chore(deps): update g33kphr33k/musicgrabber docker tag to v2.8.10

Merge pull request 'chore(deps): update loki docker tag to v15' (#7048 ) from renovate/major-unified-loki into main
Reviewed-on: #7048
2026-05-17 02:00:14 +00:00 · 2026-05-17 01:54:43 +00:00 · 2026-05-17 01:54:43 +00:00 · 2026-05-17 01:48:30 +00:00 · 2026-05-17 01:48:01 +00:00 · 2026-05-17 01:39:17 +00:00
643 changed files with 8284 additions and 5984 deletions
@@ -16,8 +16,8 @@ on:
 env:
  CLUSTER: cl01tl
  BASE_BRANCH: "origin/${{ github.base_ref }}"
-  # renovate: datasource=github-releases depName=yannh/kubeconform
  KUBECONFORM_VERSION: "v0.6.7"
+  ARGOCD_VERSION: "v3.3.6"

 jobs:
  lint-helm:
@@ -102,7 +102,7 @@ jobs:
            echo ""
            echo "${CHANGED_CHARTS}"

-            CHANGED_CHARTS_CSV=$(echo "$CHANGED_CHARTS" | paste -sd ',' -)
+            CHANGED_CHARTS_CSV=$(echo "${CHANGED_CHARTS}" | paste -sd ',' -)

            echo ""
            echo "----"
@@ -169,9 +169,10 @@ jobs:

          echo ">> Running linting on changed charts ..."

-          for DIR in ${CHANGED_CHARTS}; do
-            CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
-            CHART_NAME=$(basename "${CHART_PATH}")
+          lint_chart() {
+            local DIR="$1"
+            local CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
+            local CHART_NAME=$(basename "${CHART_PATH}")

            if [ -f "${CHART_PATH}/Chart.yaml" ]; then
              echo ""
@@ -182,15 +183,8 @@ jobs:
              echo ">> Linting helm chart ${CHART_NAME} ..."

              if ! helm lint "${CHART_PATH}" --namespace "default"; then
-                EXIT_CODE=1
-
-                if [ -z "${FAILED_CHARTS}" ]; then
-                  FAILED_CHARTS="${DIR}"
-
-                else
-                  FAILED_CHARTS="${FAILED_CHARTS}, ${DIR}"
-
-                fi
+                echo "${DIR}" > ".failed_chart_${CHART_NAME}"
+                return 1
              fi

            else
@@ -198,8 +192,20 @@ jobs:
              echo ">> Directory ${CHART_PATH} does not contain a Chart.yaml. Skipping ..."

            fi
+          }

-          done
+          export -f lint_chart
+          export CLUSTER
+
+          for DIR in ${CHANGED_CHARTS}; do
+            echo "${DIR}"
+          done | xargs -P 4 -I {} bash -c 'OUT=$(lint_chart "$@" 2>&1); printf "%s\n" "$OUT"' _ {}
+
+          if ls .failed_chart_* 1> /dev/null 2>&1; then
+            EXIT_CODE=1
+            FAILED_CHARTS=$(cat .failed_chart_* | paste -sd ',' - | sed 's/,/, /g')
+            rm -f .failed_chart_*
+          fi

          echo ""
          echo "----"
@@ -236,7 +242,17 @@ jobs:
        with:
          fetch-depth: 0

+      - name: Cache Kubeconform
+        id: cache-kubeconform
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        with:
+          path: /usr/local/bin/kubeconform
+          key: ${{ runner.os }}-kubeconform-${{ env.KUBECONFORM_VERSION }}
+          restore-keys: |
+            ${{ runner.os }}-kubeconform-
+
      - name: Install Kubeconform
+        if: steps.cache-kubeconform.outputs.cache-hit != 'true'
        run: |
          echo ">> Downloading Kubeconform ${{ env.KUBECONFORM_VERSION }} ..."
          wget -q https://github.com/yannh/kubeconform/releases/download/${{ env.KUBECONFORM_VERSION }}/kubeconform-linux-amd64.tar.gz
@@ -249,6 +265,8 @@ jobs:
          echo ">> Installing Kubeconform ..."
          sudo mv kubeconform /usr/local/bin/

+      - name: Verify installation
+        run: |
          echo ""
          echo ">> Verifying installation ..."
          kubeconform -v
@@ -317,32 +335,38 @@ jobs:
          EXIT_CODE=0
          FAILED_CHARTS=""

-          for DIR in ${CHANGED_CHARTS}; do
-            CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
+          validate_chart() {
+            local DIR="$1"
+            local CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
            echo ""
            echo ">> Validating: ${DIR}"

            helm dependency build "${CHART_PATH}" --skip-refresh

-            if ! helm template "${DIR}" "${CHART_PATH}" --include-crds --namespace default --api-versions "gateway.networking.k8s.io/v1/HTTPRoute" | \
+            if ! helm template "${DIR}" "${CHART_PATH}" --include-crds --namespace default --api-versions "gateway.networking.k8s.io/v1/HTTPRoute,monitoring.coreos.com/v1,monitoring.coreos.com/v1/ServiceMonitor" | \
              kubeconform \
                ${SCHEMA_LOCATIONS} \
                -ignore-missing-schemas \
                -strict \
                -summary; then

-              EXIT_CODE=1
-
-              if [ -z "${FAILED_CHARTS}" ]; then
-                FAILED_CHARTS="${DIR}"
-
-              else
-                FAILED_CHARTS="${FAILED_CHARTS}, ${DIR}"
-
-              fi
+              echo "${DIR}" > ".failed_chart_${DIR}"
+              return 1
            fi
+          }

-          done
+          export -f validate_chart
+          export CLUSTER SCHEMA_LOCATIONS
+
+          for DIR in ${CHANGED_CHARTS}; do
+            echo "${DIR}"
+          done | xargs -P 4 -I {} bash -c 'OUT=$(validate_chart "$@" 2>&1); printf "%s\n" "$OUT"' _ {}
+
+          if ls .failed_chart_* 1> /dev/null 2>&1; then
+            EXIT_CODE=1
+            FAILED_CHARTS=$(cat .failed_chart_* | paste -sd ',' - | sed 's/,/, /g')
+            rm -f .failed_chart_*
+          fi

