From b696349b025b04a551442a034e9ead44fa895afe Mon Sep 17 00:00:00 2001
From: Astra Logical <booksandpi@gmail.com>
Date: Sun, 5 Apr 2026 16:47:11 -0400
Subject: [PATCH] Convert all internet-facing services to ClusterIP

---
 .../audiobookshelf-deployment.yaml            |  1 +
 .../audiobookshelf-ingress.yaml               | 19 ++++++
 .../audiobookshelf-service.yaml               |  9 ++-
 .../calibre-web/calibre-web-deployment.yaml   |  1 +
 services/calibre-web/calibre-web-ingress.yaml | 19 ++++++
 services/calibre-web/calibre-web-service.yaml |  9 ++-
 .../foundryvtt/foundry-vtt-deployment.yaml    |  1 +
 services/foundryvtt/foundry-vtt-ingress.yaml  | 19 ++++++
 services/foundryvtt/foundry-vtt-service.yaml  |  8 +--
 services/jellyfin/jellyfin-deployment.yaml    |  1 +
 services/jellyfin/jellyfin-ingress.yaml       | 19 ++++++
 services/jellyfin/jellyfin-service.yaml       |  9 ++-
 services/navidrome/navidrome-deployment.yaml  |  1 +
 services/navidrome/navidrome-ingress.yaml     | 19 ++++++
 services/navidrome/navidrome-service.yaml     |  9 ++-
 .../vault/keykeeper/keykeeper-deployment.yaml | 59 +++++++++++++++++++
 .../vault/keykeeper/keykeeper-ingress.yaml    | 19 ++++++
 .../vault/keykeeper/keykeeper-service.yaml    | 13 ++++
 .../vaultwarden/vaultwarden-deployment.yaml   |  2 +-
 services/vaultwarden/vaultwarden-ingress.yaml | 19 ++++++
 services/vaultwarden/vaultwarden-service.yaml |  8 +--
 21 files changed, 235 insertions(+), 29 deletions(-)
 create mode 100644 services/audiobookshelf/audiobookshelf-ingress.yaml
 create mode 100644 services/calibre-web/calibre-web-ingress.yaml
 create mode 100644 services/foundryvtt/foundry-vtt-ingress.yaml
 create mode 100644 services/jellyfin/jellyfin-ingress.yaml
 create mode 100644 services/navidrome/navidrome-ingress.yaml
 create mode 100644 services/vault/keykeeper/keykeeper-deployment.yaml
 create mode 100644 services/vault/keykeeper/keykeeper-ingress.yaml
 create mode 100644 services/vault/keykeeper/keykeeper-service.yaml
 create mode 100644 services/vaultwarden/vaultwarden-ingress.yaml

diff --git a/services/audiobookshelf/audiobookshelf-deployment.yaml b/services/audiobookshelf/audiobookshelf-deployment.yaml
index 4a010d2..79d4b05 100644
--- a/services/audiobookshelf/audiobookshelf-deployment.yaml
+++ b/services/audiobookshelf/audiobookshelf-deployment.yaml
@@ -31,6 +31,7 @@ spec:
           ports:
             - containerPort: 80
               protocol: TCP
+              name: web-ui
           volumeMounts:
             - mountPath: /audiobooks
               name: audiobookshelf-audiobooks
diff --git a/services/audiobookshelf/audiobookshelf-ingress.yaml b/services/audiobookshelf/audiobookshelf-ingress.yaml
new file mode 100644
index 0000000..d143317
--- /dev/null
+++ b/services/audiobookshelf/audiobookshelf-ingress.yaml
@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: audiobookshelf-ingress
+  namespace: default
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  rules:
+  - host: lyrebird.mynest.love
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: audiobookshelf
+            port:
+              name: http-web
diff --git a/services/audiobookshelf/audiobookshelf-service.yaml b/services/audiobookshelf/audiobookshelf-service.yaml
index ae892e5..5475b77 100644
--- a/services/audiobookshelf/audiobookshelf-service.yaml
+++ b/services/audiobookshelf/audiobookshelf-service.yaml
@@ -8,11 +8,10 @@ metadata:
     io.kompose.service: audiobookshelf
   name: audiobookshelf
 spec:
-  type: NodePort
+  type: ClusterIP
   ports:
-    - name: "30378"
-      port: 30378
-      targetPort: 80
-      nodePort: 30378
+    - name: http-web
+      port: 80
+      targetPort: web-ui
   selector:
     io.kompose.service: audiobookshelf
diff --git a/services/calibre-web/calibre-web-deployment.yaml b/services/calibre-web/calibre-web-deployment.yaml
index 747f846..cb9284a 100644
--- a/services/calibre-web/calibre-web-deployment.yaml
+++ b/services/calibre-web/calibre-web-deployment.yaml
@@ -33,6 +33,7 @@ spec:
           ports:
             - containerPort: 8083
               protocol: TCP
+              name: web-ui
           volumeMounts:
             - mountPath: /config
               name: calibre-web-config
diff --git a/services/calibre-web/calibre-web-ingress.yaml b/services/calibre-web/calibre-web-ingress.yaml
new file mode 100644
index 0000000..ad01b0f
--- /dev/null
+++ b/services/calibre-web/calibre-web-ingress.yaml
@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: calibre-web-ingress
+  namespace: default
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  rules:
+  - host: rookery.mynest.love
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: calibre-web
+            port:
+              name: http-web
diff --git a/services/calibre-web/calibre-web-service.yaml b/services/calibre-web/calibre-web-service.yaml
index bd6a480..84b2306 100644
--- a/services/calibre-web/calibre-web-service.yaml
+++ b/services/calibre-web/calibre-web-service.yaml
@@ -5,11 +5,10 @@ metadata:
     io.kompose.service: calibre-web
   name: calibre-web
 spec:
-  type: NodePort
+  type: ClusterIP
   ports:
-    - name: "30083"
-      port: 30083
-      targetPort: 8083
-      nodePort: 30083
+    - name: http-web
+      port: 80
+      targetPort: web-ui
   selector:
     io.kompose.service: calibre-web
diff --git a/services/foundryvtt/foundry-vtt-deployment.yaml b/services/foundryvtt/foundry-vtt-deployment.yaml
index 1fcada4..5a8c971 100644
--- a/services/foundryvtt/foundry-vtt-deployment.yaml
+++ b/services/foundryvtt/foundry-vtt-deployment.yaml
@@ -53,6 +53,7 @@ spec:
           ports:
             - containerPort: 30000
               protocol: TCP
+              name: web-ui
           volumeMounts:
             - mountPath: /data
               name: foundry-vtt-volume
diff --git a/services/foundryvtt/foundry-vtt-ingress.yaml b/services/foundryvtt/foundry-vtt-ingress.yaml
new file mode 100644
index 0000000..c0163b0
--- /dev/null
+++ b/services/foundryvtt/foundry-vtt-ingress.yaml
@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: foundry-ingress
+  namespace: default
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  rules:
+  - host: foundry.mynest.love
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: foundry-vtt
+            port:
+              name: http-web
diff --git a/services/foundryvtt/foundry-vtt-service.yaml b/services/foundryvtt/foundry-vtt-service.yaml
index fc5fd79..d54d53b 100644
--- a/services/foundryvtt/foundry-vtt-service.yaml
+++ b/services/foundryvtt/foundry-vtt-service.yaml
@@ -8,10 +8,10 @@ metadata:
     io.kompose.service: foundry-vtt
   name: foundry-vtt
 spec:
-  type: NodePort
+  type: ClusterIP
   ports:
-    - port: 30000
-      targetPort: 30000
-      nodePort: 30000
+    - name: http-web
+      port: 80
+      targetPort: web-ui
   selector:
     io.kompose.service: foundry-vtt
diff --git a/services/jellyfin/jellyfin-deployment.yaml b/services/jellyfin/jellyfin-deployment.yaml
index 4d91853..4cdb440 100644
--- a/services/jellyfin/jellyfin-deployment.yaml
+++ b/services/jellyfin/jellyfin-deployment.yaml
@@ -33,6 +33,7 @@ spec:
           ports:
             - containerPort: 8096
               protocol: TCP
+              name: web-ui
           volumeMounts:
             - mountPath: /config
               name: jellyfin-config
diff --git a/services/jellyfin/jellyfin-ingress.yaml b/services/jellyfin/jellyfin-ingress.yaml
new file mode 100644
index 0000000..8c6b0a1
--- /dev/null
+++ b/services/jellyfin/jellyfin-ingress.yaml
@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: jellyfin-ingress
+  namespace: default
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  rules:
+  - host: beak.mynest.love
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: jellyfin
+            port:
+              name: http-web
diff --git a/services/jellyfin/jellyfin-service.yaml b/services/jellyfin/jellyfin-service.yaml
index c676056..1451810 100644
--- a/services/jellyfin/jellyfin-service.yaml
+++ b/services/jellyfin/jellyfin-service.yaml
@@ -8,11 +8,10 @@ metadata:
     io.kompose.service: jellyfin
   name: jellyfin
 spec:
-  type: NodePort
+  type: ClusterIP
   ports:
-    - name: "30796"
-      port: 30796
-      targetPort: 8096
-      nodePort: 30796
+    - name: http-web
+      port: 80
+      targetPort: web-ui
   selector:
     io.kompose.service: jellyfin
diff --git a/services/navidrome/navidrome-deployment.yaml b/services/navidrome/navidrome-deployment.yaml
index 1421668..3088608 100644
--- a/services/navidrome/navidrome-deployment.yaml
+++ b/services/navidrome/navidrome-deployment.yaml
@@ -43,6 +43,7 @@ spec:
           ports:
             - containerPort: 4533
               protocol: TCP
+              name: http
           securityContext:
             runAsGroup: 1000
             runAsUser: 1000
diff --git a/services/navidrome/navidrome-ingress.yaml b/services/navidrome/navidrome-ingress.yaml
new file mode 100644
index 0000000..9b68ab9
--- /dev/null
+++ b/services/navidrome/navidrome-ingress.yaml
@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: navidrome-ingress
+  namespace: default
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  rules:
+  - host: chirp.mynest.love
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: navidrome
+            port:
+              name: http-web
diff --git a/services/navidrome/navidrome-service.yaml b/services/navidrome/navidrome-service.yaml
index 8023647..74d2f66 100644
--- a/services/navidrome/navidrome-service.yaml
+++ b/services/navidrome/navidrome-service.yaml
@@ -8,11 +8,10 @@ metadata:
     io.kompose.service: navidrome
   name: navidrome
 spec:
-  type: NodePort
+  type: ClusterIP
   ports:
-    - name: "30533"
-      port: 30533
-      targetPort: 4533
-      nodePort: 30533
+    - name: http-web
+      port: 80
+      targetPort: http
   selector:
     io.kompose.service: navidrome
diff --git a/services/vault/keykeeper/keykeeper-deployment.yaml b/services/vault/keykeeper/keykeeper-deployment.yaml
new file mode 100644
index 0000000..41e0fef
--- /dev/null
+++ b/services/vault/keykeeper/keykeeper-deployment.yaml
@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vault-keykeeper
+  namespace: vault
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: vault-keykeeper
+  template:
+    metadata:
+      labels:
+        app: vault-keykeeper
+    spec:
+      nodeSelector:
+        app: keykeeper # Should be Robin/some non-server node with a /keykeeper local dir
+      containers:
+      - name: vault
+        image: hashicorp/vault:latest
+        args: ["server"]
+        env:
+        - name: VAULT_LOCAL_CONFIG
+          value: |
+            storage "file" {
+              path = "/vault/file"
+            }
+            listener "tcp" {
+              address     = "0.0.0.0:8200"
+              tls_disable = 1
+            }
+            disable_mlock = true
+        - name: VAULT_API_ADDR
+          value: "http://$(HOSTNAME).vault-internal:8200"
+        - name: SKIP_SETCAP
+          value: "true"
+        - name: VAULT_ADDR
+          value: "http://127.0.0.1:8200"
+        - name: VAULT_CLUSTER_ADDR
+          value: "http://$(HOSTNAME).vault-internal:8201"
+        - name: VAULT_K8S_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: VAULT_K8S_POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        ports:
+        - containerPort: 8200
+          name: vault-ui
+        volumeMounts:
+        - name: vault-data
+          mountPath: /vault/file
+      volumes:
+      - name: vault-data
+        hostPath:
+          path: /vaultkeeper
+          type: DirectoryOrCreate
diff --git a/services/vault/keykeeper/keykeeper-ingress.yaml b/services/vault/keykeeper/keykeeper-ingress.yaml
new file mode 100644
index 0000000..d810555
--- /dev/null
+++ b/services/vault/keykeeper/keykeeper-ingress.yaml
@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: keykeeper-ingress
+  namespace: vault
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  rules:
+  - host: keykeeper.k3s.home.nest
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: vault-keykeeper
+            port:
+              name: http-web
diff --git a/services/vault/keykeeper/keykeeper-service.yaml b/services/vault/keykeeper/keykeeper-service.yaml
new file mode 100644
index 0000000..ccfc102
--- /dev/null
+++ b/services/vault/keykeeper/keykeeper-service.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: vault-keykeeper
+  namespace: vault
+spec:
+  type: ClusterIP
+  ports:
+    - name: http-web
+      port: 8200
+      targetPort: vault-ui
+  selector:
+    app: vault-keykeeper
diff --git a/services/vaultwarden/vaultwarden-deployment.yaml b/services/vaultwarden/vaultwarden-deployment.yaml
index 0526310..398d8e6 100644
--- a/services/vaultwarden/vaultwarden-deployment.yaml
+++ b/services/vaultwarden/vaultwarden-deployment.yaml
@@ -8,7 +8,6 @@ metadata:
     io.kompose.service: vaultwarden
   name: vaultwarden
 spec:
-  replicas: 3
   selector:
     matchLabels:
       io.kompose.service: vaultwarden
@@ -33,6 +32,7 @@ spec:
           ports:
             - containerPort: 80
               protocol: TCP
+              name: http
           securityContext:
             runAsGroup: 1000
             runAsUser: 1000
diff --git a/services/vaultwarden/vaultwarden-ingress.yaml b/services/vaultwarden/vaultwarden-ingress.yaml
new file mode 100644
index 0000000..10f300d
--- /dev/null
+++ b/services/vaultwarden/vaultwarden-ingress.yaml
@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vaultwarden-ingress
+  namespace: default
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  rules:
+  - host: vault.mynest.love
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: vaultwarden
+            port:
+              name: http-web
diff --git a/services/vaultwarden/vaultwarden-service.yaml b/services/vaultwarden/vaultwarden-service.yaml
index f984904..35d8fbd 100644
--- a/services/vaultwarden/vaultwarden-service.yaml
+++ b/services/vaultwarden/vaultwarden-service.yaml
@@ -8,10 +8,10 @@ metadata:
     io.kompose.service: vaultwarden
   name: vaultwarden
 spec:
-  type: NodePort
+  type: ClusterIP
   ports:
-    - port: 32233
-      targetPort: 80
-      nodePort: 32233
+    - name: http-web
+      port: 80
+      targetPort: http
   selector:
     io.kompose.service: vaultwarden