mirror of
https://github.com/wahyd4/home-docker.git
synced 2026-08-09 04:15:52 +10:00
Junv (via Hermes)
a8b6890a99
Updates 7 Docker images across the infrastructure manifests (PG14 kept as-is):
media/jackett.yaml
linuxserver/jackett: 0.24.1124 → 0.24.1985 (patch)
media/media.yaml
linuxserver/qbittorrent: version-5.1.2-r4 → version-5.2.1_v2.0.12 (major 5.1→5.2)
home-apps/n8n.yaml
n8nio/n8n: 2.15.0 → 2.23.1 (minor)
db/qdrant.yaml
qdrant/qdrant: v1.16-unprivileged → v1.18.1-unprivileged (minor)
kube-vip/daemonset.yaml
kube-vip/kube-vip: v0.4.4 → v0.9.2 (conservative, stayed within v0.x)
on-demand/once-etcd-job.yaml
etcd: 3.5.1-0 → 3.5.30-0 (patch)
adhoc-config/oauth2-proxy.yaml
oauth2-proxy/oauth2-proxy: v7.6.0 → v7.15.2 (minor)
Note: postgres:14 kept unchanged per PR review feedback.
kube-vip kept at v0.9.2 (latest v0.x) instead of v1.2.0 to avoid
v0→v1 breaking changes.
638 lines
16 KiB
YAML
638 lines
16 KiB
YAML
apiVersion: apps/v1
|
||
kind: Deployment
|
||
metadata:
|
||
name: qbit
|
||
spec:
|
||
revisionHistoryLimit: 2
|
||
selector:
|
||
matchLabels:
|
||
app: qbit
|
||
replicas: 1
|
||
template:
|
||
metadata:
|
||
labels:
|
||
app: qbit
|
||
spec:
|
||
volumes:
|
||
- name: config
|
||
persistentVolumeClaim:
|
||
claimName: configs-local-pvc
|
||
- name: downloads
|
||
persistentVolumeClaim:
|
||
claimName: downloads-nfs
|
||
imagePullSecrets:
|
||
- name: regcred
|
||
containers:
|
||
- name: openvpn
|
||
# Config
|
||
# https://github.com/qdm12/gluetun-wiki/blob/main/setup/providers/surfshark.md
|
||
image: mirror.gcr.io/qmcgaw/gluetun:latest
|
||
securityContext:
|
||
runAsUser: 0
|
||
privileged: true
|
||
capabilities:
|
||
add: ["NET_ADMIN"]
|
||
imagePullPolicy: IfNotPresent
|
||
env:
|
||
- name: VPN_TYPE
|
||
value: "wireguard"
|
||
- name: WIREGUARD_ADDRESSES
|
||
value: 10.14.0.2/16
|
||
- name: SERVER_HOSTNAMES
|
||
value: au-mel.prod.surfshark.com,au-syd.prod.surfshark.com
|
||
- name: WIREGUARD_PRIVATE_KEY
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: surfshark-wireguard
|
||
key: private_key
|
||
- name: VPN_SERVICE_PROVIDER
|
||
value: "surfshark"
|
||
- name: TZ
|
||
value: Australia/Melbourne
|
||
resources:
|
||
requests:
|
||
cpu: 50m
|
||
memory: 64Mi
|
||
limits:
|
||
cpu: 200m
|
||
memory: 256Mi
|
||
- name: qbit
|
||
# Updated: version-5.1.2-r4 -> version-5.2.1_v2.0.12 (major: 5.1->5.2, medium risk; stable release with libtorrent v2.0.12)
|
||
image: mirror.gcr.io/linuxserver/qbittorrent:version-5.2.1_v2.0.12
|
||
securityContext:
|
||
runAsUser: 0
|
||
imagePullPolicy: IfNotPresent
|
||
ports:
|
||
- containerPort: 8001
|
||
name: web-port
|
||
protocol: TCP
|
||
- containerPort: 6881
|
||
name: qbit-port
|
||
protocol: TCP
|
||
- containerPort: 6881
|
||
name: udp-qbit-port
|
||
protocol: UDP
|
||
env:
|
||
- name: TZ
|
||
value: Australia/Melbourne
|
||
- name: PUID
|
||
value: "1000"
|
||
- name: PGID
|
||
value: "1000"
|
||
- name: DELUGE_LOGLEVEL
|
||
value: error
|
||
- name: WEBUI_PORT
|
||
value: "8001"
|
||
volumeMounts:
|
||
- name: config
|
||
mountPath: /config
|
||
subPath: qbit_new
|
||
- name: downloads
|
||
mountPath: /downloads
|
||
resources:
|
||
requests:
|
||
cpu: 100m
|
||
memory: 512Mi
|
||
limits:
|
||
cpu: 300m
|
||
memory: 1024Mi
|
||
# livenessProbe:
|
||
# exec:
|
||
# command:
|
||
# - curl
|
||
# - http://localhost:8001
|
||
# initialDelaySeconds: 60
|
||
# periodSeconds: 60
|
||
# - name: youtube-dl
|
||
# image: modenaf360/youtube-dl-nas
|
||
# securityContext:
|
||
# runAsUser: 0
|
||
# imagePullPolicy: IfNotPresent
|
||
# ports:
|
||
# - containerPort: 8080
|
||
# name: youtube-dl-port
|
||
# protocol: TCP
|
||
# env:
|
||
# - name: TZ
|
||
# value: Australia/Melbourne
|
||
# - name: MY_ID
|
||
# valueFrom:
|
||
# secretKeyRef:
|
||
# name: basic-auth-credentials
|
||
# key: username
|
||
# - name: MY_PW
|
||
# valueFrom:
|
||
# secretKeyRef:
|
||
# name: basic-auth-credentials
|
||
# key: password
|
||
# volumeMounts:
|
||
# - name: downloads
|
||
# subPath: youtube-dl
|
||
# mountPath: /downfolder
|
||
# resources:
|
||
# requests:
|
||
# cpu: 50m
|
||
# memory: 126Mi
|
||
# limits:
|
||
# cpu: 100m
|
||
# memory: 256Mi
|
||
|
||
---
|
||
apiVersion: v1
|
||
kind: Service
|
||
metadata:
|
||
name: qbit
|
||
labels:
|
||
app: qbit
|
||
spec:
|
||
type: ClusterIP
|
||
ports:
|
||
- port: 80
|
||
targetPort: web-port
|
||
protocol: TCP
|
||
name: web
|
||
selector:
|
||
app: qbit
|
||
|
||
---
|
||
|
||
# apiVersion: v1
|
||
# kind: Service
|
||
# metadata:
|
||
# name: youtube-dl
|
||
# labels:
|
||
# app: youtube-dl
|
||
# spec:
|
||
# type: ClusterIP
|
||
# ports:
|
||
# - port: 80
|
||
# targetPort: youtube-dl-port
|
||
# protocol: TCP
|
||
# name: web
|
||
# selector:
|
||
# app: qbit
|
||
|
||
# ---
|
||
# apiVersion: networking.k8s.io/v1
|
||
# kind: Ingress
|
||
# metadata:
|
||
# name: youtube-dl-ingress
|
||
# annotations:
|
||
# kubernetes.io/ingress.class: "nginx"
|
||
# kubernetes.io/tls-acme: "true"
|
||
# cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||
# spec:
|
||
# tls:
|
||
# - hosts:
|
||
# - dl.junv.cc
|
||
# secretName: youtube-dl-tls
|
||
# rules:
|
||
# - host: dl.junv.cc
|
||
# http:
|
||
# paths:
|
||
# - path: /
|
||
# pathType: Prefix
|
||
# backend:
|
||
# service:
|
||
# name: youtube-dl
|
||
# port:
|
||
# number: 80
|
||
---
|
||
|
||
apiVersion: networking.k8s.io/v1
|
||
kind: Ingress
|
||
metadata:
|
||
name: qbit-ingress
|
||
annotations:
|
||
kubernetes.io/ingress.class: "nginx"
|
||
kubernetes.io/tls-acme: "true"
|
||
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||
spec:
|
||
tls:
|
||
- hosts:
|
||
- download.junv.cc
|
||
secretName: qbit-tls
|
||
rules:
|
||
- host: download.junv.cc
|
||
http:
|
||
paths:
|
||
- path: /
|
||
pathType: Prefix
|
||
backend:
|
||
service:
|
||
name: qbit
|
||
port:
|
||
number: 80
|
||
|
||
---
|
||
# Refused to send form data to 'http://cloud.junv.cc/' because it violates the following Content Security Policy directive: "form-action 'self'".
|
||
# It is not regression, I think, CSP directive form-action 'self' added intentionally. I suppose your problem is that nextcloud doesn't know that it was accessed through https. Maybe traefik don't add X-Forwarded-Proto header. You can try to add 'overwriteprotocol' => 'https' to your config and see if problem persists.