          echo ""
          echo "----"
@@ -365,3 +389,243 @@ jobs:
          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
          actions: '[{"action": "view", "label": "View Run", "url": "${{ vars.USER_URL }}/${{ github.repository }}/actions/runs/${{ github.run_id }}", "clear": true}]'
          image: true
+
+  # argo-diff:
+  #   needs: lint-helm
+  #   runs-on: ubuntu-js
+  #   if: |
+  #     needs.lint-helm.result == 'success' &&
+  #     needs.lint-helm.outputs.changes-detected == 'true' &&
+  #     github.event_name == 'pull_request'
+  #   steps:
+  #     - name: Checkout
+  #       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+  #       with:
+  #         fetch-depth: 0
+
+  #     - name: Cache ArgoCD CLI
+  #       id: cache-argocd
+  #       uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+  #       with:
+  #         path: /usr/local/bin/argocd
+  #         key: ${{ runner.os }}-argocd-${{ env.ARGOCD_VERSION }}
+  #         restore-keys: |
+  #           ${{ runner.os }}-argocd-
+
+  #     - name: Install ArgoCD CLI
+  #       if: steps.cache-argocd.outputs.cache-hit != 'true'
+  #       run: |
+  #         echo ">> Downloading ArgoCD CLI, version: ${{ env.ARGOCD_VERSION }} ..."
+  #         curl -sSL -o argocd-linux-amd64 https://github.com/argoproj/argo-cd/releases/download/${{ env.ARGOCD_VERSION }}/argocd-linux-amd64
+
+  #         echo ""
+  #         echo ">> Installing ArgoCD CLI ..."
+  #         sudo install -m 555 argocd-linux-amd64 /usr/local/bin/argocd
+
+  #         echo ""
+  #         echo "----"
+
+  #     - name: Verify installation
+  #       run: |
+  #         echo ""
+  #         echo ">> Verifying installation ..."
+  #         argocd version --client
+
+  #         echo ""
+  #         echo "----"
+
+  #     - name: Set Up Helm
+  #       uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5
+  #       with:
+  #         token: ${{ secrets.GITEA_TOKEN }}
+  #         # renovate: datasource=github-releases depName=helm/helm
+  #         version: v4.1.3
+  #         cache: true
+
+  #     - name: Cache Helm Dependencies
+  #       uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+  #       with:
+  #         path: |
+  #           ~/.cache/helm
+  #           ~/.config/helm
+  #         key: helm-cache-${{ runner.os }}-${{ hashFiles('infrastructure/clusters/cl01tl/helm/**/Chart.yaml', 'infrastructure/clusters/cl01tl/helm/**/Chart.lock') }}
+  #         restore-keys: |
+  #           helm-cache-${{ runner.os }}-
+
+  #     - name: Add Repositories
+  #       env:
+  #         CHANGED_CHARTS: ${{ needs.lint-helm.outputs.chart-dir }}
+  #       run: |
+  #         echo ">> Adding repositories for chart dependencies ..."
+  #         echo ""
+
+  #         for DIR in ${CHANGED_CHARTS}; do
+  #           helm dependency list --max-col-width 120 clusters/${CLUSTER}/helm/${DIR} 2> /dev/null \
+  #             | tail -n +2 \
+  #             | awk 'NF > 0 { print $1, $3 }' \
+  #             | while read -r REPO_NAME REPO_URL; do
+  #               if [[ "${REPO_URL}" == oci://* ]]; then
+  #                 echo ">> Ignoring OCI repo: ${REPO_URL}"
+
+  #               elif [[ -n "${REPO_NAME}" && -n "${REPO_URL}" ]]; then
+  #                 helm repo add "${REPO_NAME}" "${REPO_URL}"
+
+  #               fi
+
+  #             done || true
+  #         done
+
+  #         if helm repo list > /dev/null 2>&1; then
+  #           echo ""
+  #           echo ">> Update repository cache ..."
+  #           helm repo update
+
+  #         fi
+
+  #         echo ""
+  #         echo "----"
+
+  #     - name: Render Templates
+  #       id: render
+  #       env:
+  #         CHANGED_CHARTS: ${{ needs.lint-helm.outputs.chart-dir }}
+  #       run: |
+  #         for APP_NAME in ${CHANGED_CHARTS}; do
+  #           echo ">> Render templates for ${APP_NAME} ..."
+  #           CHART_PATH="clusters/${CLUSTER}/helm/${APP_NAME}"
+  #           OUTPUT_FOLDER="clusters/${CLUSTER}/manifests/${APP_NAME}/"
+  #           mkdir -p "${OUTPUT_FOLDER}"
+
+  #           helm dependency build "${CHART_PATH}" --skip-refresh
+
+  #           NAMESPACE="${APP_NAME}"
+  #           case "${APP_NAME}" in
+  #             "stack")
+  #               NAMESPACE="argocd"
+  #               echo ">> Special Rendering into 'argocd' namespace ..."
+  #               ;;
+  #             "cilium" | "coredns" | "metrics-server")
+  #               NAMESPACE="kube-system"
+  #               echo ">> Special Rendering for ${APP_NAME} into 'kube-system' namespace ..."
+  #               ;;
+  #             *)
+  #               echo ">> Standard Rendering ..."
+  #           esac
+
+  #           TEMPLATE=$(helm template "${APP_NAME}" "${CHART_PATH}" --include-crds --namespace "${NAMESPACE}" --api-versions "gateway.networking.k8s.io/v1/HTTPRoute,monitoring.coreos.com/v1,monitoring.coreos.com/v1/ServiceMonitor")
+
+  #           # Format and split rendered template
+  #           echo "${TEMPLATE}" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"${OUTPUT_FOLDER}"'" + .kind + "-" + .metadata.name + ".yaml"'
+
+  #           # Strip comments again to ensure formatting correctness
+  #           for file in "$OUTPUT_FOLDER"/*; do
+  #             yq -i '... comments=""' $file
+
+  #           done
+
+  #           echo ""
+  #           echo ">> Templates in output folder: ${OUTPUT_FOLDER}"
+  #           ls ${OUTPUT_FOLDER}
+  #         done
+
+  #         echo "----"
+
+  #     - name: Run App Diff
+  #       id: diff
+  #       env:
+  #         ARGOCD_SERVER: ${{ secrets.ARGOCD_SERVER }}
+  #         ARGOCD_AUTH_TOKEN: ${{ secrets.ARGOCD_AUTH_TOKEN }}
+  #         CHANGED_CHARTS: ${{ needs.lint-helm.outputs.chart-dir }}
+  #       run: |
+  #         FAILED_CHARTS=""
+  #         DIFF_FOUND="false"
+  #         EXIT_CODE=0
+
+  #         for APP_NAME in ${CHANGED_CHARTS}; do
+  #           echo ">> Running argocd app diff for ${APP_NAME} ..."
+  #           if ! argocd app diff "${APP_NAME}" \
+  #             --server "${ARGOCD_SERVER}" \
+  #             --auth-token "${ARGOCD_AUTH_TOKEN}" \
+  #             --revision ${{ github.sha }} \
+  #             --local "clusters/${CLUSTER}/manifests/${APP_NAME}" \
+  #             --local-repo-root "." \
+  #             --grpc-web > "diff_output_${APP_NAME}.txt" 2>&1; then
+
+  #             # ArgoCD diff returns non-zero on diff or error.
+  #             # Let's capture if it actually generated a diff output to post.
+  #             DIFF_FOUND="true"
+
+  #             # Check if the output contains validation/connection errors
+  #             if grep -iE 'error|failed|connection refused|timeout' "diff_output_${APP_NAME}.txt"; then
+  #                echo ">> ArgoCD encountered an error validating ${APP_NAME}!"
+  #                EXIT_CODE=1
+  #                FAILED_CHARTS="${FAILED_CHARTS} ${APP_NAME}"
+  #             fi
+  #           fi
+
+  #           if [ -s "diff_output_${APP_NAME}.txt" ]; then
+  #             echo ">> Argo diff or errors:"
+  #             echo ""
+  #             cat diff_output_${APP_NAME}.txt
+  #             echo ""
+  #           else
+  #             echo ">> No Argo diff found for ${APP_NAME}"
+  #             rm "diff_output_${APP_NAME}.txt"
+  #           fi
+  #         done
+
+  #         echo "----"
+  #         echo "diff-detected=${DIFF_FOUND}" >> "$GITHUB_OUTPUT"
+  #         echo "failed-charts=${FAILED_CHARTS}" >> "$GITHUB_OUTPUT"
+
+  #         exit $EXIT_CODE
+
+  #     - name: Post Diff
+  #       if: |
+  #         always() &&
+  #         steps.diff.outputs.diff-detected == 'true' &&
+  #         github.event.pull_request.number != null
+  #       env:
+  #         GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+  #       run: |
+  #         COMMENT_BODY="### ArgoCD Diff Results
+  #         "
+
+  #         for f in diff_output_*.txt; do
+  #           APP_NAME=$(echo $f | sed 's/diff_output_//;s/.txt//')
+  #           DIFF_CONTENT=$(cat "$f")
+
+  #           COMMENT_BODY="${COMMENT_BODY}
+  #         #### App: ${APP_NAME}
+  #         "
+
+  #           if [ -z "$DIFF_CONTENT" ]; then
+  #             COMMENT_BODY="${COMMENT_BODY} No changes detected."
+  #           else
+  #             COMMENT_BODY="${COMMENT_BODY}
+  #         \`\`\`diff
+  #         ${DIFF_CONTENT}
+  #         \`\`\`"
+  #           fi
+  #         done
+
+  #         curl -X 'POST' \
+  #           "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \
+  #           -H "Authorization: token ${GITEA_TOKEN}" \
+  #           -H "Content-Type: application/json" \
+  #           -d "$(jq -n --arg body "$COMMENT_BODY" '{body: $body}')"
+
+  #     - name: ntfy Failed
+  #       uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+  #       if: failure()
+  #       with:
+  #         url: '${{ secrets.NTFY_URL }}'
+  #         topic: '${{ secrets.NTFY_TOPIC }}'
+  #         title: 'ArgoCD Diff Failure'
+  #         priority: 3
+  #         headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+  #         tags: action,failed
+  #         details: "ArgoCD diff for cluster '${{ env.CLUSTER }}' failed on charts: ${{ steps.diff.outputs.failed-charts }}"
+  #         icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+  #         actions: '[{"action": "view", "label": "View Run", "url": "${{ vars.USER_URL }}/${{ github.repository }}/actions/runs/${{ github.run_id }}", "clear": true}]'
+  #         image: true
@@ -283,7 +283,7 @@ jobs:

              echo ">> Formating rendered template ..."
              local TEMPLATE
-              TEMPLATE=$(helm template "${CHART_NAME}" ./ --namespace "${NAMESPACE}" --include-crds --dry-run=server --api-versions "gateway.networking.k8s.io/v1/HTTPRoute")
+              TEMPLATE=$(helm template "${CHART_NAME}" ./ --namespace "${NAMESPACE}" --include-crds --dry-run=server --api-versions "gateway.networking.k8s.io/v1/HTTPRoute,monitoring.coreos.com/v1,monitoring.coreos.com/v1/ServiceMonitor")

              # Format and split rendered template
              echo "${TEMPLATE}" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"${OUTPUT_FOLDER}"'" + .kind + "-" + .metadata.name + ".yaml"'
@@ -314,7 +314,7 @@ jobs:
          for DIR in ${RENDER_DIR}; do
            echo "${DIR}"

-          done | xargs -P 4 -I {} bash -c 'OUT=$(render_chart "$@" 2>&1); printf "%s\n" "$OUT"' _ {}
+          done | xargs -P 5 -I {} bash -c 'OUT=$(render_chart "$@" 2>&1); printf "%s\n" "$OUT"' _ {}

          echo ""
          echo "----"
@@ -12,8 +12,8 @@ on:

 jobs:
  renovate:
-    runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.109.0@sha256:262d3c2d7e61da7a7eef61fdbdcf26d80cb0d13f65baaa99ace4163a4d56c0fa
+    runs-on: ubuntu-js
+    container: ghcr.io/renovatebot/renovate:43.181.2@sha256:0bdf309ffcd873506b2357513eaa5d772b170f4acc5e2ee280a2207203cbdc91
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -1,9 +1,9 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
+  version: 5.0.1
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-digest: sha256:ff81b3d8fc831e4b8048f646fffcf597aa7410e52ecf27690eab8104047dbe6f
-generated: "2026-03-06T01:04:41.514235218Z"
+  version: 2.0.0
+digest: sha256:cefbc682239406e67d7f05887c9155742d7566f1ebe0b303dd3b160f1b28aa49
+generated: "2026-05-15T00:28:22.250508809Z"
@@ -17,11 +17,11 @@ dependencies:
  - name: app-template
    alias: actual
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.6.2
+    version: 5.0.1
  - name: volsync-target
    alias: volsync-target-data
-    version: 0.8.0
+    version: 2.0.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/actual-budget.png
 # renovate: datasource=github-releases depName=actualbudget/actual
-appVersion: 26.4.0
+appVersion: 26.5.2
@@ -0,0 +1,14 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
@@ -8,7 +8,7 @@ actual:
        main:
          image:
            repository: ghcr.io/actualbudget/actual
-            tag: 26.4.0@sha256:b0e732e2c41b3dc468a71548e88ef76d3f0c157fc43d15fa05d14ec1c5747e1e
+            tag: 26.5.2@sha256:1aeeb3985db55556e716dec25e08f6ce09308c2571b65cddbc6746ee6d5e0d45
          env:
            - name: ACTUAL_PORT
              value: 5006
@@ -75,7 +75,7 @@ volsync-target-data:
    schedule: 0 8 * * *
  remote:
    enabled: true
-    schedule: 0 9 * * *
+    schedule: 0 10 * * 0
  external:
    enabled: true
-    schedule: 0 10 * * *
+    schedule: 0 9 * * 0
@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
  repository: https://argoproj.github.io/argo-helm
-  version: 9.4.17
-digest: sha256:17752dbf03861cf70ee31c9a17373a5175656a2edd00ba5fcd3988a195147da8
-generated: "2026-03-28T01:51:34.832601868Z"
+  version: 9.5.14
+digest: sha256:5cae964bb988089467bc5c46badbe33b67f64abd039f5961e66e412a5c7004a7
+generated: "2026-05-13T17:58:34.736881783Z"
@@ -13,8 +13,8 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: argo-cd
-    version: 9.4.17
+    version: 9.5.14
    repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-cd
-appVersion: v3.3.6
+appVersion: v3.4.2
@@ -0,0 +1,14 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
@@ -1,70 +1,40 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: argocd-oidc-secret
+  name: argocd-oidc-authentik
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: argocd-oidc-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: argocd-oidc-authentik
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: secret
      remoteRef:
-        key: /authentik/oidc/argocd
+        key: /cl01tl/authentik/oidc/argocd
        property: secret
    - secretKey: client
      remoteRef:
-        key: /authentik/oidc/argocd
+        key: /cl01tl/authentik/oidc/argocd
        property: client

