--- # yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2beta2.json apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease metadata: name: qbittorrent spec: interval: 30m chart: spec: chart: app-template version: 2.4.0 interval: 30m sourceRef: kind: HelmRepository name: bjw-s namespace: flux-system values: controllers: main: annotations: configmap.reloader.stakater.com/reload: qbittorrent-scripts secret.reloader.stakater.com/reload: qbittorrent-secret pod: securityContext: fsGroup: 568 fsGroupChangePolicy: "OnRootMismatch" containers: main: nameOverride: qbittorrent image: repository: ghcr.io/onedr0p/qbittorrent tag: 4.6.2@sha256:fedb62126c82ae0c7192e9052633411294a27e9c233613c03b0a8d168d160040 env: UMASK: "022" QBITTORRENT__PORT: &port 8080 QBT_Preferences__WebUI__AlternativeUIEnabled: false QBT_Preferences__WebUI__AuthSubnetWhitelistEnabled: true QBT_Preferences__WebUI__AuthSubnetWhitelist: |- 10.32.0.0/16, 10.1.2.0/24 QBT_Preferences__WebUI__LocalHostAuth: false resources: requests: cpu: 49m memory: 1024Mi limits: memory: 8192Mi securityContext: runAsUser: 568 runAsGroup: 568 runAsNonRoot: true allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL gluetun: image: repository: ghcr.io/qdm12/gluetun tag: latest@sha256:450a487b23cd460da99b025b32b22fbccd41e7f3a0b083d34326d5a4c88519b0 env: VPN_SERVICE_PROVIDER: custom VPN_TYPE: wireguard VPN_INTERFACE: wg0 VPN_ENDPOINT_PORT: 51820 VPN_PORT_FORWARDING: on VPN_PORT_FORWARDING_PROVIDER: protonvpn FIREWALL_INPUT_PORTS: 8080 FIREWALL_OUTBOUND_SUBNETS: 10.32.0.0/16 # Allow access to k8s subnets envFrom: - secretRef: name: qbittorrent-secret securityContext: capabilities: add: - NET_ADMIN allowPrivilegeEscalation: false port-forward: image: repository: ghcr.io/bjw-s/gluetun-qb-port-sync tag: v0.0.1 env: GLUETUN_CONTROL_SERVER_HOST: localhost GLUETUN_CONTROL_SERVER_PORT: 8000 QBITTORRENT_HOST: localhost QBITTORRENT_WEBUI_PORT: *port CRON_ENABLED: true CRON_SCHEDULE: "*/5 * * * *" LOG_TIMESTAMP: false securityContext: runAsUser: 568 runAsGroup: 568 runAsNonRoot: true allowPrivilegeEscalation: false readOnlyRootFilesystem: false capabilities: drop: - ALL service: main: ports: http: port: *port bittorrent: controller: main type: LoadBalancer annotations: io.cilium/lb-ipam-ips: 10.45.0.5 ports: bittorrent: enabled: true port: 8080 protocol: TCP ingress: main: enabled: true className: "internal-nginx" hosts: - host: "qb.jahanson.tech" paths: - path: / service: name: main port: http tls: - hosts: - "qb.jahanson.tech" persistence: config: enabled: true existingClaim: qbittorrent media: type: nfs server: 10.1.1.30 path: /mnt/Nahar/Media advancedMounts: main: main: - path: /data/nas-media