update workflows

update common chart
2025-12-04 18:25:01 -06:00 · 2025-12-04 18:21:28 -06:00 · 2025-12-04 18:10:18 -06:00 · 2025-12-04 18:10:05 -06:00 · 2025-12-04 18:09:45 -06:00 · 2025-12-04 18:09:20 -06:00
33 changed files with 1081 additions and 322 deletions
--- a/.gitea/workflows/lint-test.yaml
+++ b/.gitea/workflows/lint-test.yaml
@@ -1,13 +1,14 @@
-name: lint-and-test-charts
+name: lint-and-test

-on: pull_request
+on:
+  pull_request:

 jobs:
  lint-test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-js
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0

@@ -17,13 +18,14 @@ jobs:
          version: latest

      - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
-          python-version: "3.13"
-          check-latest: true
+          python-version: '3.14'

      - name: Set up Chart Testing
        uses: helm/chart-testing-action@v2.7.0
+        with:
+          yamale_version: "6.0.0"

      - name: Run Chart Testing (list-changed)
        id: list-changed
@@ -35,4 +37,19 @@ jobs:

      - name: Run Chart Testing (lint)
        if: steps.list-changed.outputs.changed == 'true'
-        run: ct lint --target-branch ${{ gitea.event.repository.default_branch }}
+        run: ct lint --validate-maintainers=false --target-branch ${{ gitea.event.repository.default_branch }}
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Test Failure - Helm Charts'
+          priority: 3
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: 'Tests have failed for Helm Charts'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/helm-charts/actions?workflow=lint-test.yaml", "clear": true}]'
+          image: true
--- a/.gitea/workflows/release-charts-cloudflared.yml
+++ b/.gitea/workflows/release-charts-cloudflared.yml
@@ -14,37 +14,80 @@ env:

 jobs:
  release:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-js
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Set up Helm
        uses: azure/setup-helm@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}
-          version: latest
+          version: v3.19.2
+
+      - name: Add Repositories
+        run: |
+          cd ${WORKFLOW_DIR}
+
+          echo ">> Adding repositories for chart dependencies ..."
+          helm dependency list --max-col-width 120 2> /dev/null \
+            | tail +2 | head -n -1 \
+            | awk '{ print "helm repo add " $1 " " $3 }' \
+            | while read cmd; do echo "$cmd" | sh; done || true
+
+          if helm repo list | tail +2 | read -r; then
+            echo ">> Update repository cache ..."
+            helm repo update
+          fi
+
+          echo "----"

      - name: Package Helm Chart
        run: |
-          cd $WORKFLOW_DIR
-          helm dependency build
+          cd ${WORKFLOW_DIR}
+
+          echo ">> Building helm dependency ..."
+          helm dependency build --skip-refresh --debug
+
+          echo "----"
+
          echo "PACKAGE_PATH=$(helm package . | awk '{print $NF}')" >> $GITEA_ENV

      - name: Publish Helm Chart to Harbor
        run: |
-          helm registry login ${{ vars.REGISTRY_HOST }} -u ${{ vars.REGISTRY_USER }} -p ${{ secrets.REGISTRY_SECRET }}
-          helm push ${{ env.PACKAGE_PATH }} oci://${{ vars.REGISTRY_HOST }}/helm-charts
+          echo ">> Logging into Harbor ..."
+          helm registry login ${{ vars.REGISTRY_HOST }} -u ${{ vars.REGISTRY_USER }} -p ${{ secrets.REGISTRY_SECRET }} --debug
+
+          echo ""
+          echo ">> Publishing chart to Harbor ..."
+          helm push ${{ env.PACKAGE_PATH }} oci://${{ vars.REGISTRY_HOST }}/helm-charts --debug
+
+          echo "----"

      - name: Publish Helm Chart to Gitea
        run: |
-          helm plugin install https://github.com/chartmuseum/helm-push
-          helm repo add --username ${{ gitea.actor }} --password ${{ secrets.REPOSITORY_TOKEN }} helm-charts https://${{ vars.REPOSITORY_HOST }}/api/packages/alexlebens/helm
-          helm cm-push ${{ env.PACKAGE_PATH }} helm-charts
+          echo ">> Installing Chart Museum plugin ..."
+          helm plugin install https://github.com/chartmuseum/helm-push --debug
+
+          echo ""
+          echo ">> Adding Gitea repository ..."
+          helm repo add --username ${{ gitea.actor }} --password ${{ secrets.REPOSITORY_TOKEN }} helm-charts https://${{ vars.REPOSITORY_HOST }}/api/packages/alexlebens/helm --debug
+
+          echo ""
+          echo ">> Pushing chart to gitea"
+          helm cm-push ${{ env.PACKAGE_PATH }} helm-charts --debug

      - name: Extract Chart Metadata
        run: |
-          cd $WORKFLOW_DIR
+          cd ${WORKFLOW_DIR}
+
+          echo ">> Adding Chart metadata to workflow ENV ..."
+          echo ""
+          echo ">> Chart Version: $(yq '.version' Chart.yaml)"
+          echo ">> Chart Name: $(yq '.name' Chart.yaml)"
+
+          echo "----"
+
          echo "CHART_VERSION=$(yq '.version' Chart.yaml)" >> $GITEA_ENV
          echo "CHART_NAME=$(yq '.name' Chart.yaml)" >> $GITEA_ENV

@@ -56,11 +99,30 @@ jobs:
          files: |-
            ${{ env.PACKAGE_PATH }}

-      - name: Actions Ntfy
-        run: |
-          curl \
-            -H "Authorization: Bearer ${{ secrets.NTFY_CRED }}" \
-            -H "Title: Chart Released: ${{ env.CHART_NAME }}-${{ env.CHART_VERSION }}" \
-            -H "Content-Type: text/plain" \
-            -d $'Repo: ${{ gitea.repository }}\nCommit: ${{ gitea.sha }}\nRef: ${{ gitea.ref }}\nStatus: ${{ job.status}}' \
-            ${{ secrets.NTFY_URL }}
+      - name: ntfy Success
+        uses: niniyas/ntfy-action@master
+        if: success()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Release Success - ${{ env.CHART_NAME }}'
+          priority: 3
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,successfully,completed
+          details: 'Helm Chart ${{ env.CHART_NAME }}-${{ env.CHART_VERSION }} has been released!'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Release Failure - ${{ env.CHART_NAME }}'
+          priority: 4
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: 'Helm Chart ${{ env.CHART_NAME }}-${{ env.CHART_VERSION }} has failed to be released.'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/helm-charts/actions?workflow=release-charts-cloudflared.yml", "clear": true}]'
+          image: true
--- a/.gitea/workflows/release-charts-generic-device-plugin.yml
+++ b/.gitea/workflows/release-charts-generic-device-plugin.yml
@@ -14,37 +14,80 @@ env:

 jobs:
  release:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-js
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Set up Helm
        uses: azure/setup-helm@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}
-          version: latest
+          version: v3.19.2
+
+      - name: Add Repositories
+        run: |
+          cd ${WORKFLOW_DIR}
+
+          echo ">> Adding repositories for chart dependencies ..."
+          helm dependency list --max-col-width 120 2> /dev/null \
+            | tail +2 | head -n -1 \
+            | awk '{ print "helm repo add " $1 " " $3 }' \
+            | while read cmd; do echo "$cmd" | sh; done || true
+
+          if helm repo list | tail +2 | read -r; then
+            echo ">> Update repository cache ..."
+            helm repo update
+          fi
+
+          echo "----"

      - name: Package Helm Chart
        run: |
-          cd $WORKFLOW_DIR
-          helm dependency build
+          cd ${WORKFLOW_DIR}
+
+          echo ">> Building helm dependency ..."
+          helm dependency build --skip-refresh --debug
+
+          echo "----"
+
          echo "PACKAGE_PATH=$(helm package . | awk '{print $NF}')" >> $GITEA_ENV

      - name: Publish Helm Chart to Harbor
        run: |
-          helm registry login ${{ vars.REGISTRY_HOST }} -u ${{ vars.REGISTRY_USER }} -p ${{ secrets.REGISTRY_SECRET }}
-          helm push ${{ env.PACKAGE_PATH }} oci://${{ vars.REGISTRY_HOST }}/helm-charts
+          echo ">> Logging into Harbor ..."
+          helm registry login ${{ vars.REGISTRY_HOST }} -u ${{ vars.REGISTRY_USER }} -p ${{ secrets.REGISTRY_SECRET }} --debug
+
+          echo ""
+          echo ">> Publishing chart to Harbor ..."
+          helm push ${{ env.PACKAGE_PATH }} oci://${{ vars.REGISTRY_HOST }}/helm-charts --debug
+
+          echo "----"

      - name: Publish Helm Chart to Gitea
        run: |
-          helm plugin install https://github.com/chartmuseum/helm-push
-          helm repo add --username ${{ gitea.actor }} --password ${{ secrets.REPOSITORY_TOKEN }} helm-charts https://${{ vars.REPOSITORY_HOST }}/api/packages/alexlebens/helm
-          helm cm-push ${{ env.PACKAGE_PATH }} helm-charts
+          echo ">> Installing Chart Museum plugin ..."
+          helm plugin install https://github.com/chartmuseum/helm-push --debug
+
+          echo ""
+          echo ">> Adding Gitea repository ..."
+          helm repo add --username ${{ gitea.actor }} --password ${{ secrets.REPOSITORY_TOKEN }} helm-charts https://${{ vars.REPOSITORY_HOST }}/api/packages/alexlebens/helm --debug
+
+          echo ""
+          echo ">> Pushing chart to gitea"
+          helm cm-push ${{ env.PACKAGE_PATH }} helm-charts --debug

      - name: Extract Chart Metadata
        run: |
-          cd $WORKFLOW_DIR
+          cd ${WORKFLOW_DIR}
+
+          echo ">> Adding Chart metadata to workflow ENV ..."
+          echo ""
+          echo ">> Chart Version: $(yq '.version' Chart.yaml)"
+          echo ">> Chart Name: $(yq '.name' Chart.yaml)"
+
+          echo "----"
+
          echo "CHART_VERSION=$(yq '.version' Chart.yaml)" >> $GITEA_ENV
          echo "CHART_NAME=$(yq '.name' Chart.yaml)" >> $GITEA_ENV

@@ -56,11 +99,30 @@ jobs:
          files: |-
            ${{ env.PACKAGE_PATH }}

