Update ghcr.io/immich-app/immich-machine-learning Docker tag to v1.137.3

Update ghcr.io/linuxserver/bazarr:1.5.2 Docker digest to 9530eb0 (#1131 )
Update kube-prometheus-stack Docker tag to v75.16.1 (#1130 )
2025-08-05 22:02:57 +00:00 · 2025-08-05 22:02:05 +00:00 · 2025-08-05 21:02:09 +00:00 · 2025-08-05 20:01:58 +00:00 · 2025-08-05 20:01:37 +00:00 · 2025-08-05 18:01:59 +00:00
523 changed files with 6130 additions and 2921 deletions
--- a/.gitea/workflows/lint-test-docker.yaml
+++ b/.gitea/workflows/lint-test-docker.yaml
@@ -0,0 +1,80 @@
 name: lint-test-docker
 on:
  push:
    branches:
      - main
    paths:
      - 'hosts/**'
      - ! 'hosts/archive'
  pull_request:
    branches:
      - main
    paths:
      - 'hosts/**'
      - ! 'hosts/archive'
 jobs:
  docker-lint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Check Branch Exists
        id: check-branch-exists
        uses: GuillaumeFalourd/branch-exists@v1.1
        with:
          branch: "origin/${{ github.base_ref }}"
      - name: Branch Does Not Exist
        if: steps.check-branch-exists.outputs.exists == 'false'
        run: echo "Branch origin/${{ github.base_ref }} was not found, likely already merged"
      - name: Set up Node.js
        if: steps.check-branch-exists.outputs.exists == 'true'
        uses: actions/setup-node@v4
        with:
          node-version: '22'
      - name: Lint Docker Compose
        if: steps.check-branch-exists.outputs.exists == 'true'
        run: |
          set -e  # Exit immediately if a command exits with a non-zero status.
          TARGET_BRANCH="origin/${{ github.base_ref }}"
          echo ">> Target branch for diff is: $TARGET_BRANCH"
          CHANGED_FILES=$(git diff --name-only "$TARGET_BRANCH" -- 'hosts/**')
          echo ">> Found changed files:"
          echo "$CHANGED_FILES"
          # For each changed file, find its parent chart directory (the one with compose.yaml).
          # Then, create a unique list of those directories.
          CHANGED_COMPOSE=$(echo "$CHANGED_FILES" | while read -r file; do
            dir=$(dirname "$file")
            while [[ "$dir" != "." && ! -f "$dir/compose.yaml" ]]; do
              dir=$(dirname "$dir")
            done
            if [[ "$dir" != "." ]]; then
              echo "$dir"
            fi
          done | sort -u)
          if [[ -z "$CHANGED_COMPOSE" ]]; then
            echo ">> Could not determine changed compose files. This will happen if only files outside a compose file were changed."
            exit 0
          fi
          echo ">> Running dclint on changed compose files:"
          echo "$CHANGED_COMPOSE"
          echo "$CHANGED_COMPOSE" | while read -r compose; do
            echo ">> Linting $compose ..."
            npx dclint $compose
          done
--- a/.gitea/workflows/lint-test-helm.yaml
+++ b/.gitea/workflows/lint-test-helm.yaml
@@ -0,0 +1,82 @@
 name: lint-test-helm
 on:
  push:
    branches:
      - main
    paths:
      - 'clusters/**'
      - ! 'clusters/*/archive'
  pull_request:
    branches:
      - main
    paths:
      - 'clusters/**'
      - ! 'clusters/*/archive'
 jobs:
  helm-lint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Check Branch Exists
        id: check-branch-exists
        uses: GuillaumeFalourd/branch-exists@v1.1
        with:
          branch: "origin/${{ github.base_ref }}"
      - name: Branch Does Not Exist
        if: steps.check-branch-exists.outputs.exists == 'false'
        run: echo "Branch origin/${{ github.base_ref }} was not found, likely already merged"
      - name: Set up Helm
        if: steps.check-branch-exists.outputs.exists == 'true'
        uses: azure/setup-helm@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}
          version: latest
      - name: Lint Helm Chart
        if: steps.check-branch-exists.outputs.exists == 'true'
        run: |
          set -e  # Exit immediately if a command exits with a non-zero status.
          TARGET_BRANCH="origin/${{ github.base_ref }}"
          echo ">> Target branch for diff is: $TARGET_BRANCH"
          CHANGED_FILES=$(git diff --name-only "$TARGET_BRANCH" -- 'clusters/**')
          echo ">> Found changed files:"
          echo "$CHANGED_FILES"
          # For each changed file, find its parent chart directory (the one with Chart.yaml).
          # Then, create a unique list of those directories.
          CHANGED_CHARTS=$(echo "$CHANGED_FILES" | while read -r file; do
            dir=$(dirname "$file")
            while [[ "$dir" != "." && ! -f "$dir/Chart.yaml" ]]; do
              dir=$(dirname "$dir")
            done
            if [[ "$dir" != "." ]]; then
              echo "$dir"
            fi
          done | sort -u)
          if [[ -z "$CHANGED_CHARTS" ]]; then
            echo ">> Could not determine changed charts. This could happen if only files outside a chart were changed."
            exit 0
          fi
          echo ">> Running helm lint on changed charts:"
          echo "$CHANGED_CHARTS"
          echo "$CHANGED_CHARTS" | while read -r chart; do
            echo ">> Building dependency for "$chart" ..."
            helm dependency build "$chart"
            echo ">> Linting $chart..."
            helm lint "$chart"
          done
--- a/.gitea/workflows/lint-test.yaml
+++ b/.gitea/workflows/lint-test.yaml
@@ -1,37 +0,0 @@
 name: lint-and-test-charts
 on: pull_request
 jobs:
  lint-test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set up Helm
        uses: azure/setup-helm@v4
        with:
          version: latest
      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"
          check-latest: true
      - name: Set up chart-testing
        uses: helm/chart-testing-action@v2.7.0
      - name: Run chart-testing (list-changed)
        id: list-changed
        run: |
          changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }})
          if [[ -n "$changed" ]]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi
      - name: Run chart-testing (lint)
        if: steps.list-changed.outputs.changed == 'true'
        run: ct lint --target-branch ${{ github.event.repository.default_branch }}
--- a/.gitea/workflows/renovate.yaml
+++ b/.gitea/workflows/renovate.yaml
@@ -0,0 +1,32 @@
 name: renovate
 on:
  schedule:
    - cron: "@hourly"
  push:
    branches:
      - main
  workflow_dispatch:
 jobs:
  renovate:
    runs-on: ubuntu-latest
    container: ghcr.io/renovatebot/renovate:41
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Renovate
        run: renovate
        env:
          RENOVATE_PLATFORM: gitea
          RENOVATE_ENDPOINT: ${{ vars.INSTANCE_URL }}
          RENOVATE_REPOSITORIES: alexlebens/infrastructure
          RENOVATE_GIT_AUTHOR: Renovate Bot <renovate-bot@alexlebens.net>
          LOG_LEVEL: info
          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
          RENOVATE_GIT_PRIVATE_KEY: ${{ secrets.RENOVATE_GIT_PRIVATE_KEY }}
          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}
          RENOVATE_REDIS_URL: ${{ vars.RENOVATE_REDIS_URL }}
--- a/clusters/cl01tl/applications/actual/Chart.yaml
+++ b/clusters/cl01tl/applications/actual/Chart.yaml
@@ -16,6 +16,6 @@ dependencies:
  - name: app-template
    alias: actual
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/actual-budget.png
 appVersion: v25.5.0
--- a/clusters/cl01tl/applications/actual/templates/external-secret.yaml
+++ b/clusters/cl01tl/applications/actual/templates/external-secret.yaml
@@ -4,8 +4,9 @@ metadata:
  name: actual-data-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/name: actual-data-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
--- a/clusters/cl01tl/applications/actual/templates/http-route.yaml
+++ b/clusters/cl01tl/applications/actual/templates/http-route.yaml
@@ -4,8 +4,9 @@ metadata:
  name: http-route-actual
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/name: http-route-actual
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
    - group: gateway.networking.k8s.io
--- a/clusters/cl01tl/applications/actual/templates/replication-source.yaml
+++ b/clusters/cl01tl/applications/actual/templates/replication-source.yaml
@@ -4,8 +4,9 @@ metadata:
  name: actual-data-backup-source
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/name: actual-data-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: actual-data
  trigger:
--- a/clusters/cl01tl/applications/actual/values.yaml
+++ b/clusters/cl01tl/applications/actual/values.yaml
@@ -9,7 +9,7 @@ actual:
        main:
          image:
            repository: ghcr.io/actualbudget/actual
-            tag: 25.5.0
+            tag: 25.8.0
            pullPolicy: IfNotPresent
          env:
            - name: TZ
--- a/clusters/cl01tl/applications/audiobookshelf/Chart.yaml
+++ b/clusters/cl01tl/applications/audiobookshelf/Chart.yaml
@@ -18,6 +18,6 @@ dependencies:
  - name: app-template
    alias: audiobookshelf
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.0.1
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/audiobookshelf.png
 appVersion: 2.21.0
--- a/clusters/cl01tl/applications/audiobookshelf/templates/external-secret.yaml
+++ b/clusters/cl01tl/applications/audiobookshelf/templates/external-secret.yaml
@@ -1,11 +1,35 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: audiobookshelf-apprise-config
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audiobookshelf-apprise-config
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: ntfy-url
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/audiobookshelf/apprise
        metadataPolicy: None
        property: ntfy-url
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: audiobookshelf-config-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/name: audiobookshelf-config-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
@@ -60,8 +84,9 @@ metadata:
  name: audiobookshelf-metadata-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/name: audiobookshelf-metadata-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
--- a/clusters/cl01tl/applications/audiobookshelf/templates/http-route.yaml
+++ b/clusters/cl01tl/applications/audiobookshelf/templates/http-route.yaml
@@ -4,8 +4,9 @@ metadata:
  name: http-route-audiobookshelf
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/name: http-route-audiobookshelf
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
    - group: gateway.networking.k8s.io
--- a/clusters/cl01tl/applications/audiobookshelf/templates/persistent-volume-claim.yaml
+++ b/clusters/cl01tl/applications/audiobookshelf/templates/persistent-volume-claim.yaml
@@ -4,8 +4,9 @@ metadata:
  name: audiobookshelf-nfs-storage-backup
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/name: audiobookshelf-nfs-storage-backup
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeMode: Filesystem
  storageClassName: nfs-client
@@ -22,8 +23,9 @@ metadata:
  name: audiobookshelf-nfs-storage
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/name: audiobookshelf-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeName: audiobookshelf-nfs-storage
  storageClassName: nfs-client
--- a/clusters/cl01tl/applications/audiobookshelf/templates/persistent-volume.yaml
+++ b/clusters/cl01tl/applications/audiobookshelf/templates/persistent-volume.yaml
@@ -4,8 +4,9 @@ metadata:
  name: audiobookshelf-nfs-storage
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/name: audiobookshelf-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs-client
--- a/clusters/cl01tl/applications/audiobookshelf/templates/replication-source.yaml
+++ b/clusters/cl01tl/applications/audiobookshelf/templates/replication-source.yaml
@@ -4,8 +4,9 @@ metadata:
  name: audiobookshelf-config-backup-source
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/name: audiobookshelf-config-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: audiobookshelf-config
  trigger:
@@ -30,8 +31,9 @@ metadata:
  name: audiobookshelf-metadata-backup-source
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/name: audiobookshelf-metadata-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: audiobookshelf-metadata
  trigger:
--- a/clusters/cl01tl/applications/audiobookshelf/templates/service-monitor.yaml
+++ b/clusters/cl01tl/applications/audiobookshelf/templates/service-monitor.yaml
@@ -0,0 +1,19 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  name: audiobookshelf-apprise
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audiobookshelf-apprise
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  endpoints:
    - port: apprise
      interval: 30s
      scrapeTimeout: 15s
      path: /metrics
  selector:
    matchLabels:
      app.kubernetes.io/name: audiobookshelf
      app.kubernetes.io/instance: {{ .Release.Name }}
--- a/clusters/cl01tl/applications/audiobookshelf/values.yaml
+++ b/clusters/cl01tl/applications/audiobookshelf/values.yaml
@@ -9,7 +9,7 @@ audiobookshelf:
        main:
          image:
            repository: ghcr.io/advplyr/audiobookshelf
-            tag: 2.22.0
+            tag: 2.27.0
            pullPolicy: IfNotPresent
          env:
            - name: TZ
@@ -18,6 +18,29 @@ audiobookshelf:
            requests:
              cpu: 10m
              memory: 128Mi
        apprise-api:
          image:
            repository: caronc/apprise
            tag: 1.2.1
            pullPolicy: IfNotPresent
          env:
            - name: TZ
              value: US/Central
            - name: APPRISE_STORAGE_MODE
              value: memory
            - name: APPRISE_STATEFUL_MODE
              value: disabled
            - name: APPRISE_WORKER_COUNT
              value: 1
            - name: APPRISE_STATELESS_URLS
              valueFrom:
                secretKeyRef:
                  name: audiobookshelf-apprise-config
                  key: ntfy-url
          resources:
            requests:
              cpu: 10m
              memory: 128Mi
  service:
    main:
      controller: main
@@ -26,6 +49,10 @@ audiobookshelf:
          port: 80
          targetPort: 80
          protocol: HTTP
        apprise:
          port: 8000
          targetPort: 8000
          protocol: HTTP
  persistence:
    config:
      storageClass: ceph-block
--- a/clusters/cl01tl/applications/bazarr/Chart.yaml
+++ b/clusters/cl01tl/applications/bazarr/Chart.yaml
@@ -0,0 +1,23 @@
 apiVersion: v2
 name: bazarr
 version: 1.0.0
 description: Bazarr
 keywords:
  - bazarr
  - servarr
  - subtitles
 home: https://wiki.alexlebens.dev/s/92784d53-1d43-42fd-b509-f42c73454226
 sources:
  - https://github.com/morpheus65535/bazarr
  - https://github.com/linuxserver/docker-bazarr
  - https://github.com/linuxserver/docker-bazarr/pkgs/container/bazarr
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
 maintainers:
  - name: alexlebens
 dependencies:
  - name: app-template
    alias: bazarr
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/bazarr.png
 appVersion: 1.5.2
--- a/clusters/cl01tl/applications/bazarr/templates/external-secret.yaml
+++ b/clusters/cl01tl/applications/bazarr/templates/external-secret.yaml
@@ -0,0 +1,55 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: bazarr-config-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: bazarr-config-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/bazarr/bazarr-config"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: S3_BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: AWS_DEFAULT_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: access_key
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: secret_key
--- a/clusters/cl01tl/applications/outline/templates/http-route.yaml
+++ b/clusters/cl01tl/applications/outline/templates/http-route.yaml
@@ -1,13 +1,11 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: http-route-outline-minio
+  name: http-route-bazarr
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: http-route-outline-minio
+    app.kubernetes.io/name: http-route-bazarr
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
@@ -16,7 +14,7 @@ spec:
      name: traefik-gateway
      namespace: traefik
  hostnames:
-    - minio-outline.alexlebens.net
+    - bazarr.alexlebens.net
  rules:
    - matches:
      - path:
@@ -25,6 +23,6 @@ spec:
      backendRefs:
        - group: ''
          kind: Service
-          name: minio-outline-console
+          name: bazarr
-          port: 9090
+          port: 80
          weight: 100
--- a/clusters/cl01tl/applications/bazarr/templates/persistent-volume-claim.yaml
+++ b/clusters/cl01tl/applications/bazarr/templates/persistent-volume-claim.yaml
@@ -0,0 +1,17 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: bazarr-nfs-storage
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: bazarr-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeName: bazarr-nfs-storage
  storageClassName: nfs-client
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
--- a/clusters/cl01tl/applications/bazarr/templates/persistent-volume.yaml
+++ b/clusters/cl01tl/applications/bazarr/templates/persistent-volume.yaml
@@ -0,0 +1,23 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
  name: bazarr-nfs-storage
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: bazarr-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs-client
  capacity:
    storage: 1Gi
  accessModes:
    - ReadWriteMany
  nfs:
    path: /volume2/Storage
    server: synologybond.alexlebens.net
  mountOptions:
    - vers=4
    - minorversion=1
    - noac
--- a/clusters/cl01tl/applications/bazarr/templates/replication-source.yaml
+++ b/clusters/cl01tl/applications/bazarr/templates/replication-source.yaml
@@ -0,0 +1,30 @@
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: bazarr-config-backup-source
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: bazarr-config-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: bazarr-config
  trigger:
    schedule: 0 4 * * *
  restic:
    pruneIntervalDays: 7
    repository: bazarr-config-backup-secret
    retain:
      hourly: 1
      daily: 3
      weekly: 2
      monthly: 2
      yearly: 4
    moverSecurityContext:
      runAsUser: 1000
      runAsGroup: 1000
      fsGroup: 1000
      fsGroupChangePolicy: OnRootMismatch
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
--- a/clusters/cl01tl/applications/bazarr/values.yaml
+++ b/clusters/cl01tl/applications/bazarr/values.yaml
@@ -0,0 +1,57 @@
 bazarr:
  controllers:
    main:
      type: deployment
      replicas: 1
      strategy: Recreate
      revisionHistoryLimit: 3
      pod:
        securityContext:
          runAsUser: 1000
          runAsGroup: 1000
          fsGroup: 1000
          fsGroupChangePolicy: OnRootMismatch
      containers:
        main:
          image:
            repository: ghcr.io/linuxserver/bazarr
            tag: 1.5.2@sha256:9530eb044660a1847e68ba9f39f90499dae0db83c3bed088973771c5f3f30007
            pullPolicy: IfNotPresent
          env:
            - name: TZ
              value: US/Central
            - name: PUID
              value: 1000
            - name: PGID
              value: 1000
          resources:
            requests:
              cpu: 10m
              memory: 256Mi
  service:
    main:
      controller: main
      ports:
        http:
          port: 80
          targetPort: 6767
          protocol: HTTP
  persistence:
    config:
      forceRename: bazarr-config
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 5Gi
      retain: true
      advancedMounts:
        main:
          main:
            - path: /config
              readOnly: false
    media:
      existingClaim: bazarr-nfs-storage
      advancedMounts:
        main:
          main:
            - path: /mnt/store
              readOnly: false
--- a/clusters/cl01tl/applications/calibre-web-automated/Chart.yaml
+++ b/clusters/cl01tl/applications/calibre-web-automated/Chart.yaml
@@ -16,6 +16,6 @@ dependencies:
  - name: app-template
    alias: calibre-web-automated
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 3.7.3
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/calibre-web.png
 appVersion: V3.0.4
--- a/clusters/cl01tl/applications/calibre-web-automated/templates/external-secret.yaml
+++ b/clusters/cl01tl/applications/calibre-web-automated/templates/external-secret.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: calibre-web-automated-gmail-config
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -31,8 +29,6 @@ metadata:
  labels:
    app.kubernetes.io/name: calibre-web-automated-config-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: backup
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
--- a/clusters/cl01tl/applications/calibre-web-automated/templates/http-route.yaml
+++ b/clusters/cl01tl/applications/calibre-web-automated/templates/http-route.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: http-route-calibre
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
@@ -38,8 +36,6 @@ metadata:
  labels:
    app.kubernetes.io/name: http-route-calibre-downloader
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
--- a/clusters/cl01tl/applications/calibre-web-automated/templates/persistent-volume-claim.yaml
+++ b/clusters/cl01tl/applications/calibre-web-automated/templates/persistent-volume-claim.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: calibre-web-automated-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: storage
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeName: calibre-web-automated-nfs-storage
@@ -27,8 +25,6 @@ metadata:
  labels:
    app.kubernetes.io/name: calibre-web-automated-ingest-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: storage
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeName: calibre-web-automated-ingest-nfs-storage
--- a/clusters/cl01tl/applications/calibre-web-automated/templates/persistent-volume.yaml
+++ b/clusters/cl01tl/applications/calibre-web-automated/templates/persistent-volume.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: calibre-web-automated-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: storage
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  persistentVolumeReclaimPolicy: Retain
@@ -33,8 +31,6 @@ metadata:
  labels:
    app.kubernetes.io/name: calibre-web-automated-ingest-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: storage
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  persistentVolumeReclaimPolicy: Retain
--- a/clusters/cl01tl/applications/calibre-web-automated/templates/replication-source.yaml
+++ b/clusters/cl01tl/applications/calibre-web-automated/templates/replication-source.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: calibre-web-automated-config-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: backup
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: calibre-web-automated-config
--- a/clusters/cl01tl/applications/calibre-web-automated/values.yaml
+++ b/clusters/cl01tl/applications/calibre-web-automated/values.yaml
@@ -20,7 +20,7 @@ calibre-web-automated:
              value: 100
          resources:
            requests:
-              cpu: 100m
+              cpu: 10m
              memory: 256Mi
    downloader:
      type: deployment
@@ -31,7 +31,7 @@ calibre-web-automated:
        main:
          image:
            repository: ghcr.io/calibrain/calibre-web-automated-book-downloader
-            tag: latest@sha256:97a636efe3b78e1306ff521aa09256125aacdb1a04e628df294d7b6da3fe7b4a
+            tag: latest@sha256:7d01e56bfb0f0f150f89da59e4ec5627c4dc53d48d5ff5283e7e10877c737f8c
            pullPolicy: IfNotPresent
          env:
            - name: FLASK_PORT
@@ -55,14 +55,12 @@ calibre-web-automated:
        bypass:
          image:
            repository: ghcr.io/sarperavci/cloudflarebypassforscraping
-            tag: latest@sha256:d1028839c2d6317a48e6e2139acaea5129bb3b089f0c5583f61fc162f1975de0
+            tag: latest@sha256:bd326a3c6ae0b7ed3e405bbaa230e43e252f444c98f57d179f7a1d78f273748b
            pullPolicy: IfNotPresent
          resources:
            requests:
              cpu: 10m
              memory: 128Mi
  serviceAccount:
    create: true
  service:
    main:
      controller: main
@@ -80,6 +78,7 @@ calibre-web-automated:
          protocol: HTTP
  persistence:
    config:
      forceRename: calibre-web-automated-config
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 5Gi
--- a/clusters/cl01tl/applications/code-server/Chart.yaml
+++ b/clusters/cl01tl/applications/code-server/Chart.yaml
@@ -19,10 +19,10 @@ dependencies:
  - name: app-template
    alias: code-server
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 3.7.3
+    version: 4.2.0
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.15.0
+    version: 1.19.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/visual-studio-code.png
-appVersion: 4.99.4
+appVersion: 4.100.2
--- a/clusters/cl01tl/applications/code-server/templates/external-secret.yaml
+++ b/clusters/cl01tl/applications/code-server/templates/external-secret.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: codeserver-password-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -38,8 +36,6 @@ metadata:
  labels:
    app.kubernetes.io/name: code-server-cloudflared-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
--- a/clusters/cl01tl/applications/code-server/templates/http-route.yaml
+++ b/clusters/cl01tl/applications/code-server/templates/http-route.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: http-route-code-server
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
--- a/clusters/cl01tl/applications/code-server/templates/persistent-volume-claim.yaml
+++ b/clusters/cl01tl/applications/code-server/templates/persistent-volume-claim.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: code-server-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: storage
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeMode: Filesystem
--- a/clusters/cl01tl/applications/code-server/values.yaml
+++ b/clusters/cl01tl/applications/code-server/values.yaml
@@ -9,7 +9,7 @@ code-server:
        main:
          image:
            repository: ghcr.io/linuxserver/code-server
-            tag: 4.100.2@sha256:511445e8877da1665b97d2ca39f03009a36edadba9959eefcc8ff3d1b0f42251
+            tag: 4.102.3@sha256:9d5bd6a6d04132cafb664e89a0eb87e632d142a4d4a9bb937f22752d37aa64e6
            pullPolicy: IfNotPresent
          env:
            - name: TZ
@@ -27,8 +27,6 @@ code-server:
            requests:
              cpu: 10m
              memory: 128Mi
  serviceAccount:
    create: true
  service:
    main:
      controller: main
--- a/clusters/cl01tl/applications/directus/Chart.yaml
+++ b/clusters/cl01tl/applications/directus/Chart.yaml
@@ -8,14 +8,10 @@ keywords:
 home: https://wiki.alexlebens.dev/s/c2d242de-dcaa-4801-86a2-c4761dc8bf9b
 sources:
  - https://github.com/directus/directus
  - https://github.com/minio/operator
  - https://github.com/valkey-io/valkey
  - https://github.com/cloudflare/cloudflared
  - https://github.com/cloudnative-pg/cloudnative-pg
  - https://hub.docker.com/r/directus/directus
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
  - https://github.com/minio/operator/tree/master/helm/tenant
  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
@@ -24,18 +20,11 @@ dependencies:
  - name: app-template
    alias: directus
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 3.7.3
+    version: 4.2.0
  - name: tenant
    alias: minio
    version: 7.1.1
    repository: https://operator.min.io/
  - name: valkey
    version: 3.0.6
    repository: oci://harbor.alexlebens.net/proxy-registry-1.docker.io/bitnamicharts
  - name: cloudflared
    alias: cloudflared-directus
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.14.8
+    version: 1.19.0
  - name: postgres-cluster
    alias: postgres-17-cluster
    version: 5.1.0
--- a/clusters/cl01tl/applications/directus/templates/external-secret.yaml
+++ b/clusters/cl01tl/applications/directus/templates/external-secret.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: directus-config
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -47,13 +45,34 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: directus-valkey-config
+  name: directus-metric-token
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: directus-valkey-config
+    app.kubernetes.io/name: directus-metric-token
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: metric-token
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/directus/metrics
        metadataPolicy: None
        property: metric-token
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: directus-redis-config
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: directus-redis-config
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -64,14 +83,14 @@ spec:
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
-        key: /cl01tl/directus/valkey
+        key: /cl01tl/directus/redis
        metadataPolicy: None
        property: user
    - secretKey: password
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
-        key: /cl01tl/directus/valkey
+        key: /cl01tl/directus/redis
        metadataPolicy: None
        property: password
@@ -84,8 +103,6 @@ metadata:
  labels:
    app.kubernetes.io/name: directus-oidc-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -107,88 +124,6 @@ spec:
        metadataPolicy: None
        property: secret
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: directus-minio-user-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: directus-minio-user-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: database
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/directus/minio/auth
        metadataPolicy: None
        property: AWS_ACCESS_KEY_ID
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/directus/minio/auth
        metadataPolicy: None
        property: AWS_SECRET_ACCESS_KEY
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: directus-minio-root-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: directus-minio-root-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: database
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: config.env
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/directus/minio/config
        metadataPolicy: None
        property: root-config.env
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: directus-minio-config-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: directus-minio-config-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: database
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: config.env
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/directus/minio/config
        metadataPolicy: None
        property: config.env
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
@@ -198,8 +133,6 @@ metadata:
  labels:
    app.kubernetes.io/name: directus-cloudflared-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -223,8 +156,6 @@ metadata:
  labels:
    app.kubernetes.io/name: directus-postgresql-17-cluster-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: database
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
--- a/clusters/cl01tl/applications/directus/templates/object-bucket-claim.yaml
+++ b/clusters/cl01tl/applications/directus/templates/object-bucket-claim.yaml
@@ -0,0 +1,11 @@
 apiVersion: objectbucket.io/v1alpha1
 kind: ObjectBucketClaim
 metadata:
  name: ceph-bucket-directus
  labels:
    app.kubernetes.io/name: ceph-bucket-directus
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  generateBucketName: bucket-directus
  storageClassName: ceph-bucket
--- a/clusters/cl01tl/applications/directus/templates/redis-replication.yaml
+++ b/clusters/cl01tl/applications/directus/templates/redis-replication.yaml
@@ -0,0 +1,35 @@
 apiVersion: redis.redis.opstreelabs.in/v1beta2
 kind: RedisReplication
 metadata:
  name: redis-replication-directus
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: redis-replication-directus
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  clusterSize: 3
  podSecurityContext:
    runAsUser: 1000
    fsGroup: 1000
  kubernetesConfig:
    image: quay.io/opstree/redis:v8.0.3
    imagePullPolicy: IfNotPresent
    redisSecret:
      name: directus-redis-config
      key: password
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
  storage:
    volumeClaimTemplate:
      spec:
        storageClassName: ceph-block
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 1Gi
  redisExporter:
    enabled: true
    image: quay.io/opstree/redis-exporter:v1.48.0
--- a/clusters/cl01tl/applications/directus/templates/service-monitor.yaml
+++ b/clusters/cl01tl/applications/directus/templates/service-monitor.yaml
@@ -0,0 +1,43 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  name: directus
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: directus
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: directus
      app.kubernetes.io/instance: {{ .Release.Name }}
  endpoints:
    - port: http
      interval: 30s
      scrapeTimeout: 15s
      path: /metrics
      bearerTokenSecret:
        name: directus-metric-token
        key: metric-token
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  name: redis-replication-directus
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: redis-replication-directus
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
    redis-operator: "true"
    env: production
 spec:
  selector:
    matchLabels:
      redis_setup_type: replication
  endpoints:
    - port: redis-exporter
      interval: 30s
      scrapeTimeout: 10s
--- a/clusters/cl01tl/applications/directus/values.yaml
+++ b/clusters/cl01tl/applications/directus/values.yaml
@@ -9,7 +9,7 @@ directus:
        main:
          image:
            repository: directus/directus
-            tag: 11.7.2
+            tag: 11.10.0
            pullPolicy: IfNotPresent
          env:
            - name: PUBLIC_URL
@@ -66,18 +66,18 @@ directus:
            - name: REDIS_ENABLED
              value: true
            - name: REDIS_HOST
-              value: directus-valkey-primary
+              value: redis-replication-directus-master
            - name: REDIS_PORT
              value: 6379
            - name: REDIS_USERNAME
              valueFrom:
                secretKeyRef:
-                  name: directus-valkey-config
+                  name: directus-redis-config
                  key: user
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
-                  name: directus-valkey-config
+                  name: directus-redis-config
                  key: password
            - name: STORAGE_LOCATIONS
              value: s3
@@ -86,21 +86,24 @@ directus:
            - name: STORAGE_S3_KEY
              valueFrom:
                secretKeyRef:
-                  name: directus-minio-user-secret
+                  name: ceph-bucket-directus
                  key: AWS_ACCESS_KEY_ID
            - name: STORAGE_S3_SECRET
              valueFrom:
                secretKeyRef:
-                  name: directus-minio-user-secret
+                  name: ceph-bucket-directus
                  key: AWS_SECRET_ACCESS_KEY
            - name: STORAGE_S3_BUCKET
-              value: directus
+              valueFrom:
                configMapKeyRef:
                  name: ceph-bucket-directus
                  key: BUCKET_NAME
            - name: STORAGE_S3_REGION
              value: us-east-1
            - name: STORAGE_S3_ENDPOINT
-              value: http://minio.directus:80
+              value: http://rook-ceph-rgw-ceph-objectstore.rook-ceph.svc:80
            - name: STORAGE_S3_FORCE_PATH_STYLE
-              value: "true"
+              value: true
            - name: AUTH_PROVIDERS
              value: AUTHENTIK
            - name: AUTH_AUTHENTIK_DRIVER
@@ -127,12 +130,17 @@ directus:
              value: Authentik
            - name: TELEMETRY
              value: false
            - name: METRICS_ENABLED
              value: true
            - name: METRICS_TOKENS
              valueFrom:
                secretKeyRef:
                  name: directus-metric-token
                  key: metric-token
          resources:
            requests:
              cpu: 10m
              memory: 256Mi
  serviceAccount:
    create: true
  service:
    main:
      controller: main
@@ -141,43 +149,6 @@ directus:
          port: 80
          targetPort: 8055
          protocol: TCP
 minio:
  existingSecret:
    name: directus-minio-root-secret
  tenant:
    name: minio-directus
    configSecret:
      name: directus-minio-config-secret
    pools:
      - servers: 3
        name: pool
        volumesPerServer: 2
        size: 10Gi
        storageClassName: ceph-block
    mountPath: /export
    subPath: /data
    metrics:
      enabled: true
      port: 9000
      protocol: http
    certificate:
      requestAutoCert: false
  ingress:
    console:
      enabled: false
 valkey:
  architecture: standalone
  auth:
    enabled: true
    existingSecret: directus-valkey-config
    existingSecretPasswordKey: password
    usePasswordFiles: false
  primary:
    persistence:
      enabled: false
  replica:
    persistence:
      enabled: false
 cloudflared-directus:
  name: cloudflared-directus
  existingSecretName: directus-cloudflared-secret
@@ -205,3 +176,4 @@ postgres-17-cluster:
    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/directus/directus-postgresql-17-cluster
    endpointCredentials: directus-postgresql-17-cluster-backup-secret
    backupIndex: 2
    retentionPolicy: "7d"
--- a/clusters/cl01tl/applications/eigenfocus/Chart.yaml
+++ b/clusters/cl01tl/applications/eigenfocus/Chart.yaml
@@ -16,6 +16,6 @@ dependencies:
  - name: app-template
    alias: eigenfocus
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 3.7.3
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/eigenfocus.png
-appVersion: v1.1.0
+appVersion: 1.1.0
--- a/clusters/cl01tl/applications/eigenfocus/templates/external-secret.yaml
+++ b/clusters/cl01tl/applications/eigenfocus/templates/external-secret.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: eigenfocus-data-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: backup
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
--- a/clusters/cl01tl/applications/eigenfocus/templates/http-route.yaml
+++ b/clusters/cl01tl/applications/eigenfocus/templates/http-route.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: http-route-eigenfocus
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
--- a/clusters/cl01tl/applications/eigenfocus/templates/replication-source.yaml
+++ b/clusters/cl01tl/applications/eigenfocus/templates/replication-source.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: eigenfocus-data-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: backup
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: eigenfocus-data
--- a/clusters/cl01tl/applications/eigenfocus/values.yaml
+++ b/clusters/cl01tl/applications/eigenfocus/values.yaml
@@ -9,7 +9,7 @@ eigenfocus:
        main:
          image:
            repository: eigenfocus/eigenfocus
-            tag: 1.1.0-free
+            tag: 1.2.0-free
            pullPolicy: IfNotPresent
          env:
            - name: DEFAULT_HOST_URL
@@ -18,8 +18,6 @@ eigenfocus:
            requests:
              cpu: 10m
              memory: 128Mi
  serviceAccount:
    create: true
  service:
    main:
      controller: main
@@ -30,6 +28,7 @@ eigenfocus:
          protocol: HTTP
  persistence:
    data:
      forceRename: eigenfocus-data
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 2Gi
--- a/clusters/cl01tl/applications/element-web/Chart.yaml
+++ b/clusters/cl01tl/applications/element-web/Chart.yaml
@@ -17,11 +17,11 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: element-web
-    version: 1.4.10
+    version: 1.4.16
    repository: https://ananace.gitlab.io/charts
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.14.8
+    version: 1.19.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/element.png
 appVersion: v1.11.100
--- a/clusters/cl01tl/applications/element-web/templates/external-secret.yaml
+++ b/clusters/cl01tl/applications/element-web/templates/external-secret.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: element-web-cloudflared-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
--- a/clusters/cl01tl/applications/element-web/values.yaml
+++ b/clusters/cl01tl/applications/element-web/values.yaml
@@ -2,7 +2,7 @@ element-web:
  replicaCount: 1
  image:
    repository: vectorim/element-web
-    tag: v1.11.100
+    tag: v1.11.108
    pullPolicy: IfNotPresent
  defaultServer:
    url: https://matrix.alexlebens.dev
@@ -12,8 +12,8 @@ element-web:
    disable_3pid_login: true
    brand: "Alex Lebens"
    branding:
-      welcome_background_url: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/background-4.jpg
+      welcome_background_url: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/background-5.png
-      auth_header_logo_url: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+      auth_header_logo_url: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.png
    sso_redirect_options:
      immediate: true
    default_theme: dark
--- a/clusters/cl01tl/applications/freshrss/Chart.yaml
+++ b/clusters/cl01tl/applications/freshrss/Chart.yaml
@@ -20,11 +20,11 @@ dependencies:
  - name: app-template
    alias: freshrss
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 3.7.3
+    version: 4.2.0
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.14.8
+    version: 1.19.0
  - name: postgres-cluster
    alias: postgres-17-cluster
    version: 5.1.0
--- a/clusters/cl01tl/applications/freshrss/templates/external-secret.yaml
+++ b/clusters/cl01tl/applications/freshrss/templates/external-secret.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: freshrss-install-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -43,10 +41,8 @@ metadata:
  name: freshrss-oidc-secret
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/name: freshrss-oidc-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -84,8 +80,6 @@ metadata:
  labels:
    app.kubernetes.io/name: freshrss-cloudflared-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -109,8 +103,6 @@ metadata:
  labels:
    app.kubernetes.io/name: freshrss-data-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: backup
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -168,8 +160,6 @@ metadata:
  labels:
    app.kubernetes.io/name: freshrss-postgresql-17-cluster-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: database
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
--- a/clusters/cl01tl/applications/freshrss/templates/replication-source.yaml
+++ b/clusters/cl01tl/applications/freshrss/templates/replication-source.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: freshrss-data-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: backup
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: freshrss-data
--- a/clusters/cl01tl/applications/freshrss/values.yaml
+++ b/clusters/cl01tl/applications/freshrss/values.yaml
@@ -11,7 +11,7 @@ freshrss:
            runAsUser: 0
          image:
            repository: alpine
-            tag: 3.21.3
+            tag: 3.22.1
            pullPolicy: IfNotPresent
          command:
            - /bin/sh
@@ -28,14 +28,14 @@ freshrss:
              chown -R 568:568 /var/www/FreshRSS/extensions/xExtension-YouTubeChannel2RssFeed
          resources:
            requests:
-              cpu: 100m
+              cpu: 10m
              memory: 128Mi
        init-download-extension-2:
          securityContext:
            runAsUser: 0
          image:
            repository: alpine
-            tag: 3.21.3
+            tag: 3.22.1
            pullPolicy: IfNotPresent
          command:
            - /bin/sh
@@ -49,16 +49,38 @@ freshrss:
              git checkout;
              rm -rf /var/www/FreshRSS/extensions/xExtension-ImageProxy
              cp -r xExtension-ImageProxy /var/www/FreshRSS/extensions
-              chown -R 568:568 /var/www/FreshRSS/extensions/xExtension-YouTubeChannel2RssFeed
+              chown -R 568:568 /var/www/FreshRSS/extensions/xExtension-ImageProxy
          resources:
            requests:
-              cpu: 100m
+              cpu: 10m
              memory: 128Mi
        init-download-extension-3:
          securityContext:
            runAsUser: 0
          image:
            repository: alpine
            tag: 3.22.1
            pullPolicy: IfNotPresent
          command:
            - /bin/sh
            - -ec
            - |
              cd /tmp;
              wget https://github.com/zimmra/xExtension-karakeep-button/archive/refs/tags/v1.1.tar.gz;
              tar -xvzf *.tar.gz;
              rm -rf /var/www/FreshRSS/extensions/xExtension-karakeep-button
              mkdir /var/www/FreshRSS/extensions/xExtension-karakeep-button
              cp -r /tmp/xExtension-karakeep-button-*/* /var/www/FreshRSS/extensions/xExtension-karakeep-button
              chown -R 568:568 /var/www/FreshRSS/extensions/xExtension-karakeep-button
          resources:
            requests:
              cpu: 10m
              memory: 128Mi
      containers:
        main:
          image:
            repository: freshrss/freshrss
-            tag: 1.26.2
+            tag: 1.26.3
            pullPolicy: IfNotPresent
          env:
            - name: PGID
@@ -131,8 +153,6 @@ freshrss:
            requests:
              cpu: 10m
              memory: 128Mi
  serviceAccount:
    create: true
  service:
    main:
      controller: main
@@ -165,6 +185,9 @@ freshrss:
          init-download-extension-2:
            - path: /var/www/FreshRSS/extensions
              readOnly: false
          init-download-extension-3:
            - path: /var/www/FreshRSS/extensions
              readOnly: false
          main:
            - path: /var/www/FreshRSS/extensions
              readOnly: false
@@ -194,3 +217,4 @@ postgres-17-cluster:
    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/freshrss/freshrss-postgresql-17-cluster
    endpointCredentials: freshrss-postgresql-17-cluster-backup-secret
    backupIndex: 3
    retentionPolicy: "7d"
--- a/clusters/cl01tl/applications/home-assistant/Chart.yaml
+++ b/clusters/cl01tl/applications/home-assistant/Chart.yaml
@@ -18,6 +18,6 @@ dependencies:
  - name: app-template
    alias: home-assistant
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 3.7.3
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/home-assistant.png
-appVersion: 2025.5.1
+appVersion: 2025.5.2
--- a/clusters/cl01tl/applications/home-assistant/templates/external-secret.yaml
+++ b/clusters/cl01tl/applications/home-assistant/templates/external-secret.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: home-assistant-code-server-password-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -38,8 +36,6 @@ metadata:
  labels:
    app.kubernetes.io/name: home-assistant-token-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
--- a/clusters/cl01tl/applications/home-assistant/templates/http-route.yaml
+++ b/clusters/cl01tl/applications/home-assistant/templates/http-route.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: http-route-home-assistant
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
@@ -38,8 +36,6 @@ metadata:
  labels:
    app.kubernetes.io/name: http-route-home-assistant-code-server
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
--- a/clusters/cl01tl/applications/home-assistant/templates/service-monitor.yaml
+++ b/clusters/cl01tl/applications/home-assistant/templates/service-monitor.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: home-assistant
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  selector:
--- a/clusters/cl01tl/applications/home-assistant/values.yaml
+++ b/clusters/cl01tl/applications/home-assistant/values.yaml
@@ -9,19 +9,19 @@ home-assistant:
        main:
          image:
            repository: ghcr.io/home-assistant/home-assistant
-            tag: 2025.5.2
+            tag: 2025.7.4
            pullPolicy: IfNotPresent
          env:
            - name: TZ
              value: US/Central
          resources:
            requests:
-              cpu: 1
+              cpu: 50m
-              memory: 2Gi
+              memory: 512Mi
        code-server:
          image:
            repository: ghcr.io/linuxserver/code-server
-            tag: 4.100.2@sha256:511445e8877da1665b97d2ca39f03009a36edadba9959eefcc8ff3d1b0f42251
+            tag: 4.102.3@sha256:9d5bd6a6d04132cafb664e89a0eb87e632d142a4d4a9bb937f22752d37aa64e6
            pullPolicy: IfNotPresent
          env:
            - name: TZ
@@ -39,8 +39,6 @@ home-assistant:
            requests:
              cpu: 10m
              memory: 128Mi
  serviceAccount:
    create: true
  service:
    main:
      controller: main
@@ -58,6 +56,7 @@ home-assistant:
          protocol: HTTP
  persistence:
    config:
      forceRename: home-assistant-config
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 5Gi
--- a/clusters/cl01tl/applications/homepage-dev/Chart.yaml
+++ b/clusters/cl01tl/applications/homepage-dev/Chart.yaml
@@ -18,10 +18,10 @@ dependencies:
  - name: app-template
    alias: homepage
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 3.7.3
+    version: 4.2.0
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.14.8
+    version: 1.19.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/homepage.png
 appVersion: v1.2.0
--- a/clusters/cl01tl/applications/homepage-dev/templates/external-secret.yaml
+++ b/clusters/cl01tl/applications/homepage-dev/templates/external-secret.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: homepage-dev-cloudflared-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
--- a/clusters/cl01tl/applications/homepage-dev/values.yaml
+++ b/clusters/cl01tl/applications/homepage-dev/values.yaml
@@ -11,7 +11,7 @@ homepage:
        main:
          image:
            repository: ghcr.io/gethomepage/homepage
-            tag: v1.2.0
+            tag: v1.4.3
            pullPolicy: IfNotPresent
          env:
            - name: HOMEPAGE_ALLOWED_HOSTS
@@ -20,8 +20,6 @@ homepage:
            requests:
              cpu: 10m
              memory: 128Mi
  serviceAccount:
    create: true
  configMaps:
    config:
      enabled: true
@@ -29,18 +27,18 @@ homepage:
        docker.yaml: ""
        kubernetes.yaml: ""
        settings.yaml: |
-          favicon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+          favicon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.svg
          headerStyle: clean
          hideVersion: true
          color: zinc
          background:
-            image: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/background-4.jpg
+            image: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/background-5.png
            brightness: 50
          theme: dark
          disableCollapse: true
        widgets.yaml: |
          - logo:
-              icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+              icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.png
          - datetime:
              text_size: xl
              format:
@@ -70,20 +68,26 @@ homepage:
                  href: https://gitea.alexlebens.dev
                  siteMonitor: https://gitea.alexlebens.dev
                  statusStyle: dot
              - Code:
                  icon: sh-visual-studio-code.webp
                  description: VS Code
                  href: https://codeserver.alexlebens.dev
                  siteMonitor: https://codeserver.alexlebens.dev
                  statusStyle: dot
              - Site:
-                  icon: https://d21zlbwtcn424f.cloudfront.net/icon_white.png
+                  icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.png
                  description: Profile Website
                  href: https://www.alexlebens.dev
                  siteMonitor: https://www.alexlebens.dev
                  statusStyle: dot
              - Content Management:
-                  icon: directus.webp
+                  icon: directus.png
                  description: Directus
                  href: https://directus.alexlebens.dev
                  siteMonitor: https://directus.alexlebens.dev
                  statusStyle: dot
              - Social Media Management:
-                  icon: postiz.png
+                  icon: sh-postiz.webp
                  description: Postiz
                  href: https://postiz.alexlebens.dev
                  siteMonitor: https://postiz.alexlebens.dev
@@ -131,7 +135,7 @@ homepage:
    config:
      enabled: true
      type: configMap
-      name: homepage-dev-config
+      name: homepage-dev
      advancedMounts:
        main:
          main:
--- a/clusters/cl01tl/applications/homepage/Chart.yaml
+++ b/clusters/cl01tl/applications/homepage/Chart.yaml
@@ -16,6 +16,6 @@ dependencies:
  - name: app-template
    alias: homepage
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 3.7.3
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/homepage.png
 appVersion: v1.2.0
--- a/clusters/cl01tl/applications/homepage/templates/cluster-role-binding.yaml
+++ b/clusters/cl01tl/applications/homepage/templates/cluster-role-binding.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: homepage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
--- a/clusters/cl01tl/applications/homepage/templates/cluster-role.yaml
+++ b/clusters/cl01tl/applications/homepage/templates/cluster-role.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: homepage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 rules:
  - apiGroups:
@@ -28,13 +26,20 @@ rules:
      - get
      - list
  - apiGroups:
      - traefik.containo.us
      - traefik.io
    resources:
      - ingressroutes
    verbs:
      - get
      - list
  - apiGroups:
      - gateway.networking.k8s.io
    resources:
      - httproutes
      - gateways
    verbs:
      - get
      - list
  - apiGroups:
      - metrics.k8s.io
    resources:
@@ -43,9 +48,3 @@ rules:
    verbs:
      - get
      - list
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - customresourcedefinitions/status
    verbs:
      - get
--- a/clusters/cl01tl/applications/homepage/templates/external-secret.yaml
+++ b/clusters/cl01tl/applications/homepage/templates/external-secret.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: homepage-keys-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
--- a/clusters/cl01tl/applications/homepage/templates/http-route.yaml
+++ b/clusters/cl01tl/applications/homepage/templates/http-route.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: http-route-homepage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
--- a/clusters/cl01tl/applications/homepage/templates/service.yaml
+++ b/clusters/cl01tl/applications/homepage/templates/service.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: gitea-ps10rp
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: tailscale
    app.kubernetes.io/part-of: {{ .Release.Name }}
  annotations:
    tailscale.com/tailnet-fqdn: gitea-ps10rp.boreal-beaufort.ts.net
@@ -24,8 +22,6 @@ metadata:
  labels:
    app.kubernetes.io/name: home-ps10rp
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: tailscale
    app.kubernetes.io/part-of: {{ .Release.Name }}
  annotations:
    tailscale.com/tailnet-fqdn: home-ps10rp.boreal-beaufort.ts.net
--- a/clusters/cl01tl/applications/homepage/values.yaml
+++ b/clusters/cl01tl/applications/homepage/values.yaml
@@ -7,11 +7,15 @@ homepage:
      annotations:
        reloader.stakater.com/auto: "true"
      strategy: Recreate
      serviceAccount:
        name: homepage
      pod:
        automountServiceAccountToken: true
      containers:
        main:
          image:
            repository: ghcr.io/gethomepage/homepage
-            tag: v1.2.0
+            tag: v1.4.3
            pullPolicy: IfNotPresent
          env:
            - name: HOMEPAGE_ALLOWED_HOSTS
@@ -24,8 +28,9 @@ homepage:
              cpu: 10m
              memory: 256Mi
  serviceAccount:
-    create: true
+    homepage:
-    name: homepage
+      enabled: true
      staticToken: true
  configMaps:
    config:
      enabled: true
@@ -34,12 +39,12 @@ homepage:
        kubernetes.yaml: |
          mode: cluster
        settings.yaml: |
-          favicon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+          favicon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.svg
          headerStyle: clean
          hideVersion: true
          color: zinc
          background:
-            image: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/background-4.jpg
+            image: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/background-5.png
            brightness: 50
          theme: dark
          disableCollapse: true
@@ -56,6 +61,9 @@ homepage:
            - Code:
                tab: Tools
                icon: mdi-code-block-braces-#ffffff
            - Automation:
                tab: Tools
                icon: mdi-wrench-#ffffff
            - Monitoring:
                tab: Tools
                icon: mdi-chart-line-#ffffff
@@ -91,7 +99,7 @@ homepage:
                icon: mdi-cloud-#ffffff
        widgets.yaml: |
          - logo:
-              icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+              icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.png
          - kubernetes:
              cluster:
                show: true
@@ -174,7 +182,7 @@ homepage:
                  statusStyle: dot
          - Public:
              - Site:
-                  icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+                  icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.png
                  description: Profile Website
                  href: https://www.alexlebens.dev
                  siteMonitor: https://www.alexlebens.dev
@@ -186,7 +194,7 @@ homepage:
                  siteMonitor: https://directus.alexlebens.dev
                  statusStyle: dot
              - Social Media Management:
-                  icon: postiz.png
+                  icon: sh-postiz.webp
                  description: Postiz
                  href: https://postiz.alexlebens.dev
                  siteMonitor: https://postiz.alexlebens.dev
@@ -307,21 +315,43 @@ homepage:
                  href: https://argocd.alexlebens.net
                  siteMonitor: http://argocd-server.argocd:80
                  statusStyle: dot
-                  namespace: argocd
+              - Docker Deployment:
              - Workflows:
                  icon: sh-argo-cd.webp
                  description: Argo Workflows
                  href: https://argo-workflows.alexlebens.net
                  siteMonitor: http://argo-workflows-server.argo-workflows:2746
                  statusStyle: dot
                  namespace: argocd
              - Deployment:
                  icon: sh-komodo-light.webp
                  description: Komodo
                  href: https://komodo.alexlebens.net
                  siteMonitor: http://komodo.komodo:80
                  statusStyle: dot
-                  namespace: komodo
+          - Automation:
              - Deployment Workflows:
                  icon: sh-argo-cd.webp
                  description: Argo Workflows
                  href: https://argo-workflows.alexlebens.net
                  siteMonitor: http://argo-workflows-server.argo-workflows:2746
                  statusStyle: dot
              - API Workflows:
                  icon: sh-n8n.webp
                  description: n8n
                  href: https://n8n.alexlebens.net
                  siteMonitor: http://n8n-main.n8n:80
                  statusStyle: dot
              - Jobs:
                  icon: https://raw.githubusercontent.com/mshade/kronic/main/static/android-chrome-192x192.png
                  description: Kronic
                  href: https://kronic.alexlebens.net
                  siteMonitor: http://kronic.kronic:80
                  statusStyle: dot
              - Uptime:
                  icon: sh-gatus.webp
                  description: Gatus
                  href: https://gatus.alexlebens.net
                  siteMonitor: http://gatus.gatus:80
                  statusStyle: dot
              - Tools:
                  icon: sh-omnitools.webp
                  description: OmniTools
                  href: https://omni-tools.alexlebens.net
                  siteMonitor: http://omni-tools.omni-tools:80
                  statusStyle: dot
          - Monitoring:
              - Kubernetes:
                  icon: sh-headlamp.webp
@@ -350,6 +380,23 @@ homepage:
                  widget:
                    type: prometheus
                    url: http://kube-prometheus-stack-prometheus.kube-prometheus-stack:9090
              - Alerting:
                  icon: sh-prometheus-light.webp
                  description: Alertmanager
                  href: https://alertmanager.alexlebens.net
                  siteMonitor: http://kube-prometheus-stack-alertmanager.kube-prometheus-stack:9093
                  statusStyle: dot
                  widget:
                    type: prometheusmetric
                    url: http://kube-prometheus-stack-prometheus.kube-prometheus-stack:9090
                    refreshInterval: 120s
                    metrics:
                      - label: Alerts Active
                        query: alertmanager_alerts{state="active"}
                      - label: Metric Database Size
                        query: prometheus_tsdb_storage_blocks_bytes
                        format:
                          type: bytes
              - Tautulli:
                  icon: sh-tautulli.webp
                  description: Plex Monitoring
@@ -376,11 +423,17 @@ homepage:
                  siteMonitor: http://authentik-server.authentik:80
                  statusStyle: dot
              - Email:
-                  icon: sh-stalwart-mail-server.webp
+                  icon: sh-stalwart.webp
                  description: Stalwart
                  href: https://stalwart.alexlebens.net
                  siteMonitor: http://stalwart.stalwart:80
                  statusStyle: dot
              - Notifications:
                  icon: sh-ntfy.webp
                  description: ntfy
                  href: https://ntfy.alexlebens.net
                  siteMonitor: http://ntfy.ntfy:80
                  statusStyle: dot
              - Reverse Proxy:
                  icon: sh-traefik.webp
                  description: Traefik
@@ -432,6 +485,12 @@ homepage:
                  href: https://pikvm.alexlebens.net
                  siteMonitor: https://pikvm.alexlebens.net
                  statusStyle: dot
              - Server Plug:
                  icon: sh-shelly.webp
                  description: Shelly
                  href: http://it05sp.alexlebens.net
                  siteMonitor: http://it05sp.alexlebens.net
                  statusStyle: dot
          - Storage:
              - Cluster Storage:
                  icon: sh-ceph.webp
@@ -445,24 +504,18 @@ homepage:
                  href: https://pgadmin.alexlebens.net
                  siteMonitor: http://pgadmin.pgadmin:80
                  statusStyle: dot
              - Database:
                  icon: sh-whodb.webp
                  description: WhoDB
                  href: https://whodb.alexlebens.net
                  siteMonitor: http://whodb.whodb:80
                  statusStyle: dot
              - Secrets:
                  icon: sh-hashicorp-vault.webp
                  description: Vault
                  href: https://vault.alexlebens.net
                  siteMonitor: http://vault.vault:8200
                  statusStyle: dot
              - Object Storage (Outline):
                  icon: sh-minio.webp
                  description: Minio Tenant
                  href: https://minio-outline.alexlebens.net
                  siteMonitor: http://minio-outline-console.outline:9090
                  statusStyle: dot
              - Object Storage (Directus):
                  icon: sh-minio.webp
                  description: Minio Tenant
                  href: https://minio-directus.alexlebens.net
                  siteMonitor: http://minio-directus-console.directus:9090
                  statusStyle: dot
          - TV Shows:
              - Sonarr:
                  icon: sh-sonarr.webp
@@ -590,6 +643,12 @@ homepage:
                  href: https://prowlarr.alexlebens.net
                  siteMonitor: http://prowlarr.prowlarr:80
                  statusStyle: dot
              - Bazarr:
                  icon: sh-bazarr.webp
                  description: Indexers
                  href: https://bazarr.alexlebens.net
                  siteMonitor: http://bazarr.bazarr:80
                  statusStyle: dot
              - Huntarr:
                  icon: https://raw.githubusercontent.com/plexguide/Huntarr.io/main/frontend/static/logo/128.png
                  description: Indexers
@@ -629,9 +688,6 @@ homepage:
              - Github:
                  - abbr: GH
                    href: https://github.com/alexlebens
              - Renovate:
                  - abbr: RN
                    href: https://developer.mend.io/[platform]/alexlebens/infrastructure
              - Digital Ocean:
                  - abbr: DO
                    href: https://www.digitalocean.com/
@@ -687,7 +743,7 @@ homepage:
    config:
      enabled: true
      type: configMap
-      name: homepage-config
+      name: homepage
      advancedMounts:
        main:
          main:
--- a/clusters/cl01tl/applications/huntarr/Chart.yaml
+++ b/clusters/cl01tl/applications/huntarr/Chart.yaml
@@ -16,6 +16,6 @@ dependencies:
  - name: app-template
    alias: huntarr
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 3.7.3
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/huntarr.png
-appVersion: 6.3.6
+appVersion: 7.0.0
--- a/clusters/cl01tl/applications/huntarr/templates/http-route.yaml
+++ b/clusters/cl01tl/applications/huntarr/templates/http-route.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: http-route-huntarr
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
--- a/clusters/cl01tl/applications/huntarr/values.yaml
+++ b/clusters/cl01tl/applications/huntarr/values.yaml
@@ -8,8 +8,8 @@ huntarr:
      containers:
        main:
          image:
-            repository: huntarr/huntarr
+            repository: ghcr.io/plexguide/huntarr
-            tag: 6.5.15
+            tag: 8.1.15
            pullPolicy: IfNotPresent
          env:
            - name: TZ
@@ -18,8 +18,6 @@ huntarr:
            requests:
              cpu: 100m
              memory: 256Mi
  serviceAccount:
    create: true
  service:
    main:
      controller: main
@@ -30,6 +28,7 @@ huntarr:
          protocol: HTTP
  persistence:
    config:
      forceRename: huntarr-config
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 1Gi
--- a/clusters/cl01tl/applications/immich/Chart.yaml
+++ b/clusters/cl01tl/applications/immich/Chart.yaml
@@ -8,10 +8,8 @@ keywords:
 home: https://wiki.alexlebens.dev/s/9377ae08-2041-4b6d-bc2b-61a4f5e8faae
 sources:
  - https://github.com/immich-app/immich
  - https://github.com/valkey-io/valkey
  - https://github.com/cloudnative-pg/cloudnative-pg
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
  - name: alexlebens
@@ -19,10 +17,7 @@ dependencies:
  - name: app-template
    alias: immich
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 3.7.3
+    version: 4.2.0
  - name: valkey
    version: 3.0.6
    repository: oci://harbor.alexlebens.net/proxy-registry-1.docker.io/bitnamicharts
  - name: postgres-cluster
    alias: postgres-16-cluster
    version: 5.1.0
--- a/clusters/cl01tl/applications/immich/templates/external-secrets.yaml
+++ b/clusters/cl01tl/applications/immich/templates/external-secrets.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: immich-config-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: config
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -31,8 +29,6 @@ metadata:
  labels:
    app.kubernetes.io/name: immich-postgresql-16-cluster-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: database
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
--- a/clusters/cl01tl/applications/immich/templates/http-route.yaml
+++ b/clusters/cl01tl/applications/immich/templates/http-route.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: http-route-immich
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
--- a/clusters/cl01tl/applications/immich/templates/persistent-volume-claim.yaml
+++ b/clusters/cl01tl/applications/immich/templates/persistent-volume-claim.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: immich-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: storage
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeName: immich-nfs-storage
--- a/clusters/cl01tl/applications/immich/templates/persistent-volume.yaml
+++ b/clusters/cl01tl/applications/immich/templates/persistent-volume.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: immich-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: storage
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  persistentVolumeReclaimPolicy: Retain
--- a/clusters/cl01tl/applications/immich/templates/redis-replication.yaml
+++ b/clusters/cl01tl/applications/immich/templates/redis-replication.yaml
@@ -0,0 +1,32 @@
 apiVersion: redis.redis.opstreelabs.in/v1beta2
 kind: RedisReplication
 metadata:
  name: redis-replication-immich
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: redis-replication-immich
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  clusterSize: 3
  podSecurityContext:
    runAsUser: 1000
    fsGroup: 1000
  kubernetesConfig:
    image: quay.io/opstree/redis:v8.0.3
    imagePullPolicy: IfNotPresent
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
  storage:
    volumeClaimTemplate:
      spec:
        storageClassName: ceph-block
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 1Gi
  redisExporter:
    enabled: true
    image: quay.io/opstree/redis-exporter:v1.48.0
--- a/clusters/cl01tl/applications/immich/templates/service-monitor.yaml
+++ b/clusters/cl01tl/applications/immich/templates/service-monitor.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: immich
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  selector:
@@ -23,3 +21,24 @@ spec:
      interval: 3m
      scrapeTimeout: 1m
      path: /metrics
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  name: redis-replication-immich
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: redis-replication-immich
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
    redis-operator: "true"
    env: production
 spec:
  selector:
    matchLabels:
      redis_setup_type: replication
  endpoints:
    - port: redis-exporter
      interval: 30s
      scrapeTimeout: 10s
--- a/clusters/cl01tl/applications/immich/values.yaml
+++ b/clusters/cl01tl/applications/immich/values.yaml
@@ -21,7 +21,7 @@ immich:
            - name: IMMICH_MACHINE_LEARNING_URL
              value: http://immich-machine-learning.immich:3003
            - name: REDIS_HOSTNAME
-              value: immich-valkey-primary
+              value: redis-replication-immich-master
            - name: DB_VECTOR_EXTENSION
              value: pgvecto.rs
            - name: DB_HOSTNAME
@@ -99,7 +99,7 @@ immich:
        main:
          image:
            repository: ghcr.io/immich-app/immich-machine-learning
-            tag: v1.132.1
+            tag: v1.137.3
            pullPolicy: IfNotPresent
          env:
            - name: TRANSFORMERS_CACHE
@@ -136,8 +136,6 @@ immich:
              gpu.intel.com/i915: 1
              cpu: 10m
              memory: 256Mi
  serviceAccount:
    create: true
  service:
    main:
      controller: main
@@ -173,13 +171,6 @@ immich:
              readOnly: true
              mountPropagation: None
              subPath: immich.json
    media:
      existingClaim: immich-nfs-storage
      advancedMounts:
        main:
          main:
            - path: /usr/src/app/upload
              readOnly: false
    cache:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
@@ -190,17 +181,13 @@ immich:
          main:
            - path: /cache
              readOnly: false
-valkey:
+    media:
-  architecture: standalone
+      existingClaim: immich-nfs-storage
-  auth:
+      advancedMounts:
-    enabled: false
+        main:
-    usePasswordFiles: false
+          main:
-  primary:
+            - path: /usr/src/app/upload
-    persistence:
+              readOnly: false
      enabled: false
  replica:
    persistence:
      enabled: false
 postgres-16-cluster:
  # Tensorchord
  #--- https://github.com/immich-app/immich/discussions/9060
@@ -241,3 +228,4 @@ postgres-16-cluster:
    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/immich/immich-postgresql-16-cluster
    endpointCredentials: immich-postgresql-16-cluster-backup-secret
    backupIndex: 2
    retentionPolicy: "7d"
--- a/clusters/cl01tl/applications/jellyfin/Chart.yaml
+++ b/clusters/cl01tl/applications/jellyfin/Chart.yaml
@@ -20,6 +20,6 @@ dependencies:
  - name: app-template
    alias: jellyfin
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 3.7.3
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/jellyfin.png
 appVersion: 10.10.7
--- a/clusters/cl01tl/applications/jellyfin/templates/external-secret.yaml
+++ b/clusters/cl01tl/applications/jellyfin/templates/external-secret.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: jellyfin-config-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: backup
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
--- a/clusters/cl01tl/applications/jellyfin/templates/http-route.yaml
+++ b/clusters/cl01tl/applications/jellyfin/templates/http-route.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: http-route-jellyfin
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
--- a/clusters/cl01tl/applications/jellyfin/templates/persistent-volume-claim.yaml
+++ b/clusters/cl01tl/applications/jellyfin/templates/persistent-volume-claim.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: jellyfin-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: storage
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeName: jellyfin-nfs-storage
@@ -27,8 +25,6 @@ metadata:
  labels:
    app.kubernetes.io/name: jellyfin-youtube-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: storage
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeName: jellyfin-youtube-nfs-storage
--- a/clusters/cl01tl/applications/jellyfin/templates/persistent-volume.yaml
+++ b/clusters/cl01tl/applications/jellyfin/templates/persistent-volume.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: jellyfin-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: storage
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  persistentVolumeReclaimPolicy: Retain
@@ -33,8 +31,6 @@ metadata:
  labels:
    app.kubernetes.io/name: jellyfin-youtube-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: storage
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  persistentVolumeReclaimPolicy: Retain
--- a/clusters/cl01tl/applications/jellyfin/templates/replication-source.yaml
+++ b/clusters/cl01tl/applications/jellyfin/templates/replication-source.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: jellyfin-config-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: backup
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: jellyfin-config
--- a/clusters/cl01tl/applications/jellyfin/values.yaml
+++ b/clusters/cl01tl/applications/jellyfin/values.yaml
@@ -25,8 +25,6 @@ jellyfin:
              gpu.intel.com/i915: 1
              cpu: 1
              memory: 2Gi
  serviceAccount:
    create: true
  service:
    main:
      controller: main
@@ -37,6 +35,7 @@ jellyfin:
          protocol: HTTP
  persistence:
    config:
      forceRename: jellyfin-config
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 100Gi
--- a/clusters/cl01tl/applications/jellystat/Chart.yaml
+++ b/clusters/cl01tl/applications/jellystat/Chart.yaml
@@ -18,7 +18,7 @@ dependencies:
  - name: app-template
    alias: jellystat
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 3.7.3
+    version: 4.2.0
  - name: postgres-cluster
    alias: postgres-17-cluster
    version: 5.1.0
--- a/clusters/cl01tl/applications/jellystat/templates/external-secret.yaml
+++ b/clusters/cl01tl/applications/jellystat/templates/external-secret.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: jellystat-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -45,8 +43,6 @@ metadata:
  labels:
    app.kubernetes.io/name: jellystat-data-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: backup
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -104,8 +100,6 @@ metadata:
  labels:
    app.kubernetes.io/name: jellystat-postgresql-17-cluster-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: database
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
--- a/clusters/cl01tl/applications/jellystat/templates/http-route.yaml
+++ b/clusters/cl01tl/applications/jellystat/templates/http-route.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: http-route-jellystat
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
--- a/clusters/cl01tl/applications/jellystat/templates/replication-source.yaml
+++ b/clusters/cl01tl/applications/jellystat/templates/replication-source.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: jellystat-data-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: backup
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: jellystat-data
--- a/clusters/cl01tl/applications/jellystat/values.yaml
+++ b/clusters/cl01tl/applications/jellystat/values.yaml
@@ -58,8 +58,6 @@ jellystat:
            requests:
              cpu: 10m
              memory: 256Mi
  serviceAccount:
    create: true
  service:
    main:
      controller: main
@@ -70,6 +68,7 @@ jellystat:
          protocol: HTTP
  persistence:
    data:
      forceRename: jellystat-data
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 5Gi
@@ -103,4 +102,4 @@ postgres-17-cluster:
    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/jellystat/jellystat-postgresql-17-cluster
    endpointCredentials: jellystat-postgresql-17-cluster-backup-secret
    backupIndex: 2
-    retentionPolicy: "7d"
+    retentionPolicy: "3d"
--- a/clusters/cl01tl/applications/karakeep/Chart.yaml
+++ b/clusters/cl01tl/applications/karakeep/Chart.yaml
@@ -1,9 +1,8 @@
 apiVersion: v2
-name: hoarder
+name: karakeep
 version: 1.0.0
 description: Karakeep
 keywords:
  - hoarder
  - karakeep
  - bookmarks
 home: https://wiki.alexlebens.dev/s/f8177591-8253-4e21-82d5-a556f0aeafad
@@ -19,15 +18,15 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: app-template
-    alias: hoarder
+    alias: karakeep
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 3.7.3
+    version: 4.2.0
  - name: meilisearch
-    version: 0.13.0
+    version: 0.14.0
    repository: https://meilisearch.github.io/meilisearch-kubernetes
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.14.8
+    version: 1.19.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/webp/karakeep.webp
-appVersion: 0.24.1
+appVersion: 0.26.0
--- a/clusters/cl01tl/applications/karakeep/templates/external-secret.yaml
+++ b/clusters/cl01tl/applications/karakeep/templates/external-secret.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: karakeep-key-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -21,6 +19,13 @@ spec:
        key: /cl01tl/karakeep/key
        metadataPolicy: None
        property: key
    - secretKey: prometheus-token
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/karakeep/key
        metadataPolicy: None
        property: prometheus-token
 ---
 apiVersion: external-secrets.io/v1
@@ -31,8 +36,6 @@ metadata:
  labels:
    app.kubernetes.io/name: karakeep-oidc-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -63,8 +66,6 @@ metadata:
  labels:
    app.kubernetes.io/name: karakeep-meilisearch-master-key-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: meilisearch
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -88,8 +89,6 @@ metadata:
  labels:
    app.kubernetes.io/name: karakeep-cloudflared-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -108,13 +107,11 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: hoarder-data-backup-secret
+  name: karakeep-data-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: hoarder-data-backup-secret
+    app.kubernetes.io/name: karakeep-data-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: backup
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
@@ -125,7 +122,7 @@ spec:
      mergePolicy: Merge
      engineVersion: v2
      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/hoarder/hoarder-data"
+        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/karakeep/karakeep-data"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
--- a/clusters/cl01tl/applications/karakeep/templates/object-bucket-claim.yaml
+++ b/clusters/cl01tl/applications/karakeep/templates/object-bucket-claim.yaml
@@ -0,0 +1,11 @@
 apiVersion: objectbucket.io/v1alpha1
 kind: ObjectBucketClaim
 metadata:
  name: ceph-bucket-karakeep
  labels:
    app.kubernetes.io/name: ceph-bucket-karakeep
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  generateBucketName: bucket-karakeep
  storageClassName: ceph-bucket
--- a/clusters/cl01tl/applications/karakeep/templates/replication-source.yaml
+++ b/clusters/cl01tl/applications/karakeep/templates/replication-source.yaml
@@ -1,21 +1,19 @@
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
-  name: hoarder-data-backup-source
+  name: karakeep-data-backup-source
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: hoarder-data-backup-source
+    app.kubernetes.io/name: karakeep-data-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: backup
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
-  sourcePVC: hoarder-data
+  sourcePVC: karakeep-data
  trigger:
    schedule: 0 4 * * *
  restic:
    pruneIntervalDays: 7
-    repository: hoarder-data-backup-secret
+    repository: karakeep-data-backup-secret
    retain:
      hourly: 1
      daily: 3
--- a/clusters/cl01tl/applications/karakeep/templates/service-monitor.yaml
+++ b/clusters/cl01tl/applications/karakeep/templates/service-monitor.yaml
@@ -0,0 +1,23 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  name: karakeep
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: karakeep
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  endpoints:
    - port: http
      interval: 30s
      scrapeTimeout: 15s
      path: /api/metrics
      authorization:
        credentials:
          key: prometheus-token
          name: karakeep-key-secret
  selector:
    matchLabels:
      app.kubernetes.io/name: karakeep
      app.kubernetes.io/instance: {{ .Release.Name }}
--- a/clusters/cl01tl/applications/karakeep/values.yaml
+++ b/clusters/cl01tl/applications/karakeep/values.yaml
@@ -1,4 +1,4 @@
-hoarder:
+karakeep:
  controllers:
    main:
      type: deployment
@@ -9,11 +9,13 @@ hoarder:
        main:
          image:
            repository: ghcr.io/karakeep-app/karakeep
-            tag: 0.24.1
+            tag: 0.26.0
            pullPolicy: IfNotPresent
          env:
            - name: DATA_DIR
              value: /data
            - name: DB_WAL_MODE
              value: true
            - name: NEXTAUTH_URL
              value: https://karakeep.alexlebens.dev/
            - name: NEXTAUTH_SECRET
@@ -21,15 +23,41 @@ hoarder:
                secretKeyRef:
                  name: karakeep-key-secret
                  key: key
            - name: PROMETHEUS_AUTH_TOKEN
              valueFrom:
                secretKeyRef:
                  name: karakeep-key-secret
                  key: prometheus-token
            - name: ASSET_STORE_S3_ENDPOINT
              value: http://rook-ceph-rgw-ceph-objectstore.rook-ceph.svc:80
            - name: ASSET_STORE_S3_REGION
              value: us-east-1
            - name: ASSET_STORE_S3_BUCKET
              valueFrom:
                configMapKeyRef:
                  name: ceph-bucket-karakeep
                  key: BUCKET_NAME
            - name: ASSET_STORE_S3_ACCESS_KEY_ID
              valueFrom:
                secretKeyRef:
                  name: ceph-bucket-karakeep
                  key: AWS_ACCESS_KEY_ID
            - name: ASSET_STORE_S3_SECRET_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: ceph-bucket-karakeep
                  key: AWS_SECRET_ACCESS_KEY
            - name: ASSET_STORE_S3_FORCE_PATH_STYLE
              value: true
            - name: MEILI_ADDR
-              value: http://hoarder-meilisearch.hoarder:7700
+              value: http://karakeep-meilisearch.karakeep:7700
            - name: MEILI_MASTER_KEY
              valueFrom:
                secretKeyRef:
                  name: karakeep-meilisearch-master-key-secret
                  key: MEILI_MASTER_KEY
            - name: BROWSER_WEB_URL
-              value: http://hoarder.hoarder:9222
+              value: http://karakeep.karakeep:9222
            - name: DISABLE_SIGNUPS
              value: false
            - name: OAUTH_PROVIDER_NAME
@@ -49,13 +77,13 @@ hoarder:
                  name: karakeep-oidc-secret
                  key: AUTHENTIK_CLIENT_SECRET
            - name: OLLAMA_BASE_URL
-              value: http://ollama-server-1.ollama:11434
+              value: http://ollama-server-3.ollama:11434
            - name: OLLAMA_KEEP_ALIVE
              value: 5m
            - name: INFERENCE_TEXT_MODEL
-              value: llama3.1:8b
+              value: gemma3:4b
            - name: INFERENCE_IMAGE_MODEL
-              value: llama3.2-vision:11b
+              value: granite3.2-vision:2b
            - name: EMBEDDING_TEXT_MODEL
              value: mxbai-embed-large
            - name: INFERENCE_JOB_TIMEOUT_SEC
@@ -80,8 +108,6 @@ hoarder:
            requests:
              cpu: 10m
              memory: 128Mi
  serviceAccount:
    create: true
  service:
    main:
      controller: main
--- a/clusters/cl01tl/applications/kiwix/Chart.yaml
+++ b/clusters/cl01tl/applications/kiwix/Chart.yaml
@@ -16,6 +16,6 @@ dependencies:
  - name: app-template
    alias: kiwix
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 3.7.3
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kiwix-dark.png
 appVersion: 3.7.0
--- a/clusters/cl01tl/applications/kiwix/templates/http-route.yaml
+++ b/clusters/cl01tl/applications/kiwix/templates/http-route.yaml
@@ -6,8 +6,6 @@ metadata:
  labels:
    app.kubernetes.io/name: http-route-kiwix
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
--- a/Show More
+++ b/Show More