diff --git a/apps-kustomized/sabnzbd/configmap.yaml b/apps-kustomized/sabnzbd/configmap.yaml new file mode 100644 index 0000000..ee3d75b --- /dev/null +++ b/apps-kustomized/sabnzbd/configmap.yaml @@ -0,0 +1,166 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/instance: sabnzbd + name: proxy-config +data: + proxychains.conf: |- + # proxychains.conf VER 4.x + # + # HTTP, SOCKS4a, SOCKS5 tunneling proxifier with DNS. + + + # The option below identifies how the ProxyList is treated. + # only one option should be uncommented at time, + # otherwise the last appearing option will be accepted + # + #dynamic_chain + # + # Dynamic - Each connection will be done via chained proxies + # all proxies chained in the order as they appear in the list + # at least one proxy must be online to play in chain + # (dead proxies are skipped) + # otherwise EINTR is returned to the app + # + strict_chain + # + # Strict - Each connection will be done via chained proxies + # all proxies chained in the order as they appear in the list + # all proxies must be online to play in chain + # otherwise EINTR is returned to the app + # + #round_robin_chain + # + # Round Robin - Each connection will be done via chained proxies + # of chain_len length + # all proxies chained in the order as they appear in the list + # at least one proxy must be online to play in chain + # (dead proxies are skipped). + # the start of the current proxy chain is the proxy after the last + # proxy in the previously invoked proxy chain. + # if the end of the proxy chain is reached while looking for proxies + # start at the beginning again. + # otherwise EINTR is returned to the app + # These semantics are not guaranteed in a multithreaded environment. + # + #random_chain + # + # Random - Each connection will be done via random proxy + # (or proxy chain, see chain_len) from the list. + # this option is good to test your IDS :) + + # Make sense only if random_chain or round_robin_chain + #chain_len = 2 + + # Quiet mode (no output from library) + #quiet_mode + + ## Proxy DNS requests - no leak for DNS data + # (disable all of the 3 items below to not proxy your DNS requests) + + # method 1. this uses the proxychains4 style method to do remote dns: + # a thread is spawned that serves DNS requests and hands down an ip + # assigned from an internal list (via remote_dns_subnet). + # this is the easiest (setup-wise) and fastest method, however on + # systems with buggy libcs and very complex software like webbrowsers + # this might not work and/or cause crashes. + proxy_dns + + # method 2. use the old proxyresolv script to proxy DNS requests + # in proxychains 3.1 style. requires `proxyresolv` in $PATH + # plus a dynamically linked `dig` binary. + # this is a lot slower than `proxy_dns`, doesn't support .onion URLs, + # but might be more compatible with complex software like webbrowsers. + #proxy_dns_old + + # method 3. use proxychains4-daemon process to serve remote DNS requests. + # this is similar to the threaded `proxy_dns` method, however it requires + # that proxychains4-daemon is already running on the specified address. + # on the plus side it doesn't do malloc/threads so it should be quite + # compatible with complex, async-unsafe software. + # note that if you don't start proxychains4-daemon before using this, + # the process will simply hang. + #proxy_dns_daemon 127.0.0.1:1053 + + # set the class A subnet number to use for the internal remote DNS mapping + # we use the reserved 224.x.x.x range by default, + # if the proxified app does a DNS request, we will return an IP from that range. + # on further accesses to this ip we will send the saved DNS name to the proxy. + # in case some control-freak app checks the returned ip, and denies to + # connect, you can use another subnet, e.g. 10.x.x.x or 127.x.x.x. + # of course you should make sure that the proxified app does not need + # *real* access to this subnet. + # i.e. dont use the same subnet then in the localnet section + #remote_dns_subnet 127 + #remote_dns_subnet 10 + remote_dns_subnet 224 + + # Some timeouts in milliseconds + tcp_read_time_out 15000 + tcp_connect_time_out 8000 + + ### Examples for localnet exclusion + ## localnet ranges will *not* use a proxy to connect. + ## note that localnet works only when plain IP addresses are passed to the app, + ## the hostname resolves via /etc/hosts, or proxy_dns is disabled or proxy_dns_old used. + + ## Exclude connections to 192.168.1.0/24 with port 80 + # localnet 192.168.1.0:80/255.255.255.0 + + ## Exclude connections to 192.168.100.0/24 + # localnet 192.168.100.0/255.255.255.0 + + ## Exclude connections to ANYwhere with port 80 + # localnet 0.0.0.0:80/0.0.0.0 + # localnet [::]:80/0 + + ## RFC6890 Loopback address range + ## if you enable this, you have to make sure remote_dns_subnet is not 127 + ## you'll need to enable it if you want to use an application that + ## connects to localhost. + # localnet 127.0.0.0/255.0.0.0 + # localnet ::1/128 + + ## RFC1918 Private Address Ranges + # localnet 10.0.0.0/255.0.0.0 + # localnet 172.16.0.0/255.240.0.0 + # localnet 192.168.0.0/255.255.0.0 + + ### Examples for dnat + ## Trying to proxy connections to destinations which are dnatted, + ## will result in proxying connections to the new given destinations. + ## Whenever I connect to 1.1.1.1 on port 1234 actually connect to 1.1.1.2 on port 443 + # dnat 1.1.1.1:1234 1.1.1.2:443 + + ## Whenever I connect to 1.1.1.1 on port 443 actually connect to 1.1.1.2 on port 443 + ## (no need to write :443 again) + # dnat 1.1.1.2:443 1.1.1.2 + + ## No matter what port I connect to on 1.1.1.1 port actually connect to 1.1.1.2 on port 443 + # dnat 1.1.1.1 1.1.1.2:443 + + ## Always, instead of connecting to 1.1.1.1, connect to 1.1.1.2 + # dnat 1.1.1.1 1.1.1.2 + + # ProxyList format + # type ip port [user pass] + # (values separated by 'tab' or 'blank') + # + # only numeric ipv4 addresses are valid + # + # + # Examples: + # + # socks5 192.168.67.78 1080 lamer secret + # http 192.168.89.3 8080 justu hidden + # socks4 192.168.1.49 1080 + # http 192.168.39.93 8080 + # + # + # proxy types: http, socks4, socks5, raw + # * raw: The traffic is simply forwarded to the proxy without modification. + # ( auth types supported: "basic"-http "user/pass"-socks ) + # + [ProxyList] + socks4 192.168.1.5 8080 diff --git a/apps-kustomized/sabnzbd/deploy.yaml b/apps-kustomized/sabnzbd/deploy.yaml new file mode 100644 index 0000000..7b4a610 --- /dev/null +++ b/apps-kustomized/sabnzbd/deploy.yaml @@ -0,0 +1,48 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: sabnzbd + name: sabnzbd +spec: + selector: + matchLabels: + app: sabnzbd + template: + metadata: + labels: + app: sabnzbd + spec: + containers: + - image: lscr.io/linuxserver/sabnzbd:latest + imagePullPolicy: Always + name: sabnzbd + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + volumeMounts: + - mountPath: /config + name: ssd-config + - mountPath: /downloads + name: data + - mountPath: /etc/proxychains/proxychains.conf + name: proxy-config + subPath: proxychains.conf + dnsPolicy: ClusterFirst + restartPolicy: Always + schedulerName: default-scheduler + terminationGracePeriodSeconds: 30 + volumes: + - name: ssd-config + persistentVolumeClaim: + claimName: sabnzbd-config-ssd + - name: data + persistentVolumeClaim: + claimName: smb-usenet + - configMap: + defaultMode: 420 + name: proxy-config + name: proxy-config + - configMap: + defaultMode: 493 + name: s6-overlay-overlay + name: s6-overlay-overlay diff --git a/apps-kustomized/sabnzbd/pvc.yaml b/apps-kustomized/sabnzbd/pvc.yaml new file mode 100644 index 0000000..9693d1c --- /dev/null +++ b/apps-kustomized/sabnzbd/pvc.yaml @@ -0,0 +1,25 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + labels: + app.kubernetes.io/instance: sabnzbd + name: sabnzbd-config-ssd +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi + storageClassName: rook-ceph-block-ssd +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: smb-usenet +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi + storageClassName: smb-usenet diff --git a/apps-kustomized/sabnzbd/service.yaml b/apps-kustomized/sabnzbd/service.yaml new file mode 100644 index 0000000..07f089f --- /dev/null +++ b/apps-kustomized/sabnzbd/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app: sabnzbd + annotations: + external-dns.alpha.kubernetes.io/hostname: sabnzbd.martyn.berlin + name: sabnzbd +spec: + ports: + - port: 80 + targetPort: 8080 + selector: + app: sabnzbd + type: LoadBalancer diff --git a/everything-app/sabnzbd.yaml b/everything-app/sabnzbd.yaml new file mode 100644 index 0000000..79c56dd --- /dev/null +++ b/everything-app/sabnzbd.yaml @@ -0,0 +1,17 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: sabnzbd + namespace: argocd +spec: + destination: + namespace: sabnzbd + server: https://kubernetes.default.svc + project: apps + source: + path: apps-kustomized/sabnzbd + repoURL: https://git.martyn.berlin/martyn/infra4talos + targetRevision: HEAD + syncPolicy: + automated: + selfHeal: true