gilgamezh
49cfd05bee
nzbget's usenet downloads (NNTP/563) were egressing DIRECT: the HTTP_PROXY env pointed at a standalone gluetun that isn't even running, and NNTP ignores HTTP proxies anyway. Adopt the qbittorrent pattern instead: run gluetun as a sidecar in the nzbget pod so the shared netns + kill-switch force ALL traffic through the tunnel, regardless of protocol. - Add gluetun sidecar (own AirVPN device via gluetun-wireguard-nzbget secret, FIREWALL_INPUT_PORTS=6789 to keep the WebUI reachable, DOT=off + DNS_ADDRESS per the AirVPN-blocks-DoT gotcha). - Remove the useless HTTP_PROXY/NO_PROXY envs from nzbget. - Delete the standalone gluetun chart/values/application (was not running; only nzbget referenced it). Trade-off: if the tunnel drops, downloads stop (no leak) rather than falling back to direct — same behaviour as qbittorrent. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
73 lines
2.2 KiB
YAML
73 lines
2.2 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ template "nzbget.fullname" . }}
|
|
labels:
|
|
app: {{ template "nzbget.name" . }}
|
|
chart: {{ template "nzbget.chart" . }}
|
|
release: {{ .Release.Name }}
|
|
heritage: {{ .Release.Service }}
|
|
spec:
|
|
replicas: {{ .Values.replicaCount }}
|
|
selector:
|
|
matchLabels:
|
|
app: {{ template "nzbget.name" . }}
|
|
release: {{ .Release.Name }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: {{ template "nzbget.name" . }}
|
|
release: {{ .Release.Name }}
|
|
spec:
|
|
volumes:
|
|
{{ toYaml .Values.volumes | indent 6 }}
|
|
{{- with .Values.initContainers }}
|
|
initContainers:
|
|
{{ toYaml . | indent 8 }}
|
|
{{- end }}
|
|
containers:
|
|
- name: gluetun
|
|
image: "{{ .Values.gluetun.image.repository }}:{{ .Values.gluetun.image.tag }}"
|
|
imagePullPolicy: {{ .Values.gluetun.image.pullPolicy }}
|
|
securityContext:
|
|
{{ toYaml .Values.gluetun.securityContext | indent 12 }}
|
|
env:
|
|
{{ toYaml .Values.gluetun.env | indent 12 }}
|
|
livenessProbe:
|
|
{{ toYaml .Values.gluetun.livenessProbe | indent 12 }}
|
|
readinessProbe:
|
|
{{ toYaml .Values.gluetun.readinessProbe | indent 12 }}
|
|
volumeMounts:
|
|
{{ toYaml .Values.gluetun.volumeMounts | indent 12 }}
|
|
resources:
|
|
{{ toYaml .Values.gluetun.resources | indent 12 }}
|
|
- name: {{ .Chart.Name }}
|
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
env:
|
|
{{ toYaml .Values.env | indent 12 }}
|
|
ports:
|
|
- name: http
|
|
containerPort: {{ .Values.service.port }}
|
|
protocol: TCP
|
|
livenessProbe:
|
|
{{ toYaml .Values.livenessProbe | indent 12 }}
|
|
readinessProbe:
|
|
{{ toYaml .Values.readinessProbe | indent 12 }}
|
|
volumeMounts:
|
|
{{ toYaml .Values.volumeMounts | indent 12 }}
|
|
resources:
|
|
{{ toYaml .Values.resources | indent 12 }}
|
|
{{- with .Values.nodeSelector }}
|
|
nodeSelector:
|
|
{{ toYaml . | indent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.affinity }}
|
|
affinity:
|
|
{{ toYaml . | indent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.tolerations }}
|
|
tolerations:
|
|
{{ toYaml . | indent 8 }}
|
|
{{- end }}
|