Auto-Upgrade services with keel. Clean up kompose junk. Break out pvcs from deployments

keel/keel.yaml

@@ -0,0 +1,72 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: keel
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: keel
+  namespace: keel
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: keel
+rules:
+  - apiGroups: ["", "apps", "batch", "extensions"]
+    resources:
+      - namespaces
+      - deployments
+      - daemonsets
+      - statefulsets
+      - cronjobs
+      - pods
+      - replicationcontrollers
+    verbs: ["get", "list", "watch", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: keel
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: keel
+subjects:
+  - kind: ServiceAccount
+    name: keel
+    namespace: keel
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: keel
+  namespace: keel
+  labels:
+    app: keel
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: keel
+  template:
+    metadata:
+      labels:
+        app: keel
+    spec:
+      serviceAccountName: keel
+      containers:
+        - name: keel
+          image: keelhq/keel:latest
+          imagePullPolicy: Always
+          env:
+            - name: POLL
+              value: "true"
+            - name: SCHEDULER_FREQUENCY
+              value: "1h"
+            - name: AUTO_UPDATE_EVERYTHING
+              value: "false"
+          ports:
+            - containerPort: 9300
+              name: keel

services/audiobookshelf/audiobookshelf-deployment.yaml

@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-abs.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: audiobookshelf
   name: audiobookshelf
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: audiobookshelf
+      app: audiobookshelf
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-abs.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: audiobookshelf
+        app: audiobookshelf
     spec:
       containers:
         - env:

services/audiobookshelf/audiobookshelf-service.yaml

@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-abs.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: audiobookshelf
   name: audiobookshelf
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: audiobookshelf
+    app: audiobookshelf

services/bazarr-anime/bazarr-anime-deployment.yaml

@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: bazarr-anime
   name: bazarr-anime
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: bazarr-anime
+      app: bazarr-anime
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: bazarr-anime
+        app: bazarr-anime
     spec:
       containers:
         - env:

services/bazarr-anime/bazarr-anime-service.yaml

@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: bazarr-anime
   name: bazarr-anime
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: bazarr-anime
+    app: bazarr-anime

services/bazarr/bazarr-deployment.yaml

@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: bazarr
   name: bazarr
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: bazarr
+      app: bazarr
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: bazarr
+        app: bazarr
     spec:
       containers:
         - env:

services/bazarr/bazarr-service.yaml

@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: bazarr
   name: bazarr
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: bazarr
+    app: bazarr

services/calibre-web/calibre-web-deployment.yaml

@@ -1,23 +1,22 @@
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels:
-    io.kompose.service: calibre-web
   name: calibre-web
   annotations:
-    reloader.stakater.com/auto: "true"
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: calibre-web
+      app: calibre-web
   strategy:
     type: Recreate
   template:
     metadata:
       labels:
-        io.kompose.service: calibre-web
+        app: calibre-web
     spec:
       containers:
         - name: calibre-web

services/calibre-web/calibre-web-service.yaml

@@ -1,8 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  labels:
-    io.kompose.service: calibre-web
   name: calibre-web
 spec:
   type: ClusterIP
@@ -11,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: calibre-web
+    app: calibre-web

services/deluge/deluge-deployment.yaml

@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: deluge
   name: deluge
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: deluge
+      app: deluge
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: deluge
+        app: deluge
     spec:
       containers:
         - env:
@@ -61,18 +57,3 @@ spec:
           nfs:
             server: robin.home.nest
             path: /yarr/downloads
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: deluge-config-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 20Mi

services/deluge/deluge-pvcs.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: deluge-config-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 20Mi

services/deluge/deluge-service.yaml

@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: deluge
   name: deluge
 spec:
   type: ClusterIP
@@ -24,4 +19,4 @@ spec:
       port: 82
       targetPort: daemon
   selector:
-    io.kompose.service: deluge
+    app: deluge

services/droppedneedle/droppedneedle-deployment.yaml

@@ -1,10 +1,11 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels:
-    app: droppedneedle
   name: droppedneedle
-  namespace: default
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:

services/droppedneedle/droppedneedle-external-secret.yaml

@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: droppedneedle-secret
+  namespace: default
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: vault-external-secrets-store
+    kind: ClusterSecretStore
+  target:
+    name: droppedneedle-secret
+    creationPolicy: Owner
+  data:
+  - secretKey: SERVICE_USER
+    remoteRef:
+      key: dropped-needle
+      property: service-user
+  - secretKey: SERVICE_PASS
+    remoteRef:
+      key: dropped-needle
+      property: service-password

services/droppedneedle/droppedneedle-pvcs.yaml

@@ -0,0 +1,66 @@
+# Note: This service changed name from musicseerr to droppedneedle
+# PVC names are immutable, so just keeping the old names
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: musicseerr-config-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 3Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: musicseerr-cache-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 3Gi
+---
+# For use by the transcoding service
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: droppedneedle-transcode-pv
+spec:
+  capacity:
+    storage: 3Ti
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: local-raid
+  local:
+    path: /mnt/raid/yarr/media/music
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - robin
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: droppedneedle-transcode-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-raid
+  resources:
+    requests:
+      storage: 3Ti

services/droppedneedle/droppedneedle-transcode.yaml

@@ -6,27 +6,34 @@ metadata:
 data:
   transcode.sh: |
     #!/bin/bash
-    WATCH_DIR="/yarr/media/music"
+    WATCH_DIR="/music"
     echo "Starting transcoder watch on $WATCH_DIR..."
     
-    # Listen for files moved into the directory (atomic renames) and direct writes
     inotifywait -m -r -e moved_to,close_write --format '%w%f' "$WATCH_DIR" | while read FILE
     do
-        # Case-insensitive check for .flac extension
         if [[ "${FILE,,}" == *.flac ]]; then
             echo "Detected new FLAC via import: $FILE"
             OPUS_FILE="${FILE%.*}.opus"
             
-            # Transcode (preserves tags natively in newer ffmpeg versions)
             ffmpeg -y -i "$FILE" -acodec libopus -ac 2 -ab 160k "$OPUS_FILE"
             
             if [ $? -eq 0 ]; then
                 echo "Transcode successful. Removing original FLAC..."
                 rm "$FILE"
                 
-                echo "Triggering DroppedNeedle library scan..."
+                echo "Triggering authenticated DroppedNeedle library scan..."
-                # Calls the DroppedNeedle service using internal Kubernetes DNS
+                # 1. Authenticate and save the session cookie to a temporary jar
-                curl -X POST http://droppedneedle.default.svc.cluster.local:8688/api/v1/library/scan/start
+                curl -s -X POST http://droppedneedle.default.svc.cluster.local:80/api/v1/auth/login \
+                     -H "Content-Type: application/json" \
+                     -d "{\"username\": \"$SERVICE_USER\", \"password\": \"$SERVICE_PASS\"}" \
+                     -c /tmp/dn_cookies.txt
+                
+                # 2. Trigger the scan using the saved session cookie
+                curl -s -X POST http://droppedneedle.default.svc.cluster.local:80/api/v1/library/scan/start \
+                     -b /tmp/dn_cookies.txt
+                
+                # 3. Clean up the cookie jar
+                rm /tmp/dn_cookies.txt
             else
                 echo "Error: FFmpeg transcode failed for $FILE"
             fi
@@ -36,10 +43,11 @@ data:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels:
-    app: droppedneedle-transcoder
   name: droppedneedle-transcoder
-  namespace: default
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
@@ -50,23 +58,27 @@ spec:
       labels:
         app: droppedneedle-transcoder
     spec:
+      nodeSelector:
+        kubernetes.io/hostname: robin
       containers:
         - name: transcoder
           image: alpine:latest
           command: ["/bin/sh", "-c"]
           args:
             - "apk add --no-cache bash inotify-tools ffmpeg curl && bash /scripts/transcode.sh"
+          envFrom:
+            - secretRef:
+                name: droppedneedle-secret
           volumeMounts:
-            - mountPath: /yarr
+            - mountPath: /music
               name: yarr
             - mountPath: /scripts
               name: script-volume
       restartPolicy: Always
       volumes:
         - name: yarr
-          nfs:
+          persistentVolumeClaim:
-            server: robin.home.nest
+            claimName: droppedneedle-transcode-pvc
-            path: /yarr
         - name: script-volume
           configMap:
             name: droppedneedle-transcoder-script

