aaron/infra-core
1
0
Fork 2
Code Issues Pull requests 12 Projects Releases 1 Packages Wiki Activity Actions

[HOM-56] ARR stack manifests — VPN-isolated qBittorrent + indexers + Recyclarr #255

Open
aaron wants to merge 3 commits from paperclip/HOM-56-arr-stack into live
pull from: paperclip/HOM-56-arr-stack
merge into: aaron:live
Conversation 0 Commits 3 Files changed 16 +854
aaron commented 2026-06-18 04:17:11 +00:00
Owner
Copy link

Deploys the core ARR stack per HOM-56 and the security design note.

What changed

  • media-downloads namespace (privileged) with dedicated NFS PV/PVC bound to the same Proxmox export as media.
  • qBittorrent + Gluetun VPN sidecar with ExternalSecrets for VPN and web UI credentials.
  • CiliumNetworkPolicy kill-switch: default-deny egress to world, allow only kube-dns and VPN provider WireGuard endpoints.
  • Prowlarr, Sonarr, Radarr, Bazarr deployments + ClusterIP services in media.
  • Recyclarr CronJob with TRaSH Guides profiles; API keys injected via ExternalSecret.

Related work

  • Needs prod PR: aaron/prod#(created next)
  • Depends on storage foundation from HOM-54 (namespace/PV/PVC already in live).
  • Security review required from HOM-59.

Verification after merge

  1. kubectl get applications -n argocd media shows Synced/Healthy.
  2. kubectl get pods -n media-downloads and kubectl get pods -n media all Running.
  3. kubectl exec -n media-downloads deploy/qbittorrent -c gluetun -- wget -qO- https://ipinfo.io returns VPN IP.
  4. Kill-switch test: block VPN endpoint; direct wget https://ipinfo.io from qBittorrent container times out.

Co-Authored-By: Paperclip noreply@paperclip.ing

Deploys the core ARR stack per [HOM-56](/HOM/issues/HOM-56) and the [security design note](/HOM/issues/HOM-55#document-security-design). ### What changed - `media-downloads` namespace (privileged) with dedicated NFS PV/PVC bound to the same Proxmox export as `media`. - qBittorrent + Gluetun VPN sidecar with ExternalSecrets for VPN and web UI credentials. - CiliumNetworkPolicy kill-switch: default-deny egress to world, allow only kube-dns and VPN provider WireGuard endpoints. - Prowlarr, Sonarr, Radarr, Bazarr deployments + ClusterIP services in `media`. - Recyclarr CronJob with TRaSH Guides profiles; API keys injected via ExternalSecret. ### Related work - Needs prod PR: aaron/prod#(created next) - Depends on storage foundation from [HOM-54](/HOM/issues/HOM-54) (namespace/PV/PVC already in `live`). - Security review required from [HOM-59](/HOM/issues/HOM-59). ### Verification after merge 1. `kubectl get applications -n argocd media` shows Synced/Healthy. 2. `kubectl get pods -n media-downloads` and `kubectl get pods -n media` all Running. 3. `kubectl exec -n media-downloads deploy/qbittorrent -c gluetun -- wget -qO- https://ipinfo.io` returns VPN IP. 4. Kill-switch test: block VPN endpoint; direct `wget https://ipinfo.io` from qBittorrent container times out. Co-Authored-By: Paperclip <noreply@paperclip.ing>
feat(media): deploy ARR stack with VPN-isolated downloads
Some checks are pending
CI Review / pr-title (pull_request) Waiting to run
Details
CI Review / helm-validate (pull_request) Waiting to run
Details
CI Review / ai-review (pull_request) Waiting to run
Details
Lint & Validate / terraform-validate (pull_request) Waiting to run
Details
Lint & Validate / yaml-lint (pull_request) Waiting to run
Details
Lint & Validate / shellcheck (pull_request) Waiting to run
Details
0/0 projects applied successfully.
7c59b4f41b 
- Add media-downloads namespace (privileged) for qBittorrent + Gluetun
- Add dedicated NFS PV/PVC for media-downloads bound to same Proxmox export
- Add qBittorrent deployment with Gluetun VPN sidecar
- Add CiliumNetworkPolicy kill-switch (default-deny egress, DNS + VPN only)
- Add ExternalSecrets for VPN and qBittorrent credentials
- Add Prowlarr, Sonarr, Radarr, Bazarr deployments and services in media ns
- Add Recyclarr CronJob with TRaSH Guides profiles and ExternalSecret API keys
- Reference secrets from prod SOPS-encrypted source secrets

