Update ghcr.io/immich-app/immich-machine-learning Docker tag to v1.136.0

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [cloudflared](https://github.com/cloudflare/cloudflared) | minor | `1.18.0` -> `1.19.0` |

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xLjMiLCJ1cGRhdGVkSW5WZXIiOiI0MS4xLjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImltYWdlIl19-->

Reviewed-on: #1066
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

.gitea/workflows/lint-test-docker.yaml

@@ -0,0 +1,80 @@
+name: lint-test-docker
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'hosts/**'
+      - ! 'hosts/archive'
+
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'hosts/**'
+      - ! 'hosts/archive'
+
+jobs:
+  docker-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check Branch Exists
+        id: check-branch-exists
+        uses: GuillaumeFalourd/branch-exists@v1.1
+        with:
+          branch: "origin/${{ github.base_ref }}"
+
+      - name: Branch Does Not Exist
+        if: steps.check-branch-exists.outputs.exists == 'false'
+        run: echo "Branch origin/${{ github.base_ref }} was not found, likely already merged"
+
+
+      - name: Set up Node.js
+        if: steps.check-branch-exists.outputs.exists == 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Lint Docker Compose
+        if: steps.check-branch-exists.outputs.exists == 'true'
+        run: |
+          set -e  # Exit immediately if a command exits with a non-zero status.
+
+          TARGET_BRANCH="origin/${{ github.base_ref }}"
+          echo ">> Target branch for diff is: $TARGET_BRANCH"
+
+          CHANGED_FILES=$(git diff --name-only "$TARGET_BRANCH" -- 'hosts/**')
+
+          echo ">> Found changed files:"
+          echo "$CHANGED_FILES"
+
+          # For each changed file, find its parent chart directory (the one with compose.yaml).
+          # Then, create a unique list of those directories.
+          CHANGED_COMPOSE=$(echo "$CHANGED_FILES" | while read -r file; do
+            dir=$(dirname "$file")
+            while [[ "$dir" != "." && ! -f "$dir/compose.yaml" ]]; do
+              dir=$(dirname "$dir")
+            done
+            if [[ "$dir" != "." ]]; then
+              echo "$dir"
+            fi
+          done | sort -u)
+
+          if [[ -z "$CHANGED_COMPOSE" ]]; then
+            echo ">> Could not determine changed compose files. This will happen if only files outside a compose file were changed."
+            exit 0
+          fi
+
+          echo ">> Running dclint on changed compose files:"
+          echo "$CHANGED_COMPOSE"
+
+          echo "$CHANGED_COMPOSE" | while read -r compose; do
+            echo ">> Linting $compose ..."
+            npx dclint $compose
+          done

.gitea/workflows/lint-test-helm.yaml

@@ -0,0 +1,82 @@
+name: lint-test-helm
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'clusters/**'
+      - ! 'clusters/*/archive'
+
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'clusters/**'
+      - ! 'clusters/*/archive'
+
+jobs:
+  helm-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check Branch Exists
+        id: check-branch-exists
+        uses: GuillaumeFalourd/branch-exists@v1.1
+        with:
+          branch: "origin/${{ github.base_ref }}"
+
+      - name: Branch Does Not Exist
+        if: steps.check-branch-exists.outputs.exists == 'false'
+        run: echo "Branch origin/${{ github.base_ref }} was not found, likely already merged"
+
+      - name: Set up Helm
+        if: steps.check-branch-exists.outputs.exists == 'true'
+        uses: azure/setup-helm@v4
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+          version: latest
+
+      - name: Lint Helm Chart
+        if: steps.check-branch-exists.outputs.exists == 'true'
+        run: |
+          set -e  # Exit immediately if a command exits with a non-zero status.
+
+          TARGET_BRANCH="origin/${{ github.base_ref }}"
+          echo ">> Target branch for diff is: $TARGET_BRANCH"
+
+          CHANGED_FILES=$(git diff --name-only "$TARGET_BRANCH" -- 'clusters/**')
+
+          echo ">> Found changed files:"
+          echo "$CHANGED_FILES"
+
+          # For each changed file, find its parent chart directory (the one with Chart.yaml).
+          # Then, create a unique list of those directories.
+          CHANGED_CHARTS=$(echo "$CHANGED_FILES" | while read -r file; do
+            dir=$(dirname "$file")
+            while [[ "$dir" != "." && ! -f "$dir/Chart.yaml" ]]; do
+              dir=$(dirname "$dir")
+            done
+            if [[ "$dir" != "." ]]; then
+              echo "$dir"
+            fi
+          done | sort -u)
+
+          if [[ -z "$CHANGED_CHARTS" ]]; then
+            echo ">> Could not determine changed charts. This could happen if only files outside a chart were changed."
+            exit 0
+          fi
+
+          echo ">> Running helm lint on changed charts:"
+          echo "$CHANGED_CHARTS"
+
+          echo "$CHANGED_CHARTS" | while read -r chart; do
+            echo ">> Building dependency for "$chart" ..."
+            helm dependency build "$chart"
+            echo ">> Linting $chart..."
+            helm lint "$chart"
+          done

.gitea/workflows/lint-test.yaml

@@ -1,37 +0,0 @@
-name: lint-and-test-charts
-
-on: pull_request
-
-jobs:
-  lint-test:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Set up Helm
-        uses: azure/setup-helm@v4
-        with:
-          version: latest
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.13"
-          check-latest: true
-
-      - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.7.0
-
-      - name: Run chart-testing (list-changed)
-        id: list-changed
-        run: |
-          changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }})
-          if [[ -n "$changed" ]]; then
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Run chart-testing (lint)
-        if: steps.list-changed.outputs.changed == 'true'
-        run: ct lint --target-branch ${{ github.event.repository.default_branch }}

.gitea/workflows/process-repository.yaml

@@ -0,0 +1,40 @@
+name: process-repository
+
+on:
+  schedule:
+    - cron: "@daily"
+
+jobs:
+  process-repository:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Python Script
+        uses: actions/checkout@v4
+        with:
+          repository: alexlebens/workflow-scripts
+          ref: main
+          token: ${{ secrets.BOT_TOKEN }}
+          path: workflow-scripts
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install dependencies
+        run: pip install requests immutabledict
+
+      - name: Run Script
+        env:
+          INSTANCE_URL: ${{ vars.INSTANCE_URL }}
+          OWNER: ${{ gitea.owner }}
+          REPOSITORY: ${{ gitea.repository }}
+          TOKEN: ${{ secrets.BOT_TOKEN }}
+          LOG_LEVEL: DEBUG
+          ISSUE_STALE_DAYS: 3
+          ISSUE_STALE_TAG: 16
+          ISSUE_EXCLUDE_TAG: 20
+          PULL_REQUEST_STALE_DAYS: 3
+          PULL_REQUEST_STALE_TAG: 16
+          PULL_REQUEST_REQUIRED_TAG: 15
+        run: python ./workflow-scripts/process-repository.py

.gitea/workflows/renovate.yaml

@@ -0,0 +1,32 @@
+name: renovate
+
+on:
+  schedule:
+    - cron: "@hourly"
+
+  push:
+    branches:
+      - main
+
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    container: ghcr.io/renovatebot/renovate:41
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Renovate
+        run: renovate
+        env:
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: ${{ vars.INSTANCE_URL }}
+          RENOVATE_REPOSITORIES: alexlebens/infrastructure
+          RENOVATE_GIT_AUTHOR: Renovate Bot <renovate-bot@alexlebens.net>
+          LOG_LEVEL: info
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_GIT_PRIVATE_KEY: ${{ secrets.RENOVATE_GIT_PRIVATE_KEY }}
+          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}
+          RENOVATE_REDIS_URL: ${{ vars.RENOVATE_REDIS_URL }}

clusters/cl01tl/applications/actual/Chart.yaml

@@ -16,6 +16,6 @@ dependencies:
   - name: app-template
     alias: actual
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/actual-budget.png
 appVersion: v25.5.0

clusters/cl01tl/applications/actual/values.yaml

@@ -9,7 +9,7 @@ actual:
         main:
           image:
             repository: ghcr.io/actualbudget/actual
-            tag: 25.5.0
+            tag: 25.7.1
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/audiobookshelf/Chart.yaml

