find a way to add gluetun as proxy instead as a sidecar container

external_manifests/servarr/gluetun-secret-netherland.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+data:
+  VPN_DNS_IP: MTAuMi4wLjE=
+  VPN_ENDPOINT_IP: MjEyLjguMjUzLjEzNw==
+  VPN_ENDPOINT_PORT: NTE4MjA=
+  WIREGUARD_PRIVATE_KEY: Y0grY0hLd3FMeXV3UlVlZy8wRjFYWVlDQVM4bkQwWGsxNmVOQlVLc2tYbz0=
+  WIREGUARD_PUBLIC_KEY: VVJwZVp4dHlVWEFVVUEwTVdjRmRDU2E3RitNdmNoSjRlTlNKVWV0S0VHaz0=
+kind: Secret
+metadata:
+  creationTimestamp: null
+  name: gluetun-secret-netherland
+  namespace: tservarr

module.tf

@@ -54,7 +54,9 @@ variable "kubernetes" {
     #      requests-cpu    = "200m"
     #      requests-memory = "200Mi"
     #    })
+    dns_nameservers       = optional(string)
     environment_variables = optional(map(string), { name = "value" })
+    security_context      = optional(bool, false)
   }))
 
 }
@@ -384,6 +386,15 @@ resource "kubernetes_deployment_v1" "automatic" {
           #            }
           #          }
 
+          dynamic "security_context" {
+            for_each = each.value.security_context == true ? [1] : []
+            content {
+              privileged = true
+              #capabilities = {
+              #  add : ["NET_ADMIN", "NET_RAW"]
+              #}
+            }
+          }
           dynamic "liveness_probe" {
             for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
             content {
@@ -394,7 +405,6 @@ resource "kubernetes_deployment_v1" "automatic" {
                 }
               }
 
-
               dynamic "http_get" {
                 for_each = each.value.liveness_http_get != null ? [""] : []
                 content {
@@ -408,7 +418,13 @@ resource "kubernetes_deployment_v1" "automatic" {
             }
           }
         }
+        dynamic "dns_config" {
+          for_each = each.value.dns_nameservers != null ? [1] : []
+          content {
+            nameservers = [each.value.dns_nameservers]
+          }
 
+        }
 
         dynamic "volume" {
           for_each = each.value.pvc != null ? each.value.pvc : {}

variables.auto.tfvars

@@ -358,10 +358,10 @@ kubernetes = {
     redis = {
     image = "docker.io/library/redis:7" }
     requirements = {
-      limits-cpu      = "800Mi"
+      limits-cpu      = "800m"
       limits-memory   = "800Mi"
-      requests-cpu    = "800Mi"
+      requests-cpu    = "10m"
-      requests-memory = "800Mi"
+      requests-memory = "300Mi"
     }
     extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/paperless/Paperless.secret.yaml"]
     #config_map_ref = ["config"]
@@ -395,13 +395,13 @@ kubernetes = {
         value = "https://paper.tryton.geeraert.eu"
       }
       PAPERLESS_TIKA_ENABLED = {
-        value = "1"
+        value = "0"
       }
       PAPERLESS_TIKA_GOTENBERG_ENDPOINT = {
-        value = "http://gotenberg-svc.gotenberg.svc:3000"
+        value = "http://gotenberg-svc.paper.svc:3000"
       }
       PAPERLESS_TIKA_ENDPOINT = {
-        value = "http://tika-svc.tika.svc:9998"
+        value = "http://tika-svc.paper.svc:9998"
       }
 
 
@@ -453,12 +453,12 @@ kubernetes = {
         pvc_size   = "2Mi"
         mount_path = "/usr/src/paperless/data"
       }
-      export = {
+      #    export = {
-        host_path  = "/tmp"
+      #      host_path  = "/tmp"
-        name       = "export"
+      #      name       = "export"
-        pvc_size   = "2Mi"
+      #      pvc_size   = "2Mi"
-        mount_path = "/usr/src/paperless/export"
+      #      mount_path = "/usr/src/paperless/export"
-      }
+      #    }
       consume = {
         pvc        = true
         name       = "consume"
@@ -470,8 +470,7 @@ kubernetes = {
   gotenberg = {
     enabled             = false
     name                = "gotenberg"
-    namespace                = "paper"
+    connected_namespace = "paper"
-    block_namespace_creation = true
     image               = "gotenberg/gotenberg:7.9.2"
     service_port        = 3000
 
@@ -487,6 +486,7 @@ kubernetes = {
   tika = {
     enabled             = false
     name                = "tika"
+    connected_namespace = "paper"
     image               = "ghcr.io/paperless-ngx/tika"
     service_port        = 9998
 
