Update Helm release loki to v6.46.0

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/twin/gatus](https://github.com/TwiN/gatus) | minor | `v5.30.0` -> `v5.31.0` |

---

### Release Notes

<details>
<summary>TwiN/gatus (ghcr.io/twin/gatus)</summary>

### [`v5.31.0`](https://github.com/TwiN/gatus/releases/tag/v5.31.0)

[Compare Source](https://github.com/TwiN/gatus/compare/v5.30.0...v5.31.0)

Highlight of this release are the ability to mark announcements as "archived", which renders said announcements in a new `Past Announcements` section at the bottom of the status page (only rendered if there is at least 1 archived announcements), support for markdown in announcements and support for monitoring gRPC health endpoints.

<img width="1166" height="556" alt="image" src="https://github.com/user-attachments/assets/d22a0ea7-c035-4c35-a148-6de097a357b7" />

#### What's Changed
* feat(announcements): Add support for archived announcements and add past announcement section in UI by @&#8203;TwiN in https://github.com/TwiN/gatus/pull/1382
* feat(announcements): add markdown support by @&#8203;Sworyz in https://github.com/TwiN/gatus/pull/1371
* feat(client): Add support for monitoring gRPC endpoints by @&#8203;diamanat in https://github.com/TwiN/gatus/pull/1376
* fix(client): update icmp/ping logic to determine pinger privileged mode by @&#8203;h3mmy in https://github.com/TwiN/gatus/pull/1346
* fix(api): Escape endpoint key in URL for raw APIs by @&#8203;Nedra1998 in https://github.com/TwiN/gatus/pull/1381
* docs(readme): adds ECS fargate module in README by @&#8203;GiamPy5 in https://github.com/TwiN/gatus/pull/1377

#### New Contributors
* @&#8203;GiamPy5 made their first contribution in https://github.com/TwiN/gatus/pull/1377
* @&#8203;h3mmy made their first contribution in https://github.com/TwiN/gatus/pull/1346
* @&#8203;diamanat made their first contribution in https://github.com/TwiN/gatus/pull/1376
* @&#8203;Nedra1998 made their first contribution in https://github.com/TwiN/gatus/pull/1381
* @&#8203;Sworyz made their first contribution in https://github.com/TwiN/gatus/pull/1371

**Full Changelog**: <https://github.com/TwiN/gatus/compare/v5.30.0...v5.31.0>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi41LjAiLCJ1cGRhdGVkSW5WZXIiOiI0Mi41LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImltYWdlIl19-->

Reviewed-on: #2008
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

.gitea/workflows/lint-test-docker-pull.yaml

@@ -1,13 +1,6 @@
 name: lint-test-docker
 
 on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'hosts/**'
-      - ! 'hosts/archive'
-
   pull_request:
     branches:
       - main
@@ -17,10 +10,10 @@ on:
 
 jobs:
   docker-lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-js
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -28,17 +21,17 @@ jobs:
         id: check-branch-exists
         uses: GuillaumeFalourd/branch-exists@v1.1
         with:
-          branch: "origin/${{ github.base_ref }}"
+          branch: "${{ github.base_ref }}"
 
       - name: Branch Does Not Exist
         if: steps.check-branch-exists.outputs.exists == 'false'
-        run: echo "Branch origin/${{ github.base_ref }} was not found, likely already merged"
+        run: echo "Branch ${{ github.base_ref }} was not found, likely already merged"
 
       - name: Set up Node.js
         if: steps.check-branch-exists.outputs.exists == 'true'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: '22'
+          node-version: '24'
 
       - name: Lint Docker Compose
         if: steps.check-branch-exists.outputs.exists == 'true'
@@ -77,3 +70,18 @@ jobs:
             echo ">> Linting $compose ..."
             npx dclint $compose
           done
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Test Failure - Infrastructure'
+          priority: 3
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: 'Docker linting on Pull Request for Infrastructure has failed!'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-docker-pull.yaml", "clear": true}]'
+          image: true

