install-charts.yaml

---
- name: Install basic charts
  hosts: all
  gather_facts: true
  vars:
    namespace_user: "{{ ansible_user }}"
    namespace_monitoring: monitoring
    namespace_generic_services: generic-services

    helm_kube_prometheus_stack_loki_config: "" # default

    # The following has been set to disable Truecharts own injection
    # of manifests for SCALE products I believe either way I dont need it:
    # - manifestManager.enabled=false
    helm_common_general: "\
      global.metallb.addServiceAnnotations=false,\
      global.traefik.addServiceAnnotations=false,\
      portal.open.enabled=false,\
      operator.verify.enabled=false,\
      workload.main.type=StatefulSet,\
      podOptions.dnsConfig.nameservers={8.8.8.8,8.8.4.4}"
    
    helm_common_ingress: "\
      ingress.main.enabled=true,\
      ingress.main.primary=true,\
      ingress.main.expandObjectName=true,\
      ingress.main.ingressClassName=nginx,\
      ingress.main.integrations.traefik.enabled=false,\
      ingress.main.hosts[0].paths[0].path='/',\
      ingress.main.hosts[0].paths[0].pathType='Prefix'"
    
    helm_common_resources: "\
      resources.requests.cpu={{ charts.resources.requests.cpu }},\
      resources.requests.memory={{ charts.resources.requests.memory }},\
      resources.limits.cpu={{ charts.resources.limits.cpu }},\
      resources.limits.memory={{ charts.resources.limits.memory }}"

    # persistence.config.hostPathType=DirectoryOrCreate doesnt work
    # because it creates the dir with root ownership and no write permissions
    helm_common_persistence: "\
      persistence.shared.enabled=false,\
      persistence.shm.enabled=false,\
      persistence.temp.enabled=false,\
      persistence.varlogs.enabled=False,\
      persistence.config.enabled=true,\
      persistence.config.size=1Gi"

    helm_common_persistence_config: "\
      persistence.config.enabled=true,\
      persistence.config.type=hostPath,\
      persistence.config.mountPath=/config"

    helm_common_persistence_media: "\
      persistence.media.enabled=true,\
      persistence.media.type=hostPath,\
      persistence.media.mountPath={{ dir_mount_path }},\
      persistence.media.hostPath={{ dir_minikube_mount }}"

    # readOnlyRootFilesystem=false is needed for the app to be able to take
    # backups in /config/Backups
    # runAsUser={{ uid }} gives write access on the pod
    helm_common_security_contexts: "\
      securityContext.container.readOnlyRootFilesystem=false,\
      securityContext.container.runAsUser={{ uid }},\
      securityContext.container.runAsGroup=568"

  tasks:
    - name: Create namespaces namespace
      shell: "kubectl create namespace {{ item }} --dry-run=client -o yaml | kubectl apply -f -"
      with_items:
        - "{{ namespace_user }}"

    - name: Install loki-stack
      when: charts.services.loki_stack.enabled
      block:
      - name: Install/Upgrade the loki-stack chart
        include_tasks: tasks-install-chart.yaml
        # https://artifacthub.io/packages/helm/grafana/loki-stack
        vars:
          repo_name: grafana
          repo_link: https://grafana.github.io/helm-charts
          install_namespace: "{{ namespace_monitoring }}"
          timeout: "{{ charts.timeout }}"
          release_name: loki-stack
          chart_name: loki-stack
          set_options: "--set \
            loki.isDefault=False,\
            test_pod.enable=False,\
            fluent-bit.enabled=True,\
            promtail.enabled=False"

      - name: Set config for Grafana to add Loki as a data source
        set_fact:
          helm_kube_prometheus_stack_loki_config: "\
            grafana.additionalDataSources[0].name=Loki,\
            grafana.additionalDataSources[0].type=loki,\
            grafana.additionalDataSources[0].access=proxy,\
            grafana.additionalDataSources[0].isDefault=False,\
            grafana.additionalDataSources[0].url='http://loki-stack.{{ namespace_monitoring }}:3100',"

