chore(deps): update helm release cilium to v1.19.1

Reviewed-on: #4983

.gitea/workflows/lint-test-docker.yaml

@@ -21,14 +21,14 @@ jobs:
     runs-on: ubuntu-js
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
       - name: Check Branch Exists
         id: check-branch-exists
         if: github.event_name == 'pull_request'
-        uses: GuillaumeFalourd/branch-exists@v1.1
+        uses: GuillaumeFalourd/branch-exists@009290475dc3d75b5d7ec680c0c5b614b0d9855d # v1.1
         with:
           branch: "${{ github.base_ref }}"
 
@@ -51,7 +51,7 @@ jobs:
 
       - name: Set Up Node.js
         if: steps.branch-exists.outputs.exists == 'true'
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: '24'
 
@@ -120,7 +120,7 @@ jobs:
           echo "----"
 
       - name: ntfy Failed
-        uses: niniyas/ntfy-action@master
+        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
         if: failure()
         with:
           url: '${{ secrets.NTFY_URL }}'

.gitea/workflows/lint-test-helm.yaml

@@ -28,14 +28,14 @@ jobs:
       changes-detected: ${{ steps.check-dir-changes.outputs.changes-detected }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
       - name: Check Branch Exists
         id: check-branch-exists
         if: github.event_name == 'pull_request'
-        uses: GuillaumeFalourd/branch-exists@v1.1
+        uses: GuillaumeFalourd/branch-exists@009290475dc3d75b5d7ec680c0c5b614b0d9855d # v1.1
         with:
           branch: ${{ github.base_ref }}
 
@@ -58,7 +58,7 @@ jobs:
 
       - name: Set Up Helm
         if: steps.branch-exists.outputs.exists == 'true'
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           # renovate: datasource=github-releases depName=helm/helm
@@ -67,7 +67,7 @@ jobs:
 
       - name: Cache Helm Dependencies
         if: steps.branch-exists.outputs.exists == 'true'
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cache/helm
@@ -209,7 +209,7 @@ jobs:
           exit $EXIT_CODE
 
       - name: ntfy Failed
-        uses: niniyas/ntfy-action@master
+        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
         if: failure()
         with:
           url: '${{ secrets.NTFY_URL }}'
@@ -232,7 +232,7 @@ jobs:
       github.event_name == 'pull_request'
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
@@ -257,7 +257,7 @@ jobs:
           echo "----"
 
       - name: Set Up Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           # renovate: datasource=github-releases depName=helm/helm
@@ -265,7 +265,7 @@ jobs:
           cache: true
 
       - name: Cache Helm Dependencies
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cache/helm
@@ -352,7 +352,7 @@ jobs:
           exit $EXIT_CODE
 
       - name: ntfy Failed
-        uses: niniyas/ntfy-action@master
+        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
         if: failure()
         with:
           url: '${{ secrets.NTFY_URL }}'

.gitea/workflows/render-manifests.yaml

@@ -31,32 +31,32 @@ jobs:
       (github.event_name == 'pull_request' && github.event.pull_request.merged == true)
     steps:
       - name: Checkout Main
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           path: infrastructure
           fetch-depth: 0
 
       - name: Checkout Manifests
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: manifests
           path: infrastructure-manifests
 
       - name: Set Up Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           version: v3.17.2 # Pending https://github.com/helm/helm/pull/30743
           cache: true
 
       - name: Configure Kubeconfig
-        uses: azure/k8s-set-context@v4
+        uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4
         with:
           method: kubeconfig
           kubeconfig: ${{ secrets.KUBECONFIG }}
 
       - name: Cache Helm Dependencies
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cache/helm
@@ -568,7 +568,7 @@ jobs:
           echo "----"
 
       - name: ntfy Created
-        uses: niniyas/ntfy-action@master
+        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
         if: steps.create-pull-request.outputs.pull-request-operation == 'created' && steps.mode.outputs.is-automerge == 'false'
         with:
           url: "${{ secrets.NTFY_URL }}"
@@ -582,7 +582,7 @@ jobs:
           actions: '[{"action": "view", "label": "View PR", "url": "${{ vars.USER_URL }}/${{ github.repository }}/pulls/${{ steps.create-pull-request.outputs.pull-request-number }}", "clear": true}]'
 
       - name: ntfy Updated
-        uses: niniyas/ntfy-action@master
+        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
         if: steps.commit-push.outputs.push == 'true' && steps.check-for-pull-request.outputs.pull-request-exists != 'false' && steps.mode.outputs.is-automerge == 'false'
         with:
           url: "${{ secrets.NTFY_URL }}"
@@ -596,7 +596,7 @@ jobs:
           actions: '[{"action": "view", "label": "View PR", "url": "${{ vars.USER_URL }}/${{ github.repository }}/pulls/${{ steps.create-pull-request.outputs.pull-request-number }}", "clear": true}]'
 
       - name: ntfy Merged
-        uses: niniyas/ntfy-action@master
+        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
         if: steps.merge-changes.outputs.pull-request-operation == 'merged'
         with:
           url: "${{ secrets.NTFY_URL }}"
@@ -610,7 +610,7 @@ jobs:
           actions: '[{"action": "view", "label": "View PR", "url": "${{ vars.USER_URL }}/${{ github.repository }}/pulls/${{ steps.create-pull-request.outputs.pull-request-number }}", "clear": true}]'
 
       - name: ntfy Failed
-        uses: niniyas/ntfy-action@master
+        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
         if: failure()
         with:
           url: "${{ secrets.NTFY_URL }}"

.gitea/workflows/renovate.yaml

@@ -13,10 +13,10 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43
+    container: ghcr.io/renovatebot/renovate:43.84.2@sha256:92285747b3aac062a4f567762c272a12dce037843a20177a02c95b7c420e20cb
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Renovate
         run: renovate
@@ -25,7 +25,7 @@ jobs:
           RENOVATE_ENDPOINT: ${{ vars.INSTANCE_URL }}
           RENOVATE_REPOSITORIES: alexlebens/infrastructure
           RENOVATE_GIT_AUTHOR: Renovate Bot <renovate-bot@alexlebens.net>
-          LOG_LEVEL: info
+          LOG_LEVEL: debug
           RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
           RENOVATE_GIT_PRIVATE_KEY: ${{ secrets.RENOVATE_GIT_PRIVATE_KEY }}
           RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}

clusters/cl01tl/helm/actual/Chart.yaml

@@ -5,11 +5,12 @@ description: Actual
 keywords:
   - actual
   - budget
-home: https://wiki.alexlebens.dev/s/86192f45-94b7-45de-872c-6ef3fec7df5e
+home: https://docs.alexlebens.dev/applications/actual/
 sources:
   - https://github.com/actualbudget/actual
   - https://github.com/actualbudget/actual/pkgs/container/actual
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/actual/values.yaml

@@ -4,20 +4,18 @@ actual:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: ghcr.io/actualbudget/actual
-            tag: 26.3.0
+            tag: 26.3.0@sha256:eb8bc26f53025e07e464594c12d77c52c4b95840c8dadd9b95c4f0c4660f8ad2
-            pullPolicy: IfNotPresent
           env:
-            - name: TZ
+            - name: ACTUAL_PORT
-              value: US/Central
+              value: 5006
           resources:
             requests:
-              cpu: 10m
+              cpu: 25m
-              memory: 128Mi
+              memory: 64Mi
           probes:
             liveness:
               enabled: true
@@ -54,11 +52,8 @@ actual:
         - actual.alexlebens.net
       rules:
         - backendRefs:
-            - group: ''
+            - name: actual
-              kind: Service
-              name: actual
               port: 80
-              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -69,7 +64,6 @@ actual:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 2Gi
-      retain: true
       advancedMounts:
         main:
           main:

clusters/cl01tl/helm/argo-workflows/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: argo-workflows
   repository: https://argoproj.github.io/argo-helm
-  version: 1.0.2
+  version: 1.0.5
 - name: argo-events
   repository: https://argoproj.github.io/argo-helm
-  version: 2.4.20
+  version: 2.4.21
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.10.0
-digest: sha256:8d1c2dd011a360d930ed5ff186462f163407077d36ae633898ec5d6ba30a4e8d
+digest: sha256:d0d7ebf1c0013d001aa2f17d04a6d3f3d7a1fa7d5c62792eef856b87c24eb26e
-generated: "2026-03-15T20:04:18.080966008Z"
+generated: "2026-03-20T20:48:30.830922259Z"

