chore(deps): update ghcr.io/linuxserver/code-server docker tag to v4.111.0

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [harbor.alexlebens.net/images/site-documentation](https://gitea.alexlebens.dev/alexlebens/site-documentation) | minor | `0.1.7` → `0.2.0` |

---

### Release Notes

<details>
<summary>alexlebens/site-documentation (harbor.alexlebens.net/images/site-documentation)</summary>

### [`v0.2.0`](https://gitea.alexlebens.dev/alexlebens/site-documentation/releases/tag/0.2.0)

[Compare Source](https://gitea.alexlebens.dev/alexlebens/site-documentation/compare/0.1.7...0.2.0)

### [0.2.0](http://gitea-http.gitea:3000/alexlebens/site-documentation/compare/0.1.7...0.2.0) (2026-03-12)

##### Features

- add robots ([4ef4353](4ef43534a0))
- switch to bun ([7413830](74138302a4))
- trigger minor version update ([7a9b62d](7a9b62dc04))
- use alpine-dev for bun builder ([4575bfb](4575bfb913))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41OS4yIiwidXBkYXRlZEluVmVyIjoiNDMuNTkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW1hZ2UiXX0=-->

Reviewed-on: #4686
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

clusters/cl01tl/helm/actual/values.yaml

@@ -81,7 +81,8 @@ volsync-target-data:
     enabled: true
     schedule: 0 8 * * *
   remote:
-    enabled: false
-  external:
     enabled: true
     schedule: 0 9 * * *
+  external:
+    enabled: true
+    schedule: 0 10 * * *

clusters/cl01tl/helm/argo-workflows/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: argo-workflows
   repository: https://argoproj.github.io/argo-helm
-  version: 0.47.4
+  version: 0.47.5
 - name: argo-events
   repository: https://argoproj.github.io/argo-helm
   version: 2.4.20
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.9.1
-digest: sha256:c3f9876ca432887c05eaa87d4e6006dcb8b3a5e654dc976103426a313fde12bc
+digest: sha256:5b7f498040dd93f99a00c708c80fcefdb64dcdf473cfd3edcf8a94255b80b3b4
-generated: "2026-03-11T20:27:51.068205101Z"
+generated: "2026-03-12T13:02:52.109982708Z"

clusters/cl01tl/helm/argo-workflows/Chart.yaml

@@ -18,7 +18,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-workflows
-    version: 0.47.4
+    version: 0.47.5
     repository: https://argoproj.github.io/argo-helm
   - name: argo-events
     version: 2.4.20
@@ -29,4 +29,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-workflows
-appVersion: v4.0.1
+appVersion: v4.0.2

clusters/cl01tl/helm/argo-workflows/values.yaml

@@ -105,7 +105,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 0 14 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true

clusters/cl01tl/helm/audiobookshelf/values.yaml

@@ -127,17 +127,19 @@ volsync-target-config:
     enabled: true
     schedule: 2 8 * * *
   remote:
-    enabled: false
-  external:
     enabled: true
     schedule: 2 9 * * *
+  external:
+    enabled: true
+    schedule: 2 10 * * *
 volsync-target-metadata:
   pvcTarget: audiobookshelf-metadata
   local:
     enabled: true
     schedule: 4 8 * * *
   remote:
-    enabled: false
-  external:
     enabled: true
     schedule: 4 9 * * *
+  external:
+    enabled: true
+    schedule: 4 10 * * *

clusters/cl01tl/helm/authentik/Chart.lock

@@ -12,4 +12,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
 digest: sha256:abb34b7bb54393236e695453aa1940497cb4def3d3a56a45ca004a22f8e05648
-generated: "2026-03-11T20:28:13.709193217Z"
+generated: "2026-03-11T22:55:49.936164674Z"

clusters/cl01tl/helm/authentik/values.yaml

@@ -93,7 +93,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 5 14 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true

clusters/cl01tl/helm/backrest/Chart.yaml

@@ -27,4 +27,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/backrest.png
 # renovate: datasource=github-releases depName=garethgeorge/backrest
-appVersion: v1.12.0
+appVersion: v1.12.1

clusters/cl01tl/helm/backrest/values.yaml

@@ -8,7 +8,7 @@ backrest:
         main:
           image:
             repository: garethgeorge/backrest
-            tag: v1.12.0
+            tag: v1.12.1
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -111,17 +111,19 @@ volsync-target-data:
     enabled: true
     schedule: 6 8 * * *
   remote:
-    enabled: false
-  external:
     enabled: true
     schedule: 6 9 * * *
+  external:
+    enabled: true
+    schedule: 6 10 * * *
 volsync-target-config:
   pvcTarget: backrest-config
   local:
     enabled: true
     schedule: 8 8 * * *
   remote:
-    enabled: false
-  external:
     enabled: true
     schedule: 8 9 * * *
+  external:
+    enabled: true
+    schedule: 8 10 * * *

clusters/cl01tl/helm/bazarr/values.yaml

@@ -87,7 +87,8 @@ volsync-target-config:
     enabled: true
     schedule: 10 8 * * *
   remote:
-    enabled: false
-  external:
     enabled: true
     schedule: 10 9 * * *
+  external:
+    enabled: true
+    schedule: 10 10 * * *

clusters/cl01tl/helm/booklore/values.yaml

@@ -225,10 +225,11 @@ volsync-target-config:
     enabled: true
     schedule: 12 8 * * *
   remote:
-    enabled: false
-  external:
     enabled: true
     schedule: 12 9 * * *
+  external:
+    enabled: true
+    schedule: 12 10 * * *
 volsync-target-data:
   pvcTarget: booklore-data
   local:
@@ -238,11 +239,11 @@ volsync-target-data:
       cacheCapacity: 10Gi
   remote:
     enabled: true
-    schedule: 14 10 * * *
+    schedule: 14 9 * * *
     restic:
       cacheCapacity: 10Gi
   external:
     enabled: true
-    schedule: 14 9 * * *
+    schedule: 14 10 * * *
     restic:
       cacheCapacity: 10Gi

clusters/cl01tl/helm/code-server/values.yaml

@@ -9,7 +9,7 @@ code-server:
         main:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.110.0@sha256:8473aa16fba93fccc3ca772173d095bccd2e44d4d3104467fee923df10d57cd2
+            tag: 4.111.0@sha256:04107645b21f33215d1087773e2c889dfed823434f5dc4c7e9ae20df218a8ef3
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -79,7 +79,8 @@ volsync-target-config:
     enabled: true
     schedule: 16 8 * * *
   remote:
-    enabled: false
-  external:
     enabled: true
     schedule: 16 9 * * *
+  external:
+    enabled: true
+    schedule: 16 10 * * *

clusters/cl01tl/helm/dawarich/Chart.lock

@@ -9,4 +9,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
 digest: sha256:9524709cf393c01f28b0d073ef6870a2f1afd46f3bc5f564e73c55450aba8dd0
-generated: "2026-03-11T20:28:31.12161959Z"
+generated: "2026-03-11T22:56:11.749729235Z"

clusters/cl01tl/helm/dawarich/values.yaml

@@ -330,7 +330,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 10 14 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true

clusters/cl01tl/helm/directus/Chart.lock

@@ -9,4 +9,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
 digest: sha256:0b50b4938669a7210930d6ee86a9602611b54cd13774f3386dbad04b4771e7f4
-generated: "2026-03-11T20:28:47.991453896Z"
+generated: "2026-03-11T22:56:26.818980186Z"

clusters/cl01tl/helm/directus/Chart.yaml

@@ -31,4 +31,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/directus.png
 # renovate: datasource=github-releases depName=directus/directus
-appVersion: 11.16.0
+appVersion: 11.16.1

clusters/cl01tl/helm/directus/templates/object-bucket-claim.yaml

@@ -1,11 +0,0 @@
-apiVersion: objectbucket.io/v1alpha1
-kind: ObjectBucketClaim
-metadata:
-  name: ceph-bucket-directus
-  labels:
-    app.kubernetes.io/name: ceph-bucket-directus
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  generateBucketName: bucket-directus
-  storageClassName: ceph-bucket

clusters/cl01tl/helm/directus/values.yaml

@@ -9,7 +9,7 @@ directus:
         main:
           image:
             repository: directus/directus
-            tag: 11.16.0
+            tag: 11.16.1
             pullPolicy: IfNotPresent
           env:
             - name: PUBLIC_URL
@@ -105,7 +105,7 @@ directus:
             - name: STORAGE_S3_BUCKET
               value: directus-assets
             - name: STORAGE_S3_ENDPOINT
-              value: http://garage-main.garage:3000
+              value: http://garage-main.garage:3900
             - name: STORAGE_S3_FORCE_PATH_STYLE
               value: true
             - name: AUTH_PROVIDERS
@@ -219,7 +219,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 15 14 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true

clusters/cl01tl/helm/freshrss/Chart.lock

@@ -12,4 +12,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:a3703e245881145524304af8a03c89d309c602479be3f7f8953c2fba120bf341
-generated: "2026-03-11T20:29:06.459675927Z"
+generated: "2026-03-11T22:56:41.856429843Z"

clusters/cl01tl/helm/freshrss/values.yaml

@@ -222,7 +222,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 20 14 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -250,7 +250,8 @@ volsync-target-data:
     enabled: true
     schedule: 18 8 * * *
   remote:
-    enabled: false
-  external:
     enabled: true
     schedule: 18 9 * * *
+  external:
+    enabled: true
+    schedule: 18 10 * * *

clusters/cl01tl/helm/garage/values.yaml

@@ -302,8 +302,8 @@ garage:
       serviceName: '{{ include "bjw-s.common.lib.chart.names.fullname" $ }}'
       endpoints:
         - port: admin
-          interval: 1m
+          interval: 5m
-          scrapeTimeout: 30s
+          scrapeTimeout: 2m
           path: /metrics
           bearerTokenSecret:
             name: garage-token-secret

clusters/cl01tl/helm/gatus/Chart.lock

@@ -9,4 +9,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:2fe7c088e99a11e0c6dd09fe48bb1e292eb58e22d9f8ff681bb6c6790945d54e
-generated: "2026-03-11T20:29:24.146159576Z"
+generated: "2026-03-11T22:56:56.957400817Z"

clusters/cl01tl/helm/gatus/values.yaml

@@ -430,7 +430,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 25 14 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -446,9 +446,10 @@ volsync-target-data:
   pvcTarget: gatus
   local:
     enabled: true
-    schedule: 22 8 * * *
+    schedule: 20 8 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 20 9 * * *
   external:
     enabled: true
-    schedule: 22 9 * * *
+    schedule: 20 10 * * *

clusters/cl01tl/helm/gitea/Chart.lock

@@ -24,4 +24,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:8f243465537fe443e97a8813e23e95d3608a6a2898b93209d03cf43f4ca8cc5d
-generated: "2026-03-11T20:29:43.560986774Z"
+generated: "2026-03-11T22:57:17.026946319Z"

clusters/cl01tl/helm/gitea/values.yaml

@@ -222,7 +222,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 0 7 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -259,7 +259,7 @@ volsync-target-storage:
     fsGroupChangePolicy: OnRootMismatch
   local:
     enabled: true
-    schedule: 0 0 0 * * *
+    schedule: 0 0 7 * * *
     restic:
       pruneIntervalDays: 3
       retain:

clusters/cl01tl/helm/grafana-operator/Chart.lock

@@ -12,4 +12,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
 digest: sha256:45cdb638fe815c3fc9703626b902d0f69ed8ffd0625e0f95bd7b33682126433b
-generated: "2026-03-11T20:30:08.534651625Z"
+generated: "2026-03-11T22:57:43.133815464Z"

clusters/cl01tl/helm/grafana-operator/values.yaml

@@ -42,7 +42,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 30 14 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true

clusters/cl01tl/helm/harbor/Chart.lock

@@ -9,4 +9,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
 digest: sha256:898f51eabee5959b9e7ebe90640cb915cb2dee446e6a6649a29499fecab8b6c7
-generated: "2026-03-11T20:30:26.896923374Z"
+generated: "2026-03-11T22:58:00.955579445Z"

clusters/cl01tl/helm/harbor/values.yaml

@@ -126,7 +126,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 35 14 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -21,7 +21,7 @@ home-assistant:
         code-server:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.110.0@sha256:8473aa16fba93fccc3ca772173d095bccd2e44d4d3104467fee923df10d57cd2
+            tag: 4.111.0@sha256:04107645b21f33215d1087773e2c889dfed823434f5dc4c7e9ae20df218a8ef3
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -134,9 +134,10 @@ volsync-target-config:
     fsGroupChangePolicy: OnRootMismatch
   local:
     enabled: true
-    schedule: 24 8 * * *
+    schedule: 22 8 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 22 9 * * *
   external:
     enabled: true
-    schedule: 24 9 * * *
+    schedule: 22 10 * * *

clusters/cl01tl/helm/immich/Chart.lock

@@ -12,4 +12,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:b886b0a1555ea75fbff52a58ccbf1659acbda20e933107bcbab9b00192aa25bd
-generated: "2026-03-11T20:30:52.850405084Z"
+generated: "2026-03-11T22:58:20.294240859Z"

clusters/cl01tl/helm/immich/values.yaml

@@ -209,7 +209,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 40 14 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -225,16 +225,16 @@ volsync-target-data:
   pvcTarget: immich
   local:
     enabled: true
-    schedule: 28 8 * * *
+    schedule: 24 8 * * *
     restic:
       cacheCapacity: 10Gi
   remote:
     enabled: true
-    schedule: 28 10 * * *
+    schedule: 24 9 * * *
     restic:
       cacheCapacity: 10Gi
   external:
     enabled: true
-    schedule: 28 9 * * *
+    schedule: 24 10 * * *
     restic:
       cacheCapacity: 10Gi

clusters/cl01tl/helm/jellyfin/values.yaml

@@ -143,14 +143,16 @@ volsync-target-config:
   pvcTarget: jellyfin-config
   local:
     enabled: true
-    schedule: 30 8 * * *
+    schedule: 26 8 * * *
     restic:
       cacheCapacity: 10Gi
   remote:
+    enabled: true
+    schedule: 26 9 * * *
     restic:
       cacheCapacity: 10Gi
   external:
     enabled: true
-    schedule: 30 9 * * *
+    schedule: 26 10 * * *
     restic:
       cacheCapacity: 10Gi

clusters/cl01tl/helm/jellystat/Chart.lock

@@ -9,4 +9,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:29b92b08c230d5f3abc13949b299acccd1e9f8ff7df1f691a5dec41df5405595
-generated: "2026-03-11T20:31:09.589577509Z"
+generated: "2026-03-11T22:58:35.766813121Z"

clusters/cl01tl/helm/jellystat/values.yaml

@@ -129,7 +129,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 45 14 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -145,9 +145,10 @@ volsync-target-data:
   pvcTarget: jellystat-data
   local:
     enabled: true
-    schedule: 32 8 * * *
+    schedule: 28 8 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 28 9 * * *
   external:
     enabled: true
-    schedule: 32 9 * * *
+    schedule: 28 10 * * *

clusters/cl01tl/helm/karakeep/templates/external-secret.yaml

@@ -57,6 +57,43 @@ spec:
         metadataPolicy: None
         property: secret
 
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: karakeep-bucket-garage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: karakeep-bucket-garage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: ACCESS_KEY_ID
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/karakeep-assets
+        metadataPolicy: None
+        property: ACCESS_KEY_ID
+    - secretKey: ACCESS_SECRET_KEY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/karakeep-assets
+        metadataPolicy: None
+        property: ACCESS_SECRET_KEY
+    - secretKey: ACCESS_REGION
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/karakeep-assets
+        metadataPolicy: None
+        property: ACCESS_REGION
+
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret

clusters/cl01tl/helm/karakeep/templates/object-bucket-claim.yaml

@@ -1,11 +0,0 @@
-apiVersion: objectbucket.io/v1alpha1
-kind: ObjectBucketClaim
-metadata:
-  name: ceph-bucket-karakeep
-  labels:
-    app.kubernetes.io/name: ceph-bucket-karakeep
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  generateBucketName: bucket-karakeep
-  storageClassName: ceph-bucket

