27 Commits

Author SHA1 Message Date
97a2d867a0 Merge pull request 'chore(deps): update helm release traefik-crds to v1.17.0' (#6152) from renovate/unified-traefik into main
Some checks are pending
renovate / renovate (push) Waiting to run
lint-test-helm / lint-helm (push) Successful in 1m23s
lint-test-helm / validate-kubeconform (push) Has been skipped
Reviewed-on: #6152
2026-04-24 16:44:16 +00:00
59fb844be3 chore(deps): update helm release traefik-crds to v1.17.0 2026-04-24 16:44:16 +00:00
81296df3ee Merge pull request 'chore(deps): update ghcr.io/linuxserver/code-server docker tag to v4.117.0-ls334' (#6155) from renovate/unified-code-server into main
Some checks failed
lint-test-helm / lint-helm (push) Successful in 45s
lint-test-helm / validate-kubeconform (push) Has been skipped
renovate / renovate (push) Has been cancelled
Reviewed-on: #6155
2026-04-24 16:42:09 +00:00
cb255378d1 chore(deps): update ghcr.io/linuxserver/code-server docker tag to v4.117.0-ls334 2026-04-24 16:42:09 +00:00
6c1c44b49e Merge pull request 'chore(deps): update external-secrets to v2.4.0' (#6189) from renovate/unified-external-secrets into main
Some checks failed
lint-test-helm / lint-helm (push) Successful in 37s
lint-test-helm / validate-kubeconform (push) Has been skipped
renovate / renovate (push) Has been cancelled
Reviewed-on: #6189
2026-04-24 16:40:12 +00:00
c4418a0b40 chore(deps): update external-secrets to v2.4.0
All checks were successful
lint-test-helm / lint-helm (pull_request) Successful in 1m43s
lint-test-helm / validate-kubeconform (pull_request) Successful in 57s
render-manifests / render-manifests (pull_request) Successful in 2m3s
2026-04-24 16:34:41 +00:00
1861572ead Merge pull request 'feat: use latest' (#6192) from tmp/qbit-2 into main
All checks were successful
lint-test-helm / lint-helm (push) Successful in 1m12s
lint-test-helm / validate-kubeconform (push) Has been skipped
renovate / renovate (push) Successful in 6m40s
Reviewed-on: #6192
2026-04-24 16:31:33 +00:00
1c07e3daa8 feat: use latest
All checks were successful
lint-test-helm / lint-helm (pull_request) Successful in 48s
lint-test-helm / validate-kubeconform (pull_request) Successful in 42s
render-manifests / render-manifests (pull_request) Successful in 1m8s
2026-04-24 11:25:11 -05:00
b446ff06e1 Merge pull request 'feat: add service account' (#6190) from tmp/secrets-13 into main
All checks were successful
lint-test-helm / lint-helm (push) Successful in 1m34s
lint-test-helm / validate-kubeconform (push) Has been skipped
renovate / renovate (push) Successful in 14m33s
Reviewed-on: #6190
2026-04-24 16:07:36 +00:00
92a5ff487d fix: wrong name
All checks were successful
lint-test-helm / lint-helm (pull_request) Successful in 1m18s
lint-test-helm / validate-kubeconform (pull_request) Successful in 1m7s
render-manifests / render-manifests (pull_request) Successful in 2m43s
2026-04-24 11:03:57 -05:00
d4ab84ed8d fix: wrong name
All checks were successful
lint-test-helm / lint-helm (pull_request) Successful in 47s
lint-test-helm / validate-kubeconform (pull_request) Successful in 46s
2026-04-24 11:00:21 -05:00
2d1f33e96c feat: add service account
All checks were successful
lint-test-helm / lint-helm (pull_request) Successful in 1m56s
lint-test-helm / validate-kubeconform (pull_request) Successful in 53s
2026-04-24 10:58:57 -05:00
ee469329c7 Merge pull request 'feat: add service account' (#6187) from tmp/matrix-5 into main
All checks were successful
lint-test-helm / lint-helm (push) Successful in 51s
lint-test-helm / validate-kubeconform (push) Has been skipped
renovate / renovate (push) Successful in 6m28s
Reviewed-on: #6187
2026-04-24 15:36:38 +00:00
221becb66c feat: add service account
All checks were successful
lint-test-helm / lint-helm (pull_request) Successful in 59s
lint-test-helm / validate-kubeconform (pull_request) Successful in 1m4s
render-manifests / render-manifests (pull_request) Successful in 3m9s
2026-04-24 10:35:35 -05:00
1ae52e9303 Merge pull request 'feat: repalce with issuer' (#6185) from tmp/outline into main
