feat(k8s/jellyfin): add Jellyfin stack (deployment scaled to 0 for data migration)

Jellyfin media server with Intel GPU hardware transcoding, NFS media
volume, and UDP discovery/DLNA ports. OIDC auth handled internally
by Jellyfin (no Authelia middleware on ingress).

kubernetes/app/jellyfin/deployment.yaml

@@ -0,0 +1,73 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jellyfin
+  namespace: jellyfin
+  labels:
+    app: jellyfin
+spec:
+  replicas: 0
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: jellyfin
+  template:
+    metadata:
+      labels:
+        app: jellyfin
+    spec:
+      containers:
+        - name: jellyfin
+          image: jellyfin/jellyfin:10.11.6
+          env:
+            - name: JELLYFIN_PublishedServerUrl
+              value: https://${JELLYFIN_HOST}
+          ports:
+            - containerPort: 8096
+              name: http
+              protocol: TCP
+            - containerPort: 7359
+              name: discovery
+              protocol: UDP
+              hostPort: 7359
+            - containerPort: 1900
+              name: dlna
+              protocol: UDP
+              hostPort: 1900
+          resources:
+            limits:
+              gpu.intel.com/i915: "1"
+          livenessProbe:
+            httpGet:
+              port: 8096
+              path: /health
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 5
+          readinessProbe:
+            httpGet:
+              port: 8096
+              path: /health
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: cache
+              mountPath: /cache
+            - name: media
+              mountPath: /media
+              subPath: complete
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: jellyfin-config
+        - name: cache
+          persistentVolumeClaim:
+            claimName: jellyfin-cache
+        - name: media
+          persistentVolumeClaim:
+            claimName: jellyfin-media

kubernetes/app/jellyfin/ingress.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: jellyfin
+  namespace: jellyfin
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+spec:
+  tls:
+    - hosts:
+        - ${JELLYFIN_HOST}
+      secretName: jellyfin-tls
+  rules:
+    - host: ${JELLYFIN_HOST}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: jellyfin
+                port:
+                  number: 8096

kubernetes/app/jellyfin/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: jellyfin
+  labels:
+    pod-security.kubernetes.io/enforce: privileged

kubernetes/app/jellyfin/networkpolicy.yaml

@@ -0,0 +1,47 @@
+# Default deny all ingress in the jellyfin namespace
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-ingress
+  namespace: jellyfin
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+---
+# Allow Traefik ingress controller to reach Jellyfin
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-ingress-controller
+  namespace: jellyfin
+spec:
+  podSelector:
+    matchLabels:
+      app: jellyfin
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+---
+# Allow UDP discovery and DLNA from local network
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-udp-discovery
+  namespace: jellyfin
+spec:
+  podSelector:
+    matchLabels:
+      app: jellyfin
+  policyTypes:
+    - Ingress
+  ingress:
+    - ports:
+        - port: 7359
+          protocol: UDP
+        - port: 1900
+          protocol: UDP

kubernetes/app/jellyfin/pv-media.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: jellyfin-media-nfs
+spec:
+  capacity:
+    storage: 1Ti
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nointr
+  nfs:
+    server: synology.storage.lviv
+    path: ${MEDIA_NFS_PATH}

kubernetes/app/jellyfin/pvc.yaml

@@ -0,0 +1,43 @@
+---
+# Jellyfin config (includes metadata)
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-config
+  namespace: jellyfin
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: nfs-synology-ssd
+  resources:
+    requests:
+      storage: 30Gi
+---
+# Jellyfin cache (transcoding temp files etc.)
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-cache
+  namespace: jellyfin
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: nfs-synology-ssd
+  resources:
+    requests:
+      storage: 20Gi
+---
+# Shared media library (NFS)
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-media
+  namespace: jellyfin
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: jellyfin-media-nfs
+  resources:
+    requests:
+      storage: 1Ti

kubernetes/app/jellyfin/service.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: jellyfin
+  namespace: jellyfin
+spec:
+  selector:
+    app: jellyfin
+  ports:
+    - name: http
+      port: 8096
+      targetPort: 8096
+      protocol: TCP