services/flaresolverr/flaresolverr-deployment.yaml

@@ -1,24 +1,20 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: flaresolverr
   name: flaresolverr
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: flaresolverr
+      app: flaresolverr
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: flaresolverr
+        app: flaresolverr
     spec:
       containers:
         - env:

services/flaresolverr/flaresolverr-service.yaml

@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: flaresolverr
   name: flaresolverr
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: flaresolverr
   selector:
-    io.kompose.service: flaresolverr
+    app: flaresolverr

services/foundryvtt/foundry-vtt-deployment.yaml

@@ -2,6 +2,10 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: foundry-vtt
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
@@ -41,18 +45,3 @@ spec:
         - name: foundry-vtt-volume
           persistentVolumeClaim:
             claimName: foundry-vtt-data-pvc
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: foundry-vtt-data-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 10Gi

services/foundryvtt/foundry-vtt-ingress.yaml

@@ -6,7 +6,6 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.middlewares: security-auth-foundryvtt@kubernetescrd
 spec:
   ingressClassName: traefik
   tls:
@@ -24,29 +23,3 @@ spec:
             name: foundry-vtt
             port:
               name: http-web
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: foundry-auth-ingress
-  namespace: security # MOVED TO SECURITY NAMESPACE
-  annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-spec:
-  ingressClassName: traefik
-  tls:
-  - hosts:
-    - foundry.mynest.love
-    secretName: foundry-vtt-tls
-  rules:
-  - host: foundry.mynest.love
-    http:
-      paths:
-      - path: /oauth2
-        pathType: Prefix
-        backend:
-          service:
-            name: oauth2-proxy-foundryvtt
-            port:
-              number: 4180

services/foundryvtt/foundry-vtt-oauth2-proxy.yaml

@@ -1,86 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: foundryvtt-proxy-foundryvtt
-  namespace: security
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: oauth2-proxy-foundryvtt
-  template:
-    metadata:
-      labels:
-        app: oauth2-proxy-foundryvtt
-    spec:
-      containers:
-      - name: oauth2-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
-        envFrom:
-          - secretRef:
-              name: foundry-oauth-secrets
-        args:
-          - "--provider=oidc"
-          - "--oidc-issuer-url=https://sso.mynest.love/realms/nest"
-          - "--oidc-groups-claim=groups"
-          - "--redirect-url=https://foundry.mynest.love/oauth2/callback"
-          - "--email-domain=*"
-          - "--allowed-group=foundryvtt"
-          - "--skip-provider-button=true"
-          - "--cookie-secure=true"
-          - "--cookie-domain=foundry.mynest.love"
-          - "--http-address=0.0.0.0:4180"
-          - "--reverse-proxy=true"
-          - "--upstream=static://200"
-          - "--whitelist-domain=foundry.mynest.love"
-        ports:
-          - containerPort: 4180
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: foundry-oauth-secrets
-  namespace: security
-spec:
-  refreshInterval: "1h"
-  secretStoreRef:
-    name: vault-external-secrets-store
-    kind: ClusterSecretStore
-  target:
-    name: foundry-oauth-secrets
-    creationPolicy: Owner
-  data:
-  - secretKey: OAUTH2_PROXY_CLIENT_ID
-    remoteRef:
-      key: oauth2-proxy/foundryvtt
-      property: client-id
-  - secretKey: OAUTH2_PROXY_CLIENT_SECRET
-    remoteRef:
-      key: oauth2-proxy/foundryvtt
-      property: client-secret
-  - secretKey: OAUTH2_PROXY_COOKIE_SECRET
-    remoteRef:
-      key: oauth2-proxy/foundryvtt
-      property: cookie-secret
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: oauth2-proxy-foundryvtt
-  namespace: security
-spec:
-  ports:
-  - port: 4180
-    targetPort: 4180
-  selector:
-    app: oauth2-proxy-foundryvtt
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: auth-foundryvtt
-  namespace: security
-spec:
-  forwardAuth:
-    address: "http://oauth2-proxy-foundryvtt.security.svc.cluster.local:4180"
-    trustForwardHeader: true