    - name: Install kube-prometheus-stack
      when: charts.services.kube_prometheus_stack.enabled
      block:
      - name: Install/Upgrade the kube-prometheus-stack chart
        include_tasks: tasks-install-chart.yaml
        # https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack
        vars:
          repo_name: prometheus-community
          repo_link: https://prometheus-community.github.io/helm-charts
          install_namespace: "{{ namespace_monitoring }}"
          timeout: "{{ charts.timeout }}"
          release_name: kube-prometheus-stack
          chart_name: kube-prometheus-stack
          set_options: "--set \
            {{ helm_kube_prometheus_stack_loki_config }}\
            prometheus.prometheusSpec.retention=730d,\
            prometheus.prometheusSpec.storageSpec.volumeClaimTemplate.spec.accessModes={'ReadWriteOnce'},\
            prometheus.prometheusSpec.storageSpec.volumeClaimTemplate.spec.resources.requests.storage='50Gi',\
            prometheus.prometheusSpec.serviceMonitorSelectorNilUsesHelmValues=false,\
            prometheus.prometheusSpec.serviceMonitorNamespaceSelector=null,\
            prometheus.prometheusSpec.serviceMonitorSelector=null,\
            prometheus.prometheusSpec.ruleSelectorNilUsesHelmValues=false,\
            prometheus.prometheusSpec.ruleNamespaceSelector=null,\
            prometheus.prometheusSpec.ruleSelector=null,\
            prometheus.prometheusSpec.podMonitorSelectorNilUsesHelmValues=false,\
            prometheus.prometheusSpec.podMonitorNamespaceSelector=null,\
            prometheus.prometheusSpec.podMonitorSelector=null,\
            prometheus.prometheusSpec.probeSelectorNilUsesHelmValues=false,\
            prometheus.prometheusSpec.probeSelectorNamespaceSelector=null,\
            prometheus.prometheusSpec.probeSelector=null,\
            prometheus.prometheusSpec.additionalScrapeConfigs[0].job_name=kubernetes-service-scraper,\
            prometheus.prometheusSpec.additionalScrapeConfigs[0].kubernetes_sd_configs[0].role=service,\
            grafana.persistence.enabled=true,\
            grafana.adminUser={{ charts.services.kube_prometheus_stack.grafana.admin_username }},\
            grafana.adminPassword={{ charts.services.kube_prometheus_stack.grafana.admin_password }},\
            grafana.ingress.enabled=true,\
            grafana.ingress.ingressClassName=nginx,\
            grafana.ingress.hosts={grafana.{{ domain_name }}}"

      - name: Setup plugins for Grafana
        block:
        - name: Search for all Pods labelled app.kubernetes.io/name=grafana
          kubernetes.core.k8s_info:
            kind: Pod
            label_selectors:
              - app.kubernetes.io/name = grafana
          register: output

        - name: Install piechart panel plugin for Grafana
          kubernetes.core.k8s_exec:
            namespace: "{{ namespace_monitoring }}"
            pod: "{{ output.resources[0].metadata.name }}"
            container: grafana
            command: grafana cli plugins install grafana-piechart-panel
          ignore_errors: True

      - name: Restart pods to pick up any config updates
        include_tasks: tasks-kubernetes-delete-kind-instances.yaml
        vars:
          kind: pod
          namespace: "{{ namespace_monitoring }}"
          contains: kube-prometheus-stack
            
      - debug:
          msg: >
            You can log into Grafana at 'grafana.{{ domain_name }}' using
            {{ charts.services.kube_prometheus_stack.grafana.admin_username }}/
            {{ charts.services.kube_prometheus_stack.grafana.admin_password }}