 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: argocd-notifications-secret
+  name: argocd-notifications-ntfy
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: argocd-notifications-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: argocd-notifications-ntfy
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: ntfy-token
      remoteRef:
-        key: /ntfy/user/cl01tl
+        key: /cl01tl/ntfy/users/cl01tl
        property: token
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: argocd-gitea-repo-infrastructure-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: argocd-gitea-repo-infrastructure-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: type
-      remoteRef:
-        key: /cl01tl/argocd/credentials/repo/infrastructure
-        property: type
-    - secretKey: url
-      remoteRef:
-        key: /cl01tl/argocd/credentials/repo/infrastructure
-        property: url
-    - secretKey: sshPrivateKey
-      remoteRef:
-        key: /cl01tl/argocd/credentials/repo/infrastructure
-        property: sshPrivateKey
@@ -0,0 +1,108 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: haproxy
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: haproxy
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  groups:
+    - name: EmbeddedExporter
+      rules:
+        - alert: HAProxyHighHTTP4xxErrorRateBackend
+          expr: ((sum by (proxy) (rate(haproxy_server_http_responses_total{code="4xx"}[1m])) / sum by (proxy) (rate(haproxy_server_http_responses_total[1m]))) * 100) > 5 and sum by (proxy) (rate(haproxy_server_http_responses_total[1m])) > 0
+          for: 1m
+          labels:
+            severity: critical
+          annotations:
+            summary: HAProxy high HTTP 4xx error rate backend (instance {{ `{{ $labels.instance }}` }})
+            description: "Too many HTTP requests with status 4xx (> 5%) on backend {{ `{{ $labels.proxy }}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: HAProxyHighHTTP5xxErrorRateBackend
+          expr: ((sum by (proxy) (rate(haproxy_server_http_responses_total{code="5xx"}[1m])) / sum by (proxy) (rate(haproxy_server_http_responses_total[1m]))) * 100) > 5 and sum by (proxy) (rate(haproxy_server_http_responses_total[1m])) > 0
+          for: 1m
+          labels:
+            severity: critical
+          annotations:
+            summary: HAProxy high HTTP 5xx error rate backend (instance {{ `{{ $labels.instance }}` }})
+            description: "Too many HTTP requests with status 5xx (> 5%) on backend {{ `{{ $labels.proxy }}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: HAProxyHighHTTP4xxErrorRateServer
+          expr: ((sum by (server) (rate(haproxy_server_http_responses_total{code="4xx"}[1m])) / sum by (server) (rate(haproxy_server_http_responses_total[1m]))) * 100) > 5 and sum by (server) (rate(haproxy_server_http_responses_total[1m])) > 0
+          for: 1m
+          labels:
+            severity: critical
+          annotations:
+            summary: HAProxy high HTTP 4xx error rate server (instance {{ `{{ $labels.instance }}` }})
+            description: "Too many HTTP requests with status 4xx (> 5%) on server {{ `{{ $labels.server }}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: HAProxyHighHTTP5xxErrorRateServer
+          expr: ((sum by (server) (rate(haproxy_server_http_responses_total{code="5xx"}[1m])) / sum by (server) (rate(haproxy_server_http_responses_total[1m]))) * 100) > 5 and sum by (server) (rate(haproxy_server_http_responses_total[1m])) > 0
+          for: 1m
+          labels:
+            severity: critical
+          annotations:
+            summary: HAProxy high HTTP 5xx error rate server (instance {{ `{{ $labels.instance }}` }})
+            description: "Too many HTTP requests with status 5xx (> 5%) on server {{ `{{ $labels.server }}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: HAProxyServerResponseErrors
+          expr: (sum by (server) (rate(haproxy_server_response_errors_total[1m])) / sum by (server) (rate(haproxy_server_http_responses_total[1m]))) * 100 > 5 and sum by (server) (rate(haproxy_server_http_responses_total[1m])) > 0
+          for: 1m
+          labels:
+            severity: critical
+          annotations:
+            summary: HAProxy server response errors (instance {{ `{{ $labels.instance }}` }})
+            description: "Too many response errors to {{ `{{ $labels.server }}` }} server (> 5%).\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: HAProxyBackendConnectionErrors
+          expr: (sum by (proxy) (rate(haproxy_backend_connection_errors_total[1m]))) > 100
+          for: 1m
+          labels:
+            severity: critical
+          annotations:
+            summary: HAProxy backend connection errors (instance {{ `{{ $labels.instance }}` }})
+            description: "Too many connection errors to {{ `{{ $labels.proxy }}` }} backend (> 100 req/s). Request throughput may be too high.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: HAProxyServerConnectionErrors
+          expr: (sum by (proxy) (rate(haproxy_server_connection_errors_total[1m]))) > 100
+          for: 0m
+          labels:
+            severity: critical
+          annotations:
+            summary: HAProxy server connection errors (instance {{ `{{ $labels.instance }}` }})
+            description: "Too many connection errors to {{ `{{ $labels.proxy }}` }} (> 100 req/s). Request throughput may be too high.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: HAProxyBackendMaxActiveSession>80%
+          expr: (haproxy_backend_current_sessions / haproxy_backend_limit_sessions * 100) > 80 and haproxy_backend_limit_sessions > 0
+          for: 2m
+          labels:
+            severity: warning
+          annotations:
+            summary: HAProxy backend max active session > 80% (instance {{ `{{ $labels.instance }}` }})
+            description: "Session limit from backend {{ `{{ $labels.proxy }}` }} reached 80% of limit - {{ `{{ $value | printf \"%.2f\"}}` }}%\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: HAProxyPendingRequests
+          expr: sum by (proxy) (haproxy_backend_current_queue) > 0
+          for: 2m
+          labels:
+            severity: warning
+          annotations:
+            summary: HAProxy pending requests (instance {{ `{{ $labels.instance }}` }})
+            description: "Some HAProxy requests are pending on {{ `{{ $labels.proxy }}` }} - {{ `{{ $value | printf \"%.2f\"}}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: HAProxyRetryHigh
+          expr: sum by (proxy) (rate(haproxy_backend_retry_warnings_total[1m])) > 10
+          for: 2m
+          labels:
+            severity: warning
+          annotations:
+            summary: HAProxy retry high (instance {{ `{{ $labels.instance }}` }})
+            description: "High rate of retry on {{ `{{ $labels.proxy }}` }} - {{ `{{ $value | printf \"%.2f\"}}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: HAProxyFrontendSecurityBlockedRequests
+          expr: sum by (proxy) (rate(haproxy_frontend_denied_connections_total[2m])) > 10
+          for: 2m
+          labels:
+            severity: warning
+          annotations:
+            summary: HAProxy frontend security blocked requests (instance {{ `{{ $labels.instance }}` }})
+            description: "HAProxy is blocking requests for security reason\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: HAProxyServerHealthcheckFailure
+          expr: increase(haproxy_server_check_failures_total[1m]) > 2
+          for: 0m
+          labels:
+            severity: warning
+          annotations:
+            summary: HAProxy server healthcheck failure (instance {{ `{{ $labels.instance }}` }})
+            description: "Some server healthcheck are failing on {{ `{{ $labels.server }}` }} ({{ `{{ $value }}` }} in the last 1m)\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
@@ -13,8 +13,8 @@ argo-cd:
        connectors:
        - config:
            issuer: https://authentik.alexlebens.net/application/o/argocd/
-            clientID: $argocd-oidc-secret:client
-            clientSecret: $argocd-oidc-secret:secret
+            clientID: $argocd-oidc-authentik:client
+            clientSecret: $argocd-oidc-authentik:secret
            insecureEnableGroups: true
            scopes:
              - openid
@@ -48,31 +48,31 @@ argo-cd:
        enabled: true
      rules:
        enabled: true
-      spec:
-        - alert: ArgoAppMissing
-          expr: |
-            absent(argocd_app_info) == 1
-          for: 15m
-          labels:
-            severity: critical
-          annotations:
-            summary: "[Argo CD] No reported applications"
-            description: >
-              Argo CD has not reported any applications data for the past 15 minutes which
-              means that it must be down or not functioning properly.  This needs to be
-              resolved for this cloud to continue to maintain state.
-        - alert: ArgoAppNotSynced
-          expr: |
-            argocd_app_info{sync_status!="Synced"} == 1
-          for: 12h
-          labels:
-            severity: warning
-          annotations:
-            summary: "[{{`{{$labels.name}}`}}] Application not synchronized"
-            description: >
-              The application [{{`{{$labels.name}}`}} has not been synchronized for over
-              12 hours which means that the state of this cloud has drifted away from the
-              state inside Git.
+        spec:
+          - alert: ArgoAppMissing
+            expr: |
+              absent(argocd_app_info) == 1
+            for: 15m
+            labels:
+              severity: critical
+            annotations:
+              summary: "[Argo CD] No reported applications"
+              description: >
+                Argo CD has not reported any applications data for the past 15 minutes which
+                means that it must be down or not functioning properly.  This needs to be
+                resolved for this cloud to continue to maintain state.
+          - alert: ArgoAppNotSynced
+            expr: |
+              argocd_app_info{sync_status!="Synced"} == 1
+            for: 12h
+            labels:
+              severity: warning
+            annotations:
+              summary: "[{{`{{$labels.name}}`}}] Application not synchronized"
+              description: >
+                The application [{{`{{$labels.name}}`}} has not been synchronized for over
+                12 hours which means that the state of this cloud has drifted away from the
+                state inside Git.
  dex:
    enabled: true
    resources:
@@ -91,7 +91,7 @@ argo-cd:
    enabled: true
    image:
      repository: redis
-      tag: 8.6.2-alpine@sha256:81b6f81d6a6c5b9019231a2e8eb10085e3a139a34f833dcc965a8a959b040b72
+      tag: 8.6.3-alpine@sha256:69f2c586c8a7e9cce4ae1ee9bbaf60bc4bb5f4bb3880e4ed022b1fd758a7cab9
    persistentVolume:
      enabled: true
    redis:
@@ -103,7 +103,7 @@ argo-cd:
      enabled: true
      image:
        repository: haproxy
-        tag: 3.3.6-alpine@sha256:744be2dca649a44d490a4c565d36968d19482dd387f1bdd44c168f4322bc6b1e
+        tag: 3.3.10-alpine@sha256:3201152205e9d02557ab3c8ecfcf0d378126eec0a5d1b0950ea22af31ee10bf2
      resources:
        requests:
          cpu: 5m
@@ -205,7 +205,7 @@ argo-cd:
    argocdUrl: https://argocd.alexlebens.net
    secret:
      create: false
-      name: argocd-notifications-secret
+      name: argocd-notifications-ntfy
    metrics:
      enabled: true
      serviceMonitor:
@@ -1,12 +1,12 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
+  version: 5.0.1
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
+  version: 2.0.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-digest: sha256:7ee4cfdf7f908401c39b3cda0cf8783b25dcb9cf93e7c911609bab9e303ec5bf
-generated: "2026-03-06T01:05:03.534042627Z"
+  version: 2.0.0
+digest: sha256:1301152734c6f4df67089c4076875022ecafc466c308dc994f4333917c3d8622
+generated: "2026-05-15T00:28:34.959229494Z"
@@ -21,15 +21,15 @@ dependencies:
  - name: app-template
    alias: audiobookshelf