clusters/cl01tl/helm/karakeep/values.yaml

@@ -29,24 +29,24 @@ karakeep:
                   name: karakeep-key-secret
                   key: prometheus-token
             - name: ASSET_STORE_S3_ENDPOINT
-              value: http://rook-ceph-rgw-ceph-objectstore.rook-ceph.svc:80
+              value: http://garage-main.garage:3900
             - name: ASSET_STORE_S3_REGION
-              value: us-east-1
-            - name: ASSET_STORE_S3_BUCKET
               valueFrom:
-                configMapKeyRef:
+                secretKeyRef:
-                  name: ceph-bucket-karakeep
+                  name: karakeep-bucket-garage
-                  key: BUCKET_NAME
+                  key: ACCESS_REGION
+            - name: ASSET_STORE_S3_BUCKET
+              value: karakeep-assets
             - name: ASSET_STORE_S3_ACCESS_KEY_ID
               valueFrom:
                 secretKeyRef:
-                  name: ceph-bucket-karakeep
+                  name: karakeep-bucket-garage
-                  key: AWS_ACCESS_KEY_ID
+                  key: ACCESS_KEY_ID
             - name: ASSET_STORE_S3_SECRET_ACCESS_KEY
               valueFrom:
                 secretKeyRef:
-                  name: ceph-bucket-karakeep
+                  name: karakeep-bucket-garage
-                  key: AWS_SECRET_ACCESS_KEY
+                  key: ACCESS_SECRET_KEY
             - name: ASSET_STORE_S3_FORCE_PATH_STYLE
               value: true
             - name: MEILI_ADDR
@@ -172,9 +172,10 @@ volsync-target-data:
   pvcTarget: karakeep
   local:
     enabled: true
-    schedule: 34 8 * * *
+    schedule: 30 8 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 30 9 * * *
   external:
     enabled: true
-    schedule: 34 9 * * *
+    schedule: 30 10 * * *

clusters/cl01tl/helm/komodo/Chart.lock

@@ -6,4 +6,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.9.1
 digest: sha256:833a88f82c14f78d63abea99244f2473bee2f5124a533a898a34844956f62b27
-generated: "2026-03-11T20:31:26.930797103Z"
+generated: "2026-03-11T22:58:51.287064579Z"

clusters/cl01tl/helm/komodo/values.yaml

@@ -230,7 +230,7 @@ postgresql-17-fdb-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 50 14 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true

clusters/cl01tl/helm/libation/values.yaml

@@ -75,9 +75,10 @@ volsync-target-config:
   pvcTarget: libation
   local:
     enabled: true
-    schedule: 36 8 * * *
+    schedule: 32 8 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 32 9 * * *
   external:
     enabled: true
-    schedule: 36 9 * * *
+    schedule: 32 10 * * *

clusters/cl01tl/helm/lidarr/Chart.lock

@@ -9,4 +9,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:d43b95fa1fc70c93541b9d73180406b31059c6cc45aa57a0cc8d9386c64833c3
-generated: "2026-03-11T20:31:44.929449841Z"
+generated: "2026-03-11T22:59:07.151659257Z"

clusters/cl01tl/helm/lidarr/values.yaml

@@ -167,7 +167,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 55 14 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -188,9 +188,10 @@ volsync-target-config:
     fsGroupChangePolicy: OnRootMismatch
   local:
     enabled: true
-    schedule: 38 8 * * *
+    schedule: 34 8 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 34 9 * * *
   external:
     enabled: true
-    schedule: 38 9 * * *
+    schedule: 34 10 * * *

clusters/cl01tl/helm/matrix-synapse/Chart.lock

@@ -1,7 +1,7 @@
 dependencies:
 - name: matrix-synapse
   repository: https://ananace.gitlab.io/charts
-  version: 3.12.22
+  version: 3.12.23
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.6.2
@@ -38,5 +38,5 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:3b61539bbe5efd66392178ded30fc80f23ca1bb54c1e552ab183037e478ad2a0
+digest: sha256:fb87880d3de281064519117d8046d7de14f41450ec8ff8c3c603f0179004768e
-generated: "2026-03-11T20:32:04.252221224Z"
+generated: "2026-03-12T11:03:45.232564538Z"

clusters/cl01tl/helm/matrix-synapse/Chart.yaml

@@ -29,7 +29,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: matrix-synapse
-    version: 3.12.22
+    version: 3.12.23
     repository: https://ananace.gitlab.io/charts
   - name: app-template
     alias: matrix-hookshot
@@ -81,4 +81,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/matrix.png
 # renovate: datasource=github-releases depName=element-hq/synapse
-appVersion: v1.149.0
+appVersion: v1.149.1

clusters/cl01tl/helm/matrix-synapse/values.yaml

@@ -434,7 +434,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 0 15 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -470,22 +470,24 @@ volsync-target-synapse:
   pvcTarget: matrix-synapse
   local:
     enabled: true
-    schedule: 44 8 * * *
+    schedule: 36 8 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 36 9 * * *
   external:
     enabled: true
-    schedule: 44 9 * * *
+    schedule: 36 10 * * *
 volsync-target-hookshot:
   pvcTarget: matrix-hookshot
   local:
     enabled: true
-    schedule: 46 8 * * *
+    schedule: 38 8 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 38 9 * * *
   external:
     enabled: true
-    schedule: 46 9 * * *
+    schedule: 38 10 * * *
 volsync-target-discord:
   pvcTarget: mautrix-discord
   moverSecurityContext:
@@ -493,12 +495,13 @@ volsync-target-discord:
     runAsGroup: 1337
   local:
     enabled: true
-    schedule: 48 8 * * *
+    schedule: 40 8 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 40 9 * * *
   external:
     enabled: true
-    schedule: 48 9 * * *
+    schedule: 40 10 * * *
 volsync-target-whatsapp:
   pvcTarget: mautrix-whatsapp
   moverSecurityContext:
@@ -506,9 +509,10 @@ volsync-target-whatsapp:
     runAsGroup: 1337
   local:
     enabled: true
-    schedule: 50 8 * * *
+    schedule: 42 8 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 42 9 * * *
   external:
     enabled: true
-    schedule: 50 9 * * *
+    schedule: 42 10 * * *

clusters/cl01tl/helm/movie-roulette/values.yaml

@@ -119,9 +119,10 @@ volsync-target-data:
   pvcTarget: movie-roulette-data
   local:
     enabled: true
-    schedule: 44 11 * * *
+    schedule: 44 8 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 44 9 * * *
   external:
     enabled: true
-    schedule: 44 12 * * *
+    schedule: 44 10 * * *

clusters/cl01tl/helm/navidrome/values.yaml

@@ -178,9 +178,10 @@ volsync-target-data:
     fsGroupChangePolicy: OnRootMismatch
   local:
     enabled: true
-    schedule: 52 8 * * *
+    schedule: 46 8 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 46 9 * * *
   external:
     enabled: true
-    schedule: 52 9 * * *
+    schedule: 46 10 * * *

clusters/cl01tl/helm/ollama/Chart.lock

@@ -9,4 +9,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:a3201fc53ddfbaeb5a81d08e9d20135fb59174879e20f0b4986b1b8540011e03
-generated: "2026-03-11T20:32:26.777194388Z"
+generated: "2026-03-11T22:59:44.389634096Z"

clusters/cl01tl/helm/ollama/values.yaml

@@ -289,7 +289,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 5 15 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -308,9 +308,10 @@ volsync-target-data:
     runAsGroup: 1337
   local:
     enabled: true
-    schedule: 54 8 * * *
+    schedule: 48 8 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 48 9 * * *
   external:
     enabled: true
-    schedule: 54 9 * * *
+    schedule: 48 10 * * *

clusters/cl01tl/helm/outline/Chart.lock

@@ -11,5 +11,8 @@ dependencies:
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
-digest: sha256:f1c3d6256c972a77b322e5717250332bee58345a123e691644b327b243fc14ca
+- name: volsync-target
-generated: "2026-03-11T20:32:45.928324638Z"
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.8.0
+digest: sha256:1f2e4e46e3ae2985ff3e7708c7d75a36f506f0402e02921d95f797ea0403db93
+generated: "2026-03-11T23:00:00.871137498Z"

clusters/cl01tl/helm/outline/Chart.yaml

@@ -33,6 +33,10 @@ dependencies:
     alias: valkey
     version: 0.4.0
     repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-data
+    version: 0.8.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/outline.png
 # renovate: datasource=github-releases depName=outline/outline
 appVersion: 1.5.0