-      - name: Actions Ntfy
-        run: |
-          curl \
-            -H "Authorization: Bearer ${{ secrets.NTFY_CRED }}" \
-            -H "Title: Chart Released: ${{ env.CHART_NAME }}-${{ env.CHART_VERSION }}" \
-            -H "Content-Type: text/plain" \
-            -d $'Repo: ${{ gitea.repository }}\nCommit: ${{ gitea.sha }}\nRef: ${{ gitea.ref }}\nStatus: ${{ job.status}}' \
-            ${{ secrets.NTFY_URL }}
+      - name: ntfy Success
+        uses: niniyas/ntfy-action@master
+        if: success()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Release Success - ${{ env.CHART_NAME }}'
+          priority: 3
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,successfully,completed
+          details: 'Helm Chart ${{ env.CHART_NAME }}-${{ env.CHART_VERSION }} has been released!'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Release Failure - ${{ env.CHART_NAME }}'
+          priority: 4
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: 'Helm Chart ${{ env.CHART_NAME }}-${{ env.CHART_VERSION }} has failed to be released.'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/helm-charts/actions?workflow=release-charts-generic-device-plugin.yml", "clear": true}]'
+          image: true
--- a/.gitea/workflows/release-charts-gitea-actions.yml
+++ b/.gitea/workflows/release-charts-gitea-actions.yml
@@ -0,0 +1,128 @@
+name: release-charts-gitea-actions
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "charts/gitea-actions/**"
+
+  workflow_dispatch:
+
+env:
+  WORKFLOW_DIR: "charts/gitea-actions"
+
+jobs:
+  release:
+    runs-on: ubuntu-js
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+          version: v3.19.2
+
+      - name: Add Repositories
+        run: |
+          cd ${WORKFLOW_DIR}
+
+          echo ">> Adding repositories for chart dependencies ..."
+          helm dependency list --max-col-width 120 2> /dev/null \
+            | tail +2 | head -n -1 \
+            | awk '{ print "helm repo add " $1 " " $3 }' \
+            | while read cmd; do echo "$cmd" | sh; done || true
+
+          if helm repo list | tail +2 | read -r; then
+            echo ">> Update repository cache ..."
+            helm repo update
+          fi
+
+          echo "----"
+
+      - name: Package Helm Chart
+        run: |
+          cd ${WORKFLOW_DIR}
+
+          echo ">> Building helm dependency ..."
+          helm dependency build --skip-refresh --debug
+
+          echo "----"
+
+          echo "PACKAGE_PATH=$(helm package . | awk '{print $NF}')" >> $GITEA_ENV
+
+      - name: Publish Helm Chart to Harbor
+        run: |
+          echo ">> Logging into Harbor ..."
+          helm registry login ${{ vars.REGISTRY_HOST }} -u ${{ vars.REGISTRY_USER }} -p ${{ secrets.REGISTRY_SECRET }} --debug
+
+          echo ""
+          echo ">> Publishing chart to Harbor ..."
+          helm push ${{ env.PACKAGE_PATH }} oci://${{ vars.REGISTRY_HOST }}/helm-charts --debug
+
+          echo "----"
+
+      - name: Publish Helm Chart to Gitea
+        run: |
+          echo ">> Installing Chart Museum plugin ..."
+          helm plugin install https://github.com/chartmuseum/helm-push --debug
+
+          echo ""
+          echo ">> Adding Gitea repository ..."
+          helm repo add --username ${{ gitea.actor }} --password ${{ secrets.REPOSITORY_TOKEN }} helm-charts https://${{ vars.REPOSITORY_HOST }}/api/packages/alexlebens/helm --debug
+
+          echo ""
+          echo ">> Pushing chart to gitea"
+          helm cm-push ${{ env.PACKAGE_PATH }} helm-charts --debug
+
+      - name: Extract Chart Metadata
+        run: |
+          cd ${WORKFLOW_DIR}
+
+          echo ">> Adding Chart metadata to workflow ENV ..."
+          echo ""
+          echo ">> Chart Version: $(yq '.version' Chart.yaml)"
+          echo ">> Chart Name: $(yq '.name' Chart.yaml)"
+
+          echo "----"
+
+          echo "CHART_VERSION=$(yq '.version' Chart.yaml)" >> $GITEA_ENV
+          echo "CHART_NAME=$(yq '.name' Chart.yaml)" >> $GITEA_ENV
+
+      - name: Release Helm Chart
+        uses: akkuman/gitea-release-action@v1
+        with:
+          name: ${{ env.CHART_NAME }}-${{ env.CHART_VERSION }}
+          tag_name: ${{ env.CHART_NAME }}-${{ env.CHART_VERSION }}
+          files: |-
+            ${{ env.PACKAGE_PATH }}
+
+      - name: ntfy Success
+        uses: niniyas/ntfy-action@master
+        if: success()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Release Success - ${{ env.CHART_NAME }}'
+          priority: 3
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,successfully,completed
+          details: 'Helm Chart ${{ env.CHART_NAME }}-${{ env.CHART_VERSION }} has been released!'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Release Failure - ${{ env.CHART_NAME }}'
+          priority: 4
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: 'Helm Chart ${{ env.CHART_NAME }}-${{ env.CHART_VERSION }} has failed to be released.'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/helm-charts/actions?workflow=release-charts-gitea-actions.yml", "clear": true}]'
+          image: true
--- a/.gitea/workflows/release-charts-postgres-cluster.yml
+++ b/.gitea/workflows/release-charts-postgres-cluster.yml
@@ -14,37 +14,80 @@ env:

 jobs:
  release:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-js
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Set up Helm
        uses: azure/setup-helm@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}
-          version: latest
+          version: v3.19.2
+
+      - name: Add Repositories
+        run: |
+          cd ${WORKFLOW_DIR}
+
+          echo ">> Adding repositories for chart dependencies ..."
+          helm dependency list --max-col-width 120 2> /dev/null \
+            | tail +2 | head -n -1 \
+            | awk '{ print "helm repo add " $1 " " $3 }' \
+            | while read cmd; do echo "$cmd" | sh; done || true
+
+          if helm repo list | tail +2 | read -r; then
+            echo ">> Update repository cache ..."
+            helm repo update
+          fi
+
+          echo "----"

      - name: Package Helm Chart
        run: |
-          cd $WORKFLOW_DIR
-          helm dependency build
+          cd ${WORKFLOW_DIR}
+
+          echo ">> Building helm dependency ..."
+          helm dependency build --skip-refresh --debug
+
+          echo "----"
+
          echo "PACKAGE_PATH=$(helm package . | awk '{print $NF}')" >> $GITEA_ENV

      - name: Publish Helm Chart to Harbor
        run: |
-          helm registry login ${{ vars.REGISTRY_HOST }} -u ${{ vars.REGISTRY_USER }} -p ${{ secrets.REGISTRY_SECRET }}
-          helm push ${{ env.PACKAGE_PATH }} oci://${{ vars.REGISTRY_HOST }}/helm-charts
+          echo ">> Logging into Harbor ..."
+          helm registry login ${{ vars.REGISTRY_HOST }} -u ${{ vars.REGISTRY_USER }} -p ${{ secrets.REGISTRY_SECRET }} --debug
+
+          echo ""
+          echo ">> Publishing chart to Harbor ..."
+          helm push ${{ env.PACKAGE_PATH }} oci://${{ vars.REGISTRY_HOST }}/helm-charts --debug
+
+          echo "----"

      - name: Publish Helm Chart to Gitea
        run: |
-          helm plugin install https://github.com/chartmuseum/helm-push
-          helm repo add --username ${{ gitea.actor }} --password ${{ secrets.REPOSITORY_TOKEN }} helm-charts https://${{ vars.REPOSITORY_HOST }}/api/packages/alexlebens/helm
-          helm cm-push ${{ env.PACKAGE_PATH }} helm-charts
+          echo ">> Installing Chart Museum plugin ..."
+          helm plugin install https://github.com/chartmuseum/helm-push --debug
+
+          echo ""
+          echo ">> Adding Gitea repository ..."
+          helm repo add --username ${{ gitea.actor }} --password ${{ secrets.REPOSITORY_TOKEN }} helm-charts https://${{ vars.REPOSITORY_HOST }}/api/packages/alexlebens/helm --debug
+
+          echo ""
+          echo ">> Pushing chart to gitea"
+          helm cm-push ${{ env.PACKAGE_PATH }} helm-charts --debug

      - name: Extract Chart Metadata
        run: |
-          cd $WORKFLOW_DIR
+          cd ${WORKFLOW_DIR}
+
+          echo ">> Adding Chart metadata to workflow ENV ..."
+          echo ""
+          echo ">> Chart Version: $(yq '.version' Chart.yaml)"
+          echo ">> Chart Name: $(yq '.name' Chart.yaml)"
+
+          echo "----"
+
          echo "CHART_VERSION=$(yq '.version' Chart.yaml)" >> $GITEA_ENV
          echo "CHART_NAME=$(yq '.name' Chart.yaml)" >> $GITEA_ENV

@@ -56,11 +99,30 @@ jobs:
          files: |-
            ${{ env.PACKAGE_PATH }}

-      - name: Actions Ntfy
-        run: |
-          curl \
-            -H "Authorization: Bearer ${{ secrets.NTFY_CRED }}" \
-            -H "Title: Chart Released: ${{ env.CHART_NAME }}-${{ env.CHART_VERSION }}" \
-            -H "Content-Type: text/plain" \
-            -d $'Repo: ${{ gitea.repository }}\nCommit: ${{ gitea.sha }}\nRef: ${{ gitea.ref }}\nStatus: ${{ job.status}}' \
-            ${{ secrets.NTFY_URL }}
+      - name: ntfy Success
+        uses: niniyas/ntfy-action@master
+        if: success()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Release Success - ${{ env.CHART_NAME }}'
+          priority: 3
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,successfully,completed
+          details: 'Helm Chart ${{ env.CHART_NAME }}-${{ env.CHART_VERSION }} has been released!'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Release Failure - ${{ env.CHART_NAME }}'
+          priority: 4
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: 'Helm Chart ${{ env.CHART_NAME }}-${{ env.CHART_VERSION }} has failed to be released.'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/helm-charts/actions?workflow=release-charts-postgres-cluster.yml", "clear": true}]'
+          image: true
--- a/.gitea/workflows/renovate.yaml
+++ b/.gitea/workflows/renovate.yaml
@@ -0,0 +1,32 @@
+name: renovate
+
+on:
+  schedule:
+    - cron: "@daily"
+
+  push:
+    branches:
+      - main
+
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    container: ghcr.io/renovatebot/renovate:42
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Renovate
+        run: renovate
+        env:
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: ${{ vars.INSTANCE_URL }}
+          RENOVATE_REPOSITORIES: alexlebens/helm-charts
+          RENOVATE_GIT_AUTHOR: Renovate Bot <renovate-bot@alexlebens.net>
+          LOG_LEVEL: info
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_GIT_PRIVATE_KEY: ${{ secrets.RENOVATE_GIT_PRIVATE_KEY }}
+          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}
+          RENOVATE_REDIS_URL: ${{ vars.RENOVATE_REDIS_URL }}
--- a/.github/workflows/release-charts.yml
+++ b/.github/workflows/release-charts.yml
@@ -14,7 +14,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0

