release 0.0.1 for karakeep

charts/donetick/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: donetick
-description: A Helm chart for Donetick application
+description: Donetick helm chart for Kubernetes
 type: application
 version: 1.0.1
 appVersion: "v0.1.38"

charts/donetick/readme.md

@@ -6,6 +6,10 @@ A Helm chart for deploying the Donetick task management application on Kubernete
 
 This chart deploys [Donetick](https://github.com/donetick/donetick) on a Kubernetes cluster using the Helm package manager. 
 
+Source code can be found here:
+- https://github.com/rtomik/helm-charts/tree/main/charts/donetick
+
+
 ## Prerequisites
 
 - Kubernetes 1.19+

charts/jellyseerr/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: jellyseerr
-description: A Helm chart for Jellyseerr - A fork of Overseerr for Jellyfin support
+description: Jellyseerr helm chart for Kubernetes
 type: application
 version: 0.0.1
 appVersion: 2.5.2

charts/jellyseerr/readme.md

@@ -6,6 +6,9 @@ A Helm chart for deploying [Jellyseerr](https://github.com/fallenbagel/jellyseer
 
 This chart deploys Jellyseerr on a Kubernetes cluster using the Helm package manager. Jellyseerr is a fork of Overseerr for Jellyfin support.
 
+Source code can be found here:
+- https://github.com/rtomik/helm-charts/tree/main/charts/jellyseerr
+
 ## Prerequisites
 
 - Kubernetes 1.19+
@@ -17,8 +20,8 @@ This chart deploys Jellyseerr on a Kubernetes cluster using the Helm package man
 To install the chart with the release name `jellyseerr`:
 
 ```bash
-$ helm repo add rtomik-charts https://rtomik.github.io/helm-charts
-$ helm install jellyseerr rtomik-charts/jellyseerr
+helm repo add rtomik-charts https://rtomik.github.io/helm-charts
+helm install jellyseerr rtomik-charts/jellyseerr 
 ```
 
 > **Tip**: List all releases using `helm list`
@@ -28,7 +31,7 @@ $ helm install jellyseerr rtomik-charts/jellyseerr
 To uninstall/delete the `jellyseerr` deployment:
 
 ```bash
-$ helm uninstall jellyseerr
+helm uninstall jellyseerr
 ```
 
 ## Parameters

charts/karakeep/Chart.yaml

@@ -0,0 +1,16 @@
+apiVersion: v2
+name: karakeep
+description: Karakeep helm chart for Kubernetes
+type: application
+version: 0.0.1
+appVersion: "0.26.0"
+maintainers:
+  - name: Richard Tomik
+    email: no@m.com
+keywords:
+  - bookmark-manager
+  - karakeep
+  - productivity
+home: https://github.com/rtomik/helm-charts
+sources:
+  - https://github.com/karakeep-app/karakeep

charts/karakeep/NOTES.txt

@@ -0,0 +1,46 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "karakeep.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "karakeep.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "karakeep.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "{{ include "karakeep.selectorLabels" . }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:3000 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 3000:$CONTAINER_PORT
+{{- end }}
+
+2. Karakeep has been deployed with the following components:
+   - Main application (Karakeep)
+   - MeiliSearch for search functionality
+   - Chrome browser for web scraping
+
+{{- if not .Values.persistence.enabled }}
+3. WARNING: Persistence is disabled. Data will be lost when pods are restarted.
+   Enable persistence by setting:
+   persistence.enabled=true
+{{- end }}
+
+4. IMPORTANT: Configuration for production:
+   - Generate a secure 32-character random string for NEXTAUTH_SECRET
+   - NEXTAUTH_URL is automatically set when ingress is enabled
+   - Update secrets or environment variables as needed
+
+{{- if not .Values.secrets.create }}
+{{- if not .Values.secrets.existingSecret }}
+5. Optional: Configure additional API keys via secrets:
+   - OPENAI_API_KEY for AI features
+   - MEILI_MASTER_KEY for MeiliSearch authentication
+{{- end }}
+{{- end }}

charts/karakeep/readme.md

@@ -0,0 +1,108 @@
+# Karakeep Helm Chart
+
+This Helm chart deploys [Karakeep](https://github.com/karakeep-app/karakeep), a bookmark management application, along with its required services on a Kubernetes cluster.
+
+## Components
+
+This chart deploys three containers in a single pod:
+
+1. **Karakeep**: The main bookmark management application
+2. **Chrome**: Headless Chrome browser for web scraping and preview generation
+3. **MeiliSearch**: Search engine for fast bookmark search functionality
+
+## Prerequisites
+
+- Kubernetes 1.19+
+- Helm 3.2.0+
+- PV provisioner support in the underlying infrastructure (if persistence is enabled)
+
+## Installing the Chart
+
+To install the chart with the release name `karakeep`:
+
+```bash
+helm repo add karakeep-chart https://rtomik.github.io/helm-charts
+helm install karakeep karakeep-chart/karakeep
+```
+
+## Uninstalling the Chart
+
+To uninstall/delete the `karakeep` deployment:
+
+```bash
+helm delete karakeep
+```
+
+## Configuration
+
+The following table lists the configurable parameters and their default values.
+
+### Global Settings
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `nameOverride` | Override the name of the chart | `""` |
+| `fullnameOverride` | Override the full name of the chart | `""` |
+| `replicaCount` | Number of replicas | `1` |
+
+### Karakeep Configuration
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `karakeep.image.repository` | Karakeep image repository | `ghcr.io/karakeep-app/karakeep` |
+| `karakeep.image.tag` | Karakeep image tag | `"release"` |
+| `karakeep.image.pullPolicy` | Image pull policy | `IfNotPresent` |
+
+### Chrome Configuration
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `chrome.image.repository` | Chrome image repository | `gcr.io/zenika-hub/alpine-chrome` |
+| `chrome.image.tag` | Chrome image tag | `"124"` |
+
+### MeiliSearch Configuration
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `meilisearch.image.repository` | MeiliSearch image repository | `getmeili/meilisearch` |
+| `meilisearch.image.tag` | MeiliSearch image tag | `"v1.13.3"` |
+
+### Persistence
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `persistence.enabled` | Enable persistent storage | `true` |
+| `persistence.data.size` | Size of data volume | `5Gi` |
+| `persistence.data.storageClass` | Storage class for data volume | `""` |
+| `persistence.meilisearch.size` | Size of MeiliSearch volume | `2Gi` |
+| `persistence.meilisearch.storageClass` | Storage class for MeiliSearch volume | `""` |
+
+### Ingress
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `ingress.enabled` | Enable ingress | `false` |
+| `ingress.hosts[0].host` | Hostname | `karakeep.domain.com` |
+
+### Secrets
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `secrets.create` | Create secret for environment variables | `false` |
+| `secrets.existingSecret` | Use existing secret | `""` |
+| `secrets.env` | Environment variables to store in secret | `{}` |
+
+**Important Configuration:**
+1. The default `NEXTAUTH_SECRET` is set to a placeholder value. For production deployments, you should either:
+   - Override the value: `--set karakeep.env[3].value="your-secure-32-character-string"`
+   - Use secrets: `--set secrets.create=true --set secrets.env.NEXTAUTH_SECRET="your-secure-32-character-string"`
+
+2. When ingress is enabled, `NEXTAUTH_URL` is automatically set to the ingress hostname. For custom configurations:
+   - Override manually: `--set karakeep.env[4].value="https://your-domain.com"`
+
+## Notes
+
+- This chart creates a multi-container pod with all three services running together
+- Data persistence is enabled by default with separate volumes for Karakeep data and MeiliSearch indices
+- The services communicate via localhost since they share the same pod network
+- Chrome runs with security flags for containerized environments

