will.anderson/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix port forwarding: read file instead of HTTP API, fix server names

Browse Source 
- portforward-helper now reads /tmp/gluetun/forwarded_port via shared emptyDir
  volume instead of polling gluetun HTTP API (which returned Unauthorized)
- Main qbt: SERVER_NAMES=US-IL#1 (valid entry in gluetun server list)
- Both manifests cleaned up
This commit is contained in:
Will Anderson
2026-04-11 10:12:19 -05:00
parent 69976ca172
commit ffd3068f78
2 changed files with 84 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/legion/k8s/media/fornax-workers.yaml
+41 -26
View File
@@ -1,10 +1,10 @@
# Fornax distributed torrent workers — each is a gluetun+qBittorrent pod on a different VPN server # Fornax distributed torrent workers — each is a gluetun+qBittorrent pod on a different VPN server
# Worker TX#253: US-TX#253, NAT-PMP via gluetun native ProtonVPN port forwarding # Worker TX#179: US-TX#179, NAT-PMP via gluetun native ProtonVPN port forwarding
# Worker TX#34: US-TX#34, NAT-PMP via gluetun native ProtonVPN port forwarding # Worker TX#220: US-TX#220, NAT-PMP via gluetun native ProtonVPN port forwarding
# Both workers share the media-data PVC; each has its own config PVC and VPN credentials # Both workers share the media-data PVC; each has its own config PVC and VPN credentials
# The Fornax coordinator proxy (TBD) routes work across these workers # Port file shared via emptyDir: gluetun writes /tmp/gluetun/forwarded_port, helper reads it
# ── Worker TX#253 ───────────────────────────────────────────────────────────── # ── Worker TX#179 ─────────────────────────────────────────────────────────────
apiVersion: apps/v1 apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:
@@ -13,7 +13,7 @@ metadata:
labels: labels:
app: fornax-worker-tx253 app: fornax-worker-tx253
fornax-role: worker fornax-role: worker
fornax-server: us-tx-253 fornax-server: us-tx-179
spec: spec:
replicas: 1 replicas: 1
strategy: strategy:
@@ -26,7 +26,7 @@ spec:
labels: labels:
app: fornax-worker-tx253 app: fornax-worker-tx253
fornax-role: worker fornax-role: worker
fornax-server: us-tx-253 fornax-server: us-tx-179
spec: spec:
initContainers: initContainers:
- name: tun-setup - name: tun-setup
@@ -41,7 +41,6 @@ spec:
capabilities: capabilities:
add: ["NET_ADMIN"] add: ["NET_ADMIN"]
env: env:
# Use protonvpn provider so gluetun handles NAT-PMP natively
- name: VPN_SERVICE_PROVIDER - name: VPN_SERVICE_PROVIDER
value: "protonvpn" value: "protonvpn"
- name: VPN_TYPE - name: VPN_TYPE
@@ -51,17 +50,17 @@ spec:
secretKeyRef: secretKeyRef:
name: fornax-worker-tx253-secrets name: fornax-worker-tx253-secrets
key: PROTONVPN_PRIVATE_KEY key: PROTONVPN_PRIVATE_KEY
# US-TX#179 — from gluetun's built-in ProtonVPN server list
- name: SERVER_NAMES - name: SERVER_NAMES
value: "US-TX#179" value: "US-TX#179"
# gluetun handles NAT-PMP internally, exposes port at :8000/v1/openvpn/portforwarded
- name: VPN_PORT_FORWARDING - name: VPN_PORT_FORWARDING
value: "on" value: "on"
- name: FIREWALL_OUTBOUND_SUBNETS - name: FIREWALL_OUTBOUND_SUBNETS
value: "10.42.0.0/16,10.43.0.0/16" value: "10.42.0.0/16,10.43.0.0/16"
volumeMounts:
- name: gluetun-data
mountPath: /tmp/gluetun
ports: ports:
- containerPort: 8000 # gluetun control server - containerPort: 8888
- containerPort: 8888 # gluetun HTTP proxy
resources: resources:
requests: requests:
memory: 128Mi memory: 128Mi
@@ -70,19 +69,18 @@ spec:
memory: 512Mi memory: 512Mi
cpu: 200m cpu: 200m
# Port forwarding helper — polls gluetun's control API for the assigned port, # Port forwarding helper — reads port from file gluetun writes to /tmp/gluetun/forwarded_port