clusters/cl01tl/helm/outline/templates/object-bucket-claim.yaml

@@ -1,30 +0,0 @@
-apiVersion: objectbucket.io/v1alpha1
-kind: ObjectBucketClaim
-metadata:
-  name: ceph-bucket-outline
-  labels:
-    app.kubernetes.io/name: ceph-bucket-outline
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  generateBucketName: bucket-outline
-  storageClassName: ceph-bucket
-  # additionalConfig:
-  #   bucketPolicy: |
-  #       {
-  #           "Version": "2012-10-17",
-  #           "Statement": [
-  #               {
-  #                   "Sid": "VisualEditor",
-  #                   "Effect": "Allow",
-  #                   "Action": [
-  #                       "s3:GetObjectAcl",
-  #                       "s3:DeleteObject",
-  #                       "s3:PutObject",
-  #                       "s3:GetObject",
-  #                       "s3:PutObjectAcl"
-  #                   ],
-  #                   "Resource": "arn:aws:s3:::bucket-outline-630c57e0-d475-4d78-926c-c1c082291d73/*"
-  #               }
-  #           ]
-  #       }

clusters/cl01tl/helm/outline/values.yaml

@@ -5,6 +5,9 @@ outline:
       replicas: 1
       strategy: Recreate
       revisionHistoryLimit: 3
+      pod:
+        securityContext:
+          fsGroup: 1001
       containers:
         main:
           image:
@@ -66,30 +69,7 @@ outline:
             - name: REDIS_URL
               value: redis://outline-valkey.outline:6379
             - name: FILE_STORAGE
-              value: s3
+              value: local
-            - name: AWS_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: ceph-bucket-outline
-                  key: AWS_ACCESS_KEY_ID
-            - name: AWS_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: ceph-bucket-outline
-                  key: AWS_SECRET_ACCESS_KEY
-            - name: AWS_REGION
-              value: us-east-1
-            - name: AWS_S3_UPLOAD_BUCKET_NAME
-              valueFrom:
-                configMapKeyRef:
-                  name: ceph-bucket-outline
-                  key: BUCKET_NAME
-            - name: AWS_S3_UPLOAD_BUCKET_URL
-              value: https://objects.alexlebens.dev
-            - name: AWS_S3_FORCE_PATH_STYLE
-              value: true
-            - name: AWS_S3_ACL
-              value: private
             - name: FILE_STORAGE_UPLOAD_MAX_SIZE
               value: "26214400"
             - name: FORCE_HTTPS
@@ -142,6 +122,18 @@ outline:
           port: 3000
           targetPort: 3000
           protocol: HTTP
+  persistence:
+    data:
+      forceRename: outline-data
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 5Gi
+      retain: true
+      advancedMounts:
+        main:
+          main:
+            - path: /var/lib/outline/data
+              readOnly: false
 postgres-18-cluster:
   mode: recovery
   recovery:
@@ -172,7 +164,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 10 15 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -184,3 +176,16 @@ postgres-18-cluster:
       #   immediate: true
       #   schedule: "0 0 0 * * *"
       #   backupName: external
+volsync-target-data:
+  pvcTarget: outline-data
+  moverSecurityContext:
+    fsGroup: 1001
+  local:
+    enabled: true
+    schedule: 50 8 * * *
+  remote:
+    enabled: true
+    schedule: 50 9 * * *
+  external:
+    enabled: true
+    schedule: 50 10 * * *

clusters/cl01tl/helm/photoview/Chart.lock

@@ -6,4 +6,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.9.1
 digest: sha256:e9b0673f31b8309beb326635e784964c41bafc10f3bde7eb17ea316d83076854
-generated: "2026-03-11T20:33:03.981010255Z"
+generated: "2026-03-11T23:00:19.541959816Z"

clusters/cl01tl/helm/photoview/values.yaml

@@ -123,7 +123,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 15 15 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true

clusters/cl01tl/helm/postiz/Chart.lock

@@ -18,4 +18,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:cf9b71f29450c69550b0f59d792193788f9dd7ffa2c623db27eb423c0f6e3109
-generated: "2026-03-11T20:33:20.656140762Z"
+generated: "2026-03-11T23:00:37.739141183Z"

clusters/cl01tl/helm/postiz/values.yaml

@@ -155,7 +155,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 20 15 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -181,19 +181,21 @@ volsync-target-config:
   pvcTarget: postiz-config
   local:
     enabled: true
-    schedule: 56 8 * * *
+    schedule: 52 8 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 52 9 * * *
   external:
     enabled: true
-    schedule: 56 9 * * *
+    schedule: 52 10 * * *
 volsync-target-upload:
   pvcTarget: postiz-uploads
   local:
     enabled: true
-    schedule: 58 8 * * *
+    schedule: 54 8 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 54 9 * * *
   external:
     enabled: true
-    schedule: 58 9 * * *
+    schedule: 54 10 * * *

clusters/cl01tl/helm/prowlarr/values.yaml

@@ -84,9 +84,10 @@ volsync-target-config:
       - 65539
   local:
     enabled: true
-    schedule: 0 11 * * *
+    schedule: 56 8 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 56 9 * * *
   external:
     enabled: true
-    schedule: 0 12 * * *
+    schedule: 56 10 * * *

clusters/cl01tl/helm/qbittorrent/values.yaml

@@ -452,19 +452,21 @@ volsync-target-config:
     fsGroupChangePolicy: OnRootMismatch
   local:
     enabled: true
-    schedule: 2 11 * * *
+    schedule: 58 8 * * *
     restic:
       copyMethod: Snapshot
       storageClassName: ceph-filesystem
       volumeSnapshotClassName: ceph-filesystem-snapshot
   remote:
+    enabled: true
+    schedule: 58 9 * * *
     restic:
       copyMethod: Snapshot
       storageClassName: ceph-filesystem
       volumeSnapshotClassName: ceph-filesystem-snapshot
   external:
     enabled: true
-    schedule: 2 12 * * *
+    schedule: 58 10 * * *
     restic:
       copyMethod: Snapshot
       storageClassName: ceph-filesystem
@@ -473,19 +475,21 @@ volsync-target-qbit-manage-config:
   pvcTarget: qbittorrent-qbit-manage-config-data
   local:
     enabled: true
-    schedule: 4 11 * * *
+    schedule: 0 11 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 0 12 * * *
   external:
     enabled: true
-    schedule: 4 12 * * *
+    schedule: 0 13 * * *
 volsync-target-qui-config:
   pvcTarget: qbittorrent-qui-config-data
   local:
     enabled: true
-    schedule: 6 11 * * *
+    schedule: 2 11 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 2 12 * * *
   external:
     enabled: true
-    schedule: 6 12 * * *
+    schedule: 2 13 * * *

clusters/cl01tl/helm/radarr-4k/Chart.lock

@@ -9,4 +9,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:7e873c90668a70b423efb04d4f2683d25022e8982248ba32a8e5820e323f9b7d
-generated: "2026-03-11T20:33:37.899162919Z"
+generated: "2026-03-11T23:00:55.780623797Z"

clusters/cl01tl/helm/radarr-4k/values.yaml

@@ -167,7 +167,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 30 15 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -188,9 +188,10 @@ volsync-target-config:
     fsGroupChangePolicy: OnRootMismatch
   local:
     enabled: true
-    schedule: 10 11 * * *
+    schedule: 6 11 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 6 12 * * *
   external:
     enabled: true
-    schedule: 10 12 * * *
+    schedule: 6 13 * * *

clusters/cl01tl/helm/radarr-anime/Chart.lock

@@ -9,4 +9,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:0a7ae6aa3062beedc4b4bcba61edb9f70d441dab0146e5b9559583fa12a319a8
-generated: "2026-03-11T20:33:55.401538625Z"
+generated: "2026-03-11T23:01:12.399079707Z"

clusters/cl01tl/helm/radarr-anime/values.yaml

@@ -165,7 +165,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 30 15 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -186,9 +186,10 @@ volsync-target-config:
     fsGroupChangePolicy: OnRootMismatch
   local:
     enabled: true
-    schedule: 12 11 * * *
+    schedule: 8 11 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 8 12 * * *
   external:
     enabled: true
-    schedule: 12 12 * * *
+    schedule: 8 13 * * *

