feat: MediaServices | add ingress for arr services

media-services/index.ts

@@ -76,6 +76,7 @@ export class MediaServices extends TerraformStack {
     new ProwlarrServer(this, "prowlarr", {
       provider,
       namespace,
+      host: "prowlarr.dogar.dev",
     });
   }
 }

media-services/jellyfin/index.ts

@@ -2,7 +2,11 @@ import { Construct } from "constructs";
 import { DeploymentV1 } from "@cdktf/provider-kubernetes/lib/deployment-v1";
 import { ServiceV1 } from "@cdktf/provider-kubernetes/lib/service-v1";
 
-import { InternalIngressRoute, LonghornPvc } from "../../utils";
+import {
+  CloudflareCertificate,
+  InternalIngressRoute,
+  LonghornPvc,
+} from "../../utils";
 import { BaseMediaServiceOptions, getAamil3NodeSelector } from "../types";
 
 type JellyfinServerOptions = BaseMediaServiceOptions & {
@@ -137,6 +141,14 @@ export class JellyfinServer extends Construct {
       },
     });
 
+    new CloudflareCertificate(this, "certificate", {
+      provider,
+      namespace,
+      name,
+      secretName: "jellyfin-tls",
+      dnsNames: [host],
+    });
+
     // Ingress - using internal ingress for secure access
     new InternalIngressRoute(this, "ingress", {
       provider,
@@ -145,6 +157,7 @@ export class JellyfinServer extends Construct {
       host,
       serviceName: name,
       servicePort: 80,
+      tlsSecretName: "jellyfin-tls",
     });
   }
 }

media-services/prowlarr/index.ts

@@ -2,18 +2,27 @@ import { Construct } from "constructs";
 import { DeploymentV1 } from "@cdktf/provider-kubernetes/lib/deployment-v1";
 import { ServiceV1 } from "@cdktf/provider-kubernetes/lib/service-v1";
 
-import { LonghornPvc } from "../../utils";
+import {
+  InternalIngressRoute,
+  LonghornPvc,
+  PrivateCertificate,
+} from "../../utils";
 import {
   BaseMediaServiceOptions,
   getWorkerNodeSelector,
   getCommonEnv,
 } from "../types";
 
+type ProwlarrOptions = BaseMediaServiceOptions & {
+  /** Hostname for the ingress */
+  host: string;
+};
+
 export class ProwlarrServer extends Construct {
-  constructor(scope: Construct, id: string, options: BaseMediaServiceOptions) {
+  constructor(scope: Construct, id: string, options: ProwlarrOptions) {
     super(scope, id);
 
-    const { provider, namespace } = options;
+    const { provider, namespace, host } = options;
     const name = "prowlarr";
 
     // Config PVC with backup
@@ -102,6 +111,24 @@ export class ProwlarrServer extends Construct {
       },
     });
 
-    // Note: No ingress - Prowlarr is for internal use only
+    new PrivateCertificate(this, "certificate", {
+      provider,
+      namespace,
+      name,
+      commonName: host,
+      dnsNames: [host],
+      secretName: `${name}-tls`,
+    });
+
+    // Ingress
+    new InternalIngressRoute(this, "ingress", {
+      provider,
+      namespace,
+      name,
+      host,
+      serviceName: name,
+      servicePort: 80,
+      tlsSecretName: `${name}-tls`,
+    });
   }
 }

media-services/qbittorrent/index.ts

@@ -2,7 +2,11 @@ import { Construct } from "constructs";
 import { DeploymentV1 } from "@cdktf/provider-kubernetes/lib/deployment-v1";
 import { ServiceV1 } from "@cdktf/provider-kubernetes/lib/service-v1";
 
-import { InternalIngressRoute, LonghornPvc } from "../../utils";
+import {
+  InternalIngressRoute,
+  LonghornPvc,
+  PrivateCertificate,
+} from "../../utils";
 import {
   BaseMediaServiceOptions,
   getAamil3NodeSelector,
@@ -17,11 +21,7 @@ type QBittorrentServerOptions = BaseMediaServiceOptions & {
 };
 
 export class QBittorrentServer extends Construct {
-  constructor(
-    scope: Construct,
-    id: string,
-    options: QBittorrentServerOptions,
-  ) {
+  constructor(scope: Construct, id: string, options: QBittorrentServerOptions) {
     super(scope, id);
 
     const { provider, namespace, downloadsPvcName, host } = options;
@@ -137,6 +137,15 @@ export class QBittorrentServer extends Construct {
       },
     });
 
+    new PrivateCertificate(this, "certificate", {
+      provider,
+      namespace,
+      name,
+      commonName: host,
+      dnsNames: [host],
+      secretName: `${name}-tls`,
+    });
+
     // Ingress
     new InternalIngressRoute(this, "ingress", {
       provider,
@@ -145,6 +154,7 @@ export class QBittorrentServer extends Construct {
       host,
       serviceName: name,
       servicePort: 80,
+      tlsSecretName: `${name}-tls`,
     });
   }
 }

media-services/radarr/index.ts

@@ -2,7 +2,11 @@ import { Construct } from "constructs";
 import { DeploymentV1 } from "@cdktf/provider-kubernetes/lib/deployment-v1";
 import { ServiceV1 } from "@cdktf/provider-kubernetes/lib/service-v1";
 
-import { InternalIngressRoute, LonghornPvc } from "../../utils";
+import {
+  InternalIngressRoute,
+  LonghornPvc,
+  PrivateCertificate,
+} from "../../utils";
 import {
   BaseMediaServiceOptions,
   getAamil3NodeSelector,
@@ -132,6 +136,15 @@ export class RadarrServer extends Construct {
       },
     });
 
+    new PrivateCertificate(this, "certificate", {
+      provider,
+      namespace,
+      name,
+      commonName: host,
+      dnsNames: [host],
+      secretName: `${name}-tls`,
+    });
+
     // Ingress
     new InternalIngressRoute(this, "ingress", {
       provider,
@@ -140,6 +153,7 @@ export class RadarrServer extends Construct {
       host,
       serviceName: name,
       servicePort: 80,
+      tlsSecretName: `${name}-tls`,
     });
   }
 }

media-services/sonarr/index.ts

@@ -2,7 +2,11 @@ import { Construct } from "constructs";
 import { DeploymentV1 } from "@cdktf/provider-kubernetes/lib/deployment-v1";
 import { ServiceV1 } from "@cdktf/provider-kubernetes/lib/service-v1";
 
-import { InternalIngressRoute, LonghornPvc } from "../../utils";
+import {
+  InternalIngressRoute,
+  LonghornPvc,
+  PrivateCertificate,
+} from "../../utils";
 import {
   BaseMediaServiceOptions,
   getAamil3NodeSelector,
@@ -132,6 +136,15 @@ export class SonarrServer extends Construct {
       },
     });
 
+    new PrivateCertificate(this, "certificate", {
+      provider,
+      namespace,
+      name,
+      commonName: host,
+      dnsNames: [host],
+      secretName: `${name}-tls`,
+    });
+
     // Ingress
     new InternalIngressRoute(this, "ingress", {
       provider,
@@ -140,6 +153,7 @@ export class SonarrServer extends Construct {
       host,
       serviceName: name,
       servicePort: 80,
+      tlsSecretName: `${name}-tls`,
     });
   }
 }