# then updates qBittorrent. No natpmpc needed; gluetun handles the NAT-PMP exchange.
- name: portforward-helper - name: portforward-helper
image: alpine:latest image: alpine:latest
command: command:
- sh - sh
- -c - -c
- | - |
echo "Waiting for gluetun to assign a forwarded port..."
until apk add -q curl 2>/dev/null; do sleep 5; done until apk add -q curl 2>/dev/null; do sleep 5; done
echo "Watching /tmp/gluetun/forwarded_port for assigned port..."
while true; do while true; do
RESP=$(curl -s http://localhost:8000/v1/openvpn/portforwarded 2>/dev/null) if [ -f /tmp/gluetun/forwarded_port ]; then
PORT=$(echo "$RESP" | grep -oE '"port":[0-9]+' | grep -oE '[0-9]+$') PORT=$(cat /tmp/gluetun/forwarded_port)
if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
echo "$(date): Forwarded port: $PORT — updating qBittorrent" echo "$(date): Forwarded port: $PORT — updating qBittorrent"
curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \ curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
@@ -91,10 +89,16 @@ spec:
-d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1 -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
echo "$(date): qBittorrent listen port set to $PORT" echo "$(date): qBittorrent listen port set to $PORT"
else else
echo "$(date): No port yet (gluetun response: $RESP)" echo "$(date): Port file empty, waiting..."
fi
else
echo "$(date): Waiting for gluetun to write port file..."
fi fi
sleep 45 sleep 45
done done
volumeMounts:
- name: gluetun-data
mountPath: /tmp/gluetun
resources: resources:
requests: requests:
memory: 32Mi memory: 32Mi
@@ -129,6 +133,8 @@ spec:
memory: 1Gi memory: 1Gi
cpu: 500m cpu: 500m
volumes: volumes:
- name: gluetun-data
emptyDir: {}
- name: config - name: config
persistentVolumeClaim: persistentVolumeClaim:
claimName: fornax-worker-tx253-config claimName: fornax-worker-tx253-config
@@ -154,7 +160,7 @@ spec:
type: ClusterIP type: ClusterIP
--- ---
# ── Worker TX#34 ────────────────────────────────────────────────────────────── # ── Worker TX#220 ─────────────────────────────────────────────────────────────
apiVersion: apps/v1 apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:
@@ -163,7 +169,7 @@ metadata:
labels: labels:
app: fornax-worker-tx34 app: fornax-worker-tx34
fornax-role: worker fornax-role: worker
fornax-server: us-tx-34 fornax-server: us-tx-220
spec: spec:
replicas: 1 replicas: 1
strategy: strategy:
@@ -176,7 +182,7 @@ spec:
labels: labels:
app: fornax-worker-tx34 app: fornax-worker-tx34
fornax-role: worker fornax-role: worker
fornax-server: us-tx-34 fornax-server: us-tx-220
spec: spec:
initContainers: initContainers:
- name: tun-setup - name: tun-setup
@@ -200,15 +206,16 @@ spec:
secretKeyRef: secretKeyRef:
name: fornax-worker-tx34-secrets name: fornax-worker-tx34-secrets
key: PROTONVPN_PRIVATE_KEY key: PROTONVPN_PRIVATE_KEY
# US-TX#220 — from gluetun's built-in ProtonVPN server list
- name: SERVER_NAMES - name: SERVER_NAMES
value: "US-TX#220" value: "US-TX#220"
- name: VPN_PORT_FORWARDING - name: VPN_PORT_FORWARDING
value: "on" value: "on"
- name: FIREWALL_OUTBOUND_SUBNETS - name: FIREWALL_OUTBOUND_SUBNETS
value: "10.42.0.0/16,10.43.0.0/16" value: "10.42.0.0/16,10.43.0.0/16"
volumeMounts:
- name: gluetun-data
mountPath: /tmp/gluetun
ports: ports:
- containerPort: 8000
- containerPort: 8888 - containerPort: 8888
resources: resources:
requests: requests:
@@ -224,11 +231,11 @@ spec:
- sh - sh
- -c - -c
- | - |
echo "Waiting for gluetun to assign a forwarded port..."