    - name: Install jellyfin
      when: charts.services.jellyfin.enabled
      block:
      - name: Install/Upgrade the jellyfin chart
        include_tasks: tasks-install-chart.yaml
        vars:
          repo_name: TrueCharts
          repo_link: oci://tccr.io/truecharts
          install_namespace: "{{ namespace_generic_services }}"
          timeout: "{{ charts.timeout }}"
          release_name: jellyfin
          chart_name: jellyfin
          # to allow the pod to be able to use the /dev mount
          # to access /dev/dri/renderD128 for hwa, these options are set to true
          # - securityContext.container.runAsUser=0
          # - securityContext.container.privileged=true
          # - securityContext.container.allowPrivilegeEscalation=true
          set_options: "--set \
            {{ helm_common_general }},\
            {{ helm_common_persistence }},\
            {{ helm_common_security_contexts }},\
            {{ helm_common_persistence_media }},\
            {{ helm_common_resources }},\
            {{ helm_common_ingress }},\
            securityContext.container.runAsUser=0,\
            securityContext.container.privileged=true,\
            securityContext.container.runAsNonRoot=false,\
            securityContext.container.allowPrivilegeEscalation=true,\
            persistence.cache.enabled=true,\
            persistence.cache.accessMode=ReadWriteOnce,\
            persistence.cache.size=50G,\
            persistence.dev.enabled=true,\
            persistence.dev.type=hostPath,\
            persistence.dev.mountPath=/dev,\
            persistence.dev.hostPath=/dev,\
            ingress.main.hosts[0].host='jellyfin.{{ domain_name }}',\
            ingress.main.hosts[0].paths[0].service.name=jellyfin,\
            ingress.main.hosts[0].paths[0].service.port=8096"

      - debug:
          msg: >
              You can log into Jellyfin at 'jellyfin.{{ domain_name }}'.
              '{{ dir_home }}' is available under '/media' and can be used by
              Jellyfin. If need be, delete any existing server and go to the
              URL mention above once again to setup a new server.

    - name: Install qbittorrent
      when: charts.services.qbittorrent.enabled
      block:
      - name: Install/Upgrade the qbittorrent chart
        include_tasks: tasks-install-chart.yaml
        vars:
          repo_name: TrueCharts
          repo_link: oci://tccr.io/truecharts
          install_namespace: "{{ namespace_generic_services }}"
          timeout: "{{ charts.timeout }}"
          release_name: qbittorrent
          chart_name: qbittorrent
          set_options: "--set \
            {{ helm_common_general }},\
            {{ helm_common_persistence }},\
            {{ helm_common_security_contexts }},\
            {{ helm_common_persistence_media }},\
            {{ helm_common_resources }},\
            {{ helm_common_ingress }},\
            ingress.main.hosts[0].host='qbittorrent.{{ domain_name }}',\
            ingress.main.hosts[0].paths[0].service.name=qbittorrent,\
            ingress.main.hosts[0].paths[0].service.port=10095"

      - name: Search for qbittorent pod
        kubernetes.core.k8s_info:
          kind: Pod
          label_selectors:
            - app.kubernetes.io/instance = qbittorrent
            - app.kubernetes.io/name = qbittorrent
        register: output

      - name: Get randomly generated password from qbittorrent pod logs
        shell: "kubectl logs {{ output.resources[0].metadata.name }} | grep -i 'temporary password' | cut -d ':' -f 2 | tr -d ' '"
        register: qbittorrent_random_password

      - debug:
          msg: >
            You can log into qBittorrent at 'qbittorrent.{{ domain_name }}' using
            "admin/{{ qbittorrent_random_password.stdout }}" as the default creds. Change this after deployment.
            '{{ dir_home }}' from the host is available under '/media' and
            can be used by the application to download things. Downloading in
            the directories under {{ dir_data }} will be picked up by Jellyfin.

