chore(deps): update gitea/gitea docker tag to v1.26.0

Merge pull request 'chore(deps): update traefik to v3.6.14' (#6204 ) from renovate/unified-traefik into main
chore(deps): update traefik to v3.6.14
2026-04-24 17:53:33 +00:00 · 2026-04-24 17:47:13 +00:00 · 2026-04-24 17:46:46 +00:00 · 2026-04-24 17:43:28 +00:00 · 2026-04-24 17:43:28 +00:00 · 2026-04-24 17:43:15 +00:00
42 changed files with 110 additions and 64 deletions
--- a/clusters/cl01tl/helm/excalidraw/Chart.yaml
+++ b/clusters/cl01tl/helm/excalidraw/Chart.yaml
@@ -19,4 +19,4 @@ dependencies:
    version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/excalidraw.png
 # renovate: datasource=github-releases depName=excalidraw/excalidraw
-appVersion: v0.18.0
+appVersion: v0.18.1
--- a/clusters/cl01tl/helm/external-secrets/Chart.yaml
+++ b/clusters/cl01tl/helm/external-secrets/Chart.yaml
@@ -18,4 +18,4 @@ dependencies:
    repository: https://charts.external-secrets.io
 icon: https://raw.githubusercontent.com/external-secrets/external-secrets/refs/heads/main/assets/eso-logo-large.png
 # renovate: datasource=github-releases depName=external-secrets/external-secrets
-appVersion: v2.3.0
+appVersion: v2.4.0
--- a/clusters/cl01tl/helm/external-secrets/values.yaml
+++ b/clusters/cl01tl/helm/external-secrets/values.yaml
@@ -2,7 +2,7 @@ external-secrets:
  replicaCount: 3
  image:
    repository: ghcr.io/external-secrets/external-secrets
-    tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
+    tag: v2.4.0@sha256:d2b74514f63f5b55360d08351f1fe5af3b1db794a81fa10389abe2ff2999c566
  installCRDs: true
  crds:
    createClusterExternalSecret: true
@@ -29,7 +29,7 @@ external-secrets:
  webhook:
    image:
      repository: ghcr.io/external-secrets/external-secrets
-      tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
+      tag: v2.4.0@sha256:d2b74514f63f5b55360d08351f1fe5af3b1db794a81fa10389abe2ff2999c566
    resources:
      requests:
        cpu: 1m
@@ -37,7 +37,7 @@ external-secrets:
  certController:
    image:
      repository: ghcr.io/external-secrets/external-secrets
-      tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
+      tag: v2.4.0@sha256:d2b74514f63f5b55360d08351f1fe5af3b1db794a81fa10389abe2ff2999c566
    resources:
      requests:
        cpu: 1m
--- a/clusters/cl01tl/helm/gitea/values.yaml
+++ b/clusters/cl01tl/helm/gitea/values.yaml
@@ -9,7 +9,7 @@ gitea:
      maxUnavailable: 1
  image:
    repository: gitea/gitea
-    tag: 1.25.5
+    tag: 1.26.0
  service:
    http:
      type: ClusterIP
--- a/clusters/cl01tl/helm/grimmory/Chart.yaml
+++ b/clusters/cl01tl/helm/grimmory/Chart.yaml
@@ -28,4 +28,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grimmory.png
 # renovate: datasource=github-releases depName=grimmory-tools/grimmory
-appVersion: v2.3.0
+appVersion: v3.0.0
--- a/clusters/cl01tl/helm/grimmory/values.yaml
+++ b/clusters/cl01tl/helm/grimmory/values.yaml
@@ -12,7 +12,7 @@ grimmory:
        main:
          image:
            repository: ghcr.io/grimmory-tools/grimmory
-            tag: v2.3.0@sha256:9014247f591074529894f81115ca40f899db697e89f72c2fe91ec530e3f19597
+            tag: v3.0.0@sha256:0130c338d4c1186f2f6b6acdc4a7ee56388dfdab9cb0b9a23ac0fc91b79e7d75
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/home-assistant/values.yaml
+++ b/clusters/cl01tl/helm/home-assistant/values.yaml
@@ -23,7 +23,7 @@ home-assistant:
        code-server:
          image:
            repository: ghcr.io/linuxserver/code-server
-            tag: 4.116.0-ls333@sha256:4620adace18935dd6ca79d77e3bc1c379e21875392192f970cf5d6b0fb4aefcd
+            tag: 4.117.0-ls334@sha256:1f384394d473c43ab6a39b2227ba3aa9c95af648ce3a67e1b4da1969c16c7c0d
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock
@@ -1,7 +1,7 @@
 dependencies:
 - name: kube-prometheus-stack
  repository: oci://ghcr.io/prometheus-community/charts
-  version: 83.7.0
+  version: 84.0.1
 - name: prometheus-operator-crds
  repository: oci://ghcr.io/prometheus-community/charts
  version: 28.0.1
@@ -11,5 +11,5 @@ dependencies:
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.6.1
-digest: sha256:d4435b0e182ec588250d52bee0957b22d7b69abc5be8b60606d4811bfc0ed8d6
-generated: "2026-04-21T17:08:18.793790591Z"
+digest: sha256:2714de1082a27491925ba1b7adfba884a5ca9e674df22df96e8f6ccf56a54a6e
+generated: "2026-04-24T17:03:37.423427661Z"
--- a/clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml
@@ -20,7 +20,7 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: kube-prometheus-stack
-    version: 83.7.0
+    version: 84.0.1
    repository: oci://ghcr.io/prometheus-community/charts
  - name: prometheus-operator-crds
    version: 28.0.1
--- a/clusters/cl01tl/helm/kube-prometheus-stack/values.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/values.yaml
@@ -30,7 +30,7 @@ kube-prometheus-stack:
              http_config:
                basic_auth:
                  username: ntfy-alertmanager
-                  password_file: /etc/alertmanager/secrets/alertmanager-config-secret/ntfy_password
+                  password_file: /etc/alertmanager/secrets/alertmanager-ntfy-config/ntfy_password
    route:
      main:
        enabled: true
--- a/clusters/cl01tl/helm/loki/Chart.lock
+++ b/clusters/cl01tl/helm/loki/Chart.lock
@@ -1,9 +1,9 @@
 dependencies:
 - name: loki
  repository: https://grafana.github.io/helm-charts
-  version: 7.0.0
+  version: 6.55.0
 - name: alloy
  repository: https://grafana.github.io/helm-charts
-  version: 1.7.0
-digest: sha256:eede0374ce6642903c36da908b173d9485a51b3b0abfbe3ec2fd763d43debb3e
-generated: "2026-04-24T02:32:49.470695296Z"
+  version: 1.8.0
+digest: sha256:e3c7508c21ed7737f692387ca79a0c001c3393edbedff7b05c60325469a4fb2b
+generated: "2026-04-24T17:01:55.023153925Z"
--- a/clusters/cl01tl/helm/loki/Chart.yaml
+++ b/clusters/cl01tl/helm/loki/Chart.yaml
@@ -15,10 +15,10 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: loki
-    version: 7.0.0
+    version: 6.55.0
    repository: https://grafana.github.io/helm-charts
  - name: alloy
-    version: 1.7.0
+    version: 1.8.0
    repository: https://grafana.github.io/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/loki.png
 # renovate: datasource=github-releases depName=grafana/loki
--- a/clusters/cl01tl/helm/matrix-synapse/templates/_helpers.tpl
+++ b/clusters/cl01tl/helm/matrix-synapse/templates/_helpers.tpl
@@ -14,7 +14,7 @@ app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}

 {{/*
-NFS names
+ServiceAccount names
 */}}
 {{- define "custom.serviceAccountName" -}}
 matrix-synapse
--- a/clusters/cl01tl/helm/matrix-synapse/values.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/values.yaml
@@ -37,7 +37,7 @@ matrix-synapse:
    strategy:
      type: Recreate
    extraVolumes:
-      - name: config
+      - name: synapse-config
        csi:
          driver: secrets-store.csi.k8s.io
          readOnly: true
@@ -74,7 +74,7 @@ matrix-synapse:
          volumeAttributes:
            secretProviderClass: matrix-synapse-double-puppet-config
    extraVolumeMounts:
-      - name: config
+      - name: synapse-config
        mountPath: /synapse/config/conf.d/config.yaml
        mountPropagation: None
        readOnly: true
@@ -165,6 +165,8 @@ matrix-synapse:
    enabled: false
  gateway:
    enabled: false
+  serviceAccount:
+    name: matrix-synapse
 matrix-hookshot:
  global:
    nameOverride: matrix-hookshot
--- a/clusters/cl01tl/helm/ntfy/Chart.yaml
+++ b/clusters/cl01tl/helm/ntfy/Chart.yaml
@@ -23,4 +23,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ntfy.png
 # renovate: datasource=github-releases depName=binwiederhier/ntfy
-appVersion: 2.21.0
+appVersion: 2.22.0
--- a/clusters/cl01tl/helm/ntfy/values.yaml
+++ b/clusters/cl01tl/helm/ntfy/values.yaml
@@ -8,7 +8,7 @@ ntfy:
        main:
          image:
            repository: binwiederhier/ntfy
-            tag: v2.21.0@sha256:2b9e12d56a538f4402da51328eeca02696c4b207ab7fbe031c27e51a22ca9b86
+            tag: v2.22.0@sha256:d8b3408c75d5ae78e03339af6103e7e6195e56573eea6f1ad34bb4dc4f44f340
          args: ["serve"]
          env:
            - name: TZ
--- a/clusters/cl01tl/helm/ollama/Chart.yaml
+++ b/clusters/cl01tl/helm/ollama/Chart.yaml
@@ -31,4 +31,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ollama.png
 # renovate: datasource=github-releases depName=ollama/ollama
-appVersion: 0.21.0
+appVersion: 0.21.2
--- a/clusters/cl01tl/helm/ollama/values.yaml
+++ b/clusters/cl01tl/helm/ollama/values.yaml
@@ -21,7 +21,7 @@ ollama:
        main:
          image:
            repository: ollama/ollama
-            tag: 0.21.0@sha256:d3d553bdfbcc7f55dd5ddf42c4cbe3a927aa9bb1802710d35e94656ca5aea02b
+            tag: 0.21.2@sha256:2038a264392af4d21f7f14e1568e8dd9aa0f2bd0f31d7d9a59a8cca1e9829663
          env:
            - name: OLLAMA_KEEP_ALIVE
              value: 24h
@@ -55,7 +55,7 @@ ollama:
        main:
          image:
            repository: ollama/ollama
-            tag: 0.21.0@sha256:d3d553bdfbcc7f55dd5ddf42c4cbe3a927aa9bb1802710d35e94656ca5aea02b
+            tag: 0.21.2@sha256:2038a264392af4d21f7f14e1568e8dd9aa0f2bd0f31d7d9a59a8cca1e9829663
          env:
            - name: OLLAMA_KEEP_ALIVE
              value: 24h
@@ -89,7 +89,7 @@ ollama:
        main:
          image:
            repository: ollama/ollama
-            tag: 0.21.0@sha256:d3d553bdfbcc7f55dd5ddf42c4cbe3a927aa9bb1802710d35e94656ca5aea02b
+            tag: 0.21.2@sha256:2038a264392af4d21f7f14e1568e8dd9aa0f2bd0f31d7d9a59a8cca1e9829663
          env:
            - name: OLLAMA_KEEP_ALIVE
              value: 24h
--- a/clusters/cl01tl/helm/openbao/Chart.yaml
+++ b/clusters/cl01tl/helm/openbao/Chart.yaml
@@ -19,7 +19,7 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: openbao
-    version: 0.27.1
+    version: 0.27.2
    repository: https://openbao.github.io/openbao-helm
  - name: app-template
    alias: unseal
--- a/clusters/cl01tl/helm/openbao/values.yaml
+++ b/clusters/cl01tl/helm/openbao/values.yaml
@@ -100,6 +100,11 @@ openbao:
      requests:
        cpu: 50m
        memory: 100Mi
+    pod:
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
    agent:
      image:
        registry: quay.io
--- a/clusters/cl01tl/helm/outline/values.yaml
+++ b/clusters/cl01tl/helm/outline/values.yaml
@@ -96,12 +96,8 @@ outline:
                secretKeyRef:
                  name: outline-oidc-authentik
                  key: secret
-            - name: OIDC_AUTH_URI
-              value: https://auth.alexlebens.dev/application/o/authorize/
-            - name: OIDC_TOKEN_URI
-              value: https://auth.alexlebens.dev/application/o/token/
-            - name: OIDC_USERINFO_URI
-              value: https://auth.alexlebens.dev/application/o/userinfo/
+            - name: OIDC_ISSUER_URL
+              value: https://auth.alexlebens.dev/application/o/outline
            - name: OIDC_USERNAME_CLAIM
              value: email
            - name: OIDC_DISPLAY_NAME
--- a/clusters/cl01tl/helm/postiz/values.yaml
+++ b/clusters/cl01tl/helm/postiz/values.yaml
@@ -232,7 +232,7 @@ temporal:
  web:
    image:
      repository: temporalio/ui
-      tag: 2.48.4@sha256:b01df917af27067914b716a347eff78d232dfd47cc2c8527c621ce85e5bc15e3
+      tag: 2.49.1@sha256:a066bdf5c4de689cabaf80cc357871f1db5e6d750a6bcfc42e877b913e31ef24
    resources:
      requests:
        cpu: 10m
--- a/clusters/cl01tl/helm/prowlarr/Chart.yaml
+++ b/clusters/cl01tl/helm/prowlarr/Chart.yaml
@@ -28,4 +28,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prowlarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-prowlarr
-appVersion: 2.3.5.5327-ls142
+appVersion: 2.3.5.5327-ls143
--- a/clusters/cl01tl/helm/prowlarr/values.yaml
+++ b/clusters/cl01tl/helm/prowlarr/values.yaml
@@ -12,7 +12,7 @@ prowlarr:
        main:
          image:
            repository: ghcr.io/linuxserver/prowlarr
-            tag: 2.3.5.5327-ls142@sha256:6df73ab9e99d0dbaad27c39d8a47c600333eebea80fcb56253a0bb8b630c8115
+            tag: 2.3.5.5327-ls143@sha256:c5de2a8758a05594319263e7691c1dce56899442ed1720d6eca216c0958f4caf
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/qbittorrent/values.yaml
+++ b/clusters/cl01tl/helm/qbittorrent/values.yaml
@@ -55,7 +55,7 @@ qbittorrent:
        gluetun:
          image:
            repository: ghcr.io/qdm12/gluetun
-            tag: v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab
+            tag: latest@sha256:725d3e51091dde4ca43e3e3f26e2e6d3d0ccc66821e92d505c3da04958f7d472
          lifecycle:
            postStart:
              exec:
--- a/clusters/cl01tl/helm/roundcube/values.yaml
+++ b/clusters/cl01tl/helm/roundcube/values.yaml
@@ -103,7 +103,7 @@ roundcube:
            - name: ROUNDCUBEMAIL_DES_KEY
              valueFrom:
                secretKeyRef:
-                  name: roundcube-key-secret
+                  name: roundcube-key
                  key: DES_KEY
            - name: ROUNDCUBEMAIL_DEFAULT_HOST
              value: tls://stalwart.stalwart
--- a/clusters/cl01tl/helm/s3-exporter/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/s3-exporter/templates/external-secret.yaml
@@ -13,15 +13,15 @@ spec:
  data:
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
-        key: /digital-ocean/home-infra/s3-exporter
+        key: /digital-ocean/home-infra/all-access
        property: AWS_ACCESS_KEY_ID