services/foundryvtt/foundry-vtt-pvcs.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: foundry-vtt-data-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 10Gi

services/jellyfin/jellyfin-deployment.yaml

@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-jellyfin.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: jellyfin
   name: jellyfin
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: jellyfin
+      app: jellyfin
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-jellyfin.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: jellyfin
+        app: jellyfin
     spec:
       containers:
         - env:
@@ -53,33 +49,3 @@ spec:
           nfs:
             server: robin.home.nest
             path: /yarr/media
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-config-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 3Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-cache-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 3Gi

services/jellyfin/jellyfin-pvcs.yaml

@@ -1,9 +1,7 @@
-# Note: This service changed name from musicseerr to droppedneedle
-# PVC names are immutable, so just keeping the old names
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: musicseerr-config-pvc
+  name: jellyfin-config-pvc
   labels:
     recurring-job.longhorn.io/source: "enabled"
     recurring-job-group.longhorn.io/app-config-group: "enabled"
@@ -18,7 +16,7 @@ spec:
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: musicseerr-cache-pvc
+  name: jellyfin-cache-pvc
   labels:
     recurring-job.longhorn.io/source: "enabled"
     recurring-job-group.longhorn.io/app-config-group: "enabled"

services/jellyfin/jellyfin-service.yaml

@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-jellyfin.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: jellyfin
   name: jellyfin
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: jellyfin
+    app: jellyfin

services/keycloak/keycloak-pvc.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: security
   labels:
     recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/critical-data: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
 spec:
   accessModes: ["ReadWriteOnce"]
   storageClassName: "longhorn"

services/prowlarr/prowlarr-deployment.yaml

@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: prowlarr
   name: prowlarr
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: prowlarr
+      app: prowlarr
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: prowlarr
+        app: prowlarr
     spec:
       containers:
         - env:

services/prowlarr/prowlarr-service.yaml

@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: prowlarr
   name: prowlarr
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: prowlarr
+    app: prowlarr

services/radarr-anime/radarr-anime-deployment.yaml

@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: radarr-anime
   name: radarr-anime
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: radarr-anime
+      app: radarr-anime
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: radarr-anime
+        app: radarr-anime
     spec:
       containers:
         - env:
@@ -56,18 +52,3 @@ spec:
           nfs:
             server: robin.home.nest
             path: /yarr/downloads
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: radarr-anime-config-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 150Mi

services/radarr-anime/radarr-anime-pvcs.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: radarr-anime-config-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 150Mi

services/radarr-anime/radarr-anime-service.yaml

@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: radarr-anime
   name: radarr-anime
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: radarr-anime
+    app: radarr-anime

services/radarr/radarr-deployment.yaml

@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: radarr
   name: radarr
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: radarr
+      app: radarr
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: radarr
+        app: radarr
     spec:
       containers:
         - env:
@@ -56,18 +52,3 @@ spec:
           nfs:
             server: robin.home.nest
             path: /yarr/downloads
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: radarr-config-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 150Mi

services/radarr/radarr-pvcs.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: radarr-config-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 150Mi

services/radarr/radarr-service.yaml

@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: radarr
   name: radarr
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: radarr
+    app: radarr

services/sabnzbd/sabnzbd-deployment.yaml

@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: sabnzbd
   name: sabnzbd
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: sabnzbd
+      app: sabnzbd
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: sabnzbd
+        app: sabnzbd
     spec:
       containers:
         - env:
@@ -50,18 +46,3 @@ spec:
           nfs:
             server: robin.home.nest
             path: /yarr/downloads
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: sabnzbd-config-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 50Mi

