nextcloud real IPs (but not locally)

lidarr-pvc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: lidarr-pvc
+  namespace: plex
+  labels:
+    app: lidarr
+spec:
+  storageClassName: ceph-block
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi

lidarr.yaml

@@ -0,0 +1,56 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lidarr
+  namespace: plex
+spec:
+  selector:
+    matchLabels:
+      app: lidarr
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: lidarr
+    spec:
+      containers:
+      - name: lidarr
+        image: lscr.io/linuxserver/lidarr:develop-1.1.3.2982-ls75
+        ports:
+        - containerPort: 8686
+          name: http-web-svc
+        env:
+        - name: TZ
+          value: America/New_York
+        - name: PUID
+          value: "1000"
+        - name: PGID
+          value: "1000"
+        volumeMounts:
+        - mountPath: "/plex"
+          name: plex
+        - mountPath: "/config"
+          name: config
+      volumes:
+      - name: plex
+        persistentVolumeClaim:
+          claimName: plex-pvc
+      - name: config
+        persistentVolumeClaim:
+          claimName: lidarr-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: lidarr-service
+  namespace: plex
+spec:
+  selector:
+    app: lidarr
+  type: ClusterIP
+  ports:
+  - name: lidarr-web-port
+    protocol: TCP
+    port: 8686
+    targetPort: http-web-svc

nextcloud/values.yaml

@@ -170,6 +170,10 @@ nextcloud:
         secretKeyRef:
           name: redis-client-secret
           key: REDIS_HOST_PASSWORD
+    # This will only set apache's RemoteIPTrustedProxy, not
+    # RemoteIPInternalProxy. Local IPs will not be passed through.
+    - name: TRUSTED_PROXIES
+      value: "10.42.0.0/16,127.0.0.1"
 
   # Extra init containers that runs before pods start.
   extraInitContainers: []

plex.yaml

@@ -62,6 +62,7 @@ spec:
       - name: media
         persistentVolumeClaim:
           claimName: plex-pvc
+          readOnly: true
       - name: tmpfs
         emptyDir:
           medium: Memory

traefik-helmchartconfig.yaml

@@ -48,4 +48,10 @@ spec:
 
     # Fix for acme.json file being changed to 660 from 600
     podSecurityContext:
-      fsGroup: null
+      fsGroup: null
+
+    service:
+      # type: ClusterIP
+      spec:
+        externalTrafficPolicy: Local
+    hostNetwork: true