Will Anderson
91bfc42989
Scaled to replicas: 0: fornax (coordinator/ui/workers), jellyfin via media, overseerr, plex, radarr, sonarr, bazarr, prowlarr, flaresolverr, ollama, harmonic-wordpress, docuseal, listmonk, memos, plane, redpanda, wp-coordinator
199 lines
7.1 KiB
YAML
199 lines
7.1 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: fornax-worker-WORKER_ID
|
|
namespace: media
|
|
labels:
|
|
app: fornax-worker-WORKER_ID
|
|
app.kubernetes.io/part-of: fornax
|
|
app.kubernetes.io/component: worker
|
|
spec:
|
|
replicas: 0
|
|
selector:
|
|
matchLabels:
|
|
app: fornax-worker-WORKER_ID
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: fornax-worker-WORKER_ID
|
|
spec:
|
|
initContainers:
|
|
- name: tun-setup
|
|
image: busybox:latest
|
|
securityContext:
|
|
privileged: true
|
|
command:
|
|
- sh
|
|
- -c
|
|
- >-
|
|
mkdir -p /dev/net &&
|
|
[ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 &&
|
|
chmod 666 /dev/net/tun &&
|
|
sysctl -w net.ipv6.conf.all.disable_ipv6=1 || true &&
|
|
ip route flush table 51820 2>/dev/null || true &&
|
|
ip rule del priority 101 2>/dev/null || true &&
|
|
ip rule del table 51820 2>/dev/null || true
|
|
- name: qbt-config-patch
|
|
image: busybox:latest
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
CONF=/config/qBittorrent/qBittorrent.conf
|
|
HASH='@ByteArray(HqYj1eGsdXlQ4CSy597Y9A==:J9hsJIlU5FYfHb5rY5qQoIpVpTijryS/H+CE07oMtplL/ytneBVFd2tfVJtqGjhdht8tEi4wmqSSlqTgEu444w==)'
|
|
mkdir -p /config/qBittorrent
|
|
if [ -f "$CONF" ]; then
|
|
if grep -q "Password_PBKDF2" "$CONF"; then
|
|
sed -i "s|WebUI\\\\Password_PBKDF2=.*|WebUI\\\\Password_PBKDF2=\"$HASH\"|" "$CONF"
|
|
else
|
|
sed -i "/^\\[Preferences\\]/a WebUI\\\\Password_PBKDF2=\"$HASH\"" "$CONF"
|
|
fi
|
|
fi
|
|
echo "Password hash set."
|
|
volumeMounts:
|
|
- mountPath: /config
|
|
name: config
|
|
containers:
|
|
- name: gluetun
|
|
image: ghcr.io/qdm12/gluetun:latest
|
|
imagePullPolicy: Always
|
|
securityContext:
|
|
capabilities:
|
|
add:
|
|
- NET_ADMIN
|
|
env:
|
|
- name: VPN_SERVICE_PROVIDER
|
|
value: custom
|
|
- name: VPN_TYPE
|
|
value: wireguard
|
|
- name: WIREGUARD_PRIVATE_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: fornax-worker-WORKER_ID-secrets
|
|
key: PROTONVPN_PRIVATE_KEY
|
|
- name: WIREGUARD_PUBLIC_KEY
|
|
value: PLACEHOLDER_PUBLIC_KEY
|
|
- name: WIREGUARD_ADDRESSES
|
|
value: 10.2.0.2/32
|
|
- name: WIREGUARD_ENDPOINT_IP
|
|
value: PLACEHOLDER_ENDPOINT_IP
|
|
- name: WIREGUARD_ENDPOINT_PORT
|
|
value: "51820"
|
|
- name: DOT
|
|
value: "off"
|
|
- name: DNS_UPSTREAM_RESOLVER_TYPE
|
|
value: "plain"
|
|
- name: DNS_UPSTREAM_PLAIN_ADDRESSES
|
|
value: "10.43.0.10:53"
|
|
- name: HEALTH_TARGET_ADDRESS
|
|
value: "api.protonvpn.ch:443,account.proton.me:443"
|
|
- name: HEALTH_ICMP_TARGET_IPS
|
|
value: "10.2.0.1"
|
|
- name: FIREWALL_OUTBOUND_SUBNETS
|
|
value: 10.42.0.0/16,10.43.0.0/16
|
|
ports:
|
|
- containerPort: 8888
|
|
name: proxy
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 512Mi
|
|
volumeMounts:
|
|
- mountPath: /tmp/gluetun
|
|
name: gluetun-data
|
|
- name: portforward-helper
|
|
image: alpine:latest
|
|
imagePullPolicy: Always
|
|
securityContext:
|
|
capabilities:
|
|
add: ["NET_ADMIN"]
|
|
env:
|
|
- name: COORDINATOR_URL
|
|
value: "https://fornax.neuralplatform.ai"
|
|
- name: WORKER_ID
|
|
value: "WORKER_ID"
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
echo "Waiting for gluetun health endpoint..."
