From cadd4fe9a57cd8ba2cb09e121952e2a741e2e66e Mon Sep 17 00:00:00 2001
From: pgijsbertsen <117165507+pgijsbertsen@users.noreply.github.com>
Date: Sat, 9 May 2026 21:05:33 +0200
Subject: [PATCH 01/12] feat: Enable webui

---
 k8s-wheatley/qbittorrent/configmap.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/k8s-wheatley/qbittorrent/configmap.yaml b/k8s-wheatley/qbittorrent/configmap.yaml
index 68e2270..5927f1f 100644
--- a/k8s-wheatley/qbittorrent/configmap.yaml
+++ b/k8s-wheatley/qbittorrent/configmap.yaml
@@ -49,7 +49,6 @@ data:
   TZ: Europe/Amsterdam
   PUID: "1000"
   PGID: "1000"
-  SLSKD_HEADLESS: "true"
   SLSKD_REMOTE_CONFIGURATION: "true"
   SLSKD_VPN: "true"
   SLSKD_VPN_PORT_FORWARDING: "true"

From 7682efd256de9eb857e98bbd9d77617e07644b7e Mon Sep 17 00:00:00 2001
From: pgijsbertsen <117165507+pgijsbertsen@users.noreply.github.com>
Date: Sat, 9 May 2026 21:09:18 +0200
Subject: [PATCH 02/12] feat: Enable inputport

---
 k8s-wheatley/qbittorrent/configmap.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/k8s-wheatley/qbittorrent/configmap.yaml b/k8s-wheatley/qbittorrent/configmap.yaml
index 5927f1f..19f6ab7 100644
--- a/k8s-wheatley/qbittorrent/configmap.yaml
+++ b/k8s-wheatley/qbittorrent/configmap.yaml
@@ -12,7 +12,7 @@ data:
   VPN_PORT_FORWARDING_UP_COMMAND: "/scripts/port-up.sh"
   VPN_PORT_FORWARDING_DOWN_COMMAND: "/scripts/port-down.sh"
   FIREWALL_OUTBOUND_SUBNETS: 10.244.0.0/16,10.96.0.0/12
-  FIREWALL_INPUT_PORTS: "8112"
+  FIREWALL_INPUT_PORTS: "8112,5030"
 ---
 apiVersion: v1
 kind: ConfigMap

From b1d4b32fdb05662272eab6534fbc3e03fcb72734 Mon Sep 17 00:00:00 2001
From: pgijsbertsen <117165507+pgijsbertsen@users.noreply.github.com>
Date: Sat, 9 May 2026 21:12:40 +0200
Subject: [PATCH 03/12] feat: include secrets

---
 k8s-wheatley/qbittorrent/deployments.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/k8s-wheatley/qbittorrent/deployments.yaml b/k8s-wheatley/qbittorrent/deployments.yaml
index df3b2e7..b6d35cd 100644
--- a/k8s-wheatley/qbittorrent/deployments.yaml
+++ b/k8s-wheatley/qbittorrent/deployments.yaml
@@ -130,6 +130,8 @@ spec:
           envFrom:
             - configMapRef:
                 name: slskd-envs
+            - secretRef:
+                name: slskd-env-secrets
           volumeMounts:
             - mountPath: /config
               name: slskd-config

From a14da8e3b1302d80b17e3f8adfa0823ad937bdbf Mon Sep 17 00:00:00 2001
From: pgijsbertsen <117165507+pgijsbertsen@users.noreply.github.com>
Date: Sat, 9 May 2026 21:32:38 +0200
Subject: [PATCH 04/12] feat: Authenticate to soulseek

---
 k8s-wheatley/qbittorrent/secrets.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/k8s-wheatley/qbittorrent/secrets.yaml b/k8s-wheatley/qbittorrent/secrets.yaml
index 96318e9..15021e4 100644
--- a/k8s-wheatley/qbittorrent/secrets.yaml
+++ b/k8s-wheatley/qbittorrent/secrets.yaml
@@ -34,6 +34,14 @@ spec:
       remoteRef:
         key: secrets/managed/qbittorrent/slskd-env-secrets
         property: GLUETUN_API_KEY
+    - secretKey: SLSKD_SLSK_USERNAME
+      remoteRef:
+        key: secrets/managed/qbittorrent/slskd-env-secrets
+        property: SLSK_USERNAME
+    - secretKey: SLSKD_SLSK_PASSWORD
+      remoteRef:
+        key: secrets/managed/qbittorrent/slskd-env-secrets
+        property: SLSK_PASSWORD
 
 ---
 apiVersion: external-secrets.io/v1

From 5b910059ea4acfabe247ecd266b067a3b60ccf74 Mon Sep 17 00:00:00 2001
From: pgijsbertsen <117165507+pgijsbertsen@users.noreply.github.com>
Date: Sat, 9 May 2026 22:05:37 +0200
Subject: [PATCH 05/12] feat: Set correct download dir

---
 k8s-wheatley/qbittorrent/configmap.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/k8s-wheatley/qbittorrent/configmap.yaml b/k8s-wheatley/qbittorrent/configmap.yaml
index 19f6ab7..f140679 100644
--- a/k8s-wheatley/qbittorrent/configmap.yaml
+++ b/k8s-wheatley/qbittorrent/configmap.yaml
@@ -49,6 +49,8 @@ data:
   TZ: Europe/Amsterdam
   PUID: "1000"
   PGID: "1000"
+  SLSKD_DOWNLOADS_DIR: /shared/media/downloads/_slsk-downloads
+  SLSKD_INCOMPLETE_DIR: /shared/media/downloads/_slsk-incomplete
   SLSKD_REMOTE_CONFIGURATION: "true"
   SLSKD_VPN: "true"
   SLSKD_VPN_PORT_FORWARDING: "true"

From 3ac9c8071c633c7074128a6a00a7f53c46336516 Mon Sep 17 00:00:00 2001
From: pgijsbertsen <117165507+pgijsbertsen@users.noreply.github.com>
Date: Sun, 10 May 2026 12:59:42 +0200
Subject: [PATCH 06/12] feat: share downloads dir

