Merge pull request 'chore(deps): update ghcr.io/stuffanthings/qbit_manage docker tag to v4.7.1' (#7103) from renovate/unified-qbit_manage into main

Reviewed-on: #7094

.gitea/workflows/lint-test-helm.yaml

@@ -343,6 +343,7 @@ jobs:
 
             helm dependency build "${CHART_PATH}" --skip-refresh
 
+            set -o pipefail
             if ! helm template "${DIR}" "${CHART_PATH}" --include-crds --namespace default --api-versions "gateway.networking.k8s.io/v1/HTTPRoute,monitoring.coreos.com/v1,monitoring.coreos.com/v1/ServiceMonitor" | \
               kubeconform \
                 ${SCHEMA_LOCATIONS} \

.gitea/workflows/render-manifests.yaml

@@ -250,6 +250,8 @@ jobs:
 
           echo ">> Rendering Manifests ..."
 
+          EXIT_CODE=0
+
           render_chart() {
             local DIR="$1"
             local CHART_PATH="${MAIN_DIR}/clusters/${CLUSTER}/helm/${DIR}"
@@ -283,10 +285,17 @@ jobs:
 
               echo ">> Formating rendered template ..."
               local TEMPLATE
-              TEMPLATE=$(helm template "${CHART_NAME}" ./ --namespace "${NAMESPACE}" --include-crds --dry-run=server --api-versions "gateway.networking.k8s.io/v1/HTTPRoute,monitoring.coreos.com/v1,monitoring.coreos.com/v1/ServiceMonitor")
+              if ! TEMPLATE=$(helm template "${CHART_NAME}" ./ --namespace "${NAMESPACE}" --include-crds --dry-run=server --api-versions "gateway.networking.k8s.io/v1/HTTPRoute,monitoring.coreos.com/v1,monitoring.coreos.com/v1/ServiceMonitor"); then
+                echo "${DIR}" > "${MAIN_DIR}/.failed_chart_${DIR}"
+                return 1
+              fi
 
               # Format and split rendered template
-              echo "${TEMPLATE}" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"${OUTPUT_FOLDER}"'" + .kind + "-" + .metadata.name + ".yaml"'
+              set -o pipefail
+              if ! echo "${TEMPLATE}" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"${OUTPUT_FOLDER}"'" + .kind + "-" + .metadata.name + ".yaml"'; then
+                echo "${DIR}" > "${MAIN_DIR}/.failed_chart_${DIR}"
+                return 1
+              fi
 
               # Strip comments again to ensure formatting correctness
               for file in "$OUTPUT_FOLDER"/*; do
@@ -316,9 +325,16 @@ jobs:
 
           done | xargs -P 5 -I {} bash -c 'OUT=$(render_chart "$@" 2>&1); printf "%s\n" "$OUT"' _ {}
 
+          if ls .failed_chart_* 1> /dev/null 2>&1; then
+            EXIT_CODE=1
+            rm -f .failed_chart_*
+          fi
+
           echo ""
           echo "----"
 
+          exit $EXIT_CODE
+
       - name: Check for Changes
         id: check-changes
         if: steps.check-dir-changes.outputs.changes-detected == 'true'

.gitea/workflows/renovate.yaml

@@ -13,7 +13,7 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-js
-    container: ghcr.io/renovatebot/renovate:43.182.1@sha256:64690503f0e4935e6e667b323bdcdc1996a2ad59b9bfa44d7ce6319758bc6ff8
+    container: ghcr.io/renovatebot/renovate:43.183.1@sha256:37b433003c58cfca0333e164b2d2a79ff516cb0113f4375a46e7e01c013df83c
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

clusters/cl01tl/helm/authentik/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 2026.2.3
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.3.0
+  version: 3.3.1
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.12.1
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:cb3b3745cbfc4ef138a43fb617e27022a220acee177a30ca02e4f78509ca5c3f
+digest: sha256:933af8420b616894dc3b487b1bf85c120e5d4f40b7253aa8ed42922a50ac884c
-generated: "2026-05-14T14:04:28.583181759Z"
+generated: "2026-05-18T02:02:27.698107839Z"

clusters/cl01tl/helm/authentik/Chart.yaml

@@ -22,7 +22,7 @@ dependencies:
     repository: https://charts.goauthentik.io/
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 3.3.0
+    version: 3.3.1
   - name: postgres-cluster
     alias: postgres-18-cluster
     version: 7.12.1