services/sabnzbd/sabnzbd-pvcs.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sabnzbd-config-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 50Mi

services/sabnzbd/sabnzbd-service.yaml

@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: sabnzbd
   name: sabnzbd
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: sabnzbd
+    app: sabnzbd

services/seerr/seerr-deployment.yaml

@@ -1,9 +1,11 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels:
-    app: seerr
   name: seerr
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:

services/shelfmark/shelfmark-deployment.yaml

@@ -2,9 +2,10 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: shelfmark
-  namespace: default
   annotations:
-    reloader.stakater.com/auto: "true"
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   strategy:

services/slskd/slskd-deployment.yaml

@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: slskd
   name: slskd
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: slskd
+      app: slskd
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: slskd
+        app: slskd
     spec:
       containers:
         - env:

services/slskd/slskd-service.yaml

@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: slskd
   name: slskd
 spec:
   type: ClusterIP
@@ -17,4 +12,4 @@ spec:
       port: 81
       targetPort: slskd-listen
   selector:
-    io.kompose.service: slskd
+    app: slskd

services/sonarr-anime/sonarr-anime-deployment.yaml

@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: sonarr-anime
   name: sonarr-anime
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: sonarr-anime
+      app: sonarr-anime
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: sonarr-anime
+        app: sonarr-anime
     spec:
       containers:
         - env:
@@ -56,18 +52,3 @@ spec:
           nfs:
             server: robin.home.nest
             path: /yarr/downloads
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: sonarr-anime-config-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 200Mi

services/sonarr-anime/sonarr-anime-pvcs.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sonarr-anime-config-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 200Mi

services/sonarr-anime/sonarr-anime-service.yaml

@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: sonarr-anime
   name: sonarr-anime
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: sonarr-anime
+    app: sonarr-anime

services/sonarr/sonarr-deployment.yaml

@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: sonarr
   name: sonarr
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: sonarr
+      app: sonarr
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: sonarr
+        app: sonarr
     spec:
       containers:
         - env:
@@ -56,18 +52,3 @@ spec:
           nfs:
             server: robin.home.nest
             path: /yarr/downloads
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: sonarr-config-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 150Mi

services/sonarr/sonarr-pvcs.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sonarr-config-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 150Mi

services/sonarr/sonarr-service.yaml

@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: sonarr
   name: sonarr
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: sonarr
+    app: sonarr

services/tdarr/tdarr-deployment.yaml

@@ -2,6 +2,10 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: tdarr-server
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
@@ -62,6 +66,10 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: tdarr-node-cpu
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:

services/tdarr/tdarr-pvcs.yaml

@@ -2,6 +2,9 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: tdarr-config-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
 spec:
   accessModes:
     - ReadWriteOnce
@@ -14,6 +17,9 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: tdarr-cache-rwx
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
 spec:
   accessModes:
     - ReadWriteMany
@@ -26,6 +32,9 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: tdarr-db-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
 spec:
   accessModes:
     - ReadWriteOnce

services/vaultwarden/vaultwarden-deployment.yaml

@@ -1,25 +1,21 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: vaultwarden
   name: vaultwarden
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   selector:
     matchLabels:
-      io.kompose.service: vaultwarden
+      app: vaultwarden
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: vaultwarden
+        app: vaultwarden
     spec:
       containers:
         - env:
@@ -44,18 +40,3 @@ spec:
         - name: vaultwarden-volume
           persistentVolumeClaim:
             claimName: vaultwarden-data-pvc
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: vaultwarden-data-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 40Mi

services/vaultwarden/vaultwarden-pvcs.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: vaultwarden-data-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 40Mi

services/vaultwarden/vaultwarden-service.yaml

@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: vaultwarden
   name: vaultwarden
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: http
   selector:
-    io.kompose.service: vaultwarden
+    app: vaultwarden