        #     - name: MY_ID
        #       valueFrom:
        #         secretKeyRef:
        #           name: basic-auth-credentials
        #           key: username
        #     - name: MY_PW
        #       valueFrom:
        #         secretKeyRef:
        #           name: basic-auth-credentials
        #           key: password
        #   volumeMounts:
        #     - name: downloads
        #       subPath: youtube-dl
        #       mountPath: /downfolder
        #   resources:
        #     requests:
        #       cpu: 50m
        #       memory: 126Mi
        #     limits:
        #       cpu: 100m
        #       memory: 256Mi

---
apiVersion: v1
kind: Service
metadata:
  name: qbit
  labels:
    app: qbit
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: web-port
      protocol: TCP
      name: web
  selector:
    app: qbit

---

# apiVersion: v1
# kind: Service
# metadata:
#   name: youtube-dl
#   labels:
#     app: youtube-dl
# spec:
#   type: ClusterIP
#   ports:
#     - port: 80
#       targetPort: youtube-dl-port
#       protocol: TCP
#       name: web
#   selector:
#     app: qbit

# ---
# apiVersion: networking.k8s.io/v1
# kind: Ingress
# metadata:
#   name: youtube-dl-ingress
#   annotations:
#     kubernetes.io/ingress.class: "nginx"
#     kubernetes.io/tls-acme: "true"
#     cert-manager.io/cluster-issuer: "letsencrypt-prod"
# spec:
#   tls:
#   - hosts:
#     - dl.junv.cc
#     secretName: youtube-dl-tls
#   rules:
#   - host: dl.junv.cc
#     http:
#       paths:
#       - path: /
#         pathType: Prefix
#         backend:
#           service:
#             name: youtube-dl
#             port:
#               number: 80
---

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: qbit-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - download.junv.cc
    secretName: qbit-tls
  rules:
  - host: download.junv.cc
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: qbit
            port:
              number: 80

---
# Refused to send form data to 'http://cloud.junv.cc/' because it violates the following Content Security Policy directive: "form-action 'self'".
# It is not regression, I think, CSP directive form-action 'self' added intentionally. I suppose your problem is that nextcloud doesn't know that it was accessed through https. Maybe traefik don't add X-Forwarded-Proto header. You can try to add 'overwriteprotocol' => 'https' to your config and see if problem persists.

# apiVersion: apps/v1
# kind: Deployment
# metadata:
#   name: nextcloud
# spec:
#   revisionHistoryLimit: 2
#   selector:
#     matchLabels:
#       app: nextcloud
#   replicas: 1
#   template:
#     metadata:
#       labels:
#         app: nextcloud
#     spec:
#       imagePullSecrets:
#         - name: regcred
#       volumes:
#         - name: nextcloud-config
#           persistentVolumeClaim:
#             claimName: configs-local-pvc
#         - name: data
#           persistentVolumeClaim:
#             claimName: nextcloud-nfs
#       initContainers:
#         - name: take-data-dir-ownership
#           image: alpine:3
#           securityContext:
#             runAsUser: 0
#           command:
#             - chown
#             - -R
#             - 1000:1000
#             - /data
#           volumeMounts:
#             - name: data
#               mountPath: /data
#       containers:
#         - name: nextcloud
#           image: ghcr.io/wonderfall/nextcloud:24
#           securityContext:
#             # nextcloud uses www-data which id is 33
#             runAsUser: 1000
#           imagePullPolicy: IfNotPresent
#           ports:
#             - containerPort: 8888
#               name: web-port
#               protocol: TCP
#           env:
#             - name: UID
#               value: "1000"
#             - name: GID
#               value: "1000"
#             - name: ADMIN_USER
#               valueFrom:
#                 secretKeyRef:
#                   name: nextcloud-credentials
#                   key: username
#             - name: ADMIN_PASSWORD
#               valueFrom:
#                 secretKeyRef:
#                   name: nextcloud-credentials
#                   key: password
#             - name: DB_TYPE
#               value: pgsql
#             - name: DB_NAME
#               value: nextcloud
#             - name: DB_HOST
#               value: 192.168.1.2
#             - name: DB_USER
#               valueFrom:
#                 secretKeyRef:
#                   name: postgresql-credentials
#                   key: username
#             - name: DB_PASSWORD
#               valueFrom:
#                 secretKeyRef:
#                   name: postgresql-credentials
#                   key: password
#             - name: TZ
#               value: Australia/Melbourne
#           volumeMounts:
#             - name: nextcloud-config
#               subPath: nextcloud/config
#               mountPath: /nextcloud/config
#             - name: nextcloud-config
#               subPath: nextcloud/apps
#               mountPath: /nextcloud/apps2
#             - name: nextcloud-config
#               subPath: nextcloud/apps
#               mountPath: /var/www/html/apps
#             - name: data
#               mountPath: /data
#           resources:
#             requests:
#               cpu: 400m
#               memory: 512Mi
#             limits:
#               cpu: 1000m
#               memory: 1Gi
#           # livenessProbe:
#           #   httpGet:
#           #     path: /
#           #     port: 8888
#           #   initialDelaySeconds: 60
#           #   periodSeconds: 30
#           #   failureThreshold: 5
#           # readinessProbe:
#           #   httpGet:
#           #     path: /
#           #     port: 8888
#           #   initialDelaySeconds: 60
#           #   periodSeconds: 30
#           #   failureThreshold: 5
# ---

# apiVersion: v1
# kind: Service
# metadata:
#   name: nextcloud
#   labels:
#     app: nextcloud
# spec:
#   type: ClusterIP
#   ports:
#     - port: 80
#       targetPort: web-port
#       protocol: TCP
#       name: web
#   selector:
#     app: nextcloud