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.6.2
+    version: 5.0.1
  - name: volsync-target
    alias: volsync-target-config
-    version: 0.8.0
+    version: 2.0.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-metadata
-    version: 0.8.0
+    version: 2.0.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/audiobookshelf.png
 # renovate: datasource=github-releases depName=advplyr/audiobookshelf
-appVersion: 2.33.1
+appVersion: 2.34.0
@@ -0,0 +1,27 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+NFS names
+*/}}
+{{- define "custom.booksNfsName" -}}
+audiobookshelf-books-nfs-storage
+{{- end -}}
+{{- define "custom.audiobooksNfsName" -}}
+audiobookshelf-audiobooks-nfs-storage
+{{- end -}}
+{{- define "custom.podcastsNfsName" -}}
+audiobookshelf-podcasts-nfs-storage
+{{- end -}}
@@ -1,18 +1,27 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: audiobookshelf-apprise-config
+  name: audiobookshelf-config-apprise
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: audiobookshelf-apprise-config
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: audiobookshelf-config-apprise
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
+  target:
+    template:
+      mergePolicy: Merge
+      engineVersion: v2
+      data:
+        ntfy-url: "{{ `{{ .endpoint }}` }}/{{ `{{ .topic }}` }}"
  data:
-    - secretKey: ntfy-url
+    - secretKey: endpoint
      remoteRef:
-        key: /cl01tl/audiobookshelf/apprise
-        property: ntfy-url
+        key: /cl01tl/ntfy/users/cl01tl
+        property: internal-endpoint-credential
+    - secretKey: topic
+      remoteRef:
+        key: /cl01tl/ntfy/topics
+        property: audiobookshelf
@@ -1,14 +1,13 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: audiobookshelf-books-nfs-storage
+  name: {{ include "custom.booksNfsName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: audiobookshelf-books-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ include "custom.booksNfsName" . }}
+    {{ include "custom.labels" . | nindent 4 }}
 spec:
-  volumeName: audiobookshelf-books-nfs-storage
+  volumeName: {{ include "custom.booksNfsName" . }}
  storageClassName: nfs-client
  accessModes:
    - ReadWriteMany
@@ -20,14 +19,13 @@ spec:
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: audiobookshelf-audiobooks-nfs-storage
+  name: {{ include "custom.audiobooksNfsName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: audiobookshelf-audiobooks-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ include "custom.audiobooksNfsName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
-  volumeName: audiobookshelf-audiobooks-nfs-storage
+  volumeName: {{ include "custom.audiobooksNfsName" . }}
  storageClassName: nfs-client
  accessModes:
    - ReadWriteMany
@@ -39,14 +37,13 @@ spec:
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: audiobookshelf-podcasts-nfs-storage
+  name: {{ include "custom.podcastsNfsName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: audiobookshelf-podcasts-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ include "custom.podcastsNfsName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
-  volumeName: audiobookshelf-podcasts-nfs-storage
+  volumeName: {{ include "custom.podcastsNfsName" . }}
  storageClassName: nfs-client
  accessModes:
    - ReadWriteMany
@@ -1,12 +1,11 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: audiobookshelf-books-nfs-storage
+  name: {{ include "custom.booksNfsName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: audiobookshelf-books-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ include "custom.booksNfsName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs-client
@@ -26,12 +25,11 @@ spec:
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: audiobookshelf-audiobooks-nfs-storage
+  name: {{ include "custom.audiobooksNfsName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: audiobookshelf-audiobooks-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ include "custom.audiobooksNfsName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs-client
@@ -51,12 +49,11 @@ spec:
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: audiobookshelf-podcasts-nfs-storage
+  name: {{ include "custom.podcastsNfsName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: audiobookshelf-podcasts-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ include "custom.podcastsNfsName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs-client
@@ -12,7 +12,7 @@ audiobookshelf:
        main:
          image:
            repository: ghcr.io/advplyr/audiobookshelf
-            tag: 2.33.1@sha256:a4a5841bba093d81e5f4ad1eaedb4da3fda6dbb2528c552349da50ad1f7ae708
+            tag: 2.34.0@sha256:4143292c530f6ac6700afd13360c04f477e4f1a81c1c97c4224b1c7e4330c5c4
          env:
            - name: TZ
              value: America/Chicago
@@ -23,7 +23,7 @@ audiobookshelf:
        apprise-api:
          image:
            repository: ghcr.io/caronc/apprise
-            tag: v1.3.3@sha256:4bfeac268ba87b8e08e308c9aa0182fe99e9501ec464027afc333d1634e65977
+            tag: v1.4.1@sha256:25e0577915c2f06233ae1dce077f05c0fc9ba4f0ea89de5aee18a32b2ee9a75c
          env:
            - name: TZ
              value: America/Chicago
@@ -40,7 +40,7 @@ audiobookshelf:
            - name: APPRISE_STATELESS_URLS
              valueFrom:
                secretKeyRef:
-                  name: audiobookshelf-apprise-config
+                  name: audiobookshelf-config-apprise
                  key: ntfy-url
  service:
    main:
@@ -129,21 +129,21 @@ volsync-target-config:
  pvcTarget: audiobookshelf-config
  local:
    enabled: true
-    schedule: 2 8 * * *
+    schedule: 5 8 * * *
  remote:
    enabled: true
-    schedule: 2 9 * * *
+    schedule: 5 10 * * 0
  external:
    enabled: true
-    schedule: 2 10 * * *
+    schedule: 5 9 * * 0
 volsync-target-metadata:
  pvcTarget: audiobookshelf-metadata
  local:
    enabled: true
-    schedule: 4 8 * * *
+    schedule: 10 8 * * *
  remote:
    enabled: true
-    schedule: 4 9 * * *
+    schedule: 10 10 * * 0
  external:
    enabled: true
-    schedule: 4 10 * * *
+    schedule: 10 9 * * 0
@@ -1,15 +1,15 @@
 dependencies:
 - name: authentik
  repository: https://charts.goauthentik.io/
-  version: 2026.2.1
+  version: 2026.2.3
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.4.0
+  version: 3.3.0
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.11.2
+  version: 7.12.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-digest: sha256:7302a85008aee7950aa345aa7d64563c1b0da8f07e348ec9709f9438503a41ff
-generated: "2026-04-04T21:00:59.689114-05:00"
+  version: 0.8.0
+digest: sha256:cb3b3745cbfc4ef138a43fb617e27022a220acee177a30ca02e4f78509ca5c3f
+generated: "2026-05-14T14:04:28.583181759Z"
@@ -18,18 +18,18 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: authentik
-    version: 2026.2.1
+    version: 2026.2.3
    repository: https://charts.goauthentik.io/
  - name: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.4.0
+    version: 3.3.0
  - name: postgres-cluster
    alias: postgres-18-cluster
-    version: 7.11.2
+    version: 7.12.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey
-    version: 0.5.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/authentik.png
 # renovate: datasource=github-releases depName=goauthentik/authentik
@@ -0,0 +1,14 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
@@ -1,16 +1,15 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: authentik-key-secret
+  name: authentik-key
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: authentik-key-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: authentik-key
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: key
      remoteRef:
@@ -1,12 +1,11 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: authentik-tailscale
+  name: {{ .Release.Name }}-tailscale
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: authentik-tailscale
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ .Release.Name }}-tailscale
+    {{- include "custom.labels" . | nindent 4 }}
    tailscale.com/proxy-class: no-metrics
  annotations:
    tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"
@@ -26,4 +25,4 @@ spec:
              service:
                name: authentik-server
                port:
-                  number: 80
+                  name: http
@@ -5,8 +5,7 @@ metadata:
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: allow-outpost-cross-namespace-access
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  from:
    - group: gateway.networking.k8s.io
@@ -4,7 +4,7 @@ authentik:
      - name: AUTHENTIK_SECRET_KEY
        valueFrom:
          secretKeyRef:
-            name: authentik-key-secret
+            name: authentik-key
            key: key
      - name: AUTHENTIK_POSTGRESQL__HOST
        valueFrom:
@@ -1,12 +1,12 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
+  version: 5.0.1
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
+  version: 2.0.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-digest: sha256:f203538010828e77336f3cf39451a1072c90aeb8ece7c173a3476c49883b46d1
-generated: "2026-03-06T01:05:24.935421139Z"
+  version: 2.0.0
+digest: sha256:099e7a9792fceb0cbce4c13e997c5029af39807da6e5c9825a1a042b785e0887
+generated: "2026-05-15T00:28:48.302596135Z"
@@ -17,15 +17,15 @@ dependencies:
  - name: app-template
    alias: backrest
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.6.2
+    version: 5.0.1
  - name: volsync-target
    alias: volsync-target-config
-    version: 0.8.0
+    version: 2.0.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-data
-    version: 0.8.0
+    version: 2.0.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/backrest.png
 # renovate: datasource=github-releases depName=garethgeorge/backrest
-appVersion: v1.12.1
+appVersion: v1.13.0
@@ -0,0 +1,24 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+NFS names
+*/}}
+{{- define "custom.storageNfsName" -}}
+backrest-nfs-storage
+{{- end -}}
+{{- define "custom.shareNfsName" -}}
+backrest-nfs-share
+{{- end -}}
@@ -1,14 +1,13 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: backrest-nfs-storage
+  name: {{ include "custom.storageNfsName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: backrest-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ include "custom.storageNfsName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
-  volumeName: backrest-nfs-storage
+  volumeName: {{ include "custom.storageNfsName" . }}
  storageClassName: nfs-client
  accessModes:
    - ReadWriteMany
@@ -20,14 +19,13 @@ spec:
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: backrest-nfs-share
+  name: {{ include "custom.shareNfsName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: backrest-nfs-share
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ include "custom.shareNfsName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
-  volumeName: backrest-nfs-share
+  volumeName: {{ include "custom.shareNfsName" . }}
  storageClassName: nfs-client
  accessModes:
    - ReadWriteMany
@@ -1,12 +1,11 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: backrest-nfs-storage
+  name: {{ include "custom.storageNfsName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: backrest-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ include "custom.storageNfsName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs-client
@@ -26,12 +25,11 @@ spec:
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: backrest-nfs-share
+  name: {{ include "custom.shareNfsName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: backrest-nfs-share
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ include "custom.shareNfsName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs-client
@@ -8,7 +8,7 @@ backrest:
        main:
          image:
            repository: ghcr.io/garethgeorge/backrest
-            tag: v1.12.1@sha256:f4d34bd6fa985d13bdb6c01c5d8727e07708899afa9567d800808357d77b9fb0
+            tag: v1.13.0@sha256:9c9966b5c285ec791a6b06cb4545fa0247424d05442e12f9558b4322d9f8a15f
          env:
            - name: TZ
              value: America/Chicago