|
||
|
||
# apiVersion: apps/v1
|
||
# kind: Deployment
|
||
# metadata:
|
||
# name: nextcloud
|
||
# spec:
|
||
# revisionHistoryLimit: 2
|
||
# selector:
|
||
# matchLabels:
|
||
# app: nextcloud
|
||
# replicas: 1
|
||
# template:
|
||
# metadata:
|
||
# labels:
|
||
# app: nextcloud
|
||
# spec:
|
||
# imagePullSecrets:
|
||
# - name: regcred
|
||
# volumes:
|
||
# - name: nextcloud-config
|
||
# persistentVolumeClaim:
|
||
# claimName: configs-local-pvc
|
||
# - name: data
|
||
# persistentVolumeClaim:
|
||
# claimName: nextcloud-nfs
|
||
# initContainers:
|
||
# - name: take-data-dir-ownership
|
||
# image: alpine:3
|
||
# securityContext:
|
||
# runAsUser: 0
|
||
# command:
|
||
# - chown
|
||
# - -R
|
||
# - 1000:1000
|
||
# - /data
|
||
# volumeMounts:
|
||
# - name: data
|
||
# mountPath: /data
|
||
# containers:
|
||
# - name: nextcloud
|
||
# image: ghcr.io/wonderfall/nextcloud:24
|
||
# securityContext:
|
||
# # nextcloud uses www-data which id is 33
|
||
# runAsUser: 1000
|
||
# imagePullPolicy: IfNotPresent
|
||
# ports:
|
||
# - containerPort: 8888
|
||
# name: web-port
|
||
# protocol: TCP
|
||
# env:
|
||
# - name: UID
|
||
# value: "1000"
|
||
# - name: GID
|
||
# value: "1000"
|
||
# - name: ADMIN_USER
|
||
# valueFrom:
|
||
# secretKeyRef:
|
||
# name: nextcloud-credentials
|
||
# key: username
|
||
# - name: ADMIN_PASSWORD
|
||
# valueFrom:
|
||
# secretKeyRef:
|
||
# name: nextcloud-credentials
|
||
# key: password
|
||
# - name: DB_TYPE
|
||
# value: pgsql
|
||
# - name: DB_NAME
|
||
# value: nextcloud
|
||
# - name: DB_HOST
|
||
# value: 192.168.1.2
|
||
# - name: DB_USER
|
||
# valueFrom:
|
||
# secretKeyRef:
|
||
# name: postgresql-credentials
|
||
# key: username
|
||
# - name: DB_PASSWORD
|
||
# valueFrom:
|
||
# secretKeyRef:
|
||
# name: postgresql-credentials
|
||
# key: password
|
||
# - name: TZ
|
||
# value: Australia/Melbourne
|
||
# volumeMounts:
|
||
# - name: nextcloud-config
|
||
# subPath: nextcloud/config
|
||
# mountPath: /nextcloud/config
|
||
# - name: nextcloud-config
|
||
# subPath: nextcloud/apps
|
||
# mountPath: /nextcloud/apps2
|
||
# - name: nextcloud-config
|
||
# subPath: nextcloud/apps
|
||
# mountPath: /var/www/html/apps
|
||
# - name: data
|
||
# mountPath: /data
|
||
# resources:
|
||
# requests:
|
||
# cpu: 400m
|
||
# memory: 512Mi
|
||
# limits:
|
||
# cpu: 1000m
|
||
# memory: 1Gi
|
||
# # livenessProbe:
|
||
# # httpGet:
|
||
# # path: /
|
||
# # port: 8888
|
||
# # initialDelaySeconds: 60
|
||
# # periodSeconds: 30
|
||
# # failureThreshold: 5
|
||
# # readinessProbe:
|
||
# # httpGet:
|
||
# # path: /
|
||
# # port: 8888
|
||
# # initialDelaySeconds: 60
|
||
# # periodSeconds: 30
|
||
# # failureThreshold: 5
|
||
# ---
|
||
|
||
# apiVersion: v1
|
||
# kind: Service
|
||
# metadata:
|
||
# name: nextcloud
|
||
# labels:
|
||
# app: nextcloud
|
||
# spec:
|
||
# type: ClusterIP
|
||
# ports:
|
||
# - port: 80
|
||
# targetPort: web-port
|
||
# protocol: TCP
|
||
# name: web
|