Some checks failed
lint-test-helm / lint-helm (push) Successful in 39s
lint-test-helm / validate-kubeconform (push) Has been skipped
renovate / renovate (push) Has been cancelled
Reviewed-on: #6185
2026-04-24 15:33:03 +00:00
d2bf03e00e feat: repalce with issuer
All checks were successful
lint-test-helm / lint-helm (pull_request) Successful in 43s
lint-test-helm / validate-kubeconform (pull_request) Has been skipped
render-manifests / render-manifests (pull_request) Successful in 1m13s
2026-04-24 10:31:43 -05:00
8fca397ee5 Merge pull request 'feat: change name' (#6183) from tmp/secrets-12 into main
All checks were successful
lint-test-helm / lint-helm (push) Successful in 57s
lint-test-helm / validate-kubeconform (push) Has been skipped
renovate / renovate (push) Successful in 7m24s
Reviewed-on: #6183
2026-04-24 15:21:45 +00:00
11553c54b3 feat: change key
All checks were successful
lint-test-helm / lint-helm (pull_request) Successful in 44s
lint-test-helm / validate-kubeconform (pull_request) Successful in 2m0s
render-manifests / render-manifests (pull_request) Successful in 2m43s
2026-04-24 10:16:53 -05:00
af188618f6 feat: change name
All checks were successful
lint-test-helm / lint-helm (pull_request) Successful in 1m23s
lint-test-helm / validate-kubeconform (pull_request) Successful in 1m15s
2026-04-24 10:14:03 -05:00
17632c9da7 Merge pull request 'chore(deps): update searxng/searxng:latest docker digest to c9100c2' (#6181) from renovate/unified-searxng into main
All checks were successful
lint-test-helm / lint-helm (push) Successful in 37s
lint-test-helm / validate-kubeconform (push) Has been skipped
renovate / renovate (push) Successful in 6m2s
render-manifests / render-manifests (push) Successful in 14m12s
2026-04-24 14:03:33 +00:00
efe4d16f40 chore(deps): update searxng/searxng:latest docker digest to c9100c2
All checks were successful
lint-test-helm / lint-helm (pull_request) Successful in 23s
lint-test-helm / validate-kubeconform (pull_request) Has been skipped
render-manifests / render-manifests (pull_request) Successful in 1m13s
2026-04-24 14:03:20 +00:00
9f96688b1f Merge pull request 'chore(deps): update searxng/searxng:latest docker digest to f0e5e56' (#6179) from renovate/unified-searxng into main
All checks were successful
lint-test-helm / lint-helm (push) Successful in 19s
lint-test-helm / validate-kubeconform (push) Has been skipped
renovate / renovate (push) Successful in 3m38s
2026-04-24 13:04:41 +00:00
ceeebfc5e1 chore(deps): update searxng/searxng:latest docker digest to f0e5e56
All checks were successful
lint-test-helm / lint-helm (pull_request) Successful in 20s
lint-test-helm / validate-kubeconform (pull_request) Has been skipped
render-manifests / render-manifests (pull_request) Successful in 1m6s
2026-04-24 13:04:29 +00:00
939b9c3f8c Merge pull request 'chore(deps): update helm release openbao to v0.27.2' (#6177) from renovate/unified-openbao into main
All checks were successful
lint-test-helm / lint-helm (push) Successful in 30s
lint-test-helm / validate-kubeconform (push) Has been skipped
renovate / renovate (push) Successful in 5m12s
2026-04-24 09:03:36 +00:00
78043bdaab chore(deps): update helm release openbao to v0.27.2 2026-04-24 09:03:36 +00:00
912cc8df6c Merge pull request 'chore(deps): update dependency excalidraw/excalidraw to v0.18.1' (#6176) from renovate/unified-excalidraw into main
Some checks failed
lint-test-helm / lint-helm (push) Has been cancelled
lint-test-helm / validate-kubeconform (push) Has been cancelled
renovate / renovate (push) Has been cancelled
2026-04-24 09:03:11 +00:00
7a06594947 chore(deps): update dependency excalidraw/excalidraw to v0.18.1
All checks were successful
renovate/stability-days Updates have met minimum release age requirement
lint-test-helm / lint-helm (pull_request) Successful in 48s
lint-test-helm / validate-kubeconform (pull_request) Has been skipped
render-manifests / render-manifests (pull_request) Successful in 2m5s
2026-04-24 09:02:57 +00:00
22 changed files with 59 additions and 37 deletions