@@ -115,21 +115,21 @@ volsync-target-data:
  pvcTarget: backrest-data
  local:
    enabled: true
-    schedule: 6 8 * * *
+    schedule: 15 8 * * *
  remote:
    enabled: true
-    schedule: 6 9 * * *
+    schedule: 15 10 * * 0
  external:
    enabled: true
-    schedule: 6 10 * * *
+    schedule: 15 9 * * 0
 volsync-target-config:
  pvcTarget: backrest-config
  local:
    enabled: true
-    schedule: 8 8 * * *
+    schedule: 20 8 * * *
  remote:
    enabled: true
-    schedule: 8 9 * * *
+    schedule: 20 10 * * 0
  external:
    enabled: true
-    schedule: 8 10 * * *
+    schedule: 20 9 * * 0
@@ -1,9 +1,9 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
+  version: 5.0.1
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-digest: sha256:ce88e4cd451613c9dbc25d285700970789ff678452ef277f3c8465dbf6157f1f
-generated: "2026-03-06T01:05:44.405374459Z"
+  version: 2.0.0
+digest: sha256:bcced6d5e69265581b976c3e0426cc1330e36109255ce34533ef0d9b991054a5
+generated: "2026-05-15T00:29:00.968381514Z"
@@ -10,7 +10,9 @@ home: https://docs.alexlebens.dev/applications/bazarr/
 sources:
  - https://github.com/morpheus65535/bazarr
  - https://github.com/linuxserver/docker-bazarr
+  - https://github.com/onedr0p/exportarr
  - https://github.com/linuxserver/docker-bazarr/pkgs/container/bazarr
+  - https://github.com/onedr0p/exportarr/pkgs/container/exportarr
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
@@ -19,10 +21,10 @@ dependencies:
  - name: app-template
    alias: bazarr
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.6.2
+    version: 5.0.1
  - name: volsync-target
    alias: volsync-target-config
-    version: 0.8.0
+    version: 2.0.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/bazarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-bazarr
@@ -0,0 +1,21 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+NFS names
+*/}}
+{{- define "custom.storageNfsName" -}}
+bazarr-nfs-storage
+{{- end -}}
@@ -0,0 +1,17 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: bazarr-key
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: bazarr-key
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: key
+      remoteRef:
+        key: /cl01tl/bazarr/key
+        property: key
@@ -1,14 +1,13 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: bazarr-nfs-storage
+  name: {{ include "custom.storageNfsName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: bazarr-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ include "custom.storageNfsName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
-  volumeName: bazarr-nfs-storage
+  volumeName: {{ include "custom.storageNfsName" . }}
  storageClassName: nfs-client
  accessModes:
    - ReadWriteMany
@@ -1,12 +1,11 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: bazarr-nfs-storage
+  name: {{ include "custom.storageNfsName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: bazarr-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ include "custom.storageNfsName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs-client
@@ -23,11 +23,28 @@ bazarr:
            - name: PGID
              value: 1000
          resources:
-            limits:
-              cpu: 100m
            requests:
-              cpu: 1m
+              cpu: 10m
              memory: 250Mi
+        metrics:
+          image:
+            repository: ghcr.io/onedr0p/exportarr
+            tag: v2.3.0@sha256:af535d94061cf97a52e1661945ffba78c03f9443eae7c0da1a80a5a4be56b520
+          args: ["bazarr"]
+          env:
+            - name: URL
+              value: http://localhost:6767
+            - name: PORT
+              value: 9792
+            - name: APIKEY
+              valueFrom:
+                secretKeyRef:
+                  name: bazarr-key
+                  key: key
+            - name: ENABLE_ADDITIONAL_METRICS
+              value: false
+            - name: ENABLE_UNKNOWN_QUEUE_ITEMS
+              value: false
  service:
    main:
      controller: main
@@ -35,6 +52,21 @@ bazarr:
        http:
          port: 80
          targetPort: 6767
+        metrics:
+          port: 9792
+          targetPort: 9792
+  serviceMonitor:
+    main:
+      selector:
+        matchLabels:
+          app.kubernetes.io/name: bazarr
+          app.kubernetes.io/instance: bazarr
+      serviceName: '{{ include "bjw-s.common.lib.chart.names.fullname" $ }}'
+      endpoints:
+        - port: metrics
+          interval: 3m
+          scrapeTimeout: 1m
+          path: /metrics
  route:
    main:
      kind: HTTPRoute
@@ -80,10 +112,10 @@ volsync-target-config:
    fsGroupChangePolicy: OnRootMismatch
  local:
    enabled: true
-    schedule: 10 8 * * *
+    schedule: 25 8 * * *
  remote:
    enabled: true
-    schedule: 10 9 * * *
+    schedule: 25 10 * * 0
  external:
    enabled: true
-    schedule: 10 10 * * *
+    schedule: 25 9 * * 0
@@ -1,9 +1,9 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
+  version: 5.0.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-digest: sha256:49b0e666059bad492ebaa4a20119ce5bbd1959a1ee6b22b271a9ca9529122697
-generated: "2026-03-31T18:37:20.549898-05:00"
+  version: 0.8.0
+digest: sha256:adbf5c062f0be520b579854a9ec75e6932b472508d9b1ec7277bacc3940c20e9
+generated: "2026-05-15T00:29:14.40707075Z"
@@ -17,10 +17,10 @@ dependencies:
  - name: app-template
    alias: blocky
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.6.2
+    version: 5.0.1
  - name: valkey
    alias: valkey
-    version: 0.5.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/blocky.png
 # renovate: datasource=github-releases depName=0xerr0r/blocky
@@ -0,0 +1,14 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
@@ -106,10 +106,10 @@ blocky:
              audiobookshelf                  IN      CNAME   traefik-cl01tl
              authentik                       IN      CNAME   traefik-cl01tl
              backrest                        IN      CNAME   traefik-cl01tl
+              bao                             IN      CNAME   traefik-cl01tl
              bazarr                          IN      CNAME   traefik-cl01tl
              ceph                            IN      CNAME   traefik-cl01tl
              dawarich                        IN      CNAME   traefik-cl01tl
-              dependency-track                IN      CNAME   traefik-cl01tl
              directus                        IN      CNAME   traefik-cl01tl
              excalidraw                      IN      CNAME   traefik-cl01tl
              feishin                         IN      CNAME   traefik-cl01tl
@@ -134,7 +134,7 @@ blocky:
              komodo                          IN      CNAME   traefik-cl01tl
              languagetool                    IN      CNAME   traefik-cl01tl
              lidarr                          IN      CNAME   traefik-cl01tl
-              mail                            IN      CNAME   traefik-cl01tl
+              loki                            IN      CNAME   traefik-cl01tl
              medialyze                       IN      CNAME   traefik-cl01tl
              music-grabber                   IN      CNAME   traefik-cl01tl
              navidrome                       IN      CNAME   traefik-cl01tl
@@ -161,7 +161,7 @@ blocky:
              sonarr                          IN      CNAME   traefik-cl01tl
              sonarr-4k                       IN      CNAME   traefik-cl01tl
              sonarr-anime                    IN      CNAME   traefik-cl01tl
-              stalwart                        IN      CNAME   traefik-cl01tl
+              sparkyfitness                   IN      CNAME   traefik-cl01tl
              tdarr                           IN      CNAME   traefik-cl01tl
              tubearchivist                   IN      CNAME   traefik-cl01tl
              vault                           IN      CNAME   traefik-cl01tl
@@ -1,6 +1,6 @@
 dependencies:
 - name: cert-manager
  repository: https://charts.jetstack.io
-  version: v1.20.1
-digest: sha256:1bf36eba44cf096b40355a697b8cffb302f07f9135374222aabdf686f017b7a9
-generated: "2026-03-28T01:35:24.542754563Z"
+  version: v1.20.2
+digest: sha256:f218239b4538c64d57e098a56c69dcbc4e076ffcc3d320c5a5fef1e6309e38cf
+generated: "2026-04-13T23:02:59.380767677Z"
@@ -13,8 +13,8 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: cert-manager
-    version: v1.20.1
+    version: v1.20.2
    repository: https://charts.jetstack.io
 icon: https://raw.githubusercontent.com/cert-manager/cert-manager/refs/heads/master/logo/logo.png
 # renovate: datasource=github-releases depName=cert-manager/cert-manager
-appVersion: v1.20.1
+appVersion: v1.20.2
@@ -0,0 +1,24 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+NFS names
+*/}}
+{{- define "custom.cloudflareSecretName" -}}
+cert-manager-cloudflare-api-token
+{{- end -}}
+{{- define "custom.cloudflareSecretKey" -}}
+api-token
+{{- end -}}
@@ -5,8 +5,7 @@ metadata:
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: letsencrypt-issuer
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  acme:
    email: alexanderlebens@gmail.com
@@ -22,5 +21,5 @@ spec:
          cloudflare:
            email: alexanderlebens@gmail.com
            apiTokenSecretRef:
-              name: cloudflare-api-token
-              key: api-token
+              name: {{ include "custom.cloudflareSecretName" . }}
+              key: {{ include "custom.cloudflareSecretKey" . }}
@@ -1,18 +1,17 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: cloudflare-api-token
+  name: {{ include "custom.cloudflareSecretName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: cloudflare-api-token
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ include "custom.cloudflareSecretName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
-    - secretKey: api-token
+    - secretKey: {{ include "custom.cloudflareSecretKey" . }}
      remoteRef:
-        key: /cloudflare/alexlebens.net/clusterissuer
+        key: /cloudflare/alexlebens.net/cl01tl-issuer-certificate
        property: token
@@ -0,0 +1,44 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: cert-manager
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: cert-manager
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  groups:
+    - name: EmbeddedExporter
+      rules:
+        - alert: Cert-ManagerAbsent
+          expr: absent(up{job="cert-manager"})
+          for: 10m
+          labels:
+            severity: critical
+          annotations:
+            summary: Cert-Manager absent (instance {{ `{{ $labels.instance }}` }})
+            description: "Cert-Manager has disappeared from Prometheus service discovery. New certificates will not be able to be minted, and existing ones can't be renewed until cert-manager is back.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: Cert-ManagerCertificateExpiringSoon
+          expr: avg by (exported_namespace, namespace, name) (certmanager_certificate_expiration_timestamp_seconds - time()) < (21 * 24 * 3600)
+          for: 1h
+          labels:
+            severity: warning
+          annotations:
+            summary: Cert-Manager certificate expiring soon (instance {{ `{{ $labels.instance }}` }})
+            description: "The certificate {{ `{{ $labels.name }}` }} is expiring in less than 21 days.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: Cert-ManagerCertificateNotReady
+          expr: max by (name, exported_namespace, namespace, condition) (certmanager_certificate_ready_status{condition!="True"} == 1)
+          for: 10m
+          labels:
+            severity: critical
+          annotations:
+            summary: Cert-Manager certificate not ready (instance {{ `{{ $labels.instance }}` }})
+            description: "The certificate {{ `{{ $labels.name }}` }} in namespace {{ `{{ $labels.exported_namespace }}` }} is not ready to serve traffic.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: Cert-ManagerHittingACMERateLimits
+          expr: sum by (host) (rate(certmanager_acme_client_request_count{status="429"}[5m])) > 0
+          for: 5m
+          labels:
+            severity: critical
+          annotations:
+            summary: Cert-Manager hitting ACME rate limits (instance {{ `{{ $labels.instance }}` }})
