Musicseerr plus move jellyseerr to internt and OIDC

data-restorer.yaml

@@ -7,11 +7,11 @@ spec:
   containers:
   - name: alpine
     image: alpine:latest
-    command: ["/bin/sh", "-c", "apk add --no-cache vim && sleep infinity"]
+    command: ["/bin/sh", "-c", "apk add --no-cache vim rsync coreutils && sleep infinity"]
     volumeMounts:
     - mountPath: /restore
       name: target-volume
   volumes:
   - name: target-volume
     persistentVolumeClaim:
-      claimName: jellyfin-config-pvc
+      claimName: jellyseerr-data-pvc

services/jellyseerr/jellyseerr-deployment.yaml

@@ -1,26 +1,20 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-jellyfin.yaml
-    kompose.version: 1.38.0 (HEAD)
   labels:
-    io.kompose.service: jellyseerr
+    app: jellyseerr
   name: jellyseerr
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: jellyseerr
+      app: jellyseerr
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-jellyfin.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: jellyseerr
+        app: jellyseerr
     spec:
       containers:
         - env:
@@ -32,7 +26,7 @@ spec:
               value: "3000"
             - name: TZ
               value: America/New_York
-          image: fallenbagel/jellyseerr:latest
+          image: fallenbagel/jellyseerr:preview-OIDC
           name: jellyseerr
           ports:
             - containerPort: 5055
@@ -46,18 +40,3 @@ spec:
         - name: jellyseerr-volume
           persistentVolumeClaim:
             claimName: jellyseerr-data-pvc
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyseerr-data-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 20Mi

services/jellyseerr/jellyseerr-ingress.yaml

@@ -4,10 +4,16 @@ metadata:
   name: jellyseerr-ingress
   namespace: default
   annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: web
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
+  tls:
+  - hosts:
+    - stork.mynest.love
+    secretName: jellyseerr-tls
   rules:
-  - host: jellyseerr.k3s.home.nest
+  - host: stork.mynest.love
     http:
       paths:
       - path: /

services/jellyseerr/jellyseerr-pvc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyseerr-data-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 20Mi

services/jellyseerr/jellyseerr-service.yaml

@@ -1,11 +1,8 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-jellyfin.yaml
-    kompose.version: 1.38.0 (HEAD)
   labels:
-    io.kompose.service: jellyseerr
+    app: jellyseerr
   name: jellyseerr
 spec:
   type: ClusterIP
@@ -14,4 +11,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: jellyseerr
+    app: jellyseerr

services/musicseerr/musicseerr-deployment.yaml

@@ -0,0 +1,91 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: musicseerr
+  name: musicseerr
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: musicseerr
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: musicseerr
+    spec:
+      containers:
+        - name: musicseerr
+          image: ghcr.io/habirabbu/musicseerr:latest
+          ports:
+            - containerPort: 8688
+              protocol: TCP
+              name: web-ui
+          envFrom:
+            - secretRef:
+                name: musicseerr-secrets
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: PORT
+              value: "8688"
+            - name: TZ
+              value: "America/New_York"
+            - name: UVICORN_PROXY_HEADERS
+              value: "true"
+            - name: UVICORN_FORWARDED_ALLOW_IPS
+              value: "*"
+          volumeMounts:
+            - mountPath: /app/config
+              name: musicseerr-config
+            - mountPath: /app/cache
+              name: musicseerr-cache
+            - mountPath: /music
+              name: yarr
+      restartPolicy: Always
+      volumes:
+        - name: musicseerr-config
+          persistentVolumeClaim:
+            claimName: musicseerr-config-pvc
+        - name: musicseerr-cache
+          persistentVolumeClaim:
+            claimName: musicseerr-cache-pvc
+        - name: yarr
+          nfs:
+            server: robin.home.nest
+            path: /yarr/media
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: musicseerr-config-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 3Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: musicseerr-cache-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 3Gi

services/musicseerr/musicseerr-external-secrets.yaml

@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: musicseerr-secrets
+  namespace: default
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: vault-external-secrets-store
+    kind: ClusterSecretStore
+  target:
+    name: musicseerr-secrets
+    creationPolicy: Owner
+  data:
+  - secretKey: OIDC_CLIENT_ID
+    remoteRef:
+      key: oauth2-proxy/musicseerr
+      property: client-id
+  - secretKey: OIDC_CLIENT_SECRET
+    remoteRef:
+      key: oauth2-proxy/musicseerr
+      property: client-secret

services/musicseerr/musicseerr-ingress.yaml

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: musicseerr-ingress
+  namespace: default
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/custom-request-headers: "X-Forwarded-Proto:https"
+spec:
+  tls:
+  - hosts:
+    - heron.mynest.love
+    secretName: musicseerr-tls
+  rules:
+  - host: heron.mynest.love
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: musicseerr
+            port:
+              name: http-web

services/musicseerr/musicseerr-service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: musicseerr
+  name: musicseerr
+  namespace: default
+spec:
+  type: ClusterIP
+  ports:
+    - name: http-web
+      port: 80
+      targetPort: web-ui
+  selector:
+    app: musicseerr