---
 k8s-wheatley/qbittorrent/configmap.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/k8s-wheatley/qbittorrent/configmap.yaml b/k8s-wheatley/qbittorrent/configmap.yaml
index f140679..beb69f9 100644
--- a/k8s-wheatley/qbittorrent/configmap.yaml
+++ b/k8s-wheatley/qbittorrent/configmap.yaml
@@ -51,6 +51,7 @@ data:
   PGID: "1000"
   SLSKD_DOWNLOADS_DIR: /shared/media/downloads/_slsk-downloads
   SLSKD_INCOMPLETE_DIR: /shared/media/downloads/_slsk-incomplete
+  SLSKD_SHARED_DIR: "[Music]/shared/media/downloads/_slsk-downloads"
   SLSKD_REMOTE_CONFIGURATION: "true"
   SLSKD_VPN: "true"
   SLSKD_VPN_PORT_FORWARDING: "true"

From bae217dc3402c25c29d28b8ad7eec1c73f00ebde Mon Sep 17 00:00:00 2001
From: pgijsbertsen <117165507+pgijsbertsen@users.noreply.github.com>
Date: Thu, 14 May 2026 15:50:02 +0200
Subject: [PATCH 07/12] refactor(nfs-media): Refactor into subdirectory PVCs

---
 k8s-wheatley/lidarr/deployments.yaml          | 13 +++--
 k8s-wheatley/lidarr/kustomization.yaml        | 27 ++++++++--
 k8s-wheatley/plex/deployments.yaml            | 18 +++++--
 k8s-wheatley/plex/kustomization.yaml          | 54 +++++++++++++++++--
 k8s-wheatley/qbittorrent/deployments.yaml     | 10 ++--
 k8s-wheatley/qbittorrent/kustomization.yaml   | 15 +++---
 k8s-wheatley/radarr/deployments.yaml          | 13 +++--
 k8s-wheatley/radarr/kustomization.yaml        | 27 ++++++++--
 k8s-wheatley/sonarr/deployments.yaml          | 18 +++++--
 k8s-wheatley/sonarr/kustomization.yaml        | 42 +++++++++++++--
 .../components/anime/kustomization.yaml       |  5 ++
 .../nfs-media/components/anime/pvc.yaml       | 33 ++++++++++++
 .../components/downloads/kustomization.yaml   |  5 ++
 .../nfs-media/components/downloads/pvc.yaml   | 33 ++++++++++++
 .../components/movies/kustomization.yaml      |  5 ++
 .../nfs-media/components/movies/pvc.yaml      | 33 ++++++++++++
 .../components/music/kustomization.yaml       |  5 ++
 .../nfs-media/components/music/pvc.yaml       | 33 ++++++++++++
 .../components/roms/kustomization.yaml        |  5 ++
 .../nfs-media/components/roms/pvc.yaml        | 33 ++++++++++++
 .../components/series/kustomization.yaml      |  5 ++
 .../nfs-media/components/series/pvc.yaml      | 33 ++++++++++++
 kustomize-bases/nfs-media/kustomization.yaml  |  6 ---
 kustomize-bases/nfs-media/pvc.yaml            | 40 --------------
 24 files changed, 416 insertions(+), 95 deletions(-)
 create mode 100644 kustomize-bases/nfs-media/components/anime/kustomization.yaml
 create mode 100644 kustomize-bases/nfs-media/components/anime/pvc.yaml
 create mode 100644 kustomize-bases/nfs-media/components/downloads/kustomization.yaml
 create mode 100644 kustomize-bases/nfs-media/components/downloads/pvc.yaml
 create mode 100644 kustomize-bases/nfs-media/components/movies/kustomization.yaml
 create mode 100644 kustomize-bases/nfs-media/components/movies/pvc.yaml
 create mode 100644 kustomize-bases/nfs-media/components/music/kustomization.yaml
 create mode 100644 kustomize-bases/nfs-media/components/music/pvc.yaml
 create mode 100644 kustomize-bases/nfs-media/components/roms/kustomization.yaml
 create mode 100644 kustomize-bases/nfs-media/components/roms/pvc.yaml
 create mode 100644 kustomize-bases/nfs-media/components/series/kustomization.yaml
 create mode 100644 kustomize-bases/nfs-media/components/series/pvc.yaml
 delete mode 100644 kustomize-bases/nfs-media/kustomization.yaml
 delete mode 100644 kustomize-bases/nfs-media/pvc.yaml

diff --git a/k8s-wheatley/lidarr/deployments.yaml b/k8s-wheatley/lidarr/deployments.yaml
index de9c4c5..f81dda7 100644
--- a/k8s-wheatley/lidarr/deployments.yaml
+++ b/k8s-wheatley/lidarr/deployments.yaml
@@ -28,8 +28,10 @@ spec:
           volumeMounts:
             - mountPath: /config
               name: lidarr-config
-            - mountPath: /shared/media
-              name: nfs-media
+            - mountPath: /shared/media/music
+              name: nfs-media-music
+            - mountPath: /shared/media/downloads
+              name: nfs-media-downloads
           securityContext:
             seccompProfile:
               type: RuntimeDefault
@@ -45,6 +47,9 @@ spec:
         - name: lidarr-config
           persistentVolumeClaim:
             claimName: lidarr-storage
-        - name: nfs-media
+        - name: nfs-media-music
           persistentVolumeClaim:
-            claimName: nfs-media
+            claimName: nfs-media-music
+        - name: nfs-media-downloads
+          persistentVolumeClaim:
+            claimName: nfs-media-downloads
diff --git a/k8s-wheatley/lidarr/kustomization.yaml b/k8s-wheatley/lidarr/kustomization.yaml
index 018f13b..5b4c1d1 100644
--- a/k8s-wheatley/lidarr/kustomization.yaml
+++ b/k8s-wheatley/lidarr/kustomization.yaml
@@ -4,7 +4,6 @@ kind: Kustomization
 namespace: lidarr
 
 resources:
-  - ../../kustomize-bases/nfs-media
   - configmap.yaml
   - deployments.yaml
   - ingress.yaml
@@ -12,21 +11,39 @@ resources:
   - services.yaml
   - namespace.yaml
 
