Add media stack: Plex, Radarr, Sonarr, Prowlarr, qBittorrent, Bazarr, Overseerr

- Namespace: media (created via Terraform)
- Storage: hostPath PV at /media on Legion (movies, tv/shows, tv/anime, downloads)
- VPN: gluetun sidecar with ProtonVPN WireGuard (US-TX#253), all torrent traffic tunneled
- Radarr: movie automation with /media/movies root
- Sonarr: TV/anime automation with /media/tv/{shows,anime} roots
- Prowlarr: indexer aggregator (YTS, 1337x, Nyaa for anime)
- qBittorrent: torrent client, network namespaced behind gluetun VPN
- Bazarr: automatic subtitle downloads (connects to Radarr + Sonarr)
- Overseerr: family request portal at watch.nook.family
- Plex: media server at plex.nook.family

servers/legion/k8s/media/gluetun-qbittorrent.yaml

@@ -0,0 +1,115 @@
+# gluetun + qBittorrent — all torrent traffic routed through ProtonVPN WireGuard
+# gluetun runs as the VPN container; qBittorrent shares its network namespace (same pod)
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: qbittorrent
+  namespace: media
+  labels:
+    app: qbittorrent
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: qbittorrent
+  template:
+    metadata:
+      labels:
+        app: qbittorrent
+    spec:
+      initContainers:
+        # Ensure /dev/net/tun exists on the node
+        - name: tun-setup
+          image: busybox:latest
+          command: ["sh", "-c", "mkdir -p /dev/net && [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 && chmod 666 /dev/net/tun"]
+          securityContext:
+            privileged: true
+      containers:
+        # VPN container — must come first so network is up before qBittorrent starts
+        - name: gluetun
+          image: ghcr.io/qdm12/gluetun:latest
+          securityContext:
+            capabilities:
+              add: ["NET_ADMIN"]
+          env:
+            - name: VPN_SERVICE_PROVIDER
+              value: "custom"
+            - name: VPN_TYPE
+              value: "wireguard"
+            - name: WIREGUARD_PRIVATE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: media-secrets
+                  key: PROTONVPN_PRIVATE_KEY
+            - name: WIREGUARD_PUBLIC_KEY
+              value: "mngiSxBpH7GU24nnWdBEcnhDnCPn2jq5+ZP3zwPwISA="
+            - name: WIREGUARD_ADDRESSES
+              value: "10.2.0.2/32"
+            - name: VPN_ENDPOINT_IP
+              value: "95.173.217.29"
+            - name: VPN_ENDPOINT_PORT
+              value: "51820"
+            # Allow cluster-internal traffic to bypass VPN (for Radarr/Sonarr → qBittorrent API)
+            - name: FIREWALL_OUTBOUND_SUBNETS
+              value: "10.42.0.0/16,10.43.0.0/16"
+            - name: UPDATER_PERIOD
+              value: "0"
+          ports:
+            - containerPort: 8888  # gluetun HTTP proxy (unused but required)
+          resources:
+            requests:
+              memory: 64Mi
+              cpu: 50m
+            limits:
+              memory: 128Mi
+              cpu: 200m
+
+        # qBittorrent — shares gluetun's network namespace, all traffic through VPN
+        - name: qbittorrent
+          image: lscr.io/linuxserver/qbittorrent:latest
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: TZ
+              value: "America/Chicago"
+            - name: WEBUI_PORT
+              value: "8080"
+          ports:
+            - containerPort: 8080
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: media
+              mountPath: /media
+          resources:
+            requests:
+              memory: 256Mi
+              cpu: 100m
+            limits:
+              memory: 1Gi
+              cpu: 500m
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: qbittorrent-config
+        - name: media
+          persistentVolumeClaim:
+            claimName: media-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: qbittorrent
+  namespace: media
+spec:
+  selector:
+    app: qbittorrent
+  ports:
+    - name: webui
+      port: 8080
+      targetPort: 8080
+  type: ClusterIP