    - name: Install flaresolverr
      when: charts.services.flaresolverr.enabled
      block:
      - name: Install/Upgrade the flaresolverr chart
        include_tasks: tasks-install-chart.yaml
        vars:
          repo_name: TrueCharts
          repo_link: oci://tccr.io/truecharts
          install_namespace: "{{ namespace_generic_services }}"
          timeout: "{{ charts.timeout }}"
          release_name: flaresolverr
          chart_name: flaresolverr
          set_options: "--set \
            {{ helm_common_general }},\
            {{ helm_common_persistence }},\
            {{ helm_common_resources }}"

      - debug:
          msg: >
            You can flaresolverr to bypass Cloudflare's protection

    - name: Install prowlarr
      when: charts.services.prowlarr.enabled
      block:
      - name: Create config directory on hostpath for prowlarr
        file:
          path: "{{ dir_home }}{{ dir_data_config_suffix }}/prowlarr"
          state: directory
          mode: '0755'

      - name: Install/Upgrade the prowlarr chart
        include_tasks: tasks-install-chart.yaml
        vars:
          repo_name: TrueCharts
          repo_link: oci://tccr.io/truecharts
          install_namespace: "{{ namespace_generic_services }}"
          timeout: "{{ charts.timeout }}"
          release_name: prowlarr
          chart_name: prowlarr
          set_options: "--set \
            {{ helm_common_general }},\
            {{ helm_common_persistence }},\
            {{ helm_common_security_contexts }},\
            {{ helm_common_persistence_media }},\
            {{ helm_common_resources }},\
            {{ helm_common_ingress }},\
            {{ helm_common_persistence_config }},\
            persistence.config.hostPath={{ dir_minikube_mount }}{{ dir_data_config_suffix }}/prowlarr,\
            ingress.main.hosts[0].host='prowlarr.{{ domain_name }}',\
            ingress.main.hosts[0].paths[0].service.name=prowlarr,\
            ingress.main.hosts[0].paths[0].service.port=9696"

      - debug:
          msg: >
            You can log into prowlarr at 'prowlarr.{{ domain_name }}'. Go to this
            URL and add the indexers you wish to use.
            '{{ dir_home }}' from the host is available under '/media' and
            can be used by the application to download things. Downloading in
            the directories under {{ dir_data }} will be picked up by Jellyfin.

    - name: Install radarr
      when: charts.services.radarr.enabled
      block:
      - name: Create config directory on hostpath for radarr
        file:
          path: "{{ dir_home }}{{ dir_data_config_suffix }}/radarr"
          state: directory
          mode: '0755'

      - name: Install/Upgrade the radarr chart
        include_tasks: tasks-install-chart.yaml
        vars:
          repo_name: TrueCharts
          repo_link: oci://tccr.io/truecharts
          install_namespace: "{{ namespace_generic_services }}"
          timeout: "{{ charts.timeout }}"
          release_name: radarr
          chart_name: radarr
          set_options: "--set \
            {{ helm_common_general }},\
            {{ helm_common_persistence }},\
            {{ helm_common_security_contexts }},\
            {{ helm_common_persistence_media }},\
            {{ helm_common_resources }},\
            {{ helm_common_ingress }},\
            {{ helm_common_persistence_config }},\
            persistence.config.hostPath={{ dir_minikube_mount }}{{ dir_data_config_suffix }}/radarr,\
            ingress.main.hosts[0].host='radarr.{{ domain_name }}',\
            ingress.main.hosts[0].paths[0].service.name=radarr,\
            ingress.main.hosts[0].paths[0].service.port=7878"

      - debug:
          msg: >
            You can log into radarr at 'radarr.{{ domain_name }}'.
            '{{ dir_home }}' from the host is available under '/media' and
            can be used by the application to download things. Downloading in
            the directories under {{ dir_data }} will be picked up by Jellyfin.

