feat: move to chart and namespace

Reviewed-on: #6250

clusters/cl01tl/helm/directus/Chart.lock

@@ -8,5 +8,8 @@ dependencies:
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.6.1
-digest: sha256:e3d9d7bc069b79ec37769f77d691cda3b8bd92e37a9d1dd2ef8279dc6d2b6cde
-generated: "2026-04-24T21:50:43.755575922Z"
+- name: rclone-bucket
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.2.0
+digest: sha256:b95c228173eb2e4914c37d5c8b3753ad644a90dc9f7f4357dbc1cbf15004961b
+generated: "2026-04-25T20:59:03.456994-05:00"

clusters/cl01tl/helm/directus/Chart.yaml

@@ -12,6 +12,7 @@ sources:
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/rclone-bucket
 maintainers:
   - name: alexlebens
 dependencies:
@@ -27,6 +28,10 @@ dependencies:
     alias: valkey
     version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
+  - name: rclone-bucket
+    alias: rclone-directus-assets-remote
+    repository: oci://harbor.alexlebens.net/helm-charts
+    version: 0.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/directus.png
 # renovate: datasource=github-releases depName=directus/directus
 appVersion: 11.17.3

clusters/cl01tl/helm/directus/values.yaml

@@ -214,3 +214,24 @@ valkey:
     # https://github.com/valkey-io/valkey-helm/issues/135
     metrics:
       enabled: false
+rclone-directus-assets-remote:
+  cronJob:
+    suspend: false
+    schedule: 0 0 * * *
+  rclone:
+    source:
+      bucketName: directus-assets
+    destination:
+      bucketName: directus-assets
+  secret:
+    externalSecret:
+      source:
+        credentials:
+          path: /garage/home-infra/directus-assets
+        config:
+          path: /garage/config
+      destination:
+        credentials:
+          path: /garage/home-infra/directus-assets
+        config:
+          path: /garage/config

clusters/cl01tl/helm/external-secrets/templates/cluster-secret-store.yaml

@@ -1,25 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
-metadata:
-  name: vault
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  provider:
-    vault:
-      server: http://vault-internal.vault:8200
-      path: secret
-      auth:
-        tokenSecretRef:
-          namespace: vault
-          name: vault-token
-          key: token
-
----
-apiVersion: external-secrets.io/v1
-kind: ClusterSecretStore
 metadata:
   name: openbao
   namespace: {{ .Release.Namespace }}

clusters/cl01tl/helm/foldergram/templates/_helpers.tpl

@@ -16,6 +16,6 @@ app.kubernetes.io/part-of: {{ .Release.Name }}
 {{/*
 NFS names
 */}}
-{{- define "custom.storageNfsName" -}}
-foldergram-pictures-collections-nfs-storage
+{{- define "custom.storageMiaNfsName" -}}
+foldergram-pictures-collection-mia-nfs-storage
 {{- end -}}

clusters/cl01tl/helm/foldergram/templates/persistent-volume-claim.yaml

@@ -1,13 +1,13 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ include "custom.storageNfsName" . }}
+  name: {{ include "custom.storageMiaNfsName" . }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.storageNfsName" . }}
+    app.kubernetes.io/name: {{ include "custom.storageMiaNfsName" . }}
     {{- include "custom.labels" . | nindent 4 }}
 spec:
-  volumeName: {{ include "custom.storageNfsName" . }}
+  volumeName: {{ include "custom.storageMiaNfsName" . }}
   storageClassName: nfs-client
   accessModes:
     - ReadWriteMany

clusters/cl01tl/helm/foldergram/templates/persistent-volume.yaml

@@ -1,10 +1,10 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: {{ include "custom.storageNfsName" . }}
+  name: {{ include "custom.storageMiaNfsName" . }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.storageNfsName" . }}
+    app.kubernetes.io/name: {{ include "custom.storageMiaNfsName" . }}
     {{- include "custom.labels" . | nindent 4 }}
 spec:
   persistentVolumeReclaimPolicy: Retain
@@ -14,7 +14,7 @@ spec:
   accessModes:
     - ReadWriteMany
   nfs:
-    path: /volume2/Storage/Pictures/Collections
+    path: '/volume2/Storage/Pictures/Collections/Minneapolis Institute of Art'
     server: synologybond.alexlebens.net
   mountOptions:
     - vers=4

clusters/cl01tl/helm/foldergram/values.yaml

@@ -17,7 +17,7 @@ foldergram:
             - name: IMAGE_DETAIL_SOURCE
               value: original
             - name: DERIVATIVE_MODE
-              value: eager
+              value: lazy
             - name: DATA_ROOT
               value: ./data
             - name: GALLERY_ROOT
@@ -76,12 +76,12 @@ foldergram:
           main:
             - path: /app/data
               readOnly: false
-    pictures:
-      existingClaim: foldergram-pictures-collections-nfs-storage
+    pictures-mia:
+      existingClaim: foldergram-pictures-collection-mia-nfs-storage
       advancedMounts:
         main:
           main:
-            - path: /gallery
+            - path: '/gallery/Minneapolis Institute of Art'
               readOnly: true
 volsync-target-db:
   pvcTarget: foldergram-db

clusters/cl01tl/helm/grimmory/Chart.yaml

@@ -28,4 +28,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grimmory.png
 # renovate: datasource=github-releases depName=grimmory-tools/grimmory
-appVersion: v3.0.0
+appVersion: v3.0.1

clusters/cl01tl/helm/grimmory/values.yaml

@@ -12,7 +12,7 @@ grimmory:
         main:
           image:
             repository: ghcr.io/grimmory-tools/grimmory
-            tag: v3.0.0@sha256:0130c338d4c1186f2f6b6acdc4a7ee56388dfdab9cb0b9a23ac0fc91b79e7d75
+            tag: v3.0.1@sha256:e8dbba61c298b75025b2027dfc37d6e20b844bd4be5b13dd9973367c01642d05
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,7 +1,7 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 84.0.1
+  version: 84.1.0
 - name: prometheus-operator-crds
   repository: oci://ghcr.io/prometheus-community/charts
   version: 28.0.1
@@ -11,5 +11,5 @@ dependencies:
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.6.1
-digest: sha256:2714de1082a27491925ba1b7adfba884a5ca9e674df22df96e8f6ccf56a54a6e
-generated: "2026-04-24T17:03:37.423427661Z"
+digest: sha256:f7340793bc2c04e561d048b110cc7258fac0d5dc3d3b4ecdc6c2d8898445c5ab
+generated: "2026-04-26T00:12:54.803217038Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 84.0.1
+    version: 84.1.0
     repository: oci://ghcr.io/prometheus-community/charts
   - name: prometheus-operator-crds
     version: 28.0.1

clusters/cl01tl/helm/medialyze/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/frederikemmer/MediaLyze/d8f69c0628bac7c047b90f91a66341648029c273/frontend/public/favicon.svg
 # renovate: datasource=github-releases depName=frederikemmer/MediaLyze
-appVersion: 0.8.3
+appVersion: 0.9.0

clusters/cl01tl/helm/medialyze/values.yaml

@@ -12,7 +12,7 @@ medialyze:
         main:
           image:
             repository: ghcr.io/frederikemmer/medialyze
-            tag: 0.8.3@sha256:ef21e989f3d04c99f0fee4c992a92308156c746e26fb98672a3fa714fc630367
+            tag: 0.9.0@sha256:3d88b4f4a3e6cf2489a5236e5174d58d6274e99008ce2ddd4159d1389744473f
           env:
             - name: HOST_PORT
               value: 8080

clusters/cl01tl/helm/outline/Chart.yaml

@@ -38,4 +38,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/outline.png
 # renovate: datasource=github-releases depName=outline/outline
-appVersion: 1.6.1
+appVersion: 1.7.0

clusters/cl01tl/helm/outline/values.yaml

@@ -11,7 +11,7 @@ outline:
         main:
           image:
             repository: outlinewiki/outline
-            tag: 1.6.1@sha256:a750f764080ce28d4a7393176011c8e2e4170b41689a8f6d91327dadf4904eb6
+            tag: 1.7.0@sha256:b13ccd15653513a79eb66283bfa91287f5e3d0944d8cb056d5288b8565992de5
           env:
             - name: NODE_ENV
               value: production

clusters/cl01tl/helm/rclone/templates/external-secret.yaml

@@ -1,36 +1,36 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: garage-directus-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: garage-directus-secret
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        key: /garage/home-infra/directus-assets
-        property: ACCESS_KEY_ID
-    - secretKey: ACCESS_REGION
-      remoteRef:
-        key: /garage/home-infra/directus-assets
-        property: ACCESS_REGION
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        key: /garage/home-infra/directus-assets
-        property: ACCESS_SECRET_KEY
-    - secretKey: SRC_ENDPOINT
-      remoteRef:
-        key: /garage/config
-        property: ENDPOINT_LOCAL
-    - secretKey: DEST_ENDPOINT
-      remoteRef:
-        key: /garage/config
-        property: ENDPOINT_REMOTE
+# apiVersion: external-secrets.io/v1
+# kind: ExternalSecret
+# metadata:
+#   name: garage-directus-secret
+#   namespace: {{ .Release.Namespace }}
+#   labels:
+#     app.kubernetes.io/name: garage-directus-secret
+#     {{- include "custom.labels" . | nindent 4 }}
+# spec:
+#   secretStoreRef:
+#     kind: ClusterSecretStore
+#     name: openbao
+#   data:
+#     - secretKey: ACCESS_KEY_ID
+#       remoteRef:
+#         key: /garage/home-infra/directus-assets
+#         property: ACCESS_KEY_ID
+#     - secretKey: ACCESS_REGION
+#       remoteRef:
+#         key: /garage/home-infra/directus-assets
+#         property: ACCESS_REGION
+#     - secretKey: ACCESS_SECRET_KEY
+#       remoteRef:
+#         key: /garage/home-infra/directus-assets
+#         property: ACCESS_SECRET_KEY
+#     - secretKey: SRC_ENDPOINT
+#       remoteRef:
+#         key: /garage/config
+#         property: ENDPOINT_LOCAL
+#     - secretKey: DEST_ENDPOINT
+#       remoteRef:
+#         key: /garage/config
+#         property: ENDPOINT_REMOTE
 
 ---
 apiVersion: external-secrets.io/v1

clusters/cl01tl/helm/rclone/values.yaml

@@ -1,83 +1,83 @@
 rclone:
   controllers:
-    directus-assets:
-      type: cronjob
-      cronjob:
-        suspend: false
-        timeZone: America/Chicago
-        schedule: 0 0 * * *
-        backoffLimit: 3
-        parallelism: 1
-      containers:
-        sync:
-          image:
-            repository: rclone/rclone
-            tag: 1.73.5@sha256:1619a625f845e169c34b952cf40c483c0392965b821c5155cde8cbfd35254a96
-          args:
-            - sync
-            - src:directus-assets
-            - dest:directus-assets
-            - --s3-no-check-bucket
-            - --verbose
-          env:
-            - name: RCLONE_S3_PROVIDER
-              value: Other
-            - name: RCLONE_CONFIG_SRC_TYPE
-              value: s3
-            - name: RCLONE_CONFIG_SRC_PROVIDER
-              value: Other
-            - name: RCLONE_CONFIG_SRC_ENV_AUTH
-              value: false
-            - name: RCLONE_CONFIG_SRC_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: garage-directus-secret
-                  key: ACCESS_KEY_ID
-            - name: RCLONE_CONFIG_SRC_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: garage-directus-secret
-                  key: ACCESS_SECRET_KEY
-            - name: RCLONE_CONFIG_SRC_REGION
-              valueFrom:
-                secretKeyRef:
-                  name: garage-directus-secret
-                  key: ACCESS_REGION
-            - name: RCLONE_CONFIG_SRC_ENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: garage-directus-secret
-                  key: SRC_ENDPOINT
-            - name: RCLONE_CONFIG_SRC_S3_FORCE_PATH_STYLE
-              value: true
-            - name: RCLONE_CONFIG_DEST_TYPE
-              value: s3
-            - name: RCLONE_CONFIG_DEST_PROVIDER
-              value: Other
-            - name: RCLONE_CONFIG_DEST_ENV_AUTH
-              value: false
-            - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: garage-directus-secret
-                  key: ACCESS_KEY_ID
-            - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: garage-directus-secret
-                  key: ACCESS_SECRET_KEY
-            - name: RCLONE_CONFIG_DEST_REGION
-              valueFrom:
-                secretKeyRef:
-                  name: garage-directus-secret
-                  key: ACCESS_REGION
-            - name: RCLONE_CONFIG_DEST_ENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: garage-directus-secret
-                  key: DEST_ENDPOINT
-            - name: RCLONE_CONFIG_DEST_S3_FORCE_PATH_STYLE
-              value: true
+    # directus-assets:
+    #   type: cronjob
+    #   cronjob:
+    #     suspend: false
+    #     timeZone: America/Chicago
+    #     schedule: 0 0 * * *
+    #     backoffLimit: 3
+    #     parallelism: 1
+    #   containers:
+    #     sync:
+    #       image:
+    #         repository: rclone/rclone
+    #         tag: 1.73.5@sha256:1619a625f845e169c34b952cf40c483c0392965b821c5155cde8cbfd35254a96
+    #       args:
+    #         - sync
+    #         - src:directus-assets
+    #         - dest:directus-assets
+    #         - --s3-no-check-bucket
+    #         - --verbose
+    #       env:
+    #         - name: RCLONE_S3_PROVIDER
+    #           value: Other
+    #         - name: RCLONE_CONFIG_SRC_TYPE
+    #           value: s3
+    #         - name: RCLONE_CONFIG_SRC_PROVIDER
+    #           value: Other
+    #         - name: RCLONE_CONFIG_SRC_ENV_AUTH
+    #           value: false
+    #         - name: RCLONE_CONFIG_SRC_ACCESS_KEY_ID
+    #           valueFrom:
+    #             secretKeyRef:
+    #               name: garage-directus-secret
+    #               key: ACCESS_KEY_ID
+    #         - name: RCLONE_CONFIG_SRC_SECRET_ACCESS_KEY
+    #           valueFrom:
+    #             secretKeyRef:
+    #               name: garage-directus-secret
+    #               key: ACCESS_SECRET_KEY
+    #         - name: RCLONE_CONFIG_SRC_REGION
+    #           valueFrom:
+    #             secretKeyRef:
+    #               name: garage-directus-secret
+    #               key: ACCESS_REGION
+    #         - name: RCLONE_CONFIG_SRC_ENDPOINT
+    #           valueFrom:
+    #             secretKeyRef:
+    #               name: garage-directus-secret
+    #               key: SRC_ENDPOINT
+    #         - name: RCLONE_CONFIG_SRC_S3_FORCE_PATH_STYLE
+    #           value: true
+    #         - name: RCLONE_CONFIG_DEST_TYPE
+    #           value: s3
+    #         - name: RCLONE_CONFIG_DEST_PROVIDER
+    #           value: Other
+    #         - name: RCLONE_CONFIG_DEST_ENV_AUTH
+    #           value: false
+    #         - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
+    #           valueFrom:
+    #             secretKeyRef:
+    #               name: garage-directus-secret
+    #               key: ACCESS_KEY_ID
+    #         - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
+    #           valueFrom:
+    #             secretKeyRef:
+    #               name: garage-directus-secret
+    #               key: ACCESS_SECRET_KEY
+    #         - name: RCLONE_CONFIG_DEST_REGION
+    #           valueFrom:
+    #             secretKeyRef:
+    #               name: garage-directus-secret
+    #               key: ACCESS_REGION
+    #         - name: RCLONE_CONFIG_DEST_ENDPOINT
+    #           valueFrom:
+    #             secretKeyRef:
+    #               name: garage-directus-secret
+    #               key: DEST_ENDPOINT
+    #         - name: RCLONE_CONFIG_DEST_S3_FORCE_PATH_STYLE
+    #           value: true
     karakeep-assets:
       type: cronjob
       cronjob:

clusters/cl01tl/helm/sonarr-4k/Chart.yaml

@@ -33,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/sonarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-sonarr
-appVersion: 4.0.17.2952-ls308
+appVersion: 4.0.17.2952-ls309

clusters/cl01tl/helm/sonarr-4k/values.yaml

@@ -13,7 +13,7 @@ sonarr-4k:
         main:
           image:
             repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.17.2952-ls308@sha256:e6c9a091735fede0c2a205c69e7d4c2f0188eaf2bec7e42d8a26c017e5f2a910
+            tag: 4.0.17.2952-ls309@sha256:3580aec3802c915f0f819a88d5099abce61734b925732b8393d176b5dc561020
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/sonarr-anime/Chart.yaml

@@ -33,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/sonarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-sonarr
-appVersion: 4.0.17.2952-ls308
+appVersion: 4.0.17.2952-ls309

clusters/cl01tl/helm/sonarr-anime/values.yaml

@@ -13,7 +13,7 @@ sonarr-anime:
         main:
           image:
             repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.17.2952-ls308@sha256:e6c9a091735fede0c2a205c69e7d4c2f0188eaf2bec7e42d8a26c017e5f2a910
+            tag: 4.0.17.2952-ls309@sha256:3580aec3802c915f0f819a88d5099abce61734b925732b8393d176b5dc561020
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/sonarr/Chart.yaml

@@ -33,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/sonarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-sonarr
-appVersion: 4.0.17.2952-ls308
+appVersion: 4.0.17.2952-ls309

clusters/cl01tl/helm/sonarr/values.yaml

@@ -12,7 +12,7 @@ sonarr:
         main:
           image:
             repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.17.2952-ls308@sha256:e6c9a091735fede0c2a205c69e7d4c2f0188eaf2bec7e42d8a26c017e5f2a910
+            tag: 4.0.17.2952-ls309@sha256:3580aec3802c915f0f819a88d5099abce61734b925732b8393d176b5dc561020
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/talos/templates/external-secret.yaml

@@ -19,6 +19,14 @@ spec:
       remoteRef:
         key: /garage/home-infra/talos-backups
         property: ACCESS_SECRET_KEY
+    - secretKey: AWS_REGION
+      remoteRef:
+        key: /garage/home-infra/talos-backups
+        property: ACCESS_REGION
+    - secretKey: BUCKET_NAME
+      remoteRef:
+        key: /garage/home-infra/talos-backups
+        property: BUCKET
     - secretKey: BUCKET
       remoteRef:
         key: /garage/home-infra/talos-backups
@@ -50,6 +58,14 @@ spec:
       remoteRef:
         key: /garage/home-infra/talos-backups
         property: ACCESS_SECRET_KEY
+    - secretKey: AWS_REGION
+      remoteRef:
+        key: /garage/home-infra/talos-backups
+        property: ACCESS_REGION
+    - secretKey: BUCKET_NAME
+      remoteRef:
+        key: /garage/home-infra/talos-backups
+        property: BUCKET
     - secretKey: BUCKET
       remoteRef:
         key: /garage/home-infra/talos-backups
@@ -81,6 +97,14 @@ spec:
       remoteRef:
         key: /digital-ocean/home-infra/talos-backups
         property: AWS_SECRET_ACCESS_KEY
+    - secretKey: AWS_REGION
+      remoteRef:
+        key: /digital-ocean/home-infra/talos-backups
+        property: AWS_REGION
+    - secretKey: BUCKET_NAME
+      remoteRef:
+        key: /digital-ocean/home-infra/talos-backups
+        property: BUCKET
     - secretKey: BUCKET
       remoteRef:
         key: /digital-ocean/home-infra/talos-backups

clusters/cl01tl/helm/talos/values.yaml

@@ -47,11 +47,17 @@ etcd-backup:
                   name: talos-etcd-backup-local-config
                   key: AWS_SECRET_ACCESS_KEY
             - name: AWS_REGION
-              value: us-east-1
+              valueFrom:
+                secretKeyRef:
+                  name: talos-etcd-backup-local-config
+                  key: AWS_REGION
             - name: CUSTOM_S3_ENDPOINT
               value: http://garage-main.garage:3900
             - name: BUCKET
-              value: talos-backups
+              valueFrom:
+                secretKeyRef:
+                  name: talos-etcd-backup-local-config
+                  key: BUCKET_NAME
             - name: S3_PREFIX
               value: "cl01tl/etcd"
             - name: CLUSTER_NAME
@@ -129,11 +135,17 @@ etcd-backup:
                   name: talos-etcd-backup-remote-config
                   key: AWS_SECRET_ACCESS_KEY
             - name: AWS_REGION
-              value: us-east-1
+              valueFrom:
+                secretKeyRef:
+                  name: talos-etcd-backup-remote-config
+                  key: AWS_REGION
             - name: CUSTOM_S3_ENDPOINT
               value: https://garage-ps10rp.boreal-beaufort.ts.net:3900
             - name: BUCKET
-              value: talos-backups
+              valueFrom:
+                secretKeyRef:
+                  name: talos-etcd-backup-remote-config
+                  key: BUCKET_NAME
             - name: S3_PREFIX
               value: "cl01tl/etcd"
             - name: CLUSTER_NAME
@@ -211,11 +223,17 @@ etcd-backup:
                   name: talos-etcd-backup-external-config
                   key: AWS_SECRET_ACCESS_KEY
             - name: AWS_REGION
-              value: nyc3
+              valueFrom:
+                secretKeyRef:
+                  name: talos-etcd-backup-external-config
+                  key: AWS_REGION
             - name: CUSTOM_S3_ENDPOINT
               value: https://nyc3.digitaloceanspaces.com
             - name: BUCKET
-              value: talos-backups-bee8585f7b8a4d0239c9b823
+              valueFrom:
+                secretKeyRef:
+                  name: talos-etcd-backup-external-config
+                  key: BUCKET_NAME
             - name: S3_PREFIX
               value: "cl01tl/etcd"
             - name: CLUSTER_NAME

clusters/cl01tl/helm/vaultwarden/Chart.yaml

@@ -33,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/vaultwarden.png
 # renovate: datasource=github-releases depName=dani-garcia/vaultwarden
-appVersion: 1.35.7
+appVersion: 1.35.8

clusters/cl01tl/helm/vaultwarden/values.yaml

@@ -8,7 +8,7 @@ vaultwarden:
         main:
           image:
             repository: ghcr.io/dani-garcia/vaultwarden
-            tag: 1.35.7@sha256:9a8eec71f4a52411cc43edc7a50f33e9b6f62b5baca0dd95f0c6e7fd60f1a341
+            tag: 1.35.8@sha256:c4f6056fe0c288a052a223cecd263a90d1dda1a0177bb5b054a363a6c7b211d9
           env:
             - name: DOMAIN
               value: https://passwords.alexlebens.dev