- Fix liveness/readiness probe paths from /api/v2/app/version (qBittorrent)
to /health and /health/ready (Fornax Express server). Pod was restarting
every ~30s due to probe failures against wrong endpoint.
- Add fornax-ui deployment and service for React dashboard
(image: fornax/ui:latest, nginx on port 80)
- Split ingress: /api and /health → coordinator:3000, / → ui:80
- Update kustomization to include UI resources
- Worker deployment: add COORDINATOR_URL and WORKER_ID env vars to
portforward-helper; webhook calls coordinator /api/v2/workers/:id/port-lease
after each NAT-PMP renewal so coordinator tracks current forwarded port
- Worker overlays: patch WORKER_ID env var to actual worker ID (tx253/tx34)
- Grafana: fornax-grafana Argo CD app pointing to k8s/fornax/grafana/
ConfigMap with grafana_dashboard=1 label for auto-discovery by sidecar;
7 panels covering bandwidth, active torrents, worker health, request rate,
and error rate
Register voidstash.xyz as the private media stack domain.
- DNS delegated from Porkbun to Cloudflare nameservers
- stash.voidstash.xyz and whisparr.voidstash.xyz CNAME to legion tunnel
- Tunnel ingress rules added for both subdomains → Traefik
Switch qbt-config-patch from busybox/sed to python:3-alpine so we can
cleanly handle INI keys with backslashes. Now seeds both password hash
and high-throughput defaults (3000 max connections, 50 active downloads,
unlimited rate) on fresh PVC deployments. Existing configs are updated
in-place; API-applied values are preserved on restart.
Sonarr and Radarr service settings live in settings.json (not the SQLite
database). Extend the restore.js initContainer to seed both services on
first boot or after a PVC wipe, matching current live config.
LocalhostAuthEnabled=false isn't honored in this qBT version. Instead, initContainer
stamps the PBKDF2 hash for admin:adminadmin before startup so all three pods have
consistent credentials. portforward-helper and coordinator restored to cookie-based
SID auth.
Adds qbt-config-patch initContainer that sets WebUI\LocalhostAuthEnabled=false
in qBittorrent.conf before the main containers start. Prevents qBittorrent from
overwriting the setting (previously edited at runtime, lost on pod restart).
LocalhostAuthEnabled=false set in all three qbt configs. portforward-helper and
coordinator now call the API directly without auth — no more ban risk from failed
login attempts.
- portforward-helper now reads /tmp/gluetun/forwarded_port via shared emptyDir
volume instead of polling gluetun HTTP API (which returned Unauthorized)
- Main qbt: SERVER_NAMES=US-IL#1 (valid entry in gluetun server list)
- Both manifests cleaned up
- Main qbt: switch from pinned US-IL#149 (no PF) to SERVER_REGIONS=Illinois so
gluetun picks any IL server with port forwarding enabled
- Fornax workers: portforward-helper 32Mi→96Mi to stop OOMKill
Python proxy running on python:3-alpine via ConfigMap. Routes /api/v2/torrents/add
across all three workers in round-robin; proxies status/monitoring to primary.
Manages independent SID sessions to each backend with auto-refresh on 403.
Service: fornax.media.svc:8080 — point Sonarr/Radarr here instead of qbittorrent.
US-TX#253 and US-TX#34 aren't in gluetun's built-in list. Switching to:
- Main qbt: US-IL#149 (was US-IL#267)
- Fornax TX253: US-TX#179
- Fornax TX34: US-TX#220
Private keys are per-account and work with any ProtonVPN WireGuard server.
Replaces DIY natpmpc sidecar with gluetun's built-in NAT-PMP handling for the protonvpn
provider. The natpmpc UDP response was being dropped by gluetun's firewall since conntrack
doesn't track stateless UDP from the gateway. With VPN_PORT_FORWARDING=on, gluetun handles
the NAT-PMP exchange internally and exposes the port at :8000/v1/openvpn/portforwarded.