+components:
+  - ../../kustomize-bases/nfs-media/components/music
+  - ../../kustomize-bases/nfs-media/components/downloads
+
 patches:
   - target:
       kind: PersistentVolume
-      name: nfs-media
+      name: nfs-media-music
     patch: |
       - op: replace
         path: /metadata/name
-        value: nfs-media-lidarr
+        value: nfs-media-lidarr-music
   - target:
       kind: PersistentVolumeClaim
-      name: nfs-media
+      name: nfs-media-music
     patch: |
       - op: replace
         path: /spec/volumeName
-        value: nfs-media-lidarr
+        value: nfs-media-lidarr-music
+  - target:
+      kind: PersistentVolume
+      name: nfs-media-downloads
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: nfs-media-lidarr-downloads
+  - target:
+      kind: PersistentVolumeClaim
+      name: nfs-media-downloads
+    patch: |
+      - op: replace
+        path: /spec/volumeName
+        value: nfs-media-lidarr-downloads
 
 images:
   - name: linuxserver/lidarr
diff --git a/k8s-wheatley/plex/deployments.yaml b/k8s-wheatley/plex/deployments.yaml
index 3e48bda..11e0717 100644
--- a/k8s-wheatley/plex/deployments.yaml
+++ b/k8s-wheatley/plex/deployments.yaml
@@ -28,8 +28,12 @@ spec:
           volumeMounts:
             - mountPath: /config
               name: plex-config
-            - mountPath: /data
-              name: nfs-media
+            - mountPath: /data/movies
+              name: nfs-media-movies
+            - mountPath: /data/series
+              name: nfs-media-series
+            - mountPath: /data/anime
+              name: nfs-media-anime
           securityContext:
             seccompProfile:
               type: RuntimeDefault
@@ -45,6 +49,12 @@ spec:
         - name: plex-config
           persistentVolumeClaim:
             claimName: plex-storage
-        - name: nfs-media
+        - name: nfs-media-movies
           persistentVolumeClaim:
-            claimName: nfs-media
+            claimName: nfs-media-movies
+        - name: nfs-media-series
+          persistentVolumeClaim:
+            claimName: nfs-media-series
+        - name: nfs-media-anime
+          persistentVolumeClaim:
+            claimName: nfs-media-anime
diff --git a/k8s-wheatley/plex/kustomization.yaml b/k8s-wheatley/plex/kustomization.yaml
index 3bd4023..ccb0bdc 100644
--- a/k8s-wheatley/plex/kustomization.yaml
+++ b/k8s-wheatley/plex/kustomization.yaml
@@ -4,7 +4,6 @@ kind: Kustomization
 namespace: plex
 
 resources:
-  - ../../kustomize-bases/nfs-media
   - configmap.yaml
   - deployments.yaml
   - ingress.yaml
@@ -13,24 +12,69 @@ resources:
   - services.yaml
   - namespace.yaml
 
+components:
+  - ../../kustomize-bases/nfs-media/components/movies
+  - ../../kustomize-bases/nfs-media/components/series
+  - ../../kustomize-bases/nfs-media/components/anime
+
 patches:
   - target:
       kind: PersistentVolume
-      name: nfs-media
+      name: nfs-media-movies
     patch: |
       - op: replace
         path: /metadata/name
-        value: nfs-media-plex
+        value: nfs-media-plex-movies
       - op: replace
         path: /spec/accessModes/0
         value: ReadOnlyMany
   - target:
       kind: PersistentVolumeClaim
-      name: nfs-media
+      name: nfs-media-movies
     patch: |
       - op: replace
         path: /spec/volumeName
-        value: nfs-media-plex
+        value: nfs-media-plex-movies
+      - op: replace
+        path: /spec/accessModes/0
+        value: ReadOnlyMany
+  - target:
+      kind: PersistentVolume
+      name: nfs-media-series
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: nfs-media-plex-series
+      - op: replace
+        path: /spec/accessModes/0
+        value: ReadOnlyMany
+  - target:
+      kind: PersistentVolumeClaim
+      name: nfs-media-series
+    patch: |
+      - op: replace
+        path: /spec/volumeName
+        value: nfs-media-plex-series
+      - op: replace
+        path: /spec/accessModes/0
+        value: ReadOnlyMany
+  - target:
+      kind: PersistentVolume
+      name: nfs-media-anime
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: nfs-media-plex-anime
+      - op: replace
+        path: /spec/accessModes/0
+        value: ReadOnlyMany
+  - target:
+      kind: PersistentVolumeClaim
+      name: nfs-media-anime
+    patch: |
+      - op: replace
+        path: /spec/volumeName
+        value: nfs-media-plex-anime
       - op: replace
         path: /spec/accessModes/0
         value: ReadOnlyMany
diff --git a/k8s-wheatley/qbittorrent/deployments.yaml b/k8s-wheatley/qbittorrent/deployments.yaml
index b6d35cd..4eb27c3 100644
--- a/k8s-wheatley/qbittorrent/deployments.yaml
+++ b/k8s-wheatley/qbittorrent/deployments.yaml
@@ -94,7 +94,7 @@ spec:
             - mountPath: /config
               name: qbittorrent-config
             - mountPath: /shared/media/downloads
-              name: nfs-media
+              name: nfs-media-downloads
           securityContext:
             seccompProfile:
               type: RuntimeDefault
@@ -114,7 +114,7 @@ spec:
                 name: unpackerr-env-secrets
           volumeMounts:
             - mountPath: /shared/media/downloads
-              name: nfs-media
+              name: nfs-media-downloads
           securityContext:
             seccompProfile:
               type: RuntimeDefault
@@ -136,7 +136,7 @@ spec:
             - mountPath: /config
               name: slskd-config
             - mountPath: /shared/media/downloads
-              name: nfs-media
+              name: nfs-media-downloads
           securityContext:
             seccompProfile:
               type: RuntimeDefault
@@ -168,6 +168,6 @@ spec:
             defaultMode: 0755
         - name: gluetun-tmp
           emptyDir: {}
-        - name: nfs-media
+        - name: nfs-media-downloads
           persistentVolumeClaim:
-            claimName: nfs-media
+            claimName: nfs-media-downloads
diff --git a/k8s-wheatley/qbittorrent/kustomization.yaml b/k8s-wheatley/qbittorrent/kustomization.yaml
index dfe93b6..772ec7b 100644
--- a/k8s-wheatley/qbittorrent/kustomization.yaml
+++ b/k8s-wheatley/qbittorrent/kustomization.yaml
@@ -4,7 +4,6 @@ kind: Kustomization
 namespace: qbittorrent
 
 resources:
-  - ../../kustomize-bases/nfs-media
   - configmap.yaml
   - deployments.yaml
   - ingress.yaml
@@ -12,24 +11,24 @@ resources:
   - secrets.yaml
   - namespace.yaml
 