clusters/cl01tl/helm/radarr-standup/Chart.lock

@@ -9,4 +9,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:600685215060deb3d8bb6530fa0df437c0ed3d9d6bad2792cedcce959207c7e6
-generated: "2026-03-11T20:34:14.921696945Z"
+generated: "2026-03-11T23:01:28.449666027Z"

clusters/cl01tl/helm/radarr-standup/values.yaml

@@ -165,7 +165,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 35 15 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -186,9 +186,10 @@ volsync-target-config:
     fsGroupChangePolicy: OnRootMismatch
   local:
     enabled: true
-    schedule: 14 11 * * *
+    schedule: 10 11 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 10 12 * * *
   external:
     enabled: true
-    schedule: 14 12 * * *
+    schedule: 10 13 * * *

clusters/cl01tl/helm/radarr/Chart.lock

@@ -9,4 +9,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:fdad6659ae4ef46c46d62b4213d7fcf85dbb478809e094bbe7de4a86a98589f2
-generated: "2026-03-11T20:34:36.153310758Z"
+generated: "2026-03-11T23:01:46.420629722Z"

clusters/cl01tl/helm/radarr/values.yaml

@@ -167,7 +167,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 25 15 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -188,9 +188,10 @@ volsync-target-config:
     fsGroupChangePolicy: OnRootMismatch
   local:
     enabled: true
-    schedule: 8 11 * * *
+    schedule: 4 11 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 4 12 * * *
   external:
     enabled: true
-    schedule: 8 12 * * *
+    schedule: 4 13 * * *

clusters/cl01tl/helm/rclone/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.6.2
+digest: sha256:8ed5a7025cbfee661770c4f525b6e1376f412114a7ab88cea1ab1de538eea500
+generated: "2026-03-11T18:19:57.681245-05:00"

clusters/cl01tl/helm/rclone/Chart.yaml

@@ -0,0 +1,23 @@
+apiVersion: v2
+name: rclone
+version: 1.0.0
+description: Rclone
+keywords:
+  - rclone
+  - job
+  - kubernetes
+home: https://wiki.alexlebens.dev/s/
+sources:
+  - https://github.com/rclone/rclone
+  - https://hub.docker.com/r/rclone/rclone
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: rclone
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.6.2
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/rclone.webp
+# renovate: datasource=github-releases depName=rclone/rclone
+appVersion: v1.73.2

clusters/cl01tl/helm/rclone/templates/external-secret.yaml

@@ -0,0 +1,253 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: garage-directus-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: garage-directus-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: ACCESS_KEY_ID
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/directus-assets
+        metadataPolicy: None
+        property: ACCESS_KEY_ID
+    - secretKey: ACCESS_REGION
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/directus-assets
+        metadataPolicy: None
+        property: ACCESS_REGION
+    - secretKey: ACCESS_SECRET_KEY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/directus-assets
+        metadataPolicy: None
+        property: ACCESS_SECRET_KEY
+    - secretKey: SRC_ENDPOINT
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/config/local
+        metadataPolicy: None
+        property: ENDPOINT
+    - secretKey: DEST_ENDPOINT
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/config/remote
+        metadataPolicy: None
+        property: ENDPOINT
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: garage-karakeep-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: garage-karakeep-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: ACCESS_KEY_ID
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/karakeep-assets
+        metadataPolicy: None
+        property: ACCESS_KEY_ID
+    - secretKey: ACCESS_REGION
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/karakeep-assets
+        metadataPolicy: None
+        property: ACCESS_REGION
+    - secretKey: ACCESS_SECRET_KEY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/karakeep-assets
+        metadataPolicy: None
+        property: ACCESS_SECRET_KEY
+    - secretKey: SRC_ENDPOINT
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/config/local
+        metadataPolicy: None
+        property: ENDPOINT
+    - secretKey: DEST_ENDPOINT
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/config/remote
+        metadataPolicy: None
+        property: ENDPOINT
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: garage-talos-backups-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: garage-talos-backups-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: ACCESS_KEY_ID
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/talos-backups
+        metadataPolicy: None
+        property: ACCESS_KEY_ID
+    - secretKey: ACCESS_REGION
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/talos-backups
+        metadataPolicy: None
+        property: ACCESS_REGION
+    - secretKey: ACCESS_SECRET_KEY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/talos-backups
+        metadataPolicy: None
+        property: ACCESS_SECRET_KEY
+    - secretKey: SRC_ENDPOINT
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/config/local
+        metadataPolicy: None
+        property: ENDPOINT
+    - secretKey: DEST_ENDPOINT
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/config/remote
+        metadataPolicy: None
+        property: ENDPOINT
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: garage-web-assets-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: garage-web-assets-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: ACCESS_KEY_ID
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/web-assets
+        metadataPolicy: None
+        property: ACCESS_KEY_ID
+    - secretKey: ACCESS_REGION
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/web-assets
+        metadataPolicy: None
+        property: ACCESS_REGION
+    - secretKey: ACCESS_SECRET_KEY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/web-assets
+        metadataPolicy: None
+        property: ACCESS_SECRET_KEY
+    - secretKey: SRC_ENDPOINT
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/config/local
+        metadataPolicy: None
+        property: ENDPOINT
+    - secretKey: DEST_ENDPOINT
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/config/remote
+        metadataPolicy: None
+        property: ENDPOINT
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: garage-postgres-backups-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: garage-postgres-backups-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: ACCESS_KEY_ID
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/postgres-backups
+        metadataPolicy: None
+        property: ACCESS_KEY_ID
+    - secretKey: ACCESS_REGION
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/postgres-backups
+        metadataPolicy: None
+        property: ACCESS_REGION
+    - secretKey: ACCESS_SECRET_KEY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/postgres-backups
+        metadataPolicy: None
+        property: ACCESS_SECRET_KEY
+    - secretKey: SRC_ENDPOINT
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/config/local
+        metadataPolicy: None
+        property: ENDPOINT
+    - secretKey: DEST_ENDPOINT
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/config/remote
+        metadataPolicy: None
+        property: ENDPOINT

