diff --git a/charts/jellyfin/examples/README.md b/charts/jellyfin/examples/README.md new file mode 100644 index 0000000..27eef2f --- /dev/null +++ b/charts/jellyfin/examples/README.md @@ -0,0 +1,128 @@ +# Jellyfin Helm Chart Examples + +This directory contains example configurations for common Jellyfin deployment scenarios. + +## Available Examples + +### 1. Minimal (`minimal.yaml`) + +Quick start configuration with ephemeral storage for testing purposes. + +```bash +helm install jellyfin jellyfin/jellyfin -f examples/minimal.yaml +``` + +**Use case**: Development, testing, demo environments. + +**Note**: All data will be lost when the pod is restarted. + +--- + +### 2. Production (`production.yaml`) + +Production-ready configuration with persistent storage, resource limits, and optimized health probes. + +```bash +helm install jellyfin jellyfin/jellyfin -f examples/production.yaml +``` + +**Features**: + +- Persistent storage for config, media, and cache +- Resource requests and limits +- Optimized health probes for large libraries +- Security context with non-root user + +--- + +### 3. Hardware Acceleration (`hardware-acceleration.yaml`) + +Enable GPU acceleration for video transcoding (Intel QuickSync example). + +```bash +helm install jellyfin jellyfin/jellyfin -f examples/hardware-acceleration.yaml +``` + +**Prerequisites**: + +- Node with compatible GPU (Intel/AMD/NVIDIA) +- GPU device plugin installed in cluster +- Appropriate node labels/taints + +**Note**: Adjust device paths and capabilities for your specific GPU type. See [Jellyfin documentation](https://jellyfin.org/docs/general/administration/hardware-acceleration/) for details. + +--- + +### 4. Ingress with TLS (`ingress-tls.yaml`) + +External access via HTTPS with automatic certificate management. + +```bash +helm install jellyfin jellyfin/jellyfin -f examples/ingress-tls.yaml +``` + +**Prerequisites**: + +- Ingress controller (e.g., ingress-nginx) +- cert-manager for automatic TLS certificates (optional) +- DNS record pointing to your cluster + +**Configuration**: + +- Update `jellyfin.example.com` to your actual domain +- Adjust cert-manager issuer if using different CA + +--- + +### 5. NetworkPolicy Security (`network-policy.yaml`) + +Secure deployment with network isolation and controlled traffic flow. + +```bash +helm install jellyfin jellyfin/jellyfin -f examples/network-policy.yaml +``` + +**Prerequisites**: + +- CNI plugin with NetworkPolicy support (Calico, Cilium, Weave, Canal) +- Ingress controller with known namespace/labels + +**Features**: + +- Restrict ingress to Ingress controller only +- Allow egress for DNS and metadata providers (HTTPS/443) +- Block unrestricted pod-to-pod communication + +--- + +## Combining Examples + +You can combine multiple example files to create custom configurations: + +```bash +helm install jellyfin jellyfin/jellyfin \ + -f examples/production.yaml \ + -f examples/hardware-acceleration.yaml \ + -f examples/ingress-tls.yaml +``` + +Files are merged in order, with later files overriding earlier ones. + +## Custom Values + +All examples can be further customized by overriding specific values: + +```bash +helm install jellyfin jellyfin/jellyfin \ + -f examples/production.yaml \ + --set persistence.media.size=1Ti \ + --set resources.limits.memory=16Gi +``` + +## Getting Help + +For more configuration options, see: + +- [Chart README](../README.md) +- [values.yaml](../values.yaml) - Complete configuration reference +- [Jellyfin Documentation](https://jellyfin.org/docs/) diff --git a/charts/jellyfin/examples/hardware-acceleration.yaml b/charts/jellyfin/examples/hardware-acceleration.yaml new file mode 100644 index 0000000..6353585 --- /dev/null +++ b/charts/jellyfin/examples/hardware-acceleration.yaml @@ -0,0 +1,62 @@ +# Hardware Acceleration (Intel QuickSync) +# Enables GPU acceleration for video transcoding +# +# Prerequisites: +# - Node with Intel GPU +# - GPU device plugin installed in cluster +# +# Usage: +# helm install jellyfin jellyfin/jellyfin -f hardware-acceleration.yaml +# +# For other GPU types (AMD/NVIDIA), adjust device paths and security context accordingly. +# See: https://jellyfin.org/docs/general/administration/hardware-acceleration/ + +# Security context for hardware acceleration +securityContext: + # Required capabilities for GPU access + capabilities: + add: + - SYS_ADMIN + drop: + - ALL + privileged: false + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + +# Mount GPU device +volumes: + - name: render-device + hostPath: + path: /dev/dri + type: Directory + +volumeMounts: + - name: render-device + mountPath: /dev/dri + +# Optional: Resource limits for GPU +# Uncomment and adjust for your GPU device plugin +# resources: +# limits: +# gpu.intel.com/i915: 1 +# requests: +# gpu.intel.com/i915: 1 + +# Persistent storage +persistence: + config: + enabled: true + size: 10Gi + media: + enabled: true + size: 500Gi + cache: + enabled: true + size: 50Gi # Larger cache for transcoding + +# Transcoding environment variables (optional) +jellyfin: + env: + - name: JELLYFIN_PublishedServerUrl + value: "https://jellyfin.example.com" diff --git a/charts/jellyfin/examples/ingress-tls.yaml b/charts/jellyfin/examples/ingress-tls.yaml