Aleksei SviridkinandClaude
3820862a1a
Add 5 example configurations covering popular deployment scenarios: 1. minimal.yaml - Quick start with ephemeral storage 2. production.yaml - Production setup with PVC and resource limits 3. hardware-acceleration.yaml - GPU transcoding (Intel QuickSync) 4. ingress-tls.yaml - External access with HTTPS and cert-manager 5. network-policy.yaml - Secure deployment with network isolation Includes comprehensive README explaining usage and combinations. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
75 lines
1.6 KiB
YAML
75 lines
1.6 KiB
YAML
# Secure Jellyfin deployment with NetworkPolicy
|
|
# Network isolation with controlled ingress/egress
|
|
#
|
|
# Prerequisites:
|
|
# - CNI plugin with NetworkPolicy support (Calico, Cilium, etc.)
|
|
# - Ingress controller running in ingress-nginx namespace
|
|
#
|
|
# Usage:
|
|
# helm install jellyfin jellyfin/jellyfin -f network-policy.yaml
|
|
|
|
# NetworkPolicy configuration
|
|
networkPolicy:
|
|
enabled: true
|
|
|
|
# Ingress: Allow only from Ingress controller
|
|
ingress:
|
|
allowExternal: false
|
|
namespaceSelector:
|
|
matchLabels:
|
|
name: ingress-nginx
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: ingress-nginx
|
|
|
|
# Egress: Restricted for security
|
|
egress:
|
|
allowDNS: true # Required for DNS resolution
|
|
allowAllEgress: false # Block unrestricted internet
|
|
restrictedEgress:
|
|
allowMetadata: true # Allow HTTPS/443 for TMDB, TheTVDB, etc.
|
|
allowInCluster: false # Block pod-to-pod communication
|
|
|
|
# Ingress for external access
|
|
ingress:
|
|
enabled: true
|
|
className: nginx
|
|
hosts:
|
|
- host: jellyfin.example.com
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
|
|
# Persistent storage
|
|
persistence:
|
|
config:
|
|
enabled: true
|
|
size: 10Gi
|
|
media:
|
|
enabled: true
|
|
size: 500Gi
|
|
cache:
|
|
enabled: true
|
|
size: 20Gi
|
|
|
|
# Security context
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
runAsNonRoot: true
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
|
|
# Resource limits
|
|
resources:
|
|
limits:
|
|
cpu: 2000m
|
|
memory: 4Gi
|
|
requests:
|
|
cpu: 500m
|
|
memory: 1Gi
|