# ---

# apiVersion: networking.k8s.io/v1
# kind: Ingress
# metadata:
#   name: nextcloud-ingress
#   annotations:
#     kubernetes.io/ingress.class: "nginx"
#     kubernetes.io/tls-acxme: "true"
#     cert-manager.io/cluster-issuer: "letsencrypt-prod"
#     nginx.ingress.kubernetes.io/proxy-body-size: 10240m
# spec:
#   tls:
#   - hosts:
#     - cloud.junv.cc
#     secretName: nextcloud-tls
#   rules:
#   - host: cloud.junv.cc
#     http:
#       paths:
#       - path: /
#         pathType: Prefix
#         backend:
#           service:
#             name: nextcloud
#             port:
#               number: 80

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: files
spec:
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app: files
  replicas: 1
  template:
    metadata:
      labels:
        app: files
    spec:
      # nodeSelector:
      #   kubernetes.io/hostname: server-3
      # tolerations:
      #   - key: "node"
      #     operator: "Equal"
      #     value: "special"
      #     effect: "NoSchedule"
      #   - key: node-role.kubernetes.io/master
      #     operator: Equal
      #     value: ""
      #     effect: NoSchedule
      #   - key: node-role.kubernetes.io/control-plane
      #     operator: Equal
      #     value: ""
      #     effect: NoSchedule
      imagePullSecrets:
        - name: regcred
      volumes:
        - name: config
          persistentVolumeClaim:
            claimName: configs-local-pvc
        - name: downloads
          persistentVolumeClaim:
            claimName: downloads-nfs
        # - name: aria2-cache
        #   persistentVolumeClaim:
        #     claimName: aria2-cache
        # - name: filebrowser-db
        #   persistentVolumeClaim:
        #     claimName: filebrowser-local-pvc
      containers:
        - name: openvpn
          # Config
          # https://github.com/qdm12/gluetun-wiki/blob/main/setup/providers/surfshark.md
          image: mirror.gcr.io/qmcgaw/gluetun:latest
          securityContext:
            runAsUser: 0
            privileged: true
            capabilities:
              add: ["NET_ADMIN"]
          imagePullPolicy: IfNotPresent
          env:
            - name: VPN_TYPE
              value: "wireguard"
            - name: WIREGUARD_ADDRESSES
              value: 10.14.0.2/16
            - name: SERVER_HOSTNAMES
              value: au-mel.prod.surfshark.com,au-syd.prod.surfshark.com
            - name: WIREGUARD_PRIVATE_KEY
              valueFrom:
                secretKeyRef:
                  name: surfshark-wireguard
                  key: private_key
            - name: VPN_SERVICE_PROVIDER
              value: "surfshark"
            - name: TZ
              value: Australia/Melbourne
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 200m
              memory: 256Mi
        - name: files
          image: mirror.gcr.io/wahyd4/aria2-ui:edge
          imagePullPolicy: Always
          ports:
            - containerPort: 80
              name: files-port
              protocol: TCP
            - containerPort: 8080
              name: fb-port
              protocol: TCP
          env:
            - name: ARIA2_EXTERNAL_PORT
              value: "443"
            - name: RPC_SECRET
              value: "Hell0Aria2!"
            - name: PUID
              value: "1000"
            - name: PGID
              value: "1000"
            - name: CADDY_LOG_LEVEL
              value: "WARN"
            - name: ENABLE_RCLONE
              value: "false"
            - name: ENABLE_FILEBROWSER
              value: "true"
          volumeMounts:
            - name: config
              subPath: aria
              mountPath: /app/conf
            - name: downloads
              mountPath: /data
            # - name: aria2-cache
            #   mountPath: /app/.cache
            - name: config
              subPath: files/filebrowser.db
              mountPath: /app/filebrowser.db
          resources:
            requests:
              cpu: 200m
              memory: 512Mi
            limits:
              cpu: 2000m
              memory: 2048Mi
          livenessProbe:
            exec:
              command:
               - curl
               - http://localhost:80/files/
            initialDelaySeconds: 180
            periodSeconds: 30
          securityContext:
            runAsUser: 0
            privileged: true
            capabilities:
              add:
                - CHOWN
                - NET_RAW
                - SETPCAP
---

apiVersion: v1
kind: Service
metadata:
  name: files
  labels:
    app: files
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: files-port
      protocol: TCP
      name: web
    - port: 8080
      targetPort: fb-port
      protocol: TCP
      name: filebrowser
  selector:
    app: files

---

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: files-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    # 200G
    nginx.ingress.kubernetes.io/proxy-body-size: 204800m
    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=https://$host$escaped_request_uri"
spec:
  tls:
  - hosts:
    - files.junv.cc
    secretName: files-tls
  rules:
  - host: files.junv.cc
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: files
            port:
              number: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: files-jsonrpc-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    # 2G upload file size limit
    nginx.ingress.kubernetes.io/proxy-body-size: 2048m
spec:
  tls:
  - hosts:
    - files-jsonrpc.junv.cc
    secretName: files-jsonrpc-tls
  rules:
  - host: files-jsonrpc.junv.cc
    http:
      paths:
      - path: /jsonrpc
        pathType: Prefix
        backend:
          service:
            name: files
            port:
              number: 80
---

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: filebrowser-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    # 200G
    nginx.ingress.kubernetes.io/proxy-body-size: 204800m
    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=https://$host$escaped_request_uri"
spec:
  tls:
  - hosts:
    - filebrowser.junv.cc
    secretName: filebrowser-tls
  rules:
  - host: filebrowser.junv.cc
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: files
            port:
              number: 8080