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
-        key: /digital-ocean/home-infra/s3-exporter
+        key: /digital-ocean/home-infra/all-access
        property: AWS_SECRET_ACCESS_KEY
    - secretKey: AWS_REGION
      remoteRef:
-        key: /digital-ocean/home-infra/s3-exporter
+        key: /digital-ocean/home-infra/all-access
        property: AWS_REGION

 ---
--- a/clusters/cl01tl/helm/searxng/values.yaml
+++ b/clusters/cl01tl/helm/searxng/values.yaml
@@ -10,7 +10,7 @@ searxng:
        main:
          image:
            repository: searxng/searxng
-            tag: latest@sha256:37c616a774b90fb5df9239eb143f1b11866ddf7b830cd1ebcca6ba11b38cc2bf
+            tag: latest@sha256:c9100c29c14a77d5289263a671580226c3b8a396a1a0130d2f500f57076a0119
          env:
            - name: SEARXNG_BASE_URL
              value: http://searxng-api.searxng:8080
@@ -38,7 +38,7 @@ searxng:
        main:
          image:
            repository: searxng/searxng
-            tag: latest@sha256:37c616a774b90fb5df9239eb143f1b11866ddf7b830cd1ebcca6ba11b38cc2bf
+            tag: latest@sha256:c9100c29c14a77d5289263a671580226c3b8a396a1a0130d2f500f57076a0119
          env:
            - name: SEARXNG_BASE_URL
              value: https://searxng.alexlebens.net/
--- a/clusters/cl01tl/helm/talos/templates/_helpers.tpl
+++ b/clusters/cl01tl/helm/talos/templates/_helpers.tpl
@@ -12,3 +12,13 @@ Selector labels
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}
+
+{{/*
+ServiceAccount names
+*/}}
+{{- define "custom.serviceAccountName" -}}
+talos-backup
+{{- end -}}
+{{- define "custom.serviceAccountSecretsName" -}}
+talos-backup-secrets
+{{- end -}}
--- a/clusters/cl01tl/helm/talos/templates/secret-provider-class.yaml
+++ b/clusters/cl01tl/helm/talos/templates/secret-provider-class.yaml
@@ -10,7 +10,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: {{ include "custom.serviceAccountName" . }}
    objects: |
      - objectName: .s3cfg
        fileName: .s3cfg
@@ -30,7 +30,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: {{ include "custom.serviceAccountName" . }}
    objects: |
      - objectName: .s3cfg
        fileName: .s3cfg
@@ -50,7 +50,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: {{ include "custom.serviceAccountName" . }}
    objects: |
      - objectName: .s3cfg
        fileName: .s3cfg
@@ -70,7 +70,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: {{ include "custom.serviceAccountName" . }}
    objects: |
      - objectName: config
        fileName: config
--- a/clusters/cl01tl/helm/talos/templates/service-account.yaml
+++ b/clusters/cl01tl/helm/talos/templates/service-account.yaml
@@ -1,10 +1,20 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "custom.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
+
+---
 apiVersion: talos.dev/v1alpha1
 kind: ServiceAccount
 metadata:
-  name: talos-backup-secrets
+  name: {{ include "custom.serviceAccountSecretsName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: talos-backup-secrets
+    app.kubernetes.io/name: {{ include "custom.serviceAccountSecretsName" . }}
    {{- include "custom.labels" . | nindent 4 }}
 spec:
  roles:
--- a/clusters/cl01tl/helm/talos/values.yaml
+++ b/clusters/cl01tl/helm/talos/values.yaml
@@ -15,6 +15,8 @@ etcd-backup:
        schedule: 0 2 * * *
        backoffLimit: 3
        parallelism: 1
+      serviceAccount:
+        name: talos-backup
      containers:
        backup:
          image:
@@ -95,6 +97,8 @@ etcd-backup:
        schedule: 0 3 * * *
        backoffLimit: 3
        parallelism: 1
+      serviceAccount:
+        name: talos-backup
      containers:
        backup:
          image:
@@ -175,6 +179,8 @@ etcd-backup:
        schedule: 0 4 * * *
        backoffLimit: 3
        parallelism: 1
+      serviceAccount:
+        name: talos-backup
      containers:
        backup:
          image:
--- a/clusters/cl01tl/helm/traefik/Chart.lock
+++ b/clusters/cl01tl/helm/traefik/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 39.0.8
 - name: traefik-crds
  repository: https://traefik.github.io/charts
-  version: 1.16.0
-digest: sha256:e63ea5a588f53e421e33372390b0755609974029827762aa17ff5caec3ddd90c
-generated: "2026-04-17T16:08:27.772737904Z"
+  version: 1.17.0
+digest: sha256:93a74b11097a301c811ad03080fd1d6a1c1e695b6794b2c6cff7d61ae98ecc4f
+generated: "2026-04-24T16:35:47.354173673Z"
--- a/clusters/cl01tl/helm/traefik/Chart.yaml
