feat(examples): add deployment examples for common use cases

Add 5 example configurations covering popular deployment scenarios:

1. minimal.yaml - Quick start with ephemeral storage
2. production.yaml - Production setup with PVC and resource limits
3. hardware-acceleration.yaml - GPU transcoding (Intel QuickSync)
4. ingress-tls.yaml - External access with HTTPS and cert-manager
5. network-policy.yaml - Secure deployment with network isolation

Includes comprehensive README explaining usage and combinations.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

charts/jellyfin/examples/README.md

@@ -0,0 +1,128 @@
+# Jellyfin Helm Chart Examples
+
+This directory contains example configurations for common Jellyfin deployment scenarios.
+
+## Available Examples
+
+### 1. Minimal (`minimal.yaml`)
+
+Quick start configuration with ephemeral storage for testing purposes.
+
+```bash
+helm install jellyfin jellyfin/jellyfin -f examples/minimal.yaml
+```
+
+**Use case**: Development, testing, demo environments.
+
+**Note**: All data will be lost when the pod is restarted.
+
+---
+
+### 2. Production (`production.yaml`)
+
+Production-ready configuration with persistent storage, resource limits, and optimized health probes.
+
+```bash
+helm install jellyfin jellyfin/jellyfin -f examples/production.yaml
+```
+
+**Features**:
+
+- Persistent storage for config, media, and cache
+- Resource requests and limits
+- Optimized health probes for large libraries
+- Security context with non-root user
+
+---
+
+### 3. Hardware Acceleration (`hardware-acceleration.yaml`)
+
+Enable GPU acceleration for video transcoding (Intel QuickSync example).
+
+```bash
+helm install jellyfin jellyfin/jellyfin -f examples/hardware-acceleration.yaml
+```
+
+**Prerequisites**:
+
+- Node with compatible GPU (Intel/AMD/NVIDIA)
+- GPU device plugin installed in cluster
+- Appropriate node labels/taints
+
+**Note**: Adjust device paths and capabilities for your specific GPU type. See [Jellyfin documentation](https://jellyfin.org/docs/general/administration/hardware-acceleration/) for details.
+
+---
+
+### 4. Ingress with TLS (`ingress-tls.yaml`)
+
+External access via HTTPS with automatic certificate management.
+
+```bash
+helm install jellyfin jellyfin/jellyfin -f examples/ingress-tls.yaml
+```
+
+**Prerequisites**:
+
+- Ingress controller (e.g., ingress-nginx)
+- cert-manager for automatic TLS certificates (optional)
+- DNS record pointing to your cluster
+
+**Configuration**:
+
+- Update `jellyfin.example.com` to your actual domain
+- Adjust cert-manager issuer if using different CA
+
+---
+
+### 5. NetworkPolicy Security (`network-policy.yaml`)
+
+Secure deployment with network isolation and controlled traffic flow.
+
+```bash
+helm install jellyfin jellyfin/jellyfin -f examples/network-policy.yaml
+```
+
+**Prerequisites**:
+
+- CNI plugin with NetworkPolicy support (Calico, Cilium, Weave, Canal)
+- Ingress controller with known namespace/labels
+
+**Features**:
+
+- Restrict ingress to Ingress controller only
+- Allow egress for DNS and metadata providers (HTTPS/443)
+- Block unrestricted pod-to-pod communication
+
+---
+
+## Combining Examples
+
+You can combine multiple example files to create custom configurations:
+
+```bash
+helm install jellyfin jellyfin/jellyfin \
+  -f examples/production.yaml \
+  -f examples/hardware-acceleration.yaml \
+  -f examples/ingress-tls.yaml
+```
+
+Files are merged in order, with later files overriding earlier ones.
+
+## Custom Values
+
+All examples can be further customized by overriding specific values:
+
+```bash
+helm install jellyfin jellyfin/jellyfin \
+  -f examples/production.yaml \
+  --set persistence.media.size=1Ti \
+  --set resources.limits.memory=16Gi
+```
+
+## Getting Help
+
+For more configuration options, see:
+
+- [Chart README](../README.md)
+- [values.yaml](../values.yaml) - Complete configuration reference
+- [Jellyfin Documentation](https://jellyfin.org/docs/)

charts/jellyfin/examples/hardware-acceleration.yaml

@@ -0,0 +1,62 @@
+# Hardware Acceleration (Intel QuickSync)
+# Enables GPU acceleration for video transcoding
+#
+# Prerequisites:
+# - Node with Intel GPU
+# - GPU device plugin installed in cluster
+#
+# Usage:
+#   helm install jellyfin jellyfin/jellyfin -f hardware-acceleration.yaml
+#
+# For other GPU types (AMD/NVIDIA), adjust device paths and security context accordingly.
+# See: https://jellyfin.org/docs/general/administration/hardware-acceleration/
+
+# Security context for hardware acceleration
+securityContext:
+  # Required capabilities for GPU access
+  capabilities:
+    add:
+      - SYS_ADMIN
+    drop:
+      - ALL
+  privileged: false
+  runAsUser: 1000
+  runAsGroup: 1000
+  fsGroup: 1000
+
+# Mount GPU device
+volumes:
+  - name: render-device
+    hostPath:
+      path: /dev/dri
+      type: Directory
+
+volumeMounts:
+  - name: render-device
+    mountPath: /dev/dri
+
+# Optional: Resource limits for GPU
+# Uncomment and adjust for your GPU device plugin
+# resources:
+#   limits:
+#     gpu.intel.com/i915: 1
+#   requests:
+#     gpu.intel.com/i915: 1
+
+# Persistent storage
+persistence:
+  config:
+    enabled: true
+    size: 10Gi
+  media:
+    enabled: true
+    size: 500Gi
+  cache:
+    enabled: true
+    size: 50Gi  # Larger cache for transcoding
+
+# Transcoding environment variables (optional)
+jellyfin:
+  env:
+    - name: JELLYFIN_PublishedServerUrl
+      value: "https://jellyfin.example.com"