@@ -18,6 +18,6 @@ dependencies:
   - name: app-template
     alias: audiobookshelf
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/audiobookshelf.png
 appVersion: 2.21.0

clusters/cl01tl/applications/audiobookshelf/templates/external-secret.yaml

@@ -1,5 +1,28 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
+metadata:
+  name: audiobookshelf-apprise-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: audiobookshelf-apprise-config
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: ntfy-url
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/audiobookshelf/apprise
+        metadataPolicy: None
+        property: ntfy-url
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: audiobookshelf-config-backup-secret
   namespace: {{ .Release.Namespace }}

clusters/cl01tl/applications/audiobookshelf/templates/service-monitor.yaml

@@ -0,0 +1,19 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: audiobookshelf-apprise
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: audiobookshelf-apprise
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  endpoints:
+    - port: apprise
+      interval: 30s
+      scrapeTimeout: 15s
+      path: /metrics
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: audiobookshelf
+      app.kubernetes.io/instance: {{ .Release.Name }}

clusters/cl01tl/applications/audiobookshelf/values.yaml

@@ -9,7 +9,7 @@ audiobookshelf:
         main:
           image:
             repository: ghcr.io/advplyr/audiobookshelf
-            tag: 2.23.0
+            tag: 2.26.3
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -18,6 +18,29 @@ audiobookshelf:
             requests:
               cpu: 10m
               memory: 128Mi
+        apprise-api:
+          image:
+            repository: caronc/apprise
+            tag: 1.2.0
+            pullPolicy: IfNotPresent
+          env:
+            - name: TZ
+              value: US/Central
+            - name: APPRISE_STORAGE_MODE
+              value: memory
+            - name: APPRISE_STATEFUL_MODE
+              value: disabled
+            - name: APPRISE_WORKER_COUNT
+              value: 1
+            - name: APPRISE_STATELESS_URLS
+              valueFrom:
+                secretKeyRef:
+                  name: audiobookshelf-apprise-config
+                  key: ntfy-url
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
   service:
     main:
       controller: main
@@ -26,6 +49,10 @@ audiobookshelf:
           port: 80
           targetPort: 80
           protocol: HTTP
+        apprise:
+          port: 8000
+          targetPort: 8000
+          protocol: HTTP
   persistence:
     config:
       storageClass: ceph-block

clusters/cl01tl/applications/bazarr/Chart.yaml

@@ -18,6 +18,6 @@ dependencies:
   - name: app-template
     alias: bazarr
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/bazarr.png
 appVersion: 1.5.2

clusters/cl01tl/applications/bazarr/values.yaml

@@ -15,7 +15,7 @@ bazarr:
         main:
           image:
             repository: ghcr.io/linuxserver/bazarr
-            tag: 1.5.2@sha256:2458b13b6bdb9beee13acd2c70172140e9f9362488914d9f7cd95a473c3742b7
+            tag: 1.5.2@sha256:911483a9ec04de93e60e649a101eabab5d7c143bcb14fcddb32161d34016e11b
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/calibre-web-automated/Chart.yaml

@@ -16,6 +16,6 @@ dependencies:
   - name: app-template
     alias: calibre-web-automated
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/calibre-web.png
 appVersion: V3.0.4

clusters/cl01tl/applications/calibre-web-automated/values.yaml

@@ -31,7 +31,7 @@ calibre-web-automated:
         main:
           image:
             repository: ghcr.io/calibrain/calibre-web-automated-book-downloader
-            tag: latest@sha256:97a636efe3b78e1306ff521aa09256125aacdb1a04e628df294d7b6da3fe7b4a
+            tag: latest@sha256:7d01e56bfb0f0f150f89da59e4ec5627c4dc53d48d5ff5283e7e10877c737f8c
             pullPolicy: IfNotPresent
           env:
             - name: FLASK_PORT
@@ -55,7 +55,7 @@ calibre-web-automated:
         bypass:
           image:
             repository: ghcr.io/sarperavci/cloudflarebypassforscraping
-            tag: latest@sha256:d1028839c2d6317a48e6e2139acaea5129bb3b089f0c5583f61fc162f1975de0
+            tag: latest@sha256:bd326a3c6ae0b7ed3e405bbaa230e43e252f444c98f57d179f7a1d78f273748b
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/applications/code-server/Chart.yaml

@@ -19,10 +19,10 @@ dependencies:
   - name: app-template
     alias: code-server
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
   - name: cloudflared
     alias: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.15.0
+    version: 1.19.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/visual-studio-code.png
 appVersion: 4.100.2

clusters/cl01tl/applications/code-server/values.yaml

@@ -9,7 +9,7 @@ code-server:
         main:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.100.2@sha256:9848be1da7932e750b44fd30d87d828771ddfd5d9507a5dfd1e487dc79a76a2e
+            tag: 4.102.2@sha256:e93e459877c47affef393e81dd6bcd591af96363c0e96748aed4980b6d12de24
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/directus/Chart.yaml

@@ -8,14 +8,10 @@ keywords:
 home: https://wiki.alexlebens.dev/s/c2d242de-dcaa-4801-86a2-c4761dc8bf9b
 sources:
   - https://github.com/directus/directus
-  - https://github.com/minio/operator
-  - https://github.com/valkey-io/valkey
   - https://github.com/cloudflare/cloudflared
   - https://github.com/cloudnative-pg/cloudnative-pg
   - https://hub.docker.com/r/directus/directus
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/minio/operator/tree/master/helm/tenant
-  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
@@ -24,18 +20,11 @@ dependencies:
   - name: app-template
     alias: directus
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
-  - name: tenant
-    alias: minio
-    version: 7.1.1
-    repository: https://operator.min.io/
-  - name: valkey
-    version: 3.0.9
-    repository: oci://harbor.alexlebens.net/proxy-registry-1.docker.io/bitnamicharts
+    version: 4.2.0
   - name: cloudflared
     alias: cloudflared-directus
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.15.0
+    version: 1.19.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/directus/templates/external-secret.yaml

@@ -45,10 +45,33 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: directus-valkey-config
+  name: directus-metric-token
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: directus-valkey-config
+    app.kubernetes.io/name: directus-metric-token
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: metric-token
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/directus/metrics
+        metadataPolicy: None
+        property: metric-token
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: directus-redis-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: directus-redis-config
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -60,14 +83,14 @@ spec:
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /cl01tl/directus/valkey
+        key: /cl01tl/directus/redis
         metadataPolicy: None
         property: user
     - secretKey: password
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /cl01tl/directus/valkey
+        key: /cl01tl/directus/redis
         metadataPolicy: None
         property: password
 
@@ -101,82 +124,6 @@ spec:
         metadataPolicy: None
         property: secret
 
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: directus-minio-user-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: directus-minio-user-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/directus/minio/auth
-        metadataPolicy: None
-        property: AWS_ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/directus/minio/auth
-        metadataPolicy: None
-        property: AWS_SECRET_ACCESS_KEY
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: directus-minio-root-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: directus-minio-root-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.env
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/directus/minio/config
-        metadataPolicy: None
-        property: root-config.env
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: directus-minio-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: directus-minio-config-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.env
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/directus/minio/config
-        metadataPolicy: None
-        property: config.env
-
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret

clusters/cl01tl/applications/directus/templates/object-bucket-claim.yaml

@@ -0,0 +1,11 @@
+apiVersion: objectbucket.io/v1alpha1
+kind: ObjectBucketClaim
+metadata:
+  name: ceph-bucket-directus
+  labels:
+    app.kubernetes.io/name: ceph-bucket-directus
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  generateBucketName: bucket-directus
+  storageClassName: ceph-bucket

clusters/cl01tl/applications/directus/templates/redis-replication.yaml

@@ -0,0 +1,35 @@
+apiVersion: redis.redis.opstreelabs.in/v1beta2
+kind: RedisReplication
+metadata:
+  name: redis-replication-directus
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-directus
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  clusterSize: 3
+  podSecurityContext:
+    runAsUser: 1000
+    fsGroup: 1000
+  kubernetesConfig:
+    image: quay.io/opstree/redis:v8.0.3
+    imagePullPolicy: IfNotPresent
+    redisSecret:
+      name: directus-redis-config
+      key: password
+    resources:
+      requests:
+        cpu: 50m
+        memory: 128Mi
+  storage:
+    volumeClaimTemplate:
+      spec:
+        storageClassName: ceph-block
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi
+  redisExporter:
+    enabled: true
+    image: quay.io/opstree/redis-exporter:v1.48.0

clusters/cl01tl/applications/directus/templates/service-monitor.yaml

@@ -0,0 +1,43 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: directus
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: directus
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: directus
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  endpoints:
+    - port: http
+      interval: 30s
+      scrapeTimeout: 15s
+      path: /metrics
+      bearerTokenSecret:
+        name: directus-metric-token
+        key: metric-token
+
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: redis-replication-directus
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-directus
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    redis-operator: "true"
+    env: production
+spec:
+  selector:
+    matchLabels:
+      redis_setup_type: replication
+  endpoints:
+    - port: redis-exporter
+      interval: 30s
+      scrapeTimeout: 10s

