chore(config): migrate config renovate.json

ci: add manager
feat: refactor apps (#5227 )
2026-03-28 02:57:32 +00:00 · 2026-03-27 21:55:27 -05:00 · 2026-03-28 02:36:08 +00:00 · 2026-03-28 01:55:23 +00:00 · 2026-03-28 01:51:51 +00:00 · 2026-03-28 01:49:58 +00:00
32 changed files with 176 additions and 284 deletions
--- a/clusters/cl01tl/helm/argocd/Chart.lock
+++ b/clusters/cl01tl/helm/argocd/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
  repository: https://argoproj.github.io/argo-helm
-  version: 9.4.16
-digest: sha256:f9ecc47369d4401df61c17f55cc59c9b2d4543f57cf122653abb1a27a4f7bf35
-generated: "2026-03-26T21:01:52.678525211Z"
+  version: 9.4.17
+digest: sha256:17752dbf03861cf70ee31c9a17373a5175656a2edd00ba5fcd3988a195147da8
+generated: "2026-03-28T01:51:34.832601868Z"
--- a/clusters/cl01tl/helm/argocd/Chart.yaml
+++ b/clusters/cl01tl/helm/argocd/Chart.yaml
@@ -13,8 +13,8 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: argo-cd
-    version: 9.4.16
+    version: 9.4.17
    repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-cd
-appVersion: v3.3.5
+appVersion: v3.3.6
--- a/clusters/cl01tl/helm/cert-manager/Chart.lock
+++ b/clusters/cl01tl/helm/cert-manager/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: cert-manager
  repository: https://charts.jetstack.io
-  version: v1.20.0
-digest: sha256:1543bd17649cb32982de3cce017fcbed1b44c41d50b76c6471b266f33e261c29
-generated: "2026-03-10T16:06:49.332999536Z"
+  version: v1.20.1
+digest: sha256:1bf36eba44cf096b40355a697b8cffb302f07f9135374222aabdf686f017b7a9
+generated: "2026-03-28T01:35:24.542754563Z"
--- a/clusters/cl01tl/helm/cert-manager/Chart.yaml
+++ b/clusters/cl01tl/helm/cert-manager/Chart.yaml
@@ -13,8 +13,8 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: cert-manager
-    version: v1.20.0
+    version: v1.20.1
    repository: https://charts.jetstack.io
 icon: https://raw.githubusercontent.com/cert-manager/cert-manager/refs/heads/master/logo/logo.png
 # renovate: datasource=github-releases depName=cert-manager/cert-manager
-appVersion: v1.20.0
+appVersion: v1.20.1
--- a/clusters/cl01tl/helm/grafana-operator/Chart.yaml
+++ b/clusters/cl01tl/helm/grafana-operator/Chart.yaml
@@ -5,14 +5,13 @@ description: Grafana Operator
 keywords:
  - grafana-operator
  - dashboard
-  - metrics
-  - logs
-home: https://wiki.alexlebens.dev/s/3e5723e1-2ab7-45ab-b496-b8854907fa39
+home: https://docs.alexlebens.dev/applications/grafana-operator/
 sources:
  - https://github.com/grafana/grafana-operator
-  - https://github.com/cloudnative-pg/cloudnative-pg
+  - https://github.com/grafana/grafana/pkgs/container/grafana%2Fgrafana
  - https://github.com/grafana/grafana-operator/tree/master/deploy/helm/grafana-operator
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
 maintainers:
  - name: alexlebens
 dependencies:
--- a/clusters/cl01tl/helm/grafana-operator/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/grafana-operator/templates/external-secret.yaml
@@ -14,17 +14,11 @@ spec:
  data:
    - secretKey: admin-user
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/grafana/auth
-        metadataPolicy: None
        property: admin-user
    - secretKey: admin-password
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/grafana/auth
-        metadataPolicy: None
        property: admin-password

 ---
@@ -44,17 +38,11 @@ spec:
  data:
    - secretKey: AUTH_CLIENT_ID
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /authentik/oidc/grafana
-        metadataPolicy: None
        property: client
    - secretKey: AUTH_CLIENT_SECRET
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /authentik/oidc/grafana
-        metadataPolicy: None
        property: secret

 ---
@@ -74,17 +62,11 @@ spec:
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
        property: access
    - secretKey: ACCESS_SECRET_KEY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
        property: secret