.gitea/workflows/lint-test-docker-push.yaml

@@ -0,0 +1,75 @@
+name: lint-test-docker
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'hosts/**'
+      - ! 'hosts/archive'
+
+jobs:
+  docker-lint:
+    runs-on: ubuntu-js
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+
+      - name: Lint Docker Compose
+        run: |
+          set -e  # Exit immediately if a command exits with a non-zero status.
+
+          TARGET_BRANCH="origin/main"
+          echo ">> Target branch for diff is: $TARGET_BRANCH"
+
+          CHANGED_FILES=$(git diff --name-only "$TARGET_BRANCH" -- 'hosts/**')
+
+          echo ">> Found changed files:"
+          echo "$CHANGED_FILES"
+
+          # For each changed file, find its parent chart directory (the one with compose.yaml).
+          # Then, create a unique list of those directories.
+          CHANGED_COMPOSE=$(echo "$CHANGED_FILES" | while read -r file; do
+            dir=$(dirname "$file")
+            while [[ "$dir" != "." && ! -f "$dir/compose.yaml" ]]; do
+              dir=$(dirname "$dir")
+            done
+            if [[ "$dir" != "." ]]; then
+              echo "$dir"
+            fi
+          done | sort -u)
+
+          if [[ -z "$CHANGED_COMPOSE" ]]; then
+            echo ">> Could not determine changed compose files. This will happen if only files outside a compose file were changed."
+            exit 0
+          fi
+
+          echo ">> Running dclint on changed compose files:"
+          echo "$CHANGED_COMPOSE"
+
+          echo "$CHANGED_COMPOSE" | while read -r compose; do
+            echo ">> Linting $compose ..."
+            npx dclint $compose
+          done
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Test Failure - Infrastructure'
+          priority: 4
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: 'Docker linting on Push for Infrastructure has failed!'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-docker-push.yaml", "clear": true}]'
+          image: true

.gitea/workflows/lint-test-helm-pull.yaml

@@ -1,13 +1,6 @@
 name: lint-test-helm
 
 on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'clusters/**'
-      - ! 'clusters/*/archive'
-
   pull_request:
     branches:
       - main
@@ -17,10 +10,10 @@ on:
 
 jobs:
   helm-lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-js
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -28,11 +21,11 @@ jobs:
         id: check-branch-exists
         uses: GuillaumeFalourd/branch-exists@v1.1
         with:
-          branch: "origin/${{ github.base_ref }}"
+          branch: ${{ github.base_ref }}
 
       - name: Branch Does Not Exist
         if: steps.check-branch-exists.outputs.exists == 'false'
-        run: echo "Branch origin/${{ github.base_ref }} was not found, likely already merged"
+        run: echo "Branch ${{ github.base_ref }} was not found, likely already merged"
 
       - name: Set up Helm
         if: steps.check-branch-exists.outputs.exists == 'true'
@@ -80,3 +73,18 @@ jobs:
             echo ">> Linting $chart..."
             helm lint "$chart"
           done
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Test Failure - Infrastructure'
+          priority: 3
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: 'Helm linting on Pull Request for Infrastructure has failed!'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-helm-pull.yaml", "clear": true}]'
+          image: true

.gitea/workflows/lint-test-helm-push.yaml

@@ -0,0 +1,78 @@
+name: lint-test-helm
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'clusters/**'
+      - ! 'clusters/*/archive'
+
+jobs:
+  helm-lint:
+    runs-on: ubuntu-js
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+          version: latest
+
+      - name: Lint Helm Chart
+        run: |
+          set -e  # Exit immediately if a command exits with a non-zero status.
+
+          TARGET_BRANCH="origin/main"
+          echo ">> Target branch for diff is: $TARGET_BRANCH"
+
+          CHANGED_FILES=$(git diff --name-only "$TARGET_BRANCH" -- 'clusters/**')
+
+          echo ">> Found changed files:"
+          echo "$CHANGED_FILES"
+
+          # For each changed file, find its parent chart directory (the one with Chart.yaml).
+          # Then, create a unique list of those directories.
+          CHANGED_CHARTS=$(echo "$CHANGED_FILES" | while read -r file; do
+            dir=$(dirname "$file")
+            while [[ "$dir" != "." && ! -f "$dir/Chart.yaml" ]]; do
+              dir=$(dirname "$dir")
+            done
+            if [[ "$dir" != "." ]]; then
+              echo "$dir"
+            fi
+          done | sort -u)
+
+          if [[ -z "$CHANGED_CHARTS" ]]; then
+            echo ">> Could not determine changed charts. This could happen if only files outside a chart were changed."
+            exit 0
+          fi
+
+          echo ">> Running helm lint on changed charts:"
+          echo "$CHANGED_CHARTS"
+
+          echo "$CHANGED_CHARTS" | while read -r chart; do
+            echo ">> Building dependency for "$chart" ..."
+            helm dependency build "$chart"
+            echo ">> Linting $chart..."
+            helm lint "$chart"
+          done
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Test Failure - Infrastructure'
+          priority: 4
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: 'Helm linting on Push for Infrastructure has failed!'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-helm-push.yaml", "clear": true}]'
+          image: true

