Will Anderson
7c17b8a93e
The /gluetun binary has restrictive permissions and cannot be exec'd from a shell wrapper. The OOM fix (512Mi limit) prevents the crashes that caused stale ip rules, so the wrapper is not needed.
116 lines
3.6 KiB
YAML
116 lines
3.6 KiB
YAML
# gluetun + qBittorrent — all torrent traffic routed through ProtonVPN WireGuard
|
|
# gluetun runs as the VPN container; qBittorrent shares its network namespace (same pod)
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: qbittorrent
|
|
namespace: media
|
|
labels:
|
|
app: qbittorrent
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: qbittorrent
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: qbittorrent
|
|
spec:
|
|
initContainers:
|
|
# Ensure /dev/net/tun exists on the node
|
|
- name: tun-setup
|
|
image: busybox:latest
|
|
command: ["sh", "-c", "mkdir -p /dev/net && [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 && chmod 666 /dev/net/tun && sysctl -w net.ipv6.conf.all.disable_ipv6=1 || true && ip route flush table 51820 2>/dev/null || true && ip rule del priority 101 2>/dev/null || true && ip rule del table 51820 2>/dev/null || true"]
|
|
securityContext:
|
|
privileged: true
|
|
containers:
|
|
# VPN container — must come first so network is up before qBittorrent starts
|
|
- name: gluetun
|
|
image: ghcr.io/qdm12/gluetun:latest
|
|
securityContext:
|
|
capabilities:
|
|
add: ["NET_ADMIN"]
|
|
env:
|
|
# Use custom provider pinned to US-TX#457 — this specific server+key combo is confirmed working
|
|
- name: VPN_SERVICE_PROVIDER
|
|
value: "custom"
|
|
- name: VPN_TYPE
|
|
value: "wireguard"
|
|
- name: WIREGUARD_PRIVATE_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: media-secrets
|
|
key: PROTONVPN_PRIVATE_KEY
|
|
# US-TX#457 server — generated from ProtonVPN portal with NAT-PMP=on
|
|
- name: WIREGUARD_PUBLIC_KEY
|
|
value: "ZLiSI0SkdK5O0/fhweOpZ2c78F30gWHtsfZcVV0vlj8="
|
|
- name: WIREGUARD_ADDRESSES
|
|
value: "10.2.0.2/32"
|
|
- name: WIREGUARD_ENDPOINT_IP
|
|
value: "95.173.217.219"
|
|
- name: WIREGUARD_ENDPOINT_PORT
|
|
value: "51820"
|
|
# Allow cluster-internal traffic to bypass VPN (for Radarr/Sonarr → qBittorrent API)
|
|
- name: FIREWALL_OUTBOUND_SUBNETS
|
|
value: "10.42.0.0/16,10.43.0.0/16"
|
|
ports:
|
|
- containerPort: 8888 # gluetun HTTP proxy (unused but required)
|
|
resources:
|
|
requests:
|
|
memory: 128Mi
|
|
cpu: 50m
|
|
limits:
|
|
memory: 512Mi
|
|
cpu: 200m
|
|
|
|
# qBittorrent — shares gluetun's network namespace, all traffic through VPN
|
|
- name: qbittorrent
|
|
image: lscr.io/linuxserver/qbittorrent:latest
|
|
env:
|
|
- name: PUID
|
|
value: "1000"
|
|
- name: PGID
|
|
value: "1000"
|
|
- name: TZ
|
|
value: "America/Chicago"
|
|
- name: WEBUI_PORT
|
|
value: "8080"
|
|
ports:
|
|
- containerPort: 8080
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /config
|
|
- name: media
|
|
mountPath: /media
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 1Gi
|
|
cpu: 500m
|
|
volumes:
|
|
- name: config
|
|
persistentVolumeClaim:
|
|
claimName: qbittorrent-config
|
|
- name: media
|
|
persistentVolumeClaim:
|
|
claimName: media-data
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: qbittorrent
|
|
namespace: media
|
|
spec:
|
|
selector:
|
|
app: qbittorrent
|
|
ports:
|
|
- name: webui
|
|
port: 8080
|
|
targetPort: 8080
|
|
type: ClusterIP
|