clusters/cl01tl/applications/directus/values.yaml

@@ -9,7 +9,7 @@ directus:
         main:
           image:
             repository: directus/directus
-            tag: 11.7.2
+            tag: 11.9.3
             pullPolicy: IfNotPresent
           env:
             - name: PUBLIC_URL
@@ -66,18 +66,18 @@ directus:
             - name: REDIS_ENABLED
               value: true
             - name: REDIS_HOST
-              value: directus-valkey-primary
+              value: redis-replication-directus-master
             - name: REDIS_PORT
               value: 6379
             - name: REDIS_USERNAME
               valueFrom:
                 secretKeyRef:
-                  name: directus-valkey-config
+                  name: directus-redis-config
                   key: user
             - name: REDIS_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: directus-valkey-config
+                  name: directus-redis-config
                   key: password
             - name: STORAGE_LOCATIONS
               value: s3
@@ -86,21 +86,24 @@ directus:
             - name: STORAGE_S3_KEY
               valueFrom:
                 secretKeyRef:
-                  name: directus-minio-user-secret
+                  name: ceph-bucket-directus
                   key: AWS_ACCESS_KEY_ID
             - name: STORAGE_S3_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: directus-minio-user-secret
+                  name: ceph-bucket-directus
                   key: AWS_SECRET_ACCESS_KEY
             - name: STORAGE_S3_BUCKET
-              value: directus
+              valueFrom:
+                configMapKeyRef:
+                  name: ceph-bucket-directus
+                  key: BUCKET_NAME
             - name: STORAGE_S3_REGION
               value: us-east-1
             - name: STORAGE_S3_ENDPOINT
-              value: http://minio.directus:80
+              value: http://rook-ceph-rgw-ceph-objectstore.rook-ceph.svc:80
             - name: STORAGE_S3_FORCE_PATH_STYLE
-              value: "true"
+              value: true
             - name: AUTH_PROVIDERS
               value: AUTHENTIK
             - name: AUTH_AUTHENTIK_DRIVER
@@ -127,6 +130,13 @@ directus:
               value: Authentik
             - name: TELEMETRY
               value: false
+            - name: METRICS_ENABLED
+              value: true
+            - name: METRICS_TOKENS
+              valueFrom:
+                secretKeyRef:
+                  name: directus-metric-token
+                  key: metric-token
           resources:
             requests:
               cpu: 10m
@@ -139,54 +149,6 @@ directus:
           port: 80
           targetPort: 8055
           protocol: TCP
-minio:
-  existingSecret:
-    name: directus-minio-root-secret
-  tenant:
-    name: minio-directus
-    configSecret:
-      name: directus-minio-config-secret
-    pools:
-      - servers: 3
-        name: pool
-        volumesPerServer: 2
-        size: 10Gi
-        storageClassName: ceph-block
-    mountPath: /export
-    subPath: /data
-    metrics:
-      enabled: true
-      port: 9000
-      protocol: http
-    certificate:
-      requestAutoCert: false
-  ingress:
-    console:
-      enabled: false
-valkey:
-  architecture: replication
-  auth:
-    enabled: true
-    existingSecret: directus-valkey-config
-    existingSecretPasswordKey: password
-    usePasswordFiles: false
-  primary:
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
-  replica:
-    replicaCount: 1
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
 cloudflared-directus:
   name: cloudflared-directus
   existingSecretName: directus-cloudflared-secret
@@ -214,3 +176,4 @@ postgres-17-cluster:
     destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/directus/directus-postgresql-17-cluster
     endpointCredentials: directus-postgresql-17-cluster-backup-secret
     backupIndex: 2
+    retentionPolicy: "7d"

clusters/cl01tl/applications/eigenfocus/Chart.yaml

@@ -16,6 +16,6 @@ dependencies:
   - name: app-template
     alias: eigenfocus
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/eigenfocus.png
 appVersion: 1.1.0

clusters/cl01tl/applications/eigenfocus/values.yaml

@@ -9,7 +9,7 @@ eigenfocus:
         main:
           image:
             repository: eigenfocus/eigenfocus
-            tag: 1.1.0-free
+            tag: 1.2.0-free
             pullPolicy: IfNotPresent
           env:
             - name: DEFAULT_HOST_URL

clusters/cl01tl/applications/element-web/Chart.yaml

@@ -17,11 +17,11 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: element-web
-    version: 1.4.10
+    version: 1.4.16
     repository: https://ananace.gitlab.io/charts
   - name: cloudflared
     alias: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.15.0
+    version: 1.19.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/element.png
 appVersion: v1.11.100

clusters/cl01tl/applications/element-web/values.yaml

@@ -2,7 +2,7 @@ element-web:
   replicaCount: 1
   image:
     repository: vectorim/element-web
-    tag: v1.11.101
+    tag: v1.11.107
     pullPolicy: IfNotPresent
   defaultServer:
     url: https://matrix.alexlebens.dev
@@ -12,8 +12,8 @@ element-web:
     disable_3pid_login: true
     brand: "Alex Lebens"
     branding:
-      welcome_background_url: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/background-4.jpg
-      auth_header_logo_url: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+      welcome_background_url: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/background-5.png
+      auth_header_logo_url: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.png
     sso_redirect_options:
       immediate: true
     default_theme: dark

clusters/cl01tl/applications/freshrss/Chart.yaml

@@ -20,11 +20,11 @@ dependencies:
   - name: app-template
     alias: freshrss
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
   - name: cloudflared
     alias: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.15.0
+    version: 1.19.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/freshrss/values.yaml

@@ -11,7 +11,7 @@ freshrss:
             runAsUser: 0
           image:
             repository: alpine
-            tag: 3.21.3
+            tag: 3.22.1
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -35,7 +35,7 @@ freshrss:
             runAsUser: 0
           image:
             repository: alpine
-            tag: 3.21.3
+            tag: 3.22.1
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -49,7 +49,29 @@ freshrss:
               git checkout;
               rm -rf /var/www/FreshRSS/extensions/xExtension-ImageProxy
               cp -r xExtension-ImageProxy /var/www/FreshRSS/extensions
-              chown -R 568:568 /var/www/FreshRSS/extensions/xExtension-YouTubeChannel2RssFeed
+              chown -R 568:568 /var/www/FreshRSS/extensions/xExtension-ImageProxy
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+        init-download-extension-3:
+          securityContext:
+            runAsUser: 0
+          image:
+            repository: alpine
+            tag: 3.22.1
+            pullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - -ec
+            - |
+              cd /tmp;
+              wget https://github.com/zimmra/xExtension-karakeep-button/archive/refs/tags/v1.1.tar.gz;
+              tar -xvzf *.tar.gz;
+              rm -rf /var/www/FreshRSS/extensions/xExtension-karakeep-button
+              mkdir /var/www/FreshRSS/extensions/xExtension-karakeep-button
+              cp -r /tmp/xExtension-karakeep-button-*/* /var/www/FreshRSS/extensions/xExtension-karakeep-button
+              chown -R 568:568 /var/www/FreshRSS/extensions/xExtension-karakeep-button
           resources:
             requests:
               cpu: 10m
@@ -58,7 +80,7 @@ freshrss:
         main:
           image:
             repository: freshrss/freshrss
-            tag: 1.26.2
+            tag: 1.26.3
             pullPolicy: IfNotPresent
           env:
             - name: PGID
@@ -163,6 +185,9 @@ freshrss:
           init-download-extension-2:
             - path: /var/www/FreshRSS/extensions
               readOnly: false
+          init-download-extension-3:
+            - path: /var/www/FreshRSS/extensions
+              readOnly: false
           main:
             - path: /var/www/FreshRSS/extensions
               readOnly: false
@@ -192,3 +217,4 @@ postgres-17-cluster:
     destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/freshrss/freshrss-postgresql-17-cluster
     endpointCredentials: freshrss-postgresql-17-cluster-backup-secret
     backupIndex: 3
+    retentionPolicy: "7d"

clusters/cl01tl/applications/home-assistant/Chart.yaml

@@ -18,6 +18,6 @@ dependencies:
   - name: app-template
     alias: home-assistant
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/home-assistant.png
 appVersion: 2025.5.2

clusters/cl01tl/applications/home-assistant/values.yaml

@@ -9,7 +9,7 @@ home-assistant:
         main:
           image:
             repository: ghcr.io/home-assistant/home-assistant
-            tag: 2025.5.2
+            tag: 2025.7.4
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -21,7 +21,7 @@ home-assistant:
         code-server:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.100.2@sha256:9848be1da7932e750b44fd30d87d828771ddfd5d9507a5dfd1e487dc79a76a2e
+            tag: 4.102.2@sha256:e93e459877c47affef393e81dd6bcd591af96363c0e96748aed4980b6d12de24
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/homepage-dev/Chart.yaml

