feat(apps): Add qbit

2026-09-26 20:55:42 +05:30
parent 96db9b3511
commit 6452a8efcc
12 changed files with 231 additions and 46 deletions
@@ -0,0 +1,126 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: qbittorrent
+  namespace: qbit
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: qbittorrent
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: qbittorrent
+    spec:
+      containers:
+        - env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: TZ
+              value: Etc/UTC
+            - name: WEBUI_PORT
+              value: "8080"
+            - name: TORRENTING_PORT
+              value: "6881"
+          image: lscr.io/linuxserver/qbittorrent:5.2.3_v2.0.15-ls478
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          name: qbittorrent
+          ports:
+            - containerPort: 8080
+              name: http
+          volumeMounts:
+            - mountPath: /config
+              name: config
+            - mountPath: /downloads
+              name: downloads
+      dnsConfig:
+        nameservers:
+          - 127.0.0.1
+      dnsPolicy: None
+      initContainers:
+        - args:
+            - ip rule del table 51820; ip -6 rule del table 51820; exec /gluetun-entrypoint
+          command:
+            - /bin/sh
+            - -c
+          env:
+            - name: VPN_SERVICE_PROVIDER
+              value: custom
+            - name: VPN_TYPE
+              value: wireguard
+            - name: WIREGUARD_IMPLEMENTATION
+              value: kernelspace
+            - name: WIREGUARD_PRIVATE_KEY
+              valueFrom:
+                secretKeyRef:
+                  key: WIREGUARD_PRIVATE_KEY
+                  name: wireguard
+            - name: WIREGUARD_PUBLIC_KEY
+              valueFrom:
+                secretKeyRef:
+                  key: WIREGUARD_PUBLIC_KEY
+                  name: wireguard
+            - name: WIREGUARD_ADDRESSES
+              valueFrom:
+                secretKeyRef:
+                  key: WIREGUARD_ADDRESSES
+                  name: wireguard
+            - name: WIREGUARD_ENDPOINT_IP
+              valueFrom:
+                secretKeyRef:
+                  key: WIREGUARD_ENDPOINT_IP
+                  name: wireguard
+            - name: WIREGUARD_ENDPOINT_PORT
+              valueFrom:
+                secretKeyRef:
+                  key: WIREGUARD_ENDPOINT_PORT
+                  name: wireguard
+            - name: WIREGUARD_MTU