charts/karakeep/templates/_helpers.tpl

@@ -0,0 +1,70 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "karakeep.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+*/}}
+{{- define "karakeep.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- printf "%s" $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "karakeep.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "karakeep.labels" -}}
+helm.sh/chart: {{ include "karakeep.chart" . }}
+{{ include "karakeep.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "karakeep.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "karakeep.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the secret to use
+*/}}
+{{- define "karakeep.secretName" -}}
+{{- if .Values.secrets.existingSecret }}
+{{- .Values.secrets.existingSecret }}
+{{- else }}
+{{- include "karakeep.fullname" . }}-secret
+{{- end }}
+{{- end }}
+
+{{/*
+Create the name of the data PVC
+*/}}
+{{- define "karakeep.dataPvcName" -}}
+{{- include "karakeep.fullname" . }}-data
+{{- end }}
+
+{{/*
+Create the name of the meilisearch PVC
+*/}}
+{{- define "karakeep.meilisearchPvcName" -}}
+{{- include "karakeep.fullname" . }}-meilisearch
+{{- end }}

charts/karakeep/templates/deployment.yaml

@@ -0,0 +1,191 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "karakeep.fullname" . }}
+  labels:
+    {{- include "karakeep.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+      {{- include "karakeep.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "karakeep.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        # Karakeep main application
+        - name: karakeep
+          image: "{{ .Values.karakeep.image.repository }}:{{ .Values.karakeep.image.tag }}"
+          imagePullPolicy: {{ .Values.karakeep.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.karakeep.service.port }}
+              protocol: TCP
+          env:
+            {{- range .Values.karakeep.env }}
+            - name: {{ .name }}
+              {{- if and (eq .name "NEXTAUTH_URL") $.Values.ingress.enabled }}
+              {{- $host := (index $.Values.ingress.hosts 0).host }}
+              {{- if $.Values.ingress.tls }}
+              value: "https://{{ $host }}"
+              {{- else }}
+              value: "http://{{ $host }}"
+              {{- end }}
+              {{- else }}
+              value: {{ .value | quote }}
+              {{- end }}
+            {{- end }}
+            {{- range .Values.karakeep.extraEnv }}
+            - name: {{ .name }}
+              {{- if .value }}
+              value: {{ .value | quote }}
+              {{- else if .valueFrom }}
+              valueFrom:
+                {{- toYaml .valueFrom | nindent 16 }}
+              {{- end }}
+            {{- end }}
+          {{- if or .Values.secrets.create .Values.secrets.existingSecret }}
+          envFrom:
+            - secretRef:
+                name: {{ include "karakeep.secretName" . }}
+          {{- end }}
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          {{- with .Values.karakeep.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 10
+
+        # Chrome browser sidecar
+        - name: chrome
+          image: "{{ .Values.chrome.image.repository }}:{{ .Values.chrome.image.tag }}"
+          imagePullPolicy: {{ .Values.chrome.image.pullPolicy }}
+          args:
+            {{- range .Values.chrome.args }}
+            - {{ . | quote }}
+            {{- end }}
+          ports:
+            - name: debug
+              containerPort: {{ .Values.chrome.service.port }}
+              protocol: TCP
+          securityContext:
+            {{- toYaml .Values.chrome.securityContext | nindent 12 }}
+          {{- with .Values.chrome.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          livenessProbe:
+            httpGet:
+              path: /json/version
+              port: debug
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /json/version
+              port: debug
+            initialDelaySeconds: 10
+            periodSeconds: 5
+
+        # MeiliSearch sidecar
+        - name: meilisearch
+          image: "{{ .Values.meilisearch.image.repository }}:{{ .Values.meilisearch.image.tag }}"
+          imagePullPolicy: {{ .Values.meilisearch.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.meilisearch.service.port }}
+              protocol: TCP
+          env:
+            {{- range .Values.meilisearch.env }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+            {{- end }}
+            {{- range .Values.meilisearch.extraEnv }}
+            - name: {{ .name }}
+              {{- if .value }}
+              value: {{ .value | quote }}
+              {{- else if .valueFrom }}
+              valueFrom:
+                {{- toYaml .valueFrom | nindent 16 }}
+              {{- end }}
+            {{- end }}
+          {{- if or .Values.secrets.create .Values.secrets.existingSecret }}
+          envFrom:
+            - secretRef:
+                name: {{ include "karakeep.secretName" . }}
+          {{- end }}
+          volumeMounts:
+            - name: meilisearch-data
+              mountPath: /meili_data
+          securityContext:
+            {{- toYaml .Values.meilisearch.securityContext | nindent 12 }}
+          {{- with .Values.meilisearch.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          startupProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            failureThreshold: 30
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 10
+
+      volumes:
+        {{- if .Values.persistence.enabled }}
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ include "karakeep.dataPvcName" . }}
+        - name: meilisearch-data
+          persistentVolumeClaim:
+            claimName: {{ include "karakeep.meilisearchPvcName" . }}
+        {{- else }}
+        - name: data
+          emptyDir: {}
+        - name: meilisearch-data
+          emptyDir: {}
+        {{- end }}