clusters/cl01tl/helm/rclone/values.yaml

@@ -0,0 +1,505 @@
+rclone:
+  controllers:
+    directus-assets:
+      type: cronjob
+      cronjob:
+        suspend: false
+        concurrencyPolicy: Forbid
+        timeZone: US/Central
+        schedule: "0 0 * * *"
+        startingDeadlineSeconds: 90
+        successfulJobsHistory: 1
+        failedJobsHistory: 1
+        backoffLimit: 3
+        parallelism: 1
+      containers:
+        sync:
+          image:
+            repository: rclone/rclone
+            tag: 1.73.2
+            pullPolicy: IfNotPresent
+          args:
+            - sync
+            - src:directus-assets
+            - dest:directus-assets
+            - --s3-no-check-bucket
+            - --verbose
+          env:
+            - name: RCLONE_S3_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_SRC_TYPE
+              value: s3
+            - name: RCLONE_CONFIG_SRC_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_SRC_ENV_AUTH
+              value: false
+            - name: RCLONE_CONFIG_SRC_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: garage-directus-secret
+                  key: ACCESS_KEY_ID
+            - name: RCLONE_CONFIG_SRC_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: garage-directus-secret
+                  key: ACCESS_SECRET_KEY
+            - name: RCLONE_CONFIG_SRC_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: garage-directus-secret
+                  key: ACCESS_REGION
+            - name: RCLONE_CONFIG_SRC_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: garage-directus-secret
+                  key: SRC_ENDPOINT
+            - name: RCLONE_CONFIG_SRC_S3_FORCE_PATH_STYLE
+              value: true
+            - name: RCLONE_CONFIG_DEST_TYPE
+              value: s3
+            - name: RCLONE_CONFIG_DEST_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_DEST_ENV_AUTH
+              value: false
+            - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: garage-directus-secret
+                  key: ACCESS_KEY_ID
+            - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: garage-directus-secret
+                  key: ACCESS_SECRET_KEY
+            - name: RCLONE_CONFIG_DEST_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: garage-directus-secret
+                  key: ACCESS_REGION
+            - name: RCLONE_CONFIG_DEST_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: garage-directus-secret
+                  key: DEST_ENDPOINT
+            - name: RCLONE_CONFIG_DEST_S3_FORCE_PATH_STYLE
+              value: true
+    karakeep-assets:
+      type: cronjob
+      cronjob:
+        suspend: false
+        concurrencyPolicy: Forbid
+        timeZone: US/Central
+        schedule: "10 0 * * *"
+        startingDeadlineSeconds: 90
+        successfulJobsHistory: 1
+        failedJobsHistory: 1
+        backoffLimit: 3
+        parallelism: 1
+      containers:
+        sync:
+          image:
+            repository: rclone/rclone
+            tag: 1.73.2
+            pullPolicy: IfNotPresent
+          args:
+            - sync
+            - src:karakeep-assets
+            - dest:karakeep-assets
+            - --s3-no-check-bucket
+            - --verbose
+          env:
+            - name: RCLONE_S3_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_SRC_TYPE
+              value: s3
+            - name: RCLONE_CONFIG_SRC_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_SRC_ENV_AUTH
+              value: false
+            - name: RCLONE_CONFIG_SRC_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: garage-karakeep-secret
+                  key: ACCESS_KEY_ID
+            - name: RCLONE_CONFIG_SRC_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: garage-karakeep-secret
+                  key: ACCESS_SECRET_KEY
+            - name: RCLONE_CONFIG_SRC_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: garage-karakeep-secret
+                  key: ACCESS_REGION
+            - name: RCLONE_CONFIG_SRC_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: garage-karakeep-secret
+                  key: SRC_ENDPOINT
+            - name: RCLONE_CONFIG_SRC_S3_FORCE_PATH_STYLE
+              value: true
+            - name: RCLONE_CONFIG_DEST_TYPE
+              value: s3
+            - name: RCLONE_CONFIG_DEST_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_DEST_ENV_AUTH
+              value: false
+            - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: garage-karakeep-secret
+                  key: ACCESS_KEY_ID
+            - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: garage-karakeep-secret
+                  key: ACCESS_SECRET_KEY
+            - name: RCLONE_CONFIG_DEST_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: garage-karakeep-secret
+                  key: ACCESS_REGION
+            - name: RCLONE_CONFIG_DEST_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: garage-karakeep-secret
+                  key: DEST_ENDPOINT
+            - name: RCLONE_CONFIG_SRC_DEST_FORCE_PATH_STYLE
+              value: true
+    talos-backups:
+      type: cronjob
+      cronjob:
+        suspend: false
+        concurrencyPolicy: Forbid
+        timeZone: US/Central
+        schedule: "20 0 * * *"
+        startingDeadlineSeconds: 90
+        successfulJobsHistory: 1
+        failedJobsHistory: 1
+        backoffLimit: 3
+        parallelism: 1
+      containers:
+        sync:
+          image:
+            repository: rclone/rclone
+            tag: 1.73.2
+            pullPolicy: IfNotPresent
+          args:
+            - sync
+            - src:talos-backups
+            - dest:talos-backups
+            - --s3-no-check-bucket
+            - --max-age
+            - 90d
+            - --verbose
+          env:
+            - name: RCLONE_S3_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_SRC_TYPE
+              value: s3
+            - name: RCLONE_CONFIG_SRC_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_SRC_ENV_AUTH
+              value: false
+            - name: RCLONE_CONFIG_SRC_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: garage-talos-backups-secret
+                  key: ACCESS_KEY_ID
+            - name: RCLONE_CONFIG_SRC_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: garage-talos-backups-secret
+                  key: ACCESS_SECRET_KEY
+            - name: RCLONE_CONFIG_SRC_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: garage-talos-backups-secret
+                  key: ACCESS_REGION
+            - name: RCLONE_CONFIG_SRC_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: garage-talos-backups-secret
+                  key: SRC_ENDPOINT
+            - name: RCLONE_CONFIG_SRC_S3_FORCE_PATH_STYLE
+              value: true
+            - name: RCLONE_CONFIG_DEST_TYPE
+              value: s3
+            - name: RCLONE_CONFIG_DEST_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_DEST_ENV_AUTH
+              value: false
+            - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: garage-talos-backups-secret
+                  key: ACCESS_KEY_ID
+            - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: garage-talos-backups-secret
+                  key: ACCESS_SECRET_KEY
+            - name: RCLONE_CONFIG_DEST_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: garage-talos-backups-secret
+                  key: ACCESS_REGION
+            - name: RCLONE_CONFIG_DEST_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: garage-talos-backups-secret
+                  key: DEST_ENDPOINT
+            - name: RCLONE_CONFIG_SRC_DEST_FORCE_PATH_STYLE
+              value: true
+        prune:
+          image:
+            repository: rclone/rclone
+            tag: 1.73.2
+            pullPolicy: IfNotPresent
+          args:
+            - delete
+            - dest:talos-backups
+            - --min-age
+            - 90d
+            - --verbose
+          env:
+            - name: RCLONE_CONFIG_DEST_TYPE
+              value: s3
+            - name: RCLONE_CONFIG_DEST_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_DEST_ENV_AUTH
+              value: false
+            - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: garage-talos-backups-secret
+                  key: ACCESS_KEY_ID
+            - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: garage-talos-backups-secret
+                  key: ACCESS_SECRET_KEY
+            - name: RCLONE_CONFIG_DEST_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: garage-talos-backups-secret
+                  key: ACCESS_REGION
+            - name: RCLONE_CONFIG_DEST_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: garage-talos-backups-secret
+                  key: DEST_ENDPOINT
+            - name: RCLONE_CONFIG_SRC_S3_FORCE_PATH_STYLE
+              value: true
+    web-assets:
+      type: cronjob
+      cronjob:
+        suspend: false
+        concurrencyPolicy: Forbid
+        timeZone: US/Central
+        schedule: "30 0 * * *"
+        startingDeadlineSeconds: 90
+        successfulJobsHistory: 1
+        failedJobsHistory: 1
+        backoffLimit: 3
+        parallelism: 1
+      containers:
+        sync:
+          image:
+            repository: rclone/rclone
+            tag: 1.73.2
+            pullPolicy: IfNotPresent
+          args:
+            - sync
+            - src:web-assets
+            - dest:web-assets
+            - --s3-no-check-bucket
+            - --verbose
+          env:
+            - name: RCLONE_S3_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_SRC_TYPE
+              value: s3
+            - name: RCLONE_CONFIG_SRC_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_SRC_ENV_AUTH
+              value: false
+            - name: RCLONE_CONFIG_SRC_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: garage-web-assets-secret
+                  key: ACCESS_KEY_ID
+            - name: RCLONE_CONFIG_SRC_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: garage-web-assets-secret
+                  key: ACCESS_SECRET_KEY
+            - name: RCLONE_CONFIG_SRC_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: garage-web-assets-secret
+                  key: ACCESS_REGION
+            - name: RCLONE_CONFIG_SRC_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: garage-web-assets-secret
+                  key: SRC_ENDPOINT
+            - name: RCLONE_CONFIG_SRC_S3_FORCE_PATH_STYLE
+              value: true
+            - name: RCLONE_CONFIG_DEST_TYPE
+              value: s3
+            - name: RCLONE_CONFIG_DEST_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_DEST_ENV_AUTH
+              value: false
+            - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: garage-web-assets-secret
+                  key: ACCESS_KEY_ID
+            - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: garage-web-assets-secret
+                  key: ACCESS_SECRET_KEY
+            - name: RCLONE_CONFIG_DEST_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: garage-web-assets-secret
+                  key: ACCESS_REGION
+            - name: RCLONE_CONFIG_DEST_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: garage-web-assets-secret
+                  key: DEST_ENDPOINT
+            - name: RCLONE_CONFIG_DEST_S3_FORCE_PATH_STYLE
+              value: true
+    postgres-backups:
+      type: cronjob
+      cronjob:
+        suspend: false
+        concurrencyPolicy: Forbid
+        timeZone: US/Central
+        schedule: "40 0 * * *"
+        startingDeadlineSeconds: 90
+        successfulJobsHistory: 1
+        failedJobsHistory: 1
+        backoffLimit: 3
+        parallelism: 1
+      containers:
+        sync:
+          image:
+            repository: rclone/rclone
+            tag: 1.73.2
+            pullPolicy: IfNotPresent
+          args:
+            - sync
+            - src:postgres-backups
+            - dest:postgres-backups
+            - --s3-no-check-bucket
+            - --max-age
+            - 30d
+            - --include
+            - "/cl01tl/*/*/*/base/**"
+            - --exclude
+            - "**/walls/**"
+            - --verbose
+          env:
+            - name: RCLONE_S3_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_SRC_TYPE
+              value: s3
+            - name: RCLONE_CONFIG_SRC_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_SRC_ENV_AUTH
+              value: false
+            - name: RCLONE_CONFIG_SRC_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: garage-postgres-backups-secret
+                  key: ACCESS_KEY_ID
+            - name: RCLONE_CONFIG_SRC_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: garage-postgres-backups-secret
+                  key: ACCESS_SECRET_KEY
+            - name: RCLONE_CONFIG_SRC_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: garage-postgres-backups-secret
+                  key: ACCESS_REGION
+            - name: RCLONE_CONFIG_SRC_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: garage-postgres-backups-secret
+                  key: SRC_ENDPOINT
+            - name: RCLONE_CONFIG_SRC_S3_FORCE_PATH_STYLE
+              value: true
+            - name: RCLONE_CONFIG_DEST_TYPE
+              value: s3
+            - name: RCLONE_CONFIG_DEST_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_DEST_ENV_AUTH
+              value: false
+            - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: garage-postgres-backups-secret
+                  key: ACCESS_KEY_ID
+            - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: garage-postgres-backups-secret
+                  key: ACCESS_SECRET_KEY
+            - name: RCLONE_CONFIG_DEST_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: garage-postgres-backups-secret
+                  key: ACCESS_REGION
+            - name: RCLONE_CONFIG_DEST_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: garage-postgres-backups-secret
+                  key: DEST_ENDPOINT
+            - name: RCLONE_CONFIG_SRC_DEST_FORCE_PATH_STYLE
+              value: true
+        prune:
+          image:
+            repository: rclone/rclone
+            tag: 1.73.2
+            pullPolicy: IfNotPresent
+          args:
+            - delete
+            - dest:postgres-backups
+            - --min-age
+            - 30d
+            - --verbose
+          env:
+            - name: RCLONE_CONFIG_DEST_TYPE
+              value: s3
+            - name: RCLONE_CONFIG_DEST_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_DEST_ENV_AUTH
+              value: false
+            - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: garage-postgres-backups-secret
+                  key: ACCESS_KEY_ID
+            - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: garage-postgres-backups-secret
+                  key: ACCESS_SECRET_KEY
+            - name: RCLONE_CONFIG_DEST_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: garage-postgres-backups-secret
+                  key: ACCESS_REGION
+            - name: RCLONE_CONFIG_DEST_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: garage-postgres-backups-secret
+                  key: DEST_ENDPOINT
+            - name: RCLONE_CONFIG_SRC_S3_FORCE_PATH_STYLE
+              value: true