    - name: Install sonarr
      when: charts.services.sonarr.enabled
      block:
      - name: Create config directory on hostpath for sonarr
        file:
          path: "{{ dir_home }}{{ dir_data_config_suffix }}/sonarr"
          state: directory
          mode: '0755'

      - name: Install/Upgrade the sonarr chart
        include_tasks: tasks-install-chart.yaml
        vars:
          repo_name: TrueCharts
          repo_link: oci://tccr.io/truecharts
          install_namespace: "{{ namespace_generic_services }}"
          timeout: "{{ charts.timeout }}"
          release_name: sonarr
          chart_name: sonarr
          set_options: "--set \
            {{ helm_common_general }},\
            {{ helm_common_persistence }},\
            {{ helm_common_security_contexts }},\
            {{ helm_common_persistence_media }},\
            {{ helm_common_resources }},\
            {{ helm_common_ingress }},\
            {{ helm_common_persistence_config }},\
            persistence.config.hostPath={{ dir_minikube_mount }}{{ dir_data_config_suffix }}/sonarr,\
            ingress.main.hosts[0].host='sonarr.{{ domain_name }}',\
            ingress.main.hosts[0].paths[0].service.name=sonarr,\
            ingress.main.hosts[0].paths[0].service.port=8989"

      - debug:
          msg: >
            You can log into sonarr at 'sonarr.{{ domain_name }}'.
            '{{ dir_home }}' from the host is available under '/media' and
            can be used by the application to download things. Downloading in
            the directories under {{ dir_data }} will be picked up by Jellyfin.

    - name: Install bazarr
      when: charts.services.bazarr.enabled
      block:
      - name: Create config directory on hostpath for bazarr
        file:
          path: "{{ dir_home }}{{ dir_data_config_suffix }}/bazarr"
          state: directory
          mode: '0755'

      - name: Install/Upgrade the bazarr chart
        include_tasks: tasks-install-chart.yaml
        vars:
          repo_name: TrueCharts
          repo_link: oci://tccr.io/truecharts
          install_namespace: "{{ namespace_generic_services }}"
          timeout: "{{ charts.timeout }}"
          release_name: bazarr
          chart_name: bazarr
          set_options: "--set \
            {{ helm_common_general }},\
            {{ helm_common_persistence }},\
            {{ helm_common_security_contexts }},\
            {{ helm_common_persistence_media }},\
            {{ helm_common_resources }},\
            {{ helm_common_ingress }},\
            {{ helm_common_persistence_config }},\
            persistence.config.hostPath={{ dir_minikube_mount }}{{ dir_data_config_suffix }}/bazarr,\
            metrics.main.enabled=false,\
            ingress.main.hosts[0].host='bazarr.{{ domain_name }}',\
            ingress.main.hosts[0].paths[0].service.name=bazarr,\
            ingress.main.hosts[0].paths[0].service.port=6767"

      - debug:
          msg: >
            You can log into bazarr at 'bazarr.{{ domain_name }}'.
            '{{ dir_home }}' from the host is available under '/media' and
            can be used by the application.

    - name: Install readarr
      when: charts.services.readarr.enabled
      block:
      - name: Create config directory on hostpath for readarr
        file:
          path: "{{ dir_home }}{{ dir_data_config_suffix }}/readarr"
          state: directory
          mode: '0755'

      - name: Install/Upgrade the readarr chart
        include_tasks: tasks-install-chart.yaml
        vars:
          repo_name: TrueCharts
          repo_link: oci://tccr.io/truecharts
          install_namespace: "{{ namespace_generic_services }}"
          timeout: "{{ charts.timeout }}"
          release_name: readarr
          chart_name: readarr
          set_options: "--set \
            {{ helm_common_general }},\
            {{ helm_common_persistence }},\
            {{ helm_common_security_contexts }},\
            {{ helm_common_persistence_media }},\
            {{ helm_common_resources }},\
            {{ helm_common_ingress }},\
            {{ helm_common_persistence_config }},\
            persistence.config.hostPath={{ dir_minikube_mount }}{{ dir_data_config_suffix }}/readarr,\
            ingress.main.hosts[0].host='readarr.{{ domain_name }}',\
            ingress.main.hosts[0].paths[0].service.name=readarr,\
            ingress.main.hosts[0].paths[0].service.port=8787"

      - debug:
          msg: >
            You can log into readarr at 'readarr.{{ domain_name }}'.
            '{{ dir_home }}' from the host is available under '/media' and
            can be used by the application.

