diff --git a/servers/legion/k8s/media/fornax-workers.yaml b/servers/legion/k8s/media/fornax-workers.yaml index 29bf838..8c8be47 100644 --- a/servers/legion/k8s/media/fornax-workers.yaml +++ b/servers/legion/k8s/media/fornax-workers.yaml @@ -1,10 +1,10 @@ # Fornax distributed torrent workers — each is a gluetun+qBittorrent pod on a different VPN server -# Worker TX#253: US-TX#253, NAT-PMP via gluetun native ProtonVPN port forwarding -# Worker TX#34: US-TX#34, NAT-PMP via gluetun native ProtonVPN port forwarding +# Worker TX#179: US-TX#179, NAT-PMP via gluetun native ProtonVPN port forwarding +# Worker TX#220: US-TX#220, NAT-PMP via gluetun native ProtonVPN port forwarding # Both workers share the media-data PVC; each has its own config PVC and VPN credentials -# The Fornax coordinator proxy (TBD) routes work across these workers +# Port file shared via emptyDir: gluetun writes /tmp/gluetun/forwarded_port, helper reads it -# ── Worker TX#253 ───────────────────────────────────────────────────────────── +# ── Worker TX#179 ───────────────────────────────────────────────────────────── apiVersion: apps/v1 kind: Deployment metadata: @@ -13,7 +13,7 @@ metadata: labels: app: fornax-worker-tx253 fornax-role: worker - fornax-server: us-tx-253 + fornax-server: us-tx-179 spec: replicas: 1 strategy: @@ -26,7 +26,7 @@ spec: labels: app: fornax-worker-tx253 fornax-role: worker - fornax-server: us-tx-253 + fornax-server: us-tx-179 spec: initContainers: - name: tun-setup @@ -41,7 +41,6 @@ spec: capabilities: add: ["NET_ADMIN"] env: - # Use protonvpn provider so gluetun handles NAT-PMP natively - name: VPN_SERVICE_PROVIDER value: "protonvpn" - name: VPN_TYPE @@ -51,17 +50,17 @@ spec: secretKeyRef: name: fornax-worker-tx253-secrets key: PROTONVPN_PRIVATE_KEY - # US-TX#179 — from gluetun's built-in ProtonVPN server list - name: SERVER_NAMES value: "US-TX#179" - # gluetun handles NAT-PMP internally, exposes port at :8000/v1/openvpn/portforwarded - name: VPN_PORT_FORWARDING value: "on" - name: FIREWALL_OUTBOUND_SUBNETS value: "10.42.0.0/16,10.43.0.0/16" + volumeMounts: + - name: gluetun-data + mountPath: /tmp/gluetun ports: - - containerPort: 8000 # gluetun control server - - containerPort: 8888 # gluetun HTTP proxy + - containerPort: 8888 resources: requests: memory: 128Mi @@ -70,31 +69,36 @@ spec: memory: 512Mi cpu: 200m - # Port forwarding helper — polls gluetun's control API for the assigned port, - # then updates qBittorrent. No natpmpc needed; gluetun handles the NAT-PMP exchange. + # Port forwarding helper — reads port from file gluetun writes to /tmp/gluetun/forwarded_port - name: portforward-helper image: alpine:latest command: - sh - -c - | - echo "Waiting for gluetun to assign a forwarded port..." until apk add -q curl 2>/dev/null; do sleep 5; done + echo "Watching /tmp/gluetun/forwarded_port for assigned port..." while true; do - RESP=$(curl -s http://localhost:8000/v1/openvpn/portforwarded 2>/dev/null) - PORT=$(echo "$RESP" | grep -oE '"port":[0-9]+' | grep -oE '[0-9]+$') - if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then - echo "$(date): Forwarded port: $PORT — updating qBittorrent" - curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \ - -d "username=admin&password=adminadmin" >/dev/null 2>&1 - curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \ - -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1 - echo "$(date): qBittorrent listen port set to $PORT" + if [ -f /tmp/gluetun/forwarded_port ]; then + PORT=$(cat /tmp/gluetun/forwarded_port) + if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then + echo "$(date): Forwarded port: $PORT — updating qBittorrent" + curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \ + -d "username=admin&password=adminadmin" >/dev/null 2>&1 + curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \ + -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1 + echo "$(date): qBittorrent listen port set to $PORT" + else + echo "$(date): Port file empty, waiting..." + fi else - echo "$(date): No port yet (gluetun response: $RESP)" + echo "$(date): Waiting for gluetun to write port file..." fi sleep 45 done + volumeMounts: + - name: gluetun-data + mountPath: /tmp/gluetun resources: requests: memory: 32Mi @@ -129,6 +133,8 @@ spec: memory: 1Gi cpu: 500m volumes: + - name: gluetun-data + emptyDir: {} - name: config persistentVolumeClaim: claimName: fornax-worker-tx253-config @@ -154,7 +160,7 @@ spec: type: ClusterIP --- -# ── Worker TX#34 ────────────────────────────────────────────────────────────── +# ── Worker TX#220 ───────────────────────────────────────────────────────────── apiVersion: apps/v1 kind: Deployment metadata: @@ -163,7 +169,7 @@ metadata: labels: app: fornax-worker-tx34 fornax-role: worker - fornax-server: us-tx-34 + fornax-server: us-tx-220 spec: replicas: 1 strategy: @@ -176,7 +182,7 @@ spec: labels: app: fornax-worker-tx34 fornax-role: worker - fornax-server: us-tx-34 + fornax-server: us-tx-220 spec: initContainers: - name: tun-setup @@ -200,15 +206,16 @@ spec: secretKeyRef: name: fornax-worker-tx34-secrets key: PROTONVPN_PRIVATE_KEY - # US-TX#220 — from gluetun's built-in ProtonVPN server list - name: SERVER_NAMES value: "US-TX#220" - name: VPN_PORT_FORWARDING value: "on" - name: FIREWALL_OUTBOUND_SUBNETS value: "10.42.0.0/16,10.43.0.0/16" + volumeMounts: + - name: gluetun-data + mountPath: /tmp/gluetun ports: - - containerPort: 8000 - containerPort: 8888 resources: requests: @@ -224,23 +231,29 @@ spec: - sh - -c - | - echo "Waiting for gluetun to assign a forwarded port..." until apk add -q curl 2>/dev/null; do sleep 5; done + echo "Watching /tmp/gluetun/forwarded_port for assigned port..." while true; do - RESP=$(curl -s http://localhost:8000/v1/openvpn/portforwarded 2>/dev/null) - PORT=$(echo "$RESP" | grep -oE '"port":[0-9]+' | grep -oE '[0-9]+$') - if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then - echo "$(date): Forwarded port: $PORT — updating qBittorrent" - curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \ - -d "username=admin&password=adminadmin" >/dev/null 2>&1 - curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \ - -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1 - echo "$(date): qBittorrent listen port set to $PORT" + if [ -f /tmp/gluetun/forwarded_port ]; then + PORT=$(cat /tmp/gluetun/forwarded_port) + if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then + echo "$(date): Forwarded port: $PORT — updating qBittorrent" + curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \ + -d "username=admin&password=adminadmin" >/dev/null 2>&1 + curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \ + -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1 + echo "$(date): qBittorrent listen port set to $PORT" + else + echo "$(date): Port file empty, waiting..." + fi else - echo "$(date): No port yet (gluetun response: $RESP)" + echo "$(date): Waiting for gluetun to write port file..." fi sleep 45 done + volumeMounts: + - name: gluetun-data + mountPath: /tmp/gluetun resources: requests: memory: 32Mi @@ -275,6 +288,8 @@ spec: memory: 1Gi cpu: 500m volumes: + - name: gluetun-data + emptyDir: {} - name: config persistentVolumeClaim: claimName: fornax-worker-tx34-config diff --git a/servers/legion/k8s/media/gluetun-qbittorrent.yaml b/servers/legion/k8s/media/gluetun-qbittorrent.yaml index e3ba52b..07075ea 100644 --- a/servers/legion/k8s/media/gluetun-qbittorrent.yaml +++ b/servers/legion/k8s/media/gluetun-qbittorrent.yaml @@ -1,7 +1,7 @@ # gluetun + qBittorrent — all torrent traffic routed through ProtonVPN WireGuard -# gluetun runs as the VPN container; qBittorrent shares its network namespace (same pod) # Port forwarding via gluetun's native ProtonVPN support (VPN_PORT_FORWARDING=on) -# — gluetun handles NAT-PMP