charts/karakeep/templates/ingress.yaml

@@ -0,0 +1,41 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "karakeep.fullname" . }}
+  labels:
+    {{- include "karakeep.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "karakeep.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

charts/karakeep/templates/pvc.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.persistence.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "karakeep.dataPvcName" . }}
+  labels:
+    {{- include "karakeep.labels" . | nindent 4 }}
+    component: data
+spec:
+  accessModes:
+    - {{ .Values.persistence.data.accessMode }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.data.size }}
+  {{- if .Values.persistence.data.storageClass }}
+  {{- if (eq "-" .Values.persistence.data.storageClass) }}
+  storageClassName: ""
+  {{- else }}
+  storageClassName: {{ .Values.persistence.data.storageClass }}
+  {{- end }}
+  {{- end }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "karakeep.meilisearchPvcName" . }}
+  labels:
+    {{- include "karakeep.labels" . | nindent 4 }}
+    component: meilisearch
+spec:
+  accessModes:
+    - {{ .Values.persistence.meilisearch.accessMode }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.meilisearch.size }}
+  {{- if .Values.persistence.meilisearch.storageClass }}
+  {{- if (eq "-" .Values.persistence.meilisearch.storageClass) }}
+  storageClassName: ""
+  {{- else }}
+  storageClassName: {{ .Values.persistence.meilisearch.storageClass }}
+  {{- end }}
+  {{- end }}
+{{- end }}

charts/karakeep/templates/secret.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.secrets.create }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "karakeep.secretName" . }}
+  labels:
+    {{- include "karakeep.labels" . | nindent 4 }}
+type: Opaque
+data:
+  {{- range $key, $value := .Values.secrets.env }}
+  {{ $key }}: {{ $value | b64enc }}
+  {{- end }}
+{{- end }}

charts/karakeep/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "karakeep.fullname" . }}
+  labels:
+    {{- include "karakeep.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "karakeep.selectorLabels" . | nindent 4 }}

charts/karakeep/values.yaml

@@ -0,0 +1,170 @@
+## Global settings
+nameOverride: ""
+fullnameOverride: ""
+
+## Deployment settings
+replicaCount: 1
+revisionHistoryLimit: 3
+
+# Pod security settings
+podSecurityContext:
+  runAsNonRoot: false
+  runAsUser: 0
+  fsGroup: 0
+
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: false
+  capabilities:
+    drop:
+      - ALL
+
+## Pod scheduling
+nodeSelector: {}
+tolerations: []
+affinity: {}
+
+## Karakeep Web Application
+karakeep:
+  image:
+    repository: ghcr.io/karakeep-app/karakeep
+    tag: "0.26.0"
+    pullPolicy: IfNotPresent
+  
+  securityContext: {}
+  
+  env:
+    - name: DATA_DIR
+      value: "/data"
+    - name: MEILI_ADDR
+      value: "http://localhost:7700"
+    - name: BROWSER_WEB_URL
+      value: "http://localhost:9222"
+    - name: NEXTAUTH_SECRET
+      value: "changeme-generate-a-secure-random-string"
+    - name: NEXTAUTH_URL
+      value: "http://localhost:3000"
+  
+  extraEnv: []
+    # - name: OPENAI_API_KEY
+    #   valueFrom:
+    #     secretKeyRef:
+    #       name: karakeep-secrets
+    #       key: openai-api-key
+  
+  service:
+    port: 3000
+  
+  #resources:
+  #  limits:
+  #    cpu: 500m
+  #    memory: 1Gi
+  #  requests:
+  #    cpu: 100m
+  #    memory: 256Mi
+
+## Chrome Browser Service
+chrome:
+  image:
+    repository: gcr.io/zenika-hub/alpine-chrome
+    tag: "124"
+    pullPolicy: IfNotPresent
+  
+  securityContext: {}
+  
+  args:
+    - --no-sandbox
+    - --disable-gpu
+    - --disable-dev-shm-usage
+    - --remote-debugging-address=0.0.0.0
+    - --remote-debugging-port=9222
+    - --hide-scrollbars
+  
+  service:
+    port: 9222
+  
+  #resources:
+  #  limits:
+  #    cpu: 500m
+  #    memory: 512Mi
+  #  requests:
+  #    cpu: 100m
+  #    memory: 128Mi
+
+## MeiliSearch Service
+meilisearch:
+  image:
+    repository: getmeili/meilisearch
+    tag: "v1.13.3"
+    pullPolicy: IfNotPresent
+  
+  securityContext: {}
+  
+  env:
+    - name: MEILI_NO_ANALYTICS
+      value: "true"
+    - name: MEILI_MAX_INDEXING_MEMORY
+      value: "512MiB"
+    - name: MEILI_MAX_INDEXING_THREADS
+      value: "2"
+  
+  extraEnv: []
+  
+  service:
+    port: 7700
+  
+  resources:
+    limits:
+      cpu: 500m
+      memory: 1Gi
+    requests:
+      cpu: 100m
+      memory: 256Mi
+
+## Service settings
+service:
+  type: ClusterIP
+  port: 3000
+
+## Ingress settings
+ingress:
+  enabled: false
+  className: ""
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+  hosts:
+    - host: karakeep.<domain.com>
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - hosts:
+        - karakeep.<domain.com>
+
+## Persistence settings
+persistence:
+  enabled: true
+  
+  # Karakeep data storage
+  data:
+    storageClass: ""
+    accessMode: ReadWriteOnce
+    size: 5Gi
+  
+  # MeiliSearch data storage
+  meilisearch:
+    storageClass: ""
+    accessMode: ReadWriteOnce
+    size: 2Gi
+
+## Secret configuration
+secrets:
+  # Set to true to create a secret for environment variables
+  create: false
+  # Name of existing secret to use
+  existingSecret: ""
+  # Environment variables to include in secret
+  env: {}
+    # NEXTAUTH_SECRET: "your-secure-random-string"
+    # OPENAI_API_KEY: "your-openai-api-key"
+    # MEILI_MASTER_KEY: "your-meilisearch-master-key"