clusters/cl01tl/helm/argo-workflows/Chart.yaml

@@ -18,10 +18,10 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-workflows
-    version: 1.0.2
+    version: 1.0.5
     repository: https://argoproj.github.io/argo-helm
   - name: argo-events
-    version: 2.4.20
+    version: 2.4.21
     repository: https://argoproj.github.io/argo-helm
   - name: postgres-cluster
     alias: postgres-18-cluster
@@ -29,4 +29,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-workflows
-appVersion: v4.0.2
+appVersion: v4.0.3

clusters/cl01tl/helm/argo-workflows/values.yaml

@@ -8,7 +8,7 @@ argo-workflows:
     upgradeJob:
       image:
         repository: registry.k8s.io/kubectl
-        tag: v1.35.2
+        tag: v1.35.3
   controller:
     metricsConfig:
       enabled: true

clusters/cl01tl/helm/argocd/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 9.4.10
+  version: 9.4.15
-digest: sha256:795aad956acef3f5efb8160390caf9b9792b7b4150d3a7984f1c5edbad92dfaa
+digest: sha256:a0eed2e174bb6b13d04653c755a359025b050d479a92180039a1990dd8ee7caa
-generated: "2026-03-10T18:58:35.720448421Z"
+generated: "2026-03-20T01:09:07.547016465Z"

clusters/cl01tl/helm/argocd/Chart.yaml

@@ -15,8 +15,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 9.4.10
+    version: 9.4.15
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-cd
-appVersion: v3.3.3
+appVersion: v3.3.4

clusters/cl01tl/helm/argocd/values.yaml

@@ -55,14 +55,7 @@ argo-cd:
   server:
     replicas: 2
     extensions:
-      enabled: true
+      enabled: false
-      extensionList:
-        - name: extension-trivy
-          env:
-            - name: EXTENSION_URL
-              value: https://github.com/mziyabo/argocd-trivy-extension/releases/download/v0.2.0/extension-trivy.tar
-            - name: EXTENSION_CHECKSUM_URL
-              value: https://github.com/mziyabo/argocd-trivy-extension/releases/download/v0.2.0/extension-trivy_checksums.txt
     metrics:
       enabled: true
       serviceMonitor:

clusters/cl01tl/helm/audiobookshelf/Chart.yaml

@@ -29,4 +29,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/audiobookshelf.png
 # renovate: datasource=github-releases depName=advplyr/audiobookshelf
-appVersion: 2.33.0
+appVersion: 2.33.1

clusters/cl01tl/helm/audiobookshelf/values.yaml

@@ -9,7 +9,7 @@ audiobookshelf:
         main:
           image:
             repository: ghcr.io/advplyr/audiobookshelf
-            tag: 2.33.0
+            tag: 2.33.1
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/blocky/values.yaml

@@ -98,7 +98,7 @@ blocky:
 
               traefik-cl01tl                  IN      A       10.232.1.21
               blocky                          IN      A       10.232.1.22
-              cilium-cl01tl                   IN      A       10.232.1.23
+              plex-lb                         IN      A       10.232.1.23
 
 
               ;; Application Names
@@ -117,6 +117,7 @@ blocky:
               directus                        IN      CNAME   traefik-cl01tl
               excalidraw                      IN      CNAME   traefik-cl01tl
               feishin                         IN      CNAME   traefik-cl01tl
+              foldergram                      IN      CNAME   traefik-cl01tl
               garage-s3                       IN      CNAME   traefik-cl01tl
               garage-webui                    IN      CNAME   traefik-cl01tl
               gatus                           IN      CNAME   traefik-cl01tl
@@ -127,14 +128,17 @@ blocky:
               home                            IN      CNAME   traefik-cl01tl
               home-assistant                  IN      CNAME   traefik-cl01tl
               home-assistant-code-server      IN      CNAME   traefik-cl01tl
+              houndarr                        IN      CNAME   traefik-cl01tl
               hubble                          IN      CNAME   traefik-cl01tl
               immich                          IN      CNAME   traefik-cl01tl
               jellyfin                        IN      CNAME   traefik-cl01tl
               jellystat                       IN      CNAME   traefik-cl01tl
               kiwix                           IN      CNAME   traefik-cl01tl
               komodo                          IN      CNAME   traefik-cl01tl
+              languagetool                    IN      CNAME   traefik-cl01tl
               lidarr                          IN      CNAME   traefik-cl01tl
               mail                            IN      CNAME   traefik-cl01tl
+              medialyze                       IN      CNAME   traefik-cl01tl
               movie-roulette                  IN      CNAME   traefik-cl01tl
               music-grabber                   IN      CNAME   traefik-cl01tl
               navidrome                       IN      CNAME   traefik-cl01tl

clusters/cl01tl/helm/booklore/Chart.yaml

@@ -4,11 +4,14 @@ version: 1.0.0
 description: booklore
 keywords:
   - booklore
+  - grimmory
   - books
 home: https://wiki.alexlebens.dev/
 sources:
   - https://github.com/booklore-app/BookLore
+  - https://github.com/grimmory-tools/grimmory
   - https://github.com/booklore-app/booklore/pkgs/container/booklore
+  - https://github.com/grimmory-tools/grimmory/pkgs/container/grimmory
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
 maintainers:
   - name: alexlebens
@@ -29,5 +32,5 @@ dependencies:
     version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/booklore.png
-# renovate: datasource=github-releases depName=booklore-app/BookLore
+# renovate: datasource=github-releases depName=grimmory-tools/grimmory
-appVersion: v2.2.1
+appVersion: v2.3.0

clusters/cl01tl/helm/booklore/values.yaml

@@ -8,8 +8,8 @@ booklore:
       containers:
         main:
           image:
-            repository: ghcr.io/booklore-app/booklore
+            repository: ghcr.io/grimmory-tools/grimmory
-            tag: v2.2.1
+            tag: v2.3.0
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/cilium/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: cilium
   repository: https://helm.cilium.io/
-  version: 1.18.6
+  version: 1.19.1
-digest: sha256:8ea328ac238524b5b423e6289f5e25d05ef64e6aa19cfd5de238f1d5dd533e9b
+digest: sha256:bf5e8b3233c18bdb9409bb98c9a7ea4114e0e04e8489a49fdb2d29ded0cfa429
-generated: "2026-02-05T12:00:20.15778-06:00"
+generated: "2026-03-22T23:03:53.391080951Z"

clusters/cl01tl/helm/cilium/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: cilium
-    version: 1.18.6
+    version: 1.19.1
     repository: https://helm.cilium.io/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/cilium.png
 # renovate: datasource=github-releases depName=cilium/cilium

clusters/cl01tl/helm/code-server/values.yaml

@@ -9,7 +9,7 @@ code-server:
         main:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.111.0@sha256:12c04b41f601604795562ece2ac64cade7cfca632415f4bfb1742477e3226272
+            tag: 4.112.0@sha256:4bb5b8ad22268001687c047f0f04933799fb03df1eb0e1e266ba15ed2d9f4e8b
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/dawarich/Chart.yaml

@@ -26,4 +26,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/dawarich.png
 # renovate: datasource=github-releases depName=Freika/dawarich
-appVersion: 1.3.4
+appVersion: 1.4.0

clusters/cl01tl/helm/dawarich/values.yaml

@@ -9,7 +9,7 @@ dawarich:
         main:
           image:
             repository: freikin/dawarich
-            tag: 1.3.4
+            tag: 1.4.0
             pullPolicy: IfNotPresent
           command: ["web-entrypoint.sh"]
           args: ["bin/rails", "server", "-p", "3000", "-b", "::"]
@@ -106,7 +106,7 @@ dawarich:
         sidekiq:
           image:
             repository: freikin/dawarich
-            tag: 1.3.4
+            tag: 1.4.0
             pullPolicy: IfNotPresent
           command: ["sidekiq-entrypoint.sh"]
           args: ["sidekiq"]

clusters/cl01tl/helm/decluttarr/Chart.lock

@@ -1,6 +0,0 @@
-dependencies:
-- name: app-template
-  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
-digest: sha256:548ae1f8699100a2f6bac11a4a3137402b3eea340c7a3db4d9f1813ad6a11dca
-generated: "2026-02-23T22:08:42.516245-06:00"

clusters/cl01tl/helm/decluttarr/Chart.yaml

@@ -1,20 +0,0 @@
-apiVersion: v2
-name: decluttarr
-version: 1.0.0
-description: decluttarr
-keywords:
-  - decluttarr
-  - servarr
-home: https://wiki.alexlebens.dev/s/
-sources:
-  - https://github.com/ManiMatter/decluttarr
-  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: decluttarr
-    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.6.2
-# renovate: datasource=github-releases depName=ManiMatter/decluttarr
-appVersion: v2.0.0

clusters/cl01tl/helm/decluttarr/templates/external-secret.yaml

@@ -1,21 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: decluttarr-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: decluttarr-config-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.yaml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/decluttarr/config
-        metadataPolicy: None
-        property: config.yaml

clusters/cl01tl/helm/decluttarr/values.yaml

@@ -1,32 +0,0 @@
-decluttarr:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: ghcr.io/manimatter/decluttarr
-            tag: v2.0.0
-            pullPolicy: IfNotPresent
-          env:
-            - name: TZ
-              value: America/Chicago
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  persistence:
-    config:
-      enabled: true
-      type: secret
-      name: decluttarr-config-secret
-      advancedMounts:
-        main:
-          main:
-            - path: /app/config/config.yaml
-              readOnly: true
-              mountPropagation: None
-              subPath: config.yaml

clusters/cl01tl/helm/eraser/values.yaml

@@ -34,27 +34,7 @@ eraser:
         request:
           cpu: 100m
           memory: 128Mi
-        config: "" # |
+        config: ""
-          # cacheDir: /var/lib/trivy
-          # dbRepo: ghcr.io/aquasecurity/trivy-db
-          # deleteFailedImages: true
-          # deleteEOLImages: true
-          # vulnerabilities:
-          #   ignoreUnfixed: true
-          #   types:
-          #     - os
-          #     - library
-          #   securityChecks:
-          #     - vuln
-          #   severities:
-          #     - CRITICAL
-          #     - HIGH
-          #     - MEDIUM
-          #     - LOW
-          #   ignoredStatuses:
-          # timeout:
-          #   total: 23h
-          #   perImage: 1h
       remover:
         request:
           cpu: 10m

clusters/cl01tl/helm/external-secrets/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: external-secrets
   repository: https://charts.external-secrets.io
-  version: 2.1.0
+  version: 2.2.0
-digest: sha256:b19563d51f1922403185979c6c442531a7bb13d302e8438b5a18d450259b7245
+digest: sha256:832fc3f8d3728bdea2b696a6044e4c18967cd9ab9c5cc74adbf40aaa270a84b4
-generated: "2026-03-07T18:02:23.908145348Z"
+generated: "2026-03-20T20:53:08.407747649Z"

clusters/cl01tl/helm/external-secrets/Chart.yaml

@@ -12,8 +12,8 @@ sources:
   - https://github.com/external-secrets/external-secrets/tree/main/deploy/charts/external-secrets
 dependencies:
   - name: external-secrets
-    version: 2.1.0
+    version: 2.2.0
     repository: https://charts.external-secrets.io
 icon: https://avatars.githubusercontent.com/u/68335991?s=48&v=4
 # renovate: datasource=github-releases depName=external-secrets/external-secrets
-appVersion: v2.1.0
+appVersion: v2.2.0

clusters/cl01tl/helm/foldergram/Chart.lock

@@ -0,0 +1,9 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.6.2
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.8.0
+digest: sha256:59100c6fbfb829f9d703b9ee1cf869c4fd77b6ff53c63b0c644a757223027e58
+generated: "2026-03-22T12:42:43.150705-05:00"

clusters/cl01tl/helm/foldergram/Chart.yaml

@@ -0,0 +1,25 @@
+apiVersion: v2
+name: foldergram
+version: 1.0.0
+description: Foldergram
+keywords:
+  - foldergram
+  - pictures
+home: https://wiki.alexlebens.dev/
+sources:
+  - https://github.com/foldergram/foldergram
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: foldergram
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.6.2
+  - name: volsync-target
+    alias: volsync-target-data
+    version: 0.8.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
+# renovate: datasource=github-releases depName=foldergram/foldergram
+appVersion: v1.0.5

clusters/cl01tl/helm/foldergram/templates/persistent-volume-claim.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: foldergram-pictures-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: foldergram-pictures-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  volumeName: foldergram-pictures-nfs-storage
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi

clusters/cl01tl/helm/foldergram/templates/persistent-volume.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: foldergram-pictures-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: foldergram-pictures-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: nfs-client
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    path: /volume2/Storage/Pictures
+    server: synologybond.alexlebens.net
+  mountOptions:
+    - vers=4
+    - minorversion=1
+    - noac

clusters/cl01tl/helm/foldergram/values.yaml

@@ -0,0 +1,87 @@
+foldergram:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: ghcr.io/foldergram/foldergram
+            tag: 1.0.5
+            pullPolicy: IfNotPresent
+          env:
+            - name: IMAGE_DETAIL_SOURCE
+              value: original
+            - name: DERIVATIVE_MODE
+              value: lazy
+            - name: DATA_ROOT
+              value: ./data
+            - name: GALLERY_ROOT
+              value: /gallery
+            - name: CSRF_TRUSTED_ORIGINS
+              value: https://foldergram.alexlebens.net
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 4141
+          protocol: HTTP
+  route:
+    main:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - foldergram.alexlebens.net
+      rules:
+        - backendRefs:
+            - group: ''
+              kind: Service
+              name: foldergram
+              port: 80
+              weight: 100
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+  persistence:
+    cache:
+      forceRename: foldergram-data
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      retain: false
+      advancedMounts:
+        main:
+          main:
+            - path: /app/data
+              readOnly: false
+    pictures:
+      existingClaim: foldergram-pictures-nfs-storage
+      advancedMounts:
+        main:
+          main:
+            - path: /gallery/pictures
+              readOnly: true
+volsync-target-data:
+  pvcTarget: foldergram-data
+  local:
+    enabled: true
+    schedule: 46 11 * * *
+  remote:
+    enabled: true
+    schedule: 46 12 * * *
+  external:
+    enabled: true
+    schedule: 46 13 * * *

clusters/cl01tl/helm/garage/values.yaml

@@ -34,7 +34,7 @@ garage:
         debug:
           image:
             repository: ubuntu
-            tag: resolute-20260108
+            tag: resolute-20260312
             pullPolicy: IfNotPresent
           command:
             - "sleep"

clusters/cl01tl/helm/gatus/values.yaml

@@ -161,6 +161,9 @@ gatus:
       - name: photoview
         url: https://photoview.alexlebens.net
         <<: *defaults
+      - name: foldergram
+        url: https://foldergram.alexlebens.net
+        <<: *defaults
       - name: booklore
         url: https://booklore.alexlebens.net
         <<: *defaults
@@ -191,6 +194,9 @@ gatus:
       - name: excalidraw
         url: https://excalidraw.alexlebens.net
         <<: *defaults
+      - name: languagetool
+        url: https://languagetool.alexlebens.net
+        <<: *defaults
       - name: gitea
         url: https://gitea.alexlebens.net
         <<: *defaults
@@ -227,6 +233,9 @@ gatus:
       - name: jellystat
         url: https://jellystat.alexlebens.net
         <<: *defaults
+      - name: medialyze
+        url: https://medialyze.alexlebens.net
+        <<: *defaults
       - name: authentik
         url: https://authentik.alexlebens.net
         <<: *defaults
@@ -301,6 +310,9 @@ gatus:
       - name: tdarr
         url: https://tdarr.alexlebens.net
         <<: *defaults
+      - name: houndarr
+        url: https://houndarr.alexlebens.net
+        <<: *defaults
       - name: sonarr
         url: http://sonarr.sonarr:80
         <<: *defaults

clusters/cl01tl/helm/generic-device-plugin/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: generic-device-plugin
   repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-  version: 0.20.22
+  version: 0.20.24
-digest: sha256:14e5aa3f02ce6a1271dadc3f76997c739fc9434e669b05655c079d0b873c56ca
+digest: sha256:36bf651c24198d299458046aaf449e9fb50942e1143389092a746357d402b731
-generated: "2026-03-15T20:35:40.676997293Z"
+generated: "2026-03-20T01:18:36.687250976Z"

clusters/cl01tl/helm/generic-device-plugin/Chart.yaml

@@ -15,6 +15,6 @@ maintainers:
 dependencies:
   - name: generic-device-plugin
     repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-    version: 0.20.22
+    version: 0.20.24
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: 1.0.0

clusters/cl01tl/helm/grafana-operator/Chart.lock

@@ -1,7 +1,7 @@
 dependencies:
 - name: grafana-operator
   repository: https://grafana.github.io/helm-charts
-  version: 5.22.1
+  version: 5.22.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.10.0
@@ -11,5 +11,5 @@ dependencies:
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
-digest: sha256:9cbba52d093e40b20917af87263e1fb0e478912440f660543f3527e70452edc7
+digest: sha256:a3bf183bcecb4d4b5354fe91a549075997dccb41c193da9daec9ccbe4d659fe2
-generated: "2026-03-15T20:05:59.855514102Z"
+generated: "2026-03-18T10:04:15.165729555Z"

clusters/cl01tl/helm/grafana-operator/Chart.yaml

@@ -17,7 +17,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: grafana-operator
-    version: 5.22.1
+    version: 5.22.2
     repository: https://grafana.github.io/helm-charts
   - name: postgres-cluster
     alias: postgres-18-cluster
@@ -33,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grafana.png
 # renovate: datasource=github-releases depName=grafana/grafana-operator
-appVersion: v5.22.1
+appVersion: v5.22.2

clusters/cl01tl/helm/grafana-operator/templates/grafana-dashboard.yaml

@@ -377,25 +377,6 @@ spec:
   resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/tdarr.json
 
----
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDashboard
-metadata:
-  name: grafana-dashboard-trivy
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: grafana-dashboard-trivy
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  instanceSelector:
-    matchLabels:
-      app: grafana-main
-  contentCacheDuration: 1h
-  folderUID: grafana-folder-service
-  resyncPeriod: 1h
-  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/trivy.json
-
 ---
 apiVersion: grafana.integreatly.org/v1beta1
 kind: GrafanaDashboard

clusters/cl01tl/helm/harbor/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: harbor
   repository: https://helm.goharbor.io
-  version: 1.18.2
+  version: 1.18.3
 - name: postgres-cluster
   repository: https://gitea.alexlebens.net/api/packages/alexlebens/helm
   version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
-digest: sha256:14c2b7d09631dbb573e9c9d4613ebe52e330146662da0da15f74c31ec519ed15
+digest: sha256:e7a5cee56dddb4abc07ff18677cb6ddf55571b38da2eeb7e654e8ad8f7709bfa
-generated: "2026-03-15T20:06:13.615175051Z"
+generated: "2026-03-19T04:16:54.362332682Z"

clusters/cl01tl/helm/harbor/Chart.yaml

@@ -17,7 +17,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: harbor
-    version: 1.18.2
+    version: 1.18.3
     repository: https://helm.goharbor.io
   - name: postgres-cluster
     alias: postgres-18-cluster
@@ -29,4 +29,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/harbor.png
 # renovate: datasource=github-releases depName=goharbor/harbor
-appVersion: v2.14.3
+appVersion: v2.15.0

clusters/cl01tl/helm/harbor/values.yaml

@@ -41,7 +41,7 @@ harbor:
   portal:
     image:
       repository: goharbor/harbor-portal
-      tag: v2.14.3
+      tag: v2.15.0
     replicas: 2
   core:
     image:
@@ -54,7 +54,7 @@ harbor:
   jobservice:
     image:
       repository: goharbor/harbor-jobservice
-      tag: v2.14.3
+      tag: v2.15.0
     replicas: 2
     jobLoggers:
       - stdout
@@ -67,7 +67,7 @@ harbor:
     controller:
       image:
         repository: goharbor/harbor-registryctl
-        tag: v2.14.3
+        tag: v2.15.0
     existingSecret: harbor-secret
     relativeurls: true
     credentials:

clusters/cl01tl/helm/headlamp/values.yaml

@@ -25,9 +25,6 @@ headlamp:
         - name: cert-manager
           source: https://artifacthub.io/packages/headlamp/headlamp-plugins/headlamp_cert-manager
           version: 0.1.0
-        - name: trivy
-          source: https://artifacthub.io/packages/headlamp/headlamp-trivy/headlamp_trivy
-          version: 0.3.1
         - name: external-secrets-operator
           source: https://artifacthub.io/packages/headlamp/external-secrets-operator-headlamp-plugin/external-secrets-operator
           version: 0.1.0-beta7

clusters/cl01tl/helm/home-assistant/Chart.yaml

@@ -25,4 +25,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/home-assistant.png
 # renovate: datasource=github-releases depName=home-assistant/core
-appVersion: 2026.3.1
+appVersion: 2026.3.3

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -9,7 +9,7 @@ home-assistant:
         main:
           image:
             repository: ghcr.io/home-assistant/home-assistant
-            tag: 2026.3.1
+            tag: 2026.3.3
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -21,7 +21,7 @@ home-assistant:
         code-server:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.111.0@sha256:12c04b41f601604795562ece2ac64cade7cfca632415f4bfb1742477e3226272
+            tag: 4.112.0@sha256:4bb5b8ad22268001687c047f0f04933799fb03df1eb0e1e266ba15ed2d9f4e8b
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/homepage/values.yaml

@@ -202,9 +202,15 @@ homepage:
                   href: https://photoview.alexlebens.net
                   siteMonitor: http://photoview.photoview:80
                   statusStyle: dot
+              - Pictures:
+                  icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
+                  description: Foldergram
+                  href: https://foldergram.alexlebens.net
+                  siteMonitor: http://foldergram.foldergram:80
+                  statusStyle: dot
               - Books:
                   icon: sh-booklore.webp
-                  description: Booklore
+                  description: Grimmory
                   href: https://booklore.alexlebens.net
                   siteMonitor: http://booklore.booklore:80
                   statusStyle: dot
@@ -477,6 +483,12 @@ homepage:
                   href: https://jellystat.alexlebens.net
                   siteMonitor: http://jellystat.jellystat:80
                   statusStyle: dot
+              - MediaLyze:
+                  icon: https://raw.githubusercontent.com/frederikemmer/MediaLyze/d8f69c0628bac7c047b90f91a66341648029c273/frontend/public/favicon.svg
+                  description: Jellyfin Media Monitoring
+                  href: https://medialyze.alexlebens.net
+                  siteMonitor: http://medialyze.medialyze:80
+                  statusStyle: dot
           - Services:
               - Auth (Public):
                   icon: sh-authentik.webp
@@ -627,6 +639,12 @@ homepage:
                   href: https://bazarr.alexlebens.net
                   siteMonitor: http://bazarr.bazarr:80
                   statusStyle: dot
+              - Houndarr:
+                  icon: https://raw.githubusercontent.com/av1155/houndarr/main/src/houndarr/static/img/houndarr-logo-dark.png
+                  description: Media Searches
+                  href: https://houndarr.alexlebens.net
+                  siteMonitor: http://houndarr.houndarr:80
+                  statusStyle: dot
               - Tdarr:
                   icon: sh-tdarr.webp
                   description: Media transcoding and health checks
@@ -774,9 +792,6 @@ homepage:
               - Digital Ocean:
                   - abbr: DO
                     href: https://www.digitalocean.com/
-              - AWS:
-                  - abbr: AW
-                    href: https://aws.amazon.com/console/
               - Cloudflare:
                   - abbr: CF
                     href: https://dash.cloudflare.com/b76e303258b84076ee01fd0f515c0768
@@ -786,12 +801,12 @@ homepage:
               - ProtonVPN:
                   - abbr: PV
                     href: https://account.protonvpn.com/
+              - AirVPN:
+                  - abbr: AV
+                    href: https://airvpn.org/
               - Unifi:
                   - abbr: UF
                     href: https://unifi.ui.com/
-              - Pushover:
-                  - abbr: PO
-                    href: https://pushover.net
               - ReCaptcha:
                   - abbr: RC
                     href: https://www.google.com/recaptcha/admin/site/698983587

clusters/cl01tl/helm/houndarr/Chart.lock

@@ -0,0 +1,9 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.6.2
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.8.0
+digest: sha256:375d6c2eb2f097717c44c5a28cb162da24f4ff154a971e5a68ccd0e0b77e936f
+generated: "2026-03-21T22:31:01.142752-05:00"

clusters/cl01tl/helm/houndarr/Chart.yaml

@@ -0,0 +1,25 @@
+apiVersion: v2
+name: houndarr
+version: 1.0.0
+description: Houndarr
+keywords:
+  - houndarr
+  - servarr
+home: https://wiki.alexlebens.dev/s/
+sources:
+  - https://github.com/av1155/houndarr
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: houndarr
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.6.2
+  - name: volsync-target
+    alias: volsync-target-data
+    version: 0.8.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+icon: https://raw.githubusercontent.com/av1155/houndarr/main/src/houndarr/static/img/houndarr-logo-dark.png
+# renovate: datasource=github-releases depName=av1155/houndarr
+appVersion: v1.6.1

clusters/cl01tl/helm/houndarr/values.yaml

@@ -0,0 +1,84 @@
+houndarr:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: ghcr.io/av1155/houndarr
+            tag: v1.6.0
+            pullPolicy: IfNotPresent
+          env:
+            - name: TZ
+              value: America/Chicago
+            - name: PUID
+              value: 1000
+            - name: PGID
+              value: 1000
+            - name: HOUNDARR_SECURE_COOKIES
+              value: true
+            - name: HOUNDARR_TRUSTED_PROXIES
+              value: 10.96.0.0/12
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 8877
+          protocol: HTTP
+  route:
+    main:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - houndarr.alexlebens.net
+      rules:
+        - backendRefs:
+            - group: ''
+              kind: Service
+              name: houndarr
+              port: 80
+              weight: 100
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+  persistence:
+    data:
+      forceRename: houndarr-data
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 1Gi
+      advancedMounts:
+        main:
+          main:
+            - path: /data
+              readOnly: false
+volsync-target-data:
+  pvcTarget: houndarr-data
+  moverSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
+  local:
+    enabled: true
+    schedule: 40 11 * * *
+  remote:
+    enabled: true
+    schedule: 40 12 * * *
+  external:
+    enabled: true
+    schedule: 40 14 * * *

clusters/cl01tl/helm/immich/Chart.yaml

@@ -32,4 +32,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/immich.png
 # renovate: datasource=github-releases depName=immich-app/immich
-appVersion: v2.5.6
+appVersion: v2.6.1

clusters/cl01tl/helm/immich/values.yaml

@@ -9,7 +9,7 @@ immich:
         main:
           image:
             repository: ghcr.io/immich-app/immich-server
-            tag: v2.5.6
+            tag: v2.6.1
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 82.10.4
+  version: 82.13.0
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.6.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
-digest: sha256:d6bbbfdd1a781b5eb82c2dc8571836a43d23bf8526eac1bcd40f38030be642db
+digest: sha256:1d90bebd9c0afd20f8ff780edd15da18b20f89cf35fd85832d6d8d44b2e0544b
-generated: "2026-03-15T20:38:11.961621853Z"
+generated: "2026-03-20T18:02:38.368086545Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 82.10.4
+    version: 82.13.0
     repository: oci://ghcr.io/prometheus-community/charts
   - name: app-template
     alias: ntfy-alertmanager
@@ -32,4 +32,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prometheus.png
 # renovate: datasource=github-releases depName=prometheus-operator/prometheus-operator
-appVersion: v0.89.0
+appVersion: v0.90.0

clusters/cl01tl/helm/languagetool/Chart.lock

@@ -0,0 +1,9 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.6.2
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.8.0
+digest: sha256:cb14506ada77add5ffcb93d38763e2a5c962312e5754618265d15c4361fea783
+generated: "2026-03-20T17:49:46.393059-05:00"

clusters/cl01tl/helm/languagetool/Chart.yaml

@@ -0,0 +1,27 @@
+apiVersion: v2
+name: languagetool
+version: 1.0.0
+description: LanguageTool
+keywords:
+  - languagetool
+  - spellchecking
+home: https://wiki.alexlebens.dev/
+sources:
+  - https://github.com/languagetool-org/languagetool
+  - https://github.com/Erikvl87/docker-languagetool
+  - https://hub.docker.com/r/erikvl87/languagetool
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: languagetool
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.6.2
+  - name: volsync-target
+    alias: volsync-target-data
+    version: 0.8.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/languagetool.webp
+# renovate: datasource=github-releases depName=Erikvl87/docker-languagetool
+appVersion: "6.7"

clusters/cl01tl/helm/languagetool/values.yaml

@@ -0,0 +1,76 @@
+languagetool:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: erikvl87/languagetool
+            tag: 6.7
+            pullPolicy: IfNotPresent
+          env:
+            - name: langtool_languageModel
+              value: /ngrams
+            - name: Java_Xms
+              value: 512m
+            - name: Java_Xmx
+              value: 1g
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 8010
+          protocol: HTTP
+  route:
+    main:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - languagetool.alexlebens.net
+      rules:
+        - backendRefs:
+            - group: ''
+              kind: Service
+              name: languagetool
+              port: 80
+              weight: 100
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+  persistence:
+    data:
+      forceRename: languagetool-data
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 1Gi
+      retain: true
+      advancedMounts:
+        main:
+          main:
+            - path: /ngrams
+              readOnly: false
+volsync-target-data:
+  pvcTarget: languagetool-data
+  local:
+    enabled: true
+    schedule: 38 11 * * *
+  remote:
+    enabled: true
+    schedule: 38 12 * * *
+  external:
+    enabled: true
+    schedule: 38 14 * * *

clusters/cl01tl/helm/libation/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/libation.png
 # renovate: datasource=github-releases depName=rmcrackan/Libation
-appVersion: 13.3.0
+appVersion: 13.3.2

clusters/cl01tl/helm/libation/values.yaml

@@ -16,7 +16,7 @@ libation:
         main:
           image:
             repository: rmcrackan/libation
-            tag: 13.3.0
+            tag: 13.3.2
             pullPolicy: IfNotPresent
           env:
             - name: SLEEP_TIME
@@ -35,7 +35,7 @@ libation:
         main:
           image:
             repository: ubuntu
-            tag: resolute-20260108
+            tag: resolute-20260312
             pullPolicy: IfNotPresent
           command:
             - "sleep"

clusters/cl01tl/helm/lidarr/values.yaml

@@ -15,7 +15,7 @@ lidarr:
         main:
           image:
             repository: ghcr.io/linuxserver/lidarr
-            tag: 3.1.2-nightly@sha256:2b1b64f07214c6cf05bcfed999aa74ee23825e4bc2ef2c48aba1cd5d5bf968fe
+            tag: 3.1.2-nightly@sha256:034055feee43b11eb2f7a8438a9af1c99ab564dd2b43e5df2fe5b3c9b3b8b1ac
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/medialyze/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.6.2
+digest: sha256:17ac9bc0cc2eac395c630c22ab095e3e34e5d75a34523c3f39629ca1c56ecbc8
+generated: "2026-03-17T17:46:15.885193-05:00"

clusters/cl01tl/helm/medialyze/Chart.yaml

@@ -0,0 +1,22 @@
+apiVersion: v2
+name: medialyze
+version: 1.0.0
+description: MediaLyze
+keywords:
+  - medialyze
+  - jellyfin
+home: https://wiki.alexlebens.dev/
+sources:
+  - https://github.com/frederikemmer/MediaLyze
+  - https://github.com/frederikemmer/MediaLyze/pkgs/container/medialyze
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: medialyze
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.6.2
+icon: https://raw.githubusercontent.com/frederikemmer/MediaLyze/d8f69c0628bac7c047b90f91a66341648029c273/frontend/public/favicon.svg
+# renovate: datasource=github-releases depName=frederikemmer/MediaLyze
+appVersion: 0.2.3

clusters/cl01tl/helm/medialyze/templates/persistent-volume-claim.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: medialyze-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: medialyze-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  volumeName: medialyze-nfs-storage
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi

clusters/cl01tl/helm/medialyze/templates/persistent-volume.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: medialyze-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: medialyze-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: nfs-client
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    path: /volume2/Storage
+    server: synologybond.alexlebens.net
+  mountOptions:
+    - vers=4
+    - minorversion=1
+    - noac

clusters/cl01tl/helm/medialyze/values.yaml

@@ -0,0 +1,85 @@
+medialyze:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: ghcr.io/frederikemmer/medialyze
+            tag: 0.2.3
+            pullPolicy: IfNotPresent
+          env:
+            - name: HOST_PORT
+              value: 8080
+            - name: SCAN_RUNTIME_WORKER_COUNT
+              value: 2
+            - name: TZ
+              value: America/Chicago
+            - name: MEDIA_HOST_DIR
+              value: /media
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 8080
+          protocol: HTTP
+  route:
+    main:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - medialyze.alexlebens.net
+      rules:
+        - backendRefs:
+            - group: ''
+              kind: Service
+              name: medialyze
+              port: 80
+              weight: 100
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+  persistence:
+    data:
+      forceRename: medialyze-data
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 1Gi
+      retain: true
+      advancedMounts:
+        main:
+          main:
+            - path: /config
+              readOnly: false
+    media:
+      existingClaim: medialyze-nfs-storage
+      advancedMounts:
+        main:
+          main:
+            - path: /media
+              readOnly: true
+volsync-target-data:
+  pvcTarget: medialyze-data
+  local:
+    enabled: true
+    schedule: 36 11 * * *
+  remote:
+    enabled: true
+    schedule: 36 12 * * *
+  external:
+    enabled: true
+    schedule: 36 14 * * *

clusters/cl01tl/helm/music-grabber/templates/external-secret.yaml

@@ -60,20 +60,27 @@ spec:
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
+        key: /airvpn/conf/cl01tl
         metadataPolicy: None
         property: private-key
-    - secretKey: proton-email
+    - secretKey: preshared-key
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
+        key: /airvpn/conf/cl01tl
         metadataPolicy: None
-        property: email
+        property: preshared-key
-    - secretKey: proton-password
+    - secretKey: addresses
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
+        key: /airvpn/conf/cl01tl
         metadataPolicy: None
-        property: password
+        property: addresses
+    - secretKey: input-ports
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /airvpn/conf/cl01tl
+        metadataPolicy: None
+        property: input-ports

clusters/cl01tl/helm/music-grabber/values.yaml

@@ -9,7 +9,7 @@ music-grabber:
         main:
           image:
             repository: g33kphr33k/musicgrabber
-            tag: 2.4.3
+            tag: 2.5.0
             pullPolicy: IfNotPresent
           env:
             - name: MUSIC_DIR
@@ -50,72 +50,72 @@ music-grabber:
             requests:
               cpu: 10m
               memory: 512Mi
-        gluetun:
+        # gluetun:
-          image:
+        #   image:
-            repository: ghcr.io/qdm12/gluetun
+        #     repository: ghcr.io/qdm12/gluetun
-            tag: v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab
+        #     tag: v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab
-            pullPolicy: IfNotPresent
+        #     pullPolicy: IfNotPresent
-          lifecycle:
+        #   lifecycle:
-            postStart:
+        #     postStart:
-              exec:
+        #       exec:
-                command: ["/bin/sh", "-c", "(ip rule del table 51820; ip -6 rule del table 51820) || true"]
+        #         command: ["/bin/sh", "-c", "(ip rule del table 51820; ip -6 rule del table 51820) || true"]
-          env:
+        #   env:
-            - name: VPN_SERVICE_PROVIDER
+        #     - name: VPN_SERVICE_PROVIDER
-              value: protonvpn
+        #       value: airvpn
-            - name: VPN_TYPE
+        #     - name: VPN_TYPE
-              value: wireguard
+        #       value: wireguard
-            - name: WIREGUARD_PRIVATE_KEY
+        #     - name: WIREGUARD_PRIVATE_KEY
-              valueFrom:
+        #       valueFrom:
-                secretKeyRef:
+        #         secretKeyRef:
-                  name: music-grabber-wireguard-conf
+        #           name: music-grabber-wireguard-conf
-                  key: private-key
+        #           key: private-key
-            - name: UPDATER_PROTONVPN_EMAIL
+        #     - name: WIREGUARD_PRESHARED_KEY
-              valueFrom:
+        #       valueFrom:
-                secretKeyRef:
+        #         secretKeyRef:
-                  name: music-grabber-wireguard-conf
+        #           name: music-grabber-wireguard-conf
-                  key: proton-email
+        #           key: preshared-key
-            - name: UPDATER_PROTONVPN_PASSWORD
+        #     - name: WIREGUARD_ADDRESSES
-              valueFrom:
+        #       valueFrom:
-                secretKeyRef:
+        #         secretKeyRef:
-                  name: music-grabber-wireguard-conf
+        #           name: music-grabber-wireguard-conf
-                  key: proton-password
+        #           key: addresses
-            - name: FIREWALL_OUTBOUND_SUBNETS
+        #     - name: FIREWALL_OUTBOUND_SUBNETS
-              value: 10.0.0.0/8
+        #       value: 10.0.0.0/8
-            - name: FIREWALL_INPUT_PORTS
+        #     - name: FIREWALL_INPUT_PORTS
-              value: 8080
+        #       value: 8080
-            - name: DNS_UPSTREAM_RESOLVER_TYPE
+        #     - name: DNS_UPSTREAM_RESOLVER_TYPE
-              value: dot
+        #       value: dot
-            - name: HTTPPROXY
+        #     - name: HTTPPROXY
-              value: "off"
+        #       value: "off"
-            - name: SHADOWSOCKS
+        #     - name: SHADOWSOCKS
-              value: "off"
+        #       value: "off"
-          securityContext:
+        #   securityContext:
-            privileged: True
+        #     privileged: True
-            capabilities:
+        #     capabilities:
-              add:
+        #       add:
-                - NET_ADMIN
+        #         - NET_ADMIN
-                - SYS_MODULE
+        #         - SYS_MODULE
-          probes:
+        #   probes:
-            liveness:
+        #     liveness:
-              enabled: true
+        #       enabled: true
-              custom: true
+        #       custom: true
-              spec:
+        #       spec:
-                exec:
+        #         exec:
-                  command:
+        #           command:
-                    - /gluetun-entrypoint
+        #             - /gluetun-entrypoint
-                    - healthcheck
+        #             - healthcheck
-                failureThreshold: 5
+        #         failureThreshold: 5
-                initialDelaySeconds: 30
+        #         initialDelaySeconds: 30
-                periodSeconds: 30
+        #         periodSeconds: 30
-                successThreshold: 1
+        #         successThreshold: 1
-                timeoutSeconds: 15
+        #         timeoutSeconds: 15
-          resources:
+        #   resources:
-            limits:
+        #     limits:
-              devic.es/tun: "1"
+        #       devic.es/tun: "1"
-            requests:
+        #     requests:
-              devic.es/tun: "1"
+        #       devic.es/tun: "1"
-              cpu: 10m
+        #       cpu: 10m
-              memory: 128Mi
+        #       memory: 128Mi
   service:
     main:
       controller: main

clusters/cl01tl/helm/ntfy/Chart.yaml

@@ -20,4 +20,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ntfy.png
 # renovate: datasource=github-releases depName=binwiederhier/ntfy
-appVersion: 2.19.0
+appVersion: 2.19.2

clusters/cl01tl/helm/ntfy/values.yaml

@@ -9,7 +9,7 @@ ntfy:
         main:
           image:
             repository: binwiederhier/ntfy
-            tag: v2.19.0
+            tag: v2.19.2
             pullPolicy: IfNotPresent
           args: ["serve"]
           env:

clusters/cl01tl/helm/ollama/Chart.yaml

@@ -31,4 +31,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ollama.png
 # renovate: datasource=github-releases depName=ollama/ollama
-appVersion: 0.18.0
+appVersion: 0.18.2

clusters/cl01tl/helm/ollama/values.yaml

@@ -22,7 +22,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.18.0
+            tag: 0.18.2
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE
@@ -58,7 +58,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.18.0
+            tag: 0.18.2
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE
@@ -94,7 +94,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.18.0
+            tag: 0.18.2
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE

clusters/cl01tl/helm/outline/Chart.yaml

@@ -39,4 +39,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/outline.png
 # renovate: datasource=github-releases depName=outline/outline
-appVersion: 1.6.0
+appVersion: 1.6.1

clusters/cl01tl/helm/outline/values.yaml

@@ -12,7 +12,7 @@ outline:
         main:
           image:
             repository: outlinewiki/outline
-            tag: 1.6.0
+            tag: 1.6.1
             pullPolicy: IfNotPresent
           env:
             - name: NODE_ENV

clusters/cl01tl/helm/plex/values.yaml

@@ -9,7 +9,7 @@ plex:
         main:
           image:
             repository: ghcr.io/linuxserver/plex
-            tag: 1.43.0@sha256:84f8646e799f6636876ab4f283d9fc8f6c51d56098ea74cba82bfb85074b68df
+            tag: 1.43.0@sha256:a27f1ce1e1d14cd3627ed217f042bf8de0f796ed274fb27b2dc971ae22a64b95
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -26,6 +26,7 @@ plex:
   service:
     main:
       controller: main
+      type: LoadBalancer
       ports:
         http:
           port: 32400

clusters/cl01tl/helm/postiz/Chart.yaml

@@ -42,4 +42,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/postiz.png
 # renovate: datasource=github-releases depName=gitroomhq/postiz-app
-appVersion: v2.20.2
+appVersion: v2.21.0

clusters/cl01tl/helm/postiz/values.yaml

@@ -9,7 +9,7 @@ postiz:
         main:
           image:
             repository: ghcr.io/gitroomhq/postiz-app
-            tag: v2.20.2
+            tag: v2.21.0
             pullPolicy: IfNotPresent
           env:
             - name: MAIN_URL

clusters/cl01tl/helm/prometheus-operator-crds/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: prometheus-operator-crds
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 27.0.0
+  version: 28.0.0
-digest: sha256:ab76a45fb53268d4afdad507277c244af11c50344e50a24799182bbd9757258d
+digest: sha256:82e19c59373b1dd1a854a4e5699c7b864cfbb96e58a065f53ad76e64d7109cff
-generated: "2026-02-06T14:05:22.069162277Z"
+generated: "2026-03-19T22:02:57.659253727Z"

clusters/cl01tl/helm/prometheus-operator-crds/Chart.yaml

@@ -15,8 +15,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: prometheus-operator-crds
-    version: 27.0.0
+    version: 28.0.0
     repository: oci://ghcr.io/prometheus-community/charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prometheus.png
 # renovate: datasource=github-releases depName=prometheus-operator/prometheus-operator
-appVersion: v0.89.0
+appVersion: v0.90.0

clusters/cl01tl/helm/qbittorrent/templates/external-secret.yaml

@@ -16,23 +16,30 @@ spec:
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
+        key: /airvpn/conf/cl01tl
         metadataPolicy: None
         property: private-key
-    - secretKey: proton-email
+    - secretKey: preshared-key
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
+        key: /airvpn/conf/cl01tl
         metadataPolicy: None
-        property: email
+        property: preshared-key
-    - secretKey: proton-password
+    - secretKey: addresses
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
+        key: /airvpn/conf/cl01tl
         metadataPolicy: None
-        property: password
+        property: addresses
+    - secretKey: input-ports
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /airvpn/conf/cl01tl
+        metadataPolicy: None
+        property: input-ports
 
 ---
 apiVersion: external-secrets.io/v1

clusters/cl01tl/helm/qbittorrent/values.yaml

@@ -56,7 +56,7 @@ qbittorrent:
                 command: ["/bin/sh", "-c", "(ip rule del table 51820; ip -6 rule del table 51820) || true"]
           env:
             - name: VPN_SERVICE_PROVIDER
-              value: protonvpn
+              value: airvpn
             - name: VPN_TYPE
               value: wireguard
             - name: WIREGUARD_PRIVATE_KEY
@@ -64,28 +64,29 @@ qbittorrent:
                 secretKeyRef:
                   name: qbittorrent-wireguard-conf
                   key: private-key
-            - name: UPDATER_PROTONVPN_EMAIL
+            - name: WIREGUARD_PRESHARED_KEY
               valueFrom:
                 secretKeyRef:
                   name: qbittorrent-wireguard-conf
-                  key: proton-email
+                  key: preshared-key
-            - name: UPDATER_PROTONVPN_PASSWORD
+            - name: WIREGUARD_ADDRESSES
               valueFrom:
                 secretKeyRef:
                   name: qbittorrent-wireguard-conf
-                  key: proton-password
+                  key: addresses
-            - name: VPN_PORT_FORWARDING
+            - name: FIREWALL_VPN_INPUT_PORTS
-              value: "on"
+              valueFrom:
-            - name: VPN_PORT_FORWARDING_UP_COMMAND
+                secretKeyRef:
-              value: '/bin/sh -c "/gluetun/update.sh {{ printf "{{PORTS}}" }}"'
+                  name: qbittorrent-wireguard-conf
-            - name: PORT_FORWARD_ONLY
+                  key: input-ports
-              value: "on"
             - name: FIREWALL_OUTBOUND_SUBNETS
               value: 192.168.1.0/24,10.244.0.0/16
             - name: FIREWALL_INPUT_PORTS
               value: 8080,9022
             - name: DNS_UPSTREAM_RESOLVER_TYPE
               value: dot
+            - name: BLOCK_MALICIOUS
+              value: "off"
             - name: HTTPPROXY
               value: "off"
             - name: SHADOWSOCKS
@@ -216,7 +217,7 @@ qbittorrent:
         qui:
           image:
             repository: ghcr.io/autobrr/qui
-            tag: v1.14.1
+            tag: v1.15.0
             pullPolicy: IfNotPresent
           env:
             - name: QUI__METRICS_ENABLED

clusters/cl01tl/helm/roundcube/Chart.yaml

@@ -29,4 +29,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/roundcube.png
 # renovate: datasource=github-releases depName=roundcube/roundcubemail
-appVersion: 1.6.13
+appVersion: 1.6.14

clusters/cl01tl/helm/roundcube/values.yaml

@@ -9,7 +9,7 @@ roundcube:
         main:
           image:
             repository: roundcube/roundcubemail
-            tag: 1.6.13-fpm-alpine
+            tag: 1.6.14-fpm-alpine
             pullPolicy: IfNotPresent
           env:
             - name: ROUNDCUBEMAIL_DB_TYPE
@@ -85,7 +85,7 @@ roundcube:
         backup:
           image:
             repository: roundcube/roundcubemail
-            tag: 1.6.13-fpm-alpine
+            tag: 1.6.14-fpm-alpine
             pullPolicy: IfNotPresent
           env:
             - name: ROUNDCUBEMAIL_DB_TYPE

clusters/cl01tl/helm/rybbit/values.yaml

@@ -71,7 +71,7 @@ rybbit:
                   key: mapbox-token
           probes:
             liveness:
-              enabled: true
+              enabled: false
               custom: true
               spec:
                 exec:
@@ -122,7 +122,7 @@ rybbit:
         main:
           image:
             repository: clickhouse/clickhouse-server
-            tag: 26.2.4
+            tag: 26.2.5
             pullPolicy: IfNotPresent
           env:
             - name: CLICKHOUSE_DB

clusters/cl01tl/helm/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:9206e4c2de22ea36274a67eb961afd90f51d2a9df2f8242b00c94e6c6692a946
+            tag: latest@sha256:b6db575bb821d35279474090270db9e53e92432a66d19e7da51c0ef1b5ddb806
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -39,7 +39,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:9206e4c2de22ea36274a67eb961afd90f51d2a9df2f8242b00c94e6c6692a946
+            tag: latest@sha256:b6db575bb821d35279474090270db9e53e92432a66d19e7da51c0ef1b5ddb806
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL

clusters/cl01tl/helm/shelfmark/Chart.yaml

@@ -23,4 +23,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/shelfmark.webp
 # renovate: datasource=github-releases depName=calibrain/shelfmark
-appVersion: v1.2.0
+appVersion: v1.2.1

clusters/cl01tl/helm/shelfmark/values.yaml

@@ -9,7 +9,7 @@ shelfmark:
         main:
           image:
             repository: ghcr.io/calibrain/shelfmark
-            tag: v1.2.0
+            tag: v1.2.1
             pullPolicy: IfNotPresent
           env:
             - name: FLASK_PORT

clusters/cl01tl/helm/site-profile/values.yaml

@@ -11,7 +11,7 @@ site-profile:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-profile
-            tag: 3.13.0
+            tag: 3.15.1
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/slskd/templates/external-secret.yaml

@@ -62,20 +62,27 @@ spec:
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
+        key: /airvpn/conf/cl01tl
         metadataPolicy: None
         property: private-key
-    - secretKey: proton-email
+    - secretKey: preshared-key
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
+        key: /airvpn/conf/cl01tl
         metadataPolicy: None
-        property: email
+        property: preshared-key
-    - secretKey: proton-password
+    - secretKey: addresses
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
+        key: /airvpn/conf/cl01tl
         metadataPolicy: None
-        property: password
+        property: addresses
+    - secretKey: input-ports
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /airvpn/conf/cl01tl
+        metadataPolicy: None
+        property: input-ports

clusters/cl01tl/helm/slskd/values.yaml

@@ -54,7 +54,7 @@ slskd:
                 command: ["/bin/sh", "-c", "(ip rule del table 51820; ip -6 rule del table 51820) || true"]
           env:
             - name: VPN_SERVICE_PROVIDER
-              value: protonvpn
+              value: airvpn
             - name: VPN_TYPE
               value: wireguard
             - name: WIREGUARD_PRIVATE_KEY
@@ -62,26 +62,29 @@ slskd:
                 secretKeyRef:
                   name: slskd-wireguard-conf
                   key: private-key
-            - name: UPDATER_PROTONVPN_EMAIL
+            - name: WIREGUARD_PRESHARED_KEY
               valueFrom:
                 secretKeyRef:
                   name: slskd-wireguard-conf
-                  key: proton-email
+                  key: preshared-key
-            - name: UPDATER_PROTONVPN_PASSWORD
+            - name: WIREGUARD_ADDRESSES
               valueFrom:
                 secretKeyRef:
                   name: slskd-wireguard-conf
-                  key: proton-password
+                  key: addresses
-            - name: VPN_PORT_FORWARDING
+            - name: FIREWALL_VPN_INPUT_PORTS
-              value: "on"
+              valueFrom:
-            - name: PORT_FORWARD_ONLY
+                secretKeyRef:
-              value: "on"
+                  name: slskd-wireguard-conf
+                  key: input-ports
             - name: FIREWALL_OUTBOUND_SUBNETS
               value: 192.168.1.0/24,10.244.0.0/16
             - name: FIREWALL_INPUT_PORTS
               value: 5030,50300
             - name: DNS_UPSTREAM_RESOLVER_TYPE
               value: dot
+            - name: BLOCK_MALICIOUS
+              value: "off"
             - name: HTTPPROXY
               value: "off"
             - name: SHADOWSOCKS

clusters/cl01tl/helm/sonarr-4k/values.yaml

@@ -13,7 +13,7 @@ sonarr-4k:
         main:
           image:
             repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.16@sha256:21c1c3d52248589bb064f5adafec18cad45812d7a01d317472955eef051e619b
+            tag: 4.0.17@sha256:76414c033f290d3c9f1f9dfad71150abe71d92592369a3377a5903d579e6e2b2
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/sonarr-anime/values.yaml

@@ -13,7 +13,7 @@ sonarr-anime:
         main:
           image:
             repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.16@sha256:21c1c3d52248589bb064f5adafec18cad45812d7a01d317472955eef051e619b
+            tag: 4.0.17@sha256:76414c033f290d3c9f1f9dfad71150abe71d92592369a3377a5903d579e6e2b2
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/sonarr/values.yaml

@@ -13,7 +13,7 @@ sonarr:
         main:
           image:
             repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.16@sha256:21c1c3d52248589bb064f5adafec18cad45812d7a01d317472955eef051e619b
+            tag: 4.0.17@sha256:76414c033f290d3c9f1f9dfad71150abe71d92592369a3377a5903d579e6e2b2
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/tailscale-operator/Chart.yaml

@@ -21,4 +21,4 @@ dependencies:
     repository: https://pkgs.tailscale.com/helmcharts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tailscale-light.png
 # renovate: datasource=github-releases depName=tailscale/tailscale
-appVersion: v1.94.2
+appVersion: v1.96.3

clusters/cl01tl/helm/talos/values.yaml

@@ -69,7 +69,7 @@ etcd-backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:a41234c2b43d6cfa0d51c9523a2d7925f7f21297a41d69932946c3e364d32b5e
+            tag: latest@sha256:e3965f8205dfb96fb00e66cee54a0d171f1829a3cc6a1bbb980ab076730e54be
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -155,7 +155,7 @@ etcd-backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:a41234c2b43d6cfa0d51c9523a2d7925f7f21297a41d69932946c3e364d32b5e
+            tag: latest@sha256:e3965f8205dfb96fb00e66cee54a0d171f1829a3cc6a1bbb980ab076730e54be
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -241,7 +241,7 @@ etcd-backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:a41234c2b43d6cfa0d51c9523a2d7925f7f21297a41d69932946c3e364d32b5e
+            tag: latest@sha256:e3965f8205dfb96fb00e66cee54a0d171f1829a3cc6a1bbb980ab076730e54be
             pullPolicy: IfNotPresent
           command:
             - /bin/sh

clusters/cl01tl/helm/tdarr/values.yaml

@@ -9,7 +9,7 @@ tdarr:
         main:
           image:
             repository: ghcr.io/haveagitgat/tdarr
-            tag: 2.63.01
+            tag: 2.64.02
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -48,7 +48,7 @@ tdarr:
         main:
           image:
             repository: ghcr.io/haveagitgat/tdarr_node
-            tag: 2.63.01
+            tag: 2.64.02
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/traefik/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: traefik
   repository: https://traefik.github.io/charts
-  version: 39.0.5
+  version: 39.0.6
 - name: traefik-crds
   repository: https://traefik.github.io/charts
   version: 1.15.0
-digest: sha256:8edf8d2dcabdba2c2b8d6a9508f001ba5ef4bec205423f864b92f2adedd73b60
+digest: sha256:45b11c0cb1083daff76df3c90ecf7d73fc09979239bdc0f272d826fab92a3ba4
-generated: "2026-03-16T15:32:49.364653199Z"
+generated: "2026-03-20T20:50:42.131002257Z"

clusters/cl01tl/helm/traefik/Chart.yaml

@@ -15,11 +15,11 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: traefik
-    version: 39.0.5
+    version: 39.0.6
     repository: https://traefik.github.io/charts
   - name: traefik-crds
     version: 1.15.0
     repository: https://traefik.github.io/charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/webp/traefik.webp
 # renovate: datasource=github-releases depName=traefik/traefik
-appVersion: v3.6.10
+appVersion: v3.6.11

clusters/cl01tl/helm/trivy/Chart.lock

@@ -1,6 +0,0 @@
-dependencies:
-- name: trivy-operator
-  repository: https://aquasecurity.github.io/helm-charts/
-  version: 0.32.1
-digest: sha256:7e25850fc3115f52e6c65151c76668929eee6713228e935862d9f156397c2ede
-generated: "2026-03-15T17:21:41.373519-05:00"

clusters/cl01tl/helm/trivy/Chart.yaml

@@ -1,23 +0,0 @@
-apiVersion: v2
-name: trivy
-version: 1.0.0
-description: Trivy
-keywords:
-  - trivy
-  - vulnerability
-  - monitoring
-  - kubernetes
-home: https://wiki.alexlebens.dev/s/
-sources:
-  - https://github.com/aquasecurity/trivy
-  - https://github.com/aquasecurity/trivy-operator
-  - https://github.com/aquasecurity/trivy-operator/tree/main/deploy/helm
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: trivy-operator
-    version: 0.32.1
-    repository: https://aquasecurity.github.io/helm-charts/
-icon: https://raw.githubusercontent.com/aquasecurity/trivy/main/docs/imgs/logo.png
-# renovate: github=aquasecurity/trivy
-appVersion: 0.32.1