 ---
@@ -104,22 +86,13 @@ spec:
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: ACCESS_SECRET_KEY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
        property: ACCESS_SECRET_KEY
    - secretKey: ACCESS_REGION
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
        property: ACCESS_REGION
--- a/clusters/cl01tl/helm/grafana-operator/templates/grafana-dashboard.yaml
+++ b/clusters/cl01tl/helm/grafana-operator/templates/grafana-dashboard.yaml
@@ -11,9 +11,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/ceph.json

 ---
@@ -30,9 +30,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/coredns.json

 ---
@@ -49,9 +49,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/etcd.json

 ---
@@ -68,9 +68,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/garage.json

 ---
@@ -87,9 +87,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/loki.json

 ---
@@ -106,9 +106,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/node-full.json

 ---
@@ -125,9 +125,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/node-short.json

 ---
@@ -144,9 +144,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/pods.json

 ---
@@ -163,9 +163,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/argocd.json

 ---
@@ -182,9 +182,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/blocky.json

 ---
@@ -201,9 +201,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/cert-manager.json

 ---
@@ -220,9 +220,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/cloudnative-pg.json

 ---
@@ -239,9 +239,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/descheduler.json

 ---
@@ -258,9 +258,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/gatus.json

 ---
@@ -277,9 +277,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/grafana-operator.json

 ---
@@ -296,9 +296,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/harbor.json

 ---
@@ -315,9 +315,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/speedtest-exporter.json

 ---
@@ -334,9 +334,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/spegel.json

 ---
@@ -353,9 +353,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/traefik.json

 ---
@@ -372,9 +372,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/tdarr.json

 ---
@@ -391,9 +391,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/unpoller.json

 ---
@@ -410,9 +410,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/volsync.json

 ---
@@ -429,9 +429,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/s3.json

 ---
@@ -448,9 +448,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/authentik.json

 ---
@@ -467,9 +467,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/gitea.json

 ---
@@ -486,9 +486,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/ntfy.json

 ---
@@ -505,9 +505,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/qbittorrent.json

 ---
@@ -524,9 +524,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/vault.json

 ---
@@ -543,9 +543,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-iot
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/iot/airgradient.json

 ---
@@ -562,9 +562,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-iot
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/iot/server-power-consumption.json

 ---
@@ -581,9 +581,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-application
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/immich.json

 ---
@@ -600,9 +600,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-application
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/jellyfin.json

 ---
@@ -619,9 +619,9 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-application
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/radarr.json