charts/qbittorrent-vpn/Chart.yaml

@@ -0,0 +1,18 @@
+apiVersion: v2
+name: qbittorrent-vpn
+description: qBittorrent with Gluetun VPN sidecar for Kubernetes
+type: application
+version: 0.0.1
+appVersion: 5.1.0
+maintainers:
+  - name: Richard Tomik
+    email: richard.tomik@proton.me
+keywords:
+  - qbittorrent
+  - vpn
+  - gluetun
+  - torrent
+home: https://github.com/rtomik/helm-charts
+sources:
+  - https://github.com/linuxserver/docker-qbittorrent
+  - https://github.com/qdm12/gluetun

charts/qbittorrent-vpn/NOTES.txt

@@ -0,0 +1,38 @@
+Thank you for installing {{ .Chart.Name }}.
+
+Your qBittorrent with VPN has been deployed successfully!
+
+1. Get the application URL:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "qbittorrent-vpn.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "qbittorrent-vpn.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "qbittorrent-vpn.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "qbittorrent-vpn.fullname" . }} {{ .Values.service.port }}:{{ .Values.service.port }}
+  Visit http://127.0.0.1:{{ .Values.service.port }} to access qBittorrent
+{{- end }}
+
+2. VPN Status:
+   To check the VPN connection status:
+   kubectl exec -it -n {{ .Release.Namespace }} deployment/{{ include "qbittorrent-vpn.fullname" . }} -c gluetun -- curl -s http://localhost:8000/v1/vpn/status
+
+3. Public IP:
+   To check your current public IP through the VPN:
+   kubectl exec -it -n {{ .Release.Namespace }} deployment/{{ include "qbittorrent-vpn.fullname" . }} -c gluetun -- curl -s http://localhost:8000/v1/publicip/ip
+
+4. Verify qBittorrent:
+   Make sure qBittorrent is functioning by accessing the Web UI at the URL in step 1.
+
+For more information about this chart: 
+https://github.com/rtomik/helm-charts/tree/main/charts/qbittorrent-vpn