+              value: "1280"
+            - name: WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL
+              value: 25s
+            - name: FIREWALL_INPUT_PORTS
+              value: "8080"
+            - name: HEALTH_VPN_DURATION_INITIAL
+              value: 30s
+            - name: TZ
+              value: Etc/UTC
+          image: qmcgaw/gluetun:v3.41.3
+          livenessProbe:
+            exec:
+              command:
+                - /gluetun-entrypoint
+                - healthcheck
+            periodSeconds: 30
+            timeoutSeconds: 10
+          name: gluetun
+          restartPolicy: Always
+          securityContext:
+            capabilities:
+              add:
+                - NET_ADMIN
+          startupProbe:
+            exec:
+              command:
+                - /gluetun-entrypoint
+                - healthcheck
+            failureThreshold: 30
+            periodSeconds: 5
+            timeoutSeconds: 5
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: qbit-config-pvc
+        - hostPath:
+            path: /srv/media
+          name: downloads
@@ -0,0 +1,37 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: qbittorrent
+  namespace: qbit
+spec:
+  hostnames:
+    - qbit.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: authentik-server
+          namespace: authentik
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /outpost.goauthentik.io
+    - backendRefs:
+        - name: qbittorrent
+          port: 8080
+      filters:
+        - extensionRef:
+            group: traefik.io
+            kind: Middleware
+            name: authentik
+          type: ExtensionRef
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sealed-secret.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - middleware.yaml
+  - httproute.yaml
@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: authentik
+  namespace: qbit
+spec:
+  forwardAuth:
+    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+    trustForwardHeader: true
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: qbit-config-pvc
+  namespace: qbit
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 500Mi
@@ -0,0 +1,17 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: wireguard
+  namespace: qbit
+spec:
+  encryptedData:
+    WIREGUARD_ADDRESSES: AgCUjKDTHlj+cDz5QmTdFrQ2uzgf2h7nHIB22Hiy8dNQoHPmpl42IS8pWMM3cC7/RQ620XX3Gvnjt7w3N+cRHsxZONCtBaocM/B4lBxgkrqoBuMISQ90oeqeL16ZWd6yDPmzgJLG0JfWPEuGkXsCkMHKg2cTQwZeIhoI0jiiUIKtY0q3YA19cSaf9gX0buQyu84hy6oi7Y2l0EXqwcbHJP2NEAWmxXuHF1nKtcSnAUlsHGCfomHLtSPoyoR0Ug3CER60oE18JIYmbt+iFL4Oalx4nKFoJbkD+dPLx/Do7kylySVqX5DAj1ivIQjyqZmcsyaigP01OU+poSM0D94mhMt8Dfi+ZOzDemoVDKtJlOYNfskk0hLdbLdGk6DzlONl7KBjduzbSk7BnFlr5bRNeKYFiDpg5I1y2FKROpmFCvV2pzqlLFl0C2BTwZU1dAj2Qk+ouUdhzzxEKqS2Q/CUUIftepqKIYzMJncFDbEjt5gAB0DJOt6FWiNG9TV3v+oSdzqn9UFPTIP1SO3IhyVoICDGmo829ki104ZnvjVciuPLH85l5rSdQI6qJuabLXylqTU8tmebTXDJZw/kBD+hw4ycCgD1kQssZM3djjy/RbMhY4zrpN345jelr9Z5kQsINcDBPfyCjCm/Eo6PM/fiuCkNP/KrKHI6C+NkyFHWk14ZeYODJI8GYakRO6SCRZ1G/SWJxA5DfZcuojweGD0G
+    WIREGUARD_ENDPOINT_IP: AgBKPD8cgNPVl7YTUsKkDRioPFCLNg+q+PGYiN5Qvw5nAvhh8tmUiV3JlkdtUHp/ggC8Fn+bLsNPRjjQoa02F8wZv1oxO1XeThNtxX49xlcLiFsw83wtL/pKQcNShml+HClsiCXN569g9NkcCY4R13tcSZPRbVs+oV95sGeUtfx/Ukh4g/URX1Z0aKzI2RE1ENMLQMXkVrrk7GJdqKBBsW76wHcTHw3DgcshMhlgcDwLiX4b+e5nAOzjlcwEKm6EBxXz2NuHP9PTkzfvK9QSSZJ7GLlac7eqFWj+xir8k1s1bIzB/suNMIzpo0bvOUjpxmoI54Xd4/hZ6fXkEF7lD1DwK7G/RV9+XNePPX+lGSJ9gQMIadmK3P6jHNnl/+RtqUk3mQ35r3Tl1Tmz3mhhK3/YalL6/8zWesNVYt6D4yQkFi3GFnc02Htl7/CyU+r5a3TwE3xUl/VNtkhHklrL8obF/cCORbFlYcwT2tbYl1av/3slJ8UsG+DXEX62+o6Tpt70Mzhcj61mQ2H/Emb5d7FPYlohogM1e37YY6lJhbjZeNHxxKvki8kusPa/eY8ZAdJcpd41/0rrL3uSOOZqqELNuTzqQKRhb6CDUGaoYFqSw9umDqwjdvfFQcYLQepn84HFILAlUfNF/InO6WrNh8jWGKx9SNsDfrJpY/RRyEJK8EoNIuelLdNP3phZhxUcQn/UBZ/M/UOzJZZ2xJPl
+    WIREGUARD_ENDPOINT_PORT: AgCOTc0MMWugdnF6Ou8mGgBGu5VD7zP6O3hGr+4YzW/UvCEARqwuoRXTKggUpFcZC0mNf1CdGCB1iRGCVWjnFJsw6zSudcJiWEVOtqLMfxxwZHhApiMtaHq4ERP4Hhu3jn/QwdwbYgk7rUoqsCRU2JelgPoYIhJh/2BtOz0z8PO+ktMIi5Qaj7m6O0zkxbzvqZaEbgkYsFCtQlaWqvghNk7GZB12KOOr0kU+Uu4vyi2ak7quoMjaQkMrRHOhhw0hk++FCXN9SNpDGyGBcqPtl/8ZRUyomLi76O3nsHX8QtXXj3yzDEwrdfwNzCwJXqI6HI4X2+/xSvnxI09wf5ei6D8gyJX8gkPQiqsXA4dsYvTUstf26Qlh/L6iQjB8RkXixBR1YwrIu/lLNO0FpFPqtLJu5jf1jMjZIn+oPl3GxAXcM+kRsX9YS5oJdD3rFFTz8HGthfOTSpaEgSnN2rF440vfIH8DKvTDH4cyR78C2Z8TWQ2hbDxXOX/NwxvPfidttyC3euLBc4Nkb/VX/DEU9W3QCB9yKuXw2KKSqnWHvIAReYLn5ex9czU+B+8IP2fJzTMDH7gOYqwtxuRMPu5bto0dn/120ZaLDBzGUHL38pBnMsYhssOGQlerpG32nT66IYdaZXTMD2UHsTwnNqu4/J98IY47n60wg3SVOVyZQ/dmS7Dfp8lPr/kE3+xNM8HWayCEKYxW
+    WIREGUARD_PRIVATE_KEY: AgAwJo1zxNRWXAinDWXvLajPWwHeWwAD8zOopE8Z8M5xAUDKWkTwZecR/ODI37bYQ22bb1+qjErBsqUHyT79adOmypY9DLW6YdY2YPkQwef33iXdgC1T7nV4pjI2TahiVab0z+5ot18A/FM9S7VHmRX4L+3ccO/oqcInNz5PFbsXp6U0dZZtiKWg7N5IzdT9dwDCknNFTv10URlHKE0Awff8jA34XGC8Ra/SvF3gSiaYjwd74HEBpnBMM5CsiveOyU1vCNxg93S12yrauC5jmD/ex5oEnJ4J1SziTUlB6e6ALpluA3AD91wuZ+wXeaJ0huNSz4g4sL6jm3OQykyiRx7jx/8FL3no0u3ydGPgYZ5MaEYXBtTk6ODFEhUZ7EGs9w8vip1SY/FijZYC3QT78R5WMim8gi1wf+TwmA8YRIDZW0CMhbtI32Ef2oDmb1Jzl58Igba8zQGTIqT7Htj6f4mpJk8gKSRIzkvLK6o+cynOpQzZBOZb+G7lZst4g+lILLjmfpFGJTVgogfEkuYV6ntuE3dGB2OmRGUW0vpDM4ZCkxYsjh/1kzSyOGVYtL0EHS689ehzUDUJLuJuvuwZIFUjOFCFofGP37rKCcSGouLNj+xWmcbCgx7si05rw8JMeAWE5YETaBbi55DDaUB98G97KM28OlPBDm8PtqdcBD4W2up34nowXdG0tZ38VsTV7xNyp+2A5saPQZ72wM1fQiUwGwoHRKdHB1ptF6u+0zr6tlQoiVE07BMQ8/ykAQ==
+    WIREGUARD_PUBLIC_KEY: AgBAElHBgsQNQ3l8CGLlKMmi9dMTLmgp4gseMgbEMW4sjOvhsAIeLGsuv+HuStvH+bfAp7U9Fh6pAlEZKPOdN5pbpoFjkTDC5VU8aKJcdO/+iZWURbULYBDyGK32Ss/0eCwIsdO7lFcSFy2T7XJFPn656lBx8gocBp9PMHRSoL2dELP9q8JyNr3nb84vZ8hwiBP3Gy8BITeeE4J7+DnF2SUg+4pc92gMOgmWL4LO25pI39Q1yKBw4tCOf4f4ETgmjRHv17WsFw2JZTgb1rmXFvvKWGzTPZbA1gajcRgTKY7DrzWFjFi/o84qjGC4feQ9vb5ZwnLN1MzU1yByQmxQiAOSCK+1SMrvUJ9dF2kE3zJw0fSGjU83iXcorpbe4YYFr4Y8k6mKSSthchYyQZp5FuB9N9J7vm4vv4kUbTGOtwHQFrKRNiB5PVVFqzUVYWs9CfFcodAu7JaCBHKzLj1X7xBLiQoWYpx7/LVTjoR/R9j/+bfblKlid+H322Oh4ReSuxVKfMmNiOGeueMOrGX+DhHtYFbGHmdc3aprjBkYanq71MV9kFRVAZd834IX4wWykQWWgmYtx+eZJs6DZRWhAaVbBQ9IY0vS4IjAInTpMN9yqNxJkZ+w1MJIeTG5S9NnB3xUjnOgSCow9r/IEVNFbT4CbsEXbMECQ3S0OIby8r3Zwt8J7NEphFYkLtsR+brtMLsWRHIw23mtSTZajLMaSHOG6fooZyNKYgYJGr0Spura2M6TjhW+f1csYKrkxA==
+    wgcf-account.toml: AgAaSo7eZz/CvAN1reUDhHzFWIcmQMopYloYitAYq5Zu6gXE+65ogq0Jr/S7WLTqdgL3KWWhSmlG+jpepC8cpomVrnPfydlw6or227dm0ND5XNEO1MwNOtzeGNS3q7ayB8NoC7qZVR33KqutGOZLbFawyTZUi4ItjW74SdvL/Ftd4VvqrG7hQtAd/2PP37mL0unw2DesL8hFUXTkvlzAdKHZGQMaYNcH73JWJwvlf95L6ncKdZXWEM0uJnjhAVE+sCpUEQK67mQcX4RrYairr1wwux2YYjwweAriXw7wzBDvOXnHqg3Ldmat0V7FMK0MeIzHhezy15AGLtYRonFcYzEznIl7P2FjjG4Yz0EAk0t1rJpQgV35NAybseQ8t/92+vPa7LaPcjUUKZ5Kx1a2SdihljtLEjzuIdvYN/tKPcselzehWWrbDl/qeQuwZABxj8z24moJmBqJcXpAigvX4XlDcWp0jHWQxbLDozKtYHKUEPmhAklVaDuVr+bY2jOxU4Nki3ybLYpi834CsifcSc7RAaruJIlnITZUR2VG7PMIoTObqfeYnSyZKabHadWHHdkoyYsJmSiWjadvlvBXtW+RTHVU8UsD8GdVS9wBpA6ZcRsegFiEAoMzdyZQNRabYjUeAxpA/lOtt/PH1FnIV588Of/lhypBdUF4rRYcCvVT0gFQjoe7ITsvEf/P+fLb3TO47fQtBqOmKqoD21yhtb8Y4GQ21XVmB1gJT+/oYjny9/YL5CuhJif0XoarJZHtvTb5Ubs716PRSmSvAoXI6jBMKVSssWtfMIedL03X+RAxyT3jvL/W/SEuN5D5a2RpjIswAIN5LQ3b9f7F/JgDIQKdIHUEm+Z430lS83RDsMpJ13SmRVoXzbAededT7r08DHu++sOvDfHeMy+lTD0aTaskbPWY5PLve7g7PWat9q+NMepgRC3z26JCw/08O4SGX/fUhxg709F5A8hf/LUSTNGRlQ==
+  template:
+    metadata:
+      name: wireguard
+      namespace: qbit
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: qbittorrent
+  namespace: qbit
+spec:
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: qbittorrent