chore(deps): update valkey docker tag to v0.5.0

Reviewed-on: #5281

.gitea/workflows/renovate.yaml

@@ -13,7 +13,7 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.96.0@sha256:41af2f21008f8f5785833277ac951b4f44e936b61394dc7edccdc0fe09e59132
+    container: ghcr.io/renovatebot/renovate:43.100.0@sha256:1188aeae54f7f2103a9dcea554316efde65eb4221793bcee5a0b29772e16aed3
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

clusters/cl01tl/helm/argocd/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 9.4.16
+  version: 9.4.17
-digest: sha256:f9ecc47369d4401df61c17f55cc59c9b2d4543f57cf122653abb1a27a4f7bf35
+digest: sha256:17752dbf03861cf70ee31c9a17373a5175656a2edd00ba5fcd3988a195147da8
-generated: "2026-03-26T21:01:52.678525211Z"
+generated: "2026-03-28T01:51:34.832601868Z"

clusters/cl01tl/helm/argocd/Chart.yaml

@@ -13,8 +13,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 9.4.16
+    version: 9.4.17
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-cd
-appVersion: v3.3.5
+appVersion: v3.3.6

clusters/cl01tl/helm/authentik/Chart.lock

@@ -10,6 +10,6 @@ dependencies:
   version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
-digest: sha256:8c353c5dad4c3d04d518c1445497f0d1cb64261a4201ae17a2c0874454b807a7
+digest: sha256:61594c78fbb79aca6131bfc07805050e47c7999ce9bbca6283c30530f7695d44
-generated: "2026-03-15T20:04:35.99407071Z"
+generated: "2026-03-30T09:10:21.577832264Z"

clusters/cl01tl/helm/authentik/Chart.yaml

@@ -29,7 +29,7 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/authentik.png
 # renovate: datasource=github-releases depName=goauthentik/authentik

clusters/cl01tl/helm/blocky/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 4.6.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
-digest: sha256:a5b0099261d772b24a302a106d106cfa82ac07fa14564141e00cf107d708e859
+digest: sha256:49b0e666059bad492ebaa4a20119ce5bbd1959a1ee6b22b271a9ca9529122697
-generated: "2026-03-09T23:06:16.853255429Z"
+generated: "2026-03-30T09:10:34.725227438Z"

clusters/cl01tl/helm/blocky/Chart.yaml

@@ -20,7 +20,7 @@ dependencies:
     version: 4.6.2
   - name: valkey
     alias: valkey
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/blocky.png
 # renovate: datasource=github-releases depName=0xerr0r/blocky

clusters/cl01tl/helm/cert-manager/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: cert-manager
   repository: https://charts.jetstack.io
-  version: v1.20.0
+  version: v1.20.1
-digest: sha256:1543bd17649cb32982de3cce017fcbed1b44c41d50b76c6471b266f33e261c29
+digest: sha256:1bf36eba44cf096b40355a697b8cffb302f07f9135374222aabdf686f017b7a9
-generated: "2026-03-10T16:06:49.332999536Z"
+generated: "2026-03-28T01:35:24.542754563Z"

clusters/cl01tl/helm/cert-manager/Chart.yaml

@@ -13,8 +13,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: cert-manager
-    version: v1.20.0
+    version: v1.20.1
     repository: https://charts.jetstack.io
 icon: https://raw.githubusercontent.com/cert-manager/cert-manager/refs/heads/master/logo/logo.png
 # renovate: datasource=github-releases depName=cert-manager/cert-manager
-appVersion: v1.20.0
+appVersion: v1.20.1

clusters/cl01tl/helm/code-server/values.yaml

@@ -28,7 +28,7 @@ code-server:
           resources:
             requests:
               cpu: 1m
-              memory: 50Mi
+              memory: 40Mi
   service:
     main:
       controller: main

clusters/cl01tl/helm/dawarich/Chart.lock

@@ -7,6 +7,6 @@ dependencies:
   version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
-digest: sha256:7584c2a1613454bbd83b66df46170fd0157df5186842844d483e2dd131398574
+digest: sha256:8db0a7a2ef774f3a729378cb84ee16c8ca929906c4de33572fdaa06c062a5066
-generated: "2026-03-15T20:04:49.68456485Z"
+generated: "2026-03-30T09:10:45.699536601Z"

clusters/cl01tl/helm/dawarich/Chart.yaml

@@ -25,7 +25,7 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/dawarich.png
 # renovate: datasource=github-releases depName=Freika/dawarich

clusters/cl01tl/helm/directus/Chart.lock

@@ -7,6 +7,6 @@ dependencies:
   version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
-digest: sha256:dfcb5d35e03ecdc4206227d206d36509319f0dcdaed54363840d71337debb3f7
+digest: sha256:5547185ded7e1416cb9b3142bc997f176622633437f68607f8b17359fcd032a0
-generated: "2026-03-15T20:05:03.156596646Z"
+generated: "2026-03-30T09:10:56.808307166Z"

clusters/cl01tl/helm/directus/Chart.yaml

@@ -25,7 +25,7 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/directus.png
 # renovate: datasource=github-releases depName=directus/directus

clusters/cl01tl/helm/directus/values.yaml

@@ -143,7 +143,7 @@ directus:
           resources:
             requests:
               cpu: 10m
-              memory: 1Gi
+              memory: 300Mi
   service:
     main:
       controller: main

clusters/cl01tl/helm/foldergram/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
 # renovate: datasource=github-releases depName=foldergram/foldergram
-appVersion: v1.0.8
+appVersion: v1.0.9

clusters/cl01tl/helm/foldergram/values.yaml

@@ -12,7 +12,7 @@ foldergram:
         main:
           image:
             repository: ghcr.io/foldergram/foldergram
-            tag: 1.0.8@sha256:3546dc1da4ec12cb27aaecbf77896d708ac7601eb0225e0f6e181d7ef35273f9
+            tag: 1.0.9@sha256:aa6707e7456386f2d74b8f2769d0281f4127d1276349583b8531dbaa8f844883
             pullPolicy: IfNotPresent
           env:
             - name: IMAGE_DETAIL_SOURCE

