viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

stem95su: scheduled Drive->site sync CronJob (every 10m)

Browse source 
CronJob stem95su-gdrive-sync (*/10) mounts the content PVC RW and
rclone-syncs the read-only Drive folder "claude" (stem claude/files) onto
it (rclone/rclone:1.74.3, scope=drive.readonly, empty-source guard +
--max-delete 25). ESO ExternalSecret stem95su-rclone <- Vault
secret/stem95su. Requires the GCP OAuth app published to Production or the
refresh token expires ~weekly.

Lands the gdrive-sync stack on master (it had landed on a feature branch
by accident on the shared devvm checkout).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin 2026-06-09 08:42:26 +00:00
parent 05b50d2b96
commit 6d224861c4
1168 changed files with 120 additions and 358547 deletions
Download patch file Download diff file Expand all files Collapse all files

161
stacks/servarr/readarr/main.tf
View file

@ -1,161 +0,0 @@
variable "tls_secret_name" {}
variable "tier" { type = string }
variable "nfs_server" { type = string }
resource "kubernetes_namespace" "readarr" {
metadata {
name = "readarr"
# labels = {
# "istio-injection" : "enabled"
# }
}
lifecycle {
# KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
}
}
module "tls_secret" {
source = "../../../modules/kubernetes/setup_tls_secret"
namespace = "readarr"
tls_secret_name = var.tls_secret_name
}
module "nfs_data_host" {
source = "../../../modules/kubernetes/nfs_volume"
name = "readarr-data-host"
namespace = "readarr"
nfs_server = "192.168.1.127"
nfs_path = "/srv/nfs/servarr/readarr"
}
module "nfs_qbittorrent_host" {
source = "../../../modules/kubernetes/nfs_volume"
name = "readarr-qbittorrent-host"
namespace = "readarr"
nfs_server = "192.168.1.127"
nfs_path = "/srv/nfs/servarr/qbittorrent"
}
resource "kubernetes_deployment" "readarr" {
metadata {
name = "readarr"
namespace = "readarr"
labels = {
app = "readarr"
tier = var.tier
}
annotations = {
"reloader.stakater.com/search" = "true"
}
}
spec {
replicas = 1
selector {
match_labels = {
app = "readarr"
}
}
template {
metadata {
labels = {
app = "readarr"
}
}
spec {
container {
image = "lscr.io/linuxserver/readarr:develop"
name = "readarr"
port {
container_port = 8787
}
env {
name = "PUID"
value = 1000
}
env {
name = "PGID"
value = 1000
}
env {
name = "TZ"
value = "Etc/UTC"
}
volume_mount {
name = "data"
mount_path = "/config"
}
volume_mount {
name = "data"
mount_path = "/books"
}
volume_mount {
name = "data"
mount_path = "/downloads"
}
volume_mount {
name = "qbittorrent"
mount_path = "/mnt"
read_only = true
}
}
volume {
name = "data"
persistent_volume_claim {
claim_name = module.nfs_data_host.claim_name
}
}
volume {
name = "qbittorrent"
persistent_volume_claim {
claim_name = module.nfs_qbittorrent_host.claim_name
}
}
}
}
}
lifecycle {
# KYVERNO_LIFECYCLE_V1: Kyverno admission webhook mutates dns_config with ndots=2
ignore_changes = [
spec[0].template[0].spec[0].dns_config, # KYVERNO_LIFECYCLE_V1
metadata[0].annotations["keel.sh/policy"],
metadata[0].annotations["keel.sh/trigger"],
metadata[0].annotations["keel.sh/pollSchedule"], # KYVERNO_LIFECYCLE_V2
metadata[0].annotations["keel.sh/match-tag"],
spec[0].template[0].spec[0].container[0].image, # KEEL_IGNORE_IMAGE — Keel manages tag updates
metadata[0].annotations["kubernetes.io/change-cause"],
metadata[0].annotations["deployment.kubernetes.io/revision"],
spec[0].template[0].metadata[0].annotations["keel.sh/update-time"], # KEEL_LIFECYCLE_V1
]
}
}
resource "kubernetes_service" "readarr" {
metadata {
name = "readarr"
namespace = "readarr"
labels = {
app = "readarr"
}
}
spec {
selector = {
app = "readarr"
}
port {
name = "http"
port = 8787
}
}
}
module "ingress" {
source = "../../../modules/kubernetes/ingress_factory"
namespace = "readarr"
name = "readarr"
port = 8787
tls_secret_name = var.tls_secret_name
auth = "required"
}