@@ -18,10 +18,10 @@ dependencies:
   - name: app-template
     alias: homepage
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
   - name: cloudflared
     alias: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.15.0
+    version: 1.19.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/homepage.png
 appVersion: v1.2.0

clusters/cl01tl/applications/homepage-dev/values.yaml

@@ -11,7 +11,7 @@ homepage:
         main:
           image:
             repository: ghcr.io/gethomepage/homepage
-            tag: v1.2.0
+            tag: v1.4.0
             pullPolicy: IfNotPresent
           env:
             - name: HOMEPAGE_ALLOWED_HOSTS
@@ -27,18 +27,18 @@ homepage:
         docker.yaml: ""
         kubernetes.yaml: ""
         settings.yaml: |
-          favicon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+          favicon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.svg
           headerStyle: clean
           hideVersion: true
           color: zinc
           background:
-            image: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/background-4.jpg
+            image: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/background-5.png
             brightness: 50
           theme: dark
           disableCollapse: true
         widgets.yaml: |
           - logo:
-              icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+              icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.png
           - datetime:
               text_size: xl
               format:
@@ -68,14 +68,20 @@ homepage:
                   href: https://gitea.alexlebens.dev
                   siteMonitor: https://gitea.alexlebens.dev
                   statusStyle: dot
+              - Code:
+                  icon: sh-visual-studio-code.webp
+                  description: VS Code
+                  href: https://codeserver.alexlebens.dev
+                  siteMonitor: https://codeserver.alexlebens.dev
+                  statusStyle: dot
               - Site:
-                  icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+                  icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.png
                   description: Profile Website
                   href: https://www.alexlebens.dev
                   siteMonitor: https://www.alexlebens.dev
                   statusStyle: dot
               - Content Management:
-                  icon: sh-directus.webp
+                  icon: directus.png
                   description: Directus
                   href: https://directus.alexlebens.dev
                   siteMonitor: https://directus.alexlebens.dev

clusters/cl01tl/applications/homepage/Chart.yaml

@@ -16,6 +16,6 @@ dependencies:
   - name: app-template
     alias: homepage
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/homepage.png
 appVersion: v1.2.0

clusters/cl01tl/applications/homepage/values.yaml

@@ -15,7 +15,7 @@ homepage:
         main:
           image:
             repository: ghcr.io/gethomepage/homepage
-            tag: v1.2.0
+            tag: v1.4.0
             pullPolicy: IfNotPresent
           env:
             - name: HOMEPAGE_ALLOWED_HOSTS
@@ -39,12 +39,12 @@ homepage:
         kubernetes.yaml: |
           mode: cluster
         settings.yaml: |
-          favicon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+          favicon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.svg
           headerStyle: clean
           hideVersion: true
           color: zinc
           background:
-            image: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/background-4.jpg
+            image: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/background-5.png
             brightness: 50
           theme: dark
           disableCollapse: true
@@ -61,6 +61,9 @@ homepage:
             - Code:
                 tab: Tools
                 icon: mdi-code-block-braces-#ffffff
+            - Automation:
+                tab: Tools
+                icon: mdi-wrench-#ffffff
             - Monitoring:
                 tab: Tools
                 icon: mdi-chart-line-#ffffff
@@ -96,7 +99,7 @@ homepage:
                 icon: mdi-cloud-#ffffff
         widgets.yaml: |
           - logo:
-              icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+              icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.png
           - kubernetes:
               cluster:
                 show: true
@@ -179,7 +182,7 @@ homepage:
                   statusStyle: dot
           - Public:
               - Site:
-                  icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+                  icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.png
                   description: Profile Website
                   href: https://www.alexlebens.dev
                   siteMonitor: https://www.alexlebens.dev
@@ -312,21 +315,43 @@ homepage:
                   href: https://argocd.alexlebens.net
                   siteMonitor: http://argocd-server.argocd:80
                   statusStyle: dot
-                  namespace: argocd
-              - Workflows:
-                  icon: sh-argo-cd.webp
-                  description: Argo Workflows
-                  href: https://argo-workflows.alexlebens.net
-                  siteMonitor: http://argo-workflows-server.argo-workflows:2746
-                  statusStyle: dot
-                  namespace: argocd
-              - Deployment:
+              - Docker Deployment:
                   icon: sh-komodo-light.webp
                   description: Komodo
                   href: https://komodo.alexlebens.net
                   siteMonitor: http://komodo.komodo:80
                   statusStyle: dot
-                  namespace: komodo
+          - Automation:
+              - Deployment Workflows:
+                  icon: sh-argo-cd.webp
+                  description: Argo Workflows
+                  href: https://argo-workflows.alexlebens.net
+                  siteMonitor: http://argo-workflows-server.argo-workflows:2746
+                  statusStyle: dot
+              - API Workflows:
+                  icon: sh-n8n.webp
+                  description: n8n
+                  href: https://n8n.alexlebens.net
+                  siteMonitor: http://n8n-main.n8n:80
+                  statusStyle: dot
+              - Jobs:
+                  icon: https://raw.githubusercontent.com/mshade/kronic/main/static/android-chrome-192x192.png
+                  description: Kronic
+                  href: https://kronic.alexlebens.net
+                  siteMonitor: http://kronic.kronic:80
+                  statusStyle: dot
+              - Uptime:
+                  icon: sh-gatus.webp
+                  description: Gatus
+                  href: https://gatus.alexlebens.net
+                  siteMonitor: http://gatus.gatus:80
+                  statusStyle: dot
+              - Tools:
+                  icon: sh-omnitools.webp
+                  description: OmniTools
+                  href: https://omni-tools.alexlebens.net
+                  siteMonitor: http://omni-tools.omni-tools:80
+                  statusStyle: dot
           - Monitoring:
               - Kubernetes:
                   icon: sh-headlamp.webp
@@ -398,7 +423,7 @@ homepage:
                   siteMonitor: http://authentik-server.authentik:80
                   statusStyle: dot
               - Email:
-                  icon: sh-stalwart-mail-server.webp
+                  icon: sh-stalwart.webp
                   description: Stalwart
                   href: https://stalwart.alexlebens.net
                   siteMonitor: http://stalwart.stalwart:80
@@ -460,6 +485,12 @@ homepage:
                   href: https://pikvm.alexlebens.net
                   siteMonitor: https://pikvm.alexlebens.net
                   statusStyle: dot
+              - Server Plug:
+                  icon: sh-shelly.webp
+                  description: Shelly
+                  href: http://it05sp.alexlebens.net
+                  siteMonitor: http://it05sp.alexlebens.net
+                  statusStyle: dot
           - Storage:
               - Cluster Storage:
                   icon: sh-ceph.webp
@@ -485,18 +516,6 @@ homepage:
                   href: https://vault.alexlebens.net
                   siteMonitor: http://vault.vault:8200
                   statusStyle: dot
-              - Object Storage (Outline):
-                  icon: sh-minio.webp
-                  description: Minio Tenant
-                  href: https://minio-outline.alexlebens.net
-                  siteMonitor: http://minio-outline-console.outline:9090
-                  statusStyle: dot
-              - Object Storage (Directus):
-                  icon: sh-minio.webp
-                  description: Minio Tenant
-                  href: https://minio-directus.alexlebens.net
-                  siteMonitor: http://minio-directus-console.directus:9090
-                  statusStyle: dot
           - TV Shows:
               - Sonarr:
                   icon: sh-sonarr.webp
@@ -669,9 +688,6 @@ homepage:
               - Github:
                   - abbr: GH
                     href: https://github.com/alexlebens
-              - Renovate:
-                  - abbr: RN
-                    href: https://developer.mend.io/[platform]/alexlebens/infrastructure
               - Digital Ocean:
                   - abbr: DO
                     href: https://www.digitalocean.com/

clusters/cl01tl/applications/huntarr/Chart.yaml

@@ -16,6 +16,6 @@ dependencies:
   - name: app-template
     alias: huntarr
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/huntarr.png
 appVersion: 7.0.0

clusters/cl01tl/applications/huntarr/values.yaml

@@ -9,7 +9,7 @@ huntarr:
         main:
           image:
             repository: ghcr.io/plexguide/huntarr
-            tag: 7.1.1
+            tag: 8.1.15
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/immich/Chart.yaml

@@ -8,10 +8,8 @@ keywords:
 home: https://wiki.alexlebens.dev/s/9377ae08-2041-4b6d-bc2b-61a4f5e8faae
 sources:
   - https://github.com/immich-app/immich
-  - https://github.com/valkey-io/valkey
   - https://github.com/cloudnative-pg/cloudnative-pg
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
   - name: alexlebens
@@ -19,10 +17,7 @@ dependencies:
   - name: app-template
     alias: immich
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
-  - name: valkey
-    version: 3.0.9
-    repository: oci://harbor.alexlebens.net/proxy-registry-1.docker.io/bitnamicharts
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-16-cluster
     version: 5.1.0

clusters/cl01tl/applications/immich/templates/redis-replication.yaml

@@ -0,0 +1,32 @@
+apiVersion: redis.redis.opstreelabs.in/v1beta2
+kind: RedisReplication
+metadata:
+  name: redis-replication-immich
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-immich
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  clusterSize: 3
+  podSecurityContext:
+    runAsUser: 1000
+    fsGroup: 1000
+  kubernetesConfig:
+    image: quay.io/opstree/redis:v8.0.3
+    imagePullPolicy: IfNotPresent
+    resources:
+      requests:
+        cpu: 50m
+        memory: 128Mi
+  storage:
+    volumeClaimTemplate:
+      spec:
+        storageClassName: ceph-block
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi
+  redisExporter:
+    enabled: true
+    image: quay.io/opstree/redis-exporter:v1.48.0

clusters/cl01tl/applications/immich/templates/service-monitor.yaml

@@ -21,3 +21,24 @@ spec:
       interval: 3m
       scrapeTimeout: 1m
       path: /metrics
+
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: redis-replication-immich
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-immich
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    redis-operator: "true"
+    env: production
+spec:
+  selector:
+    matchLabels:
+      redis_setup_type: replication
+  endpoints:
+    - port: redis-exporter
+      interval: 30s
+      scrapeTimeout: 10s

