chore(deps): update cilium to v1.19.2

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [frederikemmer/MediaLyze](https://github.com/frederikemmer/MediaLyze) | minor | `0.3.0` → `0.4.0` |
| [ghcr.io/frederikemmer/medialyze](https://github.com/frederikemmer/MediaLyze) | minor | `0.3.0` → `0.4.0` |

---

### Release Notes

<details>
<summary>frederikemmer/MediaLyze (frederikemmer/MediaLyze)</summary>

### [`v0.4.0`](https://github.com/frederikemmer/MediaLyze/blob/HEAD/CHANGELOG.md#v040)

[Compare Source](https://github.com/frederikemmer/MediaLyze/compare/v0.3.0...v0.4.0)

> 2026-03-30

First "rough" implementation for detecting duplicate files. May break desktop install use v0.3.0 if it's not working properly.

##### ✨ New

- add per-library duplicate detection with `off` (default), `filename`, `filehash`, `both` modes ([#&#8203;16](https://github.com/frederikemmer/MediaLyze/issues/16))
- view and search through duplicates on library page
- scan performance tuning in `App settings` with separate controls for per-scan analysis workers and parallel library scans

##### 🐛 Bug fixes

- rework scan execution so discovery streams files directly into analysis and duplicate workers, live progress reflects worker completion, and configured worker counts now affect real throughput
- stop auto-resuming or auto-queuing stale startup jobs, clear pending watchdog debounce requests on cancel, and improve failed scan diagnostics with copyable detailed error payloads
- tighten the duplicate and library-settings UI by capping visible duplicate variants with internal scrolling, aligning scan controls consistently, and making the `dev` desktop artifact build manual-only

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDAuMiIsInVwZGF0ZWRJblZlciI6IjQzLjEwMC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkb2NrZXIiXX0=-->

Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/5294
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

.gitea/workflows/renovate.yaml

@@ -13,7 +13,7 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.96.0@sha256:41af2f21008f8f5785833277ac951b4f44e936b61394dc7edccdc0fe09e59132
+    container: ghcr.io/renovatebot/renovate:43.101.1@sha256:06c9297754f7d487adca6446b9970fecade3202190138259e7888c30ec8d4277
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

clusters/cl01tl/helm/argocd/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 9.4.16
+  version: 9.4.17
-digest: sha256:f9ecc47369d4401df61c17f55cc59c9b2d4543f57cf122653abb1a27a4f7bf35
+digest: sha256:17752dbf03861cf70ee31c9a17373a5175656a2edd00ba5fcd3988a195147da8
-generated: "2026-03-26T21:01:52.678525211Z"
+generated: "2026-03-28T01:51:34.832601868Z"

clusters/cl01tl/helm/argocd/Chart.yaml

@@ -13,8 +13,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 9.4.16
+    version: 9.4.17
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-cd
-appVersion: v3.3.5
+appVersion: v3.3.6

clusters/cl01tl/helm/cert-manager/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: cert-manager
   repository: https://charts.jetstack.io
-  version: v1.20.0
+  version: v1.20.1
-digest: sha256:1543bd17649cb32982de3cce017fcbed1b44c41d50b76c6471b266f33e261c29
+digest: sha256:1bf36eba44cf096b40355a697b8cffb302f07f9135374222aabdf686f017b7a9
-generated: "2026-03-10T16:06:49.332999536Z"
+generated: "2026-03-28T01:35:24.542754563Z"

clusters/cl01tl/helm/cert-manager/Chart.yaml

@@ -13,8 +13,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: cert-manager
-    version: v1.20.0
+    version: v1.20.1
     repository: https://charts.jetstack.io
 icon: https://raw.githubusercontent.com/cert-manager/cert-manager/refs/heads/master/logo/logo.png
 # renovate: datasource=github-releases depName=cert-manager/cert-manager
-appVersion: v1.20.0
+appVersion: v1.20.1

clusters/cl01tl/helm/cilium/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: cilium
   repository: https://helm.cilium.io/
-  version: 1.18.6
+  version: 1.19.2
-digest: sha256:8ea328ac238524b5b423e6289f5e25d05ef64e6aa19cfd5de238f1d5dd533e9b
+digest: sha256:11f8eef4733b70c2b9a91ce39fe3c1ea1ad3fa3c46750efb015e03ff6ea3655b
-generated: "2026-02-05T12:00:20.15778-06:00"
+generated: "2026-03-30T19:14:31.754830448Z"

clusters/cl01tl/helm/cilium/Chart.yaml

@@ -14,8 +14,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: cilium
-    version: 1.18.6
+    version: 1.19.2
     repository: https://helm.cilium.io/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/cilium.png
 # renovate: datasource=github-releases depName=cilium/cilium
-appVersion: 1.18.6
+appVersion: 1.19.2

clusters/cl01tl/helm/code-server/values.yaml

@@ -28,7 +28,7 @@ code-server:
           resources:
             requests:
               cpu: 1m
-              memory: 50Mi
+              memory: 40Mi
   service:
     main:
       controller: main

clusters/cl01tl/helm/dawarich/Chart.yaml

@@ -29,4 +29,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/dawarich.png
 # renovate: datasource=github-releases depName=Freika/dawarich
-appVersion: 1.4.0
+appVersion: 1.6.0

clusters/cl01tl/helm/dawarich/values.yaml

@@ -8,7 +8,7 @@ dawarich:
         main:
           image:
             repository: freikin/dawarich
-            tag: 1.4.0@sha256:07adb7643b00d1d8f606c675931d3604317fa3851b91b74ec503df8d50734cb8
+            tag: 1.6.0@sha256:5cba4d96fb57976fb6a956b8622365789d74a1178cc3ada1cb7541a4473993a9
           command:
             - "web-entrypoint.sh"
           args:
@@ -111,7 +111,7 @@ dawarich:
         sidekiq:
           image:
             repository: freikin/dawarich
-            tag: 1.4.0@sha256:07adb7643b00d1d8f606c675931d3604317fa3851b91b74ec503df8d50734cb8
+            tag: 1.6.0@sha256:5cba4d96fb57976fb6a956b8622365789d74a1178cc3ada1cb7541a4473993a9
           command:
             - "sidekiq-entrypoint.sh"
           args:

clusters/cl01tl/helm/directus/values.yaml

@@ -8,7 +8,7 @@ directus:
         main:
           image:
             repository: ghcr.io/directus/directus
-            tag: 11.17.0@sha256:076269ccbe7d4a0c44ce5f5b7f11e2ea5f7b3e4c4f704c0f88a52805e069c1c6
+            tag: 11.17.1@sha256:1dd2080a50a9f6df2b6f49df15a7734424bbd1a5902983c4b6e447f22027b80b
             pullPolicy: IfNotPresent
           env:
             - name: PUBLIC_URL
@@ -143,7 +143,7 @@ directus:
           resources:
             requests:
               cpu: 10m
-              memory: 1Gi
+              memory: 300Mi
   service:
     main:
       controller: main

clusters/cl01tl/helm/foldergram/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
 # renovate: datasource=github-releases depName=foldergram/foldergram
-appVersion: v1.0.8
+appVersion: v1.0.9

clusters/cl01tl/helm/foldergram/values.yaml

@@ -12,7 +12,7 @@ foldergram:
         main:
           image:
             repository: ghcr.io/foldergram/foldergram
-            tag: 1.0.8@sha256:3546dc1da4ec12cb27aaecbf77896d708ac7601eb0225e0f6e181d7ef35273f9
+            tag: 1.0.9@sha256:aa6707e7456386f2d74b8f2769d0281f4127d1276349583b8531dbaa8f844883
             pullPolicy: IfNotPresent
           env:
             - name: IMAGE_DETAIL_SOURCE

clusters/cl01tl/helm/freshrss/values.yaml

@@ -79,7 +79,7 @@ freshrss:
           resources:
             requests:
               cpu: 1m
-              memory: 128Mi
+              memory: 100Mi
   service:
     main:
       controller: main

clusters/cl01tl/helm/garage/values.yaml

@@ -28,7 +28,7 @@ garage:
           resources:
             requests:
               cpu: 10m
-              memory: 400Mi
+              memory: 200Mi
     server-2:
       type: deployment
       replicas: 1
@@ -57,7 +57,7 @@ garage:
           resources:
             requests:
               cpu: 10m
-              memory: 400Mi
+              memory: 200Mi
     server-3:
       type: deployment
       replicas: 1
@@ -86,7 +86,7 @@ garage:
           resources:
             requests:
               cpu: 10m
-              memory: 400Mi
+              memory: 200Mi
     webui:
       type: deployment
       replicas: 1

clusters/cl01tl/helm/gitea/Chart.lock

@@ -7,7 +7,7 @@ dependencies:
   version: 0.0.3
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.29.0
+  version: 0.30.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.4.0
@@ -23,5 +23,5 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:49862b06fe4884f504d0a892cb899f577262b584053b64a3504bacaf96d70f39
+digest: sha256:e2c79d0dc5bee77c31bb92f117eac6fe248def2c17eaa589cc4388e7ad55c84f
-generated: "2026-03-26T20:59:30.690577-05:00"
+generated: "2026-03-30T16:13:01.539524905Z"

clusters/cl01tl/helm/gitea/Chart.yaml

@@ -32,7 +32,7 @@ dependencies:
     repository: https://dl.gitea.com/charts/
     version: 0.0.3
   - name: meilisearch
-    version: 0.29.0
+    version: 0.30.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/helm/grafana-operator/Chart.yaml

@@ -5,14 +5,13 @@ description: Grafana Operator
 keywords:
   - grafana-operator
   - dashboard
-  - metrics
+home: https://docs.alexlebens.dev/applications/grafana-operator/
-  - logs
-home: https://wiki.alexlebens.dev/s/3e5723e1-2ab7-45ab-b496-b8854907fa39
 sources:
   - https://github.com/grafana/grafana-operator
-  - https://github.com/cloudnative-pg/cloudnative-pg
+  - https://github.com/grafana/grafana/pkgs/container/grafana%2Fgrafana
   - https://github.com/grafana/grafana-operator/tree/master/deploy/helm/grafana-operator
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/grafana-operator/templates/external-secret.yaml

@@ -14,17 +14,11 @@ spec:
   data:
     - secretKey: admin-user
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/grafana/auth
-        metadataPolicy: None
         property: admin-user
     - secretKey: admin-password
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/grafana/auth
-        metadataPolicy: None
         property: admin-password
 
 ---
@@ -44,17 +38,11 @@ spec:
   data:
     - secretKey: AUTH_CLIENT_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/grafana
-        metadataPolicy: None
         property: client
     - secretKey: AUTH_CLIENT_SECRET
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/grafana
-        metadataPolicy: None
         property: secret
 
 ---
@@ -74,17 +62,11 @@ spec:
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
         property: access
     - secretKey: ACCESS_SECRET_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
         property: secret
 
 ---
@@ -104,22 +86,13 @@ spec:
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: ACCESS_SECRET_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
     - secretKey: ACCESS_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
         property: ACCESS_REGION

clusters/cl01tl/helm/grafana-operator/templates/grafana-dashboard.yaml

@@ -11,9 +11,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/ceph.json
 
 ---
@@ -30,9 +30,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/coredns.json
 
 ---
@@ -49,9 +49,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/etcd.json
 
 ---
@@ -68,9 +68,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/garage.json
 
 ---
@@ -87,9 +87,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/loki.json
 
 ---
@@ -106,9 +106,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/node-full.json
 
 ---
@@ -125,9 +125,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/node-short.json
 
 ---
@@ -144,9 +144,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/pods.json
 
 ---
@@ -163,9 +163,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/argocd.json
 
 ---
@@ -182,9 +182,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/blocky.json
 
 ---
@@ -201,9 +201,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/cert-manager.json
 
 ---
@@ -220,9 +220,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/cloudnative-pg.json
 
 ---
@@ -239,9 +239,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/descheduler.json
 
 ---
@@ -258,9 +258,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/gatus.json
 