+components:
+  - ../../kustomize-bases/nfs-media/components/downloads
+
 patches:
   - target:
       kind: PersistentVolume
-      name: nfs-media
+      name: nfs-media-downloads
     patch: |
       - op: replace
         path: /metadata/name
-        value: nfs-media-qbittorrent
-      - op: replace
-        path: /spec/nfs/path
-        value: /tank/media/downloads
+        value: nfs-media-qbittorrent-downloads
   - target:
       kind: PersistentVolumeClaim
-      name: nfs-media
+      name: nfs-media-downloads
     patch: |
       - op: replace
         path: /spec/volumeName
-        value: nfs-media-qbittorrent
+        value: nfs-media-qbittorrent-downloads
 
 images:
   - name: ghcr.io/qdm12/gluetun
diff --git a/k8s-wheatley/radarr/deployments.yaml b/k8s-wheatley/radarr/deployments.yaml
index a4042c0..41587c3 100644
--- a/k8s-wheatley/radarr/deployments.yaml
+++ b/k8s-wheatley/radarr/deployments.yaml
@@ -28,8 +28,10 @@ spec:
           volumeMounts:
             - mountPath: /config
               name: radarr-config
-            - mountPath: /shared/media
-              name: nfs-media
+            - mountPath: /shared/media/movies
+              name: nfs-media-movies
+            - mountPath: /shared/media/downloads
+              name: nfs-media-downloads
           securityContext:
             seccompProfile:
               type: RuntimeDefault
@@ -45,6 +47,9 @@ spec:
         - name: radarr-config
           persistentVolumeClaim:
             claimName: radarr-storage
-        - name: nfs-media
+        - name: nfs-media-movies
           persistentVolumeClaim:
-            claimName: nfs-media
+            claimName: nfs-media-movies
+        - name: nfs-media-downloads
+          persistentVolumeClaim:
+            claimName: nfs-media-downloads
diff --git a/k8s-wheatley/radarr/kustomization.yaml b/k8s-wheatley/radarr/kustomization.yaml
index 445d2f3..7296e89 100644
--- a/k8s-wheatley/radarr/kustomization.yaml
+++ b/k8s-wheatley/radarr/kustomization.yaml
@@ -4,7 +4,6 @@ kind: Kustomization
 namespace: radarr
 
 resources:
-  - ../../kustomize-bases/nfs-media
   - configmap.yaml
   - deployments.yaml
   - ingress.yaml
@@ -13,21 +12,39 @@ resources:
   - services.yaml
   - namespace.yaml
 
+components:
+  - ../../kustomize-bases/nfs-media/components/movies
+  - ../../kustomize-bases/nfs-media/components/downloads
+
 patches:
   - target:
       kind: PersistentVolume
-      name: nfs-media
+      name: nfs-media-movies
     patch: |
       - op: replace
         path: /metadata/name
-        value: nfs-media-radarr
+        value: nfs-media-radarr-movies
   - target:
       kind: PersistentVolumeClaim
-      name: nfs-media
+      name: nfs-media-movies
     patch: |
       - op: replace
         path: /spec/volumeName
-        value: nfs-media-radarr
+        value: nfs-media-radarr-movies
+  - target:
+      kind: PersistentVolume
+      name: nfs-media-downloads
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: nfs-media-radarr-downloads
+  - target:
+      kind: PersistentVolumeClaim
+      name: nfs-media-downloads
+    patch: |
+      - op: replace
+        path: /spec/volumeName
+        value: nfs-media-radarr-downloads
 
 images:
   - name: linuxserver/radarr
diff --git a/k8s-wheatley/sonarr/deployments.yaml b/k8s-wheatley/sonarr/deployments.yaml
index 45e7ea9..79a8b50 100644
--- a/k8s-wheatley/sonarr/deployments.yaml
+++ b/k8s-wheatley/sonarr/deployments.yaml
@@ -28,8 +28,12 @@ spec:
           volumeMounts:
             - mountPath: /config
               name: sonarr-config
-            - mountPath: /shared/media
-              name: nfs-media
+            - mountPath: /shared/media/series
+              name: nfs-media-series
+            - mountPath: /shared/media/anime
+              name: nfs-media-anime
+            - mountPath: /shared/media/downloads
+              name: nfs-media-downloads
           securityContext:
             seccompProfile:
               type: RuntimeDefault
@@ -45,6 +49,12 @@ spec:
         - name: sonarr-config
           persistentVolumeClaim:
             claimName: sonarr-storage
-        - name: nfs-media
+        - name: nfs-media-series
           persistentVolumeClaim:
-            claimName: nfs-media
+            claimName: nfs-media-series
+        - name: nfs-media-anime
+          persistentVolumeClaim:
+            claimName: nfs-media-anime
+        - name: nfs-media-downloads
+          persistentVolumeClaim:
+            claimName: nfs-media-downloads
diff --git a/k8s-wheatley/sonarr/kustomization.yaml b/k8s-wheatley/sonarr/kustomization.yaml
index 51ba92b..4c9f0c9 100644
--- a/k8s-wheatley/sonarr/kustomization.yaml
+++ b/k8s-wheatley/sonarr/kustomization.yaml
@@ -4,7 +4,6 @@ kind: Kustomization
 namespace: sonarr
 
 resources:
-  - ../../kustomize-bases/nfs-media
   - configmap.yaml
   - deployments.yaml
   - ingress.yaml
@@ -13,21 +12,54 @@ resources:
   - services.yaml
   - namespace.yaml
 
