Fix port forwarding: read file instead of HTTP API, fix server names
- portforward-helper now reads /tmp/gluetun/forwarded_port via shared emptyDir volume instead of polling gluetun HTTP API (which returned Unauthorized) - Main qbt: SERVER_NAMES=US-IL#1 (valid entry in gluetun server list) - Both manifests cleaned up
This commit is contained in:
Will Anderson
@@ -1,10 +1,10 @@
|
||||
# Fornax distributed torrent workers — each is a gluetun+qBittorrent pod on a different VPN server
|
||||
# Worker TX#253: US-TX#253, NAT-PMP via gluetun native ProtonVPN port forwarding
|
||||
# Worker TX#34: US-TX#34, NAT-PMP via gluetun native ProtonVPN port forwarding
|
||||
# Worker TX#179: US-TX#179, NAT-PMP via gluetun native ProtonVPN port forwarding
|
||||
# Worker TX#220: US-TX#220, NAT-PMP via gluetun native ProtonVPN port forwarding
|
||||
# Both workers share the media-data PVC; each has its own config PVC and VPN credentials
|
||||
# The Fornax coordinator proxy (TBD) routes work across these workers
|
||||
# Port file shared via emptyDir: gluetun writes /tmp/gluetun/forwarded_port, helper reads it
|
||||
|
||||
# ── Worker TX#253 ─────────────────────────────────────────────────────────────
|
||||
# ── Worker TX#179 ─────────────────────────────────────────────────────────────
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
@@ -13,7 +13,7 @@ metadata:
|
||||
labels:
|
||||
app: fornax-worker-tx253
|
||||
fornax-role: worker
|
||||
fornax-server: us-tx-253
|
||||
fornax-server: us-tx-179
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
@@ -26,7 +26,7 @@ spec:
|
||||
labels:
|
||||
app: fornax-worker-tx253
|
||||
fornax-role: worker
|
||||
fornax-server: us-tx-253
|
||||
fornax-server: us-tx-179
|
||||
spec:
|
||||
initContainers:
|
||||
- name: tun-setup
|
||||
@@ -41,7 +41,6 @@ spec:
|
||||
capabilities:
|
||||
add: ["NET_ADMIN"]
|
||||
env:
|
||||
# Use protonvpn provider so gluetun handles NAT-PMP natively
|
||||
- name: VPN_SERVICE_PROVIDER
|
||||
value: "protonvpn"
|
||||
- name: VPN_TYPE
|
||||
@@ -51,17 +50,17 @@ spec:
|
||||
secretKeyRef:
|
||||
name: fornax-worker-tx253-secrets
|
||||
key: PROTONVPN_PRIVATE_KEY
|
||||
# US-TX#179 — from gluetun's built-in ProtonVPN server list
|
||||
- name: SERVER_NAMES
|
||||
value: "US-TX#179"
|
||||
# gluetun handles NAT-PMP internally, exposes port at :8000/v1/openvpn/portforwarded
|
||||
- name: VPN_PORT_FORWARDING
|
||||
value: "on"
|
||||
- name: FIREWALL_OUTBOUND_SUBNETS
|
||||
value: "10.42.0.0/16,10.43.0.0/16"
|
||||
volumeMounts:
|
||||
- name: gluetun-data
|
||||
mountPath: /tmp/gluetun
|
||||
ports:
|
||||
- containerPort: 8000 # gluetun control server
|
||||
- containerPort: 8888 # gluetun HTTP proxy
|
||||
- containerPort: 8888
|
||||
resources:
|
||||
requests:
|
||||
memory: 128Mi
|
||||
@@ -70,31 +69,36 @@ spec:
|
||||
memory: 512Mi
|
||||
cpu: 200m
|
||||
|
||||
# Port forwarding helper — polls gluetun's control API for the assigned port,
|
||||
# then updates qBittorrent. No natpmpc needed; gluetun handles the NAT-PMP exchange.
|
||||
# Port forwarding helper — reads port from file gluetun writes to /tmp/gluetun/forwarded_port
|
||||
- name: portforward-helper
|
||||
image: alpine:latest
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
echo "Waiting for gluetun to assign a forwarded port..."