 ---
@@ -638,7 +638,7 @@ spec:
  instanceSelector:
    matchLabels:
      app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
  folderUID: grafana-folder-application
-  resyncPeriod: 1h
+  resyncPeriod: 6h
  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/sonarr.json
--- a/clusters/cl01tl/helm/grafana-operator/templates/grafana.yaml
+++ b/clusters/cl01tl/helm/grafana-operator/templates/grafana.yaml
@@ -56,11 +56,12 @@ spec:
        spec:
          containers:
            - name: grafana
-              image: grafana/grafana:12.0.0
+              # renovate: datasource=docker depName=grafana/grafana
+              image: grafana/grafana:12.4.2@sha256:83749231c3835e390a3144e5e940203e42b9589761f20ef3169c716e734ad505
              resources:
                requests:
-                  cpu: 100m
-                  memory: 128Mi
+                  cpu: 20m
+                  memory: 120Mi
              env:
                - name: AUTH_CLIENT_ID
                  valueFrom:
@@ -107,3 +108,12 @@ spec:
                    secretKeyRef:
                      name: grafana-operator-postgresql-18-cluster-app
                      key: password
+  httpRoute:
+    spec:
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - grafana.alexlebens.net
--- a/clusters/cl01tl/helm/grafana-operator/templates/http-route.yaml
+++ b/clusters/cl01tl/helm/grafana-operator/templates/http-route.yaml
@@ -1,28 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: grafana
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: grafana
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-  hostnames:
-    - grafana.alexlebens.net
-  rules:
-    - matches:
-      - path:
-          type: PathPrefix
-          value: /
-      backendRefs:
-        - group: ''
-          kind: Service
-          name: grafana-main-service
-          port: 3000
-          weight: 100
--- a/clusters/cl01tl/helm/grafana-operator/values.yaml
+++ b/clusters/cl01tl/helm/grafana-operator/values.yaml
@@ -1,17 +1,11 @@
 grafana-operator:
  replicas: 2
-  serviceAccount:
-    create: true
-  rbac:
-    create: true
  resources:
    requests:
-      cpu: 10m
-      memory: 64Mi
+      cpu: 1m
+      memory: 50Mi
  serviceMonitor:
    enabled: true
-  dashboard:
-    enabled: false
 postgres-18-cluster:
  mode: recovery
  recovery:
@@ -25,35 +19,12 @@ postgres-18-cluster:
        destinationBucket: postgres-backups
        externalSecretCredentialPath: /garage/home-infra/postgres-backups
        isWALArchiver: true
-      # - name: garage-remote
-      #   index: 1
-      #   destinationBucket: postgres-backups
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   retentionPolicy: "90d"
-      #   data:
-      #     compression: bzip2
-      # - name: external
-      #   index: 1
-      #   endpointURL: https://nyc3.digitaloceanspaces.com
-      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   isWALArchiver: false
    scheduledBackups:
      - name: live-backup
        suspend: false
        immediate: true
        schedule: "0 30 14 * * *"
        backupName: garage-local
-      # - name: weekly-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 4 * * SAT"
-      #   backupName: garage-remote
-      # - name: daily-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 0 * * *"
-      #   backupName: external
 valkey-unified-alerting:
  valkey:
    nameOverride: valkey-unified-alerting
--- a/clusters/cl01tl/helm/homepage/Chart.yaml
+++ b/clusters/cl01tl/helm/homepage/Chart.yaml
@@ -19,4 +19,4 @@ dependencies:
    version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/homepage.png
 # renovate: datasource=github-releases depName=gethomepage/homepage
-appVersion: v1.11.0
+appVersion: v1.12.0
--- a/clusters/cl01tl/helm/homepage/values.yaml
+++ b/clusters/cl01tl/helm/homepage/values.yaml
@@ -16,7 +16,7 @@ homepage:
        main:
          image:
            repository: ghcr.io/gethomepage/homepage
-            tag: v1.11.0
+            tag: v1.12.0
            pullPolicy: IfNotPresent
          env:
            - name: HOMEPAGE_ALLOWED_HOSTS
--- a/clusters/cl01tl/helm/houndarr/values.yaml
+++ b/clusters/cl01tl/helm/houndarr/values.yaml
@@ -9,7 +9,7 @@ houndarr:
        main:
          image:
            repository: ghcr.io/av1155/houndarr
-            tag: v1.6.2
+            tag: v1.6.3
            pullPolicy: IfNotPresent
          env:
            - name: TZ
--- a/clusters/cl01tl/helm/immich/values.yaml
+++ b/clusters/cl01tl/helm/immich/values.yaml
@@ -9,7 +9,7 @@ immich:
        main:
          image:
            repository: ghcr.io/immich-app/immich-server
-            tag: v2.6.2
+            tag: v2.6.3
            pullPolicy: IfNotPresent
          env:
            - name: TZ
--- a/clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock
@@ -1,12 +1,12 @@
 dependencies:
 - name: kube-prometheus-stack
  repository: oci://ghcr.io/prometheus-community/charts
-  version: 82.15.0
+  version: 82.15.1
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.6.2
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.4.0
-digest: sha256:524759b57f9500d5742b962bcdb114ec556d80ec4418921c93a722e00df57647
-generated: "2026-03-26T23:02:03.558664114Z"
+digest: sha256:7be2f0d61a12e674af175046960df7ba06a7248dc92db0b2d9c9b63a77a5bc17
+generated: "2026-03-28T01:54:34.406941487Z"
--- a/clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml
@@ -20,7 +20,7 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: kube-prometheus-stack
-    version: 82.15.0
+    version: 82.15.1
    repository: oci://ghcr.io/prometheus-community/charts
  - name: app-template
    alias: ntfy-alertmanager
--- a/clusters/cl01tl/helm/loki/Chart.yaml
+++ b/clusters/cl01tl/helm/loki/Chart.yaml
@@ -23,4 +23,4 @@ dependencies:
    repository: https://grafana.github.io/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/loki.png
 # renovate: datasource=github-releases depName=grafana/loki
-appVersion: 3.7.0
+appVersion: 3.7.1
--- a/clusters/cl01tl/helm/movie-roulette/Chart.yaml
+++ b/clusters/cl01tl/helm/movie-roulette/Chart.yaml
@@ -19,4 +19,4 @@ dependencies:
    version: 4.6.2
 icon: https://raw.githubusercontent.com/sahara101/Movie-Roulette/refs/heads/main/static/icons/icon.png
 # renovate: datasource=github-releases depName=sahara101/Movie-Roulette
-appVersion: v5.3.0
+appVersion: v5.4.0
--- a/clusters/cl01tl/helm/movie-roulette/values.yaml
+++ b/clusters/cl01tl/helm/movie-roulette/values.yaml
@@ -9,7 +9,7 @@ movie-roulette:
        main:
          image:
            repository: ghcr.io/sahara101/movie-roulette
-            tag: v5.3.0
+            tag: v5.4.0
            pullPolicy: IfNotPresent
          env:
            - name: FLASK_SECRET_KEY
--- a/clusters/cl01tl/helm/ntfy/Chart.yaml
+++ b/clusters/cl01tl/helm/ntfy/Chart.yaml
@@ -20,4 +20,4 @@ dependencies:
    version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ntfy.png
 # renovate: datasource=github-releases depName=binwiederhier/ntfy
-appVersion: 2.20.0
+appVersion: 2.20.1
--- a/clusters/cl01tl/helm/ntfy/values.yaml
+++ b/clusters/cl01tl/helm/ntfy/values.yaml
@@ -9,7 +9,7 @@ ntfy:
        main:
          image:
            repository: binwiederhier/ntfy
-            tag: v2.20.0
+            tag: v2.20.1
            pullPolicy: IfNotPresent
          args: ["serve"]
          env:
--- a/clusters/cl01tl/helm/ollama/values.yaml
+++ b/clusters/cl01tl/helm/ollama/values.yaml
@@ -117,7 +117,7 @@ ollama:
        main:
          image:
            repository: ghcr.io/open-webui/open-webui
-            tag: v0.8.10
+            tag: v0.8.12
            pullPolicy: IfNotPresent
          env:
            - name: ENV
--- a/clusters/cl01tl/helm/postiz/values.yaml
+++ b/clusters/cl01tl/helm/postiz/values.yaml
@@ -9,7 +9,7 @@ postiz:
        main:
          image:
            repository: ghcr.io/gitroomhq/postiz-app
-            tag: v2.21.0
+            tag: v2.21.2
            pullPolicy: IfNotPresent
          env:
            - name: MAIN_URL
--- a/clusters/cl01tl/helm/rybbit/values.yaml
+++ b/clusters/cl01tl/helm/rybbit/values.yaml
@@ -122,7 +122,7 @@ rybbit:
        main:
          image:
            repository: clickhouse/clickhouse-server
-            tag: 26.2.5
+            tag: 26.3.2
            pullPolicy: IfNotPresent
          env:
            - name: CLICKHOUSE_DB
--- a/clusters/cl01tl/helm/tailscale-operator/Chart.yaml
+++ b/clusters/cl01tl/helm/tailscale-operator/Chart.yaml
@@ -21,4 +21,4 @@ dependencies:
    repository: https://pkgs.tailscale.com/helmcharts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tailscale-light.png
 # renovate: datasource=github-releases depName=tailscale/tailscale
-appVersion: v1.96.3
+appVersion: v1.96.4
--- a/clusters/cl01tl/helm/whodb/Chart.yaml
+++ b/clusters/cl01tl/helm/whodb/Chart.yaml
@@ -20,4 +20,4 @@ dependencies:
    version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/whodb.png
 # renovate: datasource=github-releases depName=clidey/whodb
-appVersion: 0.101.0
+appVersion: 0.103.0
--- a/clusters/cl01tl/helm/whodb/values.yaml
+++ b/clusters/cl01tl/helm/whodb/values.yaml
@@ -8,7 +8,7 @@ whodb:
        main:
          image:
            repository: clidey/whodb
-            tag: 0.101.0
+            tag: 0.103.0
            pullPolicy: IfNotPresent
          env:
            - name: WHODB_OLLAMA_HOST
--- a/hosts/ps08rp/traefik/compose.yaml
+++ b/hosts/ps08rp/traefik/compose.yaml
@@ -1,7 +1,7 @@
 ---
 services:
    traefik:
-        image: ghcr.io/traefik/traefik:v3.6.11@sha256:acfc80650104f0194a15f73dc1648f517561bc1645391a15705332a064cfc33c
+        image: ghcr.io/traefik/traefik:v3.6.12@sha256:171c9c3565b29f6c133f1c1b43c5d4e5853415198e9e1078c001f8702ff66aec
        container_name: traefik
        command:
            - "--global.checkNewVersion=false"
--- a/hosts/ps09rp/traefik/compose.yaml
+++ b/hosts/ps09rp/traefik/compose.yaml
@@ -1,7 +1,7 @@
 ---
 services:
    traefik:
-        image: ghcr.io/traefik/traefik:v3.6.11@sha256:acfc80650104f0194a15f73dc1648f517561bc1645391a15705332a064cfc33c
+        image: ghcr.io/traefik/traefik:v3.6.12@sha256:171c9c3565b29f6c133f1c1b43c5d4e5853415198e9e1078c001f8702ff66aec
        container_name: traefik
        command:
            - "--global.checkNewVersion=false"
--- a/hosts/ps10rp/homepage/compose.yaml
+++ b/hosts/ps10rp/homepage/compose.yaml
@@ -32,7 +32,7 @@ services:
            - /var/run/docker.sock:/var/run/docker.sock:ro