 ---
@@ -277,9 +277,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/grafana-operator.json
 
 ---
@@ -296,9 +296,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/harbor.json
 
 ---
@@ -315,9 +315,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/speedtest-exporter.json
 
 ---
@@ -334,9 +334,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/spegel.json
 
 ---
@@ -353,9 +353,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/traefik.json
 
 ---
@@ -372,9 +372,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/tdarr.json
 
 ---
@@ -391,9 +391,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/unpoller.json
 
 ---
@@ -410,9 +410,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/volsync.json
 
 ---
@@ -429,9 +429,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/s3.json
 
 ---
@@ -448,9 +448,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/authentik.json
 
 ---
@@ -467,9 +467,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/gitea.json
 
 ---
@@ -486,9 +486,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/ntfy.json
 
 ---
@@ -505,9 +505,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/qbittorrent.json
 
 ---
@@ -524,9 +524,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/vault.json
 
 ---
@@ -543,9 +543,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-iot
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/iot/airgradient.json
 
 ---
@@ -562,9 +562,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-iot
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/iot/server-power-consumption.json
 
 ---
@@ -581,9 +581,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-application
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/immich.json
 
 ---
@@ -600,9 +600,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-application
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/jellyfin.json
 
 ---
@@ -619,9 +619,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-application
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/radarr.json
 
 ---
@@ -638,7 +638,7 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-application
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/sonarr.json

clusters/cl01tl/helm/grafana-operator/templates/grafana.yaml

@@ -56,11 +56,12 @@ spec:
         spec:
           containers:
             - name: grafana
-              image: grafana/grafana:12.0.0
+              # renovate: datasource=docker depName=grafana/grafana
+              image: grafana/grafana:12.4.2@sha256:83749231c3835e390a3144e5e940203e42b9589761f20ef3169c716e734ad505
               resources:
                 requests:
-                  cpu: 100m
+                  cpu: 20m
-                  memory: 128Mi
+                  memory: 150Mi
               env:
                 - name: AUTH_CLIENT_ID
                   valueFrom:
@@ -107,3 +108,12 @@ spec:
                     secretKeyRef:
                       name: grafana-operator-postgresql-18-cluster-app
                       key: password
+  httpRoute:
+    spec:
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - grafana.alexlebens.net

clusters/cl01tl/helm/grafana-operator/templates/http-route.yaml

@@ -1,28 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: grafana
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: grafana
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-  hostnames:
-    - grafana.alexlebens.net
-  rules:
-    - matches:
-      - path:
-          type: PathPrefix
-          value: /
-      backendRefs:
-        - group: ''
-          kind: Service
-          name: grafana-main-service
-          port: 3000
-          weight: 100

clusters/cl01tl/helm/grafana-operator/values.yaml

@@ -1,17 +1,11 @@
 grafana-operator:
   replicas: 2
-  serviceAccount:
-    create: true
-  rbac:
-    create: true
   resources:
     requests:
-      cpu: 10m
+      cpu: 1m
-      memory: 64Mi
+      memory: 50Mi
   serviceMonitor:
     enabled: true
-  dashboard:
-    enabled: false
 postgres-18-cluster:
   mode: recovery
   recovery:
@@ -25,35 +19,12 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
-      # - name: garage-remote
-      #   index: 1
-      #   destinationBucket: postgres-backups
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   retentionPolicy: "90d"
-      #   data:
-      #     compression: bzip2
-      # - name: external
-      #   index: 1
-      #   endpointURL: https://nyc3.digitaloceanspaces.com
-      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 30 14 * * *"
         backupName: garage-local
-      # - name: weekly-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 4 * * SAT"
-      #   backupName: garage-remote
-      # - name: daily-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 0 * * *"
-      #   backupName: external
 valkey-unified-alerting:
   valkey:
     nameOverride: valkey-unified-alerting

clusters/cl01tl/helm/harbor/Chart.yaml

@@ -4,15 +4,14 @@ version: 1.0.0
 description: Harbor
 keywords:
   - harbor
-  - images
+  - image-registry
-  - cache
+home: https://docs.alexlebens.dev/applications/harbor/
-  - kubernetes
-home: https://wiki.alexlebens.dev/s/7e132c13-afee-48ec-b3dd-efd656d240c9
 sources:
   - https://github.com/goharbor
-  - https://github.com/cloudnative-pg/cloudnative-pg
+  - https://github.com/orgs/goharbor/packages
   - https://github.com/goharbor/harbor-helm
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/harbor/templates/external-secret.yaml

@@ -14,85 +14,49 @@ spec:
   data:
     - secretKey: HARBOR_ADMIN_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/config
-        metadataPolicy: None
         property: admin-password
     - secretKey: secretKey
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/config
-        metadataPolicy: None
         property: secretKey
     - secretKey: CSRF_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/core
-        metadataPolicy: None
         property: CSRF_KEY
     - secretKey: secret
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/core
-        metadataPolicy: None
         property: secret
     - secretKey: tls.crt
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/core
-        metadataPolicy: None
         property: tls.crt
     - secretKey: tls.key
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/core
-        metadataPolicy: None
         property: tls.key
     - secretKey: JOBSERVICE_SECRET
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/jobservice
-        metadataPolicy: None
         property: JOBSERVICE_SECRET
     - secretKey: REGISTRY_HTTP_SECRET
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/registry
-        metadataPolicy: None
         property: REGISTRY_HTTP_SECRET
     - secretKey: REGISTRY_REDIS_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/registry
-        metadataPolicy: None
         property: REGISTRY_REDIS_PASSWORD
     - secretKey: REGISTRY_HTPASSWD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/registry
-        metadataPolicy: None
         property: REGISTRY_HTPASSWD
     - secretKey: REGISTRY_CREDENTIAL_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/registry
-        metadataPolicy: None
         property: REGISTRY_CREDENTIAL_PASSWORD
     - secretKey: REGISTRY_PASSWD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/registry
-        metadataPolicy: None
         property: REGISTRY_CREDENTIAL_PASSWORD