+            description: "Cert-Manager is being rate-limited by the ACME provider. Certificate issuance and renewal may be blocked for up to a week.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
@@ -1,6 +1,6 @@
 dependencies:
 - name: cilium
  repository: https://helm.cilium.io/
-  version: 1.18.6
-digest: sha256:8ea328ac238524b5b423e6289f5e25d05ef64e6aa19cfd5de238f1d5dd533e9b
-generated: "2026-02-05T12:00:20.15778-06:00"
+  version: 1.18.9
+digest: sha256:f7d127bed9b2c9154f25ffdc36ef7477ac8c8b12aeb92c5f4c20be5abd49ec11
+generated: "2026-05-10T19:25:36.71023-05:00"
@@ -14,8 +14,8 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: cilium
-    version: 1.18.6
+    version: 1.18.9
    repository: https://helm.cilium.io/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/cilium.png
 # renovate: datasource=github-releases depName=cilium/cilium
-appVersion: 1.18.6
+appVersion: 1.18.9
@@ -0,0 +1,14 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
@@ -1,19 +0,0 @@
-# apiVersion: cilium.io/v2
-# kind: CiliumBGPAdvertisement
-# metadata:
-#   name: cilium-bgp-advertisements
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: cilium-bgp-advertisements
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   advertisements:
-#     - advertisementType: "Service"
-#       service:
-#         addresses:
-#           - ExternalIP
-#           - LoadBalancerIP
-#       selector:
-#         matchExpressions:
-#          - {key: somekey, operator: NotIn, values: ['never-used-value']}
@@ -1,22 +0,0 @@
-# apiVersion: cilium.io/v2
-# kind: CiliumBGPClusterConfig
-# metadata:
-#   name: cilium-bgp
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: cilium-bgp
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   nodeSelector:
-#     matchLabels:
-#       node-role.kubernetes.io/bgp: "65020"
-#   bgpInstances:
-#     - name: "65020"
-#       localASN: 65020
-#       peers:
-#         - name: "udm-65000"
-#           peerASN: 65000
-#           peerAddress: 192.168.1.1
-#           peerConfigRef:
-#             name: "cilium-peer"
@@ -1,23 +0,0 @@
-# apiVersion: cilium.io/v2
-# kind: CiliumBGPPeerConfig
-# metadata:
-#   name: cilium-peer
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: cilium-peer
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   timers:
-#     holdTimeSeconds: 9
-#     keepAliveTimeSeconds: 3
-#   ebgpMultihop: 4
-#   gracefulRestart:
-#     enabled: true
-#     restartTimeSeconds: 15
-#   families:
-#     - afi: ipv4
-#       safi: unicast
-#       advertisements:
-#         matchLabels:
-#           app.kubernetes.io/name: cilium-bgp-advertisements
@@ -5,25 +5,8 @@ metadata:
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: default-ip-pool
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  blocks:
    - start: "10.232.1.21"
      stop: "10.232.1.23"
-
---
-apiVersion: cilium.io/v2
-kind: CiliumLoadBalancerIPPool
-metadata:
-  name: bgp-ip-pool
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: bgp-ip-pool
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  blocks:
-    - start: "10.232.2.100"
-      stop: "10.232.2.200"
-  disabled: true
@@ -1,45 +0,0 @@
-# apiVersion: gateway.networking.k8s.io/v1
-# kind: Gateway
-# metadata:
-#   name: cilium-tls-gateway
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: cilium-tls-gateway
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-#   annotations:
-#     cert-manager.io/cluster-issuer: letsencrypt-issuer
-# spec:
-#   addresses:
-#     - type: IPAddress
-#       value: 10.232.1.23
-#   gatewayClassName: cilium
-#   listeners:
-#     - allowedRoutes:
-#         namespaces:
-#           from: All
-#       hostname: '*.alexlebens.net'
-#       name: https
-#       port: 443
-#       protocol: HTTPS
-#       tls:
-#         certificateRefs:
-#           - group: ''
-#             kind: Secret
-#             name: https-gateway-cert
-#             namespace: kube-system
-#         mode: Terminate
-#     - allowedRoutes:
-#         namespaces:
-#           from: All
-#       hostname: 'alexlebens.net'
-#       name: https-domain
-#       port: 443
-#       protocol: HTTPS
-#       tls:
-#         certificateRefs:
-#           - group: ''
-#             kind: Secret
-#             name: https-gateway-cert
-#             namespace: kube-system
-#         mode: Terminate
@@ -5,8 +5,7 @@ metadata:
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: hubble
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  parentRefs:
    - group: gateway.networking.k8s.io
@@ -21,8 +20,6 @@ spec:
          type: PathPrefix
          value: /
      backendRefs:
-        - group: ''
-          kind: Service
+        - kind: Service
          name: hubble-ui
          port: 80
-          weight: 100
@@ -25,20 +25,14 @@ cilium:
        - NET_ADMIN
        - SYS_ADMIN
        - SYS_RESOURCE
-  bgpControlPlane:
-    enabled: false
  bpf:
    hostLegacyRouting: true
+    masquerade: false
  devices: end0 enp6s0
  ciliumEndpointSlice:
    enabled: true
  gatewayAPI:
-    enabled: true
-    enableAppProtocol: true
-    enableAlpn: true
-    secretsNamespace:
-      create: false
-      name: kube-system
+    enabled: false
  socketLB:
    enabled: true
    hostNamespaceOnly: true
@@ -1,9 +1,15 @@
 dependencies:
 - name: cloudnative-pg
  repository: https://cloudnative-pg.io/charts/
-  version: 0.28.0
+  version: 0.28.2
 - name: plugin-barman-cloud
  repository: https://cloudnative-pg.io/charts/
-  version: 0.5.0
-digest: sha256:3e9b26d00fdb61af60f003bcb327e05d02799eb6088e30aaabd01c49c6021aac
-generated: "2026-04-01T20:05:40.198140255Z"
+  version: 0.6.0
+- name: rclone-bucket
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.11.3
+- name: rclone-bucket
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.11.3
+digest: sha256:a08719a82de76d62cddfec163dbc9feecfbea83ab406f3750d25d4deaf586f0c
+generated: "2026-05-13T00:10:14.309341878Z"
@@ -13,15 +13,24 @@ sources:
  - https://github.com/cloudnative-pg/postgres-containers/pkgs/container/postgresql
  - https://github.com/cloudnative-pg/charts/tree/main/charts/cloudnative-pg
  - https://github.com/cloudnative-pg/charts/tree/main/charts/plugin-barman-cloud
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/rclone-bucket
 maintainers:
  - name: alexlebens
 dependencies:
  - name: cloudnative-pg
-    version: 0.28.0
+    version: 0.28.2
    repository: https://cloudnative-pg.io/charts/
  - name: plugin-barman-cloud
-    version: 0.5.0
+    version: 0.6.0
    repository: https://cloudnative-pg.io/charts/
+  - name: rclone-bucket
+    alias: rclone-postgres-backups-remote
+    repository: oci://harbor.alexlebens.net/helm-charts
+    version: 0.11.3
+  - name: rclone-bucket
+    alias: rclone-postgres-backups-external
+    repository: oci://harbor.alexlebens.net/helm-charts
+    version: 0.11.3
 icon: https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg.github.io/refs/heads/main/assets/images/hero_image.png
 # renovate: datasource=github-releases depName=cloudnative-pg/cloudnative-pg
-appVersion: 1.29.0
+appVersion: 1.29.1
@@ -0,0 +1,14 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
@@ -14,3 +14,61 @@ plugin-barman-cloud:
    requests:
      cpu: 1m
      memory: 20Mi
+rclone-postgres-backups-remote:
+  nameOverride: postgres-backups-remote-rclone
+  cronJob:
+    suspend: false
+    schedule: 30 6 * * 1
+  rclone:
+    source:
+      bucketName: postgres-backups
+    destination:
+      bucketName: postgres-backups
+  prune:
+    enabled: true
+    ageToPrune: 45d
+    include: "/cl01tl/*/*/*/base/**"
+    exclude: "**/walls/**"
+  secret:
+    externalSecret:
+      source:
+        credentials:
+          path: /garage/home-infra/postgres-backups
+        config:
+          path: /garage/config
+      destination:
+        credentials:
+          path: /garage/home-infra/postgres-backups
+        config:
+          path: /garage/config
+rclone-postgres-backups-external:
+  nameOverride: postgres-backups-external-rclone
+  cronJob:
+    suspend: false
+    schedule: 0 6 * * 1
+  rclone:
+    source:
+      bucketName: postgres-backups
+    destination:
+      bucketName: postgres-backups-775957147abfbc73
+  prune:
+    enabled: true
+    ageToPrune: 45d
+    include: "/cl01tl/*/*/*/base/**"
+    exclude: "**/walls/**"
+  secret:
+    externalSecret:
+      source:
+        credentials:
+          path: /garage/home-infra/postgres-backups
+        config:
+          path: /garage/config
+      destination:
+        credentials:
+          path: /backblaze/home-infra/postgres-backups
+          keyIdProperty: AWS_ACCESS_KEY_ID
+          secretKeyProperty: AWS_SECRET_ACCESS_KEY
+          regionProperty: AWS_REGION
+        config:
+          path: /backblaze/config
+          endpointProperty: ENDPOINT
@@ -8,6 +8,7 @@ keywords:
 home: https://docs.alexlebens.dev/applications/coredns/
 sources:
  - https://github.com/coredns/coredns
+  - https://explore.ggcr.dev/?repo=registry.k8s.io%2Fcoredns%2Fcoredns
  - https://github.com/coredns/helm
 maintainers:
  - name: alexlebens
@@ -17,4 +18,4 @@ dependencies:
    repository: https://coredns.github.io/helm
 icon: https://raw.githubusercontent.com/coredns/coredns.io/refs/heads/master/static/images/favicon.png
 # renovate: datasource=github-releases depName=coredns/coredns
-appVersion: v1.14.2
+appVersion: v1.14.3
@@ -0,0 +1,14 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
@@ -1,7 +1,7 @@
 coredns:
  image:
-    repository: registry.k8s.io/coredns/coredns
-    tag: v1.14.2@sha256:e7e6440cfd1e919280958f5b5a6ab2b184d385bba774c12ad2a9e1e4183f90d9
+    repository: coredns/coredns
+    tag: 1.14.3@sha256:b21d26b915e10acb5bc78715c1e8b6047ab2675389b2bcc18b3a6499d90e74c0
  replicaCount: 3
  resources:
    limits:
@@ -1,12 +1,21 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
+  version: 5.0.1
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.11.2
+  version: 7.12.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-digest: sha256:b070640b7006e3ad528193ca784cfbca602994c87afbef4ef4b40a05229cab10
-generated: "2026-04-04T21:01:27.376484-05:00"
+  version: 0.8.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 2.0.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 2.0.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 2.0.0
+digest: sha256:9cee1f95659261182052fb1e48c74052cca5b346c39d61ca99c20eeb1e6ce8ae
+generated: "2026-05-15T00:29:26.90725275Z"
@@ -12,21 +12,34 @@ sources:
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
  - name: alexlebens
 dependencies:
  - name: app-template
    alias: dawarich
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.6.2
+    version: 5.0.1
  - name: postgres-cluster
    alias: postgres-18-cluster
-    version: 7.11.2
+    version: 7.12.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey
-    version: 0.5.0
+    version: 0.8.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-storage
+    version: 2.0.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-public
+    version: 2.0.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-watched
+    version: 2.0.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/dawarich.png
 # renovate: datasource=github-releases depName=Freika/dawarich
-appVersion: 1.6.1
+appVersion: 1.7.8
@@ -0,0 +1,14 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
@@ -1,42 +1,75 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: dawarich-key-secret
+  name: dawarich-key
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: dawarich-key-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: dawarich-key
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: key
      remoteRef:
        key: /cl01tl/dawarich/key
        property: key
+    - secretKey: otp-primary-key
+      remoteRef:
+        key: /cl01tl/dawarich/key
+        property: otp-primary-key
+    - secretKey: otp-deterministic-key
+      remoteRef:
+        key: /cl01tl/dawarich/key
+        property: otp-deterministic-key
+    - secretKey: otp-derivation-salt
+      remoteRef:
+        key: /cl01tl/dawarich/key
+        property: otp-derivation-salt