clusters/cl01tl/helm/freshrss/values.yaml

@@ -79,7 +79,7 @@ freshrss:
           resources:
             requests:
               cpu: 1m
-              memory: 128Mi
+              memory: 100Mi
   service:
     main:
       controller: main

clusters/cl01tl/helm/garage/values.yaml

@@ -28,7 +28,7 @@ garage:
           resources:
             requests:
               cpu: 10m
-              memory: 400Mi
+              memory: 200Mi
     server-2:
       type: deployment
       replicas: 1
@@ -57,7 +57,7 @@ garage:
           resources:
             requests:
               cpu: 10m
-              memory: 400Mi
+              memory: 200Mi
     server-3:
       type: deployment
       replicas: 1
@@ -86,7 +86,7 @@ garage:
           resources:
             requests:
               cpu: 10m
-              memory: 400Mi
+              memory: 200Mi
     webui:
       type: deployment
       replicas: 1

clusters/cl01tl/helm/gitea/Chart.lock

@@ -16,12 +16,12 @@ dependencies:
   version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:49862b06fe4884f504d0a892cb899f577262b584053b64a3504bacaf96d70f39
+digest: sha256:bca8d860ce3d102b9e0ea1e645aa32dc38a1fc73823376c10cbeb018e5415325
-generated: "2026-03-26T20:59:30.690577-05:00"
+generated: "2026-03-30T09:11:09.830261156Z"

clusters/cl01tl/helm/gitea/Chart.yaml

@@ -43,11 +43,11 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-gitea
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-renovate
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-storage

clusters/cl01tl/helm/grafana-operator/Chart.lock

@@ -7,9 +7,9 @@ dependencies:
   version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
-digest: sha256:a3bf183bcecb4d4b5354fe91a549075997dccb41c193da9daec9ccbe4d659fe2
+digest: sha256:1924dca439d3a8c9c5bd31a4b8602011a37e913d8c1ad7550cad817eb7470951
-generated: "2026-03-18T10:04:15.165729555Z"
+generated: "2026-03-30T09:11:27.754217765Z"

clusters/cl01tl/helm/grafana-operator/Chart.yaml

@@ -5,14 +5,13 @@ description: Grafana Operator
 keywords:
   - grafana-operator
   - dashboard
-  - metrics
+home: https://docs.alexlebens.dev/applications/grafana-operator/
-  - logs
-home: https://wiki.alexlebens.dev/s/3e5723e1-2ab7-45ab-b496-b8854907fa39
 sources:
   - https://github.com/grafana/grafana-operator
-  - https://github.com/cloudnative-pg/cloudnative-pg
+  - https://github.com/grafana/grafana/pkgs/container/grafana%2Fgrafana
   - https://github.com/grafana/grafana-operator/tree/master/deploy/helm/grafana-operator
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
 maintainers:
   - name: alexlebens
 dependencies:
@@ -25,11 +24,11 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-unified-alerting
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-remote-cache
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grafana.png
 # renovate: datasource=github-releases depName=grafana/grafana-operator

clusters/cl01tl/helm/grafana-operator/templates/external-secret.yaml

@@ -14,17 +14,11 @@ spec:
   data:
     - secretKey: admin-user
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/grafana/auth
-        metadataPolicy: None
         property: admin-user
     - secretKey: admin-password
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/grafana/auth
-        metadataPolicy: None
         property: admin-password
 
 ---
@@ -44,17 +38,11 @@ spec:
   data:
     - secretKey: AUTH_CLIENT_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/grafana
-        metadataPolicy: None
         property: client
     - secretKey: AUTH_CLIENT_SECRET
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/grafana
-        metadataPolicy: None
         property: secret
 
 ---
@@ -74,17 +62,11 @@ spec:
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
         property: access
     - secretKey: ACCESS_SECRET_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
         property: secret
 
 ---
@@ -104,22 +86,13 @@ spec:
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: ACCESS_SECRET_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
     - secretKey: ACCESS_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
         property: ACCESS_REGION

clusters/cl01tl/helm/grafana-operator/templates/grafana-dashboard.yaml

@@ -11,9 +11,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/ceph.json
 
 ---
@@ -30,9 +30,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/coredns.json
 
 ---
@@ -49,9 +49,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/etcd.json
 
 ---
@@ -68,9 +68,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/garage.json
 
 ---
@@ -87,9 +87,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/loki.json
 
 ---
@@ -106,9 +106,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/node-full.json
 
 ---
@@ -125,9 +125,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/node-short.json
 
 ---
@@ -144,9 +144,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/pods.json
 
 ---
@@ -163,9 +163,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/argocd.json
 
 ---
@@ -182,9 +182,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/blocky.json
 
 ---
@@ -201,9 +201,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/cert-manager.json
 
 ---
@@ -220,9 +220,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/cloudnative-pg.json
 
 ---
@@ -239,9 +239,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/descheduler.json
 
 ---
@@ -258,9 +258,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/gatus.json
 
 ---
@@ -277,9 +277,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/grafana-operator.json
 
 ---
@@ -296,9 +296,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/harbor.json
 
 ---
@@ -315,9 +315,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/speedtest-exporter.json
 
 ---
@@ -334,9 +334,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/spegel.json
 
 ---
@@ -353,9 +353,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/traefik.json
 
 ---
@@ -372,9 +372,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/tdarr.json
 
 ---
@@ -391,9 +391,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/unpoller.json
 
 ---
@@ -410,9 +410,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/volsync.json
 
 ---
@@ -429,9 +429,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/s3.json
 
 ---
@@ -448,9 +448,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/authentik.json
 
 ---
@@ -467,9 +467,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/gitea.json
 
 ---
@@ -486,9 +486,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/ntfy.json
 
 ---
@@ -505,9 +505,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/qbittorrent.json
 
 ---
@@ -524,9 +524,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/vault.json
 
 ---
@@ -543,9 +543,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-iot
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/iot/airgradient.json
 
 ---
@@ -562,9 +562,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-iot
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/iot/server-power-consumption.json
 