new file mode 100644 index 0000000..a16bb47 --- /dev/null +++ b/charts/jellyfin/examples/ingress-tls.yaml @@ -0,0 +1,58 @@ +# Jellyfin with Ingress and TLS +# External access via HTTPS with certificate management +# +# Prerequisites: +# - Ingress controller installed (e.g., ingress-nginx) +# - cert-manager for TLS certificate automation (optional) +# +# Usage: +# helm install jellyfin jellyfin/jellyfin -f ingress-tls.yaml + +# Ingress configuration +ingress: + enabled: true + className: nginx + annotations: + # cert-manager annotation for automatic certificate provisioning + cert-manager.io/cluster-issuer: letsencrypt-prod + # Recommended nginx settings for Jellyfin + nginx.ingress.kubernetes.io/proxy-body-size: "0" + nginx.ingress.kubernetes.io/proxy-buffering: "off" + nginx.ingress.kubernetes.io/proxy-request-buffering: "off" + nginx.ingress.kubernetes.io/configuration-snippet: | + proxy_set_header X-Forwarded-Protocol $scheme; + proxy_set_header X-Forwarded-Host $http_host; + + hosts: + - host: jellyfin.example.com + paths: + - path: / + pathType: Prefix + + tls: + - secretName: jellyfin-tls + hosts: + - jellyfin.example.com + +# Service configuration +service: + type: ClusterIP + port: 8096 + +# Persistent storage +persistence: + config: + enabled: true + size: 10Gi + media: + enabled: true + size: 500Gi + cache: + enabled: true + size: 20Gi + +# Set published server URL for external access +jellyfin: + env: + - name: JELLYFIN_PublishedServerUrl + value: "https://jellyfin.example.com" diff --git a/charts/jellyfin/examples/minimal.yaml b/charts/jellyfin/examples/minimal.yaml new file mode 100644 index 0000000..b6e3c6f --- /dev/null +++ b/charts/jellyfin/examples/minimal.yaml @@ -0,0 +1,19 @@ +# Minimal Jellyfin deployment +# Quick start with default settings and ephemeral storage +# +# Usage: +# helm install jellyfin jellyfin/jellyfin -f minimal.yaml + +# Use ephemeral storage for testing +persistence: + config: + enabled: false + media: + enabled: false + cache: + enabled: false + +# Basic service configuration +service: + type: ClusterIP + port: 8096 diff --git a/charts/jellyfin/examples/network-policy.yaml b/charts/jellyfin/examples/network-policy.yaml new file mode 100644 index 0000000..2b86c8f --- /dev/null +++ b/charts/jellyfin/examples/network-policy.yaml @@ -0,0 +1,74 @@ +# Secure Jellyfin deployment with NetworkPolicy +# Network isolation with controlled ingress/egress +# +# Prerequisites: +# - CNI plugin with NetworkPolicy support (Calico, Cilium, etc.) +# - Ingress controller running in ingress-nginx namespace +# +# Usage: +# helm install jellyfin jellyfin/jellyfin -f network-policy.yaml + +# NetworkPolicy configuration +networkPolicy: + enabled: true + + # Ingress: Allow only from Ingress controller + ingress: + allowExternal: false + namespaceSelector: + matchLabels: + name: ingress-nginx + podSelector: + matchLabels: + app.kubernetes.io/name: ingress-nginx + + # Egress: Restricted for security + egress: + allowDNS: true # Required for DNS resolution + allowAllEgress: false # Block unrestricted internet + restrictedEgress: + allowMetadata: true # Allow HTTPS/443 for TMDB, TheTVDB, etc. + allowInCluster: false # Block pod-to-pod communication + +# Ingress for external access +ingress: + enabled: true + className: nginx + hosts: + - host: jellyfin.example.com + paths: + - path: / + pathType: Prefix + +# Persistent storage +persistence: + config: + enabled: true + size: 10Gi + media: + enabled: true + size: 500Gi + cache: + enabled: true + size: 20Gi + +# Security context +securityContext: + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + capabilities: + drop: + - ALL + +# Resource limits +resources: + limits: + cpu: 2000m + memory: 4Gi + requests: + cpu: 500m + memory: 1Gi diff --git a/charts/jellyfin/examples/production.yaml b/charts/jellyfin/examples/production.yaml new file mode 100644 index 0000000..104f4ac --- /dev/null +++ b/charts/jellyfin/examples/production.yaml @@ -0,0 +1,76 @@ +# Production Jellyfin deployment +# Persistent storage, resource limits, and health probes +# +# Usage: +# helm install jellyfin jellyfin/jellyfin -f production.yaml + +# Persistent storage configuration +persistence: + config: + enabled: true + size: 10Gi + storageClass: "" # Use default storage class + accessModes: + - ReadWriteOnce + + media: + enabled: true + size: 500Gi + storageClass: "" + accessModes: + - ReadWriteOnce + + cache: + enabled: true + size: 20Gi + storageClass: "" + accessModes: + - ReadWriteOnce + +# Resource limits and requests +resources: + limits: + cpu: 4000m + memory: 8Gi + requests: + cpu: 1000m + memory: 2Gi + +# Health probes with adjusted timeouts for large libraries +startupProbe: + enabled: true + initialDelaySeconds: 0 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 60 + +livenessProbe: + enabled: true + initialDelaySeconds: 0 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + +readinessProbe: + enabled: true + initialDelaySeconds: 0 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + +# Security context +securityContext: + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + capabilities: + drop: + - ALL + +# Service configuration +service: + type: ClusterIP + port: 8096