+++ b/clusters/cl01tl/helm/traefik/Chart.yaml
@@ -17,8 +17,8 @@ dependencies:
    version: 39.0.8
    repository: https://traefik.github.io/charts
  - name: traefik-crds
-    version: 1.16.0
+    version: 1.17.0
    repository: https://traefik.github.io/charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/traefik.png
 # renovate: datasource=github-releases depName=traefik/traefik
-appVersion: v3.6.13
+appVersion: v3.6.14
--- a/clusters/cl01tl/helm/traefik/values.yaml
+++ b/clusters/cl01tl/helm/traefik/values.yaml
@@ -2,7 +2,7 @@ traefik:
  image:
    registry: docker.io
    repository: traefik
-    tag: v3.6.13@sha256:abb4f51887319c9b9d9cfe1d3cdf9379a771138003bf683f10e97697e148f95f
+    tag: v3.6.14@sha256:1c1be62608b6a484c585a917203b01a8226cff13df6a2a78705eeb66b52e667e
  deployment:
    kind: DaemonSet
  ingressClass:
--- a/clusters/cl01tl/helm/vault/templates/_helpers.tpl
+++ b/clusters/cl01tl/helm/vault/templates/_helpers.tpl
@@ -12,3 +12,10 @@ Selector labels
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}
+
+{{/*
+ServiceAccount names
+*/}}
+{{- define "custom.serviceAccountName" -}}
+vault
+{{- end -}}
--- a/clusters/cl01tl/helm/vault/templates/secret-provider-class.yaml
+++ b/clusters/cl01tl/helm/vault/templates/secret-provider-class.yaml
@@ -10,7 +10,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: vault
    objects: |
      - objectName: .s3cfg
        fileName: .s3cfg
@@ -30,7 +30,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: vault
    objects: |
      - objectName: .s3cfg
        fileName: .s3cfg
@@ -50,7 +50,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: vault
    objects: |
      - objectName: .s3cfg
        fileName: .s3cfg
--- a/clusters/cl01tl/helm/vault/templates/service-account.yaml
+++ b/clusters/cl01tl/helm/vault/templates/service-account.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "custom.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
--- a/clusters/cl01tl/helm/vault/values.yaml
+++ b/clusters/cl01tl/helm/vault/values.yaml
@@ -107,6 +107,8 @@ snapshot:
        schedule: 0 4 * * *
        backoffLimit: 3
        parallelism: 1
+      serviceAccount:
+        name: vault
      initContainers:
        snapshot:
          image:
--- a/hosts/ps08rp/traefik/compose.yaml
+++ b/hosts/ps08rp/traefik/compose.yaml
@@ -1,7 +1,7 @@
 ---
 services:
    traefik:
-        image: ghcr.io/traefik/traefik:v3.6.13@sha256:abb4f51887319c9b9d9cfe1d3cdf9379a771138003bf683f10e97697e148f95f
+        image: ghcr.io/traefik/traefik:v3.6.14@sha256:1c1be62608b6a484c585a917203b01a8226cff13df6a2a78705eeb66b52e667e
        container_name: traefik
        command:
            - "--global.checkNewVersion=false"
--- a/hosts/ps09rp/traefik/compose.yaml
+++ b/hosts/ps09rp/traefik/compose.yaml
@@ -1,7 +1,7 @@
 ---
 services:
    traefik:
-        image: ghcr.io/traefik/traefik:v3.6.13@sha256:abb4f51887319c9b9d9cfe1d3cdf9379a771138003bf683f10e97697e148f95f
+        image: ghcr.io/traefik/traefik:v3.6.14@sha256:1c1be62608b6a484c585a917203b01a8226cff13df6a2a78705eeb66b52e667e
        container_name: traefik
        command:
            - "--global.checkNewVersion=false"
--- a/hosts/ps10rp/traefik/compose.yaml
+++ b/hosts/ps10rp/traefik/compose.yaml
@@ -20,7 +20,7 @@ services:
            - /dev/net/tun:/dev/net/tun

    traefik:
-        image: ghcr.io/traefik/traefik:v3.6.13@sha256:abb4f51887319c9b9d9cfe1d3cdf9379a771138003bf683f10e97697e148f95f
+        image: ghcr.io/traefik/traefik:v3.6.14@sha256:1c1be62608b6a484c585a917203b01a8226cff13df6a2a78705eeb66b52e667e
        container_name: traefik
        command:
            - "--global.checkNewVersion=false"
Author	SHA1	Message	Date
Renovate Bot	f84b66fd7f	chore(deps): update gitea/gitea docker tag to v1.26.0	2026-04-24 17:53:33 +00:00
Renovate Bot	1276702808	Merge pull request 'chore(deps): update traefik to v3.6.14' (#6204 ) from renovate/unified-traefik into main Some checks failed lint-test-helm / validate-kubeconform (push) Has been skipped Details lint-test-helm / lint-helm (push) Successful in 30s Details lint-test-docker / lint-docker-compose (push) Successful in 1m33s Details renovate / renovate (push) Has been cancelled Details	2026-04-24 17:47:13 +00:00