charts/jellyfin/examples/ingress-tls.yaml

@@ -0,0 +1,58 @@
+# Jellyfin with Ingress and TLS
+# External access via HTTPS with certificate management
+#
+# Prerequisites:
+# - Ingress controller installed (e.g., ingress-nginx)
+# - cert-manager for TLS certificate automation (optional)
+#
+# Usage:
+#   helm install jellyfin jellyfin/jellyfin -f ingress-tls.yaml
+
+# Ingress configuration
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    # cert-manager annotation for automatic certificate provisioning
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    # Recommended nginx settings for Jellyfin
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-buffering: "off"
+    nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      proxy_set_header X-Forwarded-Protocol $scheme;
+      proxy_set_header X-Forwarded-Host $http_host;
+
+  hosts:
+    - host: jellyfin.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+
+  tls:
+    - secretName: jellyfin-tls
+      hosts:
+        - jellyfin.example.com
+
+# Service configuration
+service:
+  type: ClusterIP
+  port: 8096
+
+# Persistent storage
+persistence:
+  config:
+    enabled: true
+    size: 10Gi
+  media:
+    enabled: true
+    size: 500Gi
+  cache:
+    enabled: true
+    size: 20Gi
+
+# Set published server URL for external access
+jellyfin:
+  env:
+    - name: JELLYFIN_PublishedServerUrl
+      value: "https://jellyfin.example.com"

charts/jellyfin/examples/minimal.yaml

@@ -0,0 +1,19 @@
+# Minimal Jellyfin deployment
+# Quick start with default settings and ephemeral storage
+#
+# Usage:
+#   helm install jellyfin jellyfin/jellyfin -f minimal.yaml
+
+# Use ephemeral storage for testing
+persistence:
+  config:
+    enabled: false
+  media:
+    enabled: false
+  cache:
+    enabled: false
+
+# Basic service configuration
+service:
+  type: ClusterIP
+  port: 8096

charts/jellyfin/examples/network-policy.yaml

@@ -0,0 +1,74 @@
+# Secure Jellyfin deployment with NetworkPolicy
+# Network isolation with controlled ingress/egress
+#
+# Prerequisites:
+# - CNI plugin with NetworkPolicy support (Calico, Cilium, etc.)
+# - Ingress controller running in ingress-nginx namespace
+#
+# Usage:
+#   helm install jellyfin jellyfin/jellyfin -f network-policy.yaml
+
+# NetworkPolicy configuration
+networkPolicy:
+  enabled: true
+
+  # Ingress: Allow only from Ingress controller
+  ingress:
+    allowExternal: false
+    namespaceSelector:
+      matchLabels:
+        name: ingress-nginx
+    podSelector:
+      matchLabels:
+        app.kubernetes.io/name: ingress-nginx
+
+  # Egress: Restricted for security
+  egress:
+    allowDNS: true  # Required for DNS resolution
+    allowAllEgress: false  # Block unrestricted internet
+    restrictedEgress:
+      allowMetadata: true  # Allow HTTPS/443 for TMDB, TheTVDB, etc.
+      allowInCluster: false  # Block pod-to-pod communication
+
+# Ingress for external access
+ingress:
+  enabled: true
+  className: nginx
+  hosts:
+    - host: jellyfin.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+
+# Persistent storage
+persistence:
+  config:
+    enabled: true
+    size: 10Gi
+  media:
+    enabled: true
+    size: 500Gi
+  cache:
+    enabled: true
+    size: 20Gi
+
+# Security context
+securityContext:
+  runAsUser: 1000
+  runAsGroup: 1000
+  fsGroup: 1000
+  runAsNonRoot: true
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: false
+  capabilities:
+    drop:
+      - ALL
+
+# Resource limits
+resources:
+  limits:
+    cpu: 2000m
+    memory: 4Gi
+  requests:
+    cpu: 500m
+    memory: 1Gi

charts/jellyfin/examples/production.yaml

@@ -0,0 +1,76 @@
+# Production Jellyfin deployment
+# Persistent storage, resource limits, and health probes
+#
+# Usage:
+#   helm install jellyfin jellyfin/jellyfin -f production.yaml
+
+# Persistent storage configuration
+persistence:
+  config:
+    enabled: true
+    size: 10Gi
+    storageClass: ""  # Use default storage class
+    accessModes:
+      - ReadWriteOnce
+
+  media:
+    enabled: true
+    size: 500Gi
+    storageClass: ""
+    accessModes:
+      - ReadWriteOnce
+
+  cache:
+    enabled: true
+    size: 20Gi
+    storageClass: ""
+    accessModes:
+      - ReadWriteOnce
+
+# Resource limits and requests
+resources:
+  limits:
+    cpu: 4000m
+    memory: 8Gi
+  requests:
+    cpu: 1000m
+    memory: 2Gi
+
+# Health probes with adjusted timeouts for large libraries
+startupProbe:
+  enabled: true
+  initialDelaySeconds: 0
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 60
+
+livenessProbe:
+  enabled: true
+  initialDelaySeconds: 0
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 3
+
+readinessProbe:
+  enabled: true
+  initialDelaySeconds: 0
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 3
+
+# Security context
+securityContext:
+  runAsUser: 1000
+  runAsGroup: 1000
+  fsGroup: 1000
+  runAsNonRoot: true
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: false
+  capabilities:
+    drop:
+      - ALL
+
+# Service configuration
+service:
+  type: ClusterIP
+  port: 8096