Files

kubernetes/apps/downloads/slskd/app/helmrelease.yaml

1 ---

# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s-labs/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json

3 apiVersion: helm.toolkit.fluxcd.io/v2

4 kind: HelmRelease

5 metadata:

6 name: slskd

7 spec:

8 chartRef:

9 kind: OCIRepository

10 name: slskd

11 interval: 1h

12 values:

13 controllers:

14 slskd:

15 annotations:

16 reloader.stakater.com/auto: "true"

17 initContainers:

18 gluetun:

19 image:

20 repository: ghcr.io/qdm12/gluetun

21 tag: v3.41.3@sha256:fa19cc76b2af13d57a8d3dc3066f2ada061b1c761b8aecf989b3877c0486e027

22 restartPolicy: Always

23 env:

24 DNS_UPSTREAM_RESOLVER_TYPE: plain

25 FIREWALL_INPUT_PORTS: "80,9999"

26 FIREWALL_OUTBOUND_SUBNETS: "10.42.0.0/16,10.43.0.0/16,192.168.69.0/24"

27 HEALTH_SERVER_ADDRESS: ":9999"

28 PORT_FORWARD_ONLY: "on"

29 VPN_PORT_FORWARDING: "on"

30 VPN_TYPE: wireguard

31 VPN_PORT_FORWARDING_UP_COMMAND: '/config/update-port.sh {{ "{{PORT}}" }}'

32 envFrom:

33 - secretRef:

34 name: "{{ .Release.Name }}-secret"

35 lifecycle:

36 postStart:

37 exec:

38 command:

39 - "/bin/sh"

40 - "-c"

41 - "(ip rule del table 51820; ip -6 rule del table 51820) || true"

42 probes:

43 liveness: &gProbes

44 enabled: true

45 custom: true

46 spec:

47 httpGet:

48 path: /check

49 port: 9999

50 readiness: *gProbes

51 startup:

52 enabled: true

53 custom: true

54 spec:

55 httpGet:

56 path: /check

57 port: 9999

58 initialDelaySeconds: 10

59 securityContext:

60 runAsNonRoot: false

61 runAsUser: 0

62 runAsGroup: 0

63 capabilities: { add: ["NET_ADMIN"] }

64 allowPrivilegeEscalation: false

65 containers:

66 app:

67 image:

68 repository: ghcr.io/slskd/slskd

69 tag: 0.26.0@sha256:ecd4026d4f8fb504e2cc55323efa2c1f5b56d20d3686b018249cc36b48ea17a6

70 env:

71 DOTNET_BUNDLE_EXTRACT_BASE_DIR: /tmp/.net

72 SLSKD_CONFIG: /tmp/slskd.yaml

73 SLSKD_APP_DIR: /config

74 SLSKD_HTTP_PORT: &port 80

75 SLSKD_NO_AUTH: true

76 SLSKD_NO_HTTPS: true

77 SLSKD_NO_VERSION_CHECK: true

78 envFrom:

79 - secretRef:

80 name: "{{ .Release.Name }}-secret"

81 probes:

82 liveness: &probes

83 enabled: true

84 custom: true

85 spec:

86 httpGet:

87 path: /health

88 port: *port

89 initialDelaySeconds: 0

90 periodSeconds: 10

91 timeoutSeconds: 1

92 failureThreshold: 3

93 readiness: *probes

94 securityContext:

95 runAsNonRoot: true

96 runAsUser: 1000

97 runAsGroup: 1000

98 allowPrivilegeEscalation: false

99 readOnlyRootFilesystem: true

100 capabilities: { drop: ["ALL"] }

101 resources:

102 requests:

103 cpu: 10m

104 memory: 128Mi

105 limits:

106 memory: 1Gi

107 defaultPodOptions:

108 securityContext:

109 fsGroup: 1000

110 fsGroupChangePolicy: OnRootMismatch

111 service:

112 app:

113 forceRename: "{{ .Release.Name }}"

114 primary: true

115 ports:

116 http:

117 port: *port

118 route:

119 app:

120 hostnames:

121 - "{{ .Release.Name }}.janpuc.com"

122 parentRefs:

123 - name: envoy-internal

124 namespace: network

125 rules:

126 - backendRefs:

127 - identifier: app

128 port: *port

129 configMaps:

130 config:

131 data:

132 slskd.yaml: |-

133 soulseek:

134 listenPort: 50429

135 directories:

136 downloads: /media/Downloads/soulseek/complete

137 incomplete: /media/Downloads/soulseek/incomplete

138 transfers:

139 download:

140 destination:

141 permissions:

142 mode: 750

143 retry:

144 partial: resume

145 attempts: 3

146 delay: 5000

147 max_delay: 60000

148 shares:

149 directories:

150 - /media/Music

151 - /media/Downloads/soulseek/shared

152 filters:

153 - \.ini$

154 - Thumbs.db$

155 - \.DS_Store$

156 update-port.sh: |-

157 #!/bin/sh

158 set -eu

159

160 PORT="$${1:?forwarded port must be passed as the first argument}"

161

162 IN="/config/slskd.yaml"

163 OUT="/tmp/slskd.yaml"

164

165 case "$$PORT" in

166 ''|*[!0-9]*)

167 echo "ERROR: PORT must be an integer, got: $$PORT" >&2

168 exit 2

169 ;;

170 esac

171 if [ "$$PORT" -lt 1 ] || [ "$$PORT" -gt 65535 ]; then

172 echo "ERROR: PORT must be in range 1..65535, got: $$PORT" >&2

173 exit 2

174 fi

175

176 if [ ! -r "$$IN" ]; then

177 echo "ERROR: input config not readable: $$IN" >&2

178 exit 1

179 fi

180

181 tmp="$$(mktemp "$${OUT}.XXXXXX")"

182 cleanup() { rm -f "$$tmp"; }

183 trap cleanup EXIT INT TERM

184

185 sed -E "s/^([[:space:]]*listenPort:).*/\1 $${PORT}/" "$$IN" > "$$tmp"

186

187 if ! grep -Eq '^[[:space:]]*listenPort:[[:space:]]*[0-9]+' "$$tmp"; then

188 echo "ERROR: listenPort: key not found or not updated in $$IN" >&2

189 exit 3

190 fi

191

192 mv -f "$$tmp" "$$OUT"

193 trap - EXIT INT TERM

194

195 chown 1000:1000 "$$OUT"

196

197 echo "Updated listenPort to $$PORT in $$OUT"

198 persistence:

199 config:

200 existingClaim: "{{ .Release.Name }}"

201 config-file:

202 type: configMap

203 identifier: config

204 defaultMode: 0550

205 advancedMounts:

206 slskd:

207 gluetun:

208 - path: /config/slskd.yaml

209 subPath: slskd.yaml

210 - path: /config/update-port.sh

211 subPath: update-port.sh

212 media:

213 type: nfs

214 server: bigmouth.internal

215 path: /mnt/Vault/Media

216 globalMounts:

217 - path: /media

218 tmp:

219 type: emptyDir

The forwarded port arrives as an argument, not an env var

gotcha ·ok L31

gluetun does not export a PORT environment variable to this command. In v3.41.3 (internal/portforward/service/command.go) it string-replaces {{PORT}}, {{PORTS}} and {{VPN_INTERFACE}} in the template, splits the result with command.Split, and runs it through exec.CommandContext — no shell, and cmd.Env is never populated. An earlier revision here called the script bare and had it read $PORT; that aborted on the first line every time, and because start.go only logs "running up command: ..." without failing the tunnel, the sole symptom was slskd silently keeping the static listenPort from the ConfigMap.

Show the rest

The double wrapping of {{PORT}} is not decoration. app-template runs Helm tpl over every container env value (charts/common/templates/lib/container/fields/_env.tpl on 5.0.1), so a bare {{PORT}} fails the render with `function "PORT" not defined`. Writing {{ "{{PORT}}" }} makes tpl emit the literal placeholder for gluetun to substitute later. Verified by rendering this file's values against app-template 5.0.1.

2026-08-1001KZPMR979VSTX4QA714E7H485

$$1 is doubled because Flux postBuild envsubst eats $1

why ·ok L160

The port is read positionally because gluetun passes it as argv, not in the environment — see the annotation on VPN_PORT_FORWARDING_UP_COMMAND.

The $$ is the same escaping every other variable in this script needs: ks.yaml sets postBuild.substitute, so kustomize-controller runs envsubst over the built manifest. drone/envsubst parses digits as part of a variable name, so an unescaped $1 would resolve to the empty string and the script would reject every port as a missing argument. Assigning to PORT here keeps the rest of the script, which already refers to $$PORT throughout, unchanged.

2026-08-1001KZPMRCTCG0HJV6R77ZDNQFNF

gluetun must stay root; never set runAsUser in defaultPodOptions

invariant ·ok L59

gluetun builds the tunnel with iptables and cannot do it as a non-root uid. NET_ADMIN alone is not enough: the very first thing it does is take /run/xtables.lock, and as uid 1000 all three backends fail with "can't open lock file /run/xtables.lock: Permission denied" and "Could not fetch rule set generation id (you must be root)", after which it logs "Shutdown successful" and the sidecar crash-loops before the app container ever starts.

Show the rest

This is spelled out on the container rather than left to the image default because defaultPodOptions.securityContext reaches every container in the pod. Setting runAsUser/runAsGroup/runAsNonRoot there to give the app container an identity silently re-uids gluetun too and breaks the tunnel. Pod level carries fsGroup only; each container states its own uid — 0 here, 1000 for app.

2026-08-1001KZPNN3YBEC2F005ACK0S98BS

The library is shared by path, not by symlink

why ·ok L148

/media/Music is the Lidarr library on the same NFS export this pod already mounts, so it is listed directly rather than symlinked into the shared directory. slskd masks share locations: with no alias, a share is presented to remote peers under the name of its last path segment, so /media/Music appears as "Music" and the local layout is not disclosed. An alias in square brackets is only needed when the path itself is sensitive.

Show the rest

Sharing matters beyond etiquette. slskd ran with an empty share for its first evening (`Scan found 0 files`) and a large share of peers auto-refuse browse and download requests from accounts that share nothing, which showed up as soularr's `users/<name>/directory` calls returning 500 and transfers being cancelled mid-read.

Shares are upload-only — slskd never writes into them, and remote file management is off by default — so pointing this at the library carries no risk of a peer altering it.

2026-08-1001KZPQW972FJKQG9QNKAJH5WB9