charts/qbittorrent-vpn/readme.md

@@ -0,0 +1,273 @@
+# qBittorrent with Gluetun VPN
+
+A Helm chart for deploying qBittorrent with a Gluetun VPN sidecar container on Kubernetes.
+
+## Introduction
+
+This chart deploys [qBittorrent](https://www.qbittorrent.org/) alongside [Gluetun](https://github.com/qdm12/gluetun), a VPN client/tunnel in a container, to ensure all BitTorrent traffic is routed through the VPN. The chart supports all major VPN providers and protocols through Gluetun's comprehensive compatibility.
+
+Source code can be found here:
+- https://github.com/rtomik/helm-charts/tree/main/charts/qbittorrent-vpn
+
+Note: Currently only tested with NordVPN an OpenVPN configuration.
+
+## Features
+
+- **Multiple VPN Providers**: Support for 30+ VPN providers including NordVPN, ProtonVPN, Private Internet Access, ExpressVPN, Surfshark, Mullvad, and more
+- **Protocol Support**: Use OpenVPN or WireGuard based on your provider's capabilities
+- **Server Selection**: Choose servers by country, city, or specific hostnames with optional randomization
+- **Security**: Proper container security settings to ensure traffic only flows through the VPN
+- **Health Monitoring**: Integrated health checks for both qBittorrent and the VPN connection
+- **Persistence**: Separate volume storage for configuration and downloads
+- **Web UI**: Access qBittorrent via web interface with optional ingress support
+- **Proxy Services**: HTTP and Shadowsocks proxies for additional devices to use the VPN tunnel
+
+## Prerequisites
+
+- Kubernetes 1.19+
+- Helm 3.2.0+
+- PV provisioner support in the cluster
+- A valid subscription to a VPN service
+
+## Installation
+
+### Add the Repository
+
+```bash
+helm repo add rtomik-charts https://rtomik.github.io/helm-charts
+helm repo update
+```
+
+### Create a Secret for VPN Credentials
+
+For better security, store your VPN credentials in a Kubernetes secret:
+
+```bash
+# For OpenVPN authentication
+kubectl create secret generic vpn-credentials \
+  --namespace default \
+  --from-literal=username='your-vpn-username' \
+  --from-literal=password='your-vpn-password'
+
+# For WireGuard authentication (if using WireGuard)
+kubectl create secret generic wireguard-keys \
+  --namespace default \
+  --from-literal=private_key='your-wireguard-private-key'
+```
+
+Then reference this secret in your values:
+
+```yaml
+gluetun:
+  credentials:
+    create: false
+    existingSecret: "vpn-credentials"
+    usernameKey: "username"
+    passwordKey: "password"
+```
+
+### Install the Chart
+
+```bash
+# Option 1: Installation with custom values file (recommended)
+helm install qbittorrent-vpn rtomik-charts/qbittorrent-vpn -f values.yaml -n media
+
+# Option 2: Installation with inline parameter overrides
+helm install qbittorrent-vpn rtomik-charts/qbittorrent-vpn -n media \
+  --set gluetun.vpn.provider=nordvpn \
+  --set gluetun.vpn.serverCountries=Germany \
+  --set-string gluetun.credentials.existingSecret=vpn-credentials
+```
+
+## Uninstallation
+
+```bash
+helm uninstall qbittorrent-vpn -n media
+```
+
+Note: This will not delete Persistent Volume Claims. To delete them:
+
+```bash
+kubectl delete pvc -l app.kubernetes.io/instance=qbittorrent-vpn
+```
+
+## Configuration
+
+### Key Parameters
+
+| Parameter                             | Description                                           | Default                    |
+|---------------------------------------|-------------------------------------------------------|----------------------------|
+| `qbittorrent.image.repository`        | qBittorrent image repository                          | `linuxserver/qbittorrent`  |
+| `qbittorrent.image.tag`               | qBittorrent image tag                                 | `latest`                   |
+| `gluetun.image.repository`            | Gluetun image repository                              | `qmcgaw/gluetun`           |
+| `gluetun.image.tag`                   | Gluetun image tag                                     | `v3.40.0`                  |
+| `gluetun.vpn.provider`                | VPN provider name                                     | `nordvpn`                  |
+| `gluetun.vpn.type`                    | VPN protocol (`openvpn` or `wireguard`)              | `openvpn`                  |
+| `gluetun.vpn.serverCountries`         | Countries to connect to (comma-separated)            | `Germany`                  |
+| `persistence.config.size`             | Size of PVC for qBittorrent config                    | `2Gi`                      |
+| `persistence.downloads.size`          | Size of PVC for downloads                             | `100Gi`                    |
+| `ingress.enabled`                     | Enable ingress controller resource                     | `true`                     |
+| `ingress.hosts[0].host`               | Hostname for the ingress                              | `qbittorrent.domain.com`   |
+
+For a complete list of parameters, see the [values.yaml](values.yaml) file.
+
+### Example: Using with NordVPN
+
+```yaml
+gluetun:
+  vpn:
+    provider: "nordvpn"
+    type: "openvpn"
+    serverCountries: "United States"
+    openvpn:
+      NORDVPN_CATEGORY: "P2P"  # For torrent-optimized servers
+  credentials:
+    create: true
+    username: "your-nordvpn-username"
+    password: "your-nordvpn-password"
+```
+
+### Example: Using with ProtonVPN
+
+```yaml
+gluetun:
+  vpn:
+    provider: "protonvpn"
+    type: "openvpn"
+    serverCountries: "Switzerland"
+    openvpn:
+      PROTONVPN_TIER: "2"  # 0 is free, 2 is paid (Plus/Visionary)
+      SERVER_FEATURES: "p2p"  # For torrent support
+  credentials:
+    create: true
+    username: "protonvpn-username"
+    password: "protonvpn-password"
+```
+
+### Example: Using with Private Internet Access
+
+```yaml
+gluetun:
+  vpn:
+    provider: "private internet access"
+    type: "openvpn"
+    serverCountries: "US"
+  credentials:
+    create: true
+    username: "pia-username"
+    password: "pia-password"
+  settings:
+    VPN_PORT_FORWARDING: "on"  # PIA supports port forwarding
+```
+
+## VPN Provider Support
+
+This chart supports all VPN providers compatible with Gluetun, including:
+
+- AirVPN
+- Cyberghost
+- ExpressVPN
+- FastestVPN
+- HideMyAss
+- IPVanish
+- IVPN
+- Mullvad
+- NordVPN
+- Perfect Privacy
+- Private Internet Access (PIA)
+- PrivateVPN
+- ProtonVPN
+- PureVPN
+- Surfshark
+- TorGuard
+- VyprVPN
+- WeVPN
+- Windscribe
+
+For the complete list and provider-specific options, see the [Gluetun Providers Documentation](https://github.com/qdm12/gluetun-wiki/tree/main/setup/providers).
+
+## Additional Features
+
+### Accessing the HTTP Proxy
+
+Gluetun provides an HTTP proxy on port 8888 that can be used by other applications to route traffic through the VPN. To expose this proxy:
+
+```yaml
+service:
+  proxies:
+    enabled: true
+    httpPort: 8888
+    socksPort: 8388
+```
+
+### Firewall Settings
+
+By default, the chart enables the Gluetun firewall to prevent leaks if the VPN connection drops. You can customize this:
+
+```yaml
+gluetun:
+  settings:
+    FIREWALL: "on"
+    FIREWALL_OUTBOUND_SUBNETS: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
+```
+
+### Port Forwarding
+
+For VPN providers that support port forwarding (like PIA):
+
+```yaml
+gluetun:
+  settings:
+    VPN_PORT_FORWARDING: "on"
+    STATUS_FILE: "/tmp/gluetun-status.json"
+```
+
+## Troubleshooting
+
+### VPN Connection Issues
+
+If the VPN isn't connecting properly:
+
+1. Check the Gluetun logs:
+   ```bash
+   kubectl logs deployment/qbittorrent-vpn -c gluetun
+   ```
+
+2. Verify your credentials are correct:
+   ```bash
+   kubectl describe secret vpn-credentials
+   ```
+
+3. Try setting the log level to debug for more detailed information:
+   ```yaml
+   gluetun:
+     extraEnv:
+       - name: LOG_LEVEL
+         value: "debug"
+   ```
+
+### qBittorrent Can't Create Directories
+
+If you see errors like "Could not create required directory":
+
+1. Make sure the init container is enabled and properly configured
+2. Ensure proper `fsGroup` is set in the `podSecurityContext`
+3. Check that the persistence volume allows the correct permissions
+
+### Firewall/Security Issues
+
+If you encounter iptables or network issues:
+
+1. Ensure the Gluetun container has `privileged: true`
+2. Verify the `NET_ADMIN` capability is added
+3. Check that the `/dev/net/tun` device is correctly mounted
+
+## License
+
+This chart is licensed under the MIT License.
+
+## Acknowledgements
+
+- [Gluetun](https://github.com/qdm12/gluetun) by [qdm12](https://github.com/qdm12)
+- [LinuxServer.io](https://linuxserver.io/) for the qBittorrent container
+- The qBittorrent team for the excellent torrent client

charts/qbittorrent-vpn/templates/_helpers.tpl

@@ -0,0 +1,45 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "qbittorrent-vpn.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+*/}}
+{{- define "qbittorrent-vpn.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- printf "%s" $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "qbittorrent-vpn.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "qbittorrent-vpn.labels" -}}
+helm.sh/chart: {{ include "qbittorrent-vpn.chart" . }}
+{{ include "qbittorrent-vpn.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "qbittorrent-vpn.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "qbittorrent-vpn.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}

