Update roundcube/roundcubemail Docker tag to v1.6.12 (#2589 )

Update Helm release reloader to v2.2.7 (#2587 )
disable volsync
2025-12-16 10:02:12 +00:00 · 2025-12-16 07:02:04 +00:00 · 2025-12-15 23:47:06 -06:00 · 2025-12-15 23:35:36 -06:00 · 2025-12-15 22:48:59 -06:00 · 2025-12-15 22:22:57 -06:00
382 changed files with 4313 additions and 4921 deletions
--- a/.gitea/workflows/lint-test-docker-pull.yaml
+++ b/.gitea/workflows/lint-test-docker-pull.yaml
@@ -1,86 +0,0 @@
 name: lint-test-docker
 on:
  pull_request:
    branches:
      - main
    paths:
      - 'hosts/**'
 jobs:
  docker-lint:
    runs-on: ubuntu-js
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Check Branch Exists
        id: check-branch-exists
        uses: GuillaumeFalourd/branch-exists@v1.1
        with:
          branch: "${{ github.base_ref }}"
      - name: Branch Does Not Exist
        if: steps.check-branch-exists.outputs.exists == 'false'
        run: echo "Branch ${{ github.base_ref }} was not found, likely already merged"
      - name: Set up Node.js
        if: steps.check-branch-exists.outputs.exists == 'true'
        uses: actions/setup-node@v6
        with:
          node-version: '24'
      - name: Lint Docker Compose
        if: steps.check-branch-exists.outputs.exists == 'true'
        run: |
          set -e  # Exit immediately if a command exits with a non-zero status.
          TARGET_BRANCH="origin/${{ github.base_ref }}"
          echo ">> Target branch for diff is: $TARGET_BRANCH"
          CHANGED_FILES=$(git diff --name-only "$TARGET_BRANCH" -- 'hosts/**')
          echo ">> Found changed files:"
          echo "$CHANGED_FILES"
          # For each changed file, find its parent chart directory (the one with compose.yaml).
          # Then, create a unique list of those directories.
          CHANGED_COMPOSE=$(echo "$CHANGED_FILES" | while read -r file; do
            dir=$(dirname "$file")
            while [[ "$dir" != "." && ! -f "$dir/compose.yaml" ]]; do
              dir=$(dirname "$dir")
            done
            if [[ "$dir" != "." ]]; then
              echo "$dir"
            fi
          done | sort -u)
          if [[ -z "$CHANGED_COMPOSE" ]]; then
            echo ">> Could not determine changed compose files. This will happen if only files outside a compose file were changed."
            exit 0
          fi
          echo ">> Running dclint on changed compose files:"
          echo "$CHANGED_COMPOSE"
          echo "$CHANGED_COMPOSE" | while read -r compose; do
            echo ">> Linting $compose ..."
            npx dclint $compose
          done
      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: '${{ secrets.NTFY_URL }}'
          topic: '${{ secrets.NTFY_TOPIC }}'
          title: 'Test Failure - Infrastructure'
          priority: 3
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,failed
          details: 'Docker linting on Pull Request for Infrastructure has failed!'
          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-docker-pull.yaml", "clear": true}]'
          image: true
--- a/.gitea/workflows/lint-test-docker-push.yaml
+++ b/.gitea/workflows/lint-test-docker-push.yaml
@@ -1,74 +0,0 @@
 name: lint-test-docker
 on:
  push:
    branches:
      - main
    paths:
      - 'hosts/**'
 jobs:
  docker-lint:
    runs-on: ubuntu-js
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'
      - name: Lint Docker Compose
        run: |
          set -e  # Exit immediately if a command exits with a non-zero status.