|
||||
until apk add -q curl 2>/dev/null; do sleep 5; done
|
||||
echo "Watching /tmp/gluetun/forwarded_port for assigned port..."
|
||||
while true; do
|
||||
RESP=$(curl -s http://localhost:8000/v1/openvpn/portforwarded 2>/dev/null)
|
||||
PORT=$(echo "$RESP" | grep -oE '"port":[0-9]+' | grep -oE '[0-9]+$')
|
||||
if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
|
||||
echo "$(date): Forwarded port: $PORT — updating qBittorrent"
|
||||
curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
|
||||
-d "username=admin&password=adminadmin" >/dev/null 2>&1
|
||||
curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
|
||||
-d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
|
||||
echo "$(date): qBittorrent listen port set to $PORT"
|
||||
if [ -f /tmp/gluetun/forwarded_port ]; then
|
||||
PORT=$(cat /tmp/gluetun/forwarded_port)
|
||||
if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
|
||||
echo "$(date): Forwarded port: $PORT — updating qBittorrent"
|
||||
curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
|
||||
-d "username=admin&password=adminadmin" >/dev/null 2>&1
|
||||
curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
|
||||
-d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
|
||||
echo "$(date): qBittorrent listen port set to $PORT"
|
||||
else
|
||||
echo "$(date): Port file empty, waiting..."
|
||||
fi
|
||||
else
|
||||
echo "$(date): No port yet (gluetun response: $RESP)"
|
||||
echo "$(date): Waiting for gluetun to write port file..."
|
||||
fi
|
||||
sleep 45
|
||||
done
|
||||
volumeMounts:
|
||||
- name: gluetun-data
|
||||
mountPath: /tmp/gluetun
|
||||
resources:
|
||||
requests:
|
||||
memory: 32Mi
|
||||
@@ -129,6 +133,8 @@ spec:
|
||||
memory: 1Gi
|
||||
cpu: 500m
|
||||
volumes:
|
||||
- name: gluetun-data
|
||||
emptyDir: {}
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: fornax-worker-tx253-config
|
||||
@@ -154,7 +160,7 @@ spec:
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
# ── Worker TX#34 ──────────────────────────────────────────────────────────────
|
||||
# ── Worker TX#220 ─────────────────────────────────────────────────────────────
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
@@ -163,7 +169,7 @@ metadata:
|
||||
labels:
|
||||
app: fornax-worker-tx34
|
||||
fornax-role: worker
|
||||
fornax-server: us-tx-34
|
||||
fornax-server: us-tx-220
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
@@ -176,7 +182,7 @@ spec:
|
||||
labels:
|
||||
app: fornax-worker-tx34
|
||||
fornax-role: worker
|
||||
fornax-server: us-tx-34
|
||||
fornax-server: us-tx-220
|
||||
spec:
|
||||
initContainers:
|
||||
- name: tun-setup
|
||||
@@ -200,15 +206,16 @@ spec:
|
||||
secretKeyRef:
|
||||
name: fornax-worker-tx34-secrets
|
||||
key: PROTONVPN_PRIVATE_KEY
|
||||
# US-TX#220 — from gluetun's built-in ProtonVPN server list
|
||||
- name: SERVER_NAMES
|
||||
value: "US-TX#220"
|
||||
- name: VPN_PORT_FORWARDING
|
||||
value: "on"
|
||||
- name: FIREWALL_OUTBOUND_SUBNETS
|
||||
value: "10.42.0.0/16,10.43.0.0/16"
|
||||
volumeMounts:
|
||||
- name: gluetun-data
|
||||
mountPath: /tmp/gluetun
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
- containerPort: 8888
|
||||
resources:
|
||||
requests:
|
||||
@@ -224,23 +231,29 @@ spec:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
echo "Waiting for gluetun to assign a forwarded port..."