charts/qbittorrent-vpn/templates/deployment.yaml

@@ -0,0 +1,306 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "qbittorrent-vpn.fullname" . }}
+  labels:
+    {{- include "qbittorrent-vpn.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+      {{- include "qbittorrent-vpn.selectorLabels" . | nindent 6 }}
+  strategy:
+    type: Recreate  # Using Recreate instead of RollingUpdate for stateful pods
+  template:
+    metadata:
+      labels:
+        {{- include "qbittorrent-vpn.selectorLabels" . | nindent 8 }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      # Add hostNetwork if specified
+      {{- if .Values.hostNetwork }}
+      hostNetwork: {{ .Values.hostNetwork }}
+      {{- end }}
+      
+      # Init containers if needed for directory setup
+      {{- if .Values.initContainers }}
+      initContainers:
+      {{- toYaml .Values.initContainers | nindent 8 }}
+      {{- end }}
+      
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      
+      containers:
+        {{- if .Values.gluetun.enabled }}
+        # Gluetun VPN container
+        - name: gluetun
+          image: "{{ .Values.gluetun.image.repository }}:{{ .Values.gluetun.image.tag }}"
+          imagePullPolicy: {{ .Values.gluetun.image.pullPolicy }}
+          securityContext:
+            {{- toYaml .Values.gluetun.securityContext | nindent 12 }}
+          env:
+            # VPN Provider selection - Common settings for all VPN types
+            - name: VPN_SERVICE_PROVIDER
+              value: {{ .Values.gluetun.vpn.provider | quote }}
+            - name: VPN_TYPE
+              value: {{ .Values.gluetun.vpn.type | quote }}
+            - name: SERVER_COUNTRIES
+              value: {{ .Values.gluetun.vpn.serverCountries | quote }}
+            {{- if .Values.gluetun.vpn.serverNames }}
+            - name: SERVER_HOSTNAMES
+              value: {{ .Values.gluetun.vpn.serverNames | quote }}
+            {{- end }}
+            {{- if .Values.gluetun.vpn.serverCities }}
+            - name: SERVER_CITIES
+              value: {{ .Values.gluetun.vpn.serverCities | quote }}
+            {{- end }}
+            {{- if .Values.gluetun.vpn.randomize }}
+            - name: SERVER_HOSTNAMES_RANDOMIZED
+              value: {{ .Values.gluetun.vpn.randomize | quote }}
+            {{- end }}
+            
+            # OpenVPN specific configuration
+            {{- if eq .Values.gluetun.vpn.type "openvpn" }}
+            {{- if .Values.gluetun.credentials.create }}
+            - name: OPENVPN_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "qbittorrent-vpn.fullname" . }}-vpn-credentials
+                  key: {{ .Values.gluetun.credentials.usernameKey }}
+            - name: OPENVPN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "qbittorrent-vpn.fullname" . }}-vpn-credentials
+                  key: {{ .Values.gluetun.credentials.passwordKey }}
+            {{- else if .Values.gluetun.credentials.existingSecret }}
+            - name: OPENVPN_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.gluetun.credentials.existingSecret }}
+                  key: {{ .Values.gluetun.credentials.usernameKey }}
+            - name: OPENVPN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.gluetun.credentials.existingSecret }}
+                  key: {{ .Values.gluetun.credentials.passwordKey }}
+            {{- end }}
+            
+            # Additional OpenVPN settings
+            {{- with .Values.gluetun.vpn.openvpn }}
+            {{- range $key, $value := . }}
+            - name: {{ $key | upper }}
+              value: {{ $value | quote }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
+            
+            # WireGuard specific configuration
+            {{- if eq .Values.gluetun.vpn.type "wireguard" }}
+            {{- if and .Values.gluetun.vpn.wireguard.privateKey .Values.gluetun.credentials.create }}
+            - name: WIREGUARD_PRIVATE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "qbittorrent-vpn.fullname" . }}-vpn-credentials
+                  key: wireguard_private_key
+            {{- else if and .Values.gluetun.vpn.wireguard.privateKeyExistingSecret .Values.gluetun.vpn.wireguard.privateKeyExistingSecretKey }}
+            - name: WIREGUARD_PRIVATE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.gluetun.vpn.wireguard.privateKeyExistingSecret }}
+                  key: {{ .Values.gluetun.vpn.wireguard.privateKeyExistingSecretKey }}
+            {{- end }}
+            
+            # Additional WireGuard settings
+            {{- with .Values.gluetun.vpn.wireguard }}
+            {{- if .addresses }}
+            - name: WIREGUARD_ADDRESSES
+              value: {{ .addresses | quote }}
+            {{- end }}
+            {{- if .endpointIP }}
+            - name: WIREGUARD_ENDPOINT_IP
+              value: {{ .endpointIP | quote }}
+            {{- end }}
+            {{- if .endpointPort }}
+            - name: WIREGUARD_ENDPOINT_PORT
+              value: {{ .endpointPort | quote }}
+            {{- end }}
+            {{- if .publicKey }}
+            - name: WIREGUARD_PUBLIC_KEY
+              value: {{ .publicKey | quote }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
+            
+            # Gluetun general settings
+            {{- with .Values.gluetun.settings }}
+            {{- range $key, $value := . }}
+            - name: {{ $key | upper }}
+              value: {{ $value | quote }}
+            {{- end }}
+            {{- end }}
+            
+            # Extra environment variables
+            {{- with .Values.gluetun.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          
+          ports:
+            - name: control
+              containerPort: 8000
+              protocol: TCP
+            - name: http-proxy
+              containerPort: 8888
+              protocol: TCP
+            - name: shadowsocks-tcp
+              containerPort: 8388
+              protocol: TCP
+            - name: shadowsocks-udp
+              containerPort: 8388
+              protocol: UDP
+            {{- with .Values.gluetun.extraPorts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          
+          volumeMounts:
+            # Mount tun device for VPN
+            - name: tun
+              mountPath: /dev/net/tun
+            {{- if .Values.gluetun.persistence.enabled }}
+            - name: gluetun-config
+              mountPath: /gluetun
+            {{- end }}
+            {{- with .Values.gluetun.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          
+          resources:
+            {{- toYaml .Values.gluetun.resources | nindent 12 }}
+          
+        {{- end }}
+          
+        # qBittorrent container
+        - name: qbittorrent
+          image: "{{ .Values.qbittorrent.image.repository }}:{{ .Values.qbittorrent.image.tag }}"
+          imagePullPolicy: {{ .Values.qbittorrent.image.pullPolicy }}
+          {{- if .Values.qbittorrent.securityContext }}
+          securityContext:
+            {{- toYaml .Values.qbittorrent.securityContext | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.qbittorrent.service.port }}
+              protocol: TCP
+            {{- if .Values.qbittorrent.bittorrentPort }}
+            - name: bittorrent-tcp
+              containerPort: {{ .Values.qbittorrent.bittorrentPort }}
+              protocol: TCP
+            - name: bittorrent-udp
+              containerPort: {{ .Values.qbittorrent.bittorrentPort }}
+              protocol: UDP
+            {{- end }}
+          
+          {{- if .Values.probes.liveness.enabled }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.probes.liveness.path }}
+              port: http
+            initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
+            successThreshold: {{ .Values.probes.liveness.successThreshold }}
+          {{- end }}
+          
+          {{- if .Values.probes.readiness.enabled }}
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.probes.readiness.path }}
+              port: http
+            initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
+            successThreshold: {{ .Values.probes.readiness.successThreshold }}
+          {{- end }}
+          
+          env:
+          {{- range .Values.qbittorrent.env }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+          {{- end }}
+          {{- with .Values.qbittorrent.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          
+          volumeMounts:
+            {{- if .Values.qbittorrent.persistence.config.enabled }}
+            - name: config
+              mountPath: {{ .Values.qbittorrent.persistence.config.mountPath }}
+            {{- end }}
+            
+            {{- if .Values.qbittorrent.persistence.downloads.enabled }}
+            - name: downloads
+              mountPath: {{ .Values.qbittorrent.persistence.downloads.mountPath }}
+            {{- end }}
+            
+            {{- with .Values.qbittorrent.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          
+          resources:
+            {{- toYaml .Values.qbittorrent.resources | nindent 12 }}
+      
+      volumes:
+        # Create /dev/net/tun as a device
+        - name: tun
+          hostPath:
+            path: /dev/net/tun
+            type: CharDevice
+        
+        {{- if .Values.qbittorrent.persistence.config.enabled }}
+        - name: config
+          persistentVolumeClaim:
+            claimName: {{ if .Values.qbittorrent.persistence.config.existingClaim }}{{ .Values.qbittorrent.persistence.config.existingClaim }}{{ else }}{{ include "qbittorrent-vpn.fullname" . }}-config{{ end }}
+        {{- end }}
+        
+        {{- if .Values.qbittorrent.persistence.downloads.enabled }}
+        - name: downloads
+          persistentVolumeClaim:
+            claimName: {{ if .Values.qbittorrent.persistence.downloads.existingClaim }}{{ .Values.qbittorrent.persistence.downloads.existingClaim }}{{ else }}{{ include "qbittorrent-vpn.fullname" . }}-downloads{{ end }}
+        {{- end }}
+        
+        {{- if and .Values.gluetun.enabled .Values.gluetun.persistence.enabled }}
+        {{- if .Values.gluetun.persistence.useEmptyDir }}
+        - name: gluetun-config
+          emptyDir: {}
+        {{- else }}
+        - name: gluetun-config
+          persistentVolumeClaim:
+            claimName: {{ if .Values.gluetun.persistence.existingClaim }}{{ .Values.gluetun.persistence.existingClaim }}{{ else }}{{ include "qbittorrent-vpn.fullname" . }}-gluetun{{ end }}
+        {{- end }}
+        {{- end }}
+        
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/qbittorrent-vpn/templates/ingress.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "qbittorrent-vpn.fullname" . }}
+  labels:
+    {{- include "qbittorrent-vpn.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      {{- if .secretName }}
+      secretName: {{ .secretName }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "qbittorrent-vpn.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