Helper sidecar now just polls that endpoint.
Two initial Fornax distributed torrent workers, each a gluetun+qBittorrent+natpmpc-helper
pod on a different ProtonVPN TX server with NAT-PMP enabled. VPN private keys stored in
Vault at secret/fornax/worker-tx253 and secret/fornax/worker-tx34, surfaced via
ExternalSecrets. Workers share the media-data PVC; each has its own config PVC.
Services: fornax-worker-tx253:8080 and fornax-worker-tx34:8080 (ClusterIP, media ns)
Tunnel routes were being managed ad-hoc via Cloudflare API. Now codified
in Terraform so they can't drift — neuron.neuralplatform.ai was missing
from the tunnel config, causing 404s for Neuron MCP connections.
Also fix mcp.json: type http → sse (Neuron uses SSE transport, not
streamable HTTP). CF-Access headers were already present and correct.
Increase memory limit 32→64Mi (apk install was hitting the 32Mi ceiling).
Fix qBittorrent setPreferences call: use form-encoded json=<string> not
json body nesting.
Adds a lightweight Alpine sidecar that runs natpmpc against the ProtonVPN
NAT-PMP gateway (10.2.0.1) every 45s to maintain a forwarded port, then
updates qBittorrent's listen port via API. Without inbound port forwarding
peers can only be dialed out to, which severely limits download speeds on
a gigabit connection.
Audio tracks in some video files return language as a BoxList (list of
Language objects) from the video metadata parser. The existing code
tries to add this directly to a Python set, which fails because BoxList
is not hashable — crashing subtitle search for every movie.
Fix: check if lang has __iter__ and iterate over it, or call .alpha3
directly if it's a single Language object.
Delivered via ConfigMap volumeMount so it survives pod restarts.
The /gluetun binary has restrictive permissions and cannot be exec'd
from a shell wrapper. The OOM fix (512Mi limit) prevents the crashes
that caused stale ip rules, so the wrapper is not needed.
- Increase memory limit 128Mi → 512Mi (DNS block list download needs ~200MB)
- Add command wrapper that cleans stale ip rules before exec'ing gluetun
so container restarts within the same pod don't fail with "file exists"
- Fix deprecated VPN_ENDPOINT_IP/PORT → WIREGUARD_ENDPOINT_IP/PORT
The protonvpn named provider rotates through P2P servers and DNS
health checks were failing on every server it tried. Switching back
to custom provider pinned to the specific US-TX#457 server/key combo
from the ProtonVPN conf file, which is confirmed to work.
This sacrifices automatic port forwarding but restores stable downloads.
Custom WireGuard mode doesn't support NAT-PMP port forwarding — peers
can't connect inbound so most torrents stall. Switching to protonvpn
provider with SERVER_FEATURES=p2p picks a port-forwarding-capable server
and VPN_PORT_FORWARDING=on handles the NAT-PMP handshake. Up command
updates qBittorrent listen port automatically when gluetun gets the port.
Seerr's scheduler compares mediaServerType against numeric enum values
(PLEX=1, JELLYFIN=2, EMBY=3). restore.js was setting the string 'JELLYFIN'
which never matched, so Jellyfin scan jobs were never registered in the
scheduler — causing 'Watch on Jellyfin' buttons to never appear.
Bazarr initializes scheduler, DB, and Radarr/Sonarr connections before
serving HTTP. 30s initialDelay was too short, causing restart loops.
Also add readinessProbe and failureThreshold for resilience.
Seerr's checkOverseerrMerge calls Settings.load with raw=true, which
replaces this.data entirely with file contents. If settings.main is
absent (as in our jellyfin-only restore), it crashes at line 418:
'Cannot read properties of undefined (reading apiKey)'.
restore.js now ensures settings.main exists and mediaServerType=JELLYFIN,
which both prevents the crash and causes checkOverseerrMerge to return
early (migration already done).
Will Anderson