clusters/cl01tl/applications/immich/values.yaml

@@ -21,7 +21,7 @@ immich:
             - name: IMMICH_MACHINE_LEARNING_URL
               value: http://immich-machine-learning.immich:3003
             - name: REDIS_HOSTNAME
-              value: immich-valkey-primary
+              value: redis-replication-immich-master
             - name: DB_VECTOR_EXTENSION
               value: pgvecto.rs
             - name: DB_HOSTNAME
@@ -99,7 +99,7 @@ immich:
         main:
           image:
             repository: ghcr.io/immich-app/immich-machine-learning
-            tag: v1.132.1
+            tag: v1.136.0
             pullPolicy: IfNotPresent
           env:
             - name: TRANSFORMERS_CACHE
@@ -188,28 +188,6 @@ immich:
           main:
             - path: /usr/src/app/upload
               readOnly: false
-valkey:
-  architecture: replication
-  auth:
-    enabled: false
-    usePasswordFiles: false
-  primary:
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
-  replica:
-    replicaCount: 1
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
 postgres-16-cluster:
   # Tensorchord
   #--- https://github.com/immich-app/immich/discussions/9060
@@ -250,3 +228,4 @@ postgres-16-cluster:
     destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/immich/immich-postgresql-16-cluster
     endpointCredentials: immich-postgresql-16-cluster-backup-secret
     backupIndex: 2
+    retentionPolicy: "7d"

clusters/cl01tl/applications/jellyfin/Chart.yaml

@@ -20,6 +20,6 @@ dependencies:
   - name: app-template
     alias: jellyfin
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/jellyfin.png
 appVersion: 10.10.7

clusters/cl01tl/applications/jellystat/Chart.yaml

@@ -18,7 +18,7 @@ dependencies:
   - name: app-template
     alias: jellystat
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/jellystat/values.yaml

@@ -102,4 +102,4 @@ postgres-17-cluster:
     destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/jellystat/jellystat-postgresql-17-cluster
     endpointCredentials: jellystat-postgresql-17-cluster-backup-secret
     backupIndex: 2
-    retentionPolicy: "7d"
+    retentionPolicy: "3d"

clusters/cl01tl/applications/karakeep/Chart.yaml

@@ -1,9 +1,8 @@
 apiVersion: v2
-name: hoarder
+name: karakeep
 version: 1.0.0
 description: Karakeep
 keywords:
-  - hoarder
   - karakeep
   - bookmarks
 home: https://wiki.alexlebens.dev/s/f8177591-8253-4e21-82d5-a556f0aeafad
@@ -19,15 +18,15 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: app-template
-    alias: hoarder
+    alias: karakeep
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
   - name: meilisearch
-    version: 0.13.0
+    version: 0.14.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     alias: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.15.0
+    version: 1.19.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/webp/karakeep.webp
-appVersion: 0.24.1
+appVersion: 0.26.0

clusters/cl01tl/applications/karakeep/templates/external-secret.yaml

@@ -19,6 +19,13 @@ spec:
         key: /cl01tl/karakeep/key
         metadataPolicy: None
         property: key
+    - secretKey: prometheus-token
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/karakeep/key
+        metadataPolicy: None
+        property: prometheus-token
 
 ---
 apiVersion: external-secrets.io/v1
@@ -100,10 +107,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: hoarder-data-backup-secret
+  name: karakeep-data-backup-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: hoarder-data-backup-secret
+    app.kubernetes.io/name: karakeep-data-backup-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -115,7 +122,7 @@ spec:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/hoarder/hoarder-data"
+        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/karakeep/karakeep-data"
   data:
     - secretKey: BUCKET_ENDPOINT
       remoteRef:

clusters/cl01tl/applications/karakeep/templates/object-bucket-claim.yaml

@@ -0,0 +1,11 @@
+apiVersion: objectbucket.io/v1alpha1
+kind: ObjectBucketClaim
+metadata:
+  name: ceph-bucket-karakeep
+  labels:
+    app.kubernetes.io/name: ceph-bucket-karakeep
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  generateBucketName: bucket-karakeep
+  storageClassName: ceph-bucket

clusters/cl01tl/applications/karakeep/templates/replication-source.yaml

@@ -1,19 +1,19 @@
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
-  name: hoarder-data-backup-source
+  name: karakeep-data-backup-source
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: hoarder-data-backup-source
+    app.kubernetes.io/name: karakeep-data-backup-source
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
-  sourcePVC: hoarder-data
+  sourcePVC: karakeep-data
   trigger:
     schedule: 0 4 * * *
   restic:
     pruneIntervalDays: 7
-    repository: hoarder-data-backup-secret
+    repository: karakeep-data-backup-secret
     retain:
       hourly: 1
       daily: 3

clusters/cl01tl/applications/karakeep/templates/service-monitor.yaml

@@ -0,0 +1,23 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: karakeep
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: karakeep
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  endpoints:
+    - port: http
+      interval: 30s
+      scrapeTimeout: 15s
+      path: /api/metrics
+      authorization:
+        credentials:
+          key: prometheus-token
+          name: karakeep-key-secret
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: karakeep
+      app.kubernetes.io/instance: {{ .Release.Name }}

clusters/cl01tl/applications/karakeep/values.yaml

@@ -1,4 +1,4 @@
-hoarder:
+karakeep:
   controllers:
     main:
       type: deployment
@@ -9,11 +9,13 @@ hoarder:
         main:
           image:
             repository: ghcr.io/karakeep-app/karakeep
-            tag: 0.24.1
+            tag: 0.26.0
             pullPolicy: IfNotPresent
           env:
             - name: DATA_DIR
               value: /data
+            - name: DB_WAL_MODE
+              value: true
             - name: NEXTAUTH_URL
               value: https://karakeep.alexlebens.dev/
             - name: NEXTAUTH_SECRET
@@ -21,15 +23,41 @@ hoarder:
                 secretKeyRef:
                   name: karakeep-key-secret
                   key: key
+            - name: PROMETHEUS_AUTH_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: karakeep-key-secret
+                  key: prometheus-token
+            - name: ASSET_STORE_S3_ENDPOINT
+              value: http://rook-ceph-rgw-ceph-objectstore.rook-ceph.svc:80
+            - name: ASSET_STORE_S3_REGION
+              value: us-east-1
+            - name: ASSET_STORE_S3_BUCKET
+              valueFrom:
+                configMapKeyRef:
+                  name: ceph-bucket-karakeep
+                  key: BUCKET_NAME
+            - name: ASSET_STORE_S3_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: ceph-bucket-karakeep
+                  key: AWS_ACCESS_KEY_ID
+            - name: ASSET_STORE_S3_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: ceph-bucket-karakeep
+                  key: AWS_SECRET_ACCESS_KEY
+            - name: ASSET_STORE_S3_FORCE_PATH_STYLE
+              value: true
             - name: MEILI_ADDR
-              value: http://hoarder-meilisearch.hoarder:7700
+              value: http://karakeep-meilisearch.karakeep:7700
             - name: MEILI_MASTER_KEY
               valueFrom:
                 secretKeyRef:
                   name: karakeep-meilisearch-master-key-secret
                   key: MEILI_MASTER_KEY
             - name: BROWSER_WEB_URL
-              value: http://hoarder.hoarder:9222
+              value: http://karakeep.karakeep:9222
             - name: DISABLE_SIGNUPS
               value: false
             - name: OAUTH_PROVIDER_NAME
@@ -49,13 +77,13 @@ hoarder:
                   name: karakeep-oidc-secret
                   key: AUTHENTIK_CLIENT_SECRET
             - name: OLLAMA_BASE_URL
-              value: http://ollama-server-1.ollama:11434
+              value: http://ollama-server-3.ollama:11434
             - name: OLLAMA_KEEP_ALIVE
               value: 5m
             - name: INFERENCE_TEXT_MODEL
-              value: llama3.1:8b
+              value: gemma3:4b
             - name: INFERENCE_IMAGE_MODEL
-              value: llama3.2-vision:11b
+              value: granite3.2-vision:2b
             - name: EMBEDDING_TEXT_MODEL
               value: mxbai-embed-large
             - name: INFERENCE_JOB_TIMEOUT_SEC
@@ -94,7 +122,6 @@ hoarder:
           protocol: HTTP
   persistence:
     data:
-      forceRename: hoarder-data
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 10Gi

clusters/cl01tl/applications/kiwix/Chart.yaml

@@ -16,6 +16,6 @@ dependencies:
   - name: app-template
     alias: kiwix
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kiwix-dark.png
 appVersion: 3.7.0

clusters/cl01tl/applications/libation/Chart.yaml

@@ -17,6 +17,6 @@ dependencies:
   - name: app-template
     alias: libation
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/libation.png
 appVersion: 12.4.3

clusters/cl01tl/applications/libation/values.yaml

@@ -6,7 +6,7 @@ libation:
         suspend: false
         concurrencyPolicy: Forbid
         timeZone: US/Central
-        schedule: "0 * * * *"
+        schedule: "30 4 * * *"
         startingDeadlineSeconds: 90
         successfulJobsHistory: 3
         failedJobsHistory: 3
@@ -16,7 +16,7 @@ libation:
         main:
           image:
             repository: rmcrackan/libation
-            tag: 12.4.3
+            tag: 12.4.11
             pullPolicy: IfNotPresent
           env:
             - name: SLEEP_TIME

clusters/cl01tl/applications/lidarr/Chart.yaml

@@ -21,7 +21,7 @@ dependencies:
   - name: app-template
     alias: lidarr
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/lidarr/values.yaml