.gitea/workflows/renovate.yaml

@@ -13,10 +13,10 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:41
+    container: ghcr.io/renovatebot/renovate:42
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Renovate
         run: renovate

clusters/cl01tl/applications/calibre-web-automated/values.yaml

@@ -55,7 +55,7 @@ calibre-web-automated:
         bypass:
           image:
             repository: ghcr.io/sarperavci/cloudflarebypassforscraping
-            tag: latest@sha256:c34ef70a768ddf35c057f893c5392b8f65465fc4fbac634ba68a16d6a9dd0cbb
+            tag: latest@sha256:37ef0669d4ffc24b2cea3e0b3be62dc5bf72cad3750fe592483b1398aae810da
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/applications/code-server/values.yaml

@@ -9,7 +9,7 @@ code-server:
         main:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.105.1@sha256:c7c66416238b70312df90b5936ea4adb6108552d866dd00a804c86c599b2ab6c
+            tag: 4.105.1@sha256:f01693e529a6c4db98deb4bb28bf2655a403489831e962e6cc0b2c5f89f220f6
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/directus/values.yaml

@@ -9,7 +9,7 @@ directus:
         main:
           image:
             repository: directus/directus
-            tag: 11.12.0
+            tag: 11.13.2
             pullPolicy: IfNotPresent
           env:
             - name: PUBLIC_URL

clusters/cl01tl/applications/element-web/Chart.yaml

@@ -17,7 +17,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: element-web
-    version: 1.4.22
+    version: 1.4.23
     repository: https://ananace.gitlab.io/charts
   - name: cloudflared
     alias: cloudflared

clusters/cl01tl/applications/home-assistant/values.yaml

@@ -9,7 +9,7 @@ home-assistant:
         main:
           image:
             repository: ghcr.io/home-assistant/home-assistant
-            tag: 2025.10.4
+            tag: 2025.11.1
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -21,7 +21,7 @@ home-assistant:
         code-server:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.105.1@sha256:c7c66416238b70312df90b5936ea4adb6108552d866dd00a804c86c599b2ab6c
+            tag: 4.105.1@sha256:f01693e529a6c4db98deb4bb28bf2655a403489831e962e6cc0b2c5f89f220f6
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/homepage/values.yaml

@@ -522,6 +522,12 @@ homepage:
                   href: https://vault.alexlebens.net
                   siteMonitor: http://vault.vault:8200
                   statusStyle: dot
+              - Backups:
+                  icon: sh-backrest-light.webp
+                  description: Backrest
+                  href: https://backrest.alexlebens.net
+                  siteMonitor: http://backrest.backrest:80
+                  statusStyle: dot
           - TV Shows:
               - Sonarr:
                   icon: sh-sonarr.webp

clusters/cl01tl/applications/karakeep/values.yaml

@@ -9,7 +9,7 @@ karakeep:
         main:
           image:
             repository: ghcr.io/karakeep-app/karakeep
-            tag: 0.27.1
+            tag: 0.28.0
             pullPolicy: IfNotPresent
           env:
             - name: DATA_DIR

clusters/cl01tl/applications/libation/values.yaml

@@ -16,7 +16,7 @@ libation:
         main:
           image:
             repository: rmcrackan/libation
-            tag: 12.5.7
+            tag: 12.7.1
             pullPolicy: IfNotPresent
           env:
             - name: SLEEP_TIME