clusters/cl01tl/helm/cloudnative-pg/Chart.lock

@@ -7,9 +7,9 @@ dependencies:
   version: 0.6.0
 - name: rclone-bucket
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.11.3
+  version: 0.11.4
 - name: rclone-bucket
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.11.3
+  version: 0.11.4
-digest: sha256:a08719a82de76d62cddfec163dbc9feecfbea83ab406f3750d25d4deaf586f0c
+digest: sha256:35ff1bb60552f176dab2055a17c0e8880cc6b6c7bfa6c64415a1eec421f8723f
-generated: "2026-05-13T00:10:14.309341878Z"
+generated: "2026-05-18T02:14:30.999705779Z"

clusters/cl01tl/helm/cloudnative-pg/Chart.yaml

@@ -26,11 +26,11 @@ dependencies:
   - name: rclone-bucket
     alias: rclone-postgres-backups-remote
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.11.3
+    version: 0.11.4
   - name: rclone-bucket
     alias: rclone-postgres-backups-external
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.11.3
+    version: 0.11.4
 icon: https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg.github.io/refs/heads/main/assets/images/hero_image.png
 # renovate: datasource=github-releases depName=cloudnative-pg/cloudnative-pg
 appVersion: 1.29.1

clusters/cl01tl/helm/directus/Chart.lock

@@ -10,9 +10,9 @@ dependencies:
   version: 0.8.0
 - name: rclone-bucket
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.11.3
+  version: 0.11.4
 - name: rclone-bucket
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.11.3
+  version: 0.11.4
-digest: sha256:80a6b37486f2ac7f189cf41b08e731f8a34df37e1af916c3eb49a5dc68939df0
+digest: sha256:afb31ecd23bb5ac9fc06df07d94341b029c6b0148f801dad91e13f63481c6b37
-generated: "2026-05-15T00:29:39.148310428Z"
+generated: "2026-05-18T02:14:47.055499121Z"

clusters/cl01tl/helm/directus/Chart.yaml

@@ -31,11 +31,11 @@ dependencies:
   - name: rclone-bucket
     alias: rclone-directus-assets-remote
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.11.3
+    version: 0.11.4
   - name: rclone-bucket
     alias: rclone-directus-assets-external
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.11.3
+    version: 0.11.4
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/directus.png
 # renovate: datasource=github-releases depName=directus/directus
 appVersion: 11.17.4

clusters/cl01tl/helm/element-web/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 1.4.36
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.3.0
+  version: 3.3.1
-digest: sha256:ede4fbfd1808fcb8e6e8394ceb469603ada10d789b551e3b9885825244ee33d9
+digest: sha256:37a41dfedd352f4122d78d17f4f3b7a703055553c45983bca0aa377cdd599fa2
-generated: "2026-05-14T14:04:44.871143485Z"
+generated: "2026-05-18T02:02:39.83645496Z"

clusters/cl01tl/helm/element-web/Chart.yaml

@@ -19,7 +19,7 @@ dependencies:
     repository: https://ananace.gitlab.io/charts
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 3.3.0
+    version: 3.3.1
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/element.png
 # renovate: datasource=github-releases depName=element-hq/element-web
 appVersion: v1.12.18

clusters/cl01tl/helm/foldergram/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 5.0.1
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.3.0
+  version: 3.3.1
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.0.0
-digest: sha256:1d30d0c1899bb32faa2c6ab3f5039682c596432f6b41d153191f211c745f637d
+digest: sha256:5637258c6907d062d327578a8b4f6a97112446f2f1ef2f1085e9317baba49310
-generated: "2026-05-15T00:30:27.088686555Z"
+generated: "2026-05-18T02:02:50.886833918Z"

clusters/cl01tl/helm/foldergram/Chart.yaml

@@ -21,7 +21,7 @@ dependencies:
     version: 5.0.1
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 3.3.0
+    version: 3.3.1
   - name: volsync-target
     alias: volsync-target-db
     version: 2.0.0

clusters/cl01tl/helm/freshrss/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 5.0.1
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.3.0
+  version: 3.3.1
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.12.1
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.0.0
-digest: sha256:76585c8fec2e77f3ee5e9eecfcf2bd9c058cada91aed57afd977e00d3ce64a3c
+digest: sha256:1da8f9bc0b2ea4764559c0ddf48faca6c505ec6582a6f9ec9445989285a6139c
-generated: "2026-05-15T00:30:43.314740702Z"
+generated: "2026-05-18T02:03:01.478918052Z"

clusters/cl01tl/helm/freshrss/Chart.yaml

@@ -22,7 +22,7 @@ dependencies:
     version: 5.0.1
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 3.3.0
+    version: 3.3.1
   - name: postgres-cluster
     alias: postgres-18-cluster
     version: 7.12.1