clusters/cl01tl/helm/rook-ceph/Chart.yaml

@@ -21,10 +21,6 @@ dependencies:
   - name: rook-ceph-cluster
     version: v1.19.2
     repository: https://charts.rook.io/release
-  - name: cloudflared
-    alias: cloudflared-rgw
-    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.4.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ceph.png
 # renovate: datasource=github-releases depName=rook/rook
 appVersion: v1.19.2

clusters/cl01tl/helm/rook-ceph/values.yaml

@@ -177,51 +177,4 @@ rook-ceph-cluster:
     name: ceph-blockpool-snapshot
     isDefault: true
     deletionPolicy: Delete
-  cephObjectStores:
+  cephObjectStores: []
-    - name: ceph-objectstore
-      spec:
-        metadataPool:
-          failureDomain: host
-          replicated:
-            size: 3
-        dataPool:
-          failureDomain: host
-          erasureCoded:
-            dataChunks: 2
-            codingChunks: 1
-          parameters:
-            bulk: "true"
-        preservePoolsOnDelete: true
-        gateway:
-          port: 80
-          resources:
-            requests:
-              cpu: "1000m"
-              memory: "1Gi"
-          instances: 1
-          priorityClassName: system-cluster-critical
-        hosting:
-          dnsNames:
-            - objects.alexlebens.dev
-            - objects.alexlebens.net
-      storageClass:
-        enabled: true
-        name: ceph-bucket
-        reclaimPolicy: Delete
-        volumeBindingMode: "Immediate"
-        parameters:
-          region: us-east-1
-      route:
-        enabled: true
-        port: 80
-        host:
-          name: objects.alexlebens.net
-          path: /
-          pathType: PathPrefix
-        parentRefs:
-          - group: gateway.networking.k8s.io
-            kind: Gateway
-            name: traefik-gateway
-            namespace: traefik
-cloudflared-rgw:
-  name: rgw

clusters/cl01tl/helm/roundcube/Chart.lock

@@ -9,4 +9,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:5cfad7a46f5671378adac77c3e39df224430a7481aeb16f7d3713f134e5d1dab
-generated: "2026-03-11T20:34:53.851532629Z"
+generated: "2026-03-11T23:02:03.844844518Z"

clusters/cl01tl/helm/roundcube/values.yaml

@@ -58,7 +58,7 @@ roundcube:
         nginx:
           image:
             repository: nginx
-            tag: 1.29.5-alpine-slim
+            tag: 1.29.6-alpine-slim
             pullPolicy: IfNotPresent
           env:
             - name: NGINX_HOST
@@ -256,7 +256,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 40 15 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -272,9 +272,10 @@ volsync-target-data:
   pvcTarget: roundcube-data
   local:
     enabled: true
-    schedule: 16 11 * * *
+    schedule: 12 11 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 12 12 * * *
   external:
     enabled: true
-    schedule: 16 12 * * *
+    schedule: 12 13 * * *

clusters/cl01tl/helm/rybbit/Chart.lock

@@ -12,4 +12,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:4cc27a45f60df729db0cff4780bfb49655db739fdd35f6a46eb3a0489efdc88f
-generated: "2026-03-11T20:35:09.94349519Z"
+generated: "2026-03-11T23:02:21.670318334Z"

clusters/cl01tl/helm/rybbit/values.yaml

@@ -288,7 +288,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 45 15 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -309,9 +309,10 @@ volsync-target-clickhouse-data:
     fsGroupChangePolicy: OnRootMismatch
   local:
     enabled: true
-    schedule: 40 11 * * *
+    schedule: 14 11 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 14 12 * * *
   external:
     enabled: true
-    schedule: 40 12 * * *
+    schedule: 14 13 * * *

clusters/cl01tl/helm/s3-exporter/templates/external-secret.yaml

@@ -34,43 +34,6 @@ spec:
         metadataPolicy: None
         property: AWS_REGION
 
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: s3-ceph-directus-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: s3-ceph-directus-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/directus/ceph
-        metadataPolicy: None
-        property: AWS_ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/directus/ceph
-        metadataPolicy: None
-        property: AWS_SECRET_ACCESS_KEY
-    - secretKey: BUCKET_HOST
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/directus/ceph
-        metadataPolicy: None
-        property: BUCKET_HOST
-
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret

clusters/cl01tl/helm/s3-exporter/values.yaml

@@ -39,45 +39,6 @@ s3-exporter:
             requests:
               cpu: 10m
               memory: 64Mi
-    ceph-directus:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: molu8bits/s3bucket_exporter
-            tag: 1.0.2
-            pullPolicy: IfNotPresent
-          env:
-            - name: S3_NAME
-              value: ceph-directus
-            - name: S3_ENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: s3-ceph-directus-secret
-                  key: BUCKET_HOST
-            - name: S3_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: s3-ceph-directus-secret
-                  key: AWS_ACCESS_KEY_ID
-            - name: S3_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: s3-ceph-directus-secret
-                  key: AWS_SECRET_ACCESS_KEY
-            - name: S3_REGION
-              value: us-east-1
-            - name: LOG_LEVEL
-              value: info
-            - name: S3_FORCE_PATH_STYLE
-              value: true
-          resources:
-            requests:
-              cpu: 10m
-              memory: 64Mi
     garage-local:
       type: deployment
       replicas: 1
@@ -158,13 +119,6 @@ s3-exporter:
           port: 9655
           targetPort: 9655
           protocol: TCP
-    ceph-directus:
-      controller: ceph-directus
-      ports:
-        metrics:
-          port: 9655
-          targetPort: 9655
-          protocol: TCP
     garage-local:
       controller: garage-local
       ports:
@@ -190,19 +144,7 @@ s3-exporter:
       endpoints:
         - port: metrics
           interval: 5m
-          scrapeTimeout: 120s
+          scrapeTimeout: 2m
-          path: /metrics
-    ceph-directus:
-      selector:
-        matchLabels:
-          app.kubernetes.io/name: s3-exporter
-          app.kubernetes.io/instance: s3-exporter
-          app.kubernetes.io/service: s3-exporter-ceph-directus
-      serviceName: s3-exporter-ceph-directus
-      endpoints:
-        - port: metrics
-          interval: 5m
-          scrapeTimeout: 120s
           path: /metrics
     garage-local:
       selector:
@@ -214,7 +156,7 @@ s3-exporter:
       endpoints:
         - port: metrics
           interval: 5m
-          scrapeTimeout: 120s
+          scrapeTimeout: 2m
           path: /metrics
     garage-remote:
       selector:
@@ -226,5 +168,5 @@ s3-exporter:
       endpoints:
         - port: metrics
           interval: 5m
-          scrapeTimeout: 120s
+          scrapeTimeout: 2m
           path: /metrics