clusters/cl01tl/applications/lidatube/values.yaml

@@ -13,7 +13,7 @@ lidatube:
         main:
           image:
             repository: thewicklowwolf/lidatube
-            tag: 0.2.40
+            tag: 0.2.41
             pullPolicy: IfNotPresent
           env:
             - name: PUID

clusters/cl01tl/applications/plex/values.yaml

@@ -9,7 +9,7 @@ plex:
         main:
           image:
             repository: ghcr.io/linuxserver/plex
-            tag: 1.42.2@sha256:a59133e5b94b3ca19158e4ab272657c77c62dc9abdbebe1172b7657da138badb
+            tag: 1.42.2@sha256:a4749f3b84dc3f923a7bd4d2bc4ddc1e871b5a656b62022d3827d3d98afd5efd
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:7f7e3d85b9fc38cc99e8f7c715e3ae1b74ed11971d24987d6fa7b7f360a108be
+            tag: latest@sha256:83c3d61dc9d8fa13016ba8208a9bdb60e29701a0f789fc9c7ecd1ff8c4ae51c2
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -43,7 +43,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:7f7e3d85b9fc38cc99e8f7c715e3ae1b74ed11971d24987d6fa7b7f360a108be
+            tag: latest@sha256:83c3d61dc9d8fa13016ba8208a9bdb60e29701a0f789fc9c7ecd1ff8c4ae51c2
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL

clusters/cl01tl/applications/tdarr/values.yaml

@@ -9,7 +9,7 @@ tdarr:
         main:
           image:
             repository: ghcr.io/haveagitgat/tdarr
-            tag: 2.51.03
+            tag: 2.54.01
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -48,7 +48,7 @@ tdarr:
         main:
           image:
             repository: ghcr.io/haveagitgat/tdarr_node
-            tag: 2.51.03
+            tag: 2.54.01
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/tubearchivist/values.yaml

@@ -9,7 +9,7 @@ tubearchivist:
         main:
           image:
             repository: bbilly1/tubearchivist
-            tag: v0.5.7
+            tag: v0.5.8
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/deployment/argocd/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 9.0.6
+    version: 9.1.2
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 appVersion: 3.0.0

clusters/cl01tl/management/argo-workflows/Chart.yaml

@@ -18,7 +18,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-workflows
-    version: 0.45.27
+    version: 0.45.28
     repository: https://argoproj.github.io/argo-helm
   - name: argo-events
     version: 2.4.17

clusters/cl01tl/management/headlamp/Chart.yaml

@@ -14,7 +14,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: headlamp
-    version: 0.37.0
+    version: 0.38.0
     repository: https://kubernetes-sigs.github.io/headlamp/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/headlamp.png
-appVersion: 0.30.1
+appVersion: 0.37.0

clusters/cl01tl/management/headlamp/templates/cluster-role-binding.yaml

@@ -15,3 +15,6 @@ subjects:
   - kind: User
     name: alexanderlebens@gmail.com
     apiGroup: rbac.authorization.k8s.io
+  - kind: ServiceAccount
+    name: headlamp-admin
+    namespace: headlamp

clusters/cl01tl/management/headlamp/templates/service-account.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: headlamp-admin
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: headlamp-admin
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}

clusters/cl01tl/management/komodo/values.yaml

@@ -95,7 +95,7 @@ komodo:
         main:
           image:
             repository: ghcr.io/ferretdb/ferretdb
-            tag: 2.5.0
+            tag: 2.7.0
             pullPolicy: IfNotPresent
           env:
             - name: FERRETDB_POSTGRESQL_URL

clusters/cl01tl/monitoring/gatus/values.yaml

@@ -7,7 +7,7 @@ gatus:
     enabled: true
   image:
     repository: ghcr.io/twin/gatus
-    tag: v5.30.0
+    tag: v5.31.0
   annotations:
     reloader.stakater.com/auto: "true"
   service:

clusters/cl01tl/monitoring/kube-prometheus-stack/Chart.yaml

@@ -19,7 +19,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 79.2.1
+    version: 79.4.1
     repository: oci://ghcr.io/prometheus-community/charts
   - name: app-template
     alias: ntfy-alertmanager