|
||||
until apk add -q curl 2>/dev/null; do sleep 5; done
|
||||
echo "Watching /tmp/gluetun/forwarded_port for assigned port..."
|
||||
while true; do
|
||||
RESP=$(curl -s http://localhost:8000/v1/openvpn/portforwarded 2>/dev/null)
|
||||
PORT=$(echo "$RESP" | grep -oE '"port":[0-9]+' | grep -oE '[0-9]+$')
|
||||
if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
|
||||
echo "$(date): Forwarded port: $PORT — updating qBittorrent"
|
||||
curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
|
||||
-d "username=admin&password=adminadmin" >/dev/null 2>&1
|
||||
curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
|
||||
-d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
|
||||
echo "$(date): qBittorrent listen port set to $PORT"
|
||||
if [ -f /tmp/gluetun/forwarded_port ]; then
|
||||
PORT=$(cat /tmp/gluetun/forwarded_port)
|
||||
if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
|
||||
echo "$(date): Forwarded port: $PORT — updating qBittorrent"
|
||||
curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
|
||||
-d "username=admin&password=adminadmin" >/dev/null 2>&1
|
||||
curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
|
||||
-d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
|
||||
echo "$(date): qBittorrent listen port set to $PORT"
|
||||
else
|
||||
echo "$(date): Port file empty, waiting..."
|
||||
fi
|
||||
else
|
||||
echo "$(date): No port yet (gluetun response: $RESP)"
|
||||
echo "$(date): Waiting for gluetun to write port file..."
|
||||
fi
|
||||
sleep 45
|
||||
done
|
||||
volumeMounts:
|
||||
- name: gluetun-data
|
||||
mountPath: /tmp/gluetun
|
||||
resources:
|
||||
requests:
|
||||
memory: 32Mi
|
||||
@@ -275,6 +288,8 @@ spec:
|
||||
memory: 1Gi
|
||||
cpu: 500m
|
||||
volumes:
|
||||
- name: gluetun-data
|
||||
emptyDir: {}
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: fornax-worker-tx34-config
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# gluetun + qBittorrent — all torrent traffic routed through ProtonVPN WireGuard
|
||||
# gluetun runs as the VPN container; qBittorrent shares its network namespace (same pod)
|
||||
# Port forwarding via gluetun's native ProtonVPN support (VPN_PORT_FORWARDING=on)
|
||||
# — gluetun handles NAT-PMP internally, exposes port at :8000/v1/openvpn/portforwarded
|
||||
# gluetun writes the assigned port to /tmp/gluetun/forwarded_port (shared emptyDir)
|
||||
# portforward-helper reads that file and updates qBittorrent's listen port
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
@@ -22,14 +22,12 @@ spec:
|
||||
app: qbittorrent
|
||||
spec:
|
||||
initContainers:
|
||||
# Ensure /dev/net/tun exists on the node
|
||||
- name: tun-setup
|
||||
image: busybox:latest
|
||||
command: ["sh", "-c", "mkdir -p /dev/net && [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 && chmod 666 /dev/net/tun && sysctl -w net.ipv6.conf.all.disable_ipv6=1 || true && ip route flush table 51820 2>/dev/null || true && ip rule del priority 101 2>/dev/null || true && ip rule del table 51820 2>/dev/null || true"]
|
||||
securityContext:
|
||||
privileged: true
|
||||
containers:
|
||||
# VPN container — protonvpn provider with native port forwarding support
|
||||
- name: gluetun
|
||||
image: ghcr.io/qdm12/gluetun:latest
|
||||
securityContext:
|
||||
@@ -45,18 +43,17 @@ spec:
|
||||
secretKeyRef:
|
||||
name: media-secrets
|
||||
key: PROTONVPN_PRIVATE_KEY
|