+components:
+  - ../../kustomize-bases/nfs-media/components/series
+  - ../../kustomize-bases/nfs-media/components/anime
+  - ../../kustomize-bases/nfs-media/components/downloads
+
 patches:
   - target:
       kind: PersistentVolume
-      name: nfs-media
+      name: nfs-media-series
     patch: |
       - op: replace
         path: /metadata/name
-        value: nfs-media-sonarr
+        value: nfs-media-sonarr-series
   - target:
       kind: PersistentVolumeClaim
-      name: nfs-media
+      name: nfs-media-series
     patch: |
       - op: replace
         path: /spec/volumeName
-        value: nfs-media-sonarr
+        value: nfs-media-sonarr-series
+  - target:
+      kind: PersistentVolume
+      name: nfs-media-anime
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: nfs-media-sonarr-anime
+  - target:
+      kind: PersistentVolumeClaim
+      name: nfs-media-anime
+    patch: |
+      - op: replace
+        path: /spec/volumeName
+        value: nfs-media-sonarr-anime
+  - target:
+      kind: PersistentVolume
+      name: nfs-media-downloads
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: nfs-media-sonarr-downloads
+  - target:
+      kind: PersistentVolumeClaim
+      name: nfs-media-downloads
+    patch: |
+      - op: replace
+        path: /spec/volumeName
+        value: nfs-media-sonarr-downloads
 
 images:
   - name: linuxserver/sonarr
diff --git a/kustomize-bases/nfs-media/components/anime/kustomization.yaml b/kustomize-bases/nfs-media/components/anime/kustomization.yaml
new file mode 100644
index 0000000..9014f38
--- /dev/null
+++ b/kustomize-bases/nfs-media/components/anime/kustomization.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+resources:
+  - pvc.yaml
diff --git a/kustomize-bases/nfs-media/components/anime/pvc.yaml b/kustomize-bases/nfs-media/components/anime/pvc.yaml
new file mode 100644
index 0000000..9471154
--- /dev/null
+++ b/kustomize-bases/nfs-media/components/anime/pvc.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nfs-media-anime
+spec:
+  capacity:
+    storage: 40Ti
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: 10.0.69.10
+    path: /tank/media/anime
+  mountOptions:
+    - vers=4.1
+    - rsize=1048576
+    - wsize=1048576
+    - hard
+    - timeo=600
+    - noatime
+  persistentVolumeReclaimPolicy: Retain
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nfs-media-anime
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 40Ti
+  volumeName: nfs-media-anime
diff --git a/kustomize-bases/nfs-media/components/downloads/kustomization.yaml b/kustomize-bases/nfs-media/components/downloads/kustomization.yaml
new file mode 100644
index 0000000..9014f38
--- /dev/null
+++ b/kustomize-bases/nfs-media/components/downloads/kustomization.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+resources:
+  - pvc.yaml
diff --git a/kustomize-bases/nfs-media/components/downloads/pvc.yaml b/kustomize-bases/nfs-media/components/downloads/pvc.yaml
new file mode 100644
index 0000000..16b0b65
--- /dev/null
+++ b/kustomize-bases/nfs-media/components/downloads/pvc.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nfs-media-downloads
+spec:
+  capacity:
+    storage: 40Ti
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: 10.0.69.10
+    path: /tank/media/downloads
+  mountOptions:
+    - vers=4.1
+    - rsize=1048576
+    - wsize=1048576
+    - hard
+    - timeo=600
+    - noatime
+  persistentVolumeReclaimPolicy: Retain
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nfs-media-downloads
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 40Ti
+  volumeName: nfs-media-downloads
diff --git a/kustomize-bases/nfs-media/components/movies/kustomization.yaml b/kustomize-bases/nfs-media/components/movies/kustomization.yaml
new file mode 100644
index 0000000..9014f38
--- /dev/null
+++ b/kustomize-bases/nfs-media/components/movies/kustomization.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+resources:
+  - pvc.yaml
diff --git a/kustomize-bases/nfs-media/components/movies/pvc.yaml b/kustomize-bases/nfs-media/components/movies/pvc.yaml
new file mode 100644
index 0000000..28af8e4
--- /dev/null
+++ b/kustomize-bases/nfs-media/components/movies/pvc.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nfs-media-movies
+spec:
+  capacity:
+    storage: 40Ti
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: 10.0.69.10
+    path: /tank/media/movies
+  mountOptions:
+    - vers=4.1
+    - rsize=1048576
+    - wsize=1048576
+    - hard
+    - timeo=600
+    - noatime
+  persistentVolumeReclaimPolicy: Retain
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nfs-media-movies
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 40Ti
+  volumeName: nfs-media-movies
diff --git a/kustomize-bases/nfs-media/components/music/kustomization.yaml b/kustomize-bases/nfs-media/components/music/kustomization.yaml
new file mode 100644
index 0000000..9014f38
--- /dev/null
+++ b/kustomize-bases/nfs-media/components/music/kustomization.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+resources:
+  - pvc.yaml
diff --git a/kustomize-bases/nfs-media/components/music/pvc.yaml b/kustomize-bases/nfs-media/components/music/pvc.yaml
new file mode 100644
index 0000000..117fb3e
--- /dev/null
+++ b/kustomize-bases/nfs-media/components/music/pvc.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nfs-media-music
+spec:
+  capacity:
+    storage: 40Ti
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: 10.0.69.10
+    path: /tank/media/music
+  mountOptions:
+    - vers=4.1
+    - rsize=1048576
+    - wsize=1048576
+    - hard
+    - timeo=600
+    - noatime
+  persistentVolumeReclaimPolicy: Retain
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nfs-media-music
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 40Ti
+  volumeName: nfs-media-music
diff --git a/kustomize-bases/nfs-media/components/roms/kustomization.yaml b/kustomize-bases/nfs-media/components/roms/kustomization.yaml
new file mode 100644
index 0000000..9014f38
--- /dev/null
+++ b/kustomize-bases/nfs-media/components/roms/kustomization.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+resources:
+  - pvc.yaml
diff --git a/kustomize-bases/nfs-media/components/roms/pvc.yaml b/kustomize-bases/nfs-media/components/roms/pvc.yaml
new file mode 100644
index 0000000..6f2e6e6
--- /dev/null
+++ b/kustomize-bases/nfs-media/components/roms/pvc.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nfs-media-roms
+spec:
+  capacity:
+    storage: 40Ti
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: 10.0.69.10
+    path: /tank/media/roms
+  mountOptions:
+    - vers=4.1
+    - rsize=1048576
+    - wsize=1048576
+    - hard
+    - timeo=600
+    - noatime
+  persistentVolumeReclaimPolicy: Retain
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nfs-media-roms
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 40Ti
+  volumeName: nfs-media-roms
diff --git a/kustomize-bases/nfs-media/components/series/kustomization.yaml b/kustomize-bases/nfs-media/components/series/kustomization.yaml
new file mode 100644
index 0000000..9014f38
--- /dev/null
+++ b/kustomize-bases/nfs-media/components/series/kustomization.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+resources:
+  - pvc.yaml
diff --git a/kustomize-bases/nfs-media/components/series/pvc.yaml b/kustomize-bases/nfs-media/components/series/pvc.yaml
new file mode 100644
index 0000000..0aec6a8
--- /dev/null
+++ b/kustomize-bases/nfs-media/components/series/pvc.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nfs-media-series
+spec:
+  capacity:
+    storage: 40Ti
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: 10.0.69.10
+    path: /tank/media/series
+  mountOptions:
+    - vers=4.1
+    - rsize=1048576
+    - wsize=1048576
+    - hard
+    - timeo=600
+    - noatime
+  persistentVolumeReclaimPolicy: Retain
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nfs-media-series
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 40Ti
+  volumeName: nfs-media-series
diff --git a/kustomize-bases/nfs-media/kustomization.yaml b/kustomize-bases/nfs-media/kustomization.yaml
deleted file mode 100644
index 482f897..0000000
--- a/kustomize-bases/nfs-media/kustomization.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - pvc.yaml
diff --git a/kustomize-bases/nfs-media/pvc.yaml b/kustomize-bases/nfs-media/pvc.yaml
deleted file mode 100644
index 94091c9..0000000
--- a/kustomize-bases/nfs-media/pvc.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-# Shared NFS media storage template — used by plex, sonarr, radarr, and qbittorrent.
-# All apps on k8s-wheatley mount the same NFS server: 10.0.69.10
-#
-# Each app overlays this base with JSON patches in its kustomization.yaml:
-#   - Always: rename PV (metadata.name) and update PVC volumeName to match
-#   - plex only: patch accessModes to ReadOnlyMany on both PV and PVC
-#   - qbittorrent only: patch nfs.path to /tank/media/downloads
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: nfs-media  # renamed per-app via JSON patch
-spec:
-  capacity:
-    storage: 40Ti
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    server: 10.0.69.10
-    path: /tank/media
-  mountOptions:
-    - vers=4.1
-    - rsize=1048576
-    - wsize=1048576
-    - hard
-    - timeo=600
-    - noatime
-  persistentVolumeReclaimPolicy: Retain
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: nfs-media
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 40Ti
-  volumeName: nfs-media  # patched per-app to match PV name