          TARGET_BRANCH="origin/main"
          echo ">> Target branch for diff is: $TARGET_BRANCH"
          CHANGED_FILES=$(git diff --name-only "$TARGET_BRANCH" -- 'hosts/**')
          echo ">> Found changed files:"
          echo "$CHANGED_FILES"
          # For each changed file, find its parent chart directory (the one with compose.yaml).
          # Then, create a unique list of those directories.
          CHANGED_COMPOSE=$(echo "$CHANGED_FILES" | while read -r file; do
            dir=$(dirname "$file")
            while [[ "$dir" != "." && ! -f "$dir/compose.yaml" ]]; do
              dir=$(dirname "$dir")
            done
            if [[ "$dir" != "." ]]; then
              echo "$dir"
            fi
          done | sort -u)
          if [[ -z "$CHANGED_COMPOSE" ]]; then
            echo ">> Could not determine changed compose files. This will happen if only files outside a compose file were changed."
            exit 0
          fi
          echo ">> Running dclint on changed compose files:"
          echo "$CHANGED_COMPOSE"
          echo "$CHANGED_COMPOSE" | while read -r compose; do
            echo ">> Linting $compose ..."
            npx dclint $compose
          done
      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: '${{ secrets.NTFY_URL }}'
          topic: '${{ secrets.NTFY_TOPIC }}'
          title: 'Test Failure - Infrastructure'
          priority: 4
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,failed
          details: 'Docker linting on Push for Infrastructure has failed!'
          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-docker-push.yaml", "clear": true}]'
          image: true
--- a/.gitea/workflows/lint-test-docker.yaml
+++ b/.gitea/workflows/lint-test-docker.yaml
@@ -0,0 +1,141 @@
 name: lint-test-docker
 on:
  pull_request:
    branches:
      - main
    paths:
      - 'hosts/**'
  push:
    branches:
      - main
    paths:
      - 'hosts/**'
 env:
  BASE_BRANCH: "origin/${{ gitea.base_ref }}"
 jobs:
  lint-docker-compose:
    runs-on: ubuntu-js
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Check Branch Exists
        id: check-branch-exists
        if: github.event_name == 'pull_request'
        uses: GuillaumeFalourd/branch-exists@v1.1
        with:
          branch: "${{ github.base_ref }}"
      - name: Report Branch Exists
        id: branch-exists
        if: github.event_name == 'push' || steps.check-branch-exists.outputs.exists == 'true' && github.event_name == 'pull_request'
        run: |
          if [ ${{ github.event_name == 'push' }} ]; then
            echo ">> Action is from a push event, will continue with linting"
          else
            echo ">> Branch ${{ gitea.base_ref }} exists, will continue with linting"
          fi
          echo "----"
          echo "exists=true" >> $GITEA_OUTPUT
      - name: Set up Node.js
        if: steps.branch-exists.outputs.exists == 'true'
        uses: actions/setup-node@v6
        with:
          node-version: '24'
      - name: Check Directories for Changes
        id: check-dir-changes
        if: steps.branch-exists.outputs.exists == 'true'
        run: |
          CHANGED_COMPOSE=()
          echo ">> Target branch for diff is: ${BASE_BRANCH}"
          if [ "${{ github.event_name }}" == "pull_request" ]; then
            echo ""
            echo ">> Checking for changes in a pull request ..."
            GIT_DIFF=$(git diff --name-only "${BASE_BRANCH}" | xargs -I {} dirname {} | sort -u)
          else
            echo ""
            echo ">> Checking for changes from a push ..."
            GIT_DIFF=$(git diff --name-only ${{ gitea.event.before }}..HEAD | xargs -I {} dirname {} | sort -u)
          fi
          if [ -n "${GIT_DIFF}" ]; then
            echo ""
            echo ">> Changes detected:"
            echo "$GIT_DIFF"
            for path in $GIT_DIFF; do
              if echo "$path" | grep -q -E "hosts/[^/]+/[^/]+"; then
                echo ""
                echo ">> Adding path: $path"
                CHANGED_COMPOSE+=$(echo "$path")
                CHANGED_COMPOSE+=$(echo " ")
              fi
            done
          else
            echo ""
            echo ">> No changes detected"
          fi
          if [ -n "${CHANGED_COMPOSE}" ]; then
            echo ""
            echo ">> Compose to Lint:"
            echo "$(echo "${CHANGED_COMPOSE}" | sort -u)"
            echo "----"
            echo "changes-detected=true" >> $GITEA_OUTPUT
            echo "compose-dir<<EOF" >> $GITEA_OUTPUT
            echo "$(echo "${CHANGED_COMPOSE}" | sort -u)" >> $GITEA_OUTPUT
            echo "EOF" >> $GITEA_OUTPUT
          else
            echo ""
            echo ">> Did not find any docker compose files to lint"
            echo "----"
            echo "changes-detected=false" >> $GITEA_OUTPUT
          fi
      - name: Lint Docker Compose
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          CHANGED_COMPOSE: ${{ steps.check-dir-changes.outputs.compose-dir }}
        run: |
          echo ">> Running dclint on changed compose files:"
          echo "$CHANGED_COMPOSE"
          for compose in $CHANGED_COMPOSE; do
            echo ">> Linting $compose ..."