View File

@@ -19,4 +19,4 @@ dependencies:
version: 4.6.2
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/excalidraw.png
# renovate: datasource=github-releases depName=excalidraw/excalidraw
appVersion: v0.18.0
appVersion: v0.18.1

View File

@@ -18,4 +18,4 @@ dependencies:
repository: https://charts.external-secrets.io
icon: https://raw.githubusercontent.com/external-secrets/external-secrets/refs/heads/main/assets/eso-logo-large.png
# renovate: datasource=github-releases depName=external-secrets/external-secrets
appVersion: v2.3.0
appVersion: v2.4.0

View File

@@ -2,7 +2,7 @@ external-secrets:
replicaCount: 3
image:
repository: ghcr.io/external-secrets/external-secrets
tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
tag: v2.4.0@sha256:d2b74514f63f5b55360d08351f1fe5af3b1db794a81fa10389abe2ff2999c566
installCRDs: true
crds:
createClusterExternalSecret: true
@@ -29,7 +29,7 @@ external-secrets:
webhook:
image:
repository: ghcr.io/external-secrets/external-secrets
tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
tag: v2.4.0@sha256:d2b74514f63f5b55360d08351f1fe5af3b1db794a81fa10389abe2ff2999c566
resources:
requests:
cpu: 1m
@@ -37,7 +37,7 @@ external-secrets:
certController:
image:
repository: ghcr.io/external-secrets/external-secrets
tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
tag: v2.4.0@sha256:d2b74514f63f5b55360d08351f1fe5af3b1db794a81fa10389abe2ff2999c566
resources:
requests:
cpu: 1m

View File

@@ -23,7 +23,7 @@ home-assistant:
code-server:
image:
repository: ghcr.io/linuxserver/code-server
tag: 4.116.0-ls333@sha256:4620adace18935dd6ca79d77e3bc1c379e21875392192f970cf5d6b0fb4aefcd
tag: 4.117.0-ls334@sha256:1f384394d473c43ab6a39b2227ba3aa9c95af648ce3a67e1b4da1969c16c7c0d
env:
- name: TZ
value: America/Chicago

View File

@@ -30,7 +30,7 @@ kube-prometheus-stack:
http_config:
basic_auth:
username: ntfy-alertmanager
password_file: /etc/alertmanager/secrets/alertmanager-config-secret/ntfy_password
password_file: /etc/alertmanager/secrets/alertmanager-config-config/ntfy_password
route:
main:
enabled: true

View File

@@ -14,7 +14,7 @@ app.kubernetes.io/part-of: {{ .Release.Name }}
{{- end }}
{{/*
NFS names
ServiceAccount names
*/}}
{{- define "custom.serviceAccountName" -}}
matrix-synapse