--- a/.gitignore
+++ b/.gitignore
@@ -1,12 +1,2 @@
-# Archived
-charts/**/archive
-
 # Compiled Helm chart dependencies
-charts/**/Chart.lock
 charts/**/charts/
-
-# Testing
-__snapshot__/
-
-# Docs
-_site/
--- a/charts/cloudflared/Chart.lock
+++ b/charts/cloudflared/Chart.lock
@@ -0,0 +1,6 @@
+dependencies:
+- name: common
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.5.0
+digest: sha256:cd050e107fbec6769024a6d316c3f43701295a55cddf53a9fc304b52ea879560
+generated: "2025-12-04T18:06:50.235715-06:00"
--- a/charts/cloudflared/Chart.yaml
+++ b/charts/cloudflared/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: cloudflared
-version: 1.15.0
+version: 1.23.2
 description: Cloudflared Tunnel
 keywords:
  - cloudflare
@@ -13,6 +13,6 @@ maintainers:
 dependencies:
  - name: common
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.5.0
 icon: https://avatars.githubusercontent.com/u/314135?s=48&v=4
-appVersion: "2025.5.0"
+appVersion: "2025.11.1"
--- a/charts/cloudflared/README.md
+++ b/charts/cloudflared/README.md
@@ -1,6 +1,6 @@
 # cloudflared

-![Version: 1.15.0](https://img.shields.io/badge/Version-1.15.0-informational?style=flat-square) ![AppVersion: 2025.5.0](https://img.shields.io/badge/AppVersion-2025.5.0-informational?style=flat-square)
+![Version: 1.23.2](https://img.shields.io/badge/Version-1.23.2-informational?style=flat-square) ![AppVersion: 2025.11.1](https://img.shields.io/badge/AppVersion-2025.11.1-informational?style=flat-square)

 Cloudflared Tunnel

@@ -19,7 +19,7 @@ Cloudflared Tunnel

 | Repository | Name | Version |
 |------------|------|---------|
-| https://bjw-s-labs.github.io/helm-charts/ | common | 4.0.1 |
+| https://bjw-s-labs.github.io/helm-charts/ | common | 4.5.0 |

 ## Values

@@ -27,7 +27,7 @@ Cloudflared Tunnel
 |-----|------|---------|-------------|
 | existingSecretKey | string | `"cf-tunnel-token"` | Name of key that contains the token in the existingSecret |
 | existingSecretName | string | `"cloudflared-secret"` | Name of existing secret that contains Cloudflare token |
-| image | object | `{"pullPolicy":"IfNotPresent","repository":"cloudflare/cloudflared","tag":"2025.5.0"}` | Default image |
+| image | object | `{"pullPolicy":"IfNotPresent","repository":"cloudflare/cloudflared","tag":"2025.11.1"}` | Default image |
 | name | string | `"cloudflared"` | Name override of release |
 | resources | object | `{"requests":{"cpu":"10m","memory":"128Mi"}}` | Default resources |

--- a/charts/cloudflared/values.yaml
+++ b/charts/cloudflared/values.yaml
@@ -10,7 +10,7 @@ existingSecretKey: cf-tunnel-token
 # -- Default image
 image:
  repository: cloudflare/cloudflared
-  tag: "2025.5.0"
+  tag: "2025.11.1"
  pullPolicy: IfNotPresent

 # -- Default resources
--- a/charts/generic-device-plugin/Chart.lock
+++ b/charts/generic-device-plugin/Chart.lock
@@ -0,0 +1,6 @@
+dependencies:
+- name: common
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.5.0
+digest: sha256:cd050e107fbec6769024a6d316c3f43701295a55cddf53a9fc304b52ea879560
+generated: "2025-12-04T18:08:17.823318-06:00"
--- a/charts/generic-device-plugin/Chart.yaml
+++ b/charts/generic-device-plugin/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: generic-device-plugin
-version: 0.1.10
+version: 0.20.4
 description: Generic Device Plugin
 keywords:
  - generic-device-plugin
@@ -13,6 +13,6 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: common
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.7.3
-appVersion: 0.1.10
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.5.0
+appVersion: 0.20.4
--- a/charts/generic-device-plugin/README.md
+++ b/charts/generic-device-plugin/README.md
@@ -1,6 +1,6 @@
 # generic-device-plugin

-![Version: 0.1.10](https://img.shields.io/badge/Version-0.1.10-informational?style=flat-square) ![AppVersion: 0.1.10](https://img.shields.io/badge/AppVersion-0.1.10-informational?style=flat-square)
+![Version: 0.20.4](https://img.shields.io/badge/Version-0.20.4-informational?style=flat-square) ![AppVersion: 0.20.4](https://img.shields.io/badge/AppVersion-0.20.4-informational?style=flat-square)

 Generic Device Plugin

@@ -19,7 +19,7 @@ Generic Device Plugin

 | Repository | Name | Version |
 |------------|------|---------|
-| https://bjw-s.github.io/helm-charts/ | common | 3.7.3 |
+| https://bjw-s-labs.github.io/helm-charts/ | common | 4.5.0 |

 ## Values

@@ -27,10 +27,10 @@ Generic Device Plugin
 |-----|------|---------|-------------|
 | config | object | `{"data":"devices:\n  - name: serial\n    groups:\n      - paths:\n          - path: /dev/ttyUSB*\n      - paths:\n          - path: /dev/ttyACM*\n      - paths:\n          - path: /dev/tty.usb*\n      - paths:\n          - path: /dev/cu.*\n      - paths:\n          - path: /dev/cuaU*\n      - paths:\n          - path: /dev/rfcomm*\n  - name: video\n    groups:\n      - paths:\n          - path: /dev/video0\n  - name: fuse\n    groups:\n      - count: 10\n        paths:\n          - path: /dev/fuse\n  - name: audio\n    groups:\n      - count: 10\n        paths:\n          - path: /dev/snd\n  - name: capture\n    groups:\n      - paths:\n          - path: /dev/snd/controlC0\n          - path: /dev/snd/pcmC0D0c\n      - paths:\n          - path: /dev/snd/controlC1\n            mountPath: /dev/snd/controlC0\n          - path: /dev/snd/pcmC1D0c\n            mountPath: /dev/snd/pcmC0D0c\n      - paths:\n          - path: /dev/snd/controlC2\n            mountPath: /dev/snd/controlC0\n          - path: /dev/snd/pcmC2D0c\n            mountPath: /dev/snd/pcmC0D0c\n      - paths:\n          - path: /dev/snd/controlC3\n            mountPath: /dev/snd/controlC0\n          - path: /dev/snd/pcmC3D0c\n            mountPath: /dev/snd/pcmC0D0c\n","enabled":true}` | Config map |
 | config.data | string | See [values.yaml](./values.yaml) | generic-device-plugin config file [[ref]](https://github.com/squat/generic-device-plugin#usage) |
-| deviceDomain | string | `"squat.ai"` | Domain used by devices for identifcation |
-| image | object | `{"pullPolicy":"Always","repository":"ghcr.io/squat/generic-device-plugin","tag":"latest@sha256:d7d0951df7f11479185fd9fba1c1cb4d9c8f3232d38a5468d6fe80074f2b45d5"}` | Default image |
+| deviceDomain | string | `"devic.es"` | Domain used by devices for identifcation |
+| image | object | `{"pullPolicy":"Always","repository":"ghcr.io/squat/generic-device-plugin","tag":"latest@sha256:4896ffd516624d6eb7572e102bc4397e91f8bc3b2fb38b5bfefd758baae3dcf2"}` | Default image |
 | name | string | `"generic-device-plugin"` | Name override of release |
-| resources | object | `{"limit":{"cpu":"100m","memory":"20Mi"},"requests":{"cpu":"50m","memory":"10Mi"}}` | Default resources |
+| resources | object | `{"requests":{"cpu":"50m","memory":"10Mi"}}` | Default resources |
 | service | object | `{"listenPort":8080}` | Service port |

 ----------------------------------------------
--- a/charts/generic-device-plugin/values.yaml
+++ b/charts/generic-device-plugin/values.yaml
@@ -4,11 +4,11 @@ name: generic-device-plugin
 # -- Default image
 image:
  repository: ghcr.io/squat/generic-device-plugin
-  tag: latest@sha256:d7d0951df7f11479185fd9fba1c1cb4d9c8f3232d38a5468d6fe80074f2b45d5
+  tag: latest@sha256:4896ffd516624d6eb7572e102bc4397e91f8bc3b2fb38b5bfefd758baae3dcf2
  pullPolicy: Always