From 50a206c9430dd9c8cfbedb3e94c68ef5552cdba2 Mon Sep 17 00:00:00 2001
From: pgijsbertsen <117165507+pgijsbertsen@users.noreply.github.com>
Date: Thu, 14 May 2026 16:38:55 +0200
Subject: [PATCH 08/12] chore: Bump Cilium to 1.18.10

---
 kustomize-bases/cilium/kustomization.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kustomize-bases/cilium/kustomization.yaml b/kustomize-bases/cilium/kustomization.yaml
index 4cccdf0..db4bf50 100644
--- a/kustomize-bases/cilium/kustomization.yaml
+++ b/kustomize-bases/cilium/kustomization.yaml
@@ -13,5 +13,5 @@ helmCharts:
     repo: https://helm.cilium.io
     namespace: kube-system
     releaseName: cilium
-    version: 1.18.6
+    version: 1.18.10
     valuesFile: values.yaml

From 6a9c153f5c47520a6e09e9018c8e7fcb30116680 Mon Sep 17 00:00:00 2001
From: pgijsbertsen <117165507+pgijsbertsen@users.noreply.github.com>
Date: Thu, 14 May 2026 21:08:11 +0200
Subject: [PATCH 09/12] feat: Add RomM

---
 k8s-peterg/argocd/applications-wheatley.yaml | 19 +++++
 k8s-wheatley/romm/configmap.yaml             | 21 +++++
 k8s-wheatley/romm/deployments.yaml           | 83 ++++++++++++++++++++
 k8s-wheatley/romm/ingress.yaml               | 16 ++++
 k8s-wheatley/romm/kustomization.yaml         | 53 +++++++++++++
 k8s-wheatley/romm/namespace.yaml             |  5 ++
 k8s-wheatley/romm/pvc.yaml                   | 24 ++++++
 k8s-wheatley/romm/secrets.yaml               | 52 ++++++++++++
 k8s-wheatley/romm/services.yaml              | 12 +++
 9 files changed, 285 insertions(+)
 create mode 100644 k8s-wheatley/romm/configmap.yaml
 create mode 100644 k8s-wheatley/romm/deployments.yaml
 create mode 100644 k8s-wheatley/romm/ingress.yaml
 create mode 100644 k8s-wheatley/romm/kustomization.yaml
 create mode 100644 k8s-wheatley/romm/namespace.yaml
 create mode 100644 k8s-wheatley/romm/pvc.yaml
 create mode 100644 k8s-wheatley/romm/secrets.yaml
 create mode 100644 k8s-wheatley/romm/services.yaml

