New attempt at migrating PVR stack

services/PVR/deploy-NZBHydra.yml

@@ -4,12 +4,10 @@ metadata:
   name: nzbhydra
   namespace: pvr
 spec:
-  type: NodePort
   ports:
     - protocol: TCP
       name: web
       port: 5076
-      nodePort: 30010
   selector:
     app: nzbhydra
 ---
@@ -40,15 +38,15 @@ spec:
         - mountPath: /config
           name: flexvolsmb-nzbhydra-config
         - mountPath: /downloads
-          name: flexvolsmb-pvr-downloads
+          name: smb-pvr-volatile
           subPath: downloads
       volumes:
       - name: flexvolsmb-nzbhydra-config
         persistentVolumeClaim:
           claimName: flexvolsmb-nzbhydra-config
-      - name: flexvolsmb-pvr-downloads
+      - name: smb-pvr-volatile
         persistentVolumeClaim:
-          claimName: flexvolsmb-pvr-downloads
+          claimName: smb-pvr-volatile
 ---
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
@@ -65,7 +63,14 @@ spec:
     - name: nzbhydra
       port: 5076
     middlewares:
-      - name: ldap-authentication@file
+      - name: 2fa-authentication@file
+      - name: security-headers@file
+  - match: Host(`index.pvr.spamasaurus.com`) && (Headers(`X-Api-Key`, `<removed>`) || Query(`apikey=<removed>`))
+    kind: Rule
+    services:
+    - name: nzbhydra
+      port: 5076
+    middlewares:
       - name: security-headers@file
   tls:
     options:

services/PVR/deploy-Radarr.yml

@@ -4,12 +4,10 @@ metadata:
   name: radarr
   namespace: pvr
 spec:
-  type: NodePort
   ports:
     - protocol: TCP
       name: web
       port: 7878
-      nodePort: 30020
   selector:
     app: radarr
 ---
@@ -42,7 +40,7 @@ spec:
         - mountPath: /movies
           name: flexvolsmb-pvr-movies
         - mountPath: /downloads
-          name: flexvolsmb-pvr-downloads
+          name: smb-pvr-volatile
           subPath: downloads
       volumes:
       - name: flexvolsmb-radarr-config
@@ -51,9 +49,9 @@ spec:
       - name: flexvolsmb-pvr-movies
         persistentVolumeClaim:
           claimName: flexvolsmb-pvr-movies
-      - name: flexvolsmb-pvr-downloads
+      - name: smb-pvr-volatile
         persistentVolumeClaim:
-          claimName: flexvolsmb-pvr-downloads
+          claimName: smb-pvr-volatile
 ---
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
@@ -70,7 +68,14 @@ spec:
     - name: radarr
       port: 7878
     middlewares:
-      - name: ldap-authentication@file
+      - name: 2fa-authentication@file
+      - name: security-headers@file
+  - match: Host(`movies.pvr.spamasaurus.com`) && (Headers(`X-Api-Key`, `<removed>`) || Query(`apikey=<removed>`))
+    kind: Rule
+    services:
+    - name: radarr
+      port: 7878
+    middlewares:
       - name: security-headers@file
   tls:
     options:

services/PVR/deploy-SABnzbd.yml

@@ -4,12 +4,10 @@ metadata:
   name: sabnzbd
   namespace: pvr
 spec:
-  type: NodePort
   ports:
     - protocol: TCP
       name: web
       port: 8080
-      nodePort: 30030
   selector:
     app: sabnzbd
 ---
@@ -37,21 +35,22 @@ spec:
           - name: web
             containerPort: 8080
         volumeMounts:
-        - mountPath: /config
+        - mountPath: /config/sabnzbd.ini
+          subPath: sabnzbd.ini
           name: flexvolsmb-sabnzbd-config
         - mountPath: /downloads
-          name: flexvolsmb-pvr-downloads
           subPath: downloads
+          name: smb-pvr-volatile
         - mountPath: /incomplete-downloads
-          name: flexvolsmb-pvr-downloads
           subPath: incomplete-downloads
+          name: smb-pvr-volatile
       volumes:
       - name: flexvolsmb-sabnzbd-config
         persistentVolumeClaim:
           claimName: flexvolsmb-sabnzbd-config
-      - name: flexvolsmb-pvr-downloads
+      - name: smb-pvr-volatile
         persistentVolumeClaim:
-          claimName: flexvolsmb-pvr-downloads
+          claimName: smb-pvr-volatile
 ---
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
@@ -68,7 +67,14 @@ spec:
     - name: sabnzbd
       port: 8080
     middlewares:
-      - name: ldap-authentication@file
+      - name: 2fa-authentication@file
+      - name: security-headers@file
+  - match: Host(`download.pvr.spamasaurus.com`) && (Headers(`X-Api-Key`, `<removed>`) || Query(`apikey=<removed>`))
+    kind: Rule
+    services:
+    - name: sabnzbd
+      port: 8080
+    middlewares:
       - name: security-headers@file
   tls:
     options:

services/PVR/deploy-Sonarr.yml

@@ -4,12 +4,10 @@ metadata:
   name: sonarr
   namespace: pvr
 spec:
-  type: NodePort
   ports:
     - protocol: TCP
       name: web
       port: 8989
-      nodePort: 30040
   selector:
     app: sonarr
 ---
@@ -42,7 +40,7 @@ spec:
         - mountPath: /tv
           name: flexvolsmb-pvr-series
         - mountPath: /downloads
-          name: flexvolsmb-pvr-downloads
+          name: smb-pvr-volatile
           subPath: downloads
       volumes:
       - name: flexvolsmb-sonarr-config
@@ -51,9 +49,9 @@ spec:
       - name: flexvolsmb-pvr-series
         persistentVolumeClaim:
           claimName: flexvolsmb-pvr-series
-      - name: flexvolsmb-pvr-downloads
+      - name: smb-pvr-volatile
         persistentVolumeClaim:
-          claimName: flexvolsmb-pvr-downloads
+          claimName: smb-pvr-volatile
 ---
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
@@ -70,7 +68,14 @@ spec:
     - name: sonarr
       port: 8989
     middlewares:
-      - name: ldap-authentication@file
+      - name: 2fa-authentication@file
+      - name: security-headers@file
+  - match: Host(`series.pvr.spamasaurus.com`) && (Headers(`X-Api-Key`, `<removed>`) || Query(`apikey=<removed>`))
+    kind: Rule
+    services:
+    - name: sonarr
+      port: 8989
+    middlewares:
       - name: security-headers@file
   tls:
     options:

services/PVR/persistentVolumeClaim-PVR.yml

@@ -1,38 +1,5 @@
 apiVersion: v1
 kind: PersistentVolume
-metadata:
-  name: flexvolsmb-pvr-downloads
-  namespace: pvr
-spec:
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  storageClassName: flexvolsmb-pvr-downloads
-  flexVolume:
-    driver: mount/smb
-    secretRef:
-      name: smb-secret
-    options:
-      opts: domain=bessems.eu,file_mode=0777,dir_mode=0777,iocharset=utf8,cache=none
-      server: 192.168.11.225
-      share: /Volatile/downloads
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: flexvolsmb-pvr-downloads
-  namespace: pvr
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: flexvolsmb-pvr-downloads
-  resources:
-    requests:
-      storage: 1Gi
----
-apiVersion: v1
-kind: PersistentVolume
 metadata:
   name: flexvolsmb-pvr-movies
   namespace: pvr

services/PVR/storageClass-PVR.yml

@@ -0,0 +1,30 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: pvr
+provisioner: smb.csi.k8s.io
+parameters:
+  source: "//192.168.11.225/K3s.StorageClass/pvr"
+  csi.storage.k8s.io/node-stage-secret-name: "smb-credentials"
+  csi.storage.k8s.io/node-stage-secret-namespace: "default"
+  createSubDir: "true"  # optional: create a sub dir for new volume
+reclaimPolicy: Retain  # only retain is supported
+volumeBindingMode: Immediate
+mountOptions:
+  - dir_mode=0777
+  - file_mode=0777
+  - iocharset=utf8
+  - cache=none
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: smb-pvr-volatile
+  namespace: pvr
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: pvr
+  resources:
+    requests:
+      storage: 50Gi