@@ -15,7 +15,7 @@ lidarr:
         main:
           image:
             repository: ghcr.io/linuxserver/lidarr
-            tag: 2.11.2@sha256:e01a6968d2c58f04278a67da9690e62b0cba07f5dbacb03b0cfbf195940f94a7
+            tag: 2.12.4@sha256:2231bc5581589de7c5373b19f7f16e1a5bfa48c5a365ca9b928e232b4c985dce
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -117,4 +117,4 @@ postgres-17-cluster:
     destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/lidarr2/lidarr2-postgresql-17-cluster
     endpointCredentials: lidarr-postgresql-17-cluster-backup-secret
     backupIndex: 3
-    retentionPolicy: "7d"
+    retentionPolicy: "3d"

clusters/cl01tl/applications/lidatube/Chart.yaml

@@ -17,6 +17,6 @@ dependencies:
   - name: app-template
     alias: lidatube
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/lidatube.png
 appVersion: 0.2.22

clusters/cl01tl/applications/lidatube/values.yaml

@@ -13,7 +13,7 @@ lidatube:
         main:
           image:
             repository: thewicklowwolf/lidatube
-            tag: 0.2.22
+            tag: 0.2.30
             pullPolicy: IfNotPresent
           env:
             - name: PUID

clusters/cl01tl/applications/omni-tools/Chart.yaml

@@ -0,0 +1,20 @@
+apiVersion: v2
+name: omni-tools
+version: 1.0.0
+description: OmniTools
+keywords:
+  - omni-tools
+home: https://wiki.alexlebens.dev/s/8820cd36-dcf6-4ddf-8b2f-584271628a54
+sources:
+  - https://github.com/iib0011/omni-tools
+  - https://hub.docker.com/r/iib0011/omni-tools
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: omni-tools
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.2.0
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/omnitools.png
+appVersion: 0.4.0

clusters/cl01tl/applications/omni-tools/templates/http-route.yaml

@@ -1,10 +1,10 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: http-route-outline-minio
+  name: http-route-omni-tools
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: http-route-outline-minio
+    app.kubernetes.io/name: http-route-omni-tools
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -14,7 +14,7 @@ spec:
       name: traefik-gateway
       namespace: traefik
   hostnames:
-    - minio-outline.alexlebens.net
+    - omni-tools.alexlebens.net
   rules:
     - matches:
       - path:
@@ -23,6 +23,6 @@ spec:
       backendRefs:
         - group: ''
           kind: Service
-          name: minio-outline-console
-          port: 9090
+          name: omni-tools
+          port: 80
           weight: 100

clusters/cl01tl/applications/omni-tools/values.yaml

@@ -0,0 +1,25 @@
+omni-tools:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: iib0011/omni-tools
+            tag: 0.5.0
+            pullPolicy: IfNotPresent
+          resources:
+            requests:
+              cpu: 50m
+              memory: 512Mi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 80
+          protocol: HTTP

clusters/cl01tl/applications/outline/Chart.yaml

@@ -9,14 +9,10 @@ keywords:
 home: https://wiki.alexlebens.dev/s/c530c2b9-82b7-44df-b7ef-870c8b29242f
 sources:
   - https://github.com/outline/outline
-  - https://github.com/minio/operator
-  - https://github.com/valkey-io/valkey
   - https://github.com/cloudflare/cloudflared
   - https://github.com/cloudnative-pg/cloudnative-pg
   - https://hub.docker.com/r/outlinewiki/outline
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/minio/operator/tree/master/helm/tenant
-  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
@@ -25,22 +21,11 @@ dependencies:
   - name: app-template
     alias: outline
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
-  - name: tenant
-    alias: minio
-    version: 7.1.1
-    repository: https://operator.min.io/
-  - name: valkey
-    version: 3.0.9
-    repository: oci://harbor.alexlebens.net/proxy-registry-1.docker.io/bitnamicharts
+    version: 4.2.0
   - name: cloudflared
     alias: cloudflared-outline
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.15.0
-  - name: cloudflared
-    alias: cloudflared-minio
-    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.15.0
+    version: 1.19.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/outline/templates/external-secret.yaml

@@ -57,82 +57,6 @@ spec:
         metadataPolicy: None
         property: secret
 
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: outline-minio-user-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: outline-minio-user-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/outline/minio/auth
-        metadataPolicy: None
-        property: AWS_ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/outline/minio/auth
-        metadataPolicy: None
-        property: AWS_SECRET_ACCESS_KEY
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: outline-minio-root-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: outline-minio-root-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.env
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/outline/minio/config
-        metadataPolicy: None
-        property: root-config.env
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: outline-minio-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: outline-minio-config-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.env
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/outline/minio/config
-        metadataPolicy: None
-        property: config.env
-
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
@@ -156,29 +80,6 @@ spec:
         metadataPolicy: None
         property: token
 
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: outline-minio-cloudflared-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: outline-minio-cloudflared-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: cf-tunnel-token
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cloudflare/tunnels/outline-minio
-        metadataPolicy: None
-        property: token
-
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret

clusters/cl01tl/applications/outline/templates/object-bucket-claim.yaml

@@ -0,0 +1,30 @@
+apiVersion: objectbucket.io/v1alpha1
+kind: ObjectBucketClaim
+metadata:
+  name: ceph-bucket-outline
+  labels:
+    app.kubernetes.io/name: ceph-bucket-outline
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  generateBucketName: bucket-outline
+  storageClassName: ceph-bucket
+  additionalConfig:
+    bucketPolicy: |
+        {
+            "Version": "2012-10-17",
+            "Statement": [
+                {
+                    "Sid": "VisualEditor",
+                    "Effect": "Allow",
+                    "Action": [
+                        "s3:GetObjectAcl",
+                        "s3:DeleteObject",
+                        "s3:PutObject",
+                        "s3:GetObject",
+                        "s3:PutObjectAcl"
+                    ],
+                    "Resource": "arn:aws:s3:::bucket-outline-630c57e0-d475-4d78-926c-c1c082291d73/*"
+                }
+            ]
+        }

clusters/cl01tl/applications/outline/templates/redis-replication.yaml

@@ -0,0 +1,32 @@
+apiVersion: redis.redis.opstreelabs.in/v1beta2
+kind: RedisReplication
+metadata:
+  name: redis-replication-outline
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-outline
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  clusterSize: 3
+  podSecurityContext:
+    runAsUser: 1000
+    fsGroup: 1000
+  kubernetesConfig:
+    image: quay.io/opstree/redis:v8.0.3
+    imagePullPolicy: IfNotPresent
+    resources:
+      requests:
+        cpu: 50m
+        memory: 128Mi
+  storage:
+    volumeClaimTemplate:
+      spec:
+        storageClassName: ceph-block
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi
+  redisExporter:
+    enabled: true
+    image: quay.io/opstree/redis-exporter:v1.48.0

clusters/cl01tl/applications/outline/templates/service-monitor.yaml

@@ -0,0 +1,19 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: redis-replication-outline
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-outline
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    redis-operator: "true"
+    env: production
+spec:
+  selector:
+    matchLabels:
+      redis_setup_type: replication
+  endpoints:
+    - port: redis-exporter
+      interval: 30s
+      scrapeTimeout: 10s