charts/qbittorrent-vpn/templates/pvc.yaml

@@ -0,0 +1,55 @@
+{{- if and .Values.qbittorrent.persistence.config.enabled (not .Values.qbittorrent.persistence.config.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "qbittorrent-vpn.fullname" . }}-config
+  labels:
+    {{- include "qbittorrent-vpn.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - {{ .Values.qbittorrent.persistence.config.accessMode | quote }}
+  {{- if .Values.qbittorrent.persistence.config.storageClass }}
+  storageClassName: {{ .Values.qbittorrent.persistence.config.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.qbittorrent.persistence.config.size | quote }}
+{{- end }}
+
+{{- if and .Values.qbittorrent.persistence.downloads.enabled (not .Values.qbittorrent.persistence.downloads.existingClaim) }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "qbittorrent-vpn.fullname" . }}-downloads
+  labels:
+    {{- include "qbittorrent-vpn.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - {{ .Values.qbittorrent.persistence.downloads.accessMode | quote }}
+  {{- if .Values.qbittorrent.persistence.downloads.storageClass }}
+  storageClassName: {{ .Values.qbittorrent.persistence.downloads.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.qbittorrent.persistence.downloads.size | quote }}
+{{- end }}
+
+{{- if and .Values.gluetun.enabled .Values.gluetun.persistence.enabled (not .Values.gluetun.persistence.useEmptyDir) (not .Values.gluetun.persistence.existingClaim) }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "qbittorrent-vpn.fullname" . }}-gluetun
+  labels:
+    {{- include "qbittorrent-vpn.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - {{ .Values.gluetun.persistence.accessMode | quote }}
+  {{- if .Values.gluetun.persistence.storageClass }}
+  storageClassName: {{ .Values.gluetun.persistence.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.gluetun.persistence.size | quote }}
+{{- end }}

charts/qbittorrent-vpn/templates/secret.yaml

@@ -0,0 +1,18 @@
+{{- if and .Values.gluetun.enabled .Values.gluetun.credentials.create }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "qbittorrent-vpn.fullname" . }}-vpn-credentials
+  labels:
+    {{- include "qbittorrent-vpn.labels" . | nindent 4 }}
+type: Opaque
+data:
+  {{- if eq .Values.gluetun.vpn.type "openvpn" }}
+  {{ .Values.gluetun.credentials.usernameKey }}: {{ .Values.gluetun.credentials.username | b64enc | quote }}
+  {{ .Values.gluetun.credentials.passwordKey }}: {{ .Values.gluetun.credentials.password | b64enc | quote }}
+  {{- end }}
+  
+  {{- if and (eq .Values.gluetun.vpn.type "wireguard") .Values.gluetun.vpn.wireguard.privateKey }}
+  wireguard_private_key: {{ .Values.gluetun.vpn.wireguard.privateKey | b64enc | quote }}
+  {{- end }}
+{{- end }}

charts/qbittorrent-vpn/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "qbittorrent-vpn.fullname" . }}
+  labels:
+    {{- include "qbittorrent-vpn.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "qbittorrent-vpn.selectorLabels" . | nindent 4 }}

