# ServiceDefinition: qbittorrent
# Source of truth: spec docs/13-service-catalog.md row 13; docs/03-networking-isolation-and-egress.md;
# docs/15-identity-and-access.md; decisions/adr-0015 (VPN egress steering).
# internal download client | egress VPN + kill-switch | config on Longhorn | auth forward-auth
# (bare web UI, no native OIDC).
#
# BULK DOWNLOADS TIER — OPEN PREREQUISITE, intentionally NOT declared here (mirrors plex + sonarr/radarr):
#   docs/13 row 13 places qBittorrent's downloads/staging volume on the `bulk` tier (large, non-3x-
#   replicated media handoff to the arr stack). The `bulk` StorageClass exists
#   (platform/longhorn/storageclasses.yaml) and both the schema and renderer support `class: bulk`, BUT
#   it is a NON-PROVISIONING STUB pending OQ-2 (its NFS/SMB backing is REPLACE-ME and the NFS CSI driver
#   is not installed) — a `bulk` PVC would never bind and would leave the pod Pending. Declaring it now
#   would also pull the bulk-tier requirement into the change's "touched" set, whose in-cluster
#   conformance test is not yet scaffolded, blocking the merge gate. So the downloads volume is DEFERRED
#   and this onboarding ships config-only. Once OQ-2 is resolved and `bulk` provisions, attach downloads
#   with a one-line add under storage:
#         - name: downloads
#           class: bulk          # external mount; size omitted (sized outside the cluster)
#   then re-render. See the WS-APPS report for the full bulk-downloads finding.
#
# VPN-class (docs/13 row 13; docs/03 "VPN-class set"): ALL of this pod's public-internet egress
# (peer/tracker/DHT traffic) MUST leave via the node PIA tunnel, never the WAN. `egress: vpn` renders
# the homelab.keithjackson.dev/egress-class=vpn pod label the shared CiliumEgressGatewayPolicy
# (platform/vpn-egress/egress-steering.yaml) selects on to steer + kill-switch the traffic OUTSIDE the
# workload (R-NET-05/06/07). No independent egress path; fail-closed if tun0 is down.
#
# Inbound reachability (<- sonarr, <- radarr) is an EAST-WEST allow rendered on the arr side; being
# VPN-class governs egress, not intra-cluster reachability. This service initiates nothing east-west, so
# dependencies is empty (reaches only DNS + VPN internet).
# Validates against schemas/servicedefinition.schema.json.
name: qbittorrent
kind: container
source:
  image: lscr.io/linuxserver/qbittorrent:5.1.2   # pinned stable tag (R-UPD-01); update.range governs advancement
exposure: internal              # LAN-only web UI at qbittorrent.home.keithjackson.dev (docs/13 row 13; R-DNS/R-NET)
egress: vpn                     # ALL public egress via node PIA tunnel + kill-switch (docs/03; ADR-0015; R-NET-05/06)
storage:
  - name: config
    size: 5Gi
    class: longhorn             # settings/categories/session on 3-replica Longhorn; DR-critical (docs/04; R-STATE-02)
dependencies: []                # default-deny: reaches only DNS; arr reach it north of its own egress (docs/03; R-NET-01/02)
ingressRoutes:
  - host: qbittorrent.home.keithjackson.dev
    port: 8080                  # qBittorrent WebUI; protected at the Gateway by forward-auth (docs/09, docs/15)
auth:
  mode: forward-auth            # oauth2-proxy -> Keycloak; bare UI, no usable native OIDC (docs/15; R-IDP-02)
  groups:
    - media-users               # authenticated AND in an authorized group (R-IDP-06)
update:
  channel: stable               # R-UPD-01
  range: ">=5.0.0 <6.0.0"       # stay on the qBittorrent 5.x stable line
  cadence: "0 4 * * *"
  autoRollbackOnFailedHealth: true   # R-UPD-03
observability:
  metrics: true
  slis:
    - up                        # download client down -> alert (docs/10; R-OBS-01)
backup:
  policy: daily-offcluster      # config (categories/settings) backed up off-cluster (docs/04; R-STATE-03)