 # -- Domain used by devices for identifcation
-deviceDomain: squat.ai
+deviceDomain: devic.es

 # -- Service port
 service:
@@ -16,9 +16,6 @@ service:

 # -- Default resources
 resources:
-  limit:
-    cpu: 100m
-    memory: 20Mi
  requests:
    cpu: 50m
    memory: 10Mi
--- a/charts/gitea-actions/Chart.yaml
+++ b/charts/gitea-actions/Chart.yaml
@@ -0,0 +1,15 @@
+apiVersion: v2
+name: gitea-actions
+version: 0.2.1
+description: Gitea Actions
+keywords:
+  - cicd
+  - runner
+  - actions
+sources:
+  - https://gitea.com/gitea/helm-actions
+  - https://gitea.com/gitea/act
+maintainers:
+  - name: alexlebens
+icon: https://avatars.githubusercontent.com/u/100373852?s=48&v=4
+appVersion: 0.2.11
--- a/charts/gitea-actions/LICENSE
+++ b/charts/gitea-actions/LICENSE
@@ -0,0 +1,18 @@
+MIT License
+
+Copyright (c) 2025 gitea
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
+EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.
--- a/charts/gitea-actions/README.md
+++ b/charts/gitea-actions/README.md
@@ -0,0 +1,54 @@
+# gitea-actions
+
+![Version: 0.2.1](https://img.shields.io/badge/Version-0.2.1-informational?style=flat-square) ![AppVersion: 0.2.11](https://img.shields.io/badge/AppVersion-0.2.11-informational?style=flat-square)
+
+Gitea Actions
+
+## Maintainers
+
+| Name | Email | Url |
+| ---- | ------ | --- |
+| alexlebens |  |  |
+
+## Source Code
+
+* <https://gitea.com/gitea/helm-actions>
+* <https://gitea.com/gitea/act>
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| enabled | bool | `true` |  |
+| existingSecret | string | `""` |  |
+| existingSecretKey | string | `""` |  |
+| giteaRootURL | string | `""` |  |
+| global.fullnameOverride | string | `""` |  |
+| global.imageRegistry | string | `""` |  |
+| global.nameOverride | string | `""` |  |
+| global.storageClass | string | `""` |  |
+| init.image.repository | string | `"busybox"` |  |
+| init.image.tag | string | `"1.37.0"` |  |
+| statefulset.actRunner.config | string | `"log:\n  level: debug\ncache:\n  enabled: false\n"` |  |
+| statefulset.actRunner.extraVolumeMounts | list | `[]` |  |
+| statefulset.actRunner.pullPolicy | string | `"IfNotPresent"` |  |
+| statefulset.actRunner.repository | string | `"gitea/act_runner"` |  |
+| statefulset.actRunner.tag | string | `"0.2.11"` |  |
+| statefulset.affinity | object | `{}` |  |
+| statefulset.annotations | object | `{}` |  |
+| statefulset.dind.extraEnvs | list | `[]` |  |
+| statefulset.dind.extraVolumeMounts | list | `[]` |  |
+| statefulset.dind.pullPolicy | string | `"IfNotPresent"` |  |
+| statefulset.dind.repository | string | `"docker"` |  |
+| statefulset.dind.tag | string | `"25.0.2-dind"` |  |
+| statefulset.extraVolumes | list | `[]` |  |
+| statefulset.labels | object | `{}` |  |
+| statefulset.nodeSelector | object | `{}` |  |
+| statefulset.persistence.size | string | `"1Gi"` |  |
+| statefulset.persistence.storageClass | string | `""` |  |
+| statefulset.replicas | int | `1` |  |
+| statefulset.resources | object | `{}` |  |
+| statefulset.tolerations | list | `[]` |  |
+
+----------------------------------------------
+Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)
--- a/charts/gitea-actions/templates/_helpers.tpl
+++ b/charts/gitea-actions/templates/_helpers.tpl
@@ -0,0 +1,102 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+
+{{- define "gitea.actions.name" -}}
+{{- default .Chart.Name .Values.global.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "gitea.actions.fullname" -}}
+{{- if .Values.global.fullnameOverride -}}
+{{- .Values.global.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.global.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "gitea.actions.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Storage Class
+*/}}
+{{- define "gitea.actions.persistence.storageClass" -}}
+{{- $storageClass :=  (tpl ( default "" .Values.statefulset.persistence.storageClass) .) | default (tpl ( default "" .Values.global.storageClass) .) }}
+{{- if $storageClass }}
+storageClassName: {{ $storageClass | quote }}
+{{- end }}
+{{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "gitea.actions.labels" -}}
+helm.sh/chart: {{ include "gitea.actions.chart" . }}
+app: {{ include "gitea.actions.name" . }}
+{{ include "gitea.actions.selectorLabels" . }}
+app.kubernetes.io/version: {{ .Values.statefulset.actRunner.tag | default .Chart.AppVersion | quote }}
+version: {{ .Values.statefulset.actRunner.tag | default .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{- define "gitea.actions.labels.actRunner" -}}
+helm.sh/chart: {{ include "gitea.actions.chart" . }}
+app: {{ include "gitea.actions.name" . }}-act-runner
+{{ include "gitea.actions.selectorLabels.actRunner" . }}
+app.kubernetes.io/version: {{ .Values.statefulset.actRunner.tag | default .Chart.AppVersion | quote }}
+version: {{ .Values.statefulset.actRunner.tag | default .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{/*
+Selector labels
+*/}}
+{{- define "gitea.actions.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "gitea.actions.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{- define "gitea.actions.selectorLabels.actRunner" -}}
+app.kubernetes.io/name: {{ include "gitea.actions.name" . }}-act-runner
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{- define "gitea.actions.local_root_url" -}}
+  {{- .Values.giteaRootURL -}}
+{{- end -}}
+
+{{/*
+Parse the http url to hostname + port separated by space for the nc command
+*/}}
+{{- define "gitea.actions.nc" -}}
+{{- $url := include "gitea.actions.local_root_url" . | urlParse -}}
+{{- $host := get $url "host" -}}
+{{- $scheme := get $url "scheme" -}}
+{{- $port := "80" -}}
+{{- if contains ":" $host -}}
+    {{- $hostAndPort := regexSplit ":" $host 2 -}}
+    {{- $host = index $hostAndPort 0 -}}
+    {{- $port = index $hostAndPort 1 -}}
+{{- else if eq $scheme "https" -}}
+    {{- $port = "443" -}}
+{{- else if eq $scheme "http" -}}
+    {{- $port = "80" -}}
+{{- end -}}
+{{- printf "%s %s" $host $port -}}
+{{- end -}}
--- a/charts/gitea-actions/templates/config-map.yaml
+++ b/charts/gitea-actions/templates/config-map.yaml
@@ -0,0 +1,15 @@
+{{- if .Values.enabled }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "gitea.actions.fullname" . }}-act-runner-config
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "gitea.actions.labels" . | nindent 4 }}
+data:
+  config.yaml: |
+    {{- with .Values.statefulset.actRunner.config -}}
+    {{ . | nindent 4}}
+    {{- end -}}
+{{- end }}
--- a/charts/gitea-actions/templates/stateful-set.yaml
+++ b/charts/gitea-actions/templates/stateful-set.yaml
@@ -0,0 +1,127 @@
+{{- if .Values.enabled }}
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    {{- include "gitea.actions.labels.actRunner" . | nindent 4 }}
+    {{- with .Values.statefulset.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  annotations:
+    {{- with .Values.statefulset.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  name: {{ include "gitea.actions.fullname" . }}-act-runner
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+spec:
+  replicas: {{ .Values.statefulset.replicas }}
+  selector:
+    matchLabels:
+      {{- include "gitea.actions.selectorLabels.actRunner" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "gitea.actions.labels.actRunner" . | nindent 8 }}
+        {{- with .Values.statefulset.labels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      initContainers:
+        - name: init-gitea
+          image: "{{ .Values.init.image.repository }}:{{ .Values.init.image.tag }}"
+          command:
+            - sh
+            - -c
+            - |
+              while ! nc -z {{ include "gitea.actions.nc" . }}; do
+                sleep 5
+              done
+      containers:
+        - name: act-runner
+          image: "{{ .Values.statefulset.actRunner.repository }}:{{ .Values.statefulset.actRunner.tag }}"
+          imagePullPolicy: {{ .Values.statefulset.actRunner.pullPolicy }}
+          workingDir: /data
+          env:
+            - name: DOCKER_HOST
+              value: tcp://127.0.0.1:2376
+            - name: DOCKER_TLS_VERIFY
+              value: "1"
+            - name: DOCKER_CERT_PATH
+              value: /certs/server
+            - name: GITEA_RUNNER_REGISTRATION_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.existingSecret | default "gitea-actions-token" }}"
+                  key: "{{ .Values.existingSecretKey | default "token" }}"
+            - name: GITEA_INSTANCE_URL
+              value: {{ include "gitea.actions.local_root_url" . }}
+            - name: CONFIG_FILE
+              value: /actrunner/config.yaml
+          resources:
+            {{- toYaml .Values.statefulset.resources | nindent 12 }}
+          volumeMounts:
+            - mountPath: /actrunner/config.yaml
+              name: act-runner-config
+              subPath: config.yaml
+            - mountPath: /certs/server
+              name: docker-certs
+            - mountPath: /data
+              name: data-act-runner
+            {{- with .Values.statefulset.actRunner.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+        - name: dind
+          image: "{{ .Values.statefulset.dind.repository }}:{{ .Values.statefulset.dind.tag }}"
+          imagePullPolicy: {{ .Values.statefulset.dind.pullPolicy }}
+          env:
+            - name: DOCKER_HOST
+              value: tcp://127.0.0.1:2376
+            - name: DOCKER_TLS_VERIFY
+              value: "1"
+            - name: DOCKER_CERT_PATH
+              value: /certs/server
+            {{- if .Values.statefulset.dind.extraEnvs }}
+            {{- toYaml .Values.statefulset.dind.extraEnvs | nindent 12 }}
+            {{- end }}
+          securityContext:
+            privileged: true
+          resources:
+            {{- toYaml .Values.statefulset.resources | nindent 12 }}
+          volumeMounts:
+            - mountPath: /certs/server
+              name: docker-certs
+            {{- with .Values.statefulset.dind.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+      {{- range $key, $value := .Values.statefulset.nodeSelector }}
+      nodeSelector:
+        {{ $key }}: {{ $value | quote }}
+      {{- end }}
+      {{- with .Values.statefulset.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.statefulset.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+        - name: act-runner-config
+          configMap:
+            name: {{ include "gitea.actions.fullname" . }}-act-runner-config
+        - name: docker-certs
+          emptyDir: {}
+        {{- with .Values.statefulset.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+  volumeClaimTemplates:
+    - metadata:
+        name: data-act-runner
+      spec:
+        accessModes: [ "ReadWriteOnce" ]
+        {{- include "gitea.actions.persistence.storageClass" . | nindent 8 }}
+        resources:
+          requests:
+            storage: {{ .Values.statefulset.persistence.size }}
+{{- end }}
--- a/charts/gitea-actions/values.yaml
+++ b/charts/gitea-actions/values.yaml
@@ -0,0 +1,102 @@
+# Configure Gitea Actions
+# - must enable persistence if the job is enabled
+## @section Gitea Actions
+#
+## @param enabled Create an act runner StatefulSet.
+## @param init.image.repository The image used for the init containers
+## @param init.image.tag The image tag used for the init containers
+## @param statefulset.annotations Act runner annotations
+## @param statefulset.labels Act runner labels
+## @param statefulset.resources Act runner resources
+## @param statefulset.nodeSelector NodeSelector for the statefulset
+## @param statefulset.tolerations Tolerations for the statefulset
+## @param statefulset.affinity Affinity for the statefulset
+## @param statefulset.extraVolumes Extra volumes for the statefulset
+## @param statefulset.actRunner.repository The Gitea act runner image
+## @param statefulset.actRunner.tag The Gitea act runner tag
+## @param statefulset.actRunner.pullPolicy The Gitea act runner pullPolicy
+## @param statefulset.actRunner.extraVolumeMounts Allows mounting extra volumes in the act runner container
+## @param statefulset.actRunner.config [default: Too complex. See values.yaml] Act runner custom configuration. See [Act Runner documentation](https://docs.gitea.com/usage/actions/act-runner#configuration) for details.
+## @param statefulset.dind.repository The Docker-in-Docker image
+## @param statefulset.dind.tag The Docker-in-Docker image tag
+## @param statefulset.dind.pullPolicy The Docker-in-Docker pullPolicy
+## @param statefulset.dind.extraVolumeMounts Allows mounting extra volumes in the Docker-in-Docker container
+## @param statefulset.dind.extraEnvs Allows adding custom environment variables, such as `DOCKER_IPTABLES_LEGACY`
+## @param statefulset.persistence.size Size for persistence to store act runner data
+## @param provisioning.enabled Create a job that will create and save the token in a Kubernetes Secret
+## @param provisioning.annotations Job's annotations
+## @param provisioning.labels Job's labels
+## @param provisioning.resources Job's resources
+## @param provisioning.nodeSelector NodeSelector for the job
+## @param provisioning.tolerations Tolerations for the job
+## @param provisioning.affinity Affinity for the job
+## @param provisioning.ttlSecondsAfterFinished ttl for the job after finished in order to allow helm to properly recognize that the job completed
+## @param provisioning.publish.repository The image that can create the secret via kubectl
+## @param provisioning.publish.tag The publish image tag that can create the secret
+## @param provisioning.publish.pullPolicy The publish image pullPolicy that can create the secret
+## @param existingSecret Secret that contains the token
+## @param existingSecretKey Secret key
+## @param giteaRootURL URL the act_runner registers and connect with
+enabled: true
+statefulset:
+  replicas: 1
+  annotations: {}
+  labels: {}
+  resources: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  extraVolumes: []
+
+  actRunner:
+    repository: gitea/act_runner
+    tag: 0.2.11
+    pullPolicy: IfNotPresent
+    extraVolumeMounts: []
+
+    # See full example here: https://gitea.com/gitea/act_runner/src/branch/main/internal/pkg/config/config.example.yaml
+    config: |
+      log:
+        level: debug
+      cache:
+        enabled: false
+
+  dind:
+    repository: docker
+    tag: 25.0.2-dind
+    pullPolicy: IfNotPresent
+    extraVolumeMounts: []
+
+    # If the container keeps crashing in your environment, you might have to add the `DOCKER_IPTABLES_LEGACY` environment variable.
+    # See https://github.com/docker-library/docker/issues/463#issuecomment-1881909456
+    extraEnvs:
+      []
+      #  - name: "DOCKER_IPTABLES_LEGACY"
+      #    value: "1"
+
+  persistence:
+    storageClass: ""
+    size: 1Gi
+
+init:
+  image:
+    repository: busybox
+    tag: "1.37.0"
+
+## Specify an existing token secret
+##
+existingSecret: ""
+existingSecretKey: ""
+
+## Specify the root URL of the Gitea instance
+giteaRootURL: ""
+
+## @section Global
+#
+## @param global.imageRegistry global image registry override
+## @param global.storageClass global storage class override
+global:
+  imageRegistry: ""
+  storageClass: ""
+  nameOverride: ""
+  fullnameOverride: ""
--- a/charts/postgres-cluster/Chart.yaml
+++ b/charts/postgres-cluster/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: postgres-cluster
-version: 6.1.1
+version: 6.16.1
 description: Cloudnative-pg Cluster
 keywords:
  - database
@@ -11,4 +11,4 @@ sources:
 maintainers:
  - name: alexlebens
 icon: https://avatars.githubusercontent.com/u/100373852?s=48&v=4
-appVersion: v1.26.0
+appVersion: v1.27.0
--- a/charts/postgres-cluster/README.md
+++ b/charts/postgres-cluster/README.md
@@ -1,6 +1,6 @@
 # postgres-cluster

-![Version: 6.1.1](https://img.shields.io/badge/Version-6.1.1-informational?style=flat-square) ![AppVersion: v1.26.0](https://img.shields.io/badge/AppVersion-v1.26.0-informational?style=flat-square)
+![Version: 6.16.1](https://img.shields.io/badge/Version-6.16.1-informational?style=flat-square) ![AppVersion: v1.27.0](https://img.shields.io/badge/AppVersion-v1.27.0-informational?style=flat-square)

 Cloudnative-pg Cluster

@@ -19,44 +19,21 @@ Cloudnative-pg Cluster

 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| backup | object | `{"enabled":true,"method":"objectStore","objectStore":[{"clusterName":"","data":{"compression":"snappy","encryption":"","jobs":1},"destinationPath":"s3://postgres-backups","endpointCA":{"create":false,"key":"","name":""},"endpointCredentials":"","endpointURL":"https://nyc3.digitaloceanspaces.com","index":1,"isWALArchiver":true,"name":"external","retentionPolicy":"30d","wal":{"compression":"snappy","encryption":"","maxParallel":1}}],"scheduledBackups":[{"backupName":"external","backupOwnerReference":"self","name":"daily-backup","plugin":"barman-cloud.cloudnative-pg.io","schedule":"0 0 */3 * *","suspend":false}]}` | Backup settings |
-| backup.enabled | bool | `true` | You need to configure backups manually, so backups are disabled by default. |
+| backup | object | `{"method":"objectStore","objectStore":[],"scheduledBackups":[]}` | Backup settings |
 | backup.method | string | `"objectStore"` | Method to create backups, options currently are only objectStore |
-| backup.objectStore | list | `[{"clusterName":"","data":{"compression":"snappy","encryption":"","jobs":1},"destinationPath":"s3://postgres-backups","endpointCA":{"create":false,"key":"","name":""},"endpointCredentials":"","endpointURL":"https://nyc3.digitaloceanspaces.com","index":1,"isWALArchiver":true,"name":"external","retentionPolicy":"30d","wal":{"compression":"snappy","encryption":"","maxParallel":1}}]` | Options for object store backups |
-| backup.objectStore[0].clusterName | string | `""` | Override the name of the backup cluster, defaults to "cluster.name" |
-| backup.objectStore[0].data.compression | string | `"snappy"` | Data compression method. One of `` (for no compression), `gzip`, `bzip2` or `snappy`. |
-| backup.objectStore[0].data.encryption | string | `""` | Whether to instruct the storage provider to encrypt data files. One of `` (use the storage container default), `AES256` or `aws:kms`. |
-| backup.objectStore[0].data.jobs | int | `1` | Number of data files to be archived or restored in parallel. |
-| backup.objectStore[0].destinationPath | string | `"s3://postgres-backups"` | Overrides the provider specific default path. Defaults to: S3: s3://<bucket><path> Azure: https://<storageAccount>.<serviceName>.core.windows.net/<containerName><path> Google: gs://<bucket><path> |
-| backup.objectStore[0].endpointCA | object | `{"create":false,"key":"","name":""}` | Specifies a CA bundle to validate a privately signed certificate. |
-| backup.objectStore[0].endpointCA.create | bool | `false` | Creates a secret with the given value if true, otherwise uses an existing secret. |
-| backup.objectStore[0].endpointCredentials | string | `""` | Specifies secret that contains S3 credentials, should contain the keys ACCESS_KEY_ID and ACCESS_SECRET_KEY |
-| backup.objectStore[0].endpointURL | string | `"https://nyc3.digitaloceanspaces.com"` | Overrides the provider specific default endpoint. Defaults to: S3: https://s3.<region>.amazonaws.com" |
-| backup.objectStore[0].index | int | `1` | Generate external cluster name, uses: {{ .Release.Name }}-postgresql-<major version>-backup-index-{{ index }} |
-| backup.objectStore[0].isWALArchiver | bool | `true` | Specificies if this backup will do WALs |
-| backup.objectStore[0].name | string | `"external"` | Object store backup name |
-| backup.objectStore[0].retentionPolicy | string | `"30d"` | Retention policy for backups |
-| backup.objectStore[0].wal | object | `{"compression":"snappy","encryption":"","maxParallel":1}` | Storage |
-| backup.objectStore[0].wal.compression | string | `"snappy"` | WAL compression method. One of `` (for no compression), `gzip`, `bzip2` or `snappy`. |
-| backup.objectStore[0].wal.encryption | string | `""` | Whether to instruct the storage provider to encrypt WAL files. One of `` (use the storage container default), `AES256` or `aws:kms`. |
-| backup.objectStore[0].wal.maxParallel | int | `1` | Number of WAL files to be archived or restored in parallel. |
-| backup.scheduledBackups[0].backupName | string | `"external"` | Name of backup target |
-| backup.scheduledBackups[0].backupOwnerReference | string | `"self"` | Backup owner reference |
-| backup.scheduledBackups[0].name | string | `"daily-backup"` | Scheduled backup name |
-| backup.scheduledBackups[0].plugin | string | `"barman-cloud.cloudnative-pg.io"` | Backup method, can be `barman-cloud.cloudnative-pg.io` (default) |
-| backup.scheduledBackups[0].schedule | string | `"0 0 */3 * *"` | Schedule in cron format |
-| backup.scheduledBackups[0].suspend | bool | `false` | Temporarily stop scheduled backups from running |
-| cluster | object | `{"additionalLabels":{},"affinity":{"enablePodAntiAffinity":true,"topologyKey":"kubernetes.io/hostname"},"annotations":{},"certificates":{},"enablePDB":true,"enableSuperuserAccess":false,"image":{"repository":"ghcr.io/cloudnative-pg/postgresql","tag":"17.5-1-bullseye"},"imagePullPolicy":"IfNotPresent","imagePullSecrets":[],"initdb":{},"instances":3,"logLevel":"info","monitoring":{"customQueries":[],"customQueriesSecret":[],"disableDefaultQueries":false,"enabled":false,"podMonitor":{"enabled":true,"metricRelabelings":[],"relabelings":[]},"prometheusRule":{"enabled":false,"excludeRules":[]}},"postgresGID":-1,"postgresUID":-1,"postgresql":{"ldap":{},"parameters":{"hot_standby_feedback":"on","max_slot_wal_keep_size":"2000MB","shared_buffers":"128MB"},"pg_hba":[],"pg_ident":[],"shared_preload_libraries":[],"synchronous":{}},"primaryUpdateMethod":"switchover","primaryUpdateStrategy":"unsupervised","priorityClassName":"","resources":{"limits":{"hugepages-2Mi":"256Mi"},"requests":{"cpu":"100m","memory":"256Mi"}},"roles":[],"serviceAccountTemplate":{},"services":{},"storage":{"size":"10Gi","storageClass":""},"superuserSecret":"","walStorage":{"enabled":true,"size":"2Gi","storageClass":""}}` | Cluster settings |
+| backup.objectStore | list | `[]` | Options for object store backups |
+| backup.scheduledBackups | list | `[]` | List of scheduled backups |
+| cluster | object | `{"additionalLabels":{},"affinity":{"enablePodAntiAffinity":true,"topologyKey":"kubernetes.io/hostname"},"annotations":{},"certificates":{},"enablePDB":true,"enableSuperuserAccess":false,"image":{"repository":"ghcr.io/cloudnative-pg/postgresql","tag":"17.7-standard-trixie"},"imagePullPolicy":"IfNotPresent","imagePullSecrets":[],"initdb":{},"instances":3,"logLevel":"info","monitoring":{"customQueries":[],"customQueriesSecret":[],"disableDefaultQueries":false,"enabled":false,"podMonitor":{"enabled":true,"metricRelabelings":[],"relabelings":[]},"prometheusRule":{"enabled":false,"excludeRules":["CNPGClusterLastFailedArchiveTimeWarning"]}},"postgresGID":-1,"postgresUID":-1,"postgresql":{"ldap":{},"parameters":{"hot_standby_feedback":"on","max_slot_wal_keep_size":"2000MB","shared_buffers":"128MB"},"pg_hba":[],"pg_ident":[],"shared_preload_libraries":[],"synchronous":{}},"primaryUpdateMethod":"switchover","primaryUpdateStrategy":"unsupervised","priorityClassName":"","resources":{"limits":{"hugepages-2Mi":"256Mi"},"requests":{"cpu":"100m","memory":"256Mi"}},"roles":[],"serviceAccountTemplate":{},"services":{},"storage":{"size":"10Gi","storageClass":""},"superuserSecret":"","walStorage":{"enabled":true,"size":"2Gi","storageClass":""}}` | Cluster settings |
 | cluster.affinity | object | `{"enablePodAntiAffinity":true,"topologyKey":"kubernetes.io/hostname"}` | Affinity/Anti-affinity rules for Pods. See: https://cloudnative-pg.io/documentation/current/cloudnative-pg.v1/#postgresql-cnpg-io-v1-AffinityConfiguration |
 | cluster.certificates | object | `{}` | The configuration for the CA and related certificates. See: https://cloudnative-pg.io/documentation/current/cloudnative-pg.v1/#postgresql-cnpg-io-v1-CertificatesConfiguration |
 | cluster.enablePDB | bool | `true` | Allow to disable PDB, mainly useful for upgrade of single-instance clusters or development purposes See: https://cloudnative-pg.io/documentation/current/kubernetes_upgrade/#pod-disruption-budgets |
 | cluster.enableSuperuserAccess | bool | `false` | When this option is enabled, the operator will use the SuperuserSecret to update the postgres user password. If the secret is not present, the operator will automatically create one. When this option is disabled, the operator will ignore the SuperuserSecret content, delete it when automatically created, and then blank the password of the postgres user by setting it to NULL. |
-| cluster.image | object | `{"repository":"ghcr.io/cloudnative-pg/postgresql","tag":"17.5-1-bullseye"}` | Default image |
+| cluster.image | object | `{"repository":"ghcr.io/cloudnative-pg/postgresql","tag":"17.7-standard-trixie"}` | Default image |
 | cluster.imagePullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never or IfNotPresent. If not defined, it defaults to IfNotPresent. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images |
 | cluster.imagePullSecrets | list | `[]` | The list of pull secrets to be used to pull the images. See: https://cloudnative-pg.io/documentation/current/cloudnative-pg.v1/#postgresql-cnpg-io-v1-LocalObjectReference |
 | cluster.initdb | object | `{}` | Bootstrap is the configuration of the bootstrap process when initdb is used. See: https://cloudnative-pg.io/documentation/current/bootstrap/ See: https://cloudnative-pg.io/documentation/current/cloudnative-pg.v1/#postgresql-cnpg-io-v1-bootstrapinitdb |
 | cluster.logLevel | string | `"info"` | The instances' log level, one of the following values: error, warning, info (default), debug, trace |
-| cluster.monitoring | object | `{"customQueries":[],"customQueriesSecret":[],"disableDefaultQueries":false,"enabled":false,"podMonitor":{"enabled":true,"metricRelabelings":[],"relabelings":[]},"prometheusRule":{"enabled":false,"excludeRules":[]}}` | Enable default monitoring and alert rules |
+| cluster.monitoring | object | `{"customQueries":[],"customQueriesSecret":[],"disableDefaultQueries":false,"enabled":false,"podMonitor":{"enabled":true,"metricRelabelings":[],"relabelings":[]},"prometheusRule":{"enabled":false,"excludeRules":["CNPGClusterLastFailedArchiveTimeWarning"]}}` | Enable default monitoring and alert rules |
 | cluster.monitoring.customQueries | list | `[]` | Custom Prometheus metrics Will be stored in the ConfigMap |
 | cluster.monitoring.customQueriesSecret | list | `[]` | The list of secrets containing the custom queries |
 | cluster.monitoring.disableDefaultQueries | bool | `false` | Whether the default queries should be injected. Set it to true if you don't want to inject default queries into the cluster. |
@@ -65,7 +42,7 @@ Cloudnative-pg Cluster
 | cluster.monitoring.podMonitor.metricRelabelings | list | `[]` | The list of metric relabelings for the PodMonitor. Applied to samples before ingestion. |
 | cluster.monitoring.podMonitor.relabelings | list | `[]` | The list of relabelings for the PodMonitor. Applied to samples before scraping. |
 | cluster.monitoring.prometheusRule.enabled | bool | `false` | Whether to enable the PrometheusRule automated alerts |
-| cluster.monitoring.prometheusRule.excludeRules | list | `[]` | Exclude specified rules |
+| cluster.monitoring.prometheusRule.excludeRules | list | `["CNPGClusterLastFailedArchiveTimeWarning"]` | Exclude specified rules |
 | cluster.postgresUID | int | `-1` | The UID and GID of the postgres user inside the image, defaults to 26 |
 | cluster.postgresql | object | `{"ldap":{},"parameters":{"hot_standby_feedback":"on","max_slot_wal_keep_size":"2000MB","shared_buffers":"128MB"},"pg_hba":[],"pg_ident":[],"shared_preload_libraries":[],"synchronous":{}}` | Parameters to be set for the database itself See: https://cloudnative-pg.io/documentation/current/cloudnative-pg.v1/#postgresql-cnpg-io-v1-PostgresConfiguration |
 | cluster.postgresql.ldap | object | `{}` | PostgreSQL LDAP configuration (see https://cloudnative-pg.io/documentation/current/postgresql_conf/#ldap-configuration) |
@@ -85,7 +62,7 @@ Cloudnative-pg Cluster
 | nameOverride | string | `""` | Override the name of the cluster |
 | namespaceOverride | string | `""` | Override the namespace of the chart |
 | poolers | list | `[]` | List of PgBouncer poolers |
-| recovery | object | `{"backup":{"backupName":"","database":"app","owner":"","pitrTarget":{"time":""}},"import":{"databases":[],"pgDumpExtraOptions":[],"pgRestoreExtraOptions":[],"postImportApplicationSQL":[],"roles":[],"schemaOnly":false,"source":{"database":"app","host":"","passwordSecret":{"create":false,"key":"password","name":"","value":""},"port":5432,"sslCertSecret":{"key":"","name":""},"sslKeySecret":{"key":"","name":""},"sslMode":"verify-full","sslRootCertSecret":{"key":"","name":""},"username":"app"},"type":"microservice"},"method":"backup","objectStore":{"clusterName":"","data":{"compression":"snappy","encryption":"","jobs":1},"database":"app","destinationPath":"","endpointCA":{"create":false,"key":"","name":""},"endpointCredentials":"","endpointURL":"","index":1,"name":"recovery","owner":"","pitrTarget":{"time":""},"wal":{"compression":"snappy","encryption":"","maxParallel":1}},"pgBaseBackup":{"database":"app","owner":"","secret":"","source":{"database":"app","host":"","passwordSecret":{"create":false,"key":"password","name":"","value":""},"port":5432,"sslCertSecret":{"key":"","name":""},"sslKeySecret":{"key":"","name":""},"sslMode":"verify-full","sslRootCertSecret":{"key":"","name":""},"username":""}}}` | Recovery settings when booting cluster from external cluster |
+| recovery | object | `{"backup":{"backupName":"","database":"app","owner":"","pitrTarget":{"time":""}},"import":{"databases":[],"pgDumpExtraOptions":[],"pgRestoreExtraOptions":[],"postImportApplicationSQL":[],"roles":[],"schemaOnly":false,"source":{"database":"app","host":"","passwordSecret":{"create":false,"key":"password","name":"","value":""},"port":5432,"sslCertSecret":{"key":"","name":""},"sslKeySecret":{"key":"","name":""},"sslMode":"verify-full","sslRootCertSecret":{"key":"","name":""},"username":"app"},"type":"microservice"},"method":"backup","objectStore":{"clusterName":"","data":{"compression":"snappy","encryption":"","jobs":1},"database":"app","destinationPath":"","endpointCA":{"create":false,"key":"","name":""},"endpointCredentials":"","endpointURL":"https://nyc3.digitaloceanspaces.com","index":1,"name":"recovery","owner":"","pitrTarget":{"time":""},"wal":{"compression":"snappy","encryption":"","maxParallel":1}},"pgBaseBackup":{"database":"app","owner":"","secret":"","source":{"database":"app","host":"","passwordSecret":{"create":false,"key":"password","name":"","value":""},"port":5432,"sslCertSecret":{"key":"","name":""},"sslKeySecret":{"key":"","name":""},"sslMode":"verify-full","sslRootCertSecret":{"key":"","name":""},"username":""}}}` | Recovery settings when booting cluster from external cluster |
 | recovery.backup.backupName | string | `""` | Name of the backup to recover from. |
 | recovery.backup.database | string | `"app"` | Name of the database used by the application. Default: `app`. |
 | recovery.backup.owner | string | `""` | Name of the owner of the database in the instance to be used by applications. Defaults to the value of the `database` key. |
@@ -113,7 +90,7 @@ Cloudnative-pg Cluster
 | recovery.objectStore.endpointCA | object | `{"create":false,"key":"","name":""}` | Specifies a CA bundle to validate a privately signed certificate. |
 | recovery.objectStore.endpointCA.create | bool | `false` | Creates a secret with the given value if true, otherwise uses an existing secret. |
 | recovery.objectStore.endpointCredentials | string | `""` | Specifies secret that contains S3 credentials, should contain the keys ACCESS_KEY_ID and ACCESS_SECRET_KEY |
-| recovery.objectStore.endpointURL | string | `""` | Overrides the provider specific default endpoint. Defaults to: S3: https://s3.<region>.amazonaws.com" Leave empty if using the default S3 endpoint |
+| recovery.objectStore.endpointURL | string | `"https://nyc3.digitaloceanspaces.com"` | Overrides the provider specific default endpoint. Defaults to: S3: https://s3.<region>.amazonaws.com" Leave empty if using the default S3 endpoint |
 | recovery.objectStore.index | int | `1` | Generate external cluster name, uses: {{ .Release.Name }}-postgresql-<major version>-backup-index-{{ index }} |
 | recovery.objectStore.name | string | `"recovery"` | Object store backup name |
 | recovery.objectStore.owner | string | `""` | Name of the owner of the database in the instance to be used by applications. Defaults to the value of the `database` key. |
@@ -131,7 +108,7 @@ Cloudnative-pg Cluster
 | recovery.pgBaseBackup.source.passwordSecret.key | string | `"password"` | The key in the secret containing the password |
 | recovery.pgBaseBackup.source.passwordSecret.name | string | `""` | Name of the secret containing the password |
 | recovery.pgBaseBackup.source.passwordSecret.value | string | `""` | The password value to use when creating the secret |
-| type | string | `"postgresql"` | Type of the CNPG database. Available types: * `postgresql` * `tensorchord` |
+| type | string | `"postgresql"` | Type of the CNPG database. Available types: * `postgresql` |

 ----------------------------------------------
 Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)
--- a/charts/postgres-cluster/prometheus_rules/cluster-last_failed_archive_time-warning.yaml
+++ b/charts/postgres-cluster/prometheus_rules/cluster-last_failed_archive_time-warning.yaml
@@ -6,7 +6,7 @@ annotations:
  description: |-
    Archiving failed for {{`{{`}} $labels.pod {{`}}`}}
 expr: |
-  (cnpg_pg_stat_archiver_last_failed_time - cnpg_pg_stat_archiver_last_archived_time) > 1
+  (cnpg_pg_stat_archiver_last_failed_time - cnpg_pg_stat_archiver_last_archived_time) > 2
 for: 1m
 labels:
  severity: warning
--- a/charts/postgres-cluster/templates/_bootstrap.tpl
+++ b/charts/postgres-cluster/templates/_bootstrap.tpl
@@ -11,21 +11,8 @@ bootstrap:
    {{- if .Values.cluster.initdb.owner }}
    owner: {{ tpl .Values.cluster.initdb.owner . }}
    {{- end }}
-    {{- if eq .Values.type "tensorchord" }}
-    dataChecksums: true
-    {{- end }}
-    {{- if or (eq .Values.type "tensorchord") (.Values.cluster.initdb.postInitApplicationSQL) }}
+    {{- if (.Values.cluster.initdb.postInitApplicationSQL) }}
    postInitApplicationSQL:
-      {{- if eq .Values.type "tensorchord" }}
-      - ALTER SYSTEM SET search_path TO "$user", public, vectors;
-      - SET search_path TO "$user", public, vectors;
-      - CREATE EXTENSION IF NOT EXISTS "vectors";
-      - CREATE EXTENSION IF NOT EXISTS "cube";
-      - CREATE EXTENSION IF NOT EXISTS "earthdistance";
-      - ALTER SCHEMA vectors OWNER TO "app";
-      - GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA vectors TO "app";
-      - GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "app";
-      {{- end }}
      {{- with .Values.cluster.initdb }}
        {{- range .postInitApplicationSQL }}
          {{- printf "- %s" . | nindent 6 }}
@@ -131,6 +118,8 @@ externalClusters:
  - name: {{ include "cluster.recoveryServerName" . }}
    plugin:
      name: barman-cloud.cloudnative-pg.io
+      enabled: true
+      isWALArchiver: false
      parameters:
        barmanObjectName: "{{ include "cluster.name" . }}-{{ .Values.recovery.objectStore.name }}"
        serverName: {{ include "cluster.recoveryServerName" . }}
--- a/charts/postgres-cluster/templates/_helpers.tpl
+++ b/charts/postgres-cluster/templates/_helpers.tpl
@@ -80,17 +80,6 @@ Generate recovery server name
  {{- if .Values.recovery.recoveryServerName -}}
    {{- .Values.recovery.recoveryServerName -}}
  {{- else -}}
-    {{- printf "%s-backup-%s" (include "cluster.name" .) (toString .Values.recovery.recoveryIndex) | trunc 63 | trimSuffix "-" -}}
-  {{- end }}
-{{- end }}
-
-{{/*
-Generate name for recovery object store credentials
-*/}}
-{{- define "cluster.recoveryCredentials" -}}
-  {{- if .Values.recovery.endpointCredentials -}}
-    {{- .Values.recovery.endpointCredentials -}}
-  {{- else -}}
-    {{- printf "%s-backup-secret" (include "cluster.name" .) | trunc 63 | trimSuffix "-" -}}
+    {{- printf "%s-backup-%s" (include "cluster.name" .) (toString .Values.recovery.objectStore.index) | trunc 63 | trimSuffix "-" -}}
  {{- end }}
 {{- end }}
--- a/charts/postgres-cluster/templates/cluster.yaml
+++ b/charts/postgres-cluster/templates/cluster.yaml
@@ -19,22 +19,31 @@ spec:
  {{- end }}
  postgresUID: {{ include "cluster.postgresUID" . }}
  postgresGID: {{ include "cluster.postgresGID" . }}
-  {{ if or (and (.Values.backup.enabled) (eq .Values.backup.method "objectStore")) (eq .Values.recovery.method "objectStore") }}
  plugins:
-  {{ end }}
-  {{ if and (.Values.backup.enabled) (eq .Values.backup.method "objectStore") }}
-  {{ $context := . -}}
-  {{ range .Values.backup.objectStore -}}
+  {{- range $objectStore := .Values.backup.objectStore }}
    - name: barman-cloud.cloudnative-pg.io
-      isWALArchiver: {{ .isWALArchiver }}
+      enabled: true
+      {{- if $objectStore.isWALArchiver }}
+      isWALArchiver: true
+      {{- else }}
+      isWALArchiver: false
+      {{- end }}
      parameters:
-        barmanObjectName: "{{ include "cluster.name" $context }}-{{ .name }}-backup"
-  {{ end -}}
-  {{ end }}
-  {{ if eq .Values.recovery.method "objectStore" }}
-    - name: barman-cloud.cloudnative-pg.io
-      parameters:
-        barmanObjectName: "{{ include "cluster.name" . }}-{{ .Values.recovery.objectStore.name }}"
+        barmanObjectName: "{{ include "cluster.name" $ }}-{{ $objectStore.name }}-backup"
+        {{- if $objectStore.clusterName }}
+        serverName: "{{ $objectStore.clusterName }}-backup-{{ $objectStore.index }}"
+        {{- else }}
+        serverName: "{{ include "cluster.name" $ }}-backup-{{ $objectStore.index }}"
+        {{- end }}
+  {{- end }}
+  {{ if (eq .Values.recovery.method "objectStore") }}
+  externalClusters:
+    - name: recovery
+      plugin:
+        name: barman-cloud.cloudnative-pg.io
+        parameters:
+          barmanObjectName: "{{ include "cluster.name" . }}-{{ .Values.recovery.objectStore.name }}"
+          serverName: {{ include "cluster.recoveryServerName" . }}
  {{ end }}
  storage:
    size: {{ .Values.cluster.storage.size }}
@@ -75,11 +84,8 @@ spec:
  enablePDB: {{ .Values.cluster.enablePDB }}

  postgresql:
-    {{- if or (eq .Values.type "tensorchord") (not (empty .Values.cluster.postgresql.shared_preload_libraries)) }}
+    {{- if .Values.cluster.postgresql.shared_preload_libraries }}
    shared_preload_libraries:
-      {{- if eq .Values.type "tensorchord" }}
-      - vectors.so
-      {{- end }}
      {{- with .Values.cluster.postgresql.shared_preload_libraries }}
      {{- toYaml . | nindent 6 }}
      {{- end }}
--- a/charts/postgres-cluster/templates/object-store.yaml
+++ b/charts/postgres-cluster/templates/object-store.yaml
@@ -1,4 +1,4 @@
-{{ if and (.Values.backup.enabled) (eq .Values.backup.method "objectStore") }}
+{{ if (eq .Values.backup.method "objectStore") }}
 {{ $context := . -}}
 {{ range .Values.backup.objectStore -}}
 ---
@@ -10,47 +10,43 @@ metadata:
  labels:
    {{- include "cluster.labels" $context | nindent 4 }}
 spec:
-  retentionPolicy: {{ .retentionPolicy }}
+  retentionPolicy: {{ .retentionPolicy | default "30d" }}
  configuration:
-    destinationPath: {{ .destinationPath }}
-    endpointURL: {{ .endpointURL }}
-    {{ if .endpointCA.name }}
+    destinationPath: {{ .destinationPath | required "Destination path is required" }}
+    endpointURL: {{ .endpointURL | default "https://nyc3.digitaloceanspaces.com" }}
+    {{- if .endpointCA }}
    endpointCA:
      name: {{ .endpointCA.name }}
      key: {{ .endpointCA.key }}
-    {{ end }}
-    {{- if .clusterName }}
-    serverName: "{{ .clusterName }}-backup-{{ .index }}"
-    {{- else }}
-    serverName: "{{ include "cluster.name" $context }}-backup-{{ .index }}"
    {{- end }}
+    {{- if .wal }}
    wal:
-      compression: {{ .wal.compression }}
-      {{- with .wal.encryption}}
+      compression: {{ .wal.compression | default "snappy" }}
+      {{ with .wal.encryption }}
      encryption: {{ . }}
-      {{- end }}
-      maxParallel: {{ .wal.maxParallel }}
+      {{ end }}
+      maxParallel: {{ .wal.maxParallel | default "1" }}
+    {{- end }}
+    {{- if .data }}
    data:
-      compression: {{ .data.compression }}
+      compression: {{ .data.compression | default "snappy"  }}
      {{- with .data.encryption }}
      encryption: {{ . }}
      {{- end }}
-      jobs: {{ .data.jobs }}
+      jobs: {{ .data.jobs | default 1 }}
+    {{- end }}
    s3Credentials:
      accessKeyId:
-        {{- if not (empty .endpointCredentials) }}
-        name: {{ .endpointCredentials }}
-        {{- else }}
-        name: {{- printf "%s-backup-secret" (include "cluster.name" $context) | trunc 63 | trimSuffix "-" -}}
-        {{- end }}
+        name: {{ .endpointCredentials | default (printf "%s-cluster-backup-secret" (include "cluster.name" $context) | trunc 63 | trimSuffix "-") }}
        key: ACCESS_KEY_ID
      secretAccessKey:
-        {{- if .endpointCredentials }}
-        name: {{ .endpointCredentials }}
-        {{- else }}
-        name: {{- printf "%s-backup-secret" (include "cluster.name" $context) | trunc 63 | trimSuffix "-" -}}
-        {{- end }}
+        name: {{ .endpointCredentials | default (printf "%s-cluster-backup-secret" (include "cluster.name" $context) | trunc 63 | trimSuffix "-") }}
        key: ACCESS_SECRET_KEY
+    {{- if .endpointCredentialsIncludeRegion }}
+      region:
+        name: {{ .endpointCredentials | default (printf "%s-cluster-backup-secret" (include "cluster.name" $context) | trunc 63 | trimSuffix "-") }}
+        key: ACCESS_REGION
+    {{- end }}
 {{ end -}}
 {{ end }}

@@ -72,7 +68,6 @@ spec:
      name: {{ .Values.recovery.objectStore.endpointCA.name }}
      key: {{ .Values.recovery.objectStore.endpointCA.key }}
    {{- end }}
-    serverName: {{ include "cluster.recoveryServerName" . }}
    wal:
      compression: {{ .Values.recovery.objectStore.wal.compression }}
      {{- with .Values.recovery.objectStore.wal.encryption}}
@@ -87,9 +82,9 @@ spec:
      jobs: {{ .Values.recovery.objectStore.data.jobs }}
    s3Credentials:
      accessKeyId:
-        name: {{ include "cluster.recoveryCredentials" . }}
+        name: {{ .Values.recovery.objectStore.endpointCredentials | default (printf "%s-cluster-backup-secret" (include "cluster.name" .) | trunc 63 | trimSuffix "-") }}
        key: ACCESS_KEY_ID
      secretAccessKey:
-        name: {{ include "cluster.recoveryCredentials" . }}
+        name: {{ .Values.recovery.objectStore.endpointCredentials | default (printf "%s-cluster-backup-secret" (include "cluster.name" .) | trunc 63 | trimSuffix "-") }}
        key: ACCESS_SECRET_KEY
 {{ end }}
--- a/charts/postgres-cluster/templates/scheduled-backup.yaml
+++ b/charts/postgres-cluster/templates/scheduled-backup.yaml
@@ -1,4 +1,3 @@
-{{ if .Values.backup.enabled }}
 {{ $context := . -}}
 {{ range .Values.backup.scheduledBackups -}}
 ---
@@ -10,16 +9,15 @@ metadata:
  labels:
    {{- include "cluster.labels" $context | nindent 4 }}
 spec:
-  immediate: true
-  suspend: {{ .suspend }}
-  schedule: {{ .schedule | quote }}
-  backupOwnerReference: {{ .backupOwnerReference }}
+  immediate: {{ .immediate | default false }}
+  suspend: {{ .suspend | default false }}
+  schedule: {{ .schedule | quote | required "Schedule is required" }}
+  backupOwnerReference: {{ .backupOwnerReference | default "self" }}
  cluster:
    name: {{ include "cluster.name" $context }}-cluster
  method: plugin
  pluginConfiguration:
-    name: {{ .plugin }}
+    name: {{ .plugin | default "barman-cloud.cloudnative-pg.io" }}
    parameters:
      barmanObjectName: "{{ include "cluster.name" $context }}-{{ .backupName }}-backup"
 {{ end -}}
-{{ end }}
--- a/charts/postgres-cluster/values.yaml
+++ b/charts/postgres-cluster/values.yaml
@@ -6,7 +6,6 @@ namespaceOverride: ""

 # -- Type of the CNPG database. Available types:
 # * `postgresql`
-# * `tensorchord`
 type: postgresql

 # -- Cluster mode of operation. Available modes:
@@ -21,7 +20,7 @@ cluster:
  # -- Default image
  image:
    repository: ghcr.io/cloudnative-pg/postgresql
-    tag: "17.5-1-bullseye"
+    tag: 17.7-standard-trixie

  # -- Image pull policy. One of Always, Never or IfNotPresent. If not defined, it defaults to IfNotPresent. Cannot be updated.
  # More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
@@ -131,7 +130,8 @@ cluster:
      enabled: false

      # -- Exclude specified rules
-      excludeRules: []
+      excludeRules:
+        - CNPGClusterLastFailedArchiveTimeWarning

    # -- Whether the default queries should be injected.
    # Set it to true if you don't want to inject default queries into the cluster.
@@ -271,7 +271,7 @@ recovery:
    # -- Overrides the provider specific default endpoint. Defaults to:
    # S3: https://s3.<region>.amazonaws.com"
    # Leave empty if using the default S3 endpoint
-    endpointURL: ""
+    endpointURL: "https://nyc3.digitaloceanspaces.com"

    # -- Specifies a CA bundle to validate a privately signed certificate.
    endpointCA:
@@ -417,92 +417,95 @@ recovery:
 # -- Backup settings
 backup:

-  # -- You need to configure backups manually, so backups are disabled by default.
-  enabled: true
-
  # -- Method to create backups, options currently are only objectStore
  method: objectStore

  # -- Options for object store backups
-  objectStore:
-    -
-      # -- Object store backup name
-      name: external
+  objectStore: []

-      # -- Overrides the provider specific default path. Defaults to:
-      # S3: s3://<bucket><path>
-      # Azure: https://<storageAccount>.<serviceName>.core.windows.net/<containerName><path>
-      # Google: gs://<bucket><path>
-      destinationPath: s3://postgres-backups
+    # -
+    #   # -- Object store backup name
+    #   name: external

-      # -- Overrides the provider specific default endpoint. Defaults to:
-      # S3: https://s3.<region>.amazonaws.com"
-      endpointURL: https://nyc3.digitaloceanspaces.com
+    #   # -- Overrides the provider specific default path. Defaults to:
+    #   # S3: s3://<bucket><path>
+    #   # Azure: https://<storageAccount>.<serviceName>.core.windows.net/<containerName><path>
+    #   # Google: gs://<bucket><path>
+    #   destinationPath: ""

-      # -- Specifies a CA bundle to validate a privately signed certificate.
-      endpointCA:
-        # -- Creates a secret with the given value if true, otherwise uses an existing secret.
-        create: false
+    #   # -- Overrides the provider specific default endpoint. Defaults to:
+    #   # https://nyc3.digitaloceanspaces.com
+    #   endpointURL: ""

-        name: ""
-        key: ""
+    #   # -- Specifies a CA bundle to validate a privately signed certificate.
+    #   endpointCA:
+    #     # -- Creates a secret with the given value if true, otherwise uses an existing secret.
+    #     create: false

-      # -- Generate external cluster name, uses: {{ .Release.Name }}-postgresql-<major version>-backup-index-{{ index }}
-      index: 1
+    #     name: ""
+    #     key: ""

-      # -- Override the name of the backup cluster, defaults to "cluster.name"
-      clusterName: ""
+    #   # -- Generate external cluster name, uses: {{ .Release.Name }}-postgresql-<major version>-backup-index-{{ index }}
+    #   index: 1

-      # -- Specifies secret that contains S3 credentials, should contain the keys ACCESS_KEY_ID and ACCESS_SECRET_KEY
-      endpointCredentials: ""
+    #   # -- Override the name of the backup cluster, defaults to "cluster.name"
+    #   clusterName: ""

-      # -- Retention policy for backups
-      retentionPolicy: "30d"
+    #   # -- Specifies secret that contains S3 credentials, should contain the keys ACCESS_KEY_ID and ACCESS_SECRET_KEY
+    #   endpointCredentials: ""

-      # -- Specificies if this backup will do WALs
-      isWALArchiver: true
+    #   # -- Retention policy for backups
+    #   retentionPolicy: "30d"

-      # -- Storage
-      wal:
+    #   # -- Specificies if this backup will do WALs
+    #   isWALArchiver: true

-        # -- WAL compression method. One of `` (for no compression), `gzip`, `bzip2` or `snappy`.
-        compression: snappy
+    #   # -- Storage
+    #   wal:

-        # -- Whether to instruct the storage provider to encrypt WAL files. One of `` (use the storage container default), `AES256` or `aws:kms`.
-        encryption: ""
+    #     # -- WAL compression method. One of `` (for no compression), `gzip`, `bzip2` or `snappy`.
+    #     compression: snappy

-        # -- Number of WAL files to be archived or restored in parallel.
-        maxParallel: 1
+    #     # -- Whether to instruct the storage provider to encrypt WAL files. One of `` (use the storage container default), `AES256` or `aws:kms`.
+    #     encryption: ""

-      data:
-        # -- Data compression method. One of `` (for no compression), `gzip`, `bzip2` or `snappy`.
-        compression: snappy
+    #     # -- Number of WAL files to be archived or restored in parallel.
+    #     maxParallel: 1

-        # -- Whether to instruct the storage provider to encrypt data files. One of `` (use the storage container default), `AES256` or `aws:kms`.
-        encryption: ""
+    #   data:
+    #     # -- Data compression method. One of `` (for no compression), `gzip`, `bzip2` or `snappy`.
+    #     compression: snappy

-        # -- Number of data files to be archived or restored in parallel.
-        jobs: 1
+    #     # -- Whether to instruct the storage provider to encrypt data files. One of `` (use the storage container default), `AES256` or `aws:kms`.
+    #     encryption: ""

-  scheduledBackups:
-    -
-      # -- Scheduled backup name
-      name: daily-backup
+    #     # -- Number of data files to be archived or restored in parallel.
+    #     jobs: 1

-      # -- Schedule in cron format
-      schedule: "0 0 */3 * *"
+  # -- List of scheduled backups
+  scheduledBackups: []

-      # -- Temporarily stop scheduled backups from running
-      suspend: false
+    # -
+    #   # -- Scheduled backup name
+    #   name: daily-backup

-      # -- Backup owner reference
-      backupOwnerReference: self
+    #   # -- Schedule in cron format
+    #   schedule: "0 0 0 * * *"

-      # -- Backup method, can be `barman-cloud.cloudnative-pg.io` (default)
-      plugin: barman-cloud.cloudnative-pg.io
+    #   # -- Start backup on deployment
+    #   immediate: false

-      # -- Name of backup target
-      backupName: external
+    #   # -- Temporarily stop scheduled backups from running
+    #   suspend: false
+
+    #   # -- Backup owner reference
+    #   backupOwnerReference: self
+
+    #   # -- Backup method, can be `barman-cloud.cloudnative-pg.io` (default)
+    #   plugin: barman-cloud.cloudnative-pg.io
+
+    #   # -- Name of backup target
+    #   backupName: external

 # -- List of PgBouncer poolers
 poolers: []
--- a/renovate.json
+++ b/renovate.json
@@ -1,49 +1,56 @@
 {
-    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-    "extends": [
-        "config:recommended",
-        "mergeConfidence:all-badges",
-        ":rebaseStalePrs"
-    ],
-    "timezone": "US/Central",
-    "schedule": [ "* */1 * * *" ],
-    "labels": [],
-    "prHourlyLimit": 0,
-    "prConcurrentLimit": 0,
-    "packageRules": [
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    "mergeConfidence:all-badges",
+    ":rebaseStalePrs"
+  ],
+  "timezone": "US/Central",
+  "labels": [],
+  "prHourlyLimit": 0,
+  "prConcurrentLimit": 0,
+  "packageRules": [
+    {
+      "description": "Label charts",
+      "matchDatasources": ["helm"],
+      "addLabels": ["chart"],
+      "automerge": false,
+      "bumpVersions": [
        {
-            "description": "Label charts",
-            "matchDatasources": [
-                "helm"
-            ],
-            "addLabels": [
-                "chart"
-            ],
-            "automerge": false
-        },
-        {
-            "description": "Label images",
-            "matchDatasources": [
-                "docker"
-            ],
-            "addLabels": [
-                "image"
-            ],
-            "automerge": false
-        },
-        {
-            "description": "CNPG image",
-            "matchDepNames": [
-                "ghcr.io/cloudnative-pg/postgresql"
-            ],
-            "matchDatasources": [
-                "docker"
-            ],
-            "addLabels": [
-                "image"
-            ],
-            "automerge": false,
-            "versioning": "deb"
+          "filePatterns": ["{{packageFileDir}}/Chart.{yaml,yml}"],
+          "matchStrings": ["version:\\s(?<version>[^\\s]+)"],
+          "bumpType": "{{#if isPatch}}patch{{else}}minor{{/if}}"
        }
-    ]
+      ]
+    },
+    {
+      "description": "Label images",
+      "matchDatasources": ["docker"],
+      "addLabels": ["image"],
+      "automerge": false,
+      "bumpVersions": [
+        {
+          "filePatterns": ["{{packageFileDir}}/Chart.{yaml,yml}"],
+          "matchStrings": ["version:\\s(?<version>[^\\s]+)"],
+          "bumpType": "{{#if isPatch}}patch{{else}}minor{{/if}}"
+        }
+      ]
+    },
+    {
+      "description": "Automerge generic-device-plugin image on digest",
+      "matchDatasources": ["docker"],
+      "matchDepNames": ["ghcr.io/squat/generic-device-plugin"],
+      "matchUpdateTypes": ["digest"],
+      "addLabels": ["image", "automerge"],
+      "automerge": true,
+      "minimumReleaseAge": "1 days",
+      "bumpVersions": [
+        {
+          "filePatterns": ["{{packageFileDir}}/Chart.{yaml,yml}"],
+          "matchStrings": ["version:\\s(?<version>[^\\s]+)"],
+          "bumpType": "patch"
+        }
+      ]
+    }
+  ]
 }