internally, exposes port at :8000/v1/openvpn/portforwarded +# gluetun writes the assigned port to /tmp/gluetun/forwarded_port (shared emptyDir) +# portforward-helper reads that file and updates qBittorrent's listen port apiVersion: apps/v1 kind: Deployment metadata: @@ -22,14 +22,12 @@ spec: app: qbittorrent spec: initContainers: - # Ensure /dev/net/tun exists on the node - name: tun-setup image: busybox:latest command: ["sh", "-c", "mkdir -p /dev/net && [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 && chmod 666 /dev/net/tun && sysctl -w net.ipv6.conf.all.disable_ipv6=1 || true && ip route flush table 51820 2>/dev/null || true && ip rule del priority 101 2>/dev/null || true && ip rule del table 51820 2>/dev/null || true"] securityContext: privileged: true containers: - # VPN container — protonvpn provider with native port forwarding support - name: gluetun image: ghcr.io/qdm12/gluetun:latest securityContext: @@ -45,18 +43,17 @@ spec: secretKeyRef: name: media-secrets key: PROTONVPN_PRIVATE_KEY - # Pick any US-IL server that supports port forwarding - - name: SERVER_REGIONS - value: "Illinois" - # gluetun handles NAT-PMP exchange natively for protonvpn provider + - name: SERVER_NAMES + value: "US-IL#1" - name: VPN_PORT_FORWARDING value: "on" - # Allow cluster-internal traffic to bypass VPN (for Radarr/Sonarr → qBittorrent API) - name: FIREWALL_OUTBOUND_SUBNETS value: "10.42.0.0/16,10.43.0.0/16" + volumeMounts: + - name: gluetun-data + mountPath: /tmp/gluetun ports: - - containerPort: 8000 # gluetun control server - - containerPort: 8888 # gluetun HTTP proxy + - containerPort: 8888 resources: requests: memory: 128Mi @@ -65,40 +62,43 @@ spec: memory: 512Mi cpu: 200m - # Port forwarding helper — polls gluetun's control API for the assigned port, - # then updates qBittorrent. No natpmpc needed; gluetun handles the NAT-PMP exchange. - name: portforward-helper image: alpine:latest command: - sh - -c - | - echo "Waiting for gluetun port forwarding to initialize..." until apk add -q curl 2>/dev/null; do sleep 5; done + echo "Watching /tmp/gluetun/forwarded_port for assigned port..." while true; do - RESP=$(curl -s http://localhost:8000/v1/openvpn/portforwarded 2>/dev/null) - PORT=$(echo "$RESP" | grep -oE '"port":[0-9]+' | grep -oE '[0-9]+$') - if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then - echo "$(date): Forwarded port: $PORT — updating qBittorrent" - curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \ - -d "username=admin&password=adminadmin" >/dev/null 2>&1 - curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \ - -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1 - echo "$(date): qBittorrent listen port set to $PORT" + if [ -f /tmp/gluetun/forwarded_port ]; then + PORT=$(cat /tmp/gluetun/forwarded_port) + if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then + echo "$(date): Forwarded port: $PORT — updating qBittorrent" + curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \ + -d "username=admin&password=adminadmin" >/dev/null 2>&1 + curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \ + -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1 + echo "$(date): qBittorrent listen port set to $PORT" + else + echo "$(date): Port file empty, waiting..." + fi else - echo "$(date): No port yet (gluetun response: $RESP)" + echo "$(date): Waiting for gluetun to write port file..." fi sleep 45 done + volumeMounts: + - name: gluetun-data + mountPath: /tmp/gluetun resources: requests: - memory: 16Mi + memory: 32Mi cpu: 10m limits: - memory: 32Mi + memory: 96Mi cpu: 50m - # qBittorrent — shares gluetun's network namespace, all traffic through VPN - name: qbittorrent image: lscr.io/linuxserver/qbittorrent:latest env: @@ -125,6 +125,8 @@ spec: memory: 1Gi cpu: 500m volumes: + - name: gluetun-data + emptyDir: {} - name: config persistentVolumeClaim: claimName: qbittorrent-config