clusters/cl01tl/helm/gitea/Chart.lock

@@ -10,10 +10,10 @@ dependencies:
   version: 0.32.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.3.0
+  version: 3.3.1
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.13.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
@@ -23,5 +23,5 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.0.0
-digest: sha256:0ed2df9ddb849bf5b0734e346e8a0e2f96c50fdf3409266ec075db051de4881d
+digest: sha256:e8cc040e977de44dbeee0246221553ed4958d5e0b2ca95759fc724ca315d138b
-generated: "2026-05-17T18:11:08.598465161Z"
+generated: "2026-05-17T22:17:22.170622-05:00"

clusters/cl01tl/helm/gitea/Chart.yaml

@@ -37,10 +37,10 @@ dependencies:
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 3.3.0
+    version: 3.3.1
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.13.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-gitea

clusters/cl01tl/helm/gitea/values.yaml

@@ -255,7 +255,11 @@ postgres-18-cluster:
   cluster:
     resources:
       requests:
+        memory: 2Gi
         cpu: 100m
+    postgresql:
+      parameters:
+        shared_buffers: 2GB
   recovery:
     method: objectStore
     objectStore:

clusters/cl01tl/helm/karakeep/Chart.lock

@@ -7,15 +7,15 @@ dependencies:
   version: 0.32.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.3.0
+  version: 3.3.1
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.0.0
 - name: rclone-bucket
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.11.3
+  version: 0.11.4
 - name: rclone-bucket
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.11.3
+  version: 0.11.4
-digest: sha256:5c8f8a7df54e88d548ec74716346114b9b1b451fa218cef155e8944ee03749f0
+digest: sha256:3610dac0450402003fb81ee6b21167526b97ae90f4cb060649ed555d0003cb45
-generated: "2026-05-15T00:32:42.867507912Z"
+generated: "2026-05-18T02:15:00.671974648Z"

clusters/cl01tl/helm/karakeep/Chart.yaml

@@ -28,7 +28,7 @@ dependencies:
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 3.3.0
+    version: 3.3.1
   - name: volsync-target
     alias: volsync-target-data
     version: 2.0.0
@@ -36,11 +36,11 @@ dependencies:
   - name: rclone-bucket
     alias: rclone-karakeep-assets-remote
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.11.3
+    version: 0.11.4
   - name: rclone-bucket
     alias: rclone-karakeep-assets-external
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.11.3
+    version: 0.11.4
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/karakeep.png
 # renovate: datasource=github-releases depName=karakeep-app/karakeep
 appVersion: 0.32.0

clusters/cl01tl/helm/matrix-synapse/Chart.lock

@@ -13,10 +13,10 @@ dependencies:
   version: 5.0.1
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.3.0
+  version: 3.3.1
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.3.0
+  version: 3.3.1
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.12.1
@@ -38,5 +38,5 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.0.0
-digest: sha256:e163e6e890b0b801d7a5080760e6e4ee3d861243897c40b9d394eeb52271c992
+digest: sha256:d270353475212f4a77fd33366933a5821d975da0931e617c7c6a9d43fe1df102
-generated: "2026-05-15T00:34:39.182329589Z"
+generated: "2026-05-18T02:03:44.662699305Z"

clusters/cl01tl/helm/matrix-synapse/Chart.yaml

@@ -42,11 +42,11 @@ dependencies:
     version: 5.0.1
   - name: cloudflared
     alias: cloudflared-synapse
-    version: 3.3.0
+    version: 3.3.1
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: cloudflared
     alias: cloudflared-hookshot
-    version: 3.3.0
+    version: 3.3.1
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: postgres-cluster
     alias: postgres-18-cluster

clusters/cl01tl/helm/ntfy/Chart.lock

@@ -7,6 +7,6 @@ dependencies:
   version: 7.12.1
 - name: rclone-bucket
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.11.3
+  version: 0.11.4
-digest: sha256:04c797f44a1d1ecc471ff3c16ce64fa9849b4c92ce412fdb23ad010ae2a0650a
+digest: sha256:8e1f6f68cc0c93adfdfbf21f43fa01ec7650184b0b367f9d95b91aba5f750725
-generated: "2026-05-15T00:35:28.412982026Z"
+generated: "2026-05-18T02:15:16.408797803Z"

clusters/cl01tl/helm/ntfy/Chart.yaml

@@ -25,7 +25,7 @@ dependencies:
   - name: rclone-bucket
     alias: rclone-ntfy-attachments-remote
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.11.3
+    version: 0.11.4
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ntfy.png
 # renovate: datasource=github-releases depName=binwiederhier/ntfy
 appVersion: 2.22.0

clusters/cl01tl/helm/openbao/Chart.lock

@@ -7,9 +7,9 @@ dependencies:
   version: 5.0.1
 - name: rclone-bucket
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.11.3
+  version: 0.11.4
 - name: rclone-bucket
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.11.3
+  version: 0.11.4
-digest: sha256:5b4009e2a16eed583be361bc160327986552498f29800ffe6f5aaa9f994fde4d
+digest: sha256:bd0ab8f854917701e69215e81bc77899d0365908998d658aba02de4afaffd889
-generated: "2026-05-15T00:36:00.495035101Z"
+generated: "2026-05-18T02:15:31.062887311Z"

clusters/cl01tl/helm/openbao/Chart.yaml

@@ -29,11 +29,11 @@ dependencies:
   - name: rclone-bucket
     alias: rclone-openbao-backups-remote
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.11.3
+    version: 0.11.4
   - name: rclone-bucket
     alias: rclone-openbao-backups-external
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.11.3
+    version: 0.11.4
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/openbao.png
 # renovate: datasource=github-releases depName=openbao/openbao
 appVersion: v2.5.3

clusters/cl01tl/helm/outline/Chart.lock

@@ -4,7 +4,7 @@ dependencies:
   version: 5.0.1
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.3.0
+  version: 3.3.1
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.12.1
@@ -14,5 +14,5 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.0.0
-digest: sha256:280313acd89b86f56c6216dccad63d222b54effc4d45e4c9d178b0dc66b6d103
+digest: sha256:93d9ceee21e04be572903be7df9614da36b79fadf51dd366651b99d1ca5621e0
-generated: "2026-05-15T00:36:13.502589844Z"
+generated: "2026-05-18T02:03:58.574045514Z"

clusters/cl01tl/helm/outline/Chart.yaml

@@ -23,7 +23,7 @@ dependencies:
     version: 5.0.1
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 3.3.0
+    version: 3.3.1
   - name: postgres-cluster
     alias: postgres-18-cluster
     version: 7.12.1

clusters/cl01tl/helm/plex/values.yaml

@@ -22,7 +22,7 @@ plex:
         main:
           image:
             repository: ghcr.io/linuxserver/plex
-            tag: 1.43.1.10611-1e34174b1-ls305@sha256:8d937dd32659bb1defa02d713a3b1cc99919f12aa17a072d588e770a6f1d7d26
+            tag: 1.43.1.10611-1e34174b1-ls306@sha256:11e99f0bc8844470733a351cf2b4e454f7bfa37c7f38b43846d465906fea360b
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/postiz/Chart.lock

@@ -7,7 +7,7 @@ dependencies:
   version: 1.2.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.3.0
+  version: 3.3.1
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.12.1
@@ -20,5 +20,5 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.0.0
-digest: sha256:ededf5084bb931828d75824153f923d4b0868f8774e921b0132702153687d54a
+digest: sha256:b62c8872275a149537052cb4966d48fa32d133743e0312fd676851196a15dddb
-generated: "2026-05-15T00:36:54.47715173Z"
+generated: "2026-05-18T02:04:11.454668454Z"

clusters/cl01tl/helm/postiz/Chart.yaml

@@ -32,7 +32,7 @@ dependencies:
     version: 1.2.0
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 3.3.0
+    version: 3.3.1
   - name: postgres-cluster
     alias: postgres-18-cluster
     version: 7.12.1

clusters/cl01tl/helm/qbittorrent/values.yaml

@@ -32,6 +32,62 @@ qbittorrent:
             - |
               sysctl -w net.ipv4.ip_forward=1;
               sysctl -w net.ipv6.conf.all.disable_ipv6=1
+        gluetun:
+          restartPolicy: Always
+          image:
+            repository: ghcr.io/qdm12/gluetun
+            tag: latest@sha256:725d3e51091dde4ca43e3e3f26e2e6d3d0ccc66821e92d505c3da04958f7d472
+          lifecycle:
+            postStart:
+              exec:
+                command: ["/bin/sh", "-c", "(ip rule del table 51820; ip -6 rule del table 51820) || true"]
+          env:
+            - name: VPN_SERVICE_PROVIDER
+              value: protonvpn
+            - name: VPN_TYPE
+              value: wireguard
+            - name: WIREGUARD_PRIVATE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: protonvpn-wireguard-conf
+                  key: private-key
+            - name: FIREWALL_OUTBOUND_SUBNETS
+              value: 127.0.0.0/8,192.168.1.0/24,10.244.0.0/16,10.96.0.0/12
+            - name: FIREWALL_INPUT_PORTS
+              value: 8080,9022
+            - name: VPN_PORT_FORWARDING
+              value: "on"
+            - name: VPN_PORT_FORWARDING_UP_COMMAND
+              value: '/bin/sh -c "/gluetun/update.sh {{ printf "{{PORT}}" }}"'
+            - name: PORT_FORWARD_ONLY
+              value: "on"
+            - name: BLOCK_MALICIOUS
+              value: "off"
+          securityContext:
+            privileged: True
+            capabilities:
+              add:
+                - NET_ADMIN
+                - SYS_MODULE
+          probes:
+            readiness:
+              enabled: true
+              custom: true
+              spec:
+                exec:
+                  command:
+                    - /gluetun-entrypoint
+                    - healthcheck
+                failureThreshold: 5
+                initialDelaySeconds: 30
+                periodSeconds: 30
+                successThreshold: 1
+                timeoutSeconds: 15
+          resources:
+            limits:
+              devic.es/tun: "1"
+            requests:
+              devic.es/tun: "1"
       containers:
         qbittorrent:
           image:
@@ -52,65 +108,6 @@ qbittorrent:
             requests:
               cpu: 500m
               memory: 1Gi
-        gluetun:
-          image:
-            repository: ghcr.io/qdm12/gluetun
-            tag: latest@sha256:725d3e51091dde4ca43e3e3f26e2e6d3d0ccc66821e92d505c3da04958f7d472
-          lifecycle:
-            postStart:
-              exec:
-                command: ["/bin/sh", "-c", "(ip rule del table 51820; ip -6 rule del table 51820) || true"]
-          env:
-            - name: VPN_SERVICE_PROVIDER
-              value: protonvpn
-            - name: VPN_TYPE
-              value: wireguard
-            - name: WIREGUARD_PRIVATE_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: protonvpn-wireguard-conf
-                  key: private-key
-            - name: FIREWALL_OUTBOUND_SUBNETS
-              value: 192.168.1.0/24,10.244.0.0/16,10.96.0.0/16
-            - name: FIREWALL_INPUT_PORTS
-              value: 8080,9022
-            - name: VPN_PORT_FORWARDING
-              value: "on"
-            - name: VPN_PORT_FORWARDING_UP_COMMAND
-              value: '/bin/sh -c "/gluetun/update.sh {{ printf "{{PORTS}}" }}"'
-            - name: DNS_UPSTREAM_RESOLVER_TYPE
-              value: dot
-            - name: BLOCK_MALICIOUS
-              value: "off"
-            - name: HTTPPROXY
-              value: "off"
-            - name: SHADOWSOCKS
-              value: "off"
-          securityContext:
-            privileged: True
-            capabilities:
-              add:
-                - NET_ADMIN
-                - SYS_MODULE
-          probes:
-            liveness:
-              enabled: true
-              custom: true
-              spec:
-                exec:
-                  command:
-                    - /gluetun-entrypoint
-                    - healthcheck
-                failureThreshold: 5
-                initialDelaySeconds: 30
-                periodSeconds: 30
-                successThreshold: 1
-                timeoutSeconds: 15
-          resources:
-            limits:
-              devic.es/tun: "1"
-            requests:
-              devic.es/tun: "1"
         exporter:
           image:
             repository: esanchezm/prometheus-qbittorrent-exporter
@@ -146,7 +143,7 @@ qbittorrent:
         qbit-manage:
           image:
             repository: ghcr.io/stuffanthings/qbit_manage
-            tag: v4.7.0@sha256:8786f2efc6fb8e26281f09bf6c5d0004e2d2420fd4781af0aed123ae01558e21
+            tag: v4.7.1@sha256:56e1eeec5582e202e82479b42b588e3807ececca25716f91c7a29f5c597c55d0
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/rclone/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: rclone-bucket
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.11.3
+  version: 0.11.4
 - name: rclone-bucket
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.11.3
+  version: 0.11.4
-digest: sha256:441a247b3b3b6b489eb42ddb5c8ddef0e865018e7a5b78fb8c95b54aedc7a003
+digest: sha256:969c9e9adfb8fb63b048fceaf70c8bf4d83c5d6a05d0e03ee569eaeec6c32609
-generated: "2026-05-09T02:56:20.465925553Z"
+generated: "2026-05-18T02:15:47.654776785Z"

clusters/cl01tl/helm/rclone/Chart.yaml

@@ -16,11 +16,11 @@ dependencies:
   - name: rclone-bucket
     alias: rclone-web-assets-local
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.11.3
+    version: 0.11.4
   - name: rclone-bucket
     alias: rclone-web-assets-remote
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.11.3
+    version: 0.11.4
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/rclone.png
 # renovate: datasource=github-releases depName=rclone/rclone
 appVersion: v1.74.1

clusters/cl01tl/helm/rybbit/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 5.0.1
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.3.0
+  version: 3.3.1
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.12.1
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.0.0
-digest: sha256:5159d866fc3dcf98b1f7e3e8c4897649fc144d09f5a03d679ef7c58e26255f49
+digest: sha256:b705f2335e3cc9ecc1d6551b45884cac408f330e7c56a15f878b71aa67b07c13
-generated: "2026-05-15T00:38:19.300788708Z"
+generated: "2026-05-18T02:04:24.774935643Z"

clusters/cl01tl/helm/rybbit/Chart.yaml

@@ -24,7 +24,7 @@ dependencies:
     version: 5.0.1
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 3.3.0
+    version: 3.3.1
   - name: postgres-cluster
     alias: postgres-18-cluster
     version: 7.12.1

clusters/cl01tl/helm/site-documentation/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 5.0.1
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.3.0
+  version: 3.3.1
-digest: sha256:e0f9d9df5b696b96cfaffe9b8b745383cec94568f54f01ccd4686fb214343045
+digest: sha256:ad0d2ba9c2a3425dcaa70eaf44ada90bbd9a14f3c07cb60e7dadbcb041d9d803
-generated: "2026-05-15T00:39:16.583350208Z"
+generated: "2026-05-18T02:04:36.312492543Z"

clusters/cl01tl/helm/site-documentation/Chart.yaml

@@ -21,7 +21,7 @@ dependencies:
     version: 5.0.1
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 3.3.0
+    version: 3.3.1
 icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.svg
 # renovate: datasource=gitea-releases registryUrl=https://gitea.alexlebens.dev depName=alexlebens/site-documentation
 appVersion: 0.20.0

clusters/cl01tl/helm/site-profile/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 5.0.1
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.3.0
+  version: 3.3.1
-digest: sha256:6cbe4ce4cbe0c9a7f6d018ebafa5dccc76060934c1ae386b2366de245a41b71f
+digest: sha256:1ad8bce2f551471ca18afa9d6aea8da36572de00b0bac54b9df2c278fb27e08e
-generated: "2026-05-15T00:39:29.720604489Z"
+generated: "2026-05-18T02:04:47.177748207Z"

clusters/cl01tl/helm/site-profile/Chart.yaml

@@ -21,7 +21,7 @@ dependencies:
     version: 5.0.1
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 3.3.0
+    version: 3.3.1
 icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.svg
 # renovate: datasource=gitea-releases registryUrl=https://gitea.alexlebens.dev depName=alexlebens/site-profile
 appVersion: 3.16.1

clusters/cl01tl/helm/site-saralebens/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 5.0.1
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.3.0
+  version: 3.3.1
-digest: sha256:8bb9fda1b3e54e32772432fef349e9fd4c6677e365ad44286c9411ad5724133e
+digest: sha256:0a9dbcf4834c9d7e9e63ed55f82f2bc521c2e852dd55fcfaae3f66e7540ef9b7
-generated: "2026-05-15T00:39:44.343644231Z"
+generated: "2026-05-18T02:04:57.965320002Z"

clusters/cl01tl/helm/site-saralebens/Chart.yaml

@@ -21,7 +21,7 @@ dependencies:
     version: 5.0.1
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 3.3.0
+    version: 3.3.1
 icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.svg
 # renovate: datasource=gitea-releases registryUrl=https://gitea.alexlebens.dev depName=alexlebens/site-saralebens
 appVersion: 0.20.0

clusters/cl01tl/helm/slskd/values.yaml

@@ -33,6 +33,56 @@ slskd:
             - |
               sysctl -w net.ipv4.ip_forward=1;
               sysctl -w net.ipv6.conf.all.disable_ipv6=1
+        gluetun:
+          restartPolicy: Always
+          image:
+            repository: ghcr.io/qdm12/gluetun
+            tag: v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab
+          lifecycle:
+            postStart:
+              exec:
+                command: ["/bin/sh", "-c", "(ip rule del table 51820; ip -6 rule del table 51820) || true"]
+          env:
+            - name: VPN_SERVICE_PROVIDER
+              value: protonvpn
+            - name: VPN_TYPE
+              value: wireguard
+            - name: WIREGUARD_PRIVATE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: protonvpn-wireguard-conf
+                  key: private-key
+            - name: FIREWALL_OUTBOUND_SUBNETS
+              value: 127.0.0.0/8,192.168.1.0/24,10.244.0.0/16,10.96.0.0/12
+            - name: FIREWALL_INPUT_PORTS
+              value: 5030
+            - name: BLOCK_MALICIOUS
+              value: "off"
+          securityContext:
+            privileged: true
+            capabilities:
+              add:
+                - NET_ADMIN
+                - SYS_MODULE
+          probes:
+            readiness:
+              enabled: true
+              custom: true
+              spec:
+                exec:
+                  command:
+                    - /gluetun-entrypoint
+                    - healthcheck
+                failureThreshold: 5
+                initialDelaySeconds: 30
+                periodSeconds: 30
+                successThreshold: 1
+                timeoutSeconds: 15
+          resources:
+            limits:
+              devic.es/tun: "1"
+            requests:
+              devic.es/tun: "1"
       containers:
         main:
           image:
@@ -53,61 +103,6 @@ slskd:
             requests:
               cpu: 100m
               memory: 330Mi
-        gluetun:
-          image:
-            repository: ghcr.io/qdm12/gluetun
-            tag: v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab
-          lifecycle:
-            postStart:
-              exec:
-                command: ["/bin/sh", "-c", "(ip rule del table 51820; ip -6 rule del table 51820) || true"]
-          env:
-            - name: VPN_SERVICE_PROVIDER
-              value: protonvpn
-            - name: VPN_TYPE
-              value: wireguard
-            - name: WIREGUARD_PRIVATE_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: protonvpn-wireguard-conf
-                  key: private-key
-            - name: FIREWALL_OUTBOUND_SUBNETS
-              value: 192.168.1.0/24,10.0.0.0/8
-            - name: FIREWALL_INPUT_PORTS
-              value: 5030,50300
-            - name: DNS_UPSTREAM_RESOLVER_TYPE
-              value: dot
-            - name: BLOCK_MALICIOUS
-              value: "off"
-            - name: HTTPPROXY
-              value: "off"
-            - name: SHADOWSOCKS
-              value: "off"
-          securityContext:
-            privileged: true
-            capabilities:
-              add:
-                - NET_ADMIN
-                - SYS_MODULE
-          probes:
-            liveness:
-              enabled: true
-              custom: true
-              spec:
-                exec:
-                  command:
-                    - /gluetun-entrypoint
-                    - healthcheck
-                failureThreshold: 5
-                initialDelaySeconds: 30
-                periodSeconds: 30
-                successThreshold: 1
-                timeoutSeconds: 15
-          resources:
-            limits:
-              devic.es/tun: "1"
-            requests:
-              devic.es/tun: "1"
   service:
     main:
       controller: main

clusters/cl01tl/helm/sparkyfitness/values.yaml

@@ -20,7 +20,7 @@ sparkyfitness:
   server:
     image:
       repository: ghcr.io/codewithcj/sparkyfitness-server
-      tag: v0.16.6.1@sha256:5710eba08e2fcbd1718f74dfcf72273a8d7e7dab3fe49c87bbab23e9d2b08c6f
+      tag: v0.16.6.2@sha256:c9fa57d68dc4bc5fae14075dc59ec2aea67d72710dd6ed289824960d4ecd22ad
     resources:
       requests:
         cpu: 100m
@@ -45,7 +45,7 @@ sparkyfitness:
   frontend:
     image:
       repository: ghcr.io/codewithcj/sparkyfitness-frontend
-      tag: v0.16.6.1@sha256:9a52fc95e96375d86990a036aa8ffebd9de8866c8601e3f2d27a483f8e102166
+      tag: v0.16.6.2@sha256:03c27a5e81d666996043f867c2140fbb35e38e07994592fb527ab86a6c808f48
     resources:
       requests:
         cpu: 10m

clusters/cl01tl/helm/tubearchivist/values.yaml

@@ -9,42 +9,9 @@ tubearchivist:
         securityContext:
           fsGroup: 1000
           fsGroupChangePolicy: OnRootMismatch
-      containers:
+      initContainers:
-        main:
-          image:
-            repository: bbilly1/tubearchivist
-            tag: v0.5.10@sha256:dfe723cf008520e1758ecc3e59e6ea8761dd10d5bb099cd87289e80f5bd66567
-          env:
-            - name: TZ
-              value: America/Chicago
-            - name: HOST_UID
-              value: 1000
-            - name: HOST_GID
-              value: 1000
-            - name: ES_URL
-              value: https://elasticsearch-tubearchivist-es-http.tubearchivist:9200
-            - name: ES_DISABLE_VERIFY_SSL
-              value: true
-            - name: REDIS_CON
-              value: redis://tubearchivist-valkey.tubearchivist:6379
-            - name: TA_HOST
-              value: https://tubearchivist.alexlebens.net http://tubearchivist.tubearchivist:80/
-            - name: TA_PORT
-              value: 24000
-            - name: TA_USERNAME
-              value: admin
-          envFrom:
-            - secretRef:
-                name: tubearchivist-config
-          resources:
-            requests:
-              cpu: 10m
-              memory: 1Gi
-        bgutil:
-          image:
-            repository: brainicism/bgutil-ytdlp-pot-provider
-            tag: 1.3.1@sha256:1aaa43a0ca72dfca6a6d2129a0fb4a23465c25adb1b043f8aff829a20825646b
         gluetun:
+          restartPolicy: Always
           image:
             repository: ghcr.io/qdm12/gluetun
             tag: v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab
@@ -63,23 +30,19 @@ tubearchivist:
                   name: protonvpn-wireguard-conf
                   key: private-key
             - name: FIREWALL_OUTBOUND_SUBNETS
-              value: 192.168.1.0/24,10.0.0.0/8
+              value: 127.0.0.0/8,192.168.1.0/24,10.244.0.0/16,10.96.0.0/12
             - name: FIREWALL_INPUT_PORTS
-              value: 80,8000,24000
+              value: "24000"
-            - name: DNS_UPSTREAM_RESOLVER_TYPE
+            - name: DNS_CACHING
-              value: dot
-            - name: HTTPPROXY
-              value: "off"
-            - name: SHADOWSOCKS
               value: "off"
           securityContext:
-            privileged: True
+            privileged: true
             capabilities:
               add:
                 - NET_ADMIN
                 - SYS_MODULE
           probes:
-            liveness:
+            readiness:
               enabled: true
               custom: true
               spec:
@@ -88,15 +51,65 @@ tubearchivist:
                     - /gluetun-entrypoint
                     - healthcheck
                 failureThreshold: 5
-                initialDelaySeconds: 30
+                initialDelaySeconds: 15
-                periodSeconds: 30
+                periodSeconds: 10
                 successThreshold: 1
-                timeoutSeconds: 15
+                timeoutSeconds: 5
           resources:
             limits:
               devic.es/tun: "1"
             requests:
               devic.es/tun: "1"
+      containers:
+        main:
+          image:
+            repository: bbilly1/tubearchivist
+            tag: v0.5.10@sha256:dfe723cf008520e1758ecc3e59e6ea8761dd10d5bb099cd87289e80f5bd66567
+          env:
+            - name: TZ
+              value: America/Chicago
+            - name: HOST_UID
+              value: 1000
+            - name: HOST_GID
+              value: 1000
+            - name: ES_URL
+              value: https://elasticsearch-tubearchivist-es-http.tubearchivist:9200
+            - name: ES_DISABLE_VERIFY_SSL
+              value: true
+            - name: REDIS_CON
+              value: redis://tubearchivist-valkey.tubearchivist.svc.cluster.local:6379
+            - name: TA_HOST
+              value: https://tubearchivist.alexlebens.net http://tubearchivist.tubearchivist:80/
+            - name: TA_PORT
+              value: 24000
+            - name: TA_USERNAME
+              value: admin
+          envFrom:
+            - secretRef:
+                name: tubearchivist-config
+          probes:
+            liveness:
+              enabled: true
+              custom: true
+              spec:
+                exec:
+                  command:
+                    - curl
+                    - -f
+                    - http://localhost:24000/api/health/
+                failureThreshold: 5
+                initialDelaySeconds: 30
+                periodSeconds: 30
+                successThreshold: 1
+                timeoutSeconds: 15
+          resources:
+            requests:
+              cpu: 10m
+              memory: 1Gi
+        bgutil:
+          image:
+            repository: brainicism/bgutil-ytdlp-pot-provider
+            tag: 1.3.1@sha256:1aaa43a0ca72dfca6a6d2129a0fb4a23465c25adb1b043f8aff829a20825646b
     metrics:
       type: deployment
       replicas: 1

clusters/cl01tl/helm/vaultwarden/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 5.0.1
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.3.0
+  version: 3.3.1
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.12.1
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.0.0
-digest: sha256:5cb40a725b3411ba40d543025286412fd506a3b51015bfba51ddbb5796736d1b
+digest: sha256:ab14d29d19591b4367880c2b142b0dd486ff2dd40dfe83edf74a518c587385cc
-generated: "2026-05-15T00:42:18.855021285Z"
+generated: "2026-05-18T02:05:08.715843644Z"

clusters/cl01tl/helm/vaultwarden/Chart.yaml

@@ -22,7 +22,7 @@ dependencies:
     version: 5.0.1
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 3.3.0
+    version: 3.3.1
   - name: postgres-cluster
     alias: postgres-18-cluster
     version: 7.12.1

clusters/cl01tl/helm/yubal/values.yaml

@@ -14,7 +14,7 @@ yubal:
         main:
           image:
             repository: ghcr.io/guillevc/yubal
-            tag: 0.8.0@sha256:f3872ab590e74472e56c3aaaef497879f77191cd96306eeb8d3576a814c8a147
+            tag: 0.8.1@sha256:406a5cdd02dcb3497d8e99d2b7d361d3a2b283ff273f992e9078d912e3a0c968
           env:
             - name: YUBAL_TZ
               value: America/Chicago