 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: dawarich-oidc-secret
+  name: dawarich-oidc-authentik
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: dawarich-oidc-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: dawarich-oidc-authentik
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: client
      remoteRef:
-        key: /authentik/oidc/dawarich
+        key: /cl01tl/authentik/oidc/dawarich
        property: client
    - secretKey: secret
      remoteRef:
-        key: /authentik/oidc/dawarich
+        key: /cl01tl/authentik/oidc/dawarich
        property: secret
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: dawarich-metrics-credentials
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: dawarich-metrics-credentials
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: user
+      remoteRef:
+        key: /cl01tl/dawarich/metrics
+        property: user
+    - secretKey: password
+      remoteRef:
+        key: /cl01tl/dawarich/metrics
+        property: password
@@ -8,7 +8,7 @@ dawarich:
        main:
          image:
            repository: freikin/dawarich
-            tag: 1.6.1@sha256:a884f69f19ce0f66992f3872d24544d1e587e133b8a003e072711aafc1e02429
+            tag: 1.7.8@sha256:dea326d03e728cd3b8d051b72d293cf375d0db6c00e22c55f338daedfdfdb3a4
          command:
            - "web-entrypoint.sh"
          args:
@@ -61,12 +61,12 @@ dawarich:
            - name: OIDC_CLIENT_ID
              valueFrom:
                secretKeyRef:
-                  name: dawarich-oidc-secret
+                  name: dawarich-oidc-authentik
                  key: client
            - name: OIDC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
-                  name: dawarich-oidc-secret
+                  name: dawarich-oidc-authentik
                  key: secret
            - name: OIDC_PROVIDER_NAME
              value: Authentik
@@ -78,11 +78,36 @@ dawarich:
              value: 0.0.0.0
            - name: PROMETHEUS_EXPORTER_PORT
              value: 9394
+            - name: METRICS_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: dawarich-metrics-credentials
+                  key: user
+            - name: METRICS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: dawarich-metrics-credentials
+                  key: password
            - name: SECRET_KEY_BASE
              valueFrom:
                secretKeyRef:
-                  name: dawarich-key-secret
+                  name: dawarich-key
                  key: key
+            - name: OTP_ENCRYPTION_PRIMARY_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: dawarich-key
+                  key: otp-primary-key
+            - name: OTP_ENCRYPTION_DETERMINISTIC_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: dawarich-key
+                  key: otp-deterministic-key
+            - name: OTP_ENCRYPTION_KEY_DERIVATION_SALT
+              valueFrom:
+                secretKeyRef:
+                  name: dawarich-key
+                  key: otp-derivation-salt
            - name: RAILS_LOG_TO_STDOUT
              value: true
            - name: SELF_HOSTED
@@ -111,7 +136,7 @@ dawarich:
        sidekiq:
          image:
            repository: freikin/dawarich
-            tag: 1.6.1@sha256:a884f69f19ce0f66992f3872d24544d1e587e133b8a003e072711aafc1e02429
+            tag: 1.7.8@sha256:dea326d03e728cd3b8d051b72d293cf375d0db6c00e22c55f338daedfdfdb3a4
          command:
            - "sidekiq-entrypoint.sh"
          args:
@@ -161,12 +186,12 @@ dawarich:
            - name: OIDC_CLIENT_ID
              valueFrom:
                secretKeyRef:
-                  name: dawarich-oidc-secret
+                  name: dawarich-oidc-authentik
                  key: client
            - name: OIDC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
-                  name: dawarich-oidc-secret
+                  name: dawarich-oidc-authentik
                  key: secret
            - name: OIDC_PROVIDER_NAME
              value: Authentik
@@ -178,11 +203,36 @@ dawarich:
              value: 0.0.0.0
            - name: PROMETHEUS_EXPORTER_PORT
              value: 9394
+            - name: METRICS_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: dawarich-metrics-credentials
+                  key: user
+            - name: METRICS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: dawarich-metrics-credentials
+                  key: password
            - name: SECRET_KEY_BASE
              valueFrom:
                secretKeyRef:
-                  name: dawarich-key-secret
+                  name: dawarich-key
                  key: key
+            - name: OTP_ENCRYPTION_PRIMARY_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: dawarich-key
+                  key: otp-primary-key
+            - name: OTP_ENCRYPTION_DETERMINISTIC_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: dawarich-key
+                  key: otp-deterministic-key
+            - name: OTP_ENCRYPTION_KEY_DERIVATION_SALT
+              valueFrom:
+                secretKeyRef:
+                  name: dawarich-key
+                  key: otp-derivation-salt
            - name: RAILS_LOG_TO_STDOUT
              value: true
            - name: SELF_HOSTED
@@ -226,6 +276,13 @@ dawarich:
          interval: 30s
          scrapeTimeout: 15s
          path: /metrics
+          basicAuth:
+            password:
+              name: dawarich-metrics-credentials
+              key: password
+            username:
+              name: dawarich-metrics-credentials
+              key: user
  route:
    main:
      kind: HTTPRoute
@@ -313,3 +370,36 @@ postgres-18-cluster:
        immediate: true
        schedule: "0 10 14 * * *"
        backupName: garage-local
+volsync-target-storage:
+  pvcTarget: dawarich-storage
+  local:
+    enabled: true
+    schedule: 30 8 * * *
+  remote:
+    enabled: true
+    schedule: 30 10 * * 0
+  external:
+    enabled: true
+    schedule: 30 9 * * 0
+volsync-target-public:
+  pvcTarget: dawarich-public
+  local:
+    enabled: true
+    schedule: 35 8 * * *
+  remote:
+    enabled: true
+    schedule: 35 10 * * 0
+  external:
+    enabled: true
+    schedule: 35 9 * * 0
+volsync-target-watched:
+  pvcTarget: dawarich-watched
+  local:
+    enabled: true
+    schedule: 40 8 * * *
+  remote:
+    enabled: true
+    schedule: 40 10 * * 0
+  external:
+    enabled: true
+    schedule: 40 9 * * 0
@@ -0,0 +1,14 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
@@ -1,16 +1,15 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: synology-iscsi-config-secret
+  name: synology-iscsi-config
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: synology-iscsi-config-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: synology-iscsi-config
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: driver-config-file.yaml
      remoteRef:
@@ -1,11 +1,10 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: democratic-csi-synology-iscsi
+  name: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: democratic-csi-synology-iscsi
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ .Release.Namespace }}
+    {{- include "custom.labels" . | nindent 4 }}
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/warn: privileged
@@ -3,7 +3,7 @@ democratic-csi:
    image:
      registry: ghcr.io/democratic-csi/democratic-csi
      tag: v1.9.5@@sha256:fc3b7d7ed3a616714139525075312758e23a5d425ffb539ad12c9bd20fb6001f
-    existingConfigSecret: synology-iscsi-config-secret
+    existingConfigSecret: synology-iscsi-config
    config:
      driver: synology-iscsi
    resources:
@@ -47,6 +47,8 @@ democratic-csi:
        fsType: ext4
  node:
    hostPID: true
+    rbac:
+      enabled: true
    driver:
      extraEnv:
        - name: ISCSIADM_HOST_STRATEGY
@@ -1,9 +0,0 @@
-dependencies:
- name: dependency-track
-  repository: https://dependencytrack.github.io/helm-charts
-  version: 0.44.0
- name: postgres-cluster
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.11.2
-digest: sha256:6ea7e8066cce675a02ce76393ee2b0e23300d2f5c72ae64946ae667fc12fde1f
-generated: "2026-04-05T17:32:11.221935-05:00"
@@ -1,27 +0,0 @@
-apiVersion: v2
-name: dependency-track
-version: 1.0.0
-description: Dependency Track
-keywords:
-  - dependency-track
-  - vulnerability-scanner
-home: https://docs.alexlebens.dev/applications/dependency-track/
-sources:
-  - https://github.com/DependencyTrack/dependency-track
-  - https://hub.docker.com/r/dependencytrack/apiserver
-  - https://hub.docker.com/r/dependencytrack/frontend
-  - https://github.com/DependencyTrack/helm-charts/tree/main/charts/dependency-track
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: dependency-track
-    version: 0.44.0
-    repository: https://dependencytrack.github.io/helm-charts
-  - name: postgres-cluster
-    alias: postgres-18-cluster
-    version: 7.11.2
-    repository: oci://harbor.alexlebens.net/helm-charts
-icon: https://avatars.githubusercontent.com/u/40258585
-# renovate: datasource=github-releases depName=DependencyTrack/dependency-track
-appVersion: 4.14.1
@@ -1,42 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: dependency-track-key-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: dependency-track-key-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: secret.key
-      remoteRef:
-        key: /cl01tl/dependency-track/key
-        property: key
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: dependency-track-oidc-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: dependency-track-oidc-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: client
-      remoteRef:
-        key: /authentik/oidc/dependency-track
-        property: client
-    - secretKey: secret
-      remoteRef:
-        key: /authentik/oidc/dependency-track
-        property: secret
@@ -1,114 +0,0 @@
-dependency-track:
-  common:
-    secretKey:
-      createSecret: false
-      existingSecretName: dependency-track-key-secret
-  apiServer:
-    image:
-      repository: dependencytrack/apiserver
-      tag: 4.14.1@sha256:2d8813e1ba4ada4aa23087d908c1b5a3ffce39261ead5555c397a1d67c7cbe9d
-    resources:
-      requests:
-        cpu: 100m
-        memory: 100Mi
-      limits:
-        memory: null
-    persistentVolume:
-      enabled: true
-      className: ceph-block
-      size: 5Gi
-    extraEnv:
-      - name: ALPINE_DATABASE_MODE
-        value: external
-      - name: ALPINE_DATABASE_DRIVER
-        value: org.postgresql.Driver
-      - name: ALPINE_DATABASE_URL
-        valueFrom:
-          secretKeyRef:
-            name: dependency-track-postgresql-18-cluster-app
-            key: jdbc-uri
-      - name: ALPINE_DATABASE_USERNAME
-        valueFrom:
-          secretKeyRef:
-            name: dependency-track-postgresql-18-cluster-app
-            key: user
-      - name: ALPINE_DATABASE_PASSWORD
-        valueFrom:
-          secretKeyRef:
-            name: dependency-track-postgresql-18-cluster-app
-            key: password
-      - name: ALPINE_OIDC_ENABLED
-        value: "true"
-      - name: ALPINE_OIDC_CLIENT_ID
-        valueFrom:
-          secretKeyRef:
-            name: dependency-track-oidc-secret
-            key: client
-      - name: ALPINE_OIDC_ISSUER
-        value: https://authentik.alexlebens.net/application/o/dependency-track/
-      - name: ALPINE_OIDC_USERNAME_CLAIM
-        value: preferred_username
-      - name: ALPINE_OIDC_TEAMS_CLAIM
-        value: groups
-      - name: ALPINE_OIDC_USER_PROVISIONING
-        value: "true"
-      - name: ALPINE_OIDC_TEAM_SYNCHRONIZATION
-        value: "true"
-      - name: ALPINE_CORS_ENABLED
-        value: "false"
-      - name: ALPINE_CORS_ALLOW_ORIGIN
-        value: dependency-track.alexlebens.net dependency-track.dependency-track
-    serviceMonitor:
-      enabled: true
-      namespace: dependency-track
-  frontend:
-    image:
-      repository: dependencytrack/frontend
-      tag: 4.14.1@sha256:8217737050b26ea69a6ddd6fe2cb419531a0bae0b903a87a04077a2415fc9f35
-    resources:
-      requests:
-        cpu: 10m
-        memory: 60Mi
-      limits:
-        memory: null
-    extraEnv:
-      - name: OIDC_ISSUER
-        value: https://authentik.alexlebens.net/application/o/dependency-track/
-      - name: OIDC_FLOW
-        value: explicit
-      - name: OIDC_CLIENT_ID
-        valueFrom:
-          secretKeyRef:
-            name: dependency-track-oidc-secret
-            key: client
-      - name: OIDC_LOGIN_BUTTON_TEXT
-        value: Authentik
-    apiBaseUrl: dependency-track-api-server.dependency-track
-  httpRoute:
-    enabled: true
-    hostnames:
-      - dependency-track.alexlebens.net
-    parentRefs:
-      - group: gateway.networking.k8s.io
-        kind: Gateway
-        name: traefik-gateway
-        namespace: traefik
-postgres-18-cluster:
-  mode: standalone
-  recovery:
-    method: objectStore
-    objectStore:
-      index: 1
-  backup:
-    objectStore:
-      - name: garage-local
-        index: 1
-        destinationBucket: postgres-backups
-        externalSecretCredentialPath: /garage/home-infra/postgres-backups
-        isWALArchiver: true
-    scheduledBackups:
-      - name: live-backup
-        suspend: false
-        immediate: true
-        schedule: "0 10 14 * * *"
-        backupName: garage-local
@@ -0,0 +1,14 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
@@ -10,7 +10,7 @@ descheduler:
    requests:
      cpu: 10m
      memory: 50Mi
-  deschedulingInterval: 5m
+  deschedulingInterval: 2m
  replicas: 3
  leaderElection:
    enabled: true
@@ -51,13 +51,13 @@ descheduler:
          - name: LowNodeUtilization
            args:
              thresholds:
-                cpu: 20
-                memory: 20
-                pods: 20
+                cpu: 30
+                memory: 30
+                pods: 30
              targetThresholds:
-                cpu: 50
-                memory: 50
-                pods: 60
+                cpu: 45
+                memory: 45
+                pods: 45
        plugins:
          balance:
            enabled:
@@ -1,12 +1,18 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
+  version: 5.0.1
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.11.2
+  version: 7.12.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-digest: sha256:5fa84b2d82a160c35e002690e4d299275b8136463da9da789be9ca7c6ff998c4
-generated: "2026-04-04T21:01:37.322862-05:00"
+  version: 0.8.0
+- name: rclone-bucket
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.11.3
+- name: rclone-bucket
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.11.3
+digest: sha256:80a6b37486f2ac7f189cf41b08e731f8a34df37e1af916c3eb49a5dc68939df0
+generated: "2026-05-15T00:29:39.148310428Z"
@@ -5,28 +5,37 @@ description: Directus
 keywords:
  - directus
  - content-management-system
-home: https://docs.alexlebens.dev/applications/descheduler/
+home: https://docs.alexlebens.dev/applications/directus/
 sources:
  - https://github.com/directus/directus
  - https://github.com/directus/directus/pkgs/container/directus
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/rclone-bucket
 maintainers:
  - name: alexlebens
 dependencies:
  - name: app-template
    alias: directus
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.6.2
+    version: 5.0.1
  - name: postgres-cluster
    alias: postgres-18-cluster
-    version: 7.11.2
+    version: 7.12.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey
-    version: 0.5.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: rclone-bucket
+    alias: rclone-directus-assets-remote
+    repository: oci://harbor.alexlebens.net/helm-charts
+    version: 0.11.3
+  - name: rclone-bucket
+    alias: rclone-directus-assets-external
+    repository: oci://harbor.alexlebens.net/helm-charts
+    version: 0.11.3
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/directus.png
 # renovate: datasource=github-releases depName=directus/directus
-appVersion: 11.17.2
+appVersion: 11.17.4
@@ -0,0 +1,14 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
@@ -5,13 +5,20 @@ metadata:
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: directus-config
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
+    - secretKey: key
+      remoteRef:
+        key: /cl01tl/directus/key
+        property: key
+    - secretKey: secret
+      remoteRef:
+        key: /cl01tl/directus/key
+        property: secret
    - secretKey: admin-email
      remoteRef:
        key: /cl01tl/directus/config
@@ -20,38 +27,6 @@ spec:
      remoteRef:
        key: /cl01tl/directus/config
        property: admin-password
-    - secretKey: secret
-      remoteRef:
-        key: /cl01tl/directus/config
-        property: secret
-    - secretKey: key
-      remoteRef:
-        key: /cl01tl/directus/config
-        property: key
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: directus-oidc-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: directus-oidc-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: OIDC_CLIENT_ID
-      remoteRef:
-        key: /authentik/oidc/directus
-        property: client
-    - secretKey: OIDC_CLIENT_SECRET
-      remoteRef:
-        key: /authentik/oidc/directus
-        property: secret

