--- # yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2beta2.json apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease metadata: name: qbittorrent spec: interval: 30m chart: spec: chart: app-template version: 2.5.0 interval: 30m sourceRef: kind: HelmRepository name: bjw-s namespace: flux-system values: controllers: main: annotations: configmap.reloader.stakater.com/reload: qbittorrent-scripts secret.reloader.stakater.com/reload: qbittorrent-secret pod: securityContext: fsGroup: 568 fsGroupChangePolicy: "OnRootMismatch" containers: main: nameOverride: qbittorrent image: repository: ghcr.io/onedr0p/qbittorrent tag: 4.6.3@sha256:a4ad890e8c4a287c17d12ca22eb1d84a046aba2efbd882bf7d6eb12459f6a70c env: UMASK: "022" QBITTORRENT__PORT: &port 8080 QBT_Preferences__WebUI__AlternativeUIEnabled: false QBT_Preferences__WebUI__AuthSubnetWhitelistEnabled: true QBT_Preferences__WebUI__AuthSubnetWhitelist: |- 10.32.0.0/16, 10.1.2.0/24 QBT_Preferences__WebUI__LocalHostAuth: false QBT_BitTorrent__Session__Interface: wg0 QBT_BitTorrent__Session__InterfaceName: wg0 resources: requests: cpu: 49m memory: 1024Mi limits: memory: 8192Mi securityContext: runAsUser: 568 runAsGroup: 568 runAsNonRoot: true allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL gluetun: image: repository: ghcr.io/qdm12/gluetun tag: latest@sha256:80787df64a93ce0f384bf237d0e87afb95278b9bd5e124ec0f2587a0e4205078 env: VPN_SERVICE_PROVIDER: custom VPN_TYPE: wireguard VPN_INTERFACE: wg0 VPN_ENDPOINT_PORT: 51820 VPN_PORT_FORWARDING: on VPN_PORT_FORWARDING_PROVIDER: protonvpn FIREWALL_INPUT_PORTS: 8080 FIREWALL_OUTBOUND_SUBNETS: 10.32.0.0/16 # Allow access to k8s subnets envFrom: - secretRef: name: qbittorrent-secret securityContext: capabilities: add: - NET_ADMIN allowPrivilegeEscalation: false port-forward: image: repository: ghcr.io/bjw-s/gluetun-qb-port-sync tag: v0.0.1 env: GLUETUN_CONTROL_SERVER_HOST: localhost GLUETUN_CONTROL_SERVER_PORT: 8000 QBITTORRENT_HOST: localhost QBITTORRENT_WEBUI_PORT: *port CRON_ENABLED: true CRON_SCHEDULE: "*/5 * * * *" LOG_TIMESTAMP: false securityContext: runAsUser: 568 runAsGroup: 568 runAsNonRoot: true allowPrivilegeEscalation: false readOnlyRootFilesystem: false capabilities: drop: - ALL service: main: ports: http: port: *port bittorrent: controller: main type: LoadBalancer annotations: io.cilium/lb-ipam-ips: 10.45.0.5 ports: bittorrent: enabled: true port: 8080 protocol: TCP ingress: main: enabled: true className: "internal-nginx" hosts: - host: "qb.jahanson.tech" paths: - path: / service: name: main port: http tls: - hosts: - "qb.jahanson.tech" persistence: config: enabled: true existingClaim: qbittorrent media: type: nfs server: 10.1.1.11 path: /volume1/Media advancedMounts: main: main: - path: /data/nas-media