until apk add -q curl 2>/dev/null; do sleep 5; done until apk add -q curl 2>/dev/null; do sleep 5; done
echo "Watching /tmp/gluetun/forwarded_port for assigned port..."
while true; do while true; do
RESP=$(curl -s http://localhost:8000/v1/openvpn/portforwarded 2>/dev/null) if [ -f /tmp/gluetun/forwarded_port ]; then
PORT=$(echo "$RESP" | grep -oE '"port":[0-9]+' | grep -oE '[0-9]+$') PORT=$(cat /tmp/gluetun/forwarded_port)
if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
echo "$(date): Forwarded port: $PORT — updating qBittorrent" echo "$(date): Forwarded port: $PORT — updating qBittorrent"
curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \ curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
@@ -237,10 +244,16 @@ spec:
-d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1 -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
echo "$(date): qBittorrent listen port set to $PORT" echo "$(date): qBittorrent listen port set to $PORT"
else else
echo "$(date): No port yet (gluetun response: $RESP)" echo "$(date): Port file empty, waiting..."
fi
else
echo "$(date): Waiting for gluetun to write port file..."
fi fi
sleep 45 sleep 45
done done
volumeMounts:
- name: gluetun-data
mountPath: /tmp/gluetun
resources: resources:
requests: requests:
memory: 32Mi memory: 32Mi
@@ -275,6 +288,8 @@ spec:
memory: 1Gi memory: 1Gi
cpu: 500m cpu: 500m
volumes: volumes:
- name: gluetun-data
emptyDir: {}
- name: config - name: config
persistentVolumeClaim: persistentVolumeClaim:
claimName: fornax-worker-tx34-config claimName: fornax-worker-tx34-config
servers/legion/k8s/media/gluetun-qbittorrent.yaml
+22 -20
View File
@@ -1,7 +1,7 @@
# gluetun + qBittorrent — all torrent traffic routed through ProtonVPN WireGuard # gluetun + qBittorrent — all torrent traffic routed through ProtonVPN WireGuard
# gluetun runs as the VPN container; qBittorrent shares its network namespace (same pod)
# Port forwarding via gluetun's native ProtonVPN support (VPN_PORT_FORWARDING=on) # Port forwarding via gluetun's native ProtonVPN support (VPN_PORT_FORWARDING=on)
# — gluetun handles NAT-PMP internally, exposes port at :8000/v1/openvpn/portforwarded # gluetun writes the assigned port to /tmp/gluetun/forwarded_port (shared emptyDir)
# portforward-helper reads that file and updates qBittorrent's listen port
apiVersion: apps/v1 apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:
@@ -22,14 +22,12 @@ spec:
app: qbittorrent app: qbittorrent
spec: spec:
initContainers: initContainers:
# Ensure /dev/net/tun exists on the node
- name: tun-setup - name: tun-setup
image: busybox:latest image: busybox:latest
command: ["sh", "-c", "mkdir -p /dev/net && [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 && chmod 666 /dev/net/tun && sysctl -w net.ipv6.conf.all.disable_ipv6=1 || true && ip route flush table 51820 2>/dev/null || true && ip rule del priority 101 2>/dev/null || true && ip rule del table 51820 2>/dev/null || true"] command: ["sh", "-c", "mkdir -p /dev/net && [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 && chmod 666 /dev/net/tun && sysctl -w net.ipv6.conf.all.disable_ipv6=1 || true && ip route flush table 51820 2>/dev/null || true && ip rule del priority 101 2>/dev/null || true && ip rule del table 51820 2>/dev/null || true"]
securityContext: securityContext:
privileged: true privileged: true
containers: containers:
# VPN container — protonvpn provider with native port forwarding support
- name: gluetun - name: gluetun
image: ghcr.io/qdm12/gluetun:latest image: ghcr.io/qdm12/gluetun:latest
securityContext: securityContext:
@@ -45,18 +43,17 @@ spec:
secretKeyRef: secretKeyRef:
name: media-secrets name: media-secrets
key: PROTONVPN_PRIVATE_KEY key: PROTONVPN_PRIVATE_KEY
# Pick any US-IL server that supports port forwarding - name: SERVER_NAMES
- name: SERVER_REGIONS value: "US-IL#1"
value: "Illinois"
# gluetun handles NAT-PMP exchange natively for protonvpn provider
- name: VPN_PORT_FORWARDING - name: VPN_PORT_FORWARDING
value: "on" value: "on"
# Allow cluster-internal traffic to bypass VPN (for Radarr/Sonarr → qBittorrent API)
- name: FIREWALL_OUTBOUND_SUBNETS - name: FIREWALL_OUTBOUND_SUBNETS
value: "10.42.0.0/16,10.43.0.0/16" value: "10.42.0.0/16,10.43.0.0/16"
volumeMounts:
- name: gluetun-data
mountPath: /tmp/gluetun
ports: ports:
- containerPort: 8000 # gluetun control server - containerPort: 8888
- containerPort: 8888 # gluetun HTTP proxy
resources: resources:
requests: requests:
memory: 128Mi memory: 128Mi
@@ -65,19 +62,17 @@ spec:
memory: 512Mi memory: 512Mi
cpu: 200m cpu: 200m
# Port forwarding helper — polls gluetun's control API for the assigned port,
# then updates qBittorrent. No natpmpc needed; gluetun handles the NAT-PMP exchange.
- name: portforward-helper - name: portforward-helper
image: alpine:latest image: alpine:latest
command: command:
- sh - sh
- -c - -c
- | - |
echo "Waiting for gluetun port forwarding to initialize..."
until apk add -q curl 2>/dev/null; do sleep 5; done until apk add -q curl 2>/dev/null; do sleep 5; done
echo "Watching /tmp/gluetun/forwarded_port for assigned port..."
while true; do while true; do
RESP=$(curl -s http://localhost:8000/v1/openvpn/portforwarded 2>/dev/null) if [ -f /tmp/gluetun/forwarded_port ]; then
PORT=$(echo "$RESP" | grep -oE '"port":[0-9]+' | grep -oE '[0-9]+$') PORT=$(cat /tmp/gluetun/forwarded_port)
if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
echo "$(date): Forwarded port: $PORT — updating qBittorrent" echo "$(date): Forwarded port: $PORT — updating qBittorrent"
curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \ curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
@@ -86,19 +81,24 @@ spec:
-d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1 -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
echo "$(date): qBittorrent listen port set to $PORT" echo "$(date): qBittorrent listen port set to $PORT"
else else
echo "$(date): No port yet (gluetun response: $RESP)" echo "$(date): Port file empty, waiting..."
fi
else
echo "$(date): Waiting for gluetun to write port file..."
fi fi
sleep 45 sleep 45
done done
volumeMounts:
- name: gluetun-data
mountPath: /tmp/gluetun
resources: resources:
requests: requests:
memory: 16Mi memory: 32Mi
cpu: 10m cpu: 10m
limits: limits:
memory: 32Mi memory: 96Mi
cpu: 50m cpu: 50m
# qBittorrent — shares gluetun's network namespace, all traffic through VPN
- name: qbittorrent - name: qbittorrent
image: lscr.io/linuxserver/qbittorrent:latest image: lscr.io/linuxserver/qbittorrent:latest
env: env:
@@ -125,6 +125,8 @@ spec:
memory: 1Gi memory: 1Gi
cpu: 500m cpu: 500m
volumes: volumes:
- name: gluetun-data
emptyDir: {}
- name: config - name: config
persistentVolumeClaim: persistentVolumeClaim:
claimName: qbittorrent-config claimName: qbittorrent-config