View File

@@ -37,7 +37,7 @@ matrix-synapse:
strategy:
type: Recreate
extraVolumes:
- name: config
- name: synapse-config
csi:
driver: secrets-store.csi.k8s.io
readOnly: true
@@ -74,7 +74,7 @@ matrix-synapse:
volumeAttributes:
secretProviderClass: matrix-synapse-double-puppet-config
extraVolumeMounts:
- name: config
- name: synapse-config
mountPath: /synapse/config/conf.d/config.yaml
mountPropagation: None
readOnly: true
@@ -165,6 +165,8 @@ matrix-synapse:
enabled: false
gateway:
enabled: false
serviceAccount:
name: matrix-synapse
matrix-hookshot:
global:
nameOverride: matrix-hookshot

View File

@@ -19,7 +19,7 @@ maintainers:
- name: alexlebens
dependencies:
- name: openbao
version: 0.27.1
version: 0.27.2
repository: https://openbao.github.io/openbao-helm
- name: app-template
alias: unseal

View File

@@ -96,12 +96,8 @@ outline:
secretKeyRef:
name: outline-oidc-authentik
key: secret
- name: OIDC_AUTH_URI
value: https://auth.alexlebens.dev/application/o/authorize/
- name: OIDC_TOKEN_URI
value: https://auth.alexlebens.dev/application/o/token/
- name: OIDC_USERINFO_URI
value: https://auth.alexlebens.dev/application/o/userinfo/
- name: OIDC_ISSUER_URL
value: https://auth.alexlebens.dev/application/o/outline
- name: OIDC_USERNAME_CLAIM
value: email
- name: OIDC_DISPLAY_NAME

View File

@@ -55,7 +55,7 @@ qbittorrent:
gluetun:
image:
repository: ghcr.io/qdm12/gluetun
tag: v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab
tag: latest@sha256:725d3e51091dde4ca43e3e3f26e2e6d3d0ccc66821e92d505c3da04958f7d472
lifecycle:
postStart:
exec:

View File

@@ -103,7 +103,7 @@ roundcube:
- name: ROUNDCUBEMAIL_DES_KEY
valueFrom:
secretKeyRef:
name: roundcube-key-secret
name: roundcube-key
key: DES_KEY
- name: ROUNDCUBEMAIL_DEFAULT_HOST
value: tls://stalwart.stalwart

View File

@@ -13,15 +13,15 @@ spec:
data:
- secretKey: AWS_ACCESS_KEY_ID
remoteRef:
key: /digital-ocean/home-infra/s3-exporter
key: /digital-ocean/home-infra/all-access
property: AWS_ACCESS_KEY_ID
- secretKey: AWS_SECRET_ACCESS_KEY
remoteRef:
key: /digital-ocean/home-infra/s3-exporter
key: /digital-ocean/home-infra/all-access
property: AWS_SECRET_ACCESS_KEY
- secretKey: AWS_REGION
remoteRef:
key: /digital-ocean/home-infra/s3-exporter
key: /digital-ocean/home-infra/all-access
property: AWS_REGION
---

View File

@@ -10,7 +10,7 @@ searxng:
main:
image:
repository: searxng/searxng
tag: latest@sha256:37c616a774b90fb5df9239eb143f1b11866ddf7b830cd1ebcca6ba11b38cc2bf
tag: latest@sha256:c9100c29c14a77d5289263a671580226c3b8a396a1a0130d2f500f57076a0119
env:
- name: SEARXNG_BASE_URL
value: http://searxng-api.searxng:8080
@@ -38,7 +38,7 @@ searxng:
main:
image:
repository: searxng/searxng
tag: latest@sha256:37c616a774b90fb5df9239eb143f1b11866ddf7b830cd1ebcca6ba11b38cc2bf
tag: latest@sha256:c9100c29c14a77d5289263a671580226c3b8a396a1a0130d2f500f57076a0119
env:
- name: SEARXNG_BASE_URL
value: https://searxng.alexlebens.net/

