tmp/trivy (#4829)

Reviewed-on: #4829

clusters/cl01tl/helm/argocd/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 9.4.10
+  version: 9.4.11
-digest: sha256:795aad956acef3f5efb8160390caf9b9792b7b4150d3a7984f1c5edbad92dfaa
+digest: sha256:7726a0806d7ab4e0c2f5942aceee4ce363decf63d54a545a91b537559e5a9f0f
-generated: "2026-03-10T18:58:35.720448421Z"
+generated: "2026-03-17T13:05:43.394982076Z"

clusters/cl01tl/helm/argocd/Chart.yaml

@@ -15,8 +15,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 9.4.10
+    version: 9.4.11
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-cd
-appVersion: v3.3.3
+appVersion: v3.3.4

clusters/cl01tl/helm/blocky/values.yaml

@@ -135,6 +135,7 @@ blocky:
               komodo                          IN      CNAME   traefik-cl01tl
               lidarr                          IN      CNAME   traefik-cl01tl
               mail                            IN      CNAME   traefik-cl01tl
+              medialyze                       IN      CNAME   traefik-cl01tl
               movie-roulette                  IN      CNAME   traefik-cl01tl
               music-grabber                   IN      CNAME   traefik-cl01tl
               navidrome                       IN      CNAME   traefik-cl01tl

clusters/cl01tl/helm/gatus/values.yaml

@@ -227,6 +227,9 @@ gatus:
       - name: jellystat
         url: https://jellystat.alexlebens.net
         <<: *defaults
+      - name: medialyze
+        url: https://medialyze.alexlebens.net
+        <<: *defaults
       - name: authentik
         url: https://authentik.alexlebens.net
         <<: *defaults

clusters/cl01tl/helm/harbor/values.yaml

@@ -41,7 +41,7 @@ harbor:
   portal:
     image:
       repository: goharbor/harbor-portal
-      tag: v2.14.3
+      tag: v2.15.0
     replicas: 2
   core:
     image:
@@ -54,7 +54,7 @@ harbor:
   jobservice:
     image:
       repository: goharbor/harbor-jobservice
-      tag: v2.14.3
+      tag: v2.15.0
     replicas: 2
     jobLoggers:
       - stdout
@@ -63,11 +63,11 @@ harbor:
     registry:
       image:
         repository: goharbor/registry-photon
-        tag: v2.14.3
+        tag: v2.15.0
     controller:
       image:
         repository: goharbor/harbor-registryctl
-        tag: v2.14.3
+        tag: v2.15.0
     existingSecret: harbor-secret
     relativeurls: true
     credentials:
@@ -94,7 +94,7 @@ harbor:
   exporter:
     image:
       repository: goharbor/harbor-exporter
-      tag: v2.14.3
+      tag: v2.15.0
     replicas: 2
 postgres-18-cluster:
   mode: recovery

clusters/cl01tl/helm/home-assistant/Chart.yaml

@@ -25,4 +25,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/home-assistant.png
 # renovate: datasource=github-releases depName=home-assistant/core
-appVersion: 2026.3.1
+appVersion: 2026.3.2

clusters/cl01tl/helm/homepage/values.yaml

@@ -477,6 +477,12 @@ homepage:
                   href: https://jellystat.alexlebens.net
                   siteMonitor: http://jellystat.jellystat:80
                   statusStyle: dot
+              - MediaLyze:
+                  icon: https://raw.githubusercontent.com/frederikemmer/MediaLyze/d8f69c0628bac7c047b90f91a66341648029c273/frontend/public/favicon.svg
+                  description: Jellyfin Media Monitoring
+                  href: https://medialyze.alexlebens.net
+                  siteMonitor: http://medialyze.medialyze:80
+                  statusStyle: dot
           - Services:
               - Auth (Public):
                   icon: sh-authentik.webp

clusters/cl01tl/helm/lidarr/values.yaml

@@ -15,7 +15,7 @@ lidarr:
         main:
           image:
             repository: ghcr.io/linuxserver/lidarr
-            tag: 3.1.2-nightly@sha256:2b1b64f07214c6cf05bcfed999aa74ee23825e4bc2ef2c48aba1cd5d5bf968fe
+            tag: 3.1.2-nightly@sha256:034055feee43b11eb2f7a8438a9af1c99ab564dd2b43e5df2fe5b3c9b3b8b1ac
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/medialyze/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.6.2
+digest: sha256:17ac9bc0cc2eac395c630c22ab095e3e34e5d75a34523c3f39629ca1c56ecbc8
+generated: "2026-03-17T17:46:15.885193-05:00"

clusters/cl01tl/helm/medialyze/Chart.yaml

@@ -0,0 +1,22 @@
+apiVersion: v2
+name: medialyze
+version: 1.0.0
+description: MediaLyze
+keywords:
+  - medialyze
+  - jellyfin
+home: https://wiki.alexlebens.dev/
+sources:
+  - https://github.com/frederikemmer/MediaLyze
+  - https://github.com/frederikemmer/MediaLyze/pkgs/container/medialyze
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: medialyze
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.6.2
+icon: https://raw.githubusercontent.com/frederikemmer/MediaLyze/d8f69c0628bac7c047b90f91a66341648029c273/frontend/public/favicon.svg
+# renovate: datasource=github-releases depName=frederikemmer/MediaLyze
+appVersion: 0.2.1

clusters/cl01tl/helm/medialyze/templates/persistent-volume-claim.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: medialyze-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: medialyze-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  volumeName: medialyze-nfs-storage
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi

clusters/cl01tl/helm/medialyze/templates/persistent-volume.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: medialyze-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: medialyze-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: nfs-client
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    path: /volume2/Storage
+    server: synologybond.alexlebens.net
+  mountOptions:
+    - vers=4
+    - minorversion=1
+    - noac

clusters/cl01tl/helm/medialyze/values.yaml

@@ -0,0 +1,85 @@
+medialyze:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: ghcr.io/frederikemmer/medialyze
+            tag: 0.2.1
+            pullPolicy: IfNotPresent
+          env:
+            - name: HOST_PORT
+              value: 8080
+            - name: SCAN_RUNTIME_WORKER_COUNT
+              value: 2
+            - name: TZ
+              value: America/Chicago
+            - name: MEDIA_HOST_DIR
+              value: /media
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 8080
+          protocol: HTTP
+  route:
+    main:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - medialyze.alexlebens.net
+      rules:
+        - backendRefs:
+            - group: ''
+              kind: Service
+              name: medialyze
+              port: 80
+              weight: 100
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+  persistence:
+    data:
+      forceRename: medialyze-data
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 1Gi
+      retain: true
+      advancedMounts:
+        main:
+          main:
+            - path: /config
+              readOnly: false
+    media:
+      existingClaim: medialyze-nfs-storage
+      advancedMounts:
+        main:
+          main:
+            - path: /media
+              readOnly: true
+volsync-target-data:
+  pvcTarget: medialyze-data
+  local:
+    enabled: true
+    schedule: 36 11 * * *
+  remote:
+    enabled: true
+    schedule: 36 12 * * *
+  external:
+    enabled: true
+    schedule: 36 14 * * *

clusters/cl01tl/helm/music-grabber/values.yaml

@@ -9,7 +9,7 @@ music-grabber:
         main:
           image:
             repository: g33kphr33k/musicgrabber
-            tag: 2.4.3
+            tag: 2.4.4
             pullPolicy: IfNotPresent
           env:
             - name: MUSIC_DIR

clusters/cl01tl/helm/ntfy/Chart.yaml

@@ -20,4 +20,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ntfy.png
 # renovate: datasource=github-releases depName=binwiederhier/ntfy
-appVersion: 2.19.0
+appVersion: 2.19.2

clusters/cl01tl/helm/ntfy/values.yaml

@@ -9,7 +9,7 @@ ntfy:
         main:
           image:
             repository: binwiederhier/ntfy
-            tag: v2.19.0
+            tag: v2.19.2
             pullPolicy: IfNotPresent
           args: ["serve"]
           env:

clusters/cl01tl/helm/ollama/Chart.yaml

@@ -31,4 +31,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ollama.png
 # renovate: datasource=github-releases depName=ollama/ollama
-appVersion: 0.18.0
+appVersion: 0.18.1

clusters/cl01tl/helm/ollama/values.yaml

@@ -22,7 +22,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.18.0
+            tag: 0.18.1
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE
@@ -58,7 +58,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.18.0
+            tag: 0.18.1
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE
@@ -94,7 +94,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.18.0
+            tag: 0.18.1
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE

clusters/cl01tl/helm/prometheus-operator-crds/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: prometheus-operator-crds
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 27.0.0
+  version: 27.0.1
-digest: sha256:ab76a45fb53268d4afdad507277c244af11c50344e50a24799182bbd9757258d
+digest: sha256:c66f0099390741388fce480670ce5f40f0e8459f3471a9f49da6f3f217c028a0
-generated: "2026-02-06T14:05:22.069162277Z"
+generated: "2026-03-17T20:57:34.001956235Z"

clusters/cl01tl/helm/prometheus-operator-crds/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: prometheus-operator-crds
-    version: 27.0.0
+    version: 27.0.1
     repository: oci://ghcr.io/prometheus-community/charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prometheus.png
 # renovate: datasource=github-releases depName=prometheus-operator/prometheus-operator

clusters/cl01tl/helm/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:174f6a8498d88d2d98c265a952c2d552859bf315cd505746d1c0d4fbec37952f
+            tag: latest@sha256:090d7ef2e61cb540baf0db0656bfd4dfbcbba82604adb8ebfb5e316d09289fef
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -39,7 +39,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:174f6a8498d88d2d98c265a952c2d552859bf315cd505746d1c0d4fbec37952f
+            tag: latest@sha256:090d7ef2e61cb540baf0db0656bfd4dfbcbba82604adb8ebfb5e316d09289fef
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL

clusters/cl01tl/helm/site-profile/values.yaml

@@ -11,7 +11,7 @@ site-profile:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-profile
-            tag: 3.13.0
+            tag: 3.14.0
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/talos/values.yaml

@@ -69,7 +69,7 @@ etcd-backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:a41234c2b43d6cfa0d51c9523a2d7925f7f21297a41d69932946c3e364d32b5e
+            tag: latest@sha256:e3965f8205dfb96fb00e66cee54a0d171f1829a3cc6a1bbb980ab076730e54be
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -155,7 +155,7 @@ etcd-backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:a41234c2b43d6cfa0d51c9523a2d7925f7f21297a41d69932946c3e364d32b5e
+            tag: latest@sha256:e3965f8205dfb96fb00e66cee54a0d171f1829a3cc6a1bbb980ab076730e54be
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -241,7 +241,7 @@ etcd-backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:a41234c2b43d6cfa0d51c9523a2d7925f7f21297a41d69932946c3e364d32b5e
+            tag: latest@sha256:e3965f8205dfb96fb00e66cee54a0d171f1829a3cc6a1bbb980ab076730e54be
             pullPolicy: IfNotPresent
           command:
             - /bin/sh

clusters/cl01tl/helm/trivy/values.yaml

@@ -2,13 +2,13 @@ trivy-operator:
   targetWorkloads: "pod,replicaset,replicationcontroller,statefulset,daemonset,cronjob,job"
   operator:
     replicas: 1
-    scanJobsConcurrentLimit: 3
+    scanJobsConcurrentLimit: 1
     vulnerabilityScannerEnabled: true
-    sbomGenerationEnabled: true
+    sbomGenerationEnabled: false
-    clusterSbomCacheEnabled: true
+    clusterSbomCacheEnabled: false
     configAuditScannerEnabled: true
     rbacAssessmentScannerEnabled: true
-    infraAssessmentScannerEnabled: true
+    infraAssessmentScannerEnabled: false
     clusterComplianceEnabled: false
     vulnerabilityScannerScanOnlyCurrentRevisions: true
     accessGlobalSecretsAndServiceAccount: true
@@ -46,42 +46,46 @@ trivy-operator:
           cpu: 200m
           memory: 512Mi
       replicas: 1
-nodeCollector:
+  nodeCollector:
-  volumeMounts:
+    tolerations:
-    - name: var-lib-etcd
+      - key: node-role.kubernetes.io/control-plane
-      mountPath: /var/lib/etcd
+        operator: Exists
-      readOnly: true
+        effect: NoSchedule
-    - name: var-lib-kubelet
+    volumeMounts:
-      mountPath: /var/lib/kubelet
+      - name: var-lib-etcd
-      readOnly: true
+        mountPath: /var/lib/etcd
-    - name: var-lib-kube-scheduler
+        readOnly: true
-      mountPath: /var/lib/kube-scheduler
+      - name: var-lib-kubelet
-      readOnly: true
+        mountPath: /var/lib/kubelet
-    - name: var-lib-kube-controller-manager
+        readOnly: true
-      mountPath: /var/lib/kube-controller-manager
+      - name: var-lib-kube-scheduler
-      readOnly: true
+        mountPath: /var/lib/kube-scheduler
-    - name: etc-kubernetes
+        readOnly: true
-      mountPath: /etc/kubernetes
+      - name: var-lib-kube-controller-manager
-      readOnly: true
+        mountPath: /var/lib/kube-controller-manager
-    - name: etc-cni-netd
+        readOnly: true
-      mountPath: /etc/cni/net.d/
+      - name: etc-kubernetes
-      readOnly: true
+        mountPath: /etc/kubernetes
-  volumes:
+        readOnly: true
-    - name: var-lib-etcd
+      - name: etc-cni-netd
-      hostPath:
+        mountPath: /etc/cni/net.d/
-        path: /var/lib/etcd
+        readOnly: true
-    - name: var-lib-kubelet
+    volumes:
-      hostPath:
+      - name: var-lib-etcd
-        path: /var/lib/kubelet
+        hostPath:
-    - name: var-lib-kube-scheduler
+          path: /var/lib/etcd
-      hostPath:
+      - name: var-lib-kubelet
-        path: /var/lib/kube-scheduler
+        hostPath:
-    - name: var-lib-kube-controller-manager
+          path: /var/lib/kubelet
-      hostPath:
+      - name: var-lib-kube-scheduler
-        path: /var/lib/kube-controller-manager
+        hostPath:
-    - name: etc-kubernetes
+          path: /var/lib/kube-scheduler
-      hostPath:
+      - name: var-lib-kube-controller-manager
-        path: /etc/kubernetes
+        hostPath:
-    - name: etc-cni-netd
+          path: /var/lib/kube-controller-manager
-      hostPath:
+      - name: etc-kubernetes
-        path: /etc/cni/net.d/
+        hostPath:
+          path: /etc/kubernetes
+      - name: etc-cni-netd
+        hostPath:
+          path: /etc/cni/net.d/

clusters/cl01tl/helm/vault/values.yaml

@@ -187,7 +187,7 @@ snapshot:
         s3-backup-local:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:a41234c2b43d6cfa0d51c9523a2d7925f7f21297a41d69932946c3e364d32b5e
+            tag: latest@sha256:e3965f8205dfb96fb00e66cee54a0d171f1829a3cc6a1bbb980ab076730e54be
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -208,7 +208,7 @@ snapshot:
         s3-backup-remote:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:a41234c2b43d6cfa0d51c9523a2d7925f7f21297a41d69932946c3e364d32b5e
+            tag: latest@sha256:e3965f8205dfb96fb00e66cee54a0d171f1829a3cc6a1bbb980ab076730e54be
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -229,7 +229,7 @@ snapshot:
         s3-backup-external:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:a41234c2b43d6cfa0d51c9523a2d7925f7f21297a41d69932946c3e364d32b5e
+            tag: latest@sha256:e3965f8205dfb96fb00e66cee54a0d171f1829a3cc6a1bbb980ab076730e54be
             pullPolicy: IfNotPresent
           command:
             - /bin/sh

hosts/ps08rp/blocky/config.yml

@@ -110,6 +110,7 @@ customDNS:
     komodo                          IN      CNAME   traefik-cl01tl
     lidarr                          IN      CNAME   traefik-cl01tl
     mail                            IN      CNAME   traefik-cl01tl
+    medialyze                       IN      CNAME   traefik-cl01tl
     movie-roulette                  IN      CNAME   traefik-cl01tl
     music-grabber                   IN      CNAME   traefik-cl01tl
     navidrome                       IN      CNAME   traefik-cl01tl

hosts/ps09rp/blocky/config.yml

@@ -131,6 +131,7 @@ customDNS:
     komodo                          IN      CNAME   traefik-cl01tl
     lidarr                          IN      CNAME   traefik-cl01tl
     mail                            IN      CNAME   traefik-cl01tl
+    medialyze                       IN      CNAME   traefik-cl01tl
     movie-roulette                  IN      CNAME   traefik-cl01tl
     music-grabber                   IN      CNAME   traefik-cl01tl
     navidrome                       IN      CNAME   traefik-cl01tl

hosts/ps10rp/castsponsorskip/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     castsponsorskip:
-        image: ghcr.io/gabe565/castsponsorskip:0.8.2
+        image: ghcr.io/gabe565/castsponsorskip:0.8.3
         container_name: castsponsorskip
         environment:
             - TZ=America/Chicago