diff --git a/k8s-peterg/argocd/applications-wheatley.yaml b/k8s-peterg/argocd/applications-wheatley.yaml
index eae54ce..f0d4229 100644
--- a/k8s-peterg/argocd/applications-wheatley.yaml
+++ b/k8s-peterg/argocd/applications-wheatley.yaml
@@ -216,3 +216,22 @@ spec:
     automated:
       prune: true
       selfHeal: true
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: romm
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://code.peterg.nl/wheatley/kubernetes.git
+    path: k8s-wheatley/romm
+    targetRevision: HEAD
+  destination:
+    server: https://10.13.37.10:6443
+    namespace: romm
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
diff --git a/k8s-wheatley/romm/configmap.yaml b/k8s-wheatley/romm/configmap.yaml
new file mode 100644
index 0000000..e90220b
--- /dev/null
+++ b/k8s-wheatley/romm/configmap.yaml
@@ -0,0 +1,21 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: romm-db-envs
+data:
+  MARIADB_DATABASE: romm
+  MARIADB_USER: romm
+  TZ: Europe/Amsterdam
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: romm-envs
+data:
+  DB_HOST: 127.0.0.1
+  DB_NAME: romm
+  DB_USER: romm
+  ROMM_PORT: "8080"
+  HASHEOUS_API_ENABLED: "true"
+  TZ: Europe/Amsterdam
diff --git a/k8s-wheatley/romm/deployments.yaml b/k8s-wheatley/romm/deployments.yaml
new file mode 100644
index 0000000..79b7fd1
--- /dev/null
+++ b/k8s-wheatley/romm/deployments.yaml
@@ -0,0 +1,83 @@
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: romm
+  labels:
+    app: romm
+spec:
+  replicas: 1
+  serviceName: romm
+  selector:
+    matchLabels:
+      app: romm
+  template:
+    metadata:
+      labels:
+        app: romm
+    spec:
+      initContainers:
+        - name: romm-db
+          image: mariadb
+          envFrom:
+            - configMapRef:
+                name: romm-db-envs
+            - secretRef:
+                name: romm-db-env-secrets
+          volumeMounts:
+            - mountPath: /var/lib/mysql
+              name: romm-db-data
+          restartPolicy: Always
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - "healthcheck.sh --connect --innodb_initialized"
+            initialDelaySeconds: 5
+            periodSeconds: 3
+            timeoutSeconds: 2
+            failureThreshold: 3
+          livenessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - "healthcheck.sh --connect --innodb_initialized"
+            initialDelaySeconds: 10
+            periodSeconds: 15
+            timeoutSeconds: 2
+            failureThreshold: 3
+      containers:
+        - name: romm
+          image: rommapp/romm
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8080
+          envFrom:
+            - configMapRef:
+                name: romm-envs
+            - secretRef:
+                name: romm-env-secrets
+          volumeMounts:
+            - mountPath: /romm
+              name: romm-data
+            - mountPath: /romm/library
+              name: nfs-media-roms
+              readOnly: true
+            - mountPath: /romm/downloads
+              name: nfs-media-downloads
+              readOnly: true
+      volumes:
+        - name: romm-db-data
+          persistentVolumeClaim:
+            claimName: romm-db-storage
+        - name: romm-data
+          persistentVolumeClaim:
+            claimName: romm-storage
+        - name: nfs-media-roms
+          persistentVolumeClaim:
+            claimName: nfs-media-roms
+        - name: nfs-media-downloads
+          persistentVolumeClaim:
+            claimName: nfs-media-downloads
diff --git a/k8s-wheatley/romm/ingress.yaml b/k8s-wheatley/romm/ingress.yaml
new file mode 100644
index 0000000..8a7eae1
--- /dev/null
+++ b/k8s-wheatley/romm/ingress.yaml
@@ -0,0 +1,16 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: romm-route
+spec:
+  parentRefs:
+    - name: internal
+      namespace: kube-system
+      sectionName: https
+  hostnames:
+    - "roms.wheatley.in"
+  rules:
+    - backendRefs:
+        - name: romm
+          port: 80
diff --git a/k8s-wheatley/romm/kustomization.yaml b/k8s-wheatley/romm/kustomization.yaml
new file mode 100644
index 0000000..3c4bb11
--- /dev/null
+++ b/k8s-wheatley/romm/kustomization.yaml
@@ -0,0 +1,53 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: romm
+
+resources:
+  - configmap.yaml
+  - deployments.yaml
+  - ingress.yaml
+  - pvc.yaml
+  - secrets.yaml
+  - services.yaml
+  - namespace.yaml
+
+components:
+  - ../../kustomize-bases/nfs-media/components/roms
+  - ../../kustomize-bases/nfs-media/components/downloads
+
+patches:
+  - target:
+      kind: PersistentVolume
+      name: nfs-media-roms
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: nfs-media-romm-roms
+  - target:
+      kind: PersistentVolume
+      name: nfs-media-downloads
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: nfs-media-romm-downloads
+  - target:
+      kind: PersistentVolumeClaim
+      name: nfs-media-roms
+    patch: |
+      - op: replace
+        path: /spec/volumeName
+        value: nfs-media-romm-roms
+  - target:
+      kind: PersistentVolumeClaim
+      name: nfs-media-downloads
+    patch: |
+      - op: replace
+        path: /spec/volumeName
+        value: nfs-media-romm-downloads
+
+images:
+  - name: mariadb
+    newTag: lts
+  - name: rommapp/romm
+    newTag: 4.8.1
diff --git a/k8s-wheatley/romm/namespace.yaml b/k8s-wheatley/romm/namespace.yaml
new file mode 100644
index 0000000..131f95c
--- /dev/null
+++ b/k8s-wheatley/romm/namespace.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: romm
diff --git a/k8s-wheatley/romm/pvc.yaml b/k8s-wheatley/romm/pvc.yaml
new file mode 100644
index 0000000..3d64e4c
--- /dev/null
+++ b/k8s-wheatley/romm/pvc.yaml
@@ -0,0 +1,24 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: romm-db-storage
+spec:
+  storageClassName: piraeus-lvmthin
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: romm-storage
+spec:
+  storageClassName: piraeus-lvmthin
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
diff --git a/k8s-wheatley/romm/secrets.yaml b/k8s-wheatley/romm/secrets.yaml
new file mode 100644
index 0000000..e1a9d82
--- /dev/null
+++ b/k8s-wheatley/romm/secrets.yaml
@@ -0,0 +1,52 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: romm-db-env-secrets
+spec:
+  secretStoreRef:
+    name: vault-wheatley
+    kind: ClusterSecretStore
+  target:
+    name: romm-db-env-secrets
+  data:
+    - secretKey: MARIADB_ROOT_PASSWORD
+      remoteRef:
+        key: secrets/managed/romm/romm-db
+        property: ROOT_PASSWORD
+    - secretKey: MARIADB_PASSWORD
+      remoteRef:
+        key: secrets/managed/romm/romm-db
+        property: PASSWORD
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: romm-env-secrets
+spec:
+  secretStoreRef:
+    name: vault-wheatley
+    kind: ClusterSecretStore
+  target:
+    name: romm-env-secrets
+  data:
+    - secretKey: DB_PASSWD
+      remoteRef:
+        key: secrets/managed/romm/romm-db
+        property: PASSWORD
+    - secretKey: ROMM_AUTH_SECRET_KEY
+      remoteRef:
+        key: secrets/managed/romm/romm
+        property: SECRET_KEY
+    - secretKey: IGDB_CLIENT_ID
+      remoteRef:
+        key: secrets/managed/romm/romm
+        property: IGDB_CLIENT_ID
+    - secretKey: IGDB_CLIENT_SECRET
+      remoteRef:
+        key: secrets/managed/romm/romm
+        property: IGDB_CLIENT_SECRET
+    - secretKey: STEAMGRIDDB_API_KEY
+      remoteRef:
+        key: secrets/managed/romm/romm
+        property: STEAMGRIDDB_API_KEY
diff --git a/k8s-wheatley/romm/services.yaml b/k8s-wheatley/romm/services.yaml
new file mode 100644
index 0000000..1d89402
--- /dev/null
+++ b/k8s-wheatley/romm/services.yaml
@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: romm
+spec:
+  selector:
+    app: romm
+  ports:
+    - port: 80
+      protocol: TCP
+      targetPort: 8080