    - name: Install lidarr
      when: charts.services.lidarr.enabled
      block:
      - name: Create config directory on hostpath for lidarr
        file:
          path: "{{ dir_home }}{{ dir_data_config_suffix }}/lidarr"
          state: directory
          mode: '0755'

      - name: Install/Upgrade the lidarr chart
        include_tasks: tasks-install-chart.yaml
        vars:
          repo_name: TrueCharts
          repo_link: oci://tccr.io/truecharts
          install_namespace: "{{ namespace_generic_services }}"
          timeout: "{{ charts.timeout }}"
          release_name: lidarr
          chart_name: lidarr
          set_options: "--set \
            {{ helm_common_general }},\
            {{ helm_common_persistence }},\
            {{ helm_common_security_contexts }},\
            {{ helm_common_persistence_media }},\
            {{ helm_common_resources }},\
            {{ helm_common_ingress }},\
            {{ helm_common_persistence_config }},\
            persistence.config.hostPath={{ dir_minikube_mount }}{{ dir_data_config_suffix }}/lidarr,\
            ingress.main.hosts[0].host='lidarr.{{ domain_name }}',\
            ingress.main.hosts[0].paths[0].service.name=lidarr,\
            ingress.main.hosts[0].paths[0].service.port=8686"

      - debug:
          msg: >
            You can log into lidarr at 'lidarr.{{ domain_name }}'.
            '{{ dir_home }}' from the host is available under '/media' and
            can be used by the application.

    - name: Install ombi
      when: charts.services.ombi.enabled
      block:
      - name: Install/Upgrade the ombi chart
        include_tasks: tasks-install-chart.yaml
        vars:
          repo_name: TrueCharts
          repo_link: oci://tccr.io/truecharts
          install_namespace: "{{ namespace_generic_services }}"
          timeout: "{{ charts.timeout }}"
          release_name: ombi
          chart_name: ombi
          set_options: "--set \
            {{ helm_common_general }},\
            {{ helm_common_persistence }},\
            {{ helm_common_security_contexts }},\
            {{ helm_common_resources }},\
            {{ helm_common_ingress }},\
            ingress.main.hosts[0].host='ombi.{{ domain_name }}',\
            ingress.main.hosts[0].paths[0].service.name=ombi,\
            ingress.main.hosts[0].paths[0].service.port=3579"
      - debug:
          msg: >
              You can log into ombi at 'ombi.{{ domain_name }}'.
              '{{ dir_home }}' is available under '/media' and can be used by
              ombi. If need be, delete any existing server and go to the
              URL mention above once again to setup a new server.

    - name: Install jellyseerr
      when: charts.services.jellyseerr.enabled
      block:
      - name: Install/Upgrade the jellyseerr chart
        include_tasks: tasks-install-chart.yaml
        vars:
          repo_name: TrueCharts
          repo_link: oci://tccr.io/truecharts
          install_namespace: "{{ namespace_generic_services }}"
          timeout: "{{ charts.timeout }}"
          release_name: jellyseerr
          chart_name: jellyseerr
          set_options: "--set \
            {{ helm_common_general }},\
            {{ helm_common_persistence }},\
            {{ helm_common_security_contexts }},\
            {{ helm_common_resources }},\
            {{ helm_common_ingress }},\
            ingress.main.hosts[0].host='jellyseerr.{{ domain_name }}',\
            ingress.main.hosts[0].paths[0].service.name=jellyseerr,\
            ingress.main.hosts[0].paths[0].service.port=5055"
      - debug:
          msg: >
              You can log into jellyseerr at 'jellyseerr.{{ domain_name }}'.
              '{{ dir_home }}' is available under '/media' and can be used by
              jellyseerr. If need be, delete any existing server and go to the
              URL mention above once again to setup a new server.

