kubernetes: move qbittorrent to internal ingress

- move qbittorrent from local loadBalancer svc to internal ingress

kubernetes/README.md

@@ -510,7 +510,11 @@ qBittorrent and wireguard. For security, qBittorrent is not exposed outside the
 network via ingress. It is accessible locally via loadbalancer IP address.
 
 ```bash
-helm install qbittorrent qbittorrent-helm-chart/ --atomic
+source .env
+helm upgrade --install \
+  qbittorrent qbittorrent-helm-chart/ \
+  --set ingress.host=$QBITTORRENT_HOST \
+  --atomic
 ```
 
 After deployment, verify qBittorrent is accessible on the loadbalancer IP and
@@ -937,7 +941,7 @@ helm repo add woodpecker https://woodpecker-ci.org/
 helm repo update
 helm upgrade --install woodpecker woodpecker/woodpecker \
   -f woodpecker-ci/values.yaml \
-  --version 3.2.0 \
+  --version 3.2.1 \
   --namespace woodpecker \
   --create-namespace \
   --set server.ingress.hosts[0].host=$WOODPECKER_HOST \

kubernetes/qbittorrent-helm-chart/templates/ingress.yaml

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Values.ingress.name }}
+  namespace: {{ .Values.namespace }}
+  annotations:
+{{- range $key, $value := .Values.ingress.annotations }}
+    {{ $key }}: {{ $value | quote }}
+{{- end }}
+spec:
+  ingressClassName: {{ .Values.ingress.ingressClassName }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.host }}
+      secretName: qbittorrent-tls
+  rules:
+    - host: {{ .Values.ingress.host }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ .Values.service.name }}
+                port:
+                  number: {{ .Values.service.port }}

kubernetes/qbittorrent-helm-chart/values.yaml

@@ -22,10 +22,17 @@ wireguardImage:
 
 service:
   name: qbittorrent-service
-  type: LoadBalancer
+  type: ClusterIP
   port: 8080
   wireguardPort: 51820
 
+ingress:
+  name: qbittorrent-ingress
+  host: placeholder
+  ingressClassName: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: "acme-issuer"
+
 persistence:
   config:
     enabled: true