From dfd74ecc6d236bd52e7dee9c4d8f46b658675645 Mon Sep 17 00:00:00 2001
From: pgijsbertsen <117165507+pgijsbertsen@users.noreply.github.com>
Date: Thu, 14 May 2026 21:40:06 +0200
Subject: [PATCH 10/12] fix(lidarr): Increase pvc size

---
 k8s-wheatley/lidarr/pvc.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/k8s-wheatley/lidarr/pvc.yaml b/k8s-wheatley/lidarr/pvc.yaml
index e06965e..0953aac 100644
--- a/k8s-wheatley/lidarr/pvc.yaml
+++ b/k8s-wheatley/lidarr/pvc.yaml
@@ -9,4 +9,4 @@ spec:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 5Gi
+      storage: 10Gi

From d1c6ac7202cb5a410d4526c83a4158e8bbf4ee48 Mon Sep 17 00:00:00 2001
From: pgijsbertsen <117165507+pgijsbertsen@users.noreply.github.com>
Date: Thu, 14 May 2026 21:56:04 +0200
Subject: [PATCH 11/12] chore(lidarr): Switch to nightly builds

---
 k8s-wheatley/lidarr/kustomization.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/k8s-wheatley/lidarr/kustomization.yaml b/k8s-wheatley/lidarr/kustomization.yaml
index 5b4c1d1..adcf14d 100644
--- a/k8s-wheatley/lidarr/kustomization.yaml
+++ b/k8s-wheatley/lidarr/kustomization.yaml
@@ -47,4 +47,4 @@ patches:
 
 images:
   - name: linuxserver/lidarr
-    newTag: 3.1.0@sha256:d2f944115de2ca6754ad142ee92f9db481b1574c7bc030974d624584106b78d7
+    newTag: 3.1.2-nightly

From f873fd191bf3a6053781f06d705e0144a757edf5 Mon Sep 17 00:00:00 2001
From: Renovate <renovate@peterg.nl>
Date: Thu, 14 May 2026 20:03:30 +0000
Subject: [PATCH 12/12] chore(deps): pin dependencies

---
 k8s-peterg/argo-workflows/values.yaml       | 2 +-
 k8s-wheatley/lidarr/kustomization.yaml      | 2 +-
 k8s-wheatley/qbittorrent/kustomization.yaml | 2 +-
 k8s-wheatley/romm/kustomization.yaml        | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/k8s-peterg/argo-workflows/values.yaml b/k8s-peterg/argo-workflows/values.yaml
index 26b8dcf..c0b32b5 100644
--- a/k8s-peterg/argo-workflows/values.yaml
+++ b/k8s-peterg/argo-workflows/values.yaml
@@ -155,7 +155,7 @@ server:
     # -- Repository to use for the server
     repository: argoproj/argocli
     # -- Image tag for the Argo Workflows server. Defaults to `.Values.images.tag`.
-    tag: ""
+    tag: "@sha256:4bd385f07e5245fb7028923cc03fc47515623f553a7e4ffcdd66fb3009133f15"
   rbac:
     # -- Adds Role and RoleBinding for the server.
     create: true
diff --git a/k8s-wheatley/lidarr/kustomization.yaml b/k8s-wheatley/lidarr/kustomization.yaml
index adcf14d..d624a90 100644
--- a/k8s-wheatley/lidarr/kustomization.yaml
+++ b/k8s-wheatley/lidarr/kustomization.yaml
@@ -47,4 +47,4 @@ patches:
 
 images:
   - name: linuxserver/lidarr
-    newTag: 3.1.2-nightly
+    newTag: 3.1.2-nightly@sha256:854684b3df33139a8907fa3e316a3c030676e8e753b7fac78b98d297b8cc6fe0
diff --git a/k8s-wheatley/qbittorrent/kustomization.yaml b/k8s-wheatley/qbittorrent/kustomization.yaml
index 772ec7b..52170ad 100644
--- a/k8s-wheatley/qbittorrent/kustomization.yaml
+++ b/k8s-wheatley/qbittorrent/kustomization.yaml
@@ -36,4 +36,4 @@ images:
   - name: docker.io/qbittorrentofficial/qbittorrent-nox
     newTag: 5.1.4-2@sha256:85fe2690f418dabffc4907276b3cdffcb7880c7114157b32f932d3b97bac45af
   - name: docker.io/slskd/slskd
-    newTag: 0.25.1
+    newTag: 0.25.1@sha256:ab9ed50e028b524cefdb7c1dd8ebca368a076e18441ee8ac2326473eb850b4c3
diff --git a/k8s-wheatley/romm/kustomization.yaml b/k8s-wheatley/romm/kustomization.yaml
index 3c4bb11..a49cfc5 100644
--- a/k8s-wheatley/romm/kustomization.yaml
+++ b/k8s-wheatley/romm/kustomization.yaml
@@ -48,6 +48,6 @@ patches:
 
 images:
   - name: mariadb
-    newTag: lts
+    newTag: lts@sha256:78a5047d3ba33975f183f183c2464cc7f1eab13ec8667e57cc9a5821d6da7577
   - name: rommapp/romm
-    newTag: 4.8.1
+    newTag: 4.8.1@sha256:2b7a1714b287f69b081ad2a63bb8c2fa673666a17b2f21322b580b0cd51cb266