charts/qbittorrent-vpn/values.yaml

@@ -0,0 +1,228 @@
+## Global settings
+nameOverride: ""
+fullnameOverride: ""
+
+## Deployment settings
+replicaCount: 1
+revisionHistoryLimit: 3
+
+## Pod security settings
+podSecurityContext:
+  runAsNonRoot: false
+  runAsUser: 0    # Run all containers as root
+  fsGroup: 0      # Use root group for volumes
+
+## qBittorrent Image settings
+qbittorrent:
+  image:
+    repository: linuxserver/qbittorrent
+    tag: 5.1.0
+    pullPolicy: IfNotPresent
+  
+  securityContext: {}
+
+  # Open port for BitTorrent traffic
+  bittorrentPort: 6881
+
+  env:
+    - name: PUID
+      value: "0"   # Run as root
+    - name: PGID
+      value: "0"   # Root group
+    - name: TZ
+      value: "UTC"
+    - name: WEBUI_PORT
+      value: "8080"
+  
+  
+  extraEnv: []
+  
+  service:
+    port: 8080
+  
+  #resources:
+  #  limits:
+  #    cpu: 1000m
+  #    memory: 2Gi
+  #  requests:
+  #    cpu: 200m
+  #    memory: 512Mi
+
+  persistence:
+    config:
+      enabled: true
+      existingClaim: ""
+      storageClass: ""
+      accessMode: ReadWriteOnce
+      size: 2Gi
+      mountPath: /config
+    
+    downloads:
+      enabled: true
+      existingClaim: ""
+      storageClass: ""
+      accessMode: ReadWriteOnce
+      size: 2Gi
+      mountPath: /downloads
+
+  # Volume mounts specific to qBittorrent
+  extraVolumeMounts: []
+  
+  # Volumes specific to qBittorrent
+  extraVolumes: []
+
+# Probes for qBittorrent
+probes:
+  liveness:
+    enabled: true
+    path: /
+    initialDelaySeconds: 0  # Startup probe handles delayed start
+    periodSeconds: 30
+    timeoutSeconds: 5
+    failureThreshold: 3
+    successThreshold: 1
+  
+  readiness:
+    enabled: true
+    path: /
+    initialDelaySeconds: 0  # Startup probe handles delayed start
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+    successThreshold: 1
+
+## Gluetun VPN settings
+gluetun:
+  enabled: true
+  image:
+    repository: qmcgaw/gluetun
+    tag: v3.40.0  # Latest version as of this writing
+    pullPolicy: IfNotPresent
+  
+  securityContext:
+    privileged: true
+    capabilities:
+      add:
+        - NET_ADMIN
+  
+  # VPN provider configuration
+  vpn:
+    # Choose from: nordvpn, protonvpn, expressvpn, surfshark, mullvad, ivpn, private internet access, etc.
+    provider: "nordvpn"
+    
+    # Choose from: openvpn or wireguard
+    type: "openvpn"
+    
+    # Server selection (comma-separated lists)
+    serverCountries: "Netherlands"  # e.g., "Netherlands,Germany,Sweden"
+    serverCities: ""            # e.g., "Amsterdam,Frankfurt" (optional)
+    serverNames: ""             # e.g., "nl1,nl2" (optional)
+    randomize: "true"           # Randomize server selection
+    
+    # OpenVPN specific settings (when type is "openvpn")
+    openvpn:
+      # Add any OpenVPN specific settings here, they'll be converted to env vars
+      OPENVPN_PROTOCOL: "udp"
+    
+    # WireGuard specific settings (when type is "wireguard")
+    wireguard:
+      privateKey: ""  # Will be stored in Secret if provided
+      privateKeyExistingSecret: ""
+      privateKeyExistingSecretKey: ""
+      addresses: ""   # e.g., "10.64.222.21/32"
+      endpointIP: ""  # Optional: specify endpoint IP
+      endpointPort: ""  # Optional: specify endpoint port
+      publicKey: ""   # Optional: server public key
+  
+  # VPN credentials (choose one method)
+  credentials:
+    create: true # set to false if using existing secret
+    # For OpenVPN (normal credentials)
+    username: ""
+    password: ""
+    # For WireGuard, the privateKey is specified in vpn.wireguard.privateKey
+    
+    # Alternatively, reference an existing secret
+    existingSecret: ""
+    usernameKey: "username"
+    passwordKey: "password"
+  
+  # General Gluetun settings as environment variables
+  settings:
+    FIREWALL: "on"
+    FIREWALL_OUTBOUND_SUBNETS: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
+    DNS_ADDRESS: "1.1.1.1"
+    HEALTH_SERVER_PORT: "8000"
+    
+    # Important: Add these settings to make networking work correctly with ingress
+    SERVER_ALLOWLIST: "qbittorrent:8080"  # Allow accessing qBittorrent container
+    FIREWALL_INPUT_PORTS: "8080"          # Allow ingress traffic to port 8080
+    FIREWALL_DEBUG: "on"                  # Enable firewall debugging (temporarily)
+    JOURNALD: "off"                       # Disable journald (not needed for debugging)
+    
+    # Optional port forwarding
+    VPN_PORT_FORWARDING: "off"
+  
+  # Extra environment variables
+  extraEnv:
+    - name: LOG_LEVEL
+      value: "info"
+  
+  # Extra ports to expose
+  extraPorts: []
+  # - name: custom-port
+  #   containerPort: 9999
+  #   protocol: TCP
+  
+  # Resources for Gluetun
+  resources:
+    limits:
+      cpu: 300m
+      memory: 256Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+  
+  # Persistence for Gluetun
+  persistence:
+    enabled: true
+    existingClaim: false
+    storageClass: ""
+    accessMode: ReadWriteOnce
+    size: 100Mi
+    
+  # Volume mounts specific to Gluetun
+  extraVolumeMounts: []
+  
+  # Volumes specific to Gluetun
+  extraVolumes: []
+
+## Service settings
+service:
+  type: ClusterIP
+  port: 8080
+
+## Ingress settings
+ingress:
+  enabled: false
+  className: ""
+  annotations: []
+  hosts:
+    - host: qbittorrent.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - hosts:
+        - qbittorrent.example.com
+
+# Additional specifications
+nodeSelector: {}
+tolerations: []
+affinity: {}
+podAnnotations: {}
+extraVolumes: []
+
+# Temporary options for development/debugging
+hostNetwork: false
+initContainers: []

charts/recipya/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: recipya
-description: A Helm chart for Recipya recipe manager application
+description: Recipya helm chart for Kubernetes
 type: application
 version: 0.0.2
 appVersion: "v1.2.2"

charts/recipya/readme.md

@@ -8,6 +8,9 @@ A Helm chart for deploying [Recipya](https://github.com/reaper47/recipya) on Kub
 
 This chart deploys Recipya recipe manager on a Kubernetes cluster using the Helm package manager.
 
+Source code can be found here:
+- https://github.com/rtomik/helm-charts/tree/main/charts/recipya
+
 ## Prerequisites
 
 - Kubernetes 1.19+