 ---
 apiVersion: external-secrets.io/v1
@@ -61,18 +36,67 @@ metadata:
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: directus-metric-token
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: metric-token
      remoteRef:
        key: /cl01tl/directus/metrics
        property: metric-token

+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: directus-valkey-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: directus-valkey-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: user
+      remoteRef:
+        key: /cl01tl/directus/valkey
+        property: user
+    - secretKey: password
+      remoteRef:
+        key: /cl01tl/directus/valkey
+        property: password
+    - secretKey: default
+      remoteRef:
+        key: /cl01tl/directus/valkey
+        property: password
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: directus-oidc-authentik
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: directus-oidc-authentik
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: OIDC_CLIENT_ID
+      remoteRef:
+        key: /cl01tl/authentik/oidc/directus
+        property: client
+    - secretKey: OIDC_CLIENT_SECRET
+      remoteRef:
+        key: /cl01tl/authentik/oidc/directus
+        property: secret
+
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
@@ -81,12 +105,11 @@ metadata:
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: directus-bucket-garage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
@@ -100,31 +123,3 @@ spec:
      remoteRef:
        key: /garage/home-infra/directus-assets
        property: ACCESS_REGION
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: directus-valkey-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: directus-valkey-config
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: default
-      remoteRef:
-        key: /cl01tl/directus/valkey
-        property: password
-    - secretKey: user
-      remoteRef:
-        key: /cl01tl/directus/valkey
-        property: user
-    - secretKey: password
-      remoteRef:
-        key: /cl01tl/directus/valkey
-        property: password
@@ -8,7 +8,7 @@ directus:
        main:
          image:
            repository: ghcr.io/directus/directus
-            tag: 11.17.2@sha256:5e5978377f1cc9820ffc5b92597da1573a1350ea57f8aba42efd999139993874
+            tag: 11.17.4@sha256:eb326f679ae847c0a776f93b972761dc2ebe84980e0b9d274a6bc31cd62809f7
          env:
            - name: PUBLIC_URL
              value: https://directus.alexlebens.net
@@ -113,12 +113,12 @@ directus:
            - name: AUTH_AUTHENTIK_CLIENT_ID
              valueFrom:
                secretKeyRef:
-                  name: directus-oidc-secret
+                  name: directus-oidc-authentik
                  key: OIDC_CLIENT_ID
            - name: AUTH_AUTHENTIK_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
-                  name: directus-oidc-secret
+                  name: directus-oidc-authentik
                  key: OIDC_CLIENT_SECRET
            - name: AUTH_AUTHENTIK_SCOPE
              value: openid profile email
@@ -210,7 +210,48 @@ valkey:
      aclUsers:
        default:
          permissions: "~* &* +@all"
-    # No option to configure metrics when auth is enabled
-    # https://github.com/valkey-io/valkey-helm/issues/135
-    metrics:
-      enabled: false
+rclone-directus-assets-remote:
+  nameOverride: directus-assets-remote-rclone
+  cronJob:
+    suspend: false
+    schedule: 30 6 * * 2
+  rclone:
+    source:
+      bucketName: directus-assets
+    destination:
+      bucketName: directus-assets
+  secret:
+    externalSecret:
+      source:
+        credentials:
+          path: /garage/home-infra/directus-assets
+        config:
+          path: /garage/config
+      destination:
+        credentials:
+          path: /garage/home-infra/directus-assets
+        config:
+          path: /garage/config
+rclone-directus-assets-external:
+  nameOverride: directus-assets-external-rclone
+  cronJob:
+    suspend: false
+    schedule: 0 6 * * 2
+  rclone:
+    source:
+      bucketName: directus-assets
+    destination:
+      bucketName: directus-assets-37363a16b71dc59b
+  secret:
+    externalSecret:
+      source:
+        credentials:
+          path: /garage/home-infra/directus-assets
+        config:
+          path: /garage/config
+      destination:
+        credentials:
+          path: /backblaze/home-infra/directus-assets
+        config:
+          path: /backblaze/config
+          endpointProperty: ENDPOINT
@@ -1,6 +1,6 @@
 dependencies:
 - name: eck-operator
  repository: https://helm.elastic.co
-  version: 3.3.2
-digest: sha256:ac7a849a6d8244ef56c11f18438c4c76133f92d245228c5a1c8369d42562c177
-generated: "2026-04-01T21:30:02.975920565Z"
+  version: 3.4.0
+digest: sha256:b4787630154471f65ceeb12f65fa24616eab9470e61e089b8e656e42f05f74f1
+generated: "2026-05-06T19:10:32.416627028Z"
@@ -14,8 +14,8 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: eck-operator
-    version: 3.3.2
+    version: 3.4.0
    repository: https://helm.elastic.co
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/elastic.png
 # renovate: datasource=github-releases depName=elastic/cloud-on-k8s
-appVersion: v3.3.2
+appVersion: v3.4.0
@@ -0,0 +1,14 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
@@ -1,6 +1,5 @@
 eck-operator:
  managedNamespaces:
-    - stalwart
    - tubearchivist
  installCRDs: true
  replicaCount: 2
@@ -1,9 +1,9 @@
 dependencies:
 - name: element-web
  repository: https://ananace.gitlab.io/charts
-  version: 1.4.33
+  version: 1.4.36
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.4.0
-digest: sha256:63b0e582d42fb42bcf4d96ba4b299e42c434c42f284208596808288543192fe0
-generated: "2026-03-24T16:11:50.424321433Z"
+  version: 3.3.0
+digest: sha256:ede4fbfd1808fcb8e6e8394ceb469603ada10d789b551e3b9885825244ee33d9
+generated: "2026-05-14T14:04:44.871143485Z"
@@ -15,11 +15,11 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: element-web
-    version: 1.4.33
+    version: 1.4.36
    repository: https://ananace.gitlab.io/charts
  - name: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.4.0
+    version: 3.3.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/element.png
 # renovate: datasource=github-releases depName=element-hq/element-web
-appVersion: v1.12.14
+appVersion: v1.12.18
@@ -0,0 +1,14 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
@@ -2,7 +2,7 @@ element-web:
  replicaCount: 1
  image:
    repository: ghcr.io/element-hq/element-web
-    tag: v1.12.14@sha256:13052614150733892ff06189f0f9baf098bc16092bffc0e0e18ccf2f257abe34
+    tag: v1.12.18@sha256:c21772a1eabeededa19be591343f548995e458ec34ba8f27425ae923c10af82e
  defaultServer:
    url: https://matrix.alexlebens.dev
    name: alexlebens.dev
@@ -2,5 +2,8 @@ dependencies:
 - name: eraser
  repository: https://eraser-dev.github.io/eraser/charts
  version: 1.4.1
-digest: sha256:da828de684b0cd82e99994586f3db4f55c43c01607c4d8d0e70e204c7bbbbf5b
-generated: "2025-12-03T22:53:20.200917773Z"
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 5.0.1
+digest: sha256:70822dce88f0eb843477b28caa6f738d38a6436e6e3a99b0003e3e1da69b8ed9
+generated: "2026-05-15T00:29:53.572114523Z"
@@ -9,13 +9,19 @@ home: https://docs.alexlebens.dev/applications/eraser/
 sources:
  - https://github.com/eraser-dev/eraser
  - https://github.com/eraser-dev/eraser/pkgs/container/eraser-manager
+  - https://github.com/open-telemetry/opentelemetry-collector-releases/pkgs/container/opentelemetry-collector-releases%2Fopentelemetry-collector
  - https://github.com/eraser-dev/eraser/tree/main/charts/eraser
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
 maintainers:
  - name: alexlebens
 dependencies:
  - name: eraser
    version: 1.4.1
    repository: https://eraser-dev.github.io/eraser/charts
+  - name: app-template
+    alias: eraser-metrics
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 5.0.1
 icon: https://raw.githubusercontent.com/eraser-dev/eraser/refs/heads/main/images/eraser-logo-color-1c.png
 # renovate: datasource=github-releases depName=eraser-dev/eraser
 appVersion: v1.4.1
@@ -0,0 +1,14 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
@@ -1,11 +1,10 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: yubal
+  name: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: yubal
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ .Release.Namespace }}
+    {{- include "custom.labels" . | nindent 4 }}
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/warn: privileged
--- a/Show More
+++ b/Show More