 ---
@@ -581,9 +581,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-application
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/immich.json
 
 ---
@@ -600,9 +600,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-application
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/jellyfin.json
 
 ---
@@ -619,9 +619,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-application
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/radarr.json
 
 ---
@@ -638,7 +638,7 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-application
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/sonarr.json

clusters/cl01tl/helm/grafana-operator/templates/grafana.yaml

@@ -56,11 +56,12 @@ spec:
         spec:
           containers:
             - name: grafana
-              image: grafana/grafana:12.0.0
+              # renovate: datasource=docker depName=grafana/grafana
+              image: grafana/grafana:12.4.2@sha256:83749231c3835e390a3144e5e940203e42b9589761f20ef3169c716e734ad505
               resources:
                 requests:
-                  cpu: 100m
+                  cpu: 20m
-                  memory: 128Mi
+                  memory: 150Mi
               env:
                 - name: AUTH_CLIENT_ID
                   valueFrom:
@@ -107,3 +108,12 @@ spec:
                     secretKeyRef:
                       name: grafana-operator-postgresql-18-cluster-app
                       key: password
+  httpRoute:
+    spec:
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - grafana.alexlebens.net

clusters/cl01tl/helm/grafana-operator/templates/http-route.yaml

@@ -1,28 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: grafana
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: grafana
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-  hostnames:
-    - grafana.alexlebens.net
-  rules:
-    - matches:
-      - path:
-          type: PathPrefix
-          value: /
-      backendRefs:
-        - group: ''
-          kind: Service
-          name: grafana-main-service
-          port: 3000
-          weight: 100

clusters/cl01tl/helm/grafana-operator/values.yaml

@@ -1,17 +1,11 @@
 grafana-operator:
   replicas: 2
-  serviceAccount:
-    create: true
-  rbac:
-    create: true
   resources:
     requests:
-      cpu: 10m
+      cpu: 1m
-      memory: 64Mi
+      memory: 50Mi
   serviceMonitor:
     enabled: true
-  dashboard:
-    enabled: false
 postgres-18-cluster:
   mode: recovery
   recovery:
@@ -25,35 +19,12 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
-      # - name: garage-remote
-      #   index: 1
-      #   destinationBucket: postgres-backups
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   retentionPolicy: "90d"
-      #   data:
-      #     compression: bzip2
-      # - name: external
-      #   index: 1
-      #   endpointURL: https://nyc3.digitaloceanspaces.com
-      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 30 14 * * *"
         backupName: garage-local
-      # - name: weekly-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 4 * * SAT"
-      #   backupName: garage-remote
-      # - name: daily-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 0 * * *"
-      #   backupName: external
 valkey-unified-alerting:
   valkey:
     nameOverride: valkey-unified-alerting

clusters/cl01tl/helm/harbor/Chart.lock

@@ -7,6 +7,6 @@ dependencies:
   version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
-digest: sha256:e7a5cee56dddb4abc07ff18677cb6ddf55571b38da2eeb7e654e8ad8f7709bfa
+digest: sha256:7c558ba0072be3d383ea0368ef7822f26c91f0cb5ea22f1f09087cc694613010
-generated: "2026-03-19T04:16:54.362332682Z"
+generated: "2026-03-30T09:11:43.388033712Z"

clusters/cl01tl/helm/harbor/Chart.yaml

@@ -4,15 +4,14 @@ version: 1.0.0
 description: Harbor
 keywords:
   - harbor
-  - images
+  - image-registry
-  - cache
+home: https://docs.alexlebens.dev/applications/harbor/
-  - kubernetes
-home: https://wiki.alexlebens.dev/s/7e132c13-afee-48ec-b3dd-efd656d240c9
 sources:
   - https://github.com/goharbor
-  - https://github.com/cloudnative-pg/cloudnative-pg
+  - https://github.com/orgs/goharbor/packages
   - https://github.com/goharbor/harbor-helm
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
 maintainers:
   - name: alexlebens
 dependencies:
@@ -25,7 +24,7 @@ dependencies:
     repository: https://gitea.alexlebens.net/api/packages/alexlebens/helm
   - name: valkey
     alias: valkey
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/harbor.png
 # renovate: datasource=github-releases depName=goharbor/harbor

clusters/cl01tl/helm/harbor/templates/external-secret.yaml

@@ -14,85 +14,49 @@ spec:
   data:
     - secretKey: HARBOR_ADMIN_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/config
-        metadataPolicy: None
         property: admin-password
     - secretKey: secretKey
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/config
-        metadataPolicy: None
         property: secretKey
     - secretKey: CSRF_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/core
-        metadataPolicy: None
         property: CSRF_KEY
     - secretKey: secret
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/core
-        metadataPolicy: None
         property: secret
     - secretKey: tls.crt
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/core
-        metadataPolicy: None
         property: tls.crt
     - secretKey: tls.key
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/core
-        metadataPolicy: None
         property: tls.key
     - secretKey: JOBSERVICE_SECRET
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/jobservice
-        metadataPolicy: None
         property: JOBSERVICE_SECRET
     - secretKey: REGISTRY_HTTP_SECRET
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/registry
-        metadataPolicy: None
         property: REGISTRY_HTTP_SECRET
     - secretKey: REGISTRY_REDIS_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/registry
-        metadataPolicy: None
         property: REGISTRY_REDIS_PASSWORD
     - secretKey: REGISTRY_HTPASSWD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/registry
-        metadataPolicy: None
         property: REGISTRY_HTPASSWD
     - secretKey: REGISTRY_CREDENTIAL_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/registry
-        metadataPolicy: None
         property: REGISTRY_CREDENTIAL_PASSWORD
     - secretKey: REGISTRY_PASSWD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/harbor/registry
-        metadataPolicy: None
         property: REGISTRY_CREDENTIAL_PASSWORD

clusters/cl01tl/helm/harbor/values.yaml

@@ -21,13 +21,9 @@ harbor:
         size: 100Gi
   existingSecretAdminPassword: harbor-secret
   existingSecretAdminPasswordKey: HARBOR_ADMIN_PASSWORD
-  internalTLS:
-    enabled: false
   ipFamily:
     ipv6:
       enabled: false
-    ipv4:
-      enabled: true
   updateStrategy:
     type: Recreate
   existingSecretSecretKey: harbor-secret
@@ -73,12 +69,12 @@ harbor:
     credentials:
       existingSecret: harbor-secret
     upload_purging:
-      enabled: true
       age: 72h
-      interval: 24h
-      dryrun: false
   trivy:
     enabled: true
+    image:
+      repository: ghcr.io/goharbor/trivy-adapter-photon
+      tag: v2.15.0@sha256:6fd6de9cfbbb04cb1d94722cfa01cf71b8994d3f9e7891d3b03a89a7536480ba
   database:
     type: external
     external:
@@ -109,32 +105,9 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
-      # - name: garage-remote
-      #   index: 1
-      #   destinationBucket: postgres-backups
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   retentionPolicy: "90d"
-      #   data:
-      #     compression: bzip2
-      # - name: external
-      #   index: 1
-      #   endpointURL: https://nyc3.digitaloceanspaces.com
-      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 35 14 * * *"
         backupName: garage-local
-      # - name: weekly-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 4 * * SAT"
-      #   backupName: garage-remote
-      # - name: daily-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 0 * * *"
-      #   backupName: external

clusters/cl01tl/helm/headlamp/Chart.yaml

@@ -5,8 +5,7 @@ description: Headlamp
 keywords:
   - headlamp
   - dashboard
-  - kubernetes
+home: https://docs.alexlebens.dev/applications/headlamp/
-home: https://wiki.alexlebens.dev/s/6cc43960-78df-459d-aab6-433844249243
 sources:
   - https://github.com/headlamp-k8s/headlamp
   - https://github.com/headlamp-k8s/headlamp/tree/main/charts/headlamp

clusters/cl01tl/helm/headlamp/templates/external-secret.yaml

@@ -14,43 +14,25 @@ spec:
   data:
     - secretKey: OIDC_CLIENT_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/headlamp
-        metadataPolicy: None
         property: client
     - secretKey: OIDC_CLIENT_SECRET
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/headlamp
-        metadataPolicy: None
         property: secret
     - secretKey: OIDC_ISSUER_URL
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/headlamp
-        metadataPolicy: None
         property: issuer
     - secretKey: OIDC_SCOPES
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/headlamp
-        metadataPolicy: None
         property: scopes
     - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_IDP_ISSUER_URL
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/headlamp
-        metadataPolicy: None
         property: validator-issuer-url
     - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_CLIENT_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/headlamp
-        metadataPolicy: None
         property: validator-client-id

clusters/cl01tl/helm/headlamp/templates/http-route.yaml

@@ -1,28 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: headlamp
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: headlamp
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-  hostnames:
-    - headlamp.alexlebens.net
-  rules:
-    - matches:
-      - path:
-          type: PathPrefix
-          value: /
-      backendRefs:
-        - group: ''
-          kind: Service
-          name: headlamp
-          port: 80
-          weight: 100

clusters/cl01tl/helm/headlamp/values.yaml

@@ -1,5 +1,9 @@
 headlamp:
   replicaCount: 2
+  image:
+    registry: ghcr.io
+    repository: headlamp-k8s/headlamp
+    tag: v0.41.0@sha256:89c6c65810bfde61796483c93c70d659104355593792bf55cab680d685da8eeb
   config:
     oidc:
       secret:
@@ -10,10 +14,30 @@ headlamp:
     watchPlugins: true
     # Bypasses: https://github.com/kubernetes-sigs/headlamp/issues/4883
     sessionTTL: null
+  httpRoute:
+    enabled: true
+    parentRefs:
+      - group: gateway.networking.k8s.io
+        kind: Gateway
+        name: traefik-gateway
+        namespace: traefik
+    hostnames:
+      - headlamp.alexlebens.net
+    rules:
+      - matches:
+        - path:
+            type: PathPrefix
+            value: /
+        backendRefs:
+          - group: ''
+            kind: Service
+            name: headlamp
+            port: 80
+            weight: 100
   resources:
     requests:
-      cpu: 10m
+      cpu: 1m
-      memory: 128Mi
+      memory: 80Mi
   pluginsManager:
     enabled: true
     securityContext:

clusters/cl01tl/helm/home-assistant/Chart.yaml

@@ -4,14 +4,13 @@ version: 1.0.0
 description: Home Assistant
 keywords:
   - home-assistant
-  - home
+  - home-automation
-  - automation
+home: https://docs.alexlebens.dev/applications/home-assistant/
-home: https://wiki.alexlebens.dev/s/5462c17e-cd39-4082-ad01-94545a2fa3ca
 sources:
-  - https://www.home-assistant.io/
   - https://github.com/home-assistant/core
   - https://github.com/home-assistant/core/pkgs/container/home-assistant
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/home-assistant/templates/external-secret.yaml

@@ -14,17 +14,11 @@ spec:
   data:
     - secretKey: PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/home-assistant/code-server/auth
-        metadataPolicy: None
         property: PASSWORD
     - secretKey: SUDO_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/home-assistant/code-server/auth
-        metadataPolicy: None
         property: SUDO_PASSWORD
 
 ---
@@ -44,8 +38,5 @@ spec:
   data:
     - secretKey: bearer-token
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/home-assistant/auth
-        metadataPolicy: None
         property: bearer-token

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -4,28 +4,29 @@ home-assistant:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
+      pod:
+        securityContext:
+          fsGroup: 1000
+          fsGroupChangePolicy: OnRootMismatch
       containers:
         main:
           image:
             repository: ghcr.io/home-assistant/home-assistant
-            tag: 2026.3.4
+            tag: 2026.3.4@sha256:916682086154a7390114a9788782b8efb199852d4f7d47066722c2bc5d1829e6
-            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: US/Central
+              value: America/Chicago
           resources:
             requests:
-              cpu: 50m
+              cpu: 1m
-              memory: 512Mi
+              memory: 400Mi
         code-server:
           image:
             repository: ghcr.io/linuxserver/code-server
             tag: 4.112.0@sha256:4bb5b8ad22268001687c047f0f04933799fb03df1eb0e1e266ba15ed2d9f4e8b
-            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: US/Central
+              value: America/Chicago
             - name: PUID
               value: 1000
             - name: PGID
@@ -35,10 +36,6 @@ home-assistant:
           envFrom:
             - secretRef:
                 name: home-assistant-code-server-password-secret
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
   service:
     main:
       controller: main
@@ -82,11 +79,8 @@ home-assistant:
         - home-assistant.alexlebens.net
       rules:
         - backendRefs:
-            - group: ''
+            - name: home-assistant-main
-              kind: Service
-              name: home-assistant-main
               port: 80
-              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -102,11 +96,8 @@ home-assistant:
         - home-assistant-code-server.alexlebens.net
       rules:
         - backendRefs:
-            - group: ''
+            - name: home-assistant-code-server
-              kind: Service
-              name: home-assistant-code-server
               port: 8443
-              weight: 100
           matches:
             - path:
                 type: PathPrefix

clusters/cl01tl/helm/homepage/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/homepage.png
 # renovate: datasource=github-releases depName=gethomepage/homepage
-appVersion: v1.11.0
+appVersion: v1.12.1

clusters/cl01tl/helm/homepage/values.yaml

@@ -16,7 +16,7 @@ homepage:
         main:
           image:
             repository: ghcr.io/gethomepage/homepage
-            tag: v1.11.0
+            tag: v1.12.1
             pullPolicy: IfNotPresent
           env:
             - name: HOMEPAGE_ALLOWED_HOSTS

clusters/cl01tl/helm/houndarr/values.yaml

@@ -9,7 +9,7 @@ houndarr:
         main:
           image:
             repository: ghcr.io/av1155/houndarr
-            tag: v1.6.2
+            tag: v1.6.3
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/immich/Chart.lock

@@ -7,9 +7,9 @@ dependencies:
   version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:b79ea8c506f0172deed820247a33c79329f34426435c8b5eb27b206ac8831b13
+digest: sha256:fa48b88dd941293142c5601553f32c0d5cb1a7c193ad9be1ca3607ac4156c43b
-generated: "2026-03-15T20:06:27.091094433Z"
+generated: "2026-03-30T09:11:56.291839473Z"

clusters/cl01tl/helm/immich/Chart.yaml

@@ -24,7 +24,7 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-data

clusters/cl01tl/helm/immich/values.yaml

@@ -9,7 +9,7 @@ immich:
         main:
           image:
             repository: ghcr.io/immich-app/immich-server
-            tag: v2.6.2
+            tag: v2.6.3
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 82.15.0
+  version: 82.15.1
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.6.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
-digest: sha256:524759b57f9500d5742b962bcdb114ec556d80ec4418921c93a722e00df57647
+digest: sha256:532272c1cf1d0054ff2f0a4e728505502a1dda9f31444762def0c743a265a2c6
-generated: "2026-03-26T23:02:03.558664114Z"
+generated: "2026-03-30T09:12:07.781477915Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 82.15.0
+    version: 82.15.1
     repository: oci://ghcr.io/prometheus-community/charts
   - name: app-template
     alias: ntfy-alertmanager
@@ -28,7 +28,7 @@ dependencies:
     version: 4.6.2
   - name: valkey
     alias: valkey
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prometheus.png
 # renovate: datasource=github-releases depName=prometheus-operator/prometheus-operator

clusters/cl01tl/helm/loki/Chart.yaml

@@ -23,4 +23,4 @@ dependencies:
     repository: https://grafana.github.io/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/loki.png
 # renovate: datasource=github-releases depName=grafana/loki
-appVersion: 3.7.0
+appVersion: 3.7.1

clusters/cl01tl/helm/matrix-synapse/Chart.lock

@@ -22,10 +22,10 @@ dependencies:
   version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
@@ -38,5 +38,5 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:8fb2d00605ade15db97e778f47ecc1ffae3705ce3408a17e0a21f7def65de884
+digest: sha256:4768c191b140a310d8b24f9dd9e50f8638cfef58614abeb1bb9846d847e44a62
-generated: "2026-03-24T16:59:56.540825394Z"
+generated: "2026-03-30T09:12:19.543309603Z"

clusters/cl01tl/helm/matrix-synapse/Chart.yaml

@@ -57,11 +57,11 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-matrix-synapse
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-hookshot
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-synapse

clusters/cl01tl/helm/movie-roulette/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     version: 4.6.2
 icon: https://raw.githubusercontent.com/sahara101/Movie-Roulette/refs/heads/main/static/icons/icon.png
 # renovate: datasource=github-releases depName=sahara101/Movie-Roulette
-appVersion: v5.3.0
+appVersion: v5.4.0

clusters/cl01tl/helm/movie-roulette/values.yaml

@@ -9,7 +9,7 @@ movie-roulette:
         main:
           image:
             repository: ghcr.io/sahara101/movie-roulette
-            tag: v5.3.0
+            tag: v5.4.0
             pullPolicy: IfNotPresent
           env:
             - name: FLASK_SECRET_KEY

clusters/cl01tl/helm/music-grabber/Chart.yaml

@@ -17,4 +17,5 @@ dependencies:
     alias: music-grabber
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
-appVersion: 2.0.4
+# renovate: datasource=docker depName=g33kphr33k/musicgrabber
+appVersion: 2.5.3

clusters/cl01tl/helm/music-grabber/values.yaml

@@ -9,7 +9,7 @@ music-grabber:
         main:
           image:
             repository: g33kphr33k/musicgrabber
-            tag: 2.5.2
+            tag: 2.5.3
             pullPolicy: IfNotPresent
           env:
             - name: MUSIC_DIR

clusters/cl01tl/helm/ntfy/Chart.yaml

@@ -20,4 +20,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ntfy.png
 # renovate: datasource=github-releases depName=binwiederhier/ntfy
-appVersion: 2.20.0
+appVersion: 2.20.1

clusters/cl01tl/helm/ntfy/values.yaml

@@ -9,7 +9,7 @@ ntfy:
         main:
           image:
             repository: binwiederhier/ntfy
-            tag: v2.20.0
+            tag: v2.20.1
             pullPolicy: IfNotPresent
           args: ["serve"]
           env:

clusters/cl01tl/helm/ollama/values.yaml

@@ -117,7 +117,7 @@ ollama:
         main:
           image:
             repository: ghcr.io/open-webui/open-webui
-            tag: v0.8.10
+            tag: v0.8.12
             pullPolicy: IfNotPresent
           env:
             - name: ENV

clusters/cl01tl/helm/outline/Chart.lock

@@ -10,9 +10,9 @@ dependencies:
   version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:02780454fad48c10e95851e73e45e8a98091596d9dce8ada9e361e7212e581df
+digest: sha256:fce70d7d6aab875ba9d71267e626cea4b723979a019864543d98687a274291cf
-generated: "2026-03-15T20:07:38.818063491Z"
+generated: "2026-03-30T09:12:34.240165131Z"

clusters/cl01tl/helm/outline/Chart.yaml

@@ -31,7 +31,7 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-data

clusters/cl01tl/helm/postiz/Chart.lock

@@ -10,12 +10,12 @@ dependencies:
   version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:de3fb540df1cf7385a19316741854d01e002740c0bf346f3da0ff3a809b1fc3d
+digest: sha256:7727504ece1f5caf7aa18c828d684a3809c4c0b0671d0fcec332a06d56270b82
-generated: "2026-03-15T20:08:06.855136249Z"
+generated: "2026-03-30T09:12:46.75211396Z"

clusters/cl01tl/helm/postiz/Chart.yaml

@@ -30,7 +30,7 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-config

clusters/cl01tl/helm/postiz/values.yaml

@@ -9,7 +9,7 @@ postiz:
         main:
           image:
             repository: ghcr.io/gitroomhq/postiz-app
-            tag: v2.21.0
+            tag: v2.21.4
             pullPolicy: IfNotPresent
           env:
             - name: MAIN_URL

clusters/cl01tl/helm/rybbit/values.yaml

@@ -122,7 +122,7 @@ rybbit:
         main:
           image:
             repository: clickhouse/clickhouse-server
-            tag: 26.2.5
+            tag: 26.3.2
             pullPolicy: IfNotPresent
           env:
             - name: CLICKHOUSE_DB

clusters/cl01tl/helm/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:032eec8dcd3799007059d0753e9d04837fc8dba8d8b749a08469118a8039b703
+            tag: latest@sha256:4d7ed8b7035ecf827bd901ba6d32f5c32d8119bc09bb3cdafeb0ce58f1b951c1
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -39,7 +39,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:032eec8dcd3799007059d0753e9d04837fc8dba8d8b749a08469118a8039b703
+            tag: latest@sha256:4d7ed8b7035ecf827bd901ba6d32f5c32d8119bc09bb3cdafeb0ce58f1b951c1
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL

clusters/cl01tl/helm/stalwart/Chart.lock

@@ -7,9 +7,9 @@ dependencies:
   version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:6ffe4bd6af377f2ba5134389027e86085928d5e1108bb5ecf0d4b1e4cc908b67
+digest: sha256:0748823c0bfd24bfc51828854b16098505f72c35ec9bc20287f3a331749b051c
-generated: "2026-03-15T20:10:31.966910173Z"
+generated: "2026-03-30T09:13:03.67648958Z"

clusters/cl01tl/helm/stalwart/Chart.yaml

@@ -27,7 +27,7 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-config

clusters/cl01tl/helm/tailscale-operator/Chart.yaml

@@ -21,4 +21,4 @@ dependencies:
     repository: https://pkgs.tailscale.com/helmcharts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tailscale-light.png
 # renovate: datasource=github-releases depName=tailscale/tailscale
-appVersion: v1.96.3
+appVersion: v1.96.4

clusters/cl01tl/helm/tdarr/values.yaml

@@ -39,9 +39,28 @@ tdarr:
               cpu: 200m
               memory: 1Gi
     node:
-      type: daemonset
+      type: statefulset
+      replicas: 3
       revisionHistoryLimit: 3
+      statefulset:
+        volumeClaimTemplates:
+          - name: transcode-cache
+            accessMode: ReadWriteOnce
+            size: 20Gi
+            storageClass: local-path
+            globalMounts:
+              - path: /tcache
       pod:
+        affinity:
+          podAntiAffinity:
+            requiredDuringSchedulingIgnoredDuringExecution:
+              - labelSelector:
+                  matchExpressions:
+                    - key: app.kubernetes.io/instance
+                      operator: In
+                      values:
+                        - tdarr
+                topologyKey: kubernetes.io/hostname
         nodeSelector:
           intel.feature.node.kubernetes.io/gpu: "true"
       containers:
@@ -144,13 +163,6 @@ tdarr:
           main:
             - path: /tcache
               readOnly: false
-    node-cache:
-      type: emptyDir
-      advancedMounts:
-        node:
-          main:
-            - path: /tcache
-              readOnly: false
     media:
       existingClaim: tdarr-nfs-storage
       advancedMounts:
@@ -166,7 +178,7 @@ tdarr-exporter:
   image:
     name: homeylab/tdarr-exporter
     # renovate: datasource=docker depName=homeylab/tdarr-exporter
-    tag: 1.4.2
+    tag: 1.4.3
   metrics:
     serviceMonitor:
       enabled: true

clusters/cl01tl/helm/tubearchivist/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 4.6.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
-digest: sha256:39a57c1505ed39180cffe9153ce69233c2376ba62c9287bc411071cf986f44de
+digest: sha256:bbceeb6ebc7a358798e706280aa2eaba8b47b018ea0fb736b30ece5419979c4e
-generated: "2026-03-09T23:08:53.501770729Z"
+generated: "2026-03-30T09:13:15.091505551Z"

clusters/cl01tl/helm/tubearchivist/Chart.yaml

@@ -22,7 +22,7 @@ dependencies:
     version: 4.6.2
   - name: valkey
     alias: valkey
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tube-archivist.png
 # renovate: datasource=github-releases depName=tubearchivist/tubearchivist

clusters/cl01tl/helm/whodb/Chart.yaml

@@ -20,4 +20,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/whodb.png
 # renovate: datasource=github-releases depName=clidey/whodb
-appVersion: 0.101.0
+appVersion: 0.103.0

clusters/cl01tl/helm/whodb/values.yaml

@@ -8,7 +8,7 @@ whodb:
         main:
           image:
             repository: clidey/whodb
-            tag: 0.101.0
+            tag: 0.103.0
             pullPolicy: IfNotPresent
           env:
             - name: WHODB_OLLAMA_HOST

clusters/cl01tl/helm/yamtrack/Chart.lock

@@ -7,6 +7,6 @@ dependencies:
   version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
-digest: sha256:71da007e1cef75e45b1678caa51b0d2317cb8f4dfdf7df675d534194f03650aa
+digest: sha256:3ca767f6530d29c36ae1dc5456e0ac5f889481c4b98955eb9b2d1b6c8fbf702a
-generated: "2026-03-15T20:11:03.591727143Z"
+generated: "2026-03-30T09:13:25.660511034Z"

clusters/cl01tl/helm/yamtrack/Chart.yaml

@@ -26,7 +26,7 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/yamtrack.png
 # renovate: datasource=github-releases depName=FuzzyGrim/Yamtrack

hosts/ps08rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.11@sha256:acfc80650104f0194a15f73dc1648f517561bc1645391a15705332a064cfc33c
+        image: ghcr.io/traefik/traefik:v3.6.12@sha256:171c9c3565b29f6c133f1c1b43c5d4e5853415198e9e1078c001f8702ff66aec
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

hosts/ps09rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.11@sha256:acfc80650104f0194a15f73dc1648f517561bc1645391a15705332a064cfc33c
+        image: ghcr.io/traefik/traefik:v3.6.12@sha256:171c9c3565b29f6c133f1c1b43c5d4e5853415198e9e1078c001f8702ff66aec
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

hosts/ps10rp/homepage/compose.yaml

@@ -32,7 +32,7 @@ services:
             - /var/run/docker.sock:/var/run/docker.sock:ro
 
     homepage:
-        image: ghcr.io/gethomepage/homepage:v1.11.0@sha256:b129cb0f674bd6d204e215bde2c2fc3f11d6ad0e82f6d20007cf80f74e1acbb1
+        image: ghcr.io/gethomepage/homepage:v1.12.1@sha256:9627769818fbfb14147d3e633e57cef9c27c0c5f07585f5a1d6c3d3425b3b33c
         container_name: homepage
         labels:
             traefik.enable: true

hosts/ps10rp/traefik/compose.yaml

@@ -20,7 +20,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.11@sha256:acfc80650104f0194a15f73dc1648f517561bc1645391a15705332a064cfc33c
+        image: ghcr.io/traefik/traefik:v3.6.12@sha256:171c9c3565b29f6c133f1c1b43c5d4e5853415198e9e1078c001f8702ff66aec
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

renovate.json

@@ -3,40 +3,40 @@
   "extends": [
     "config:recommended",
     "mergeConfidence:all-badges",
-    ":rebaseStalePrs",
+    ":rebaseStalePrs"
-    "group:recommended",
-    "group:monorepos",
-    "group:kubernetesMonorepo"
   ],
   "timezone": "America/Chicago",
   "labels": [],
   "prHourlyLimit": 0,
   "prConcurrentLimit": 0,
   "pinDigests": true,
+  "minimumReleaseAgeBehaviour": "timestamp-optional",
   "baseBranchPatterns": [
     "main"
   ],
   "customManagers": [
     {
-      "description": "Update appVersion in Chart.yaml",
+      "description": "Renovate tag matcher for Helm chart appVersion",
       "customType": "regex",
       "managerFilePatterns": [
         "/(^|/)Chart\\.yaml$/"
       ],
       "matchStrings": [
-        "#\\s*renovate:\\s*datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+appVersion:\\s*[\"']?(?<currentValue>[^\"'\\s]+)[\"']?"
+        "#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)(?:\\s+versioning=(?<versioning>\\S+))?\\s+appVersion:\\s*[\"']?(?<currentValue>[^\\s\"']+)[\"']?"
       ],
       "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver-coerced{{/if}}"
     },
     {
-      "description": "Update images in templates",
+      "description": "Renovate tag matcher for Helm values and templates",
       "customType": "regex",
       "managerFilePatterns": [
+        "/(^|/)values\\.yaml$/",
         "/(^|/)templates/.*\\.yaml$/"
       ],
       "matchStrings": [
-        "# renovate: datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)\\s+tag:\\s*[\"']?(?<currentValue>[^@\"'\\s\n]+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?[\"']?"
+        "#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)(?:\\s+versioning=(?<versioning>\\S+))?\\s+tag:\\s*[\"']?(?<currentValue>[^@\\s\"']+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?[\"']?"
-      ]
+      ],
+      "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}docker{{/if}}"
     },
     {
       "description": "Update Helm CLI version in GitHub Actions",
@@ -74,25 +74,48 @@
       "enabled": false
     },
     {
-      "description": "Versioning for LinuxServer images",
+      "description": "Label Helm updates",
-      "versioning": "regex:^v?(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-ls(?<revision>\\d+)$",
+      "matchDatasources": [
-      "matchPackageNames": [
+        "helm"
-        "/^linuxserver\\//",
+      ],
-        "/^ghcr\\.io/linuxserver\\//",
+      "addLabels": [
-        "/^lscr\\.io/linuxserver\\//"
+        "helm"
       ]
     },
     {
-      "description": "Label by datasource",
+      "description": "Label Docker updates",
       "matchDatasources": [
-        "helm",
+        "docker"
-        "docker",
-        "github-actions"
       ],
       "addLabels": [
-        "{{{datasource}}}"
+        "docker"
-      ],
+      ]
-      "automerge": false
+    },
+    {
+      "description": "Versioning for LinuxServer images",
+      "versioning": "regex:^v?(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-ls(?<revision>\\d+)$",
+      "matchPackageNames": [
+        "/^linuxserver//",
+        "/^ghcr\\.io/linuxserver//",
+        "/^lscr\\.io/linuxserver//"
+      ]
+    },
+    {
+      "description": "Group packages together by stripping all registry/namespace prefixes",
+      "groupName": "{{#if packageName}}{{{replace '^.*/([^/]+)$' '$1' packageName}}}{{else}}{{{replace '^.*/([^/]+)$' '$1' depName}}}{{/if}}",
+      "groupSlug": "unified-{{{groupName}}}",
+      "matchPackageNames": [
+        "*"
+      ]
+    },
+    {
+      "description": "Group for specific apps, these have different package and repo names",
+      "groupName": "{{{replace '^.*(argo-cd|bazarr|cilium|code-server|dawarich|element-web|home-assistant|immich|komodo|postiz|rook-ceph|roundcube|rybbit|tdarr|traefik).*$' '$1' depName}}}",
+      "groupSlug": "unified-{{{groupName}}}",
+      "matchPackageNames": [
+        "/(^|/)(argo-cd|bazarr|cilium|code-server|dawarich|element-web|home-assistant|immich|komodo|postiz|rook-ceph|roundcube|rybbit|tdarr|traefik)/",
+        "/^rook(-ceph|/rook|/ceph)/"
+      ]
     },
     {
       "description": "Automerge helm chart lock files",
@@ -103,91 +126,12 @@
         "enabled": true
       },
       "addLabels": [
+        "{{{datasource}}}",
         "automerge"
       ],
       "automerge": true,
       "automergeType": "branch"
     },
-    {
-      "description": "Automerge patches",
-      "matchUpdateTypes": [
-        "patch",
-        "pinDigest"
-      ],
-      "matchDatasources": [
-        "helm",
-        "docker",
-        "github-actions"
-      ],
-      "addLabels": [
-        "automerge"
-      ],
-      "automerge": true,
-      "minimumReleaseAge": "1 days"
-    },
-    {
-      "description": "Label appVersion and images, grouped",
-      "matchManagers": [
-        "custom.regex",
-        "helm-values"
-      ],
-      "groupName": "{{#if packageName}}{{{replace 'ghcr.io/' '' (replace 'docker.io/' '' packageName)}}}{{else}}{{{replace 'ghcr.io/' '' (replace 'docker.io/' '' depName)}}}{{/if}}",
-      "groupSlug": "unified-{{{groupName}}}",
-      "addLabels": [
-        "docker"
-      ],
-      "automerge": false
-    },
-    {
-      "description": "Automerge appVersion and images, grouped",
-      "matchUpdateTypes": [
-        "patch",
-        "pinDigest"
-      ],
-      "matchManagers": [
-        "custom.regex",
-        "helm-values"
-      ],
-      "groupName": "{{#if packageName}}{{{replace 'ghcr.io/' '' (replace 'docker.io/' '' packageName)}}}{{else}}{{{replace 'ghcr.io/' '' (replace 'docker.io/' '' depName)}}}{{/if}}",
-      "groupSlug": "unified-{{{groupName}}}",
-      "addLabels": [
-        "automerge"
-      ],
-      "automerge": true,
-      "minimumReleaseAge": "1 days"
-    },
-    {
-      "description": "Group apps by their keyword",
-      "groupName": "{{{replace '^.*(dawarich|komodo|immich|home-assistant|element-web|cilium|tdarr|argo-cd|traefik).*$' '$1' depName}}}",
-      "groupSlug": "unified-{{{groupName}}}",
-      "matchPackageNames": [
-        "/(^|/)(?<appName>dawarich|komodo|immich|home-assistant|element-web|cilium|tdarr|argo-cd|traefik)/"
-      ]
-    },
-    {
-      "description": "Group Bazarr dependencies",
-      "groupName": "bazarr",
-      "groupSlug": "unified-bazarr",
-      "matchPackageNames": [
-        "bazarr$"
-      ]
-    },
-    {
-      "description": "Group Code Server dependencies",
-      "groupName": "code-server",
-      "groupSlug": "unified-code-server",
-      "matchPackageNames": [
-        "code-server$"
-      ]
-    },
-    {
-      "description": "Group Rook-Ceph dependencies",
-      "groupName": "rook-ceph",
-      "groupSlug": "unified-rook-ceph",
-      "matchPackageNames": [
-        "/^rook(-ceph|\\/rook|\\/ceph)/"
-      ]
-    },
     {
       "description": "Open for digest updates, specific packages",
       "matchUpdateTypes": [
@@ -203,35 +147,46 @@
       "matchUpdateTypes": [
         "digest"
       ],
-      "matchDatasources": [
-        "docker"
-      ],
       "matchPackageNames": [
         "searxng/searxng"
       ],
       "addLabels": [
+        "{{{datasource}}}",
         "automerge"
       ],
       "enabled": true,
       "automerge": true
     },
     {
-      "description": "Automerge images, specific packages",
+      "description": "Automerge patches",
       "matchUpdateTypes": [
         "patch",
-        "minor"
+        "pinDigest"
       ],
-      "matchDatasources": [
+      "addLabels": [
-        "docker"
+        "{{{datasource}}}",
+        "automerge"
+      ],
+      "automerge": true,
+      "minimumReleaseAge": "3 days"
+    },
+    {
+      "description": "Automerge images, specific packages",
+      "matchUpdateTypes": [
+        "minor",
+        "patch",
+        "pinDigest"
       ],
       "matchPackageNames": [
         "ghcr.io/renovatebot/renovate",
         "ghcr.io/prometheus-community/charts/kube-prometheus-stack"
       ],
       "addLabels": [
+        "{{{datasource}}}",
         "automerge"
       ],
-      "automerge": true
+      "automerge": true,
+      "minimumReleaseAge": "3 days"
     }
   ]
 }