||
# selector:
|
||
# app: nextcloud
|
||
|
||
# ---
|
||
|
||
# apiVersion: networking.k8s.io/v1
|
||
# kind: Ingress
|
||
# metadata:
|
||
# name: nextcloud-ingress
|
||
# annotations:
|
||
# kubernetes.io/ingress.class: "nginx"
|
||
# kubernetes.io/tls-acxme: "true"
|
||
# cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||
# nginx.ingress.kubernetes.io/proxy-body-size: 10240m
|
||
# spec:
|
||
# tls:
|
||
# - hosts:
|
||
# - cloud.junv.cc
|
||
# secretName: nextcloud-tls
|
||
# rules:
|
||
# - host: cloud.junv.cc
|
||
# http:
|
||
# paths:
|
||
# - path: /
|
||
# pathType: Prefix
|
||
# backend:
|
||
# service:
|
||
# name: nextcloud
|
||
# port:
|
||
# number: 80
|
||
|
||
---
|
||
apiVersion: apps/v1
|
||
kind: Deployment
|
||
metadata:
|
||
name: files
|
||
spec:
|
||
revisionHistoryLimit: 2
|
||
selector:
|
||
matchLabels:
|
||
app: files
|
||
replicas: 1
|
||
template:
|
||
metadata:
|
||
labels:
|
||
app: files
|
||
spec:
|
||
# nodeSelector:
|
||
# kubernetes.io/hostname: server-3
|
||
# tolerations:
|
||
# - key: "node"
|
||
# operator: "Equal"
|
||
# value: "special"
|
||
# effect: "NoSchedule"
|
||
# - key: node-role.kubernetes.io/master
|
||
# operator: Equal
|
||
# value: ""
|
||
# effect: NoSchedule
|
||
# - key: node-role.kubernetes.io/control-plane
|
||
# operator: Equal
|
||
# value: ""
|
||
# effect: NoSchedule
|
||
imagePullSecrets:
|
||
- name: regcred
|
||
volumes:
|
||
- name: config
|
||
persistentVolumeClaim:
|
||
claimName: configs-local-pvc
|
||
- name: downloads
|
||
persistentVolumeClaim:
|
||
claimName: downloads-nfs
|
||
# - name: aria2-cache
|
||
# persistentVolumeClaim:
|
||
# claimName: aria2-cache
|
||
# - name: filebrowser-db
|
||
# persistentVolumeClaim:
|
||
# claimName: filebrowser-local-pvc
|
||
containers:
|
||
- name: openvpn
|
||
# Config
|
||
# https://github.com/qdm12/gluetun-wiki/blob/main/setup/providers/surfshark.md
|
||
image: mirror.gcr.io/qmcgaw/gluetun:latest
|
||
securityContext:
|
||
runAsUser: 0
|
||
privileged: true
|
||
capabilities:
|
||
add: ["NET_ADMIN"]
|
||
imagePullPolicy: IfNotPresent
|
||
env:
|
||
- name: VPN_TYPE
|
||
value: "wireguard"
|
||
- name: WIREGUARD_ADDRESSES
|
||
value: 10.14.0.2/16
|
||
- name: SERVER_HOSTNAMES
|
||
value: au-mel.prod.surfshark.com,au-syd.prod.surfshark.com
|
||
- name: WIREGUARD_PRIVATE_KEY
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: surfshark-wireguard
|
||
key: private_key
|
||
- name: VPN_SERVICE_PROVIDER
|
||
value: "surfshark"
|
||
- name: TZ
|
||
value: Australia/Melbourne
|
||
resources:
|
||
requests:
|
||
cpu: 50m
|
||
memory: 64Mi
|
||
limits:
|
||
cpu: 200m
|
||
memory: 256Mi
|
||
- name: files
|
||
image: mirror.gcr.io/wahyd4/aria2-ui:edge
|
||
imagePullPolicy: Always
|
||
ports:
|
||
- containerPort: 80
|
||
name: files-port
|
||
protocol: TCP
|
||
- containerPort: 8080
|
||
name: fb-port
|
||
protocol: TCP
|
||
env:
|
||
- name: ARIA2_EXTERNAL_PORT
|
||
value: "443"
|
||
- name: RPC_SECRET
|
||
value: "Hell0Aria2!"
|
||
- name: PUID
|
||
value: "1000"
|
||
- name: PGID
|
||
value: "1000"
|
||
- name: CADDY_LOG_LEVEL
|
||
value: "WARN"
|
||
- name: ENABLE_RCLONE
|
||
value: "false"
|
||
- name: ENABLE_FILEBROWSER
|
||
value: "true"
|
||
volumeMounts:
|
||
- name: config
|
||
subPath: aria
|
||
mountPath: /app/conf
|
||
- name: downloads
|
||
mountPath: /data
|
||
# - name: aria2-cache
|
||
# mountPath: /app/.cache
|
||
- name: config
|
||
subPath: files/filebrowser.db
|
||
mountPath: /app/filebrowser.db
|
||
resources:
|
||
requests:
|
||
cpu: 200m
|
||
memory: 512Mi
|
||
limits:
|
||
cpu: 2000m
|
||
memory: 2048Mi
|
||
livenessProbe:
|
||
exec:
|
||
command:
|
||
- curl
|
||
- http://localhost:80/files/
|
||
initialDelaySeconds: 180
|
||
periodSeconds: 30
|
||
securityContext:
|
||
runAsUser: 0
|
||
privileged: true
|
||
capabilities:
|
||
add:
|
||
- CHOWN
|
||
- NET_RAW
|
||
- SETPCAP
|
||
---
|
||
|
||
apiVersion: v1
|
||
kind: Service
|
||
metadata:
|
||
name: files
|
||
labels:
|
||
app: files
|
||
spec:
|
||
type: ClusterIP
|
||
ports:
|
||
- port: 80
|
||
targetPort: files-port
|
||
protocol: TCP
|
||
name: web
|
||
- port: 8080
|
||
targetPort: fb-port
|
||
protocol: TCP
|
||
name: filebrowser
|
||
selector:
|
||
app: files
|
||
|
||
---
|
||
|
||
apiVersion: networking.k8s.io/v1
|
||
kind: Ingress
|
||
metadata:
|
||
name: files-ingress
|
||
annotations:
|
||
kubernetes.io/ingress.class: "nginx"
|
||
kubernetes.io/tls-acme: "true"
|
||
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||
# 200G
|
||
nginx.ingress.kubernetes.io/proxy-body-size: 204800m
|
||
nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
|
||
nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=https://$host$escaped_request_uri"
|
||
spec:
|
||
tls:
|
||
- hosts:
|
||
- files.junv.cc
|
||
secretName: files-tls
|
||
rules:
|
||
- host: files.junv.cc
|
||
http:
|
||
paths:
|
||
- path: /
|
||
pathType: Prefix
|
||
backend:
|
||
service:
|
||
name: files
|
||
port:
|
||
number: 80
|
||
---
|
||
apiVersion: networking.k8s.io/v1
|
||
kind: Ingress
|
||
metadata:
|
||
name: files-jsonrpc-ingress
|
||
annotations:
|
||
kubernetes.io/ingress.class: "nginx"
|
||
kubernetes.io/tls-acme: "true"
|
||
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||
# 2G upload file size limit
|
||
nginx.ingress.kubernetes.io/proxy-body-size: 2048m
|
||
spec:
|
||
tls:
|
||
- hosts:
|
||
- files-jsonrpc.junv.cc
|
||
secretName: files-jsonrpc-tls
|
||
rules:
|
||
- host: files-jsonrpc.junv.cc
|
||
http:
|
||
paths:
|
||
- path: /jsonrpc
|
||
pathType: Prefix
|
||
backend:
|
||
service:
|
||
name: files
|
||
port:
|
||
number: 80
|
||
---
|
||
|
||
apiVersion: networking.k8s.io/v1
|
||
kind: Ingress
|
||
metadata:
|
||
name: filebrowser-ingress
|
||
annotations:
|
||
kubernetes.io/ingress.class: "nginx"
|
||
kubernetes.io/tls-acme: "true"
|
||
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||
# 200G
|
||
nginx.ingress.kubernetes.io/proxy-body-size: 204800m
|
||
nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
|
||
nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=https://$host$escaped_request_uri"
|
||
spec:
|
||
tls:
|
||
- hosts:
|
||
- filebrowser.junv.cc
|
||
secretName: filebrowser-tls
|
||
rules:
|
||
- host: filebrowser.junv.cc
|
||
http:
|
||
paths:
|
||
- path: /
|
||
pathType: Prefix
|
||
backend:
|
||
service:
|
||
name: files
|
||
port:
|
||
number: 8080
|