clusters/cl01tl/monitoring/loki/Chart.yaml

@@ -16,7 +16,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: loki
-    version: 6.44.0
+    version: 6.46.0
     repository: https://grafana.github.io/helm-charts
   - name: promtail
     version: 6.17.1

clusters/cl01tl/platform/external-secrets/Chart.yaml

@@ -12,7 +12,7 @@ sources:
   - https://github.com/external-secrets/external-secrets/tree/main/deploy/charts/external-secrets
 dependencies:
   - name: external-secrets
-    version: 0.20.4
+    version: 1.0.0
     repository: https://charts.external-secrets.io
 icon: https://avatars.githubusercontent.com/u/68335991?s=48&v=4
 appVersion: 0.17.0

clusters/cl01tl/platform/gitea/values.yaml

@@ -146,7 +146,7 @@ gitea-actions:
     replicas: 6
     actRunner:
       repository: gitea/act_runner
-      tag: 0.2.11
+      tag: 0.2.13
       config: |
         log:
           level: debug
@@ -154,10 +154,10 @@ gitea-actions:
           enabled: false
         runner:
           labels:
-            - "ubuntu-latest:docker://harbor.alexlebens.net/proxy-ghcr.io/catthehacker/ubuntu:runner-24.04"
-            - "ubuntu-24.04:docker://harbor.alexlebens.net/proxy-ghcr.io/catthehacker/ubuntu:runner-24.04"
+            - "ubuntu-latest:docker://harbor.alexlebens.net/proxy-hub.docker/gitea/runner-images:ubuntu-24.04"
+            - "ubuntu-js:docker://harbor.alexlebens.net/proxy-ghcr.io/catthehacker/ubuntu:js-24.04"
+            - "ubuntu-24.04:docker://harbor.alexlebens.net/proxy-hub.docker/gitea/runner-images:ubuntu-24.04"
             - "ubuntu-22.04:docker://harbor.alexlebens.net/proxy-hub.docker/gitea/runner-images:ubuntu-22.04"
-            - "ubuntu-20.04:docker://harbor.alexlebens.net/proxy-hub.docker/gitea/runner-images:ubuntu-20.04"
     dind:
       repository: docker
       tag: 25.0.2-dind
@@ -212,7 +212,7 @@ backup:
         s3-backup:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:33181474927de824a1d209a7bda39e877e2ce78e1aa34d2e7acdf490ef1b7601
+            tag: latest@sha256:4252b3d04c18dc7fec2117259ab5dc0e51cb46b8719e661762222b44f6559189
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -236,7 +236,7 @@ backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:33181474927de824a1d209a7bda39e877e2ce78e1aa34d2e7acdf490ef1b7601
+            tag: latest@sha256:4252b3d04c18dc7fec2117259ab5dc0e51cb46b8719e661762222b44f6559189
             pullPolicy: IfNotPresent
           command:
             - /bin/sh

clusters/cl01tl/platform/matrix-synapse/Chart.yaml

@@ -29,7 +29,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: matrix-synapse
-    version: 3.12.13
+    version: 3.12.14
     repository: https://ananace.gitlab.io/charts
   - name: app-template
     alias: matrix-hookshot

clusters/cl01tl/platform/n8n/values.yaml

@@ -9,7 +9,7 @@ n8n:
         main:
           image:
             repository: ghcr.io/n8n-io/n8n
-            tag: 1.119.0
+            tag: 1.119.1
             pullPolicy: IfNotPresent
           env:
             - name: GENERIC_TIMEZONE
@@ -93,7 +93,7 @@ n8n:
         main:
           image:
             repository: ghcr.io/n8n-io/n8n
-            tag: 1.119.0
+            tag: 1.119.1
             pullPolicy: IfNotPresent
           command:
             - n8n
@@ -188,7 +188,7 @@ n8n:
         main:
           image:
             repository: ghcr.io/n8n-io/n8n
-            tag: 1.119.0
+            tag: 1.119.1
             pullPolicy: IfNotPresent
           command:
             - n8n

clusters/cl01tl/platform/ollama/values.yaml

@@ -22,7 +22,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.12.9
+            tag: 0.12.10
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE
@@ -58,7 +58,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.12.9
+            tag: 0.12.10
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE
@@ -94,7 +94,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.12.9
+            tag: 0.12.10
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE
@@ -117,7 +117,7 @@ ollama:
         main:
           image:
             repository: ghcr.io/open-webui/open-webui
-            tag: 0.6.34
+            tag: v0.6.36
             pullPolicy: IfNotPresent
           env:
             - name: ENV