||||
# Pick any US-IL server that supports port forwarding
|
||||
- name: SERVER_REGIONS
|
||||
value: "Illinois"
|
||||
# gluetun handles NAT-PMP exchange natively for protonvpn provider
|
||||
- name: SERVER_NAMES
|
||||
value: "US-IL#1"
|
||||
- name: VPN_PORT_FORWARDING
|
||||
value: "on"
|
||||
# Allow cluster-internal traffic to bypass VPN (for Radarr/Sonarr → qBittorrent API)
|
||||
- name: FIREWALL_OUTBOUND_SUBNETS
|
||||
value: "10.42.0.0/16,10.43.0.0/16"
|
||||
volumeMounts:
|
||||
- name: gluetun-data
|
||||
mountPath: /tmp/gluetun
|
||||
ports:
|
||||
- containerPort: 8000 # gluetun control server
|
||||
- containerPort: 8888 # gluetun HTTP proxy
|
||||
- containerPort: 8888
|
||||
resources:
|
||||
requests:
|
||||
memory: 128Mi
|
||||
@@ -65,40 +62,43 @@ spec:
|
||||
memory: 512Mi
|
||||
cpu: 200m
|
||||
|
||||
# Port forwarding helper — polls gluetun's control API for the assigned port,
|
||||
# then updates qBittorrent. No natpmpc needed; gluetun handles the NAT-PMP exchange.
|
||||
- name: portforward-helper
|
||||
image: alpine:latest
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
echo "Waiting for gluetun port forwarding to initialize..."
|
||||
until apk add -q curl 2>/dev/null; do sleep 5; done
|
||||
echo "Watching /tmp/gluetun/forwarded_port for assigned port..."
|
||||
while true; do
|
||||
RESP=$(curl -s http://localhost:8000/v1/openvpn/portforwarded 2>/dev/null)
|
||||
PORT=$(echo "$RESP" | grep -oE '"port":[0-9]+' | grep -oE '[0-9]+$')
|
||||
if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
|
||||
echo "$(date): Forwarded port: $PORT — updating qBittorrent"
|
||||
curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
|
||||
-d "username=admin&password=adminadmin" >/dev/null 2>&1
|
||||
curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
|
||||
-d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
|
||||
echo "$(date): qBittorrent listen port set to $PORT"
|
||||
if [ -f /tmp/gluetun/forwarded_port ]; then
|
||||
PORT=$(cat /tmp/gluetun/forwarded_port)
|
||||
if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
|
||||
echo "$(date): Forwarded port: $PORT — updating qBittorrent"
|
||||
curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
|
||||
-d "username=admin&password=adminadmin" >/dev/null 2>&1
|
||||
curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
|
||||
-d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
|
||||
echo "$(date): qBittorrent listen port set to $PORT"
|
||||
else
|
||||
echo "$(date): Port file empty, waiting..."
|
||||
fi
|
||||
else
|
||||
echo "$(date): No port yet (gluetun response: $RESP)"
|
||||
echo "$(date): Waiting for gluetun to write port file..."
|
||||
fi
|
||||
sleep 45
|
||||
done
|
||||
volumeMounts:
|
||||
- name: gluetun-data
|
||||
mountPath: /tmp/gluetun
|
||||
resources:
|
||||
requests:
|
||||
memory: 16Mi
|
||||
memory: 32Mi
|
||||
cpu: 10m
|
||||
limits:
|
||||
memory: 32Mi
|
||||
memory: 96Mi
|
||||
cpu: 50m
|
||||
|
||||
# qBittorrent — shares gluetun's network namespace, all traffic through VPN
|
||||
- name: qbittorrent
|
||||
image: lscr.io/linuxserver/qbittorrent:latest
|
||||
env:
|
||||
@@ -125,6 +125,8 @@ spec:
|
||||
memory: 1Gi
|
||||
cpu: 500m
|
||||
volumes:
|
||||
- name: gluetun-data
|
||||
emptyDir: {}
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: qbittorrent-config
|
||||
|
||||
Reference in New Issue
Block a user