clusters/cl01tl/helm/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:943c8997857aa050ef405779df2fd809960b0e230707f0c45d8e1f0d6a5bb4b7
+            tag: latest@sha256:5cdcc74aa8048d41b545f1577d5d3a2acebb49d56ea609c65a7adb5f3fc6791d
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -39,7 +39,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:943c8997857aa050ef405779df2fd809960b0e230707f0c45d8e1f0d6a5bb4b7
+            tag: latest@sha256:5cdcc74aa8048d41b545f1577d5d3a2acebb49d56ea609c65a7adb5f3fc6791d
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -171,9 +171,10 @@ volsync-target-data:
   pvcTarget: searxng-browser-data
   local:
     enabled: true
-    schedule: 18 11 * * *
+    schedule: 16 11 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 16 12 * * *
   external:
     enabled: true
-    schedule: 18 12 * * *
+    schedule: 16 12 * * *

clusters/cl01tl/helm/seerr/values.yaml

@@ -48,9 +48,10 @@ volsync-target-config:
   pvcTarget: seerr-seerr-chart-config
   local:
     enabled: true
-    schedule: 20 11 * * *
+    schedule: 18 11 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 18 12 * * *
   external:
     enabled: true
-    schedule: 20 12 * * *
+    schedule: 18 13 * * *

clusters/cl01tl/helm/shelfmark/values.yaml

@@ -170,9 +170,10 @@ volsync-target-config:
     runAsGroup: 1000
   local:
     enabled: true
-    schedule: 38 11 * * *
+    schedule: 20 11 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 20 12 * * *
   external:
     enabled: true
-    schedule: 38 12 * * *
+    schedule: 20 13 * * *

clusters/cl01tl/helm/site-documentation/values.yaml

@@ -11,7 +11,7 @@ site-documentation:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-documentation
-            tag: 0.1.7
+            tag: 0.2.0
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/site-profile/values.yaml

@@ -11,7 +11,7 @@ site-profile:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-profile
-            tag: 3.1.0
+            tag: 3.7.0
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/sonarr-4k/Chart.lock

@@ -9,4 +9,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:487799d20d30d26443b4b7ffdd31dcba61e27e01067a6a0d7f3f265097a9d9af
-generated: "2026-03-11T20:35:26.400643681Z"
+generated: "2026-03-11T23:02:43.378419214Z"

clusters/cl01tl/helm/sonarr-4k/values.yaml

@@ -165,7 +165,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 55 15 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -188,7 +188,8 @@ volsync-target-config:
     enabled: true
     schedule: 24 11 * * *
   remote:
-    enabled: false
-  external:
     enabled: true
     schedule: 24 12 * * *
+  external:
+    enabled: true
+    schedule: 24 13 * * *

clusters/cl01tl/helm/sonarr-anime/Chart.lock

@@ -9,4 +9,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:b2899ddbca96333330da52c7819c54d010691894d085b9f21a8ebd8d679a9823
-generated: "2026-03-11T20:35:43.379460965Z"
+generated: "2026-03-11T23:03:04.501966653Z"

clusters/cl01tl/helm/sonarr-anime/values.yaml

@@ -165,7 +165,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 0 16 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -188,7 +188,8 @@ volsync-target-config:
     enabled: true
     schedule: 26 11 * * *
   remote:
-    enabled: false
-  external:
     enabled: true
     schedule: 26 12 * * *
+  external:
+    enabled: true
+    schedule: 26 13 * * *

clusters/cl01tl/helm/sonarr/Chart.lock

@@ -9,4 +9,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:828d3934111d24f54e39bb433da9d8a3aeeec21dcd8228737a6e496852fb6b5f
-generated: "2026-03-11T20:35:59.414582598Z"
+generated: "2026-03-11T23:03:21.968129945Z"

clusters/cl01tl/helm/sonarr/values.yaml

@@ -165,7 +165,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 50 15 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -188,7 +188,8 @@ volsync-target-config:
     enabled: true
     schedule: 22 11 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 22 12 * *
   external:
     enabled: true
-    schedule: 22 12 * * *
+    schedule: 22 13 * * *

clusters/cl01tl/helm/stalwart/Chart.lock

@@ -12,4 +12,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:aef9a2c62df9bf44adf02d84b032ccd198c34cee56ff8d86d7200e9f5b21a5c1
-generated: "2026-03-11T20:36:15.150430524Z"
+generated: "2026-03-11T23:03:39.658857007Z"

clusters/cl01tl/helm/stalwart/values.yaml

@@ -102,7 +102,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 5 16 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
@@ -118,9 +118,10 @@ volsync-target-config:
   pvcTarget: stalwart-config
   local:
     enabled: true
-    schedule: 32 11 * * *
+    schedule: 28 11 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 28 12 * * *
   external:
     enabled: true
-    schedule: 32 12 * * *
+    schedule: 28 13 * * *

clusters/cl01tl/helm/tdarr/values.yaml

@@ -181,19 +181,21 @@ volsync-target-config:
   pvcTarget: tdarr-config
   local:
     enabled: true
-    schedule: 36 11 * * *
+    schedule: 30 11 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 30 12 * * *
   external:
     enabled: true
-    schedule: 36 12 * * *
+    schedule: 30 13 * * *
 volsync-target-server:
   pvcTarget: tdarr-server
   local:
     enabled: true
-    schedule: 38 11 * * *
+    schedule: 32 11 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 32 12 * * *
   external:
     enabled: true
-    schedule: 38 12 * * *
+    schedule: 32 13 * * *

clusters/cl01tl/helm/vaultwarden/Chart.lock

@@ -12,4 +12,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 digest: sha256:1d6f670bfe76dbc3d59a2ff762cb5536be8d1f5ce0ed12b44bd9792076607bed
-generated: "2026-03-11T20:36:32.403308099Z"
+generated: "2026-03-11T23:03:57.367242959Z"

clusters/cl01tl/helm/vaultwarden/values.yaml

@@ -113,6 +113,7 @@ volsync-target-data:
     enabled: true
     schedule: 0 0 0 * * *
   remote:
+    enabled: true
     schedule: 0 0 0 * * *
   external:
     enabled: true

clusters/cl01tl/helm/yamtrack/Chart.lock

@@ -9,4 +9,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
 digest: sha256:e2398649941bcdbcba86bf8b7fbeaf5187e2ba29c5046d28be62ab9f37494c7e
-generated: "2026-03-11T20:36:49.625435181Z"
+generated: "2026-03-11T23:04:20.045077529Z"

clusters/cl01tl/helm/yamtrack/values.yaml

@@ -120,7 +120,7 @@ postgres-18-cluster:
       - name: live-backup
         suspend: false
         immediate: true
-        schedule: "0 0 0 * * *"
+        schedule: "0 10 16 * * *"
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true

clusters/cl01tl/helm/yubal/values.yaml

@@ -147,9 +147,10 @@ volsync-target-config:
   pvcTarget: yubal
   local:
     enabled: true
-    schedule: 42 11 * * *
+    schedule: 34 11 * * *
   remote:
-    enabled: false
+    enabled: true
+    schedule: 34 12 * * *
   external:
     enabled: true
-    schedule: 42 12 * * *
+    schedule: 34 14 * * *