Merge pull request 'feat: disable volsync' (#6059 ) from tmp/actual into main

Reviewed-on: #6059
fix: update lock
2026-04-19 02:11:07 +00:00 · 2026-04-18 20:15:29 -05:00 · 2026-04-18 19:39:44 -05:00 · 2026-04-19 00:38:24 +00:00 · 2026-04-18 19:35:40 -05:00 · 2026-04-19 00:29:07 +00:00
21 changed files with 374 additions and 118 deletions
--- a/.gitea/workflows/renovate.yaml
+++ b/.gitea/workflows/renovate.yaml
@@ -13,7 +13,7 @@ on:
 jobs:
  renovate:
    runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.128.0@sha256:a0d5786f0506546c9e4bf7a851ddfb37ba7ac6dc6aacefc08cc688a0d8d9be0f
+    container: ghcr.io/renovatebot/renovate:43.129.0@sha256:e4abd88d1d6326fe8a702b38c5ee76487d94b455ba4f305bd904521aba9f5a08
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
--- a/clusters/cl01tl/helm/actual/Chart.lock
+++ b/clusters/cl01tl/helm/actual/Chart.lock
@@ -2,8 +2,5 @@ dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.6.2
- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-digest: sha256:ff81b3d8fc831e4b8048f646fffcf597aa7410e52ecf27690eab8104047dbe6f
-generated: "2026-03-06T01:04:41.514235218Z"
+digest: sha256:1c04c187e6cf768117f7f91f3a3b082937ad5854c1cf6a681ad7c02687cd543d
+generated: "2026-04-18T20:15:22.778699-05:00"
--- a/clusters/cl01tl/helm/actual/Chart.yaml
+++ b/clusters/cl01tl/helm/actual/Chart.yaml
@@ -18,10 +18,10 @@ dependencies:
    alias: actual
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.6.2
-  - name: volsync-target
-    alias: volsync-target-data
-    version: 0.8.0
-    repository: oci://harbor.alexlebens.net/helm-charts
+  # - name: volsync-target
+  #   alias: volsync-target-data
+  #   version: 0.8.0
+  #   repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/actual-budget.png
 # renovate: datasource=github-releases depName=actualbudget/actual
 appVersion: 26.4.0
--- a/clusters/cl01tl/helm/external-secrets/Chart.yaml
+++ b/clusters/cl01tl/helm/external-secrets/Chart.yaml
@@ -18,4 +18,4 @@ dependencies:
    repository: https://charts.external-secrets.io
 icon: https://raw.githubusercontent.com/external-secrets/external-secrets/refs/heads/main/assets/eso-logo-large.png
 # renovate: datasource=github-releases depName=external-secrets/external-secrets
-appVersion: vv2.3.0
+appVersion: v2.3.0
--- a/clusters/cl01tl/helm/external-secrets/templates/cluster-role-binding.yaml
+++ b/clusters/cl01tl/helm/external-secrets/templates/cluster-role-binding.yaml
@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: external-secrets
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: external-secrets
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - kind: ServiceAccount
+    name: external-secrets
+    namespace: {{ .Release.Namespace }}
--- a/clusters/cl01tl/helm/external-secrets/templates/cluster-secret-store.yaml
+++ b/clusters/cl01tl/helm/external-secrets/templates/cluster-secret-store.yaml
@@ -17,3 +17,29 @@ spec:
          namespace: vault
          name: vault-token
          key: token
+
+---
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: openbao
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  provider:
+    vault:
+      server: http://openbao-internal.openbao:8200
+      path: secret
+      version: v2
+      auth:
+        kubernetes:
+          mountPath: kubernetes
+          role: external-secrets
+          serviceAccountRef:
+            name: external-secrets
+            namespace: {{ .Release.Name }}
+            audiences:
+              - openbao
--- a/clusters/cl01tl/helm/jellystat/Chart.yaml
+++ b/clusters/cl01tl/helm/jellystat/Chart.yaml
@@ -29,4 +29,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/jellystat.png
 # renovate: datasource=github-releases depName=CyferShepard/Jellystat
-appVersion: 1.1.9
+appVersion: 1.1.10
--- a/clusters/cl01tl/helm/jellystat/values.yaml
+++ b/clusters/cl01tl/helm/jellystat/values.yaml
@@ -8,7 +8,7 @@ jellystat:
        main:
          image:
            repository: ghcr.io/cyfershepard/jellystat
-            tag: 1.1.9@sha256:f7f56aabad139faa996b8bb21a36dd3e65f7c87e10408921815b95a28a4efbaf
+            tag: 1.1.10@sha256:bb7ebe42424dedeff52d8da4130232d67e3fdd6dc2dd4a66091e32ddd835ea42
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/ollama/Chart.yaml
+++ b/clusters/cl01tl/helm/ollama/Chart.yaml
@@ -31,4 +31,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ollama.png
 # renovate: datasource=github-releases depName=ollama/ollama
-appVersion: 0.20.7
+appVersion: 0.21.0
--- a/clusters/cl01tl/helm/ollama/values.yaml
+++ b/clusters/cl01tl/helm/ollama/values.yaml
@@ -21,7 +21,7 @@ ollama:
        main:
          image:
            repository: ollama/ollama
-            tag: 0.20.7@sha256:487324a9312240e3e122446f351b1f1e3f68d884ef854c246db2e08792440d94
+            tag: 0.21.0@sha256:d3d553bdfbcc7f55dd5ddf42c4cbe3a927aa9bb1802710d35e94656ca5aea02b
          env:
            - name: OLLAMA_KEEP_ALIVE
              value: 24h
@@ -55,7 +55,7 @@ ollama:
        main:
          image:
            repository: ollama/ollama
-            tag: 0.20.7@sha256:487324a9312240e3e122446f351b1f1e3f68d884ef854c246db2e08792440d94
+            tag: 0.21.0@sha256:d3d553bdfbcc7f55dd5ddf42c4cbe3a927aa9bb1802710d35e94656ca5aea02b
          env:
            - name: OLLAMA_KEEP_ALIVE
              value: 24h
@@ -89,7 +89,7 @@ ollama:
        main:
          image:
            repository: ollama/ollama
-            tag: 0.20.7@sha256:487324a9312240e3e122446f351b1f1e3f68d884ef854c246db2e08792440d94
+            tag: 0.21.0@sha256:d3d553bdfbcc7f55dd5ddf42c4cbe3a927aa9bb1802710d35e94656ca5aea02b
          env:
            - name: OLLAMA_KEEP_ALIVE
              value: 24h
--- a/clusters/cl01tl/helm/qbittorrent/values.yaml
+++ b/clusters/cl01tl/helm/qbittorrent/values.yaml
@@ -208,7 +208,7 @@ qbittorrent:
        qui:
          image:
            repository: ghcr.io/autobrr/qui
-            tag: v1.16.1@sha256:07b6ea9572e52e8b5f70f8fb15a7c688d8d754a7616242d3ad0b21dbd5c05836
+            tag: v1.17.0@sha256:fb3832e68f66b056e1b049d16c40732661e7b73999bc642d4b11469a3ebbabd3
          env:
            - name: QUI__METRICS_ENABLED
              value: true
--- a/clusters/cl01tl/helm/rclone/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/rclone/templates/external-secret.yaml
@@ -14,38 +14,23 @@ spec:
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/directus-assets
-        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: ACCESS_REGION
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/directus-assets
-        metadataPolicy: None
        property: ACCESS_REGION
    - secretKey: ACCESS_SECRET_KEY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/directus-assets
-        metadataPolicy: None
        property: ACCESS_SECRET_KEY
    - secretKey: SRC_ENDPOINT
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/config/local
-        metadataPolicy: None
        property: ENDPOINT
    - secretKey: DEST_ENDPOINT
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/config/remote
-        metadataPolicy: None
        property: ENDPOINT

 ---
@@ -65,38 +50,23 @@ spec:
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/karakeep-assets
-        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: ACCESS_REGION
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/karakeep-assets
-        metadataPolicy: None
        property: ACCESS_REGION
    - secretKey: ACCESS_SECRET_KEY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/karakeep-assets
-        metadataPolicy: None
        property: ACCESS_SECRET_KEY
    - secretKey: SRC_ENDPOINT
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/config/local
-        metadataPolicy: None
        property: ENDPOINT
    - secretKey: DEST_ENDPOINT
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/config/remote
-        metadataPolicy: None
        property: ENDPOINT

 ---
@@ -116,38 +86,23 @@ spec:
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/talos-backups
-        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: ACCESS_REGION
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/talos-backups
-        metadataPolicy: None
        property: ACCESS_REGION
    - secretKey: ACCESS_SECRET_KEY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/talos-backups
-        metadataPolicy: None
        property: ACCESS_SECRET_KEY
    - secretKey: SRC_ENDPOINT
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/config/local
-        metadataPolicy: None
        property: ENDPOINT
    - secretKey: DEST_ENDPOINT
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/config/remote
-        metadataPolicy: None
        property: ENDPOINT

 ---
@@ -167,38 +122,23 @@ spec:
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/web-assets
-        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: ACCESS_REGION
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/web-assets
-        metadataPolicy: None
        property: ACCESS_REGION
    - secretKey: ACCESS_SECRET_KEY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/web-assets
-        metadataPolicy: None
        property: ACCESS_SECRET_KEY
    - secretKey: SRC_ENDPOINT
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/config/local
-        metadataPolicy: None
        property: ENDPOINT
    - secretKey: DEST_ENDPOINT
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/config/remote
-        metadataPolicy: None
        property: ENDPOINT

 ---
@@ -218,38 +158,23 @@ spec:
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: ACCESS_REGION
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
        property: ACCESS_REGION
    - secretKey: ACCESS_SECRET_KEY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
        property: ACCESS_SECRET_KEY
    - secretKey: SRC_ENDPOINT
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/config/local
-        metadataPolicy: None
        property: ENDPOINT
    - secretKey: DEST_ENDPOINT
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/config/remote
-        metadataPolicy: None
        property: ENDPOINT

 ---
@@ -269,36 +194,89 @@ spec:
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/ntfy-attachments
-        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: ACCESS_REGION
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/ntfy-attachments
-        metadataPolicy: None
        property: ACCESS_REGION
    - secretKey: ACCESS_SECRET_KEY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/ntfy-attachments
-        metadataPolicy: None
        property: ACCESS_SECRET_KEY
    - secretKey: SRC_ENDPOINT
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/config/local
-        metadataPolicy: None
        property: ENDPOINT
    - secretKey: DEST_ENDPOINT
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/config/remote
-        metadataPolicy: None
+        property: ENDPOINT
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: garage-openbao-backups-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: garage-openbao-backups-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: ACCESS_KEY_ID
+      remoteRef:
+        key: /garage/home-infra/openbao-backups
+        property: ACCESS_KEY_ID
+    - secretKey: ACCESS_REGION
+      remoteRef:
+        key: /garage/home-infra/openbao-backups
+        property: ACCESS_REGION
+    - secretKey: ACCESS_SECRET_KEY
+      remoteRef:
+        key: /garage/home-infra/openbao-backups
+        property: ACCESS_SECRET_KEY
+    - secretKey: ENDPOINT_LOCAL
+      remoteRef:
+        key: /garage/home-infra/openbao-backups
+        property: ENDPOINT_LOCAL
+    - secretKey: ENDPOINT_REMOTE
+      remoteRef:
+        key: /garage/home-infra/openbao-backups
+        property: ENDPOINT_REMOTE
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: external-openbao-backups-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: external-openbao-backups-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: ACCESS_KEY_ID
+      remoteRef:
+        key: /digital-ocean/home-infra/openbao-backups
+        property: ACCESS_KEY_ID
+    - secretKey: ACCESS_REGION
+      remoteRef:
+        key: /digital-ocean/home-infra/openbao-backups
+        property: ACCESS_REGION
+    - secretKey: ACCESS_SECRET_KEY
+      remoteRef:
+        key: /digital-ocean/home-infra/openbao-backups
+        property: ACCESS_SECRET_KEY
+    - secretKey: ENDPOINT
+      remoteRef:
+        key: /digital-ocean/home-infra/openbao-backups
        property: ENDPOINT
--- a/clusters/cl01tl/helm/rclone/values.yaml
+++ b/clusters/cl01tl/helm/rclone/values.yaml
@@ -554,3 +554,241 @@ rclone:
                  key: DEST_ENDPOINT
            - name: RCLONE_CONFIG_SRC_DEST_FORCE_PATH_STYLE
              value: true
+    openbao-backups-remote:
+      type: cronjob
+      cronjob:
+        suspend: false
+        timeZone: America/Chicago
+        schedule: 0 1 * * *
+        backoffLimit: 3
+        parallelism: 1
+      containers:
+        sync:
+          image:
+            repository: rclone/rclone
+            tag: 1.73.4@sha256:654f6517c7aaec7e377690b2caf7c272dbe5f3b8200afbc14a00df6b4a9aa6ef
+          args:
+            - sync
+            - src:openbao-backups
+            - dest:openbao-backups
+            - --s3-no-check-bucket
+            - --max-age
+            - 90d
+            - --verbose
+          env:
+            - name: RCLONE_S3_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_SRC_TYPE
+              value: s3
+            - name: RCLONE_CONFIG_SRC_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_SRC_ENV_AUTH
+              value: false
+            - name: RCLONE_CONFIG_SRC_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: garage-openbao-backups-secret
+                  key: ACCESS_KEY_ID
+            - name: RCLONE_CONFIG_SRC_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: garage-openbao-backups-secret
+                  key: ACCESS_SECRET_KEY
+            - name: RCLONE_CONFIG_SRC_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: garage-openbao-backups-secret
+                  key: ACCESS_REGION
+            - name: RCLONE_CONFIG_SRC_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: garage-openbao-backups-secret
+                  key: ENDPOINT_LOCAL
+            - name: RCLONE_CONFIG_SRC_S3_FORCE_PATH_STYLE
+              value: true
+            - name: RCLONE_CONFIG_DEST_TYPE
+              value: s3
+            - name: RCLONE_CONFIG_DEST_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_DEST_ENV_AUTH
+              value: false
+            - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: garage-openbao-backups-secret
+                  key: ACCESS_KEY_ID
+            - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: garage-openbao-backups-secret
+                  key: ACCESS_SECRET_KEY
+            - name: RCLONE_CONFIG_DEST_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: garage-openbao-backups-secret
+                  key: ACCESS_REGION
+            - name: RCLONE_CONFIG_DEST_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: garage-openbao-backups-secret
+                  key: ENDPOINT_REMOTE
+            - name: RCLONE_CONFIG_SRC_DEST_FORCE_PATH_STYLE
+              value: true
+        prune:
+          image:
+            repository: rclone/rclone
+            tag: 1.73.4@sha256:654f6517c7aaec7e377690b2caf7c272dbe5f3b8200afbc14a00df6b4a9aa6ef
+          args:
+            - delete
+            - dest:openbao-backups
+            - --min-age
+            - 90d
+            - --verbose
+          env:
+            - name: RCLONE_CONFIG_DEST_TYPE
+              value: s3
+            - name: RCLONE_CONFIG_DEST_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_DEST_ENV_AUTH
+              value: false
+            - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: garage-openbao-backups-secret
+                  key: ACCESS_KEY_ID
+            - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: garage-openbao-backups-secret
+                  key: ACCESS_SECRET_KEY
+            - name: RCLONE_CONFIG_DEST_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: garage-openbao-backups-secret
+                  key: ACCESS_REGION
+            - name: RCLONE_CONFIG_DEST_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: garage-openbao-backups-secret
+                  key: ENDPOINT_REMOTE
+            - name: RCLONE_CONFIG_SRC_S3_FORCE_PATH_STYLE
+              value: true
+    openbao-backups-external:
+      type: cronjob
+      cronjob:
+        suspend: false
+        timeZone: America/Chicago
+        schedule: 10 1 * * *
+        backoffLimit: 3
+        parallelism: 1
+      containers:
+        sync:
+          image:
+            repository: rclone/rclone
+            tag: 1.73.4@sha256:654f6517c7aaec7e377690b2caf7c272dbe5f3b8200afbc14a00df6b4a9aa6ef
+          args:
+            - sync
+            - src:openbao-backups
+            - dest:openbao-backups-6e088aad5fad110b
+            - --s3-no-check-bucket
+            - --max-age
+            - 90d
+            - --verbose
+          env:
+            - name: RCLONE_S3_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_SRC_TYPE
+              value: s3
+            - name: RCLONE_CONFIG_SRC_PROVIDER
+              value: Other
+            - name: RCLONE_CONFIG_SRC_ENV_AUTH
+              value: false
+            - name: RCLONE_CONFIG_SRC_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: garage-openbao-backups-secret
+                  key: ACCESS_KEY_ID
+            - name: RCLONE_CONFIG_SRC_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: garage-openbao-backups-secret
+                  key: ACCESS_SECRET_KEY
+            - name: RCLONE_CONFIG_SRC_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: garage-openbao-backups-secret
+                  key: ACCESS_REGION
+            - name: RCLONE_CONFIG_SRC_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: garage-openbao-backups-secret
+                  key: ENDPOINT_LOCAL
+            - name: RCLONE_CONFIG_SRC_S3_FORCE_PATH_STYLE
+              value: true
+            - name: RCLONE_CONFIG_DEST_TYPE
+              value: s3
+            - name: RCLONE_CONFIG_DEST_PROVIDER
+              value: DigitalOcean
+            - name: RCLONE_CONFIG_DEST_ENV_AUTH
+              value: false
+            - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: external-openbao-backups-secret
+                  key: ACCESS_KEY_ID
+            - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: external-openbao-backups-secret
+                  key: ACCESS_SECRET_KEY
+            - name: RCLONE_CONFIG_DEST_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: external-openbao-backups-secret
+                  key: ACCESS_REGION
+            - name: RCLONE_CONFIG_DEST_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: external-openbao-backups-secret
+                  key: ENDPOINT
+            - name: RCLONE_CONFIG_DEST_S3_FORCE_PATH_STYLE
+              value: true
+        prune:
+          image:
+            repository: rclone/rclone
+            tag: 1.73.4@sha256:654f6517c7aaec7e377690b2caf7c272dbe5f3b8200afbc14a00df6b4a9aa6ef
+          args:
+            - delete
+            - dest:openbao-backups-6e088aad5fad110b
+            - --min-age
+            - 90d
+            - --verbose
+          env:
+            - name: RCLONE_CONFIG_DEST_TYPE
+              value: s3
+            - name: RCLONE_CONFIG_DEST_PROVIDER
+              value: DigitalOcean
+            - name: RCLONE_CONFIG_DEST_ENV_AUTH
+              value: false
+            - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: external-openbao-backups-secret
+                  key: ACCESS_KEY_ID
+            - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: external-openbao-backups-secret
+                  key: ACCESS_SECRET_KEY
+            - name: RCLONE_CONFIG_DEST_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: external-openbao-backups-secret
+                  key: ACCESS_REGION
+            - name: RCLONE_CONFIG_DEST_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: external-openbao-backups-secret
+                  key: ENDPOINT
+            - name: RCLONE_CONFIG_DEST_S3_FORCE_PATH_STYLE
+              value: true
--- a/clusters/cl01tl/helm/sonarr-4k/Chart.yaml
+++ b/clusters/cl01tl/helm/sonarr-4k/Chart.yaml
@@ -33,4 +33,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/sonarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-sonarr
-appVersion: 4.0.17.2952-ls307
+appVersion: 4.0.17.2952-ls308
--- a/clusters/cl01tl/helm/sonarr-4k/values.yaml
+++ b/clusters/cl01tl/helm/sonarr-4k/values.yaml
@@ -13,7 +13,7 @@ sonarr-4k:
        main:
          image:
            repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.17.2952-ls307@sha256:6854df9de20b8c82e1982604f39473d64dbb4c4584b1013f18f9ade1ee92af13
+            tag: 4.0.17.2952-ls308@sha256:e6c9a091735fede0c2a205c69e7d4c2f0188eaf2bec7e42d8a26c017e5f2a910
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/sonarr-anime/Chart.yaml
+++ b/clusters/cl01tl/helm/sonarr-anime/Chart.yaml
@@ -33,4 +33,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/sonarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-sonarr
-appVersion: 4.0.17.2952-ls307
+appVersion: 4.0.17.2952-ls308
--- a/clusters/cl01tl/helm/sonarr-anime/values.yaml
+++ b/clusters/cl01tl/helm/sonarr-anime/values.yaml
@@ -13,7 +13,7 @@ sonarr-anime:
        main:
          image:
            repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.17.2952-ls307@sha256:6854df9de20b8c82e1982604f39473d64dbb4c4584b1013f18f9ade1ee92af13
+            tag: 4.0.17.2952-ls308@sha256:e6c9a091735fede0c2a205c69e7d4c2f0188eaf2bec7e42d8a26c017e5f2a910
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/sonarr/Chart.yaml
+++ b/clusters/cl01tl/helm/sonarr/Chart.yaml
@@ -33,4 +33,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/sonarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-sonarr
-appVersion: 4.0.17.2952-ls307
+appVersion: 4.0.17.2952-ls308
--- a/clusters/cl01tl/helm/sonarr/values.yaml
+++ b/clusters/cl01tl/helm/sonarr/values.yaml
@@ -12,7 +12,7 @@ sonarr:
        main:
          image:
            repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.17.2952-ls307@sha256:6854df9de20b8c82e1982604f39473d64dbb4c4584b1013f18f9ade1ee92af13
+            tag: 4.0.17.2952-ls308@sha256:e6c9a091735fede0c2a205c69e7d4c2f0188eaf2bec7e42d8a26c017e5f2a910
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/sparkyfitness/values.yaml
+++ b/clusters/cl01tl/helm/sparkyfitness/values.yaml
@@ -20,7 +20,7 @@ sparkyfitness:
  server:
    image:
      repository: ghcr.io/codewithcj/sparkyfitness-server
-      tag: v0.16.5.7@sha256:7cdb8cb3ae7f90c7590dac3b92cea3a8e24d51b28eb836a1f6d5201cd45bc080
+      tag: v0.16.5.8@sha256:55e5444a74dde388fa7e54121185c41b2130ffd9d12ad38e9e31765019a5c44b
    resources:
      requests:
        cpu: 100m
@@ -45,7 +45,7 @@ sparkyfitness:
  frontend:
    image:
      repository: ghcr.io/codewithcj/sparkyfitness-frontend
-      tag: v0.16.5.7@sha256:c57a0a07b3470bd0c280d63d02b45adfe7360441b396e9bd445d7b0d22823356
+      tag: v0.16.5.8@sha256:aaf810547097007f6d0b3c90af65f8ce89d9b899a6e3035299caffef830736dc
    resources:
      requests:
        cpu: 10m
--- a/renovate.json
+++ b/renovate.json
@@ -89,10 +89,10 @@
    {
      "description": "Specific app grouping overrides",
      "matchPackageNames": [
-        "/(^|/|-)(argo-cd|bazarr|cilium|dawarich|element-web|home-assistant|immich|komodo|plex|postiz|prowlarr|radarr|rook-ceph|roundcube|rybbit|sonarr|tdarr|traefik)/",
+        "/(^|/|-)(argo-cd|bazarr|cilium|dawarich|element-web|home-assistant|immich|komodo|plex|postiz|prowlarr|radarr|rook-ceph|roundcube|rybbit|sonarr|sparkyfitness|tdarr|traefik)/",
        "/^rook(-ceph|/rook|/ceph)/"
      ],
-      "groupName": "{{#if packageName}}{{{replace '^.*(argo-cd|bazarr|cilium|dawarich|element-web|home-assistant|immich|komodo|plex|postiz|prowlarr|radarr|rook-ceph|roundcube|rybbit|sonarr|tdarr|traefik).*$' '$1' packageName}}}{{else}}{{{replace '^.*(argo-cd|bazarr|cilium|dawarich|element-web|home-assistant|immich|komodo|plex|postiz|prowlarr|radarr|rook-ceph|roundcube|rybbit|sonarr|tdarr|traefik).*$' '$1' depName}}}{{/if}}",
+      "groupName": "{{#if packageName}}{{{replace '^.*(argo-cd|bazarr|cilium|dawarich|element-web|home-assistant|immich|komodo|plex|postiz|prowlarr|radarr|rook-ceph|roundcube|rybbit|sonarr|sparkyfitness|tdarr|traefik).*$' '$1' packageName}}}{{else}}{{{replace '^.*(argo-cd|bazarr|cilium|dawarich|element-web|home-assistant|immich|komodo|plex|postiz|prowlarr|radarr|rook-ceph|roundcube|rybbit|sonarr|sparkyfitness|tdarr|traefik).*$' '$1' depName}}}{{/if}}",
      "groupSlug": "unified-{{{groupName}}}"
    },
    {
Author	SHA1	Message	Date
Alex Lebens	0e1d166fc7	Merge pull request 'feat: disable volsync' (#6059 ) from tmp/actual into main All checks were successful lint-test-helm / lint-helm (push) Successful in 22s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 3m42s Details Reviewed-on: #6059	2026-04-19 02:11:07 +00:00
Alex Lebens	0afd797774	fix: update lock All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 25s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 19s Details render-manifests / render-manifests (pull_request) Successful in 2m38s Details	2026-04-18 20:15:29 -05:00
Alex Lebens	7f2067ee4a	feat: disable volsync Some checks failed lint-test-helm / lint-helm (pull_request) Failing after 19s Details lint-test-helm / validate-kubeconform (pull_request) Has been skipped Details	2026-04-18 19:39:44 -05:00
Alex Lebens	75c694ebc3	Merge pull request 'fix: wrong env' (#6057 ) from tmp/rclone-2 into main All checks were successful lint-test-helm / lint-helm (push) Successful in 19s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 12m3s Details Reviewed-on: #6057	2026-04-19 00:38:24 +00:00
Alex Lebens	e96c50fecb	fix: wrong env All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 22s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 23s Details render-manifests / render-manifests (pull_request) Successful in 53s Details	2026-04-18 19:35:40 -05:00
Alex Lebens	e12882b4da	Merge pull request 'feat: change config' (#6055 ) from tmp/rclone-1 into main All checks were successful lint-test-helm / lint-helm (push) Successful in 45s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 5m14s Details Reviewed-on: #6055	2026-04-19 00:29:07 +00:00
Alex Lebens	415b0c61f8	feat: change config All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 30s Details lint-test-helm / validate-kubeconform (pull_request) Has been skipped Details render-manifests / render-manifests (pull_request) Successful in 1m15s Details	2026-04-18 19:17:42 -05:00
Alex Lebens	5baf930815	Merge pull request 'feat: add namespace' (#6053 ) from tmp/external-secrets-2 into main All checks were successful lint-test-helm / lint-helm (push) Successful in 23s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 4m35s Details Reviewed-on: #6053	2026-04-18 23:43:17 +00:00
Alex Lebens	9288b91537	feat: add namespace All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 20s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 21s Details render-manifests / render-manifests (pull_request) Successful in 1m51s Details	2026-04-18 18:41:34 -05:00
Renovate Bot	decf0ec015	Merge pull request 'chore(deps): update sparkyfitness to v0.16.5.8' (#6051 ) from renovate/unified-sparkyfitness into main All checks were successful lint-test-helm / lint-helm (push) Successful in 40s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 4m34s Details	2026-04-18 23:00:45 +00:00
Renovate Bot	bc9e9097f6	chore(deps): update sparkyfitness to v0.16.5.8 Some checks are pending renovate/stability-days Updates have not met minimum release age requirement Details lint-test-helm / lint-helm (pull_request) Successful in 45s Details lint-test-helm / validate-kubeconform (pull_request) Has been skipped Details render-manifests / render-manifests (pull_request) Successful in 2m58s Details	2026-04-18 23:00:21 +00:00
Alex Lebens	76170a10f7	Merge pull request 'feat: add openbao backup rclone' (#6049 ) from tmp/secrets-1 into main All checks were successful lint-test-helm / lint-helm (push) Successful in 32s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 3m25s Details Reviewed-on: #6049	2026-04-18 22:57:50 +00:00
Alex Lebens	2195e3561e	feat: add openbao backup rclone	2026-04-18 22:57:50 +00:00
Alex Lebens	d1e7c249a2	Merge pull request 'chore(deps): update sonarr to v4.0.17.2952-ls308' (#6047 ) from renovate/unified-sonarr into main Some checks failed lint-test-helm / lint-helm (push) Successful in 36s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Has been cancelled Details Reviewed-on: #6047	2026-04-18 22:54:42 +00:00
Renovate Bot	f69bb558b4	chore(deps): update sonarr to v4.0.17.2952-ls308 Some checks are pending renovate/stability-days Updates have not met minimum release age requirement Details lint-test-helm / lint-helm (pull_request) Successful in 2m1s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 1m41s Details render-manifests / render-manifests (pull_request) Successful in 2m24s Details	2026-04-18 22:22:52 +00:00
Renovate Bot	d21611ef41	Merge pull request 'chore(deps): update jellystat to v1.1.10' (#6046 ) from renovate/unified-jellystat into main All checks were successful lint-test-helm / lint-helm (push) Successful in 1m49s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 5m1s Details	2026-04-18 22:18:13 +00:00
Renovate Bot	e6a8a2a266	chore(deps): update jellystat to v1.1.10 Some checks are pending renovate/stability-days Updates have not met minimum release age requirement Details lint-test-helm / lint-helm (pull_request) Successful in 2m2s Details lint-test-helm / validate-kubeconform (pull_request) Has been skipped Details render-manifests / render-manifests (pull_request) Successful in 1m40s Details	2026-04-18 22:17:46 +00:00
Alex Lebens	d9615de558	Merge pull request 'chore(deps): update ghcr.io/autobrr/qui docker tag to v1.17.0' (#6043 ) from renovate/unified-qui into main Some checks failed lint-test-helm / lint-helm (push) Successful in 43s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Has been cancelled Details Reviewed-on: #6043	2026-04-18 22:13:19 +00:00
Renovate Bot	7fe46b42aa	chore(deps): update ghcr.io/autobrr/qui docker tag to v1.17.0	2026-04-18 22:13:19 +00:00
Alex Lebens	7e8fef36ec	ci: reconfigure Some checks failed renovate / renovate (push) Has been cancelled Details	2026-04-18 17:13:01 -05:00
Alex Lebens	392b85063c	Merge pull request 'feat: add openbao provider' (#6042 ) from tmp/external-secrets-1 into main All checks were successful lint-test-helm / lint-helm (push) Successful in 38s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details render-manifests / render-manifests (push) Successful in 11m25s Details renovate / renovate (push) Successful in 2m21s Details Reviewed-on: #6042	2026-04-18 00:21:32 +00:00
Alex Lebens	28e42346bc	feat: add openbao provider	2026-04-18 00:21:32 +00:00
Alex Lebens	399d4dcd1f	Merge pull request 'chore(deps): update gotenberg/gotenberg docker tag to v8.31.0' (#6025 ) from renovate/unified-gotenberg into main Some checks failed lint-test-helm / lint-helm (push) Successful in 1m9s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Has been cancelled Details Reviewed-on: #6025	2026-04-18 00:19:15 +00:00
Renovate Bot	705bbef630	chore(deps): update gotenberg/gotenberg docker tag to v8.31.0	2026-04-18 00:19:15 +00:00
Alex Lebens	6d8962f4f3	Merge pull request 'chore(deps): update ollama to v0.21.0' (#6020 ) from renovate/unified-ollama into main Some checks failed lint-test-helm / lint-helm (push) Successful in 43s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Has been cancelled Details Reviewed-on: #6020	2026-04-18 00:15:56 +00:00
Renovate Bot	f3dab16ef6	chore(deps): update ollama to v0.21.0 All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 34s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 27s Details render-manifests / render-manifests (pull_request) Successful in 1m59s Details	2026-04-17 22:56:04 +00:00
Renovate Bot	be8533eb51	Merge pull request 'chore(deps): update ghcr.io/renovatebot/renovate docker tag to v43.129.0' (#6041 ) from renovate/unified-renovate into main All checks were successful renovate / renovate (push) Successful in 8m52s Details	2026-04-17 22:52:41 +00:00
Renovate Bot	a0dc068b4c	chore(deps): update ghcr.io/renovatebot/renovate docker tag to v43.129.0 Some checks are pending renovate/stability-days Updates have not met minimum release age requirement Details	2026-04-17 22:52:23 +00:00