    - name: Install librespeed
      when: charts.services.librespeed.enabled
      block:
      - name: Install/Upgrade the librespeed chart
        include_tasks: tasks-install-chart.yaml
        vars:
          repo_name: TrueCharts
          repo_link: oci://tccr.io/truecharts
          install_namespace: "{{ namespace_generic_services }}"
          timeout: "{{ charts.timeout }}"
          release_name: librespeed
          chart_name: librespeed
          # PUID={{ uid }} gives write access on the pod
          # 568 is the default user ID, added to the groups cause why not
          set_options: "--set \
            {{ helm_common_general }},\
            {{ helm_common_persistence }},\
            {{ helm_common_resources }},\
            {{ helm_common_ingress }},\
            securityContext.container.PUID=\"{{ uid }}\",\
            securityContext.container.PGID=\"568\",\
            ingress.main.hosts[0].host='librespeed.{{ domain_name }}',\
            ingress.main.hosts[0].paths[0].service.name=librespeed,\
            ingress.main.hosts[0].paths[0].service.port=10016"

      - debug:
          msg: >
            You can log into librespeed at 'librespeed.{{ domain_name }}'.

    - name: Install calibre-web
      when: charts.services.calibre_web.enabled
      block:
      - name: Install/Upgrade the calibre-web chart
        include_tasks: tasks-install-chart.yaml
        vars:
          repo_name: TrueCharts
          repo_link: oci://tccr.io/truecharts
          install_namespace: "{{ namespace_generic_services }}"
          timeout: "{{ charts.timeout }}"
          release_name: calibre-web
          chart_name: calibre-web
          # PUID={{ uid }} gives write access on the pod
          # 568 is the default user ID, added to the groups cause why not
          set_options: "--set \
            {{ helm_common_general }},\
            {{ helm_common_persistence }},\
            {{ helm_common_persistence_media }},\
            {{ helm_common_resources }},\
            {{ helm_common_ingress }},\
            securityContext.container.PUID=\"{{ uid }}\",\
            securityContext.container.PGID=\"568\",\
            ingress.main.hosts[0].host='calibre-web.{{ domain_name }}',\
            ingress.main.hosts[0].paths[0].service.name=calibre-web,\
            ingress.main.hosts[0].paths[0].service.port=8083"

      - debug:
          msg: >
            You can log into calibre-web at 'calibre-web.{{ domain_name }}'.
            '{{ dir_home }}' from the host is available under '/media' and
            can be used by the application.

    - name: Install calibre
      when: charts.services.calibre.enabled
      block:
      - name: Install/Upgrade the calibre chart
        include_tasks: tasks-install-chart.yaml
        vars:
          repo_name: TrueCharts
          repo_link: oci://tccr.io/truecharts
          install_namespace: "{{ namespace_generic_services }}"
          timeout: "{{ charts.timeout }}"
          release_name: calibre
          chart_name: calibre
          # PUID={{ uid }} gives write access on the pod
          # 568 is the default user ID, added to the groups cause why not
          # securityContext.container.seccompProfile.type is required for the
          # guacamole VNC client to be able to make sys calls (required )
          set_options: "--set \
            {{ helm_common_general }},\
            {{ helm_common_persistence }},\
            {{ helm_common_persistence_media }},\
            {{ helm_common_resources }},\
            securityContext.container.PUID=\"{{ uid }}\",\
            securityContext.container.PGID=\"568\",\
            securityContext.container.seccompProfile.type=Unconfined,\
            service.webserver.enabled=true"

      - name: Expose calibre service
        include_tasks: tasks-kubernetes-port-forward-service.yaml
        vars:
          service_name: calibre
          service_file_name: calibre.service
          service_file_location_base: /etc/systemd/system/
          service_namespace: "{{ namespace_generic_services }}"
          host_port: 3002

      - include_tasks: tasks-allow-ports.yaml
        vars:
          ports:
            - "3002"

      - debug:
          msg: >
            You can log into calibre at '{{ ip }}:3002'.
            '{{ dir_home }}' from the host is available under '/media' and
            can be used by the application.