clusters/cl01tl/applications/outline/values.yaml

@@ -9,7 +9,7 @@ outline:
         main:
           image:
             repository: outlinewiki/outline
-            tag: 0.84.0
+            tag: 0.85.1
             pullPolicy: IfNotPresent
           env:
             - name: NODE_ENV
@@ -64,29 +64,30 @@ outline:
             - name: PGSSLMODE
               value: disable
             - name: REDIS_URL
-              value: redis://outline-valkey-primary.outline:6379
+              value: redis://redis-replication-outline-master.outline:6379
             - name: FILE_STORAGE
               value: s3
             - name: AWS_ACCESS_KEY_ID
               valueFrom:
                 secretKeyRef:
-                  name: outline-minio-user-secret
+                  name: ceph-bucket-outline
                   key: AWS_ACCESS_KEY_ID
             - name: AWS_SECRET_ACCESS_KEY
               valueFrom:
                 secretKeyRef:
-                  name: outline-minio-user-secret
+                  name: ceph-bucket-outline
                   key: AWS_SECRET_ACCESS_KEY
             - name: AWS_REGION
               value: us-east-1
             - name: AWS_S3_UPLOAD_BUCKET_NAME
-              value: outline
+              valueFrom:
+                configMapKeyRef:
+                  name: ceph-bucket-outline
+                  key: BUCKET_NAME
             - name: AWS_S3_UPLOAD_BUCKET_URL
-              value: https://outline-storage.alexlebens.dev/outline
-            - name: AWS_S3_ACCELERATE_URL
-              value: https://outline-storage.alexlebens.dev/outline
+              value: https://objects.alexlebens.dev
             - name: AWS_S3_FORCE_PATH_STYLE
-              value: false
+              value: true
             - name: AWS_S3_ACL
               value: private
             - name: FILE_STORAGE_UPLOAD_MAX_SIZE
@@ -141,58 +142,9 @@ outline:
           port: 3000
           targetPort: 3000
           protocol: HTTP
-minio:
-  existingSecret:
-    name: outline-minio-root-secret
-  tenant:
-    name: minio-outline
-    configSecret:
-      name: outline-minio-config-secret
-    pools:
-      - servers: 3
-        name: pool
-        volumesPerServer: 2
-        size: 10Gi
-        storageClassName: ceph-block
-    mountPath: /export
-    subPath: /data
-    metrics:
-      enabled: true
-      port: 9000
-      protocol: http
-    certificate:
-      requestAutoCert: false
-  ingress:
-    console:
-      enabled: false
-valkey:
-  architecture: replication
-  auth:
-    enabled: false
-    usePasswordFiles: false
-  primary:
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
-  replica:
-    replicaCount: 1
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
 cloudflared-outline:
   existingSecretName: outline-cloudflared-secret
   name: cloudflared-outline
-cloudflared-minio:
-  existingSecretName: outline-minio-cloudflared-secret
-  name: cloudflared-minio
 postgres-17-cluster:
   mode: standalone
   cluster:
@@ -217,3 +169,4 @@ postgres-17-cluster:
     destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/outline/outline-postgresql-17-cluster
     endpointCredentials: outline-postgresql-17-cluster-backup-secret
     backupIndex: 2
+    retentionPolicy: "7d"

clusters/cl01tl/applications/overseerr/Chart.yaml

@@ -16,6 +16,6 @@ maintainers:
 dependencies:
   - name: app-template
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/overseerr.png
 appVersion: 1.34.0

clusters/cl01tl/applications/photoview/Chart.yaml

@@ -17,7 +17,7 @@ dependencies:
   - name: app-template
     alias: photoview
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/plex/Chart.yaml

@@ -21,6 +21,6 @@ dependencies:
   - name: app-template
     alias: plex
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/plex.png
 appVersion: 1.41.6

clusters/cl01tl/applications/plex/values.yaml

@@ -9,7 +9,7 @@ plex:
         main:
           image:
             repository: ghcr.io/linuxserver/plex
-            tag: 1.41.7@sha256:fad37d3811bbd089f95886cd14768addf009648a4913a01ea3db0a623e633025
+            tag: 1.41.9@sha256:3f124bbd4d58a588187a87b75427cba35d5de05a071f2252f908abbb95edf7bb
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/postiz/Chart.yaml

@@ -8,12 +8,10 @@ keywords:
 home: https://wiki.alexlebens.dev/s/f483a06b-860b-423c-8d51-a1ce82e0fd43
 sources:
   - https://github.com/gitroomhq/postiz-app
-  - https://github.com/valkey-io/valkey
   - https://github.com/cloudflare/cloudflared
   - https://github.com/cloudnative-pg/cloudnative-pg
   - https://github.com/gitroomhq/postiz-app/pkgs/container/postiz-app
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
@@ -22,13 +20,10 @@ dependencies:
   - name: app-template
     alias: postiz
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
-  - name: valkey
-    version: 3.0.9
-    repository: oci://harbor.alexlebens.net/proxy-registry-1.docker.io/bitnamicharts
+    version: 4.2.0
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.15.0
+    version: 1.19.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/postiz/templates/external-secret.yaml

@@ -24,10 +24,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: postiz-valkey-config
+  name: postiz-redis-config
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: postiz-valkey-config
+    app.kubernetes.io/name: postiz-redis-config
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -35,27 +35,27 @@ spec:
     kind: ClusterSecretStore
     name: vault
   data:
+    - secretKey: REDIS_URL
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/postiz/redis
+        metadataPolicy: None
+        property: REDIS_URL
     - secretKey: user
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /cl01tl/postiz/valkey
+        key: /cl01tl/postiz/redis
         metadataPolicy: None
         property: user
     - secretKey: password
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /cl01tl/postiz/valkey
+        key: /cl01tl/postiz/redis
         metadataPolicy: None
         property: password
-    - secretKey: REDIS_URL
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/postiz/valkey
-        metadataPolicy: None
-        property: REDIS_URL
 
 ---
 apiVersion: external-secrets.io/v1

clusters/cl01tl/applications/postiz/templates/redis-replication.yaml

@@ -0,0 +1,35 @@
+apiVersion: redis.redis.opstreelabs.in/v1beta2
+kind: RedisReplication
+metadata:
+  name: redis-replication-postiz
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-postiz
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  clusterSize: 3
+  podSecurityContext:
+    runAsUser: 1000
+    fsGroup: 1000
+  kubernetesConfig:
+    image: quay.io/opstree/redis:v8.0.3
+    imagePullPolicy: IfNotPresent
+    redisSecret:
+      name: postiz-redis-config
+      key: password
+    resources:
+      requests:
+        cpu: 50m
+        memory: 128Mi
+  storage:
+    volumeClaimTemplate:
+      spec:
+        storageClassName: ceph-block
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi
+  redisExporter:
+    enabled: true
+    image: quay.io/opstree/redis-exporter:v1.48.0

clusters/cl01tl/applications/postiz/templates/service-monitor.yaml

@@ -0,0 +1,19 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: redis-replication-postiz
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-postiz
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    redis-operator: "true"
+    env: production
+spec:
+  selector:
+    matchLabels:
+      redis_setup_type: replication
+  endpoints:
+    - port: redis-exporter
+      interval: 30s
+      scrapeTimeout: 10s

clusters/cl01tl/applications/postiz/values.yaml

@@ -9,7 +9,7 @@ postiz:
         main:
           image:
             repository: ghcr.io/gitroomhq/postiz-app
-            tag: v1.43.4
+            tag: v2.0.8
             pullPolicy: IfNotPresent
           env:
             - name: MAIN_URL
@@ -31,7 +31,7 @@ postiz:
             - name: REDIS_URL
               valueFrom:
                 secretKeyRef:
-                  name: postiz-valkey-config
+                  name: postiz-redis-config
                   key: REDIS_URL
             - name: BACKEND_INTERNAL_URL
               value: http://localhost:3000
@@ -102,30 +102,6 @@ postiz:
           main:
             - path: /uploads
               readOnly: false
-valkey:
-  architecture: replication
-  auth:
-    enabled: true
-    existingSecret: postiz-valkey-config
-    existingSecretPasswordKey: password
-    usePasswordFiles: false
-  primary:
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
-  replica:
-    replicaCount: 1
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
 cloudflared:
   name: cloudflared-postiz
   existingSecretName: postiz-cloudflared-secret
@@ -153,3 +129,4 @@ postgres-17-cluster:
     destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/postiz/postiz-postgresql-17-cluster
     endpointCredentials: postiz-postgresql-17-cluster-backup-secret
     backupIndex: 1
+    retentionPolicy: "7d"

clusters/cl01tl/applications/prowlarr/Chart.yaml

@@ -18,6 +18,6 @@ dependencies:
   - name: app-template
     alias: prowlarr
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prowlarr.png
 appVersion: 1.35.1

clusters/cl01tl/applications/prowlarr/values.yaml

@@ -20,7 +20,7 @@ prowlarr:
         main:
           image:
             repository: ghcr.io/linuxserver/prowlarr
-            tag: 1.35.1@sha256:c63b71155541de52a9e60ba13fd10824a59f649812ca18701509b7b804a5253a
+            tag: 1.37.0@sha256:d2462d470891c70073e31d158657a9b247b317c90238c40534d8be8f98671057
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/radarr-4k/Chart.yaml

@@ -24,7 +24,7 @@ dependencies:
   - name: app-template
     alias: radarr-4k
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/radarr-4k/values.yaml

@@ -15,7 +15,7 @@ radarr-4k:
         main:
           image:
             repository: ghcr.io/linuxserver/radarr
-            tag: 5.23.3@sha256:532749cc71739130720c9d1cd8b8fbec204f6c8bd94fd633fccb4b566a672a55
+            tag: 5.26.2@sha256:ae89f05ad7023258730ed62f5fcca63aab1e27ee5adcca1edb55d716f7cef356
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/radarr-anime/Chart.yaml

@@ -24,7 +24,7 @@ dependencies:
   - name: app-template
     alias: radarr-anime
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/radarr-anime/values.yaml

@@ -13,7 +13,7 @@ radarr-anime:
         main:
           image:
             repository: ghcr.io/linuxserver/radarr
-            tag: 5.23.3@sha256:532749cc71739130720c9d1cd8b8fbec204f6c8bd94fd633fccb4b566a672a55
+            tag: 5.26.2@sha256:ae89f05ad7023258730ed62f5fcca63aab1e27ee5adcca1edb55d716f7cef356
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/radarr-standup/Chart.yaml

@@ -23,7 +23,7 @@ dependencies:
   - name: app-template
     alias: radarr-standup
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/radarr-standup/values.yaml

@@ -13,7 +13,7 @@ radarr-standup:
         main:
           image:
             repository: ghcr.io/linuxserver/radarr
-            tag: 5.23.3@sha256:532749cc71739130720c9d1cd8b8fbec204f6c8bd94fd633fccb4b566a672a55
+            tag: 5.26.2@sha256:ae89f05ad7023258730ed62f5fcca63aab1e27ee5adcca1edb55d716f7cef356
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/radarr/Chart.yaml

@@ -23,7 +23,7 @@ dependencies:
   - name: app-template
     alias: radarr
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/radarr/values.yaml

@@ -15,7 +15,7 @@ radarr:
         main:
           image:
             repository: ghcr.io/linuxserver/radarr
-            tag: 5.23.3@sha256:532749cc71739130720c9d1cd8b8fbec204f6c8bd94fd633fccb4b566a672a55
+            tag: 5.26.2@sha256:ae89f05ad7023258730ed62f5fcca63aab1e27ee5adcca1edb55d716f7cef356
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/roundcube/Chart.yaml

@@ -18,7 +18,7 @@ dependencies:
   - name: app-template
     alias: roundcube
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/roundcube/values.yaml

@@ -9,7 +9,7 @@ roundcube:
         main:
           image:
             repository: roundcube/roundcubemail
-            tag: 1.6.10-fpm-alpine
+            tag: 1.6.11-fpm-alpine
             pullPolicy: IfNotPresent
           env:
             - name: ROUNDCUBEMAIL_DB_TYPE
@@ -58,7 +58,7 @@ roundcube:
         nginx:
           image:
             repository: nginx
-            tag: 1.28.0-alpine
+            tag: 1.29.0-alpine
             pullPolicy: IfNotPresent
           env:
             - name: NGINX_HOST
@@ -75,7 +75,7 @@ roundcube:
         suspend: false
         concurrencyPolicy: Forbid
         timeZone: US/Central
-        schedule: 0 4 * * *
+        schedule: 30 4 * * *
         startingDeadlineSeconds: 90
         successfulJobsHistory: 3
         failedJobsHistory: 3
@@ -85,7 +85,7 @@ roundcube:
         backup:
           image:
             repository: roundcube/roundcubemail
-            tag: 1.6.10-fpm-alpine
+            tag: 1.6.11-fpm-alpine
             pullPolicy: IfNotPresent
           env:
             - name: ROUNDCUBEMAIL_DB_TYPE
@@ -229,3 +229,4 @@ postgres-17-cluster:
     destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/roundcube/roundcube-postgresql-17-cluster
     endpointCredentials: roundcube-postgresql-17-cluster-backup-secret
     backupIndex: 2
+    retentionPolicy: "7d"

clusters/cl01tl/applications/searxng/Chart.yaml

@@ -8,18 +8,13 @@ keywords:
 home: https://wiki.alexlebens.dev/s/6c6da68a-8725-4439-93c8-990ce824be54
 sources:
   - https://github.com/searxng/searxng
-  - https://github.com/valkey-io/valkey
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
 maintainers:
   - name: alexlebens
 dependencies:
   - name: app-template
     alias: searxng
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
-  - name: valkey
-    version: 3.0.9
-    repository: oci://harbor.alexlebens.net/proxy-registry-1.docker.io/bitnamicharts
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/searxng.png
 appVersion: 1.0.0

clusters/cl01tl/applications/searxng/templates/redis-replication.yaml

@@ -0,0 +1,32 @@
+apiVersion: redis.redis.opstreelabs.in/v1beta2
+kind: RedisReplication
+metadata:
+  name: redis-replication-searxng
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-searxng
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  clusterSize: 3
+  podSecurityContext:
+    runAsUser: 1000
+    fsGroup: 1000
+  kubernetesConfig:
+    image: quay.io/opstree/redis:v8.0.3
+    imagePullPolicy: IfNotPresent
+    resources:
+      requests:
+        cpu: 50m
+        memory: 128Mi
+  storage:
+    volumeClaimTemplate:
+      spec:
+        storageClassName: ceph-block
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi
+  redisExporter:
+    enabled: true
+    image: quay.io/opstree/redis-exporter:v1.48.0

clusters/cl01tl/applications/searxng/templates/service-monitor.yaml

@@ -0,0 +1,19 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: redis-replication-searxng
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-searxng
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    redis-operator: "true"
+    env: production
+spec:
+  selector:
+    matchLabels:
+      redis_setup_type: replication
+  endpoints:
+    - port: redis-exporter
+      interval: 30s
+      scrapeTimeout: 10s

clusters/cl01tl/applications/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:b5499b40ee1831d229d1001565461dc43968b89c1859a6877e4663b961f0dd40
+            tag: latest@sha256:8ee06648ea025780c4805cf58fd66e48245bf7e81466751afae4bf84e5ef29ca
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -43,7 +43,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:b5499b40ee1831d229d1001565461dc43968b89c1859a6877e4663b961f0dd40
+            tag: latest@sha256:8ee06648ea025780c4805cf58fd66e48245bf7e81466751afae4bf84e5ef29ca
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -53,7 +53,7 @@ searxng:
             - name: SEARXNG_HOSTNAME
               value: searxng.alexlebens.net
             - name: SEARXNG_REDIS_URL
-              value: redis://searxng-valkey-primary.searxng:6379/0
+              value: redis://redis-replication-searxng-master.searxng:6379/0
             - name: UWSGI_WORKERS
               value: 4
             - name: UWSGI_THREADS
@@ -111,25 +111,3 @@ searxng:
           main:
             - path: /etc/searxng
               readOnly: false
-valkey:
-  architecture: replication
-  auth:
-    enabled: false
-    usePasswordFiles: false
-  primary:
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
-  replica:
-    replicaCount: 1
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi

clusters/cl01tl/applications/site-profile/Chart.yaml

@@ -19,10 +19,10 @@ dependencies:
   - name: app-template
     alias: site-profile
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
   - name: cloudflared
     alias: cloudflared-site
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.15.0
-icon: https://d21zlbwtcn424f.cloudfront.net/icon_white.png
-appVersion: 0.6.6
+    version: 1.19.0
+icon: https://d21zlbwtcn424f.cloudfront.net/logo-new-round.png
+appVersion: 0.8.1

clusters/cl01tl/applications/site-profile/values.yaml

@@ -5,13 +5,13 @@ site-profile:
     main:
       type: deployment
       replicas: 3
-      strategy: Recreate
+      strategy: RollingUpdate
       revisionHistoryLimit: 3
       containers:
         main:
           image:
-            repository: gitea.alexlebens.dev/alexlebens/site-profile
-            tag: 0.6.8
+            repository: harbor.alexlebens.net/images/site-profile
+            tag: 1.0.1
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/applications/slskd/Chart.yaml

@@ -20,6 +20,6 @@ dependencies:
   - name: app-template
     alias: slskd
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/slskd.png
 appVersion: 0.22.5

clusters/cl01tl/applications/slskd/values.yaml

@@ -28,7 +28,7 @@ slskd:
         main:
           image:
             repository: slskd/slskd
-            tag: 0.22.5
+            tag: 0.23.1
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -94,7 +94,7 @@ slskd:
         main:
           image:
             repository: mrusse08/soularr
-            tag: latest@sha256:5186cd4bdaf6a1595f86d90fe99a61bb95b2baaf02998d00cbac32e52f1121b3
+            tag: latest@sha256:da225f2b1042865c7223b3ee3e6d53e496eecc24566f60e48ef239396f54898a
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/sonarr-4k/Chart.yaml

@@ -24,7 +24,7 @@ dependencies:
   - name: app-template
     alias: sonarr-4k
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/sonarr-4k/values.yaml

@@ -13,7 +13,7 @@ sonarr-4k:
         main:
           image:
             repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.14@sha256:cdf5eb3cfa207d46b066bfbb41b03576c67a1f6ecc8aba19146d0f7349ec79dc
+            tag: 4.0.15@sha256:c0836f49c20000e603170dc95d74c2527e690d50309977d94fc171eaa49351a4
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/sonarr-anime/Chart.yaml

@@ -23,7 +23,7 @@ dependencies:
   - name: app-template
     alias: sonarr-anime
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/sonarr-anime/values.yaml

@@ -13,7 +13,7 @@ sonarr-anime:
         main:
           image:
             repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.14@sha256:cdf5eb3cfa207d46b066bfbb41b03576c67a1f6ecc8aba19146d0f7349ec79dc
+            tag: 4.0.15@sha256:c0836f49c20000e603170dc95d74c2527e690d50309977d94fc171eaa49351a4
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/sonarr/Chart.yaml

@@ -23,7 +23,7 @@ dependencies:
   - name: app-template
     alias: sonarr
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0