|
|
while ! wget -q -T 3 -O- http://127.0.0.1:9999 > /dev/null 2>&1; do sleep 3; done
|
|
echo "gluetun ready"
|
|
# gluetun adds 'ip rule priority 100 from <pod-IP> lookup 200' which routes
|
|
# all pod traffic via eth0, bypassing tun0. The iptables OUTPUT DROP policy
|
|
# then blocks it. Removing rule 100 lets traffic fall through to priority 101
|
|
# (not fwmark 0xca6c -> table 51820 -> tun0).
|
|
ip rule del priority 100 2>/dev/null && echo "Fixed VPN routing (removed rule 100)" || echo "Rule 100 not present"
|
|
until apk add -q curl 2>/dev/null; do sleep 5; done
|
|
echo "Watching /tmp/gluetun/forwarded_port for assigned port..."
|
|
TTL=300
|
|
while true; do
|
|
if [ -f /tmp/gluetun/forwarded_port ]; then
|
|
PORT=$(cat /tmp/gluetun/forwarded_port)
|
|
if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
|
|
echo "$(date): Forwarded port: $PORT - updating qBittorrent"
|
|
curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
|
|
-d "username=admin&password=adminadmin" >/dev/null 2>&1
|
|
curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
|
|
-d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
|
|
echo "$(date): qBittorrent listen port set to $PORT"
|
|
if [ -n "$COORDINATOR_URL" ] && [ -n "$WORKER_ID" ]; then
|
|
curl -s -X POST "$COORDINATOR_URL/api/v2/workers/$WORKER_ID/port-lease" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"port\": $PORT, \"ttlSeconds\": $TTL}" >/dev/null 2>&1 || true
|
|
echo "$(date): Coordinator notified of port $PORT (TTL: ${TTL}s)"
|
|
fi
|
|
fi
|
|
fi
|
|
sleep 45
|
|
done
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 50m
|
|
memory: 96Mi
|
|
volumeMounts:
|
|
- mountPath: /tmp/gluetun
|
|
name: gluetun-data
|
|
- name: qbittorrent
|
|
image: lscr.io/linuxserver/qbittorrent:latest
|
|
imagePullPolicy: Always
|
|
env:
|
|
- name: PUID
|
|
value: "1000"
|
|
- name: PGID
|
|
value: "1000"
|
|
- name: TZ
|
|
value: America/Chicago
|
|
- name: WEBUI_PORT
|
|
value: "8080"
|
|
ports:
|
|
- containerPort: 8080
|
|
name: webui
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
volumeMounts:
|
|
- mountPath: /config
|
|
name: config
|
|
- mountPath: /media
|
|
name: media
|
|
volumes:
|
|
- name: gluetun-data
|
|
emptyDir: {}
|
|
- name: config
|
|
persistentVolumeClaim:
|
|
claimName: fornax-worker-WORKER_ID-config
|
|
- name: media
|
|
persistentVolumeClaim:
|
|
claimName: media-data
|