    homepage:
-        image: ghcr.io/gethomepage/homepage:v1.11.0@sha256:b129cb0f674bd6d204e215bde2c2fc3f11d6ad0e82f6d20007cf80f74e1acbb1
+        image: ghcr.io/gethomepage/homepage:v1.12.0@sha256:5bb66eac5d48f021fd60414add03aa123d1feb85770550ddb1d99a5b8851c6c2
        container_name: homepage
        labels:
            traefik.enable: true
--- a/hosts/ps10rp/traefik/compose.yaml
+++ b/hosts/ps10rp/traefik/compose.yaml
@@ -20,7 +20,7 @@ services:
            - /dev/net/tun:/dev/net/tun

    traefik:
-        image: ghcr.io/traefik/traefik:v3.6.11@sha256:acfc80650104f0194a15f73dc1648f517561bc1645391a15705332a064cfc33c
+        image: ghcr.io/traefik/traefik:v3.6.12@sha256:171c9c3565b29f6c133f1c1b43c5d4e5853415198e9e1078c001f8702ff66aec
        container_name: traefik
        command:
            - "--global.checkNewVersion=false"
--- a/renovate.json
+++ b/renovate.json
@@ -28,6 +28,18 @@
      ],
      "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver-coerced{{/if}}"
    },
+    {
+      "description": "Update specific images in values",
+      "customType": "regex",
+      "managerFilePatterns": [
+        "(^|/)values\\.yaml$"
+      ],
+      "matchStrings": [
+        "#\\s*renovate:\\s*datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)\\s*\\n\\s+tag:\\s*[\"']?(?<currentValue>[^\"'\\s]+)[\"']?"
+      ],
+      "depNameTemplate": "{{{depName}}}",
+      "datasourceTemplate": "{{{datasource}}}"
+    },
    {
      "description": "Update images in templates",
      "customType": "regex",
@@ -73,15 +85,6 @@
      ],
      "enabled": false
    },
-    {
-      "description": "Versioning for LinuxServer images",
-      "versioning": "regex:^v?(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-ls(?<revision>\\d+)$",
-      "matchPackageNames": [
-        "/^linuxserver\\//",
-        "/^ghcr\\.io/linuxserver\\//",
-        "/^lscr\\.io/linuxserver\\//"
-      ]
-    },
    {
      "description": "Label by datasource",
      "matchDatasources": [
@@ -91,8 +94,35 @@
      ],
      "addLabels": [
        "{{{datasource}}}"
+      ]
+    },
+    {
+      "description": "Versioning for LinuxServer images",
+      "versioning": "regex:^v?(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)-ls(?<revision>\d+)$",
+      "matchPackageNames": [
+        "/^linuxserver\\//",
+        "/^ghcr\\.io/linuxserver\\//",
+        "/^lscr\\.io/linuxserver\\//"
+      ]
+    },
+    {
+      "description": "Group packages together when stripping registry",
+      "matchManagers": [
+        "custom.regex",
+        "helm-values",
+        "docker"
      ],
-      "automerge": false
+      "groupName": "{{#if packageName}}{{{replace 'ghcr.io/' '' (replace 'docker.io/' '' packageName)}}}{{else}}{{{replace 'ghcr.io/' '' (replace 'docker.io/' '' depName)}}}{{/if}}",
+      "groupSlug": "unified-{{{groupName}}}"
+    },
+    {
+      "description": "Group for specific apps",
+      "matchPackageNames": [
+        "/(^|/)(argo-cd|bazarr|cilium|code-server|dawarich|element-web|home-assistant|immich|komodo|rook-ceph|tdarr|traefik)/",
+        "/^rook(-ceph|\\/rook|\\/ceph)/"
+      ],
+      "groupName": "{{{replace '^.*(argo-cd|bazarr|cilium|code-server|dawarich|element-web|home-assistant|immich|komodo|rook-ceph|tdarr|traefik).*$' '$1' depName}}}",