@@ -735,7 +735,7 @@ kubernetes = {
 
   }
   pinchflat = {
-#    enabled      = false
+    enabled             = false
     connected_namespace = "screeps"
     image               = "ghcr.io/kieraneglin/pinchflat:latest"
     service_port        = 8945
@@ -784,4 +784,149 @@ kubernetes = {
 
   }
 
+  gluetun = {
+           enabled        = false
+    namespace        = "tservarr"
+    dns_nameservers  = "10.2.0.1"
+    replicas         = 01
+    image            = "qmcgaw/gluetun:latest"
+    service_port     = 8888
+    extra_manifest   = ["/opt/kubernetes/Terraform_kube/external_manifests/servarr/gluetun-secret-netherland.yaml"]
+    security_context = true
+    #    requirements = {
+    #      limits-cpu      = "800Mi"
+    #      limits-memory   = "800Mi"
+    #      requests-cpu    = "800Mi"
+    #      requests-memory = "800Mi"
+    #    }
+    environment = {
+      DNS_ADDRESS = {
+        value_from = {
+          secret_key_ref = {
+            name = "gluetun-secret-netherland"
+            key  = "VPN_DNS_IP"
+          }
+        }
+      }
+      WIREGUARD_ENDPOINT_IP = {
+        value_from = {
+          secret_key_ref = {
+            name = "gluetun-secret-netherland"
+            key  = "VPN_ENDPOINT_IP"
+          }
+        }
+      }
+      WIREGUARD_ENDPOINT_PORT = {
+        value_from = {
+          secret_key_ref = {
+            name = "gluetun-secret-netherland"
+            key  = "VPN_ENDPOINT_PORT"
+          }
+        }
+      }
+      WIREGUARD_PRIVATE_KEY = {
+        value_from = {
+          secret_key_ref = {
+            name = "gluetun-secret-netherland"
+            key  = "WIREGUARD_PRIVATE_KEY"
+          }
+        }
+      }
+      WIREGUARD_PUBLIC_KEY = {
+        value_from = {
+          secret_key_ref = {
+            name = "gluetun-secret-netherland"
+            key  = "WIREGUARD_PUBLIC_KEY"
+          }
+        }
+      }
+      #      SHADOWSOCKS = {
+      HTTPPROXY = {
+        value = "on"
+      }
+      #SHADOWSOCKS_LOG = {
+      HTTPPROXY_LOG = {
+        value = "on"
+      }
+      HTTPPROXY_LISTENING_ADDRESS = {
+        #SHADOWSOCKS_LISTENING_ADDRESS = {
+        value = "0.0.0.0:8888"
+      }
+      #      HTTPPROXY_USER = {
+      #        value = "user"
+      #      }
+
+      #SHADOWSOCKS_PASSWORD = {
+      #      HTTPPROXY_PASSWORD = {
+      #  value = "user"
+      #}
+      DNS_KEEP_NAMESERVER = {
+        value = "off"
+      }
+      VPN_SERVICE_PROVIDER = {
+        value = "custom"
+      }
+      VPN_TYPE = {
+        value = "wireguard"
+      }
+      WIREGUARD_ADDRESSES = {
+        value = "10.2.0.2/32"
+      }
+      FIREWALL_INPUT_PORTS = {
+        value = "8081,7878,9696,9091,51413,8080,6881,8989,8191,8888,8000"
+      }
+      PUBLICIP_API = {
+        value = "ip2location"
+      }
+
+      HEALTH_TARGET_ADDRESS = {
+        value = "protonvpn.com"
+      }
+
+    }
+
+  }
+
+  prowlarr = {
+            enabled      = false
+    image               = "linuxserver/prowlarr:latest"
+    connected_namespace = "tservarr"
+    #    dns_nameservers     = "10.2.0.1"
+    service_port = 9696
+
+    environment = {
+      PUID = {
+        value = "1000"
+      }
+      PGID = {
+        value = "1000"
+      }
+      TZ = {
+        value = "Etc/UTC"
+      }
+    }
+    #    requirements = {
+    #      limits-cpu      = "1000m"
+    #      limits-memory   = "1Gi"
+    #      requests-cpu    = "500m"
+    #      requests-memory = "400Mi"
+    #    }
+    pvc = {
+      prowlarr-config = {
+        name       = "prowlarr-config"
+        pvc_size   = "10Mi"
+        pvc        = true
+        mount_path = "/config"
+      }
+      servarr-data = {
+        name       = "servarr-data"
+        pvc_size   = "10Mi"
+        pvc        = false
+        host_path  = "/data"
+        mount_path = "/disk"
+      }
+    }
+
+  }
+
 }