Implements HOM-56 chunks 3, 4, 5, 7 per the media platform plan and HOM-55
security design note.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
docs(media): explain VPN provider rationale and make killswitch CIDRs an explicit placeholder
Some checks are pending
CI Review / helm-validate (pull_request) Waiting to run
Details
CI Review / pr-title (pull_request) Waiting to run
Details
CI Review / ai-review (pull_request) Waiting to run
Details
Lint & Validate / yaml-lint (pull_request) Waiting to run
Details
Lint & Validate / shellcheck (pull_request) Waiting to run
Details
Lint & Validate / terraform-validate (pull_request) Waiting to run
Details
042c302d7d 
- Replace example TEST-NET CIDRs in the qBittorrent kill-switch with an
  empty, commented placeholder so the policy ships fail-closed.
- Add docs/runbooks/media-vpn-provider.md covering:
  * Why a separate no-log WireGuard provider is needed (vs Pangolin/Newt)
  * Provider requirements and recommended options
  * Required credential keys for ExternalSecrets
  * How to update the CiliumNetworkPolicy endpoints
  * Verification commands and kill-switch test

This addresses the review question about whether a new VPN provider is
required and makes the provider-agnostic credential flow explicit.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
fix(media): wire Sonarr/Radarr API keys from ExternalSecrets and document prod override for VPN CIDRs
Some checks are pending
CI Review / pr-title (pull_request) Waiting to run
Details
CI Review / helm-validate (pull_request) Waiting to run
Details
CI Review / ai-review (pull_request) Waiting to run
Details
Lint & Validate / yaml-lint (pull_request) Waiting to run
Details
Lint & Validate / shellcheck (pull_request) Waiting to run
Details
Lint & Validate / terraform-validate (pull_request) Waiting to run
Details
48c2e5f27a 
- Add SONARR__API_KEY / RADARR__API_KEY env vars so Recyclarr and the apps
  share the same SOPS-managed keys instead of diverging on first boot.
- Update networkpolicy comment to point at the prod-repo override that will
  supply real VPN endpoint CIDRs.

Addresses QA feedback on HOM-56.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
aaron force-pushed paperclip/HOM-56-arr-stack from 48c2e5f27a
Some checks are pending
CI Review / pr-title (pull_request) Waiting to run
Details
CI Review / helm-validate (pull_request) Waiting to run
Details
CI Review / ai-review (pull_request) Waiting to run
Details
Lint & Validate / yaml-lint (pull_request) Waiting to run
Details
Lint & Validate / shellcheck (pull_request) Waiting to run
Details
Lint & Validate / terraform-validate (pull_request) Waiting to run
Details
to 29a03f5fbb
Some checks failed
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
2026-06-18 05:14:02 +00:00 Compare
Some checks failed
CI Review / helm-validate (pull_request) Has been cancelled
Required
Details
CI Review / pr-title (pull_request) Has been cancelled
Required
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Required
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Required
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Required
Details
This pull request has changes conflicting with the target branch.
  • core/manifests/apps/media/bazarr.yaml
  • core/manifests/apps/media/external-secrets/recyclarr-credentials.yaml
  • core/manifests/apps/media/prowlarr.yaml
  • core/manifests/apps/media/radarr.yaml
  • core/manifests/apps/media/recyclarr.yaml
  • core/manifests/apps/media/services.yaml
  • core/manifests/apps/media/sonarr.yaml
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin paperclip/HOM-56-arr-stack:paperclip/HOM-56-arr-stack
git switch paperclip/HOM-56-arr-stack
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
aaron/infra-core!255
No description provided.