+      "groupSlug": "unified-{{{groupName}}}"
    },
    {
      "description": "Automerge helm chart lock files",
@@ -108,86 +138,6 @@
      "automerge": true,
      "automergeType": "branch"
    },
-    {
-      "description": "Automerge patches",
-      "matchUpdateTypes": [
-        "patch",
-        "pinDigest"
-      ],
-      "matchDatasources": [
-        "helm",
-        "docker",
-        "github-actions"
-      ],
-      "addLabels": [
-        "automerge"
-      ],
-      "automerge": true,
-      "minimumReleaseAge": "1 days"
-    },
-    {
-      "description": "Label appVersion and images, grouped",
-      "matchManagers": [
-        "custom.regex",
-        "helm-values"
-      ],
-      "groupName": "{{#if packageName}}{{{replace 'ghcr.io/' '' (replace 'docker.io/' '' packageName)}}}{{else}}{{{replace 'ghcr.io/' '' (replace 'docker.io/' '' depName)}}}{{/if}}",
-      "groupSlug": "unified-{{{groupName}}}",
-      "addLabels": [
-        "docker"
-      ],
-      "automerge": false
-    },
-    {
-      "description": "Automerge appVersion and images, grouped",
-      "matchUpdateTypes": [
-        "patch",
-        "pinDigest"
-      ],
-      "matchManagers": [
-        "custom.regex",
-        "helm-values"
-      ],
-      "groupName": "{{#if packageName}}{{{replace 'ghcr.io/' '' (replace 'docker.io/' '' packageName)}}}{{else}}{{{replace 'ghcr.io/' '' (replace 'docker.io/' '' depName)}}}{{/if}}",
-      "groupSlug": "unified-{{{groupName}}}",
-      "addLabels": [
-        "automerge"
-      ],
-      "automerge": true,
-      "minimumReleaseAge": "1 days"
-    },
-    {
-      "description": "Group apps by their keyword",
-      "groupName": "{{{replace '^.*(dawarich|komodo|immich|home-assistant|element-web|cilium|tdarr|argo-cd|traefik).*$' '$1' depName}}}",
-      "groupSlug": "unified-{{{groupName}}}",
-      "matchPackageNames": [
-        "/(^|/)(?<appName>dawarich|komodo|immich|home-assistant|element-web|cilium|tdarr|argo-cd|traefik)/"
-      ]
-    },
-    {
-      "description": "Group Bazarr dependencies",
-      "groupName": "bazarr",
-      "groupSlug": "unified-bazarr",
-      "matchPackageNames": [
-        "bazarr$"
-      ]
-    },
-    {
-      "description": "Group Code Server dependencies",
-      "groupName": "code-server",
-      "groupSlug": "unified-code-server",
-      "matchPackageNames": [
-        "code-server$"
-      ]
-    },
-    {
-      "description": "Group Rook-Ceph dependencies",
-      "groupName": "rook-ceph",
-      "groupSlug": "unified-rook-ceph",
-      "matchPackageNames": [
-        "/^rook(-ceph|\\/rook|\\/ceph)/"
-      ]
-    },
    {
      "description": "Open for digest updates, specific packages",
      "matchUpdateTypes": [
@@ -215,6 +165,23 @@
      "enabled": true,
      "automerge": true
    },
+    {
+      "description": "Automerge patches",
+      "matchUpdateTypes": [
+        "patch",
+        "pinDigest"
+      ],
+      "matchDatasources": [
+        "helm",
+        "docker",
+        "github-actions"
+      ],
+      "addLabels": [
+        "automerge"
+      ],
+      "automerge": true,
+      "minimumReleaseAge": "1 days"
+    },
    {
      "description": "Automerge images, specific packages",
      "matchUpdateTypes": [