feat: add template to detect authentik versioning

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [harbor.alexlebens.net/images/site-documentation](https://gitea.alexlebens.dev/alexlebens/site-documentation) | minor | `0.3.0` → `0.5.0` |

---

### Release Notes

<details>
<summary>alexlebens/site-documentation (harbor.alexlebens.net/images/site-documentation)</summary>

### [`v0.5.0`](https://gitea.alexlebens.dev/alexlebens/site-documentation/releases/tag/0.5.0)

[Compare Source](https://gitea.alexlebens.dev/alexlebens/site-documentation/compare/0.4.0...0.5.0)

### [0.5.0](http://gitea-http.gitea:3000/alexlebens/site-documentation/compare/0.4.0...0.5.0) (2026-03-23)

##### Features

- add argo-cd ([36be56e](36be56e450))

### [`v0.4.0`](https://gitea.alexlebens.dev/alexlebens/site-documentation/releases/tag/0.4.0)

[Compare Source](https://gitea.alexlebens.dev/alexlebens/site-documentation/compare/0.3.0...0.4.0)

### [0.4.0](http://gitea-http.gitea:3000/alexlebens/site-documentation/compare/0.3.0...0.4.0) (2026-03-23)

##### Bug Fixes

- remove react deps ([5e97a52](5e97a524ba))

##### Features

- add and update pre-commit ([95805dc](95805dcd07))
- add applications, actual ([e21d142](e21d1426d2))
- add argo-workflows ([abde3db](abde3db3c7))
- merge ([a3e6e65](a3e6e65c79))
- remove splash template ([3fecb72](3fecb72e89))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My44NC4yIiwidXBkYXRlZEluVmVyIjoiNDMuODQuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW1hZ2UiXX0=-->

Reviewed-on: #4989
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

.gitea/workflows/lint-test-docker.yaml

@@ -21,14 +21,14 @@ jobs:
     runs-on: ubuntu-js
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
       - name: Check Branch Exists
         id: check-branch-exists
         if: github.event_name == 'pull_request'
-        uses: GuillaumeFalourd/branch-exists@v1.1
+        uses: GuillaumeFalourd/branch-exists@009290475dc3d75b5d7ec680c0c5b614b0d9855d # v1.1
         with:
           branch: "${{ github.base_ref }}"
 
@@ -51,7 +51,7 @@ jobs:
 
       - name: Set Up Node.js
         if: steps.branch-exists.outputs.exists == 'true'
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: '24'
 
@@ -120,7 +120,7 @@ jobs:
           echo "----"
 
       - name: ntfy Failed
-        uses: niniyas/ntfy-action@master
+        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
         if: failure()
         with:
           url: '${{ secrets.NTFY_URL }}'

.gitea/workflows/lint-test-helm.yaml

@@ -28,14 +28,14 @@ jobs:
       changes-detected: ${{ steps.check-dir-changes.outputs.changes-detected }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
       - name: Check Branch Exists
         id: check-branch-exists
         if: github.event_name == 'pull_request'
-        uses: GuillaumeFalourd/branch-exists@v1.1
+        uses: GuillaumeFalourd/branch-exists@009290475dc3d75b5d7ec680c0c5b614b0d9855d # v1.1
         with:
           branch: ${{ github.base_ref }}
 
@@ -58,7 +58,7 @@ jobs:
 
       - name: Set Up Helm
         if: steps.branch-exists.outputs.exists == 'true'
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           # renovate: datasource=github-releases depName=helm/helm
@@ -67,7 +67,7 @@ jobs:
 
       - name: Cache Helm Dependencies
         if: steps.branch-exists.outputs.exists == 'true'
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cache/helm
@@ -209,7 +209,7 @@ jobs:
           exit $EXIT_CODE
 
       - name: ntfy Failed
-        uses: niniyas/ntfy-action@master
+        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
         if: failure()
         with:
           url: '${{ secrets.NTFY_URL }}'
@@ -232,7 +232,7 @@ jobs:
       github.event_name == 'pull_request'
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
@@ -257,7 +257,7 @@ jobs:
           echo "----"
 
       - name: Set Up Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           # renovate: datasource=github-releases depName=helm/helm
@@ -265,7 +265,7 @@ jobs:
           cache: true
 
       - name: Cache Helm Dependencies
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cache/helm
@@ -352,7 +352,7 @@ jobs:
           exit $EXIT_CODE
 
       - name: ntfy Failed
-        uses: niniyas/ntfy-action@master
+        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
         if: failure()
         with:
           url: '${{ secrets.NTFY_URL }}'

.gitea/workflows/render-manifests.yaml

@@ -31,32 +31,32 @@ jobs:
       (github.event_name == 'pull_request' && github.event.pull_request.merged == true)
     steps:
       - name: Checkout Main
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           path: infrastructure
           fetch-depth: 0
 
       - name: Checkout Manifests
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: manifests
           path: infrastructure-manifests
 
       - name: Set Up Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           version: v3.17.2 # Pending https://github.com/helm/helm/pull/30743
           cache: true
 
       - name: Configure Kubeconfig
-        uses: azure/k8s-set-context@v4
+        uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4
         with:
           method: kubeconfig
           kubeconfig: ${{ secrets.KUBECONFIG }}
 
       - name: Cache Helm Dependencies
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cache/helm
@@ -568,7 +568,7 @@ jobs:
           echo "----"
 
       - name: ntfy Created
-        uses: niniyas/ntfy-action@master
+        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
         if: steps.create-pull-request.outputs.pull-request-operation == 'created' && steps.mode.outputs.is-automerge == 'false'
         with:
           url: "${{ secrets.NTFY_URL }}"
@@ -582,7 +582,7 @@ jobs:
           actions: '[{"action": "view", "label": "View PR", "url": "${{ vars.USER_URL }}/${{ github.repository }}/pulls/${{ steps.create-pull-request.outputs.pull-request-number }}", "clear": true}]'
 
       - name: ntfy Updated
-        uses: niniyas/ntfy-action@master
+        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
         if: steps.commit-push.outputs.push == 'true' && steps.check-for-pull-request.outputs.pull-request-exists != 'false' && steps.mode.outputs.is-automerge == 'false'
         with:
           url: "${{ secrets.NTFY_URL }}"
@@ -596,7 +596,7 @@ jobs:
           actions: '[{"action": "view", "label": "View PR", "url": "${{ vars.USER_URL }}/${{ github.repository }}/pulls/${{ steps.create-pull-request.outputs.pull-request-number }}", "clear": true}]'
 
       - name: ntfy Merged
-        uses: niniyas/ntfy-action@master
+        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
         if: steps.merge-changes.outputs.pull-request-operation == 'merged'
         with:
           url: "${{ secrets.NTFY_URL }}"
@@ -610,7 +610,7 @@ jobs:
           actions: '[{"action": "view", "label": "View PR", "url": "${{ vars.USER_URL }}/${{ github.repository }}/pulls/${{ steps.create-pull-request.outputs.pull-request-number }}", "clear": true}]'
 
       - name: ntfy Failed
-        uses: niniyas/ntfy-action@master
+        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
         if: failure()
         with:
           url: "${{ secrets.NTFY_URL }}"

.gitea/workflows/renovate.yaml

@@ -13,10 +13,10 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43
+    container: ghcr.io/renovatebot/renovate:43.84.2@sha256:92285747b3aac062a4f567762c272a12dce037843a20177a02c95b7c420e20cb
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Renovate
         run: renovate
@@ -25,7 +25,7 @@ jobs:
           RENOVATE_ENDPOINT: ${{ vars.INSTANCE_URL }}
           RENOVATE_REPOSITORIES: alexlebens/infrastructure
           RENOVATE_GIT_AUTHOR: Renovate Bot <renovate-bot@alexlebens.net>
-          LOG_LEVEL: info
+          LOG_LEVEL: debug
           RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
           RENOVATE_GIT_PRIVATE_KEY: ${{ secrets.RENOVATE_GIT_PRIVATE_KEY }}
           RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}

clusters/cl01tl/helm/actual/Chart.yaml

@@ -5,11 +5,12 @@ description: Actual
 keywords:
   - actual
   - budget
-home: https://wiki.alexlebens.dev/s/86192f45-94b7-45de-872c-6ef3fec7df5e
+home: https://docs.alexlebens.dev/applications/actual/
 sources:
   - https://github.com/actualbudget/actual
   - https://github.com/actualbudget/actual/pkgs/container/actual
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/actual/values.yaml

@@ -4,20 +4,18 @@ actual:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: ghcr.io/actualbudget/actual
-            tag: 26.3.0
+            tag: 26.3.0@sha256:eb8bc26f53025e07e464594c12d77c52c4b95840c8dadd9b95c4f0c4660f8ad2
-            pullPolicy: IfNotPresent
           env:
-            - name: TZ
+            - name: ACTUAL_PORT
-              value: US/Central
+              value: 5006
           resources:
             requests:
-              cpu: 10m
+              cpu: 25m
-              memory: 128Mi
+              memory: 64Mi
           probes:
             liveness:
               enabled: true
@@ -54,11 +52,8 @@ actual:
         - actual.alexlebens.net
       rules:
         - backendRefs:
-            - group: ''
+            - name: actual
-              kind: Service
-              name: actual
               port: 80
-              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -69,7 +64,6 @@ actual:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 2Gi
-      retain: true
       advancedMounts:
         main:
           main:

clusters/cl01tl/helm/argo-workflows/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: argo-workflows
   repository: https://argoproj.github.io/argo-helm
-  version: 1.0.4
+  version: 1.0.5
 - name: argo-events
   repository: https://argoproj.github.io/argo-helm
   version: 2.4.21
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.10.0
-digest: sha256:84e79ab455d1e8e5d12637b4f1fcc87efaa04f51558824ab9fa1f38963198c8b
+digest: sha256:d0d7ebf1c0013d001aa2f17d04a6d3f3d7a1fa7d5c62792eef856b87c24eb26e
-generated: "2026-03-20T01:09:49.976096171Z"
+generated: "2026-03-20T20:48:30.830922259Z"

clusters/cl01tl/helm/argo-workflows/Chart.yaml

@@ -7,18 +7,19 @@ keywords:
   - argo-events
   - workflows
   - events
-home: https://wiki.alexlebens.dev/s/a268508f-d81d-4b4b-8bd5-9058edaea635
+home: https://docs.alexlebens.dev/applications/argo-workflows/
 sources:
   - https://github.com/argoproj/argo-workflows
   - https://github.com/argoproj/argo-events
   - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://github.com/argoproj/argo-helm/tree/main/charts
+  - https://github.com/argoproj/argo-helm/tree/main/charts/argo-workflows
+  - https://github.com/argoproj/argo-helm/tree/main/charts/argo-events
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-workflows
-    version: 1.0.4
+    version: 1.0.5
     repository: https://argoproj.github.io/argo-helm
   - name: argo-events
     version: 2.4.21

clusters/cl01tl/helm/argo-workflows/templates/external-secret.yaml

@@ -14,15 +14,9 @@ spec:
   data:
     - secretKey: secret
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/argo-workflows
-        metadataPolicy: None
         property: secret
     - secretKey: client
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/argo-workflows
-        metadataPolicy: None
         property: client

clusters/cl01tl/helm/argo-workflows/templates/http-route.yaml

@@ -1,28 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: argo-workflows
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: argo-workflows
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-  hostnames:
-    - argo-workflows.alexlebens.net
-  rules:
-    - matches:
-      - path:
-          type: PathPrefix
-          value: /
-      backendRefs:
-        - group: ''
-          kind: Service
-          name: argo-workflows-server
-          port: 2746
-          weight: 100

clusters/cl01tl/helm/argo-workflows/values.yaml

@@ -2,8 +2,6 @@ argo-workflows:
   crds:
     install: true
     keep: true
-    # -- Use full CRDs with complete OpenAPI schemas. When false, uses minified CRDs with x-kubernetes-preserve-unknown-fields.
-    # Full CRDs are very large and are installed via a pre-install/pre-upgrade hook Job that uses server-side apply.
     full: true
     upgradeJob:
       image:
@@ -13,11 +11,6 @@ argo-workflows:
     metricsConfig:
       enabled: true
     persistence:
-      connectionPool:
-        maxIdleConns: 100
-        maxOpenConns: 0
-      nodeStatusOffLoad: true
-      archive: true
       postgresql:
         host: argo-workflows-postgresql-18-cluster-rw
         port: 5432
@@ -32,24 +25,34 @@ argo-workflows:
         ssl: false
         sslMode: disable
     workflowWorkers: 2
-    workflowTTLWorkers: 1
+    workflowTTLWorkers: 2
-    podCleanupWorkers: 1
+    podCleanupWorkers: 2
-    cronWorkflowWorkers: 1
+    cronWorkflowWorkers: 2
     resources:
       requests:
         cpu: 10m
-        memory: 128Mi
+        memory: 32Mi
     serviceMonitor:
       enabled: true
-    name: workflow-controller
     workflowNamespaces:
-      - argocd
       - argo-workflows
   server:
     authModes:
       - sso
-    ingress:
+    httproute:
-      enabled: false
+      enabled: true
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - argo-workflows.alexlebens.net
+      rules:
+        - matches:
+            - path:
+                type: PathPrefix
+                value: /
     sso:
       enabled: true
       issuer: https://authentik.alexlebens.net/application/o/argo-workflows/
@@ -66,15 +69,15 @@ argo-workflows:
         - openid
         - email
         - profile
-  useStaticCredentials: true
-  artifactRepository:
-    archiveLogs: false
 argo-events:
+  crds:
+    install: true
+    keep: true
   controller:
     resources:
       requests:
         cpu: 10m
-        memory: 128Mi
+        memory: 32Mi
     metrics:
       enabled: true
       serviceMonitor:
@@ -84,7 +87,7 @@ argo-events:
     resources:
       requests:
         cpu: 10m
-        memory: 128Mi
+        memory: 32Mi
 postgres-18-cluster:
   mode: recovery
   recovery:
@@ -98,32 +101,9 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
-      # - name: garage-remote
-      #   index: 1
-      #   destinationBucket: postgres-backups
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   retentionPolicy: "90d"
-      #   data:
-      #     compression: bzip2
-      # - name: external
-      #   index: 1
-      #   endpointURL: https://nyc3.digitaloceanspaces.com
-      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 0 14 * * *"
         backupName: garage-local
-      # - name: weekly-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 4 * * SAT"
-      #   backupName: garage-remote
-      # - name: daily-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 0 * * *"
-      #   backupName: external

clusters/cl01tl/helm/argocd/Chart.yaml

@@ -4,10 +4,8 @@ version: 1.0.0
 description: Argo CD
 keywords:
   - argo-cd
-  - delivery
   - deployment
-  - gitops
+home: https://docs.alexlebens.dev/applications/argo-cd/
-home: https://wiki.alexlebens.dev/s/8a75cf26-b9df-437e-9cc5-2ef47e871a5f
 sources:
   - https://github.com/argoproj/argo-cd
   - https://github.com/argoproj/argo-helm/tree/main/charts/argo-cd

clusters/cl01tl/helm/argocd/templates/external-secret.yaml

@@ -14,17 +14,11 @@ spec:
   data:
     - secretKey: secret
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/argocd
-        metadataPolicy: None
         property: secret
     - secretKey: client
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/argocd
-        metadataPolicy: None
         property: client
 
 ---
@@ -44,10 +38,7 @@ spec:
   data:
     - secretKey: ntfy-token
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /ntfy/user/cl01tl
-        metadataPolicy: None
         property: token
 
 ---
@@ -67,22 +58,13 @@ spec:
   data:
     - secretKey: type
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/argocd/credentials/repo/infrastructure
-        metadataPolicy: None
         property: type
     - secretKey: url
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/argocd/credentials/repo/infrastructure
-        metadataPolicy: None
         property: url
     - secretKey: sshPrivateKey
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/argocd/credentials/repo/infrastructure
-        metadataPolicy: None
         property: sshPrivateKey

clusters/cl01tl/helm/argocd/values.yaml

@@ -1,12 +1,11 @@
 argo-cd:
   crds:
     install: true
+    keep: true
   configs:
     cm:
       admin.enabled: true
       accounts.homepage: apiKey
-      timeout.reconciliation: 100s
-      timeout.reconciliation.jitter: 60s
       url: https://argocd.alexlebens.net
       statusbadge.url: https://argocd.alexlebens.net/
       statusbadge.enabled: true
@@ -33,12 +32,53 @@ argo-cd:
         g, homepage, role:readonly
   controller:
     replicas: 1
+    resources:
+      requests:
+        cpu: 15m
+        memory: 1Gi
+    readinessProbe:
+      failureThreshold: 3
+      initialDelaySeconds: 60
+      periodSeconds: 30
+      successThreshold: 1
+      timeoutSeconds: 5
     metrics:
       enabled: true
       serviceMonitor:
         enabled: true
+      rules:
+        enabled: true
+      spec:
+        - alert: ArgoAppMissing
+          expr: |
+            absent(argocd_app_info) == 1
+          for: 15m
+          labels:
+            severity: critical
+          annotations:
+            summary: "[Argo CD] No reported applications"
+            description: >
+              Argo CD has not reported any applications data for the past 15 minutes which
+              means that it must be down or not functioning properly.  This needs to be
+              resolved for this cloud to continue to maintain state.
+        - alert: ArgoAppNotSynced
+          expr: |
+            argocd_app_info{sync_status!="Synced"} == 1
+          for: 12h
+          labels:
+            severity: warning
+          annotations:
+            summary: "[{{`{{$labels.name}}`}}] Application not synchronized"
+            description: >
+              The application [{{`{{$labels.name}}`}} has not been synchronized for over
+              12 hours which means that the state of this cloud has drifted away from the
+              state inside Git.
   dex:
     enabled: true
+    resources:
+      requests:
+        cpu: 10m
+        memory: 64Mi
     metrics:
       enabled: true
       serviceMonitor:
@@ -49,20 +89,57 @@ argo-cd:
       enabled: true
   redis-ha:
     enabled: true
+    image:
+      repository: redis
+      tag: 8.6.1-alpine@sha256:315270d166080f537bbdf1b489b603aaaa213cb55a544acfa51feb7481abb1c0
+    persistentVolume:
+      enabled: true
+    redis:
+      resources:
+        requests:
+          cpu: 1000m
+          memory: 64Mi
+    haproxy:
+      enabled: true
+      image:
+        repository: haproxy
+        tag: 3.3.6-alpine@sha256:744be2dca649a44d490a4c565d36968d19482dd387f1bdd44c168f4322bc6b1e
+      resources:
+        requests:
+          cpu: 10m
+          memory: 128Mi
+      metrics:
+        enabled: true
+        serviceMonitor:
+          enabled: true
+    exporter:
+      enabled: true
+      image: ghcr.io/oliver006/redis_exporter
+      tag: v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
+      serviceMonitor:
+        enabled: true
+    prometheusRule:
+      enabled: true
+      interval: 30s
+      rules:
+        - alert: RedisPodDown
+          expr: |
+            redis_up{job="{{ include "redis-ha.fullname" . }}"} == 0
+          for: 5m
+          labels:
+            severity: critical
+          annotations:
+            description: Redis pod {{ "{{ $labels.pod }}" }} is down
+            summary: Redis pod {{ "{{ $labels.pod }}" }} is down
     auth: false
   redisSecretInit:
     enabled: false
   server:
     replicas: 2
-    extensions:
+    resources:
-      enabled: true
+     requests:
-      extensionList:
+       cpu: 10m
-        - name: extension-trivy
+       memory: 64Mi
-          env:
-            - name: EXTENSION_URL
-              value: https://github.com/mziyabo/argocd-trivy-extension/releases/download/v0.2.0/extension-trivy.tar
-            - name: EXTENSION_CHECKSUM_URL
-              value: https://github.com/mziyabo/argocd-trivy-extension/releases/download/v0.2.0/extension-trivy_checksums.txt
     metrics:
       enabled: true
       serviceMonitor:
@@ -76,30 +153,55 @@ argo-cd:
           namespace: traefik
       hostnames:
         - argocd.alexlebens.net
-      rules:
-        - matches:
-            - path:
-                type: PathPrefix
-                value: /
   repoServer:
     replicas: 2
+    resources:
+      requests:
+        cpu: 10m
+        memory: 64Mi
+    readinessProbe:
+      enabled: true
+      failureThreshold: 3
+      initialDelaySeconds: 60
+      periodSeconds: 30
+      successThreshold: 1
+      timeoutSeconds: 5
+    livenessProbe:
+      enabled: true
+      failureThreshold: 3
+      initialDelaySeconds: 60
+      periodSeconds: 30
+      successThreshold: 1
+      timeoutSeconds: 5
     metrics:
       enabled: true
       serviceMonitor:
         enabled: true
   applicationSet:
     replicas: 2
+    resources:
+      requests:
+        cpu: 10m
+        memory: 64Mi
     metrics:
       enabled: true
       serviceMonitor:
         enabled: true
-    livenessProbe:
-      enabled: true
     readinessProbe:
       enabled: true
-  notifications:
+      failureThreshold: 3
+      initialDelaySeconds: 60
+      periodSeconds: 30
+      successThreshold: 1
+      timeoutSeconds: 5
+    livenessProbe:
       enabled: true
-    context:
+      failureThreshold: 3
+      initialDelaySeconds: 60
+      periodSeconds: 30
+      successThreshold: 1
+      timeoutSeconds: 5
+  notifications:
     argocdUrl: https://argocd.alexlebens.net
     secret:
       create: false
@@ -114,6 +216,10 @@ argo-cd:
         headers:
           - name: Authorization
             value: Bearer $ntfy-token
+    resources:
+      requests:
+        cpu: 10m
+        memory: 64Mi
     livenessProbe:
       enabled: true
     readinessProbe:

clusters/cl01tl/helm/audiobookshelf/Chart.yaml

@@ -7,11 +7,14 @@ keywords:
   - books
   - podcasts
   - audiobooks
-home: https://wiki.alexlebens.dev/s/d4d6719f-cd1c-4b6e-b78e-2d2d7a5097d7
+home: https://docs.alexlebens.dev/applications/audiobookshelf/
 sources:
   - https://github.com/advplyr/audiobookshelf
+  - https://github.com/caronc/apprise
   - https://github.com/advplyr/audiobookshelf/pkgs/container/audiobookshelf
+  - https://github.com/caronc/apprise-api/pkgs/container/apprise
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/audiobookshelf/templates/external-secret.yaml

@@ -14,8 +14,5 @@ spec:
   data:
     - secretKey: ntfy-url
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/audiobookshelf/apprise
-        metadataPolicy: None
         property: ntfy-url

clusters/cl01tl/helm/audiobookshelf/values.yaml

@@ -4,28 +4,25 @@ audiobookshelf:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: ghcr.io/advplyr/audiobookshelf
-            tag: 2.33.1
+            tag: 2.33.1@sha256:a4a5841bba093d81e5f4ad1eaedb4da3fda6dbb2528c552349da50ad1f7ae708
-            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: US/Central
+              value: America/Chicago
           resources:
             requests:
               cpu: 10m
-              memory: 128Mi
+              memory: 200Mi
         apprise-api:
           image:
-            repository: caronc/apprise
+            repository: ghcr.io/caronc/apprise
-            tag: v1.3.2
+            tag: v1.3.2@sha256:1aafc2118b6eae5d70d17831d9a8a52adee7104fd6f2bb018e6421664699c903
-            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: US/Central
+              value: America/Chicago
             - name: PGID
               value: "1000"
             - name: PUID
@@ -41,10 +38,6 @@ audiobookshelf:
                 secretKeyRef:
                   name: audiobookshelf-apprise-config
                   key: ntfy-url
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
   service:
     main:
       controller: main
@@ -82,11 +75,8 @@ audiobookshelf:
         - audiobookshelf.alexlebens.net
       rules:
         - backendRefs:
-            - group: ''
+            - name: audiobookshelf
-              kind: Service
-              name: audiobookshelf
               port: 80
-              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -97,7 +87,6 @@ audiobookshelf:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 2Gi
-      retain: true
       advancedMounts:
         main:
           main:
@@ -108,7 +97,6 @@ audiobookshelf:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 10Gi
-      retain: true
       advancedMounts:
         main:
           main:

clusters/cl01tl/helm/authentik/Chart.yaml

@@ -6,10 +6,8 @@ keywords:
   - authentik
   - sso
   - oidc
-  - ldap
-  - idp
   - authentication
-home: https://wiki.alexlebens.dev/s/45ca5171-581f-41d2-b6fb-2b0915029a2d
+home: https://docs.alexlebens.dev/applications/authentik/
 sources:
   - https://github.com/goauthentik/authentik
   - https://github.com/cloudflare/cloudflared
@@ -17,6 +15,7 @@ sources:
   - https://github.com/goauthentik/helm
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/authentik/templates/external-secret.yaml

@@ -14,8 +14,5 @@ spec:
   data:
     - secretKey: key
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/authentik/key
-        metadataPolicy: None
         property: key

clusters/cl01tl/helm/authentik/values.yaml

@@ -30,8 +30,23 @@ authentik:
     redis:
       host: authentik-valkey
   server:
-    name: server
+    replicas: 2
-    replicas: 1
+    resources:
+      requests:
+        cpu: 100m
+        memory: 700Mi
+    livenessProbe:
+      failureThreshold: 3
+      initialDelaySeconds: 15
+      periodSeconds: 10
+      successThreshold: 1
+      timeoutSeconds: 5
+    readinessProbe:
+      failureThreshold: 3
+      initialDelaySeconds: 15
+      periodSeconds: 10
+      successThreshold: 1
+      timeoutSeconds: 5
     metrics:
       enabled: true
       serviceMonitor:
@@ -39,8 +54,6 @@ authentik:
     route:
       main:
         enabled: true
-        apiVersion: gateway.networking.k8s.io/v1
-        kind: HTTPRoute
         hostnames:
           - authentik.alexlebens.net
         parentRefs:
@@ -48,21 +61,20 @@ authentik:
             kind: Gateway
             name: traefik-gateway
             namespace: traefik
-        httpsRedirect: false
-        matches:
-          - path:
-              type: PathPrefix
-              value: /
   worker:
     name: worker
-    replicas: 1
+    replicas: 2
+    resources:
+      requests:
+        cpu: 100m
+        memory: 512Mi
+    metrics:
+      enabled: true
+      serviceMonitor:
+        enabled: true
   prometheus:
     rules:
       enabled: true
-  postgresql:
-    enabled: false
-  redis:
-    enabled: false
 postgres-18-cluster:
   mode: recovery
   recovery:
@@ -76,32 +88,9 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
-      # - name: garage-remote
-      #   index: 1
-      #   destinationBucket: postgres-backups
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   retentionPolicy: "90d"
-      #   data:
-      #     compression: bzip2
-      # - name: external
-      #   index: 1
-      #   endpointURL: https://nyc3.digitaloceanspaces.com
-      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 5 14 * * *"
         backupName: garage-local
-      # - name: weekly-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 4 * * SAT"
-      #   backupName: garage-remote
-      # - name: daily-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 0 * * *"
-      #   backupName: external

clusters/cl01tl/helm/blocky/values.yaml

@@ -98,7 +98,7 @@ blocky:
 
               traefik-cl01tl                  IN      A       10.232.1.21
               blocky                          IN      A       10.232.1.22
-              cilium-cl01tl                   IN      A       10.232.1.23
+              plex-lb                         IN      A       10.232.1.23
 
 
               ;; Application Names
@@ -117,6 +117,7 @@ blocky:
               directus                        IN      CNAME   traefik-cl01tl
               excalidraw                      IN      CNAME   traefik-cl01tl
               feishin                         IN      CNAME   traefik-cl01tl
+              foldergram                      IN      CNAME   traefik-cl01tl
               garage-s3                       IN      CNAME   traefik-cl01tl
               garage-webui                    IN      CNAME   traefik-cl01tl
               gatus                           IN      CNAME   traefik-cl01tl
@@ -127,12 +128,14 @@ blocky:
               home                            IN      CNAME   traefik-cl01tl
               home-assistant                  IN      CNAME   traefik-cl01tl
               home-assistant-code-server      IN      CNAME   traefik-cl01tl
+              houndarr                        IN      CNAME   traefik-cl01tl
               hubble                          IN      CNAME   traefik-cl01tl
               immich                          IN      CNAME   traefik-cl01tl
               jellyfin                        IN      CNAME   traefik-cl01tl
               jellystat                       IN      CNAME   traefik-cl01tl
               kiwix                           IN      CNAME   traefik-cl01tl
               komodo                          IN      CNAME   traefik-cl01tl
+              languagetool                    IN      CNAME   traefik-cl01tl
               lidarr                          IN      CNAME   traefik-cl01tl
               mail                            IN      CNAME   traefik-cl01tl
               medialyze                       IN      CNAME   traefik-cl01tl

clusters/cl01tl/helm/booklore/Chart.yaml

@@ -4,11 +4,14 @@ version: 1.0.0
 description: booklore
 keywords:
   - booklore
+  - grimmory
   - books
 home: https://wiki.alexlebens.dev/
 sources:
   - https://github.com/booklore-app/BookLore
+  - https://github.com/grimmory-tools/grimmory
   - https://github.com/booklore-app/booklore/pkgs/container/booklore
+  - https://github.com/grimmory-tools/grimmory/pkgs/container/grimmory
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
 maintainers:
   - name: alexlebens
@@ -29,5 +32,5 @@ dependencies:
     version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/booklore.png
-# renovate: datasource=github-releases depName=booklore-app/BookLore
+# renovate: datasource=github-releases depName=grimmory-tools/grimmory
-appVersion: v2.2.1
+appVersion: v2.3.0

clusters/cl01tl/helm/booklore/values.yaml

@@ -8,8 +8,8 @@ booklore:
       containers:
         main:
           image:
-            repository: ghcr.io/booklore-app/booklore
+            repository: ghcr.io/grimmory-tools/grimmory
-            tag: v2.2.1
+            tag: v2.3.0
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/dawarich/Chart.yaml

@@ -26,4 +26,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/dawarich.png
 # renovate: datasource=github-releases depName=Freika/dawarich
-appVersion: 1.3.4
+appVersion: 1.4.0

clusters/cl01tl/helm/dawarich/values.yaml

@@ -9,7 +9,7 @@ dawarich:
         main:
           image:
             repository: freikin/dawarich
-            tag: 1.3.4
+            tag: 1.4.0
             pullPolicy: IfNotPresent
           command: ["web-entrypoint.sh"]
           args: ["bin/rails", "server", "-p", "3000", "-b", "::"]
@@ -106,7 +106,7 @@ dawarich:
         sidekiq:
           image:
             repository: freikin/dawarich
-            tag: 1.3.4
+            tag: 1.4.0
             pullPolicy: IfNotPresent
           command: ["sidekiq-entrypoint.sh"]
           args: ["sidekiq"]

clusters/cl01tl/helm/decluttarr/Chart.lock

@@ -1,6 +0,0 @@
-dependencies:
-- name: app-template
-  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
-digest: sha256:548ae1f8699100a2f6bac11a4a3137402b3eea340c7a3db4d9f1813ad6a11dca
-generated: "2026-02-23T22:08:42.516245-06:00"

clusters/cl01tl/helm/decluttarr/Chart.yaml

@@ -1,20 +0,0 @@
-apiVersion: v2
-name: decluttarr
-version: 1.0.0
-description: decluttarr
-keywords:
-  - decluttarr
-  - servarr
-home: https://wiki.alexlebens.dev/s/
-sources:
-  - https://github.com/ManiMatter/decluttarr
-  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: decluttarr
-    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.6.2
-# renovate: datasource=github-releases depName=ManiMatter/decluttarr
-appVersion: v2.0.0

clusters/cl01tl/helm/decluttarr/templates/external-secret.yaml

@@ -1,21 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: decluttarr-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: decluttarr-config-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.yaml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/decluttarr/config
-        metadataPolicy: None
-        property: config.yaml

clusters/cl01tl/helm/decluttarr/values.yaml

@@ -1,32 +0,0 @@
-decluttarr:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: ghcr.io/manimatter/decluttarr
-            tag: v2.0.0
-            pullPolicy: IfNotPresent
-          env:
-            - name: TZ
-              value: America/Chicago
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  persistence:
-    config:
-      enabled: true
-      type: secret
-      name: decluttarr-config-secret
-      advancedMounts:
-        main:
-          main:
-            - path: /app/config/config.yaml
-              readOnly: true
-              mountPropagation: None
-              subPath: config.yaml

clusters/cl01tl/helm/eraser/values.yaml

@@ -34,27 +34,7 @@ eraser:
         request:
           cpu: 100m
           memory: 128Mi
-        config: "" # |
+        config: ""
-          # cacheDir: /var/lib/trivy
-          # dbRepo: ghcr.io/aquasecurity/trivy-db
-          # deleteFailedImages: true
-          # deleteEOLImages: true
-          # vulnerabilities:
-          #   ignoreUnfixed: true
-          #   types:
-          #     - os
-          #     - library
-          #   securityChecks:
-          #     - vuln
-          #   severities:
-          #     - CRITICAL
-          #     - HIGH
-          #     - MEDIUM
-          #     - LOW
-          #   ignoredStatuses:
-          # timeout:
-          #   total: 23h
-          #   perImage: 1h
       remover:
         request:
           cpu: 10m

clusters/cl01tl/helm/external-secrets/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: external-secrets
   repository: https://charts.external-secrets.io
-  version: 2.1.0
+  version: 2.2.0
-digest: sha256:b19563d51f1922403185979c6c442531a7bb13d302e8438b5a18d450259b7245
+digest: sha256:832fc3f8d3728bdea2b696a6044e4c18967cd9ab9c5cc74adbf40aaa270a84b4
-generated: "2026-03-07T18:02:23.908145348Z"
+generated: "2026-03-20T20:53:08.407747649Z"

clusters/cl01tl/helm/external-secrets/Chart.yaml

@@ -12,8 +12,8 @@ sources:
   - https://github.com/external-secrets/external-secrets/tree/main/deploy/charts/external-secrets
 dependencies:
   - name: external-secrets
-    version: 2.1.0
+    version: 2.2.0
     repository: https://charts.external-secrets.io
 icon: https://avatars.githubusercontent.com/u/68335991?s=48&v=4
 # renovate: datasource=github-releases depName=external-secrets/external-secrets
-appVersion: v2.1.0
+appVersion: v2.2.0

clusters/cl01tl/helm/foldergram/Chart.lock

@@ -0,0 +1,9 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.6.2
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.8.0
+digest: sha256:59100c6fbfb829f9d703b9ee1cf869c4fd77b6ff53c63b0c644a757223027e58
+generated: "2026-03-22T12:42:43.150705-05:00"

clusters/cl01tl/helm/foldergram/Chart.yaml

@@ -0,0 +1,25 @@
+apiVersion: v2
+name: foldergram
+version: 1.0.0
+description: Foldergram
+keywords:
+  - foldergram
+  - pictures
+home: https://wiki.alexlebens.dev/
+sources:
+  - https://github.com/foldergram/foldergram
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: foldergram
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.6.2
+  - name: volsync-target
+    alias: volsync-target-data
+    version: 0.8.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
+# renovate: datasource=github-releases depName=foldergram/foldergram
+appVersion: v1.0.5

clusters/cl01tl/helm/foldergram/templates/persistent-volume-claim.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: foldergram-pictures-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: foldergram-pictures-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  volumeName: foldergram-pictures-nfs-storage
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi

clusters/cl01tl/helm/foldergram/templates/persistent-volume.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: foldergram-pictures-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: foldergram-pictures-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: nfs-client
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    path: /volume2/Storage/Pictures
+    server: synologybond.alexlebens.net
+  mountOptions:
+    - vers=4
+    - minorversion=1
+    - noac

clusters/cl01tl/helm/foldergram/values.yaml

@@ -0,0 +1,87 @@
+foldergram:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: ghcr.io/foldergram/foldergram
+            tag: 1.0.5
+            pullPolicy: IfNotPresent
+          env:
+            - name: IMAGE_DETAIL_SOURCE
+              value: original
+            - name: DERIVATIVE_MODE
+              value: lazy
+            - name: DATA_ROOT
+              value: ./data
+            - name: GALLERY_ROOT
+              value: /gallery
+            - name: CSRF_TRUSTED_ORIGINS
+              value: https://foldergram.alexlebens.net
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 4141
+          protocol: HTTP
+  route:
+    main:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - foldergram.alexlebens.net
+      rules:
+        - backendRefs:
+            - group: ''
+              kind: Service
+              name: foldergram
+              port: 80
+              weight: 100
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+  persistence:
+    cache:
+      forceRename: foldergram-data
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      retain: false
+      advancedMounts:
+        main:
+          main:
+            - path: /app/data
+              readOnly: false
+    pictures:
+      existingClaim: foldergram-pictures-nfs-storage
+      advancedMounts:
+        main:
+          main:
+            - path: /gallery/pictures
+              readOnly: true
+volsync-target-data:
+  pvcTarget: foldergram-data
+  local:
+    enabled: true
+    schedule: 46 11 * * *
+  remote:
+    enabled: true
+    schedule: 46 12 * * *
+  external:
+    enabled: true
+    schedule: 46 13 * * *

clusters/cl01tl/helm/gatus/values.yaml

@@ -161,6 +161,9 @@ gatus:
       - name: photoview
         url: https://photoview.alexlebens.net
         <<: *defaults
+      - name: foldergram
+        url: https://foldergram.alexlebens.net
+        <<: *defaults
       - name: booklore
         url: https://booklore.alexlebens.net
         <<: *defaults
@@ -191,6 +194,9 @@ gatus:
       - name: excalidraw
         url: https://excalidraw.alexlebens.net
         <<: *defaults
+      - name: languagetool
+        url: https://languagetool.alexlebens.net
+        <<: *defaults
       - name: gitea
         url: https://gitea.alexlebens.net
         <<: *defaults
@@ -304,6 +310,9 @@ gatus:
       - name: tdarr
         url: https://tdarr.alexlebens.net
         <<: *defaults
+      - name: houndarr
+        url: https://houndarr.alexlebens.net
+        <<: *defaults
       - name: sonarr
         url: http://sonarr.sonarr:80
         <<: *defaults

clusters/cl01tl/helm/grafana-operator/templates/grafana-dashboard.yaml

@@ -377,25 +377,6 @@ spec:
   resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/tdarr.json
 
----
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDashboard
-metadata:
-  name: grafana-dashboard-trivy
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: grafana-dashboard-trivy
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  instanceSelector:
-    matchLabels:
-      app: grafana-main
-  contentCacheDuration: 1h
-  folderUID: grafana-folder-service
-  resyncPeriod: 1h
-  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/trivy.json
-
 ---
 apiVersion: grafana.integreatly.org/v1beta1
 kind: GrafanaDashboard

clusters/cl01tl/helm/headlamp/values.yaml

@@ -25,9 +25,6 @@ headlamp:
         - name: cert-manager
           source: https://artifacthub.io/packages/headlamp/headlamp-plugins/headlamp_cert-manager
           version: 0.1.0
-        - name: trivy
-          source: https://artifacthub.io/packages/headlamp/headlamp-trivy/headlamp_trivy
-          version: 0.3.1
         - name: external-secrets-operator
           source: https://artifacthub.io/packages/headlamp/external-secrets-operator-headlamp-plugin/external-secrets-operator
           version: 0.1.0-beta7

clusters/cl01tl/helm/home-assistant/Chart.yaml

@@ -25,4 +25,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/home-assistant.png
 # renovate: datasource=github-releases depName=home-assistant/core
-appVersion: 2026.3.2
+appVersion: 2026.3.3

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -9,7 +9,7 @@ home-assistant:
         main:
           image:
             repository: ghcr.io/home-assistant/home-assistant
-            tag: 2026.3.2
+            tag: 2026.3.3
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/homepage/values.yaml

@@ -202,9 +202,15 @@ homepage:
                   href: https://photoview.alexlebens.net
                   siteMonitor: http://photoview.photoview:80
                   statusStyle: dot
+              - Pictures:
+                  icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
+                  description: Foldergram
+                  href: https://foldergram.alexlebens.net
+                  siteMonitor: http://foldergram.foldergram:80
+                  statusStyle: dot
               - Books:
                   icon: sh-booklore.webp
-                  description: Booklore
+                  description: Grimmory
                   href: https://booklore.alexlebens.net
                   siteMonitor: http://booklore.booklore:80
                   statusStyle: dot
@@ -633,6 +639,12 @@ homepage:
                   href: https://bazarr.alexlebens.net
                   siteMonitor: http://bazarr.bazarr:80
                   statusStyle: dot
+              - Houndarr:
+                  icon: https://raw.githubusercontent.com/av1155/houndarr/main/src/houndarr/static/img/houndarr-logo-dark.png
+                  description: Media Searches
+                  href: https://houndarr.alexlebens.net
+                  siteMonitor: http://houndarr.houndarr:80
+                  statusStyle: dot
               - Tdarr:
                   icon: sh-tdarr.webp
                   description: Media transcoding and health checks

clusters/cl01tl/helm/houndarr/Chart.lock

@@ -0,0 +1,9 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.6.2
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.8.0
+digest: sha256:375d6c2eb2f097717c44c5a28cb162da24f4ff154a971e5a68ccd0e0b77e936f
+generated: "2026-03-21T22:31:01.142752-05:00"

clusters/cl01tl/helm/houndarr/Chart.yaml

@@ -0,0 +1,25 @@
+apiVersion: v2
+name: houndarr
+version: 1.0.0
+description: Houndarr
+keywords:
+  - houndarr
+  - servarr
+home: https://wiki.alexlebens.dev/s/
+sources:
+  - https://github.com/av1155/houndarr
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: houndarr
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.6.2
+  - name: volsync-target
+    alias: volsync-target-data
+    version: 0.8.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+icon: https://raw.githubusercontent.com/av1155/houndarr/main/src/houndarr/static/img/houndarr-logo-dark.png
+# renovate: datasource=github-releases depName=av1155/houndarr
+appVersion: v1.6.1

clusters/cl01tl/helm/houndarr/values.yaml

@@ -0,0 +1,84 @@
+houndarr:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: ghcr.io/av1155/houndarr
+            tag: v1.6.0
+            pullPolicy: IfNotPresent
+          env:
+            - name: TZ
+              value: America/Chicago
+            - name: PUID
+              value: 1000
+            - name: PGID
+              value: 1000
+            - name: HOUNDARR_SECURE_COOKIES
+              value: true
+            - name: HOUNDARR_TRUSTED_PROXIES
+              value: 10.96.0.0/12
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 8877
+          protocol: HTTP
+  route:
+    main:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - houndarr.alexlebens.net
+      rules:
+        - backendRefs:
+            - group: ''
+              kind: Service
+              name: houndarr
+              port: 80
+              weight: 100
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+  persistence:
+    data:
+      forceRename: houndarr-data
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 1Gi
+      advancedMounts:
+        main:
+          main:
+            - path: /data
+              readOnly: false
+volsync-target-data:
+  pvcTarget: houndarr-data
+  moverSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
+  local:
+    enabled: true
+    schedule: 40 11 * * *
+  remote:
+    enabled: true
+    schedule: 40 12 * * *
+  external:
+    enabled: true
+    schedule: 40 14 * * *

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 82.12.0
+  version: 82.13.0
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.6.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
-digest: sha256:05c8453c68596a58884eb65cc0e2f86f5aaa764a63fe4b8c53d40b5f9b40670e
+digest: sha256:1d90bebd9c0afd20f8ff780edd15da18b20f89cf35fd85832d6d8d44b2e0544b
-generated: "2026-03-19T09:02:27.865169773Z"
+generated: "2026-03-20T18:02:38.368086545Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 82.12.0
+    version: 82.13.0
     repository: oci://ghcr.io/prometheus-community/charts
   - name: app-template
     alias: ntfy-alertmanager

clusters/cl01tl/helm/languagetool/Chart.lock

@@ -0,0 +1,9 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.6.2
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.8.0
+digest: sha256:cb14506ada77add5ffcb93d38763e2a5c962312e5754618265d15c4361fea783
+generated: "2026-03-20T17:49:46.393059-05:00"

clusters/cl01tl/helm/languagetool/Chart.yaml

@@ -0,0 +1,27 @@
+apiVersion: v2
+name: languagetool
+version: 1.0.0
+description: LanguageTool
+keywords:
+  - languagetool
+  - spellchecking
+home: https://wiki.alexlebens.dev/
+sources:
+  - https://github.com/languagetool-org/languagetool
+  - https://github.com/Erikvl87/docker-languagetool
+  - https://hub.docker.com/r/erikvl87/languagetool
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: languagetool
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.6.2
+  - name: volsync-target
+    alias: volsync-target-data
+    version: 0.8.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/languagetool.webp
+# renovate: datasource=github-releases depName=Erikvl87/docker-languagetool
+appVersion: "6.7"

clusters/cl01tl/helm/languagetool/values.yaml

@@ -0,0 +1,76 @@
+languagetool:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: erikvl87/languagetool
+            tag: 6.7
+            pullPolicy: IfNotPresent
+          env:
+            - name: langtool_languageModel
+              value: /ngrams
+            - name: Java_Xms
+              value: 512m
+            - name: Java_Xmx
+              value: 1g
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 8010
+          protocol: HTTP
+  route:
+    main:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - languagetool.alexlebens.net
+      rules:
+        - backendRefs:
+            - group: ''
+              kind: Service
+              name: languagetool
+              port: 80
+              weight: 100
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+  persistence:
+    data:
+      forceRename: languagetool-data
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 1Gi
+      retain: true
+      advancedMounts:
+        main:
+          main:
+            - path: /ngrams
+              readOnly: false
+volsync-target-data:
+  pvcTarget: languagetool-data
+  local:
+    enabled: true
+    schedule: 38 11 * * *
+  remote:
+    enabled: true
+    schedule: 38 12 * * *
+  external:
+    enabled: true
+    schedule: 38 14 * * *

clusters/cl01tl/helm/matrix-synapse/values.yaml

@@ -345,7 +345,7 @@ mautrix-whatsapp:
         main:
           image:
             repository: dock.mau.dev/mautrix/whatsapp
-            tag: v0.2603.0
+            tag: v0.2602.0
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/medialyze/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     version: 4.6.2
 icon: https://raw.githubusercontent.com/frederikemmer/MediaLyze/d8f69c0628bac7c047b90f91a66341648029c273/frontend/public/favicon.svg
 # renovate: datasource=github-releases depName=frederikemmer/MediaLyze
-appVersion: 0.2.2
+appVersion: 0.2.3

clusters/cl01tl/helm/medialyze/values.yaml

@@ -9,7 +9,7 @@ medialyze:
         main:
           image:
             repository: ghcr.io/frederikemmer/medialyze
-            tag: 0.2.2
+            tag: 0.2.3
             pullPolicy: IfNotPresent
           env:
             - name: HOST_PORT

clusters/cl01tl/helm/music-grabber/values.yaml

@@ -9,7 +9,7 @@ music-grabber:
         main:
           image:
             repository: g33kphr33k/musicgrabber
-            tag: 2.4.6
+            tag: 2.5.0
             pullPolicy: IfNotPresent
           env:
             - name: MUSIC_DIR

clusters/cl01tl/helm/plex/values.yaml

@@ -9,7 +9,7 @@ plex:
         main:
           image:
             repository: ghcr.io/linuxserver/plex
-            tag: 1.43.0@sha256:84f8646e799f6636876ab4f283d9fc8f6c51d56098ea74cba82bfb85074b68df
+            tag: 1.43.0@sha256:a27f1ce1e1d14cd3627ed217f042bf8de0f796ed274fb27b2dc971ae22a64b95
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -26,6 +26,7 @@ plex:
   service:
     main:
       controller: main
+      type: LoadBalancer
       ports:
         http:
           port: 32400

clusters/cl01tl/helm/postiz/Chart.yaml

@@ -42,4 +42,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/postiz.png
 # renovate: datasource=github-releases depName=gitroomhq/postiz-app
-appVersion: v2.20.2
+appVersion: v2.21.0

clusters/cl01tl/helm/postiz/values.yaml

@@ -9,7 +9,7 @@ postiz:
         main:
           image:
             repository: ghcr.io/gitroomhq/postiz-app
-            tag: v2.20.2
+            tag: v2.21.0
             pullPolicy: IfNotPresent
           env:
             - name: MAIN_URL

clusters/cl01tl/helm/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:67a3e2e339eb33e60d16df2b328961583c908c4b6f3a176b23ecb9ddd6f137fd
+            tag: latest@sha256:b6db575bb821d35279474090270db9e53e92432a66d19e7da51c0ef1b5ddb806
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -39,7 +39,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:67a3e2e339eb33e60d16df2b328961583c908c4b6f3a176b23ecb9ddd6f137fd
+            tag: latest@sha256:b6db575bb821d35279474090270db9e53e92432a66d19e7da51c0ef1b5ddb806
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL

clusters/cl01tl/helm/shelfmark/Chart.yaml

@@ -23,4 +23,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/shelfmark.webp
 # renovate: datasource=github-releases depName=calibrain/shelfmark
-appVersion: v1.2.0
+appVersion: v1.2.1

clusters/cl01tl/helm/shelfmark/values.yaml

@@ -9,7 +9,7 @@ shelfmark:
         main:
           image:
             repository: ghcr.io/calibrain/shelfmark
-            tag: v1.2.0
+            tag: v1.2.1
             pullPolicy: IfNotPresent
           env:
             - name: FLASK_PORT

clusters/cl01tl/helm/site-documentation/values.yaml

@@ -11,7 +11,7 @@ site-documentation:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-documentation
-            tag: 0.3.0
+            tag: 0.5.0
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/site-profile/values.yaml

@@ -11,7 +11,7 @@ site-profile:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-profile
-            tag: 3.15.0
+            tag: 3.15.1
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/traefik/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: traefik
   repository: https://traefik.github.io/charts
-  version: 39.0.5
+  version: 39.0.6
 - name: traefik-crds
   repository: https://traefik.github.io/charts
   version: 1.15.0
-digest: sha256:8edf8d2dcabdba2c2b8d6a9508f001ba5ef4bec205423f864b92f2adedd73b60
+digest: sha256:45b11c0cb1083daff76df3c90ecf7d73fc09979239bdc0f272d826fab92a3ba4
-generated: "2026-03-16T15:32:49.364653199Z"
+generated: "2026-03-20T20:50:42.131002257Z"

clusters/cl01tl/helm/traefik/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: traefik
-    version: 39.0.5
+    version: 39.0.6
     repository: https://traefik.github.io/charts
   - name: traefik-crds
     version: 1.15.0

clusters/cl01tl/helm/unpoller/Chart.yaml

@@ -21,4 +21,4 @@ dependencies:
     version: 4.6.2
 icon: https://camo.githubusercontent.com/c5d07a5b3acfeac8e1c25bf56f440ffe032b86e4e7f15de82357f022a43fc927/68747470733a2f2f756e706f6c6c65722e636f6d2f696d672f6c6f676f2e706e67
 # renovate: datasource=github-releases depName=unpoller/unpoller
-appVersion: v2.34.0
+appVersion: v2.35.0

clusters/cl01tl/helm/unpoller/values.yaml

@@ -9,7 +9,7 @@ unpoller:
         main:
           image:
             repository: ghcr.io/unpoller/unpoller
-            tag: v2.34.0
+            tag: v2.35.0
             pullPolicy: IfNotPresent
           env:
             - name: UP_UNIFI_CONTROLLER_0_SAVE_ALARMS

hosts/pd05wd/ollama/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-ollama:
-        image: ghcr.io/tailscale/tailscale:latest
+        image: ghcr.io/tailscale/tailscale:latest@sha256:95e528798bebe75f39b10e74e7051cf51188ee615934f232ba7ad06a3390ffa1
         container_name: tailscale-ollama
         cap_add:
             - net_admin
@@ -20,7 +20,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     ollama:
-        image: ollama/ollama:latest
+        image: ollama/ollama:latest@sha256:5a5d014aa774f78ebe1340c0d4afc2e35afc12a2c3b34c84e71f78ea20af4ba3
         container_name: ollama
         environment:
             - OLLAMA_KEEP_ALIVE=24h

hosts/pd05wd/stable-diffusion/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-stable-diffusion:
-        image: ghcr.io/tailscale/tailscale:latest
+        image: ghcr.io/tailscale/tailscale:latest@sha256:95e528798bebe75f39b10e74e7051cf51188ee615934f232ba7ad06a3390ffa1
         container_name: tailscale-stable-diffusion
         cap_add:
             - net_admin
@@ -22,7 +22,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     stable-diffusion:
-        image: ghcr.io/ai-dock/stable-diffusion-webui:latest-cuda
+        image: ghcr.io/ai-dock/stable-diffusion-webui:latest-cuda@sha256:bc4b2b12ac8d030cc5daf25e2c32517709b7c15f59a32685c4c1a14a9606eb42
         container_name: stable-diffusion
         environment:
             - WEBUI_ARGS="--api --listen"

hosts/ps08rp/blocky/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-blocky:
-        image: ghcr.io/tailscale/tailscale:v1.94.2
+        image: ghcr.io/tailscale/tailscale:v1.94.2@sha256:95e528798bebe75f39b10e74e7051cf51188ee615934f232ba7ad06a3390ffa1
         container_name: tailscale-blocky
         cap_add:
             - net_admin
@@ -18,7 +18,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     blocky:
-        image: ghcr.io/0xerr0r/blocky:v0.29.0
+        image: ghcr.io/0xerr0r/blocky:v0.29.0@sha256:a6d99f323d3036a99a3767a52ad612f4d8f3f31167492bfc14d4ea57b24cdfd0
         container_name: blocky
         environment:
             - TZ=America/Chicago

hosts/ps08rp/blocky/config.yml

@@ -73,7 +73,7 @@ customDNS:
 
     traefik-cl01tl                  IN      A       10.232.1.21
     blocky                          IN      A       10.232.1.22
-    cilium-cl01tl                   IN      A       10.232.1.23
+    plex-lb                         IN      A       10.232.1.23
 
 
     ;; Application Names
@@ -92,6 +92,7 @@ customDNS:
     directus                        IN      CNAME   traefik-cl01tl
     excalidraw                      IN      CNAME   traefik-cl01tl
     feishin                         IN      CNAME   traefik-cl01tl
+    foldergram                      IN      CNAME   traefik-cl01tl
     garage-s3                       IN      CNAME   traefik-cl01tl
     garage-webui                    IN      CNAME   traefik-cl01tl
     gatus                           IN      CNAME   traefik-cl01tl
@@ -102,12 +103,14 @@ customDNS:
     home                            IN      CNAME   traefik-cl01tl
     home-assistant                  IN      CNAME   traefik-cl01tl
     home-assistant-code-server      IN      CNAME   traefik-cl01tl
+    houndarr                        IN      CNAME   traefik-cl01tl
     hubble                          IN      CNAME   traefik-cl01tl
     immich                          IN      CNAME   traefik-cl01tl
     jellyfin                        IN      CNAME   traefik-cl01tl
     jellystat                       IN      CNAME   traefik-cl01tl
     kiwix                           IN      CNAME   traefik-cl01tl
     komodo                          IN      CNAME   traefik-cl01tl
+    languagetool                    IN      CNAME   traefik-cl01tl
     lidarr                          IN      CNAME   traefik-cl01tl
     mail                            IN      CNAME   traefik-cl01tl
     medialyze                       IN      CNAME   traefik-cl01tl

hosts/ps08rp/node-exporter/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     node-exporter:
-        image: quay.io/prometheus/node-exporter:v1.10.2
+        image: quay.io/prometheus/node-exporter:v1.10.2@sha256:337ff1d356b68d39cef853e8c6345de11ce7556bb34cda8bd205bcf2ed30b565
         container_name: node-exporter
         command:
             - '--path.rootfs=/rootfs'

hosts/ps08rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.11
+        image: ghcr.io/traefik/traefik:v3.6.11@sha256:acfc80650104f0194a15f73dc1648f517561bc1645391a15705332a064cfc33c
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

hosts/ps09rp/blocky/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-blocky:
-        image: ghcr.io/tailscale/tailscale:v1.94.2
+        image: ghcr.io/tailscale/tailscale:v1.94.2@sha256:95e528798bebe75f39b10e74e7051cf51188ee615934f232ba7ad06a3390ffa1
         container_name: tailscale-blocky
         cap_add:
             - net_admin
@@ -18,7 +18,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     blocky:
-        image: ghcr.io/0xerr0r/blocky:v0.29.0
+        image: ghcr.io/0xerr0r/blocky:v0.29.0@sha256:a6d99f323d3036a99a3767a52ad612f4d8f3f31167492bfc14d4ea57b24cdfd0
         container_name: blocky
         environment:
             - TZ=America/Chicago

hosts/ps09rp/blocky/config.yml

@@ -94,7 +94,7 @@ customDNS:
 
     traefik-cl01tl                  IN      A       10.232.1.21
     blocky                          IN      A       10.232.1.22
-    cilium-cl01tl                   IN      A       10.232.1.23
+    plex-lb                         IN      A       10.232.1.23
 
 
     ;; Application Names
@@ -113,6 +113,7 @@ customDNS:
     directus                        IN      CNAME   traefik-cl01tl
     excalidraw                      IN      CNAME   traefik-cl01tl
     feishin                         IN      CNAME   traefik-cl01tl
+    foldergram                      IN      CNAME   traefik-cl01tl
     garage-s3                       IN      CNAME   traefik-cl01tl
     garage-webui                    IN      CNAME   traefik-cl01tl
     gatus                           IN      CNAME   traefik-cl01tl
@@ -123,12 +124,14 @@ customDNS:
     home                            IN      CNAME   traefik-cl01tl
     home-assistant                  IN      CNAME   traefik-cl01tl
     home-assistant-code-server      IN      CNAME   traefik-cl01tl
+    houndarr                        IN      CNAME   traefik-cl01tl
     hubble                          IN      CNAME   traefik-cl01tl
     immich                          IN      CNAME   traefik-cl01tl
     jellyfin                        IN      CNAME   traefik-cl01tl
     jellystat                       IN      CNAME   traefik-cl01tl
     kiwix                           IN      CNAME   traefik-cl01tl
     komodo                          IN      CNAME   traefik-cl01tl
+    languagetool                    IN      CNAME   traefik-cl01tl
     lidarr                          IN      CNAME   traefik-cl01tl
     mail                            IN      CNAME   traefik-cl01tl
     medialyze                       IN      CNAME   traefik-cl01tl

hosts/ps09rp/node-exporter/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     node-exporter:
-        image: quay.io/prometheus/node-exporter:v1.10.2
+        image: quay.io/prometheus/node-exporter:v1.10.2@sha256:337ff1d356b68d39cef853e8c6345de11ce7556bb34cda8bd205bcf2ed30b565
         container_name: node-exporter
         command:
             - '--path.rootfs=/rootfs'

hosts/ps09rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.11
+        image: ghcr.io/traefik/traefik:v3.6.11@sha256:acfc80650104f0194a15f73dc1648f517561bc1645391a15705332a064cfc33c
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

hosts/ps10rp/blocky/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-blocky:
-        image: ghcr.io/tailscale/tailscale:v1.94.2
+        image: ghcr.io/tailscale/tailscale:v1.94.2@sha256:95e528798bebe75f39b10e74e7051cf51188ee615934f232ba7ad06a3390ffa1
         container_name: tailscale-blocky
         cap_add:
             - net_admin
@@ -18,7 +18,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     blocky:
-        image: ghcr.io/0xerr0r/blocky:v0.29.0
+        image: ghcr.io/0xerr0r/blocky:v0.29.0@sha256:a6d99f323d3036a99a3767a52ad612f4d8f3f31167492bfc14d4ea57b24cdfd0
         container_name: blocky
         environment:
             - TZ=America/Chicago

hosts/ps10rp/castsponsorskip/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     castsponsorskip:
-        image: ghcr.io/gabe565/castsponsorskip:0.8.3
+        image: ghcr.io/gabe565/castsponsorskip:0.8.3@sha256:f556d274aab94c3140058e9f192396bc75e04d8e075769223c1edfc8c4f4daa4
         container_name: castsponsorskip
         environment:
             - TZ=America/Chicago

hosts/ps10rp/cloudflare-ddns/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     cloudflare-ddns:
-        image: favonia/cloudflare-ddns:1.15.1
+        image: favonia/cloudflare-ddns:1.15.1@sha256:a4e2089b3531eec8c9328c7a9a586f80e8d67dcd94856e0b596b7896e1de3f62
         container_name: cloudflare-ddns
         cap_drop:
             - all

hosts/ps10rp/garage/compose.yaml

@@ -1,6 +1,6 @@
 services:
     tailscale-garage:
-        image: ghcr.io/tailscale/tailscale:v1.94.2
+        image: ghcr.io/tailscale/tailscale:v1.94.2@sha256:95e528798bebe75f39b10e74e7051cf51188ee615934f232ba7ad06a3390ffa1
         container_name: tailscale-garage
         cap_add:
             - net_admin
@@ -20,7 +20,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     tailscale-garage-ui:
-        image: ghcr.io/tailscale/tailscale:v1.94.2
+        image: ghcr.io/tailscale/tailscale:v1.94.2@sha256:95e528798bebe75f39b10e74e7051cf51188ee615934f232ba7ad06a3390ffa1
         container_name: tailscale-garage-ui
         cap_add:
             - net_admin
@@ -39,7 +39,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     garage:
-        image: dxflrs/garage:v2.2.0
+        image: dxflrs/garage:v2.2.0@sha256:45a61ce3f7c9c24fc23d9ed2b09b27ed560ab87b34605d175d5c588f539c24e4
         container_name: garage
         env_file:
             - .env
@@ -54,7 +54,7 @@ services:
             - data:/var/lib/garage/data
 
     garage-ui:
-        image: khairul169/garage-webui:1.1.0
+        image: khairul169/garage-webui:1.1.0@sha256:17c793551873155065bf9a022dabcde874de808a1f26e648d4b82e168806439c
         container_name: garage-ui
         env_file:
             - .env

hosts/ps10rp/gitea/compose.yaml

@@ -1,6 +1,6 @@
 services:
     tailscale-gitea:
-        image: ghcr.io/tailscale/tailscale:v1.94.2
+        image: ghcr.io/tailscale/tailscale:v1.94.2@sha256:95e528798bebe75f39b10e74e7051cf51188ee615934f232ba7ad06a3390ffa1
         container_name: tailscale-gitea
         cap_add:
             - net_admin
@@ -19,7 +19,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     postgresql:
-        image: docker.io/postgres:18.1-alpine3.21
+        image: docker.io/postgres:18.1-alpine3.21@sha256:44d837eb4c2ed263474a95f0cc24745413c50924df60dd73ed6c4c3e36b84259
         container_name: gitea-postgres
         env_file:
             - .env
@@ -33,7 +33,7 @@ services:
             - postgresql18:/var/lib/postgresql
 
     gitea:
-        image: gitea/gitea:1.25.5
+        image: gitea/gitea:1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472
         container_name: gitea
         depends_on:
             - postgresql

hosts/ps10rp/homepage/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-homepage:
-        image: ghcr.io/tailscale/tailscale:v1.94.2
+        image: ghcr.io/tailscale/tailscale:v1.94.2@sha256:95e528798bebe75f39b10e74e7051cf51188ee615934f232ba7ad06a3390ffa1
         container_name: tailscale-homepage
         cap_add:
             - net_admin
@@ -20,7 +20,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     dockerproxy:
-        image: ghcr.io/tecnativa/docker-socket-proxy:v0.4.2
+        image: ghcr.io/tecnativa/docker-socket-proxy:v0.4.2@sha256:1f3a6f303320723d199d2316a3e82b2e2685d86c275d5e3deeaf182573b47476
         container_name: homepage-dockerproxy
         environment:
             - CONTAINERS=1
@@ -32,7 +32,7 @@ services:
             - /var/run/docker.sock:/var/run/docker.sock:ro
 
     homepage:
-        image: ghcr.io/gethomepage/homepage:v1.11.0
+        image: ghcr.io/gethomepage/homepage:v1.11.0@sha256:b129cb0f674bd6d204e215bde2c2fc3f11d6ad0e82f6d20007cf80f74e1acbb1
         container_name: homepage
         labels:
             traefik.enable: true

hosts/ps10rp/isponsorblocktv/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     isponsorblocktv:
-        image: ghcr.io/dmunozv04/isponsorblocktv:v2.6.1
+        image: ghcr.io/dmunozv04/isponsorblocktv:v2.6.1@sha256:545856523283753ebcf4b400a46895b9906844be5265a0f4cab98a6b0bdf84be
         container_name: isponsorblocktv
         environment:
             - TZ=America/Chicago

hosts/ps10rp/komodo-periphery/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-komodo-periphery:
-        image: ghcr.io/tailscale/tailscale:latest
+        image: ghcr.io/tailscale/tailscale:latest@sha256:95e528798bebe75f39b10e74e7051cf51188ee615934f232ba7ad06a3390ffa1
         container_name: tailscale-komodo-periphery
         cap_add:
             - net_admin
@@ -20,7 +20,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     komodo-periphery:
-        image: ghcr.io/moghtech/komodo-periphery:latest
+        image: ghcr.io/moghtech/komodo-periphery:latest@sha256:bd79cf960ed054fe8e02384322303e462448679b1149dde48bbef151417255b1
         container_name: komodo-periphery
         env_file:
             - .env

hosts/ps10rp/node-exporter/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-node-exporter:
-        image: ghcr.io/tailscale/tailscale:v1.94.2
+        image: ghcr.io/tailscale/tailscale:v1.94.2@sha256:95e528798bebe75f39b10e74e7051cf51188ee615934f232ba7ad06a3390ffa1
         container_name: tailscale-node-exporter
         cap_add:
             - net_admin
@@ -20,7 +20,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     node-exporter:
-        image: quay.io/prometheus/node-exporter:v1.10.2
+        image: quay.io/prometheus/node-exporter:v1.10.2@sha256:337ff1d356b68d39cef853e8c6345de11ce7556bb34cda8bd205bcf2ed30b565
         container_name: node-exporter
         command:
             - '--path.rootfs=/rootfs'

hosts/ps10rp/tailscale-subnet/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale:
-        image: ghcr.io/tailscale/tailscale:v1.94.2
+        image: ghcr.io/tailscale/tailscale:v1.94.2@sha256:95e528798bebe75f39b10e74e7051cf51188ee615934f232ba7ad06a3390ffa1
         container_name: tailscale-subnet
         cap_add:
             - net_admin

hosts/ps10rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-traefik:
-        image: ghcr.io/tailscale/tailscale:v1.94.2
+        image: ghcr.io/tailscale/tailscale:v1.94.2@sha256:95e528798bebe75f39b10e74e7051cf51188ee615934f232ba7ad06a3390ffa1
         container_name: tailscale-traefik
         cap_add:
             - net_admin
@@ -20,7 +20,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.11
+        image: ghcr.io/traefik/traefik:v3.6.11@sha256:acfc80650104f0194a15f73dc1648f517561bc1645391a15705332a064cfc33c
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

renovate.json

@@ -5,6 +5,14 @@
     "mergeConfidence:all-badges",
     ":rebaseStalePrs"
   ],
+  "timezone": "America/Chicago",
+  "labels": [],
+  "prHourlyLimit": 0,
+  "prConcurrentLimit": 0,
+  "pinDigests": true,
+  "baseBranchPatterns": [
+    "main"
+  ],
   "customManagers": [
     {
       "description": "Update appVersion in Chart.yaml",
@@ -14,7 +22,8 @@
       ],
       "matchStrings": [
         "#\\s*renovate:\\s*datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+appVersion:\\s*[\"']?(?<currentValue>[^\"'\\s]+)[\"']?"
-      ]
+      ],
+      "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver-coerced{{/if}}"
     },
     {
       "description": "Update images in templates",
@@ -23,7 +32,7 @@
         "/(^|/)templates/.*\\.yaml$/"
       ],
       "matchStrings": [
-        "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+tag: (?<currentValue>.*)"
+        "# renovate: datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)\\s+tag:\\s*[\"']?(?<currentValue>[^@\"'\\s\n]+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?[\"']?"
       ]
     },
     {
@@ -53,14 +62,30 @@
       "versioningTemplate": "semver"
     }
   ],
-  "timezone": "US/Central",
-  "labels": [],
-  "prHourlyLimit": 0,
-  "prConcurrentLimit": 0,
-  "baseBranchPatterns": [
-    "main"
-  ],
   "packageRules": [
+    {
+      "description": "Disable updates to digests",
+      "matchUpdateTypes": [
+        "digest"
+      ],
+      "enabled": false
+    },
+    {
+      "description": "Automerge digests for actions",
+      "matchManagers": [
+        "github-actions"
+      ],
+      "matchUpdateTypes": [
+        "digest"
+      ],
+      "addLabels": [
+        "actions",
+        "automerge"
+      ],
+      "enabled": true,
+      "automerge": true,
+      "minimumReleaseAge": "1 days"
+    },
     {
       "description": "Label charts",
       "matchDatasources": [
@@ -102,7 +127,71 @@
       "automergeType": "branch"
     },
     {
-      "description": "Label images, helm",
+      "description": "Label images",
+      "matchDatasources": [
+        "docker"
+      ],
+      "addLabels": [
+        "image"
+      ],
+      "automerge": false
+    },
+    {
+      "description": "Automerge image patches",
+      "matchUpdateTypes": [
+        "patch",
+        "pinDigest"
+      ],
+      "matchDatasources": [
+        "docker"
+      ],
+      "addLabels": [
+        "image",
+        "automerge"
+      ],
+      "automerge": true,
+      "minimumReleaseAge": "1 days"
+    },
+    {
+      "description": "Automerge images, specific packages",
+      "matchUpdateTypes": [
+        "patch",
+        "minor"
+      ],
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchPackageNames": [
+        "ghcr.io/renovatebot/renovate"
+      ],
+      "addLabels": [
+        "image",
+        "automerge"
+      ],
+      "automerge": true,
+      "minimumReleaseAge": "1 days"
+    },
+    {
+      "description": "Automerge digest updates, specific packages",
+      "matchUpdateTypes": [
+        "digest"
+      ],
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchPackageNames": [
+        "searxng/searxng"
+      ],
+      "addLabels": [
+        "image",
+        "automerge"
+      ],
+      "enabled": true,
+      "automerge": true,
+      "minimumReleaseAge": "1 days"
+    },
+    {
+      "description": "Label appVersion and images, merged",
       "matchManagers": [
         "custom.regex",
         "helm-values"
@@ -115,20 +204,10 @@
       "automerge": false
     },
     {
-      "description": "Label images, docker",
+      "description": "Automerge appVersion and images, merged",
-      "matchDatasources": [
-        "docker"
-      ],
-      "addLabels": [
-        "image"
-      ],
-      "automerge": false
-    },
-    {
-      "description": "Automerge image patches, helm",
       "matchUpdateTypes": [
         "patch",
-        "digest"
+        "pinDigest"
       ],
       "matchManagers": [
         "custom.regex",
@@ -144,20 +223,17 @@
       "minimumReleaseAge": "1 days"
     },
     {
-      "description": "Automerge image patches, docker",
+      "description": "Group unmatched Dawarich dependencies",
-      "matchUpdateTypes": [
+      "matchPackageNames": [
-        "patch",
+        "freikin/dawarich",
-        "digest"
+        "freika/dawarich",
+        "ghcr.io/freikin/dawarich",
+        "ghcr.io/freika/dawarich",
+        "docker.io/freikin/dawarich",
+        "docker.io/freika/dawarich"
       ],
-      "matchDatasources": [
+      "groupName": "dawarich",
-        "docker"
+      "groupSlug": "unified-dawarich"
-      ],
-      "addLabels": [
-        "image",
-        "automerge"
-      ],
-      "automerge": true,
-      "minimumReleaseAge": "1 days"
     }
   ]
 }