clusters/cl01tl/platform/qbittorrent/values.yaml

@@ -28,7 +28,7 @@ qbittorrent:
         qbittorrent:
           image:
             repository: ghcr.io/linuxserver/qbittorrent
-            tag: 5.1.2@sha256:3908cec5685242ab49b4842124df38c7ff09f82e543c17e0f81e883788f6a611
+            tag: 5.1.2@sha256:a5b277bd1cb098dcba6215ab03ada24c28101ac16022e0e6c1ffed40743d4448
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -186,7 +186,7 @@ qbittorrent:
         qui:
           image:
             repository: ghcr.io/autobrr/qui
-            tag: v1.6.1
+            tag: v1.7.0
             pullPolicy: IfNotPresent
           env:
             - name: QUI__METRICS_ENABLED

clusters/cl01tl/platform/vault/values.yaml

@@ -198,7 +198,7 @@ snapshot:
         s3-backup:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:33181474927de824a1d209a7bda39e877e2ce78e1aa34d2e7acdf490ef1b7601
+            tag: latest@sha256:4252b3d04c18dc7fec2117259ab5dc0e51cb46b8719e661762222b44f6559189
             pullPolicy: IfNotPresent
           command:
             - /bin/sh

clusters/cl01tl/services/blocky/values.yaml

@@ -109,6 +109,7 @@ blocky:
               argocd                          IN      CNAME   traefik-cl01tl
               audiobookshelf                  IN      CNAME   traefik-cl01tl
               authentik                       IN      CNAME   traefik-cl01tl
+              backrest                        IN      CNAME   traefik-cl01tl
               bazarr                          IN      CNAME   traefik-cl01tl
               calibre                         IN      CNAME   traefik-cl01tl
               calibre-downloader              IN      CNAME   traefik-cl01tl

clusters/cl01tl/services/generic-device-plugin/Chart.yaml

@@ -15,6 +15,6 @@ maintainers:
 dependencies:
   - name: generic-device-plugin
     repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-    version: 0.17.0
+    version: 0.20.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: 1.0.0

clusters/cl01tl/services/reloader/Chart.yaml

@@ -14,7 +14,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: reloader
-    version: 2.2.4
+    version: 2.2.5
     repository: https://stakater.github.io/stakater-charts
 icon: https://raw.githubusercontent.com/stakater/Reloader/refs/heads/master/assets/web/reloader.jpg
 appVersion: v1.4.2

clusters/cl01tl/services/talos/values.yaml

@@ -73,7 +73,7 @@ etcd-backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:33181474927de824a1d209a7bda39e877e2ce78e1aa34d2e7acdf490ef1b7601
+            tag: latest@sha256:4252b3d04c18dc7fec2117259ab5dc0e51cb46b8719e661762222b44f6559189
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -169,7 +169,7 @@ etcd-defrag:
         main:
           image:
             repository: ghcr.io/siderolabs/talosctl
-            tag: v1.11.4
+            tag: v1.11.5
             pullPolicy: IfNotPresent
           args:
             - etcd
@@ -206,7 +206,7 @@ etcd-defrag:
         main:
           image:
             repository: ghcr.io/siderolabs/talosctl
-            tag: v1.11.4
+            tag: v1.11.5
             pullPolicy: IfNotPresent
           args:
             - etcd
@@ -243,7 +243,7 @@ etcd-defrag:
         main:
           image:
             repository: ghcr.io/siderolabs/talosctl
-            tag: v1.11.4
+            tag: v1.11.5
             pullPolicy: IfNotPresent
           args:
             - etcd

clusters/cl01tl/services/traefik/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: traefik
-    version: 37.2.0
+    version: 37.3.0
     repository: https://traefik.github.io/charts
   # enable pending:
   # https://github.com/traefik/traefik-helm-chart/pull/1340

clusters/cl01tl/standalone/cilium/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: cilium
-    version: 1.18.3
+    version: 1.18.4
     repository: https://helm.cilium.io/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/cilium.png
 appVersion: 1.17.3

clusters/cl01tl/standalone/prometheus-operator-crds/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: prometheus-operator-crds
-    version: 24.0.1
+    version: 24.0.2
     repository: oci://ghcr.io/prometheus-community/charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prometheus.png
 appVersion: v0.82.0

clusters/cl01tl/storage/backrest/Chart.yaml

@@ -0,0 +1,21 @@
+apiVersion: v2
+name: backrest
+version: 1.0.0
+description: backrest
+keywords:
+  - backrest
+  - backup
+home: https://wiki.alexlebens.dev/
+sources:
+  - https://github.com/garethgeorge/backrest
+  - https://hub.docker.com/r/garethgeorge/backrest
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: backrest
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.4.0
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/backrest.png
+appVersion: v1.10.1

clusters/cl01tl/storage/backrest/templates/http-route.yaml

@@ -0,0 +1,28 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-route-backrest
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: http-route-backrest
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+  hostnames:
+    - backrest.alexlebens.net
+  rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: /
+      backendRefs:
+        - group: ''
+          kind: Service
+          name: backrest
+          port: 80
+          weight: 100

clusters/cl01tl/storage/backrest/templates/persistent-volume-claim.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: backrest-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: backrest-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  volumeName: backrest-nfs-storage
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi

clusters/cl01tl/storage/backrest/templates/persistent-volume.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: backrest-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: backrest-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: nfs-client
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    path: /volume2/Storage
+    server: synologybond.alexlebens.net
+  mountOptions:
+    - vers=4
+    - minorversion=1
+    - noac

clusters/cl01tl/storage/backrest/templates/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: garage-ps10rp
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: garage-ps10rp
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+  annotations:
+    tailscale.com/tailnet-fqdn: garage-ps10rp.boreal-beaufort.ts.net
+spec:
+  externalName: placeholder
+  type: ExternalName

clusters/cl01tl/storage/backrest/values.yaml

@@ -0,0 +1,77 @@
+backrest:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      containers:
+        main:
+          image:
+            repository: garethgeorge/backrest
+            tag: v1.10.1
+            pullPolicy: IfNotPresent
+          env:
+            - name: TZ
+              value: America/Chicago
+            - name: BACKREST_DATA
+              value: /data
+            - name: BACKREST_CONFIG
+              value: /config/config.json
+            - name: XDG_CACHE_HOME
+              value: /cache
+            - name: TMPDIR
+              value: /tmp
+          resources:
+            requests:
+              cpu: 10m
+              memory: 256Mi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 9898
+          protocol: TCP
+  persistence:
+    data:
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      retain: true
+      advancedMounts:
+        main:
+          main:
+            - path: /data
+              readOnly: false
+    config:
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 1Gi
+      retain: true
+      advancedMounts:
+        main:
+          main:
+            - path: /config
+              readOnly: false
+    cache:
+      type: emptyDir
+      advancedMounts:
+        main:
+          main:
+            - path: /cache
+              readOnly: false
+    tmp:
+      type: emptyDir
+      advancedMounts:
+        main:
+          main:
+            - path: /tmp
+              readOnly: false
+    storage:
+      existingClaim: backrest-nfs-storage
+      advancedMounts:
+        main:
+          main:
+            - path: /userdata
+              readOnly: true

clusters/cl01tl/storage/cloudnative-pg/Chart.yaml

@@ -19,7 +19,7 @@ dependencies:
     version: 0.26.1
     repository: https://cloudnative-pg.io/charts/
   - name: plugin-barman-cloud
-    version: 0.2.0
+    version: 0.3.1
     repository: https://cloudnative-pg.io/charts/
 icon: https://avatars.githubusercontent.com/u/100373852?s=200&v=4
 appVersion: 1.26.0

clusters/cl01tl/storage/cloudnative-pg/values.yaml

@@ -7,10 +7,10 @@ plugin-barman-cloud:
   image:
     registry: ghcr.io
     repository: cloudnative-pg/plugin-barman-cloud
-    tag: v0.8.0
+    tag: v0.9.0
   sidecarImage:
     registry: ghcr.io
     repository: cloudnative-pg/plugin-barman-cloud-sidecar
-    tag: v0.8.0
+    tag: v0.9.0
   crds:
     create: true

clusters/cl01tl/storage/garage/values.yaml

@@ -52,10 +52,13 @@ garage:
 
           metadata_dir = "/var/lib/garage/meta"
           data_dir = "/var/lib/garage/data"
+          metadata_snapshots_dir = "/var/lib/garage/snapshots"
 
-          db_engine = "sqlite"
+          db_engine = "lmdb"
 
-          compression_level = 1
+          metadata_auto_snapshot_interval = "6h"
+
+          compression_level = 3
 
           rpc_bind_addr = "[::]:3901"
           rpc_public_addr = "127.0.0.1:3901"
@@ -119,6 +122,16 @@ garage:
               readOnly: true
               mountPropagation: None
               subPath: garage.toml
+    db:
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      retain: true
+      advancedMounts:
+        main:
+          main:
+            - path: /var/lib/garage/meta
+              readOnly: false
     data:
       storageClass: synology-iscsi-delete
       accessMode: ReadWriteOnce
@@ -127,5 +140,15 @@ garage:
       advancedMounts:
         main:
           main:
-            - path: /var/lib/garage
+            - path: /var/lib/garage/data
+              readOnly: false
+    snapshots:
+      storageClass: synology-iscsi-delete
+      accessMode: ReadWriteOnce
+      size: 50Gi
+      retain: true
+      advancedMounts:
+        main:
+          main:
+            - path: /var/lib/garage/snapshots
               readOnly: false

clusters/cl01tl/storage/pgadmin/values.yaml

@@ -28,7 +28,7 @@ pgadmin4:
             runAsGroup: 5050
           image:
             repository: dpage/pgadmin4
-            tag: "9.9"
+            tag: "9.10"
             pullPolicy: IfNotPresent
           env:
             - name: PGADMIN_CONFIG_ENHANCED_COOKIE_PROTECTION

clusters/cl01tl/storage/rook-ceph/Chart.yaml

@@ -16,10 +16,10 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: rook-ceph
-    version: v1.18.6
+    version: v1.18.7
     repository: https://charts.rook.io/release
   - name: rook-ceph-cluster
-    version: v1.18.6
+    version: v1.18.7
     repository: https://charts.rook.io/release
   - name: cloudflared
     alias: cloudflared-rgw

clusters/cl01tl/storage/whodb/values.yaml

@@ -8,7 +8,7 @@ whodb:
         main:
           image:
             repository: clidey/whodb
-            tag: 0.61.0
+            tag: 0.72.0
             pullPolicy: IfNotPresent
           env:
             - name: WHODB_OLLAMA_HOST

hosts/ps08rp/blocky/config.yml

@@ -85,6 +85,7 @@ customDNS:
     argocd                          IN      CNAME   traefik-cl01tl
     audiobookshelf                  IN      CNAME   traefik-cl01tl
     authentik                       IN      CNAME   traefik-cl01tl
+    backrest                        IN      CNAME   traefik-cl01tl
     bazarr                          IN      CNAME   traefik-cl01tl
     calibre                         IN      CNAME   traefik-cl01tl
     calibre-downloader              IN      CNAME   traefik-cl01tl

hosts/ps08rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.5.4
+        image: ghcr.io/traefik/traefik:v3.6.0
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

hosts/ps09rp/blocky/config.yml

@@ -85,6 +85,7 @@ customDNS:
     argocd                          IN      CNAME   traefik-cl01tl
     audiobookshelf                  IN      CNAME   traefik-cl01tl
     authentik                       IN      CNAME   traefik-cl01tl
+    backrest                        IN      CNAME   traefik-cl01tl
     bazarr                          IN      CNAME   traefik-cl01tl
     calibre                         IN      CNAME   traefik-cl01tl
     calibre-downloader              IN      CNAME   traefik-cl01tl

hosts/ps09rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.5.4
+        image: ghcr.io/traefik/traefik:v3.6.0
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

hosts/ps10rp/traefik/compose.yaml

@@ -20,7 +20,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     traefik:
-        image: ghcr.io/traefik/traefik:v3.5.4
+        image: ghcr.io/traefik/traefik:v3.6.0
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"