            npx dclint $compose
          done
      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: '${{ secrets.NTFY_URL }}'
          topic: '${{ secrets.NTFY_TOPIC }}'
          title: 'Test Failure - Infrastructure'
          priority: 3
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,failed
          details: 'Docker linting on Pull Request for Infrastructure has failed!'
          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-docker-pull.yaml", "clear": true}]'
          image: true
--- a/.gitea/workflows/lint-test-helm-pull.yaml
+++ b/.gitea/workflows/lint-test-helm-pull.yaml
@@ -1,94 +0,0 @@
 name: lint-test-helm
 on:
  pull_request:
    branches:
      - main
    paths:
      - 'clusters/**'
 jobs:
  helm-lint:
    runs-on: ubuntu-js
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Check Branch Exists
        id: check-branch-exists
        uses: GuillaumeFalourd/branch-exists@v1.1
        with:
          branch: ${{ github.base_ref }}
      - name: Branch Does Not Exist
        if: steps.check-branch-exists.outputs.exists == 'false'
        run: echo "Branch ${{ github.base_ref }} was not found, likely already merged"
      - name: Set up Helm
        if: steps.check-branch-exists.outputs.exists == 'true'
        uses: azure/setup-helm@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}
          version: v3.19.2
      - name: Lint Helm Chart
        if: steps.check-branch-exists.outputs.exists == 'true'
        run: |
          set -e  # Exit immediately if a command exits with a non-zero status.
          TARGET_BRANCH="origin/${{ github.base_ref }}"
          echo ">> Target branch for diff is: $TARGET_BRANCH"
          CHANGED_FILES=$(git diff --name-only "$TARGET_BRANCH" -- 'clusters/**')
          echo ">> Found changed files:"
          echo "$CHANGED_FILES"
          # For each changed file, find its parent chart directory (the one with Chart.yaml).
          # Then, create a unique list of those directories.
          CHANGED_CHARTS=$(echo "$CHANGED_FILES" | while read -r file; do
            dir=$(dirname "$file")
            while [[ "$dir" != "." && ! -f "$dir/Chart.yaml" ]]; do
              dir=$(dirname "$dir")
            done
            if [[ "$dir" != "." ]]; then
              echo "$dir"
            fi
          done | sort -u)
          if [[ -z "$CHANGED_CHARTS" ]]; then
            echo ">> Could not determine changed charts. This could happen if only files outside a chart were changed."
            exit 0
          fi
          echo ">> Running helm lint on changed charts:"
          echo "$CHANGED_CHARTS"
          echo "$CHANGED_CHARTS" | while read -r chart; do
            helm dependency list --max-col-width 120 $chart 2> /dev/null \
              | tail +2 | head -n -1 \
              | awk '{ print "helm repo add " $1 " " $3 }' \
              | while read cmd; do echo "$cmd" | sh; done || true
            echo ">> Building dependency for "$chart" ..."
            helm dependency build "$chart"
            echo ">> Linting $chart..."
            helm lint "$chart"
          done
      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: '${{ secrets.NTFY_URL }}'
          topic: '${{ secrets.NTFY_TOPIC }}'
          title: 'Test Failure - Infrastructure'
          priority: 3
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,failed
          details: 'Helm linting on Pull Request for Infrastructure has failed!'
          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-helm-pull.yaml", "clear": true}]'
          image: true
--- a/.gitea/workflows/lint-test-helm-push.yaml
+++ b/.gitea/workflows/lint-test-helm-push.yaml
@@ -1,80 +0,0 @@
 name: lint-test-helm
 on:
  push:
    branches:
      - main
    paths:
      - 'clusters/**'
 jobs:
  helm-lint:
    runs-on: ubuntu-js
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Set up Helm
        uses: azure/setup-helm@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}
          version: v3.19.2
      - name: Lint Helm Chart
        run: |
          TARGET_BRANCH="origin/main"
          echo ">> Target branch for diff is: