Update Helm release grafana-operator to v5.21.1

README.md

@@ -2,6 +2,12 @@
 
 GitOps definied infrastrucutre for the alexlebens.net domain.
 
+## Stack-cl01tl
+
+https://argocd.alexlebens.net/api/badge?name=stack-cl01tl&revision=true&showAppName=true
+
+App-of-Apps Application for cl01tl
+
 ## License
 
 This project is licensed under the terms of the Apache 2.0 License license.

clusters/cl01tl/helm/grafana-operator/Chart.lock

@@ -12,4 +12,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.5.0
 digest: sha256:485cf44121c365717b671a4c9538d7498bd9279f7cceb856dad5a796f9482afe
-generated: "2025-12-17T16:29:27.289826874Z"
+generated: "2025-12-17T16:43:40.840740448Z"

clusters/cl01tl/helm/lidarr/Chart.lock

@@ -5,5 +5,8 @@ dependencies:
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.1.3
-digest: sha256:66944bedb53a1cf3aff6cb8e1218f23cd9ccf3cca9489064f0eee46c66f59ac4
-generated: "2025-12-17T16:10:52.803256851Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:b12b64a6fac9ef6c2743b404547e40451bb47d04c13b509f8a07179aaad6071d
+generated: "2025-12-17T10:41:06.633712-06:00"

clusters/cl01tl/helm/lidarr/Chart.yaml

@@ -26,5 +26,9 @@ dependencies:
     alias: postgres-18-cluster
     version: 7.1.3
     repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/lidarr.png
 appVersion: 3.1.0

clusters/cl01tl/helm/lidarr/templates/external-secret.yaml

@@ -1,62 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
-metadata:
-  name: lidarr-config-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: lidarr-config-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/lidarr2/lidarr2-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
 metadata:
   name: lidarr-postgresql-18-cluster-backup-secret
   namespace: {{ .Release.Namespace }}

clusters/cl01tl/helm/lidarr/templates/replication-source.yaml

@@ -1,28 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: lidarr-config-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: lidarr-config-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: lidarr-config
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: lidarr-config-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      runAsUser: 1000
-      runAsGroup: 1000
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot

clusters/cl01tl/helm/lidarr/values.yaml

@@ -144,3 +144,10 @@ postgres-18-cluster:
       #   immediate: true
       #   schedule: "0 0 4 * * SAT"
       #   backupName: garage-remote
+volsync-target-config:
+  pvcTarget: lidarr-config
+  moverSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch

clusters/cl01tl/helm/lidatube/Chart.lock

@@ -2,5 +2,8 @@ dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.5.0
-digest: sha256:486139f48e88e912593a7ee18973bc4872a6ddc4881fcfa933558f5a7749503b
-generated: "2025-12-05T17:08:12.627557611Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:8dc18a31138c2e4eb4f6499058aaec0437ecd76ba4f0c5db4ec1ef46e90f9628
+generated: "2025-12-17T10:07:48.72533-06:00"

clusters/cl01tl/helm/lidatube/Chart.yaml

@@ -18,5 +18,9 @@ dependencies:
     alias: lidatube
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/lidatube.png
 appVersion: 0.2.42

clusters/cl01tl/helm/lidatube/values.yaml

@@ -64,3 +64,10 @@ lidatube:
           main:
             - path: /lidatube/downloads
               readOnly: false
+volsync-target-config:
+  pvcTarget: lidatube-config
+  moverSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch

clusters/cl01tl/helm/listenarr/Chart.lock

@@ -2,5 +2,8 @@ dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.5.0
-digest: sha256:1f215356d77b524ae23c0bb178d48fd2d602d9224dd7459658628903ff5b6e4c
-generated: "2025-12-05T17:08:24.614701742Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:bb2dd513e76b8f2597967ea48a9c7df7018ed5d40a5f8dabc3402e15cdb4c74a
+generated: "2025-12-17T10:10:10.316764-06:00"

clusters/cl01tl/helm/listenarr/Chart.yaml

@@ -17,4 +17,8 @@ dependencies:
     alias: listenarr
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 appVersion: 0.2.35

clusters/cl01tl/helm/listenarr/values.yaml

@@ -28,6 +28,7 @@ listenarr:
           protocol: HTTP
   persistence:
     config:
+      forceRename: listenarr
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 5Gi
@@ -44,3 +45,10 @@ listenarr:
           main:
             - path: /data
               readOnly: false
+volsync-target-config:
+  pvcTarget: listenarr
+  moverSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch

clusters/cl01tl/helm/matrix-synapse/Chart.lock

@@ -26,5 +26,17 @@ dependencies:
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.5.0
-digest: sha256:c08d2fd5436ca9f0d1b159d6d424ab42d171a967ca97178b2f8dd60de83f9cc9
-generated: "2025-12-15T15:56:54.377467-06:00"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:d7487cc29147c4cc2719ffca559a77a3c9c50abf5087ba34f9557eb36a9302fc
+generated: "2025-12-17T10:23:12.737976-06:00"

clusters/cl01tl/helm/matrix-synapse/Chart.yaml

@@ -63,5 +63,21 @@ dependencies:
     alias: redis-replication-hookshot
     version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-synapse
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-hookshot
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-discord
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-whatsapp
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/matrix.png
 appVersion: 1.144.0

clusters/cl01tl/helm/matrix-synapse/templates/external-secret.yaml

@@ -245,175 +245,6 @@ spec:
         metadataPolicy: None
         property: token
 
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/matrix-synapse/matrix-synapse"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: mautrix-discord-data-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/matrix-synapse/mautrix-discord-data"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: mautrix-whatsapp-data-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/matrix-synapse/mautrix-whatsapp-data"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret

clusters/cl01tl/helm/matrix-synapse/templates/replication-source.yaml

@@ -1,85 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: matrix-synapse-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: matrix-synapse
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: matrix-synapse-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-
----
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: mautrix-discord-data-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: mautrix-discord-data-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: mautrix-discord
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: mautrix-discord-data-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      runAsUser: 1337
-      runAsGroup: 1337
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-
----
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: mautrix-whatsapp-data-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: mautrix-whatsapp-data-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: mautrix-whatsapp
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: mautrix-whatsapp-data-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      runAsUser: 1337
-      runAsGroup: 1337
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot

clusters/cl01tl/helm/matrix-synapse/values.yaml

@@ -204,6 +204,7 @@ matrix-hookshot:
               mountPropagation: None
               subPath: passkey.pem
     data:
+      forceRename: matrix-hookshot
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 500Mi
@@ -285,6 +286,7 @@ mautrix-discord:
               mountPropagation: None
               subPath: mautrix-discord-registration.yaml
     data:
+      forceRename: mautrix-discord
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 500Mi
@@ -369,6 +371,7 @@ mautrix-whatsapp:
               mountPropagation: None
               subPath: mautrix-whatsapp-registration.yaml
     data:
+      forceRename: mautrix-whatsapp
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 500Mi
@@ -473,3 +476,17 @@ redis-replication-hookshot:
   redisSentinel:
     enabled: true
     clusterSize: 3
+volsync-target-synapse:
+  pvcTarget: matrix-synapse
+volsync-target-hookshot:
+  pvcTarget: matrix-hookshot
+volsync-target-discord:
+  pvcTarget: mautrix-discord
+  moverSecurityContext:
+    runAsUser: 1337
+    runAsGroup: 1337
+volsync-target-whatsapp:
+  pvcTarget: mautrix-whatsapp
+  moverSecurityContext:
+    runAsUser: 1337
+    runAsGroup: 1337

clusters/cl01tl/helm/n8n/Chart.lock

@@ -8,5 +8,8 @@ dependencies:
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.5.0
-digest: sha256:4f3ed81241b432b988d6b6277192d360f98a5258ad34c88ac0645505d0acc0a5
-generated: "2025-12-17T16:11:02.717745162Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:d5f9a1471b38c11f4ca44bd764243309b5be739a3bb1605ee229e1f456d19643
+generated: "2025-12-17T10:42:04.895167-06:00"

clusters/cl01tl/helm/n8n/Chart.yaml

@@ -26,5 +26,9 @@ dependencies:
   - name: redis-replication
     version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-data
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/n8n.png
 appVersion: 2.0.1

clusters/cl01tl/helm/n8n/values.yaml

@@ -375,3 +375,5 @@ redis-replication:
   redisSentinel:
     enabled: true
     clusterSize: 3
+volsync-target-data:
+  pvcTarget: n8n

clusters/cl01tl/helm/stack/templates/application.yaml

@@ -9,6 +9,8 @@ metadata:
     app.kubernetes.io/part-of: argocd
   finalizers:
     - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/compare-options: ServerSideDiff=false
 spec:
   project: default
   source: