Convert all internet-facing services to ClusterIP

services/audiobookshelf/audiobookshelf-deployment.yaml

@@ -31,6 +31,7 @@ spec:
           ports:
             - containerPort: 80
               protocol: TCP
+              name: web-ui
           volumeMounts:
             - mountPath: /audiobooks
               name: audiobookshelf-audiobooks

services/audiobookshelf/audiobookshelf-ingress.yaml

@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: audiobookshelf-ingress
+  namespace: default
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  rules:
+  - host: lyrebird.mynest.love
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: audiobookshelf
+            port:
+              name: http-web

services/audiobookshelf/audiobookshelf-service.yaml

@@ -8,11 +8,10 @@ metadata:
     io.kompose.service: audiobookshelf
   name: audiobookshelf
 spec:
-  type: NodePort
+  type: ClusterIP
   ports:
-    - name: "30378"
+    - name: http-web
-      port: 30378
+      port: 80
-      targetPort: 80
+      targetPort: web-ui
-      nodePort: 30378
   selector:
     io.kompose.service: audiobookshelf

services/calibre-web/calibre-web-deployment.yaml

@@ -33,6 +33,7 @@ spec:
           ports:
             - containerPort: 8083
               protocol: TCP
+              name: web-ui
           volumeMounts:
             - mountPath: /config
               name: calibre-web-config

services/calibre-web/calibre-web-ingress.yaml

@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: calibre-web-ingress
+  namespace: default
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  rules:
+  - host: rookery.mynest.love
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: calibre-web
+            port:
+              name: http-web

services/calibre-web/calibre-web-service.yaml

@@ -5,11 +5,10 @@ metadata:
     io.kompose.service: calibre-web
   name: calibre-web
 spec:
-  type: NodePort
+  type: ClusterIP
   ports:
-    - name: "30083"
+    - name: http-web
-      port: 30083
+      port: 80
-      targetPort: 8083
+      targetPort: web-ui
-      nodePort: 30083
   selector:
     io.kompose.service: calibre-web

services/foundryvtt/foundry-vtt-deployment.yaml

@@ -53,6 +53,7 @@ spec:
           ports:
             - containerPort: 30000
               protocol: TCP
+              name: web-ui
           volumeMounts:
             - mountPath: /data
               name: foundry-vtt-volume

services/foundryvtt/foundry-vtt-ingress.yaml

@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: foundry-ingress
+  namespace: default
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  rules:
+  - host: foundry.mynest.love
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: foundry-vtt
+            port:
+              name: http-web

services/foundryvtt/foundry-vtt-service.yaml

@@ -8,10 +8,10 @@ metadata:
     io.kompose.service: foundry-vtt
   name: foundry-vtt
 spec:
-  type: NodePort
+  type: ClusterIP
   ports:
-    - port: 30000
+    - name: http-web
-      targetPort: 30000
+      port: 80
-      nodePort: 30000
+      targetPort: web-ui
   selector:
     io.kompose.service: foundry-vtt

services/jellyfin/jellyfin-deployment.yaml

@@ -33,6 +33,7 @@ spec:
           ports:
             - containerPort: 8096
               protocol: TCP
+              name: web-ui
           volumeMounts:
             - mountPath: /config
               name: jellyfin-config

services/jellyfin/jellyfin-ingress.yaml

@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: jellyfin-ingress
+  namespace: default
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  rules:
+  - host: beak.mynest.love
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: jellyfin
+            port:
+              name: http-web

services/jellyfin/jellyfin-service.yaml

@@ -8,11 +8,10 @@ metadata:
     io.kompose.service: jellyfin
   name: jellyfin
 spec:
-  type: NodePort
+  type: ClusterIP
   ports:
-    - name: "30796"
+    - name: http-web
-      port: 30796
+      port: 80
-      targetPort: 8096
+      targetPort: web-ui
-      nodePort: 30796
   selector:
     io.kompose.service: jellyfin

services/navidrome/navidrome-deployment.yaml

@@ -43,6 +43,7 @@ spec:
           ports:
             - containerPort: 4533
               protocol: TCP
+              name: http
           securityContext:
             runAsGroup: 1000
             runAsUser: 1000

services/navidrome/navidrome-ingress.yaml

@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: navidrome-ingress
+  namespace: default
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  rules:
+  - host: chirp.mynest.love
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: navidrome
+            port:
+              name: http-web

services/navidrome/navidrome-service.yaml

@@ -8,11 +8,10 @@ metadata:
     io.kompose.service: navidrome
   name: navidrome
 spec:
-  type: NodePort
+  type: ClusterIP
   ports:
-    - name: "30533"
+    - name: http-web
-      port: 30533
+      port: 80
-      targetPort: 4533
+      targetPort: http
-      nodePort: 30533
   selector:
     io.kompose.service: navidrome

services/vault/keykeeper/keykeeper-deployment.yaml

@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vault-keykeeper
+  namespace: vault
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: vault-keykeeper
+  template:
+    metadata:
+      labels:
+        app: vault-keykeeper
+    spec:
+      nodeSelector:
+        app: keykeeper # Should be Robin/some non-server node with a /keykeeper local dir
+      containers:
+      - name: vault
+        image: hashicorp/vault:latest
+        args: ["server"]
+        env:
+        - name: VAULT_LOCAL_CONFIG
+          value: |
+            storage "file" {
+              path = "/vault/file"
+            }
+            listener "tcp" {
+              address     = "0.0.0.0:8200"
+              tls_disable = 1
+            }
+            disable_mlock = true
+        - name: VAULT_API_ADDR
+          value: "http://$(HOSTNAME).vault-internal:8200"
+        - name: SKIP_SETCAP
+          value: "true"
+        - name: VAULT_ADDR
+          value: "http://127.0.0.1:8200"
+        - name: VAULT_CLUSTER_ADDR
+          value: "http://$(HOSTNAME).vault-internal:8201"
+        - name: VAULT_K8S_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: VAULT_K8S_POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        ports:
+        - containerPort: 8200
+          name: vault-ui
+        volumeMounts:
+        - name: vault-data
+          mountPath: /vault/file
+      volumes:
+      - name: vault-data
+        hostPath:
+          path: /vaultkeeper
+          type: DirectoryOrCreate

services/vault/keykeeper/keykeeper-ingress.yaml

@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: keykeeper-ingress
+  namespace: vault
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  rules:
+  - host: keykeeper.k3s.home.nest
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: vault-keykeeper
+            port:
+              name: http-web

services/vault/keykeeper/keykeeper-service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: vault-keykeeper
+  namespace: vault
+spec:
+  type: ClusterIP
+  ports:
+    - name: http-web
+      port: 8200
+      targetPort: vault-ui
+  selector:
+    app: vault-keykeeper

services/vaultwarden/vaultwarden-deployment.yaml

@@ -8,7 +8,6 @@ metadata:
     io.kompose.service: vaultwarden
   name: vaultwarden
 spec:
-  replicas: 3
   selector:
     matchLabels:
       io.kompose.service: vaultwarden
@@ -33,6 +32,7 @@ spec:
           ports:
             - containerPort: 80
               protocol: TCP
+              name: http
           securityContext:
             runAsGroup: 1000
             runAsUser: 1000

services/vaultwarden/vaultwarden-ingress.yaml

@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vaultwarden-ingress
+  namespace: default
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  rules:
+  - host: vault.mynest.love
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: vaultwarden
+            port:
+              name: http-web

services/vaultwarden/vaultwarden-service.yaml

@@ -8,10 +8,10 @@ metadata:
     io.kompose.service: vaultwarden
   name: vaultwarden
 spec:
-  type: NodePort
+  type: ClusterIP
   ports:
-    - port: 32233
+    - name: http-web
-      targetPort: 80
+      port: 80
-      nodePort: 32233
+      targetPort: http
   selector:
     io.kompose.service: vaultwarden