Add Fornax worker pods — US-TX#253 and US-TX#34

Two initial Fornax distributed torrent workers, each a gluetun+qBittorrent+natpmpc-helper pod on a different ProtonVPN TX server with NAT-PMP enabled. VPN private keys stored in Vault at secret/fornax/worker-tx253 and secret/fornax/worker-tx34, surfaced via ExternalSecrets. Workers share the media-data PVC; each has its own config PVC. Services: fornax-worker-tx253:8080 and fornax-worker-tx34:8080 (ClusterIP, media ns)
2026-04-11 09:46:18 -05:00
parent 5f2720ae4e
commit 03011a73e8
3 changed files with 378 additions and 0 deletions
@@ -0,0 +1,39 @@
+# Fornax worker VPN credentials — one ExternalSecret per worker, each pulls its own private key
+# Vault paths: secret/fornax/worker-tx253, secret/fornax/worker-tx34
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: fornax-worker-tx253-secrets
+  namespace: media
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: fornax-worker-tx253-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: PROTONVPN_PRIVATE_KEY
+      remoteRef:
+        key: secret/data/fornax/worker-tx253
+        property: private_key
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: fornax-worker-tx34-secrets
+  namespace: media
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: fornax-worker-tx34-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: PROTONVPN_PRIVATE_KEY
+      remoteRef:
+        key: secret/data/fornax/worker-tx34
+        property: private_key