View File

@@ -12,3 +12,10 @@ Selector labels
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/part-of: {{ .Release.Name }}
{{- end }}
{{/*
ServiceAccount names
*/}}
{{- define "custom.serviceAccountName" -}}
talos-backup-secrets
{{- end -}}

View File

@@ -10,7 +10,7 @@ spec:
provider: openbao
parameters:
baoAddress: "http://openbao-internal.openbao:8200"
roleName: slskd
roleName: {{ include "custom.serviceAccountName" . }}
objects: |
- objectName: .s3cfg
fileName: .s3cfg
@@ -30,7 +30,7 @@ spec:
provider: openbao
parameters:
baoAddress: "http://openbao-internal.openbao:8200"
roleName: slskd
roleName: {{ include "custom.serviceAccountName" . }}
objects: |
- objectName: .s3cfg
fileName: .s3cfg
@@ -50,7 +50,7 @@ spec:
provider: openbao
parameters:
baoAddress: "http://openbao-internal.openbao:8200"
roleName: slskd
roleName: {{ include "custom.serviceAccountName" . }}
objects: |
- objectName: .s3cfg
fileName: .s3cfg
@@ -70,7 +70,7 @@ spec:
provider: openbao
parameters:
baoAddress: "http://openbao-internal.openbao:8200"
roleName: slskd
roleName: {{ include "custom.serviceAccountName" . }}
objects: |
- objectName: config
fileName: config

View File

@@ -1,10 +1,10 @@
apiVersion: talos.dev/v1alpha1
kind: ServiceAccount
metadata:
name: talos-backup-secrets
name: {{ include "custom.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: talos-backup-secrets
app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
{{- include "custom.labels" . | nindent 4 }}
spec:
roles:

View File

@@ -4,6 +4,6 @@ dependencies:
version: 39.0.8
- name: traefik-crds
repository: https://traefik.github.io/charts
version: 1.16.0
digest: sha256:e63ea5a588f53e421e33372390b0755609974029827762aa17ff5caec3ddd90c
generated: "2026-04-17T16:08:27.772737904Z"
version: 1.17.0
digest: sha256:93a74b11097a301c811ad03080fd1d6a1c1e695b6794b2c6cff7d61ae98ecc4f
generated: "2026-04-24T16:35:47.354173673Z"

View File

@@ -17,7 +17,7 @@ dependencies:
version: 39.0.8
repository: https://traefik.github.io/charts
- name: traefik-crds
version: 1.16.0
version: 1.17.0
repository: https://traefik.github.io/charts
icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/traefik.png
# renovate: datasource=github-releases depName=traefik/traefik

View File

@@ -12,3 +12,10 @@ Selector labels
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/part-of: {{ .Release.Name }}
{{- end }}
{{/*
ServiceAccount names
*/}}
{{- define "custom.serviceAccountName" -}}
vault
{{- end -}}

View File

@@ -10,7 +10,7 @@ spec:
provider: openbao
parameters:
baoAddress: "http://openbao-internal.openbao:8200"
roleName: slskd
roleName: vault
objects: |
- objectName: .s3cfg
fileName: .s3cfg
@@ -30,7 +30,7 @@ spec:
provider: openbao
parameters:
baoAddress: "http://openbao-internal.openbao:8200"
roleName: slskd
roleName: vault
objects: |
- objectName: .s3cfg
fileName: .s3cfg
@@ -50,7 +50,7 @@ spec:
provider: openbao
parameters:
baoAddress: "http://openbao-internal.openbao:8200"
roleName: slskd
roleName: vault
objects: |
- objectName: .s3cfg
fileName: .s3cfg

View File

@@ -0,0 +1,8 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "custom.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
{{- include "custom.labels" . | nindent 4 }}

View File

@@ -107,6 +107,8 @@ snapshot:
schedule: 0 4 * * *
backoffLimit: 3
parallelism: 1
serviceAccount:
name: vault
initContainers:
snapshot:
image: