From 1d98804845daa6cdb236c150e07e0b76627ecc92 Mon Sep 17 00:00:00 2001
From: fchinembiri <fchinembiri24@gmail.com>
Date: Sat, 1 Aug 2026 12:43:09 +0200
Subject: [PATCH] feat(k8s): add MinIO deployment to nextgen namespace with
 shared Jellyfin rclone storage and studio ingress

---
 k8s/nextgen/60-minio.yaml      | 151 +++++++++++++++++++++++++++++++++
 k8s/nextgen/kustomization.yaml |   1 +
 2 files changed, 152 insertions(+)
 create mode 100644 k8s/nextgen/60-minio.yaml

diff --git a/k8s/nextgen/60-minio.yaml b/k8s/nextgen/60-minio.yaml
new file mode 100644
index 0000000..56e72af
--- /dev/null
+++ b/k8s/nextgen/60-minio.yaml
@@ -0,0 +1,151 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: rclone-secret
+  namespace: nextgen
+type: Opaque
+stringData:
+  RCLONE_CONFIG_SEEDHOST_TYPE: sftp
+  RCLONE_CONFIG_SEEDHOST_HOST: wax.seedhost.eu
+  RCLONE_CONFIG_SEEDHOST_USER: tadiwanashe
+  RCLONE_CONFIG_SEEDHOST_PASS: 9uy5c06oYfPD6wpXnvYwGQ8nH0p9tm6c7ergflo
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: minio
+  namespace: nextgen
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: minio
+  template:
+    metadata:
+      labels:
+        app: minio
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: vmi3045103.contaboserver.net
+      containers:
+      - name: minio
+        image: quay.io/minio/minio:latest
+        command:
+        - sh
+        - -c
+        - "echo 'Waiting for storage mount...'; until [ -d '/data' ] && [ \"$(ls -A /data 2>/dev/null)\" ]; do sleep 1; done; echo 'Storage mount ready!'; exec minio server /data --console-address :9001"
+        env:
+        - name: MINIO_ROOT_USER
+          value: "minioadmin"
+        - name: MINIO_ROOT_PASSWORD
+          value: "minioadmin123"
+        ports:
+        - name: api
+          containerPort: 9000
+        - name: console
+          containerPort: 9001
+        volumeMounts:
+        - name: media
+          mountPath: /data
+          mountPropagation: HostToContainer
+      - name: rclone
+        image: rclone/rclone:latest
+        args:
+        - mount
+        - "seedhost:/home2/tadiwanashe/downloads/media"
+        - /data
+        - --allow-other
+        - --allow-non-empty
+        - --vfs-cache-mode
+        - full
+        - --vfs-cache-max-size
+        - 30G
+        - --vfs-read-chunk-size
+        - 128M
+        - --vfs-read-chunk-size-limit
+        - 2G
+        - --buffer-size
+        - 128M
+        - --vfs-cache-max-age
+        - 24h
+        - --cache-dir
+        - /cache
+        - --dir-cache-time
+        - 1m
+        securityContext:
+          privileged: true
+          capabilities:
+            add: ["SYS_ADMIN"]
+        lifecycle:
+          preStop:
+            exec:
+              command: ["/bin/sh", "-c", "fusermount -u /data"]
+        envFrom:
+        - secretRef:
+            name: rclone-secret
+        volumeMounts:
+        - name: media
+          mountPath: /data
+          mountPropagation: Bidirectional
+        - name: cache
+          mountPath: /cache
+      volumes:
+      - name: cache
+        emptyDir: {}
+      - name: media
+        emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: minio
+  namespace: nextgen
+spec:
+  selector:
+    app: minio
+  ports:
+    - name: api
+      port: 9000
+      targetPort: 9000
+    - name: console
+      port: 9001
+      targetPort: 9001
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: minio-ingress
+  namespace: nextgen
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - minio.next-gen.techarvest.co.zw
+    secretName: minio-nextgen-api-tls
+  - hosts:
+    - studio.minio.next-gen.techarvest.co.zw
+    secretName: studio-minio-nextgen-tls
+  rules:
+  - host: minio.next-gen.techarvest.co.zw
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: minio
+            port:
+              number: 9000
+  - host: studio.minio.next-gen.techarvest.co.zw
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: minio
+            port:
+              number: 9001
diff --git a/k8s/nextgen/kustomization.yaml b/k8s/nextgen/kustomization.yaml
index 1018795..299f486 100644
--- a/k8s/nextgen/kustomization.yaml
+++ b/k8s/nextgen/kustomization.yaml
@@ -11,6 +11,7 @@ resources:
   - supabase-nextgen-credentials.yaml
   - supabase-nextgen.yaml
   - supabase-nextgen-ingress.yaml
+  - 60-minio.yaml