clusters/cl01tl/helm/harbor/values.yaml

@@ -21,13 +21,9 @@ harbor:
         size: 100Gi
   existingSecretAdminPassword: harbor-secret
   existingSecretAdminPasswordKey: HARBOR_ADMIN_PASSWORD
-  internalTLS:
-    enabled: false
   ipFamily:
     ipv6:
       enabled: false
-    ipv4:
-      enabled: true
   updateStrategy:
     type: Recreate
   existingSecretSecretKey: harbor-secret
@@ -73,12 +69,12 @@ harbor:
     credentials:
       existingSecret: harbor-secret
     upload_purging:
-      enabled: true
       age: 72h
-      interval: 24h
-      dryrun: false
   trivy:
     enabled: true
+    image:
+      repository: ghcr.io/goharbor/trivy-adapter-photon
+      tag: v2.15.0@sha256:6fd6de9cfbbb04cb1d94722cfa01cf71b8994d3f9e7891d3b03a89a7536480ba
   database:
     type: external
     external:
@@ -109,32 +105,9 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
-      # - name: garage-remote
-      #   index: 1
-      #   destinationBucket: postgres-backups
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   retentionPolicy: "90d"
-      #   data:
-      #     compression: bzip2
-      # - name: external
-      #   index: 1
-      #   endpointURL: https://nyc3.digitaloceanspaces.com
-      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 35 14 * * *"
         backupName: garage-local
-      # - name: weekly-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 4 * * SAT"
-      #   backupName: garage-remote
-      # - name: daily-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 0 * * *"
-      #   backupName: external

clusters/cl01tl/helm/headlamp/Chart.yaml

@@ -5,8 +5,7 @@ description: Headlamp
 keywords:
   - headlamp
   - dashboard
-  - kubernetes
+home: https://docs.alexlebens.dev/applications/headlamp/
-home: https://wiki.alexlebens.dev/s/6cc43960-78df-459d-aab6-433844249243
 sources:
   - https://github.com/headlamp-k8s/headlamp
   - https://github.com/headlamp-k8s/headlamp/tree/main/charts/headlamp

clusters/cl01tl/helm/headlamp/templates/external-secret.yaml

@@ -14,43 +14,25 @@ spec:
   data:
     - secretKey: OIDC_CLIENT_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/headlamp
-        metadataPolicy: None
         property: client
     - secretKey: OIDC_CLIENT_SECRET
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/headlamp
-        metadataPolicy: None
         property: secret
     - secretKey: OIDC_ISSUER_URL
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/headlamp
-        metadataPolicy: None
         property: issuer
     - secretKey: OIDC_SCOPES
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/headlamp
-        metadataPolicy: None
         property: scopes
     - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_IDP_ISSUER_URL
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/headlamp
-        metadataPolicy: None
         property: validator-issuer-url
     - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_CLIENT_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/headlamp
-        metadataPolicy: None
         property: validator-client-id

clusters/cl01tl/helm/headlamp/templates/http-route.yaml

@@ -1,28 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: headlamp
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: headlamp
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-  hostnames:
-    - headlamp.alexlebens.net
-  rules:
-    - matches:
-      - path:
-          type: PathPrefix
-          value: /
-      backendRefs:
-        - group: ''
-          kind: Service
-          name: headlamp
-          port: 80
-          weight: 100

clusters/cl01tl/helm/headlamp/values.yaml

@@ -1,5 +1,9 @@
 headlamp:
   replicaCount: 2
+  image:
+    registry: ghcr.io
+    repository: headlamp-k8s/headlamp
+    tag: v0.41.0@sha256:89c6c65810bfde61796483c93c70d659104355593792bf55cab680d685da8eeb
   config:
     oidc:
       secret:
@@ -10,10 +14,30 @@ headlamp:
     watchPlugins: true
     # Bypasses: https://github.com/kubernetes-sigs/headlamp/issues/4883
     sessionTTL: null
+  httpRoute:
+    enabled: true
+    parentRefs:
+      - group: gateway.networking.k8s.io
+        kind: Gateway
+        name: traefik-gateway
+        namespace: traefik
+    hostnames:
+      - headlamp.alexlebens.net
+    rules:
+      - matches:
+        - path:
+            type: PathPrefix
+            value: /
+        backendRefs:
+          - group: ''
+            kind: Service
+            name: headlamp
+            port: 80
+            weight: 100
   resources:
     requests:
-      cpu: 10m
+      cpu: 1m
-      memory: 128Mi
+      memory: 80Mi
   pluginsManager:
     enabled: true
     securityContext:

clusters/cl01tl/helm/home-assistant/Chart.yaml

@@ -4,14 +4,13 @@ version: 1.0.0
 description: Home Assistant
 keywords:
   - home-assistant
-  - home
+  - home-automation
-  - automation
+home: https://docs.alexlebens.dev/applications/home-assistant/
-home: https://wiki.alexlebens.dev/s/5462c17e-cd39-4082-ad01-94545a2fa3ca
 sources:
-  - https://www.home-assistant.io/
   - https://github.com/home-assistant/core
   - https://github.com/home-assistant/core/pkgs/container/home-assistant
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/home-assistant/templates/external-secret.yaml

@@ -14,17 +14,11 @@ spec:
   data:
     - secretKey: PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/home-assistant/code-server/auth
-        metadataPolicy: None
         property: PASSWORD
     - secretKey: SUDO_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/home-assistant/code-server/auth
-        metadataPolicy: None
         property: SUDO_PASSWORD
 
 ---
@@ -44,8 +38,5 @@ spec:
   data:
     - secretKey: bearer-token
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/home-assistant/auth
-        metadataPolicy: None
         property: bearer-token

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -4,28 +4,29 @@ home-assistant:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
+      pod:
+        securityContext:
+          fsGroup: 1000
+          fsGroupChangePolicy: OnRootMismatch
       containers:
         main:
           image:
             repository: ghcr.io/home-assistant/home-assistant
-            tag: 2026.3.4
+            tag: 2026.3.4@sha256:916682086154a7390114a9788782b8efb199852d4f7d47066722c2bc5d1829e6
-            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: US/Central
+              value: America/Chicago
           resources:
             requests:
-              cpu: 50m
+              cpu: 1m
-              memory: 512Mi
+              memory: 400Mi
         code-server:
           image:
             repository: ghcr.io/linuxserver/code-server
             tag: 4.112.0@sha256:4bb5b8ad22268001687c047f0f04933799fb03df1eb0e1e266ba15ed2d9f4e8b
-            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: US/Central
+              value: America/Chicago
             - name: PUID
               value: 1000
             - name: PGID
@@ -35,10 +36,6 @@ home-assistant:
           envFrom:
             - secretRef:
                 name: home-assistant-code-server-password-secret
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
   service:
     main:
       controller: main
@@ -82,11 +79,8 @@ home-assistant:
         - home-assistant.alexlebens.net
       rules:
         - backendRefs:
-            - group: ''
+            - name: home-assistant-main
-              kind: Service
-              name: home-assistant-main
               port: 80
-              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -102,11 +96,8 @@ home-assistant:
         - home-assistant-code-server.alexlebens.net
       rules:
         - backendRefs:
-            - group: ''
+            - name: home-assistant-code-server
-              kind: Service
-              name: home-assistant-code-server
               port: 8443
-              weight: 100
           matches:
             - path:
                 type: PathPrefix

clusters/cl01tl/helm/homepage/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/homepage.png
 # renovate: datasource=github-releases depName=gethomepage/homepage
-appVersion: v1.11.0
+appVersion: v1.12.1

clusters/cl01tl/helm/homepage/values.yaml

@@ -16,7 +16,7 @@ homepage:
         main:
           image:
             repository: ghcr.io/gethomepage/homepage
-            tag: v1.11.0
+            tag: v1.12.1
             pullPolicy: IfNotPresent
           env:
             - name: HOMEPAGE_ALLOWED_HOSTS

clusters/cl01tl/helm/houndarr/values.yaml

@@ -9,7 +9,7 @@ houndarr:
         main:
           image:
             repository: ghcr.io/av1155/houndarr
-            tag: v1.6.2
+            tag: v1.6.3
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/immich/values.yaml

@@ -9,7 +9,7 @@ immich:
         main:
           image:
             repository: ghcr.io/immich-app/immich-server
-            tag: v2.6.2
+            tag: v2.6.3
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/jellyfin/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.6.2
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.29.0
+  version: 0.30.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:0dcc864984130902acce6d81fa2cf708c3ac748246f94b11d2db90c0b488cce2
+digest: sha256:32b9a206e77eabcdf1bbbc4d7e93067c40d6a621e4a07c1827e4d23961e2d82b
-generated: "2026-03-26T16:03:11.654482999Z"
+generated: "2026-03-30T16:13:40.879082765Z"

clusters/cl01tl/helm/jellyfin/Chart.yaml

@@ -25,7 +25,7 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
   - name: meilisearch
-    version: 0.29.0
+    version: 0.30.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: volsync-target
     alias: volsync-target-config

clusters/cl01tl/helm/karakeep/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 4.6.2
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.29.0
+  version: 0.30.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.4.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:a3a3400d95d62591012d33ce318075b67412c4b321a30fe5c2c19d9c9566eb86
+digest: sha256:6046192bb4ff88692bd0623fd0eb00a33bf83f6066a0b471950db8776e868661
-generated: "2026-03-26T16:03:24.623811889Z"
+generated: "2026-03-30T16:14:17.687854336Z"

clusters/cl01tl/helm/karakeep/Chart.yaml

@@ -22,7 +22,7 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
   - name: meilisearch
-    version: 0.29.0
+    version: 0.30.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 82.15.0
+  version: 82.15.1
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.6.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
-digest: sha256:524759b57f9500d5742b962bcdb114ec556d80ec4418921c93a722e00df57647
+digest: sha256:7be2f0d61a12e674af175046960df7ba06a7248dc92db0b2d9c9b63a77a5bc17
-generated: "2026-03-26T23:02:03.558664114Z"
+generated: "2026-03-28T01:54:34.406941487Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 82.15.0
+    version: 82.15.1
     repository: oci://ghcr.io/prometheus-community/charts
   - name: app-template
     alias: ntfy-alertmanager

clusters/cl01tl/helm/loki/Chart.yaml

@@ -23,4 +23,4 @@ dependencies:
     repository: https://grafana.github.io/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/loki.png
 # renovate: datasource=github-releases depName=grafana/loki
-appVersion: 3.7.0
+appVersion: 3.7.1

clusters/cl01tl/helm/medialyze/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     version: 4.6.2
 icon: https://raw.githubusercontent.com/frederikemmer/MediaLyze/d8f69c0628bac7c047b90f91a66341648029c273/frontend/public/favicon.svg
 # renovate: datasource=github-releases depName=frederikemmer/MediaLyze
-appVersion: 0.3.0
+appVersion: 0.4.0

clusters/cl01tl/helm/medialyze/values.yaml

@@ -9,7 +9,7 @@ medialyze:
         main:
           image:
             repository: ghcr.io/frederikemmer/medialyze
-            tag: 0.3.0
+            tag: 0.4.0
             pullPolicy: IfNotPresent
           env:
             - name: HOST_PORT

clusters/cl01tl/helm/movie-roulette/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     version: 4.6.2
 icon: https://raw.githubusercontent.com/sahara101/Movie-Roulette/refs/heads/main/static/icons/icon.png
 # renovate: datasource=github-releases depName=sahara101/Movie-Roulette
-appVersion: v5.3.0
+appVersion: v5.4.0

clusters/cl01tl/helm/movie-roulette/values.yaml

@@ -9,7 +9,7 @@ movie-roulette:
         main:
           image:
             repository: ghcr.io/sahara101/movie-roulette
-            tag: v5.3.0
+            tag: v5.4.0
             pullPolicy: IfNotPresent
           env:
             - name: FLASK_SECRET_KEY

clusters/cl01tl/helm/music-grabber/Chart.yaml

@@ -17,4 +17,5 @@ dependencies:
     alias: music-grabber
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
-appVersion: 2.0.4
+# renovate: datasource=docker depName=g33kphr33k/musicgrabber
+appVersion: 2.5.3

clusters/cl01tl/helm/music-grabber/values.yaml

@@ -9,7 +9,7 @@ music-grabber:
         main:
           image:
             repository: g33kphr33k/musicgrabber
-            tag: 2.5.2
+            tag: 2.5.3
             pullPolicy: IfNotPresent
           env:
             - name: MUSIC_DIR

clusters/cl01tl/helm/ntfy/Chart.yaml

@@ -20,4 +20,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ntfy.png
 # renovate: datasource=github-releases depName=binwiederhier/ntfy
-appVersion: 2.20.0
+appVersion: 2.20.1

clusters/cl01tl/helm/ntfy/values.yaml

@@ -9,7 +9,7 @@ ntfy:
         main:
           image:
             repository: binwiederhier/ntfy
-            tag: v2.20.0
+            tag: v2.20.1
             pullPolicy: IfNotPresent
           args: ["serve"]
           env:

clusters/cl01tl/helm/ollama/Chart.yaml

@@ -31,4 +31,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ollama.png
 # renovate: datasource=github-releases depName=ollama/ollama
-appVersion: 0.18.3
+appVersion: 0.19.0

clusters/cl01tl/helm/ollama/values.yaml

@@ -22,7 +22,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.18.3
+            tag: 0.19.0
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE
@@ -58,7 +58,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.18.3
+            tag: 0.19.0
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE
@@ -94,7 +94,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.18.3
+            tag: 0.19.0
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE
@@ -117,7 +117,7 @@ ollama:
         main:
           image:
             repository: ghcr.io/open-webui/open-webui
-            tag: v0.8.10
+            tag: v0.8.12
             pullPolicy: IfNotPresent
           env:
             - name: ENV

clusters/cl01tl/helm/postiz/values.yaml

@@ -9,7 +9,7 @@ postiz:
         main:
           image:
             repository: ghcr.io/gitroomhq/postiz-app
-            tag: v2.21.0
+            tag: v2.21.4
             pullPolicy: IfNotPresent
           env:
             - name: MAIN_URL

clusters/cl01tl/helm/rybbit/Chart.yaml

@@ -31,4 +31,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/rybbit.webp
 # renovate: datasource=github-releases depName=rybbit-io/rybbit
-appVersion: v2.4.0
+appVersion: v2.5.0

clusters/cl01tl/helm/rybbit/values.yaml

@@ -9,7 +9,7 @@ rybbit:
         main:
           image:
             repository: ghcr.io/rybbit-io/rybbit-backend
-            tag: v2.4.0
+            tag: v2.5.0
             pullPolicy: IfNotPresent
           env:
             - name: NODE_ENV
@@ -122,7 +122,7 @@ rybbit:
         main:
           image:
             repository: clickhouse/clickhouse-server
-            tag: 26.2.5
+            tag: 26.3.2
             pullPolicy: IfNotPresent
           env:
             - name: CLICKHOUSE_DB

clusters/cl01tl/helm/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:032eec8dcd3799007059d0753e9d04837fc8dba8d8b749a08469118a8039b703
+            tag: latest@sha256:4d7ed8b7035ecf827bd901ba6d32f5c32d8119bc09bb3cdafeb0ce58f1b951c1
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -39,7 +39,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:032eec8dcd3799007059d0753e9d04837fc8dba8d8b749a08469118a8039b703
+            tag: latest@sha256:4d7ed8b7035ecf827bd901ba6d32f5c32d8119bc09bb3cdafeb0ce58f1b951c1
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL

clusters/cl01tl/helm/site-documentation/values.yaml

@@ -11,7 +11,7 @@ site-documentation:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-documentation
-            tag: 0.11.0
+            tag: 0.12.0
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/tailscale-operator/Chart.yaml

@@ -21,4 +21,4 @@ dependencies:
     repository: https://pkgs.tailscale.com/helmcharts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tailscale-light.png
 # renovate: datasource=github-releases depName=tailscale/tailscale
-appVersion: v1.96.3
+appVersion: v1.96.4

clusters/cl01tl/helm/tdarr/values.yaml

@@ -39,9 +39,28 @@ tdarr:
               cpu: 200m
               memory: 1Gi
     node:
-      type: daemonset
+      type: statefulset
+      replicas: 3
       revisionHistoryLimit: 3
+      statefulset:
+        volumeClaimTemplates:
+          - name: transcode-cache
+            accessMode: ReadWriteOnce
+            size: 20Gi
+            storageClass: local-path
+            globalMounts:
+              - path: /tcache
       pod:
+        affinity:
+          podAntiAffinity:
+            requiredDuringSchedulingIgnoredDuringExecution:
+              - labelSelector:
+                  matchExpressions:
+                    - key: app.kubernetes.io/instance
+                      operator: In
+                      values:
+                        - tdarr
+                topologyKey: kubernetes.io/hostname
         nodeSelector:
           intel.feature.node.kubernetes.io/gpu: "true"
       containers:
@@ -144,13 +163,6 @@ tdarr:
           main:
             - path: /tcache
               readOnly: false
-    node-cache:
-      type: emptyDir
-      advancedMounts:
-        node:
-          main:
-            - path: /tcache
-              readOnly: false
     media:
       existingClaim: tdarr-nfs-storage
       advancedMounts:
@@ -166,7 +178,7 @@ tdarr-exporter:
   image:
     name: homeylab/tdarr-exporter
     # renovate: datasource=docker depName=homeylab/tdarr-exporter
-    tag: 1.4.2
+    tag: 1.4.3
   metrics:
     serviceMonitor:
       enabled: true

clusters/cl01tl/helm/tubearchivist/Chart.yaml

@@ -26,4 +26,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tube-archivist.png
 # renovate: datasource=github-releases depName=tubearchivist/tubearchivist
-appVersion: v0.5.9
+appVersion: v0.5.10

clusters/cl01tl/helm/tubearchivist/values.yaml

@@ -9,7 +9,7 @@ tubearchivist:
         main:
           image:
             repository: bbilly1/tubearchivist
-            tag: v0.5.9
+            tag: v0.5.10
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/unpoller/Chart.yaml

@@ -21,4 +21,4 @@ dependencies:
     version: 4.6.2
 icon: https://camo.githubusercontent.com/c5d07a5b3acfeac8e1c25bf56f440ffe032b86e4e7f15de82357f022a43fc927/68747470733a2f2f756e706f6c6c65722e636f6d2f696d672f6c6f676f2e706e67
 # renovate: datasource=github-releases depName=unpoller/unpoller
-appVersion: v2.38.0
+appVersion: v2.39.0

clusters/cl01tl/helm/unpoller/values.yaml

@@ -9,7 +9,7 @@ unpoller:
         main:
           image:
             repository: ghcr.io/unpoller/unpoller
-            tag: v2.38.0
+            tag: v2.39.0
             pullPolicy: IfNotPresent
           env:
             - name: UP_UNIFI_CONTROLLER_0_SAVE_ALARMS

clusters/cl01tl/helm/whodb/Chart.yaml

@@ -20,4 +20,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/whodb.png
 # renovate: datasource=github-releases depName=clidey/whodb
-appVersion: 0.101.0
+appVersion: 0.103.0

clusters/cl01tl/helm/whodb/values.yaml

@@ -8,7 +8,7 @@ whodb:
         main:
           image:
             repository: clidey/whodb
-            tag: 0.101.0
+            tag: 0.103.0
             pullPolicy: IfNotPresent
           env:
             - name: WHODB_OLLAMA_HOST

hosts/ps08rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.11@sha256:acfc80650104f0194a15f73dc1648f517561bc1645391a15705332a064cfc33c
+        image: ghcr.io/traefik/traefik:v3.6.12@sha256:171c9c3565b29f6c133f1c1b43c5d4e5853415198e9e1078c001f8702ff66aec
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

hosts/ps09rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.11@sha256:acfc80650104f0194a15f73dc1648f517561bc1645391a15705332a064cfc33c
+        image: ghcr.io/traefik/traefik:v3.6.12@sha256:171c9c3565b29f6c133f1c1b43c5d4e5853415198e9e1078c001f8702ff66aec
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

hosts/ps10rp/homepage/compose.yaml

@@ -32,7 +32,7 @@ services:
             - /var/run/docker.sock:/var/run/docker.sock:ro
 
     homepage:
-        image: ghcr.io/gethomepage/homepage:v1.11.0@sha256:b129cb0f674bd6d204e215bde2c2fc3f11d6ad0e82f6d20007cf80f74e1acbb1
+        image: ghcr.io/gethomepage/homepage:v1.12.1@sha256:9627769818fbfb14147d3e633e57cef9c27c0c5f07585f5a1d6c3d3425b3b33c
         container_name: homepage
         labels:
             traefik.enable: true

hosts/ps10rp/traefik/compose.yaml

@@ -20,7 +20,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.11@sha256:acfc80650104f0194a15f73dc1648f517561bc1645391a15705332a064cfc33c
+        image: ghcr.io/traefik/traefik:v3.6.12@sha256:171c9c3565b29f6c133f1c1b43c5d4e5853415198e9e1078c001f8702ff66aec
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

renovate.json

@@ -3,40 +3,40 @@
   "extends": [
     "config:recommended",
     "mergeConfidence:all-badges",
-    ":rebaseStalePrs",
+    ":rebaseStalePrs"
-    "group:recommended",
-    "group:monorepos",
-    "group:kubernetesMonorepo"
   ],
   "timezone": "America/Chicago",
   "labels": [],
   "prHourlyLimit": 0,
   "prConcurrentLimit": 0,
   "pinDigests": true,
+  "minimumReleaseAgeBehaviour": "timestamp-optional",
   "baseBranchPatterns": [
     "main"
   ],
   "customManagers": [
     {
-      "description": "Update appVersion in Chart.yaml",
+      "description": "Renovate tag matcher for Helm chart appVersion",
       "customType": "regex",
       "managerFilePatterns": [
         "/(^|/)Chart\\.yaml$/"
       ],
       "matchStrings": [
-        "#\\s*renovate:\\s*datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+appVersion:\\s*[\"']?(?<currentValue>[^\"'\\s]+)[\"']?"
+        "#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)(?:\\s+versioning=(?<versioning>\\S+))?\\s+appVersion:\\s*[\"']?(?<currentValue>[^\\s\"']+)[\"']?"
       ],
       "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver-coerced{{/if}}"
     },
     {
-      "description": "Update images in templates",
+      "description": "Renovate tag matcher for Helm values and templates",
       "customType": "regex",
       "managerFilePatterns": [
+        "/(^|/)values\\.yaml$/",
         "/(^|/)templates/.*\\.yaml$/"
       ],
       "matchStrings": [
-        "# renovate: datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)\\s+tag:\\s*[\"']?(?<currentValue>[^@\"'\\s\n]+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?[\"']?"
+        "#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)(?:\\s+versioning=(?<versioning>\\S+))?\\s+tag:\\s*[\"']?(?<currentValue>[^@\\s\"']+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?[\"']?"
-      ]
+      ],
+      "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}docker{{/if}}"
     },
     {
       "description": "Update Helm CLI version in GitHub Actions",
@@ -74,25 +74,48 @@
       "enabled": false
     },
     {
-      "description": "Versioning for LinuxServer images",
+      "description": "Label Helm updates",
-      "versioning": "regex:^v?(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-ls(?<revision>\\d+)$",
+      "matchDatasources": [
-      "matchPackageNames": [
+        "helm"
-        "/^linuxserver\\//",
+      ],
-        "/^ghcr\\.io/linuxserver\\//",
+      "addLabels": [
-        "/^lscr\\.io/linuxserver\\//"
+        "helm"
       ]
     },
     {
-      "description": "Label by datasource",
+      "description": "Label Docker updates",
       "matchDatasources": [
-        "helm",
+        "docker"
-        "docker",
-        "github-actions"
       ],
       "addLabels": [
-        "{{{datasource}}}"
+        "docker"
-      ],
+      ]
-      "automerge": false
+    },
+    {
+      "description": "Versioning for LinuxServer images",
+      "versioning": "regex:^v?(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-ls(?<revision>\\d+)$",
+      "matchPackageNames": [
+        "/^linuxserver//",
+        "/^ghcr\\.io/linuxserver//",
+        "/^lscr\\.io/linuxserver//"
+      ]
+    },
+    {
+      "description": "Group packages together by stripping all registry/namespace prefixes",
+      "groupName": "{{#if packageName}}{{{replace '^.*/([^/]+)$' '$1' packageName}}}{{else}}{{{replace '^.*/([^/]+)$' '$1' depName}}}{{/if}}",
+      "groupSlug": "unified-{{{groupName}}}",
+      "matchPackageNames": [
+        "*"
+      ]
+    },
+    {
+      "description": "Group for specific apps, these have different package and repo names",
+      "groupName": "{{{replace '^.*(argo-cd|bazarr|cilium|code-server|dawarich|element-web|home-assistant|immich|komodo|postiz|rook-ceph|roundcube|rybbit|tdarr|traefik).*$' '$1' depName}}}",
+      "groupSlug": "unified-{{{groupName}}}",
+      "matchPackageNames": [
+        "/(^|/)(argo-cd|bazarr|cilium|code-server|dawarich|element-web|home-assistant|immich|komodo|postiz|rook-ceph|roundcube|rybbit|tdarr|traefik)/",
+        "/^rook(-ceph|/rook|/ceph)/"
+      ]
     },
     {
       "description": "Automerge helm chart lock files",
@@ -103,91 +126,12 @@
         "enabled": true
       },
       "addLabels": [
+        "{{{datasource}}}",
         "automerge"
       ],
       "automerge": true,
       "automergeType": "branch"
     },
-    {
-      "description": "Automerge patches",
-      "matchUpdateTypes": [
-        "patch",
-        "pinDigest"
-      ],
-      "matchDatasources": [
-        "helm",
-        "docker",
-        "github-actions"
-      ],
-      "addLabels": [
-        "automerge"
-      ],
-      "automerge": true,
-      "minimumReleaseAge": "1 days"
-    },
-    {
-      "description": "Label appVersion and images, grouped",
-      "matchManagers": [
-        "custom.regex",
-        "helm-values"
-      ],
-      "groupName": "{{#if packageName}}{{{replace 'ghcr.io/' '' (replace 'docker.io/' '' packageName)}}}{{else}}{{{replace 'ghcr.io/' '' (replace 'docker.io/' '' depName)}}}{{/if}}",
-      "groupSlug": "unified-{{{groupName}}}",
-      "addLabels": [
-        "docker"
-      ],
-      "automerge": false
-    },
-    {
-      "description": "Automerge appVersion and images, grouped",
-      "matchUpdateTypes": [
-        "patch",
-        "pinDigest"
-      ],
-      "matchManagers": [
-        "custom.regex",
-        "helm-values"
-      ],
-      "groupName": "{{#if packageName}}{{{replace 'ghcr.io/' '' (replace 'docker.io/' '' packageName)}}}{{else}}{{{replace 'ghcr.io/' '' (replace 'docker.io/' '' depName)}}}{{/if}}",
-      "groupSlug": "unified-{{{groupName}}}",
-      "addLabels": [
-        "automerge"
-      ],
-      "automerge": true,
-      "minimumReleaseAge": "1 days"
-    },
-    {
-      "description": "Group apps by their keyword",
-      "groupName": "{{{replace '^.*(dawarich|komodo|immich|home-assistant|element-web|cilium|tdarr|argo-cd|traefik).*$' '$1' depName}}}",
-      "groupSlug": "unified-{{{groupName}}}",
-      "matchPackageNames": [
-        "/(^|/)(?<appName>dawarich|komodo|immich|home-assistant|element-web|cilium|tdarr|argo-cd|traefik)/"
-      ]
-    },
-    {
-      "description": "Group Bazarr dependencies",
-      "groupName": "bazarr",
-      "groupSlug": "unified-bazarr",
-      "matchPackageNames": [
-        "bazarr$"
-      ]
-    },
-    {
-      "description": "Group Code Server dependencies",
-      "groupName": "code-server",
-      "groupSlug": "unified-code-server",
-      "matchPackageNames": [
-        "code-server$"
-      ]
-    },
-    {
-      "description": "Group Rook-Ceph dependencies",
-      "groupName": "rook-ceph",
-      "groupSlug": "unified-rook-ceph",
-      "matchPackageNames": [
-        "/^rook(-ceph|\\/rook|\\/ceph)/"
-      ]
-    },
     {
       "description": "Open for digest updates, specific packages",
       "matchUpdateTypes": [
@@ -203,35 +147,46 @@
       "matchUpdateTypes": [
         "digest"
       ],
-      "matchDatasources": [
-        "docker"
-      ],
       "matchPackageNames": [
         "searxng/searxng"
       ],
       "addLabels": [
+        "{{{datasource}}}",
         "automerge"
       ],
       "enabled": true,
       "automerge": true
     },
     {
-      "description": "Automerge images, specific packages",
+      "description": "Automerge patches",
       "matchUpdateTypes": [
         "patch",
-        "minor"
+        "pinDigest"
       ],
-      "matchDatasources": [
+      "addLabels": [
-        "docker"
+        "{{{datasource}}}",
+        "automerge"
+      ],
+      "automerge": true,
+      "minimumReleaseAge": "3 days"
+    },
+    {
+      "description": "Automerge images, specific packages",
+      "matchUpdateTypes": [
+        "minor",
+        "patch",
+        "pinDigest"
       ],
       "matchPackageNames": [
         "ghcr.io/renovatebot/renovate",
         "ghcr.io/prometheus-community/charts/kube-prometheus-stack"
       ],
       "addLabels": [
+        "{{{datasource}}}",
         "automerge"
       ],
-      "automerge": true
+      "automerge": true,
+      "minimumReleaseAge": "3 days"
     }
   ]
 }