From 4dc41f994a3d353e8cc68c6e520a774fa3bc9514 Mon Sep 17 00:00:00 2001 From: pgijsbertsen <117165507+pgijsbertsen@users.noreply.github.com> Date: Sat, 16 May 2026 15:42:23 +0200 Subject: [PATCH] refactor: Move slskd to own namespace --- k8s-peterg/argocd/applications-wheatley.yaml | 19 +++ k8s-wheatley/qbittorrent/configmap.yaml | 18 +-- k8s-wheatley/qbittorrent/deployments.yaml | 30 ----- k8s-wheatley/qbittorrent/ingress.yaml | 30 ----- k8s-wheatley/qbittorrent/kustomization.yaml | 2 - k8s-wheatley/qbittorrent/pvc.yaml | 12 -- k8s-wheatley/qbittorrent/secrets.yaml | 33 ----- k8s-wheatley/soulseekd/configmap.yaml | 29 +++++ k8s-wheatley/soulseekd/deployments.yaml | 126 +++++++++++++++++++ k8s-wheatley/soulseekd/ingress.yaml | 28 +++++ k8s-wheatley/soulseekd/kustomization.yaml | 52 ++++++++ k8s-wheatley/soulseekd/namespace.yaml | 7 ++ k8s-wheatley/soulseekd/pvc.yaml | 12 ++ k8s-wheatley/soulseekd/secrets.yaml | 69 ++++++++++ 14 files changed, 343 insertions(+), 124 deletions(-) create mode 100644 k8s-wheatley/soulseekd/configmap.yaml create mode 100644 k8s-wheatley/soulseekd/deployments.yaml create mode 100644 k8s-wheatley/soulseekd/ingress.yaml create mode 100644 k8s-wheatley/soulseekd/kustomization.yaml create mode 100644 k8s-wheatley/soulseekd/namespace.yaml create mode 100644 k8s-wheatley/soulseekd/pvc.yaml create mode 100644 k8s-wheatley/soulseekd/secrets.yaml diff --git a/k8s-peterg/argocd/applications-wheatley.yaml b/k8s-peterg/argocd/applications-wheatley.yaml index f0d4229..cd06c12 100644 --- a/k8s-peterg/argocd/applications-wheatley.yaml +++ b/k8s-peterg/argocd/applications-wheatley.yaml @@ -200,6 +200,25 @@ spec: --- apiVersion: argoproj.io/v1alpha1 kind: Application +metadata: + name: soulseekd + namespace: argocd +spec: + project: default + source: + repoURL: https://code.peterg.nl/wheatley/kubernetes.git + path: k8s-wheatley/soulseekd + targetRevision: HEAD + destination: + server: https://10.13.37.10:6443 + namespace: soulseekd + syncPolicy: + automated: + prune: true + selfHeal: true +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application metadata: name: plex namespace: argocd diff --git a/k8s-wheatley/qbittorrent/configmap.yaml b/k8s-wheatley/qbittorrent/configmap.yaml index beb69f9..61c614d 100644 --- a/k8s-wheatley/qbittorrent/configmap.yaml +++ b/k8s-wheatley/qbittorrent/configmap.yaml @@ -12,7 +12,7 @@ data: VPN_PORT_FORWARDING_UP_COMMAND: "/scripts/port-up.sh" VPN_PORT_FORWARDING_DOWN_COMMAND: "/scripts/port-down.sh" FIREWALL_OUTBOUND_SUBNETS: 10.244.0.0/16,10.96.0.0/12 - FIREWALL_INPUT_PORTS: "8112,5030" + FIREWALL_INPUT_PORTS: "8112" --- apiVersion: v1 kind: ConfigMap @@ -43,22 +43,6 @@ data: --- apiVersion: v1 kind: ConfigMap -metadata: - name: slskd-envs -data: - TZ: Europe/Amsterdam - PUID: "1000" - PGID: "1000" - SLSKD_DOWNLOADS_DIR: /shared/media/downloads/_slsk-downloads - SLSKD_INCOMPLETE_DIR: /shared/media/downloads/_slsk-incomplete - SLSKD_SHARED_DIR: "[Music]/shared/media/downloads/_slsk-downloads" - SLSKD_REMOTE_CONFIGURATION: "true" - SLSKD_VPN: "true" - SLSKD_VPN_PORT_FORWARDING: "true" - SLSKD_VPN_GLUETUN_URL: http://localhost:8000 ---- -apiVersion: v1 -kind: ConfigMap metadata: name: unpackerr-envs data: diff --git a/k8s-wheatley/qbittorrent/deployments.yaml b/k8s-wheatley/qbittorrent/deployments.yaml index 4eb27c3..dd506bc 100644 --- a/k8s-wheatley/qbittorrent/deployments.yaml +++ b/k8s-wheatley/qbittorrent/deployments.yaml @@ -24,9 +24,6 @@ spec: - name: qbit-http containerPort: 8112 protocol: TCP - - name: slskd-http - containerPort: 5030 - protocol: TCP envFrom: - configMapRef: name: gluetun-envs @@ -124,30 +121,6 @@ spec: capabilities: drop: - "ALL" - - name: slskd - image: docker.io/slskd/slskd - imagePullPolicy: IfNotPresent - envFrom: - - configMapRef: - name: slskd-envs - - secretRef: - name: slskd-env-secrets - volumeMounts: - - mountPath: /config - name: slskd-config - - mountPath: /shared/media/downloads - name: nfs-media-downloads - securityContext: - seccompProfile: - type: RuntimeDefault - allowPrivilegeEscalation: false - capabilities: - drop: - - "ALL" - add: - - "CHOWN" - - "SETUID" - - "SETGID" volumes: - name: dev-tun hostPath: @@ -156,9 +129,6 @@ spec: - name: qbittorrent-config persistentVolumeClaim: claimName: qbittorrent-storage - - name: slskd-config - persistentVolumeClaim: - claimName: slskd-storage - name: gluetun-wgconfig secret: secretName: gluetun-wgconfig diff --git a/k8s-wheatley/qbittorrent/ingress.yaml b/k8s-wheatley/qbittorrent/ingress.yaml index e599673..38ddcdf 100644 --- a/k8s-wheatley/qbittorrent/ingress.yaml +++ b/k8s-wheatley/qbittorrent/ingress.yaml @@ -15,23 +15,6 @@ spec: - name: qbittorrent port: 80 ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: slskd-route -spec: - parentRefs: - - name: internal - namespace: kube-system - sectionName: https - hostnames: - - "slskd.wheatley.in" - rules: - - backendRefs: - - name: slskd - port: 80 - --- apiVersion: v1 kind: Service @@ -44,16 +27,3 @@ spec: - port: 80 protocol: TCP targetPort: 8112 - ---- -apiVersion: v1 -kind: Service -metadata: - name: slskd -spec: - selector: - app: qbittorrent - ports: - - port: 80 - protocol: TCP - targetPort: 5030 diff --git a/k8s-wheatley/qbittorrent/kustomization.yaml b/k8s-wheatley/qbittorrent/kustomization.yaml index 772ec7b..c0a83b0 100644 --- a/k8s-wheatley/qbittorrent/kustomization.yaml +++ b/k8s-wheatley/qbittorrent/kustomization.yaml @@ -35,5 +35,3 @@ images: newTag: v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab - name: docker.io/qbittorrentofficial/qbittorrent-nox newTag: 5.1.4-2@sha256:85fe2690f418dabffc4907276b3cdffcb7880c7114157b32f932d3b97bac45af - - name: docker.io/slskd/slskd - newTag: 0.25.1 diff --git a/k8s-wheatley/qbittorrent/pvc.yaml b/k8s-wheatley/qbittorrent/pvc.yaml index 4500768..c352b02 100644 --- a/k8s-wheatley/qbittorrent/pvc.yaml +++ b/k8s-wheatley/qbittorrent/pvc.yaml @@ -10,15 +10,3 @@ spec: resources: requests: storage: 5Gi ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: slskd-storage -spec: - storageClassName: piraeus-lvmthin - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi diff --git a/k8s-wheatley/qbittorrent/secrets.yaml b/k8s-wheatley/qbittorrent/secrets.yaml index 64e133e..7eebf6b 100644 --- a/k8s-wheatley/qbittorrent/secrets.yaml +++ b/k8s-wheatley/qbittorrent/secrets.yaml @@ -18,39 +18,6 @@ spec: key: secrets/managed/qbittorrent/protonvpn-wgconfig property: config ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: slskd-env-secrets -spec: - secretStoreRef: - name: vault-wheatley - kind: ClusterSecretStore - target: - name: slskd-env-secrets - data: - - secretKey: SLSKD_VPN_GLUETUN_API_KEY - remoteRef: - key: secrets/managed/qbittorrent/slskd-env-secrets - property: GLUETUN_API_KEY - - secretKey: SLSKD_SLSK_USERNAME - remoteRef: - key: secrets/managed/qbittorrent/slskd-env-secrets - property: SLSK_USERNAME - - secretKey: SLSKD_SLSK_PASSWORD - remoteRef: - key: secrets/managed/qbittorrent/slskd-env-secrets - property: SLSK_PASSWORD - - secretKey: SLSKD_PASSWORD - remoteRef: - key: secrets/managed/qbittorrent/slskd-env-secrets - property: SLSKD_PASSWORD - - secretKey: SLSKD_API_KEY - remoteRef: - key: secrets/managed/qbittorrent/slskd-env-secrets - property: API_KEY - --- apiVersion: external-secrets.io/v1 kind: ExternalSecret diff --git a/k8s-wheatley/soulseekd/configmap.yaml b/k8s-wheatley/soulseekd/configmap.yaml new file mode 100644 index 0000000..f27e944 --- /dev/null +++ b/k8s-wheatley/soulseekd/configmap.yaml @@ -0,0 +1,29 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: gluetun-envs +data: + TZ: Europe/Amsterdam + VPN_SERVICE_PROVIDER: "custom" + VPN_TYPE: "wireguard" + VPN_PORT_FORWARDING: on + VPN_PORT_FORWARDING_PROVIDER: protonvpn + FIREWALL_OUTBOUND_SUBNETS: 10.244.0.0/16,10.96.0.0/12 + FIREWALL_INPUT_PORTS: "5030" +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: slskd-envs +data: + TZ: Europe/Amsterdam + PUID: "1000" + PGID: "1000" + SLSKD_DOWNLOADS_DIR: /shared/media/downloads/_slsk-downloads + SLSKD_INCOMPLETE_DIR: /shared/media/downloads/_slsk-incomplete + SLSKD_SHARED_DIR: "[Music]/shared/media/music" + SLSKD_REMOTE_CONFIGURATION: "true" + SLSKD_VPN: "true" + SLSKD_VPN_PORT_FORWARDING: "true" + SLSKD_VPN_GLUETUN_URL: http://localhost:8000 diff --git a/k8s-wheatley/soulseekd/deployments.yaml b/k8s-wheatley/soulseekd/deployments.yaml new file mode 100644 index 0000000..481bf38 --- /dev/null +++ b/k8s-wheatley/soulseekd/deployments.yaml @@ -0,0 +1,126 @@ +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: soulseekd + namespace: soulseekd + labels: + app: soulseekd +spec: + replicas: 1 + serviceName: soulseekd + selector: + matchLabels: + app: soulseekd + template: + metadata: + labels: + app: soulseekd + spec: + initContainers: + - name: gluetun + image: ghcr.io/qdm12/gluetun + ports: + - name: slskd-http + containerPort: 5030 + protocol: TCP + envFrom: + - configMapRef: + name: gluetun-envs + - secretRef: + name: gluetun-env-secrets + volumeMounts: + - mountPath: /dev/net/tun + name: dev-tun + - mountPath: /gluetun/wireguard + name: gluetun-wgconfig + readOnly: true + - name: gluetun-tmp + mountPath: /tmp/gluetun + restartPolicy: Always + lifecycle: + postStart: + exec: + command: + [ + "/bin/sh", + "-c", + "(ip rule del table 51820; ip -6 rule del table 51820) || true", + ] + readinessProbe: + exec: + command: + - sh + - -c + - "ping -c 1 9.9.9.9" + initialDelaySeconds: 5 + periodSeconds: 3 + timeoutSeconds: 2 + failureThreshold: 3 + livenessProbe: + exec: + command: + - sh + - -c + - "ping -c 1 9.9.9.9" + initialDelaySeconds: 10 + periodSeconds: 15 + timeoutSeconds: 2 + failureThreshold: 3 + securityContext: + seccompProfile: + type: RuntimeDefault + allowPrivilegeEscalation: true + capabilities: + drop: + - "ALL" + add: + - "CHOWN" + - "NET_ADMIN" + - "NET_RAW" + containers: + - name: slskd + image: docker.io/slskd/slskd + imagePullPolicy: IfNotPresent + envFrom: + - configMapRef: + name: slskd-envs + - secretRef: + name: slskd-env-secrets + volumeMounts: + - mountPath: /config + name: slskd-config + - mountPath: /shared/media/downloads + name: nfs-media-downloads + - mountPath: /shared/media/music + name: nfs-media-music + securityContext: + seccompProfile: + type: RuntimeDefault + allowPrivilegeEscalation: false + capabilities: + drop: + - "ALL" + add: + - "CHOWN" + - "SETUID" + - "SETGID" + volumes: + - name: dev-tun + hostPath: + path: /dev/net/tun + type: CharDevice + - name: slskd-config + persistentVolumeClaim: + claimName: slskd-storage + - name: gluetun-wgconfig + secret: + secretName: gluetun-wgconfig + - name: gluetun-tmp + emptyDir: {} + - name: nfs-media-downloads + persistentVolumeClaim: + claimName: nfs-media-downloads + - name: nfs-media-music + persistentVolumeClaim: + claimName: nfs-media-music diff --git a/k8s-wheatley/soulseekd/ingress.yaml b/k8s-wheatley/soulseekd/ingress.yaml new file mode 100644 index 0000000..9ddba90 --- /dev/null +++ b/k8s-wheatley/soulseekd/ingress.yaml @@ -0,0 +1,28 @@ +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: slskd-route +spec: + parentRefs: + - name: internal + namespace: kube-system + sectionName: https + hostnames: + - "slskd.wheatley.in" + rules: + - backendRefs: + - name: slskd + port: 80 +--- +apiVersion: v1 +kind: Service +metadata: + name: slskd +spec: + selector: + app: soulseekd + ports: + - port: 80 + protocol: TCP + targetPort: 5030 diff --git a/k8s-wheatley/soulseekd/kustomization.yaml b/k8s-wheatley/soulseekd/kustomization.yaml new file mode 100644 index 0000000..e98c772 --- /dev/null +++ b/k8s-wheatley/soulseekd/kustomization.yaml @@ -0,0 +1,52 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: soulseekd + +resources: + - configmap.yaml + - deployments.yaml + - ingress.yaml + - pvc.yaml + - secrets.yaml + - namespace.yaml + +components: + - ../../kustomize-bases/nfs-media/components/downloads + - ../../kustomize-bases/nfs-media/components/music + +patches: + - target: + kind: PersistentVolume + name: nfs-media-downloads + patch: | + - op: replace + path: /metadata/name + value: nfs-media-soulseekd-downloads + - target: + kind: PersistentVolumeClaim + name: nfs-media-downloads + patch: | + - op: replace + path: /spec/volumeName + value: nfs-media-soulseekd-downloads + - target: + kind: PersistentVolume + name: nfs-media-music + patch: | + - op: replace + path: /metadata/name + value: nfs-media-soulseekd-music + - target: + kind: PersistentVolumeClaim + name: nfs-media-music + patch: | + - op: replace + path: /spec/volumeName + value: nfs-media-soulseekd-music + +images: + - name: ghcr.io/qdm12/gluetun + newTag: v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab + - name: docker.io/slskd/slskd + newTag: 0.25.1 diff --git a/k8s-wheatley/soulseekd/namespace.yaml b/k8s-wheatley/soulseekd/namespace.yaml new file mode 100644 index 0000000..8e7a9f5 --- /dev/null +++ b/k8s-wheatley/soulseekd/namespace.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: soulseekd + labels: + pod-security.kubernetes.io/enforce: privileged diff --git a/k8s-wheatley/soulseekd/pvc.yaml b/k8s-wheatley/soulseekd/pvc.yaml new file mode 100644 index 0000000..214582c --- /dev/null +++ b/k8s-wheatley/soulseekd/pvc.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: slskd-storage +spec: + storageClassName: piraeus-lvmthin + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi diff --git a/k8s-wheatley/soulseekd/secrets.yaml b/k8s-wheatley/soulseekd/secrets.yaml new file mode 100644 index 0000000..41f76d1 --- /dev/null +++ b/k8s-wheatley/soulseekd/secrets.yaml @@ -0,0 +1,69 @@ +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: gluetun-wgconfig +spec: + secretStoreRef: + name: vault-wheatley + kind: ClusterSecretStore + target: + name: gluetun-wgconfig + template: + data: + wg0.conf: "{{ .config }}" + data: + - secretKey: config + remoteRef: + key: secrets/managed/soulseekd/protonvpn-wgconfig + property: config + +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: slskd-env-secrets +spec: + secretStoreRef: + name: vault-wheatley + kind: ClusterSecretStore + target: + name: slskd-env-secrets + data: + - secretKey: SLSKD_VPN_GLUETUN_API_KEY + remoteRef: + key: secrets/managed/soulseekd/slskd-env-secrets + property: GLUETUN_API_KEY + - secretKey: SLSKD_SLSK_USERNAME + remoteRef: + key: secrets/managed/soulseekd/slskd-env-secrets + property: SLSK_USERNAME + - secretKey: SLSKD_SLSK_PASSWORD + remoteRef: + key: secrets/managed/soulseekd/slskd-env-secrets + property: SLSK_PASSWORD + - secretKey: SLSKD_PASSWORD + remoteRef: + key: secrets/managed/soulseekd/slskd-env-secrets + property: SLSKD_PASSWORD + - secretKey: SLSKD_API_KEY + remoteRef: + key: secrets/managed/soulseekd/slskd-env-secrets + property: API_KEY + +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: gluetun-env-secrets +spec: + secretStoreRef: + name: vault-wheatley + kind: ClusterSecretStore + target: + name: gluetun-env-secrets + data: + - secretKey: HTTP_CONTROL_SERVER_AUTH_DEFAULT_ROLE + remoteRef: + key: secrets/managed/soulseekd/gluetun-env-secrets + property: HTTP_CONTROL_SERVER_AUTH_DEFAULT_ROLE