Renovate Bot	c651166897	chore(deps): update traefik to v3.6.14 Some checks are pending renovate/stability-days Updates have not met minimum release age requirement Details lint-test-helm / lint-helm (pull_request) Successful in 31s Details lint-test-helm / validate-kubeconform (pull_request) Has been skipped Details render-manifests / render-manifests (pull_request) Successful in 58s Details lint-test-docker / lint-docker-compose (pull_request) Successful in 1m17s Details	2026-04-24 17:46:46 +00:00
Renovate Bot	fa4434e08c	Merge pull request 'chore(deps): update prowlarr to v2.3.5.5327-ls143' (#6200 ) from renovate/unified-prowlarr into main Some checks failed lint-test-helm / lint-helm (push) Successful in 49s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Has been cancelled Details	2026-04-24 17:43:28 +00:00
Renovate Bot	34ed4a111a	chore(deps): update prowlarr to v2.3.5.5327-ls143	2026-04-24 17:43:28 +00:00
Renovate Bot	6b61402955	Merge pull request 'chore(deps): update ollama to v0.21.2' (#6199 ) from renovate/unified-ollama into main Some checks failed lint-test-helm / validate-kubeconform (push) Has been cancelled Details renovate / renovate (push) Has been cancelled Details lint-test-helm / lint-helm (push) Has been cancelled Details	2026-04-24 17:43:15 +00:00
Renovate Bot	facf714fe0	chore(deps): update ollama to v0.21.2 Some checks are pending renovate/stability-days Updates have not met minimum release age requirement Details lint-test-helm / lint-helm (pull_request) Successful in 53s Details render-manifests / render-manifests (pull_request) Successful in 59s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 47s Details	2026-04-24 17:42:50 +00:00
Alex Lebens	7abcef1c0a	Merge pull request 'feat: add toleration' (#6197 ) from tmp/openbao-8 into main Some checks failed lint-test-helm / lint-helm (push) Successful in 22s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Has been cancelled Details Reviewed-on: #6197	2026-04-24 17:41:08 +00:00
Alex Lebens	b38ef40241	feat: add toleration All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 38s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 33s Details render-manifests / render-manifests (pull_request) Successful in 35s Details	2026-04-24 12:36:16 -05:00
Alex Lebens	c60678b182	Merge pull request 'chore(deps): update temporalio/ui docker tag to v2.49.1' (#6146 ) from renovate/unified-ui into main All checks were successful lint-test-helm / lint-helm (push) Successful in 25s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 3m7s Details Reviewed-on: #6146	2026-04-24 17:27:39 +00:00
Renovate Bot	8a6743eb10	chore(deps): update temporalio/ui docker tag to v2.49.1	2026-04-24 17:27:39 +00:00
Alex Lebens	d8082fcca9	Merge pull request 'chore(deps): update helm release alloy to v1.8.0' (#6153 ) from renovate/unified-alloy into main Some checks failed lint-test-helm / lint-helm (push) Successful in 51s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Has been cancelled Details Reviewed-on: #6153	2026-04-24 17:24:21 +00:00
Renovate Bot	1c1c7e268b	chore(deps): update helm release alloy to v1.8.0	2026-04-24 17:24:21 +00:00
Alex Lebens	c2b66ffe0f	Merge pull request 'feat: add service account' (#6195 ) from tmp/talos-1 into main Some checks failed lint-test-helm / lint-helm (push) Successful in 26s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Has been cancelled Details Reviewed-on: #6195	2026-04-24 17:22:54 +00:00
Alex Lebens	f1c6447612	feat: add service account	2026-04-24 17:22:54 +00:00
Alex Lebens	33247175c9	Merge pull request 'chore(deps): update kube-prometheus-stack docker tag to v84' (#6151 ) from renovate/major-unified-kube-prometheus-stack into main Some checks failed lint-test-helm / lint-helm (push) Successful in 39s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Has been cancelled Details Reviewed-on: #6151	2026-04-24 17:20:36 +00:00
Renovate Bot	d345b4247f	chore(deps): update kube-prometheus-stack docker tag to v84 All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 37s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 39s Details render-manifests / render-manifests (pull_request) Successful in 1m24s Details	2026-04-24 17:03:49 +00:00
Alex Lebens	2792f2d0c8	Merge pull request 'fix: wrong name' (#6194 ) from tmp/kube-prom into main All checks were successful lint-test-helm / lint-helm (push) Successful in 32s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 6m42s Details Reviewed-on: #6194	2026-04-24 16:57:15 +00:00
Alex Lebens	304ff69451	feat: add service account	2026-04-24 16:57:15 +00:00
Alex Lebens	5bbfa76a7b	fix: wrong name	2026-04-24 16:57:15 +00:00
Alex Lebens	bd15416b1f	Merge pull request 'chore(deps): update grimmory to v3 (major)' (#6150 ) from renovate/major-unified-grimmory into main Some checks failed lint-test-helm / lint-helm (push) Successful in 1m11s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Has been cancelled Details Reviewed-on: #6150	2026-04-24 16:54:09 +00:00
Renovate Bot	7fddcedda1	chore(deps): update grimmory to v3	2026-04-24 16:54:09 +00:00
Alex Lebens	b07fa39ab9	Merge pull request 'chore(deps): update dependency binwiederhier/ntfy to v2.22.0' (#6131 ) from renovate/unified-ntfy into main Some checks failed lint-test-helm / lint-helm (push) Successful in 39s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Has been cancelled Details Reviewed-on: #6131	2026-04-24 16:52:50 +00:00
Renovate Bot	0d2f95bd93	chore(deps): update dependency binwiederhier/ntfy to v2.22.0 All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 38s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 37s Details render-manifests / render-manifests (pull_request) Successful in 2m27s Details	2026-04-24 16:48:53 +00:00
Alex Lebens	97a2d867a0	Merge pull request 'chore(deps): update helm release traefik-crds to v1.17.0' (#6152 ) from renovate/unified-traefik into main All checks were successful lint-test-helm / lint-helm (push) Successful in 1m23s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 7m26s Details Reviewed-on: #6152	2026-04-24 16:44:16 +00:00
Renovate Bot	59fb844be3	chore(deps): update helm release traefik-crds to v1.17.0	2026-04-24 16:44:16 +00:00
Alex Lebens	81296df3ee	Merge pull request 'chore(deps): update ghcr.io/linuxserver/code-server docker tag to v4.117.0-ls334' (#6155 ) from renovate/unified-code-server into main Some checks failed lint-test-helm / lint-helm (push) Successful in 45s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Has been cancelled Details Reviewed-on: #6155	2026-04-24 16:42:09 +00:00
Renovate Bot	cb255378d1	chore(deps): update ghcr.io/linuxserver/code-server docker tag to v4.117.0-ls334	2026-04-24 16:42:09 +00:00
Alex Lebens	6c1c44b49e	Merge pull request 'chore(deps): update external-secrets to v2.4.0' (#6189 ) from renovate/unified-external-secrets into main Some checks failed lint-test-helm / lint-helm (push) Successful in 37s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Has been cancelled Details Reviewed-on: #6189	2026-04-24 16:40:12 +00:00
Renovate Bot	c4418a0b40	chore(deps): update external-secrets to v2.4.0 All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 1m43s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 57s Details render-manifests / render-manifests (pull_request) Successful in 2m3s Details	2026-04-24 16:34:41 +00:00
Alex Lebens	1861572ead	Merge pull request 'feat: use latest' (#6192 ) from tmp/qbit-2 into main All checks were successful lint-test-helm / lint-helm (push) Successful in 1m12s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 6m40s Details Reviewed-on: #6192	2026-04-24 16:31:33 +00:00
Alex Lebens	1c07e3daa8	feat: use latest All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 48s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 42s Details render-manifests / render-manifests (pull_request) Successful in 1m8s Details	2026-04-24 11:25:11 -05:00
Alex Lebens	b446ff06e1	Merge pull request 'feat: add service account' (#6190 ) from tmp/secrets-13 into main All checks were successful lint-test-helm / lint-helm (push) Successful in 1m34s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 14m33s Details Reviewed-on: #6190	2026-04-24 16:07:36 +00:00
Alex Lebens	92a5ff487d	fix: wrong name All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 1m18s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 1m7s Details render-manifests / render-manifests (pull_request) Successful in 2m43s Details	2026-04-24 11:03:57 -05:00
Alex Lebens	d4ab84ed8d	fix: wrong name All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 47s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 46s Details	2026-04-24 11:00:21 -05:00
Alex Lebens	2d1f33e96c	feat: add service account All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 1m56s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 53s Details	2026-04-24 10:58:57 -05:00
Alex Lebens	ee469329c7	Merge pull request 'feat: add service account' (#6187 ) from tmp/matrix-5 into main All checks were successful lint-test-helm / lint-helm (push) Successful in 51s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 6m28s Details Reviewed-on: #6187	2026-04-24 15:36:38 +00:00
Alex Lebens	221becb66c	feat: add service account All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 59s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 1m4s Details render-manifests / render-manifests (pull_request) Successful in 3m9s Details	2026-04-24 10:35:35 -05:00
Alex Lebens	1ae52e9303	Merge pull request 'feat: repalce with issuer' (#6185 ) from tmp/outline into main Some checks failed lint-test-helm / lint-helm (push) Successful in 39s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Has been cancelled Details Reviewed-on: #6185	2026-04-24 15:33:03 +00:00
Alex Lebens	d2bf03e00e	feat: repalce with issuer All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 43s Details lint-test-helm / validate-kubeconform (pull_request) Has been skipped Details render-manifests / render-manifests (pull_request) Successful in 1m13s Details	2026-04-24 10:31:43 -05:00
Alex Lebens	8fca397ee5	Merge pull request 'feat: change name' (#6183 ) from tmp/secrets-12 into main All checks were successful lint-test-helm / lint-helm (push) Successful in 57s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 7m24s Details Reviewed-on: #6183	2026-04-24 15:21:45 +00:00
Alex Lebens	11553c54b3	feat: change key All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 44s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 2m0s Details render-manifests / render-manifests (pull_request) Successful in 2m43s Details	2026-04-24 10:16:53 -05:00
Alex Lebens	af188618f6	feat: change name All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 1m23s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 1m15s Details	2026-04-24 10:14:03 -05:00
Renovate Bot	17632c9da7	Merge pull request 'chore(deps): update searxng/searxng:latest docker digest to c9100c2' (#6181 ) from renovate/unified-searxng into main All checks were successful lint-test-helm / lint-helm (push) Successful in 37s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 6m2s Details render-manifests / render-manifests (push) Successful in 14m12s Details	2026-04-24 14:03:33 +00:00
Renovate Bot	efe4d16f40	chore(deps): update searxng/searxng:latest docker digest to c9100c2 All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 23s Details lint-test-helm / validate-kubeconform (pull_request) Has been skipped Details render-manifests / render-manifests (pull_request) Successful in 1m13s Details	2026-04-24 14:03:20 +00:00
Renovate Bot	9f96688b1f	Merge pull request 'chore(deps): update searxng/searxng:latest docker digest to f0e5e56' (#6179 ) from renovate/unified-searxng into main All checks were successful lint-test-helm / lint-helm (push) Successful in 19s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 3m38s Details	2026-04-24 13:04:41 +00:00
Renovate Bot	ceeebfc5e1	chore(deps): update searxng/searxng:latest docker digest to f0e5e56 All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 20s Details lint-test-helm / validate-kubeconform (pull_request) Has been skipped Details render-manifests / render-manifests (pull_request) Successful in 1m6s Details	2026-04-24 13:04:29 +00:00
Renovate Bot	939b9c3f8c	Merge pull request 'chore(deps): update helm release openbao to v0.27.2' (#6177 ) from renovate/unified-openbao into main All checks were successful lint-test-helm / lint-helm (push) Successful in 30s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 5m12s Details	2026-04-24 09:03:36 +00:00
Renovate Bot	78043bdaab	chore(deps): update helm release openbao to v0.27.2	2026-04-24 09:03:36 +00:00
Renovate Bot	912cc8df6c	Merge pull request 'chore(deps): update dependency excalidraw/excalidraw to v0.18.1' (#6176 ) from renovate/unified-excalidraw into main Some checks failed lint-test-helm / lint-helm (push) Has been cancelled Details lint-test-helm / validate-kubeconform (push) Has been cancelled Details renovate / renovate (push) Has been cancelled Details	2026-04-24 09:03:11 +00:00
Renovate Bot	7a06594947	chore(deps): update dependency excalidraw/excalidraw to v0.18.1 All checks were successful renovate/stability-days Updates have met minimum release age requirement Details lint-test-helm / lint-helm (pull_request) Successful in 48s Details lint-test-helm / validate-kubeconform (pull_request) Has been skipped Details render-manifests / render-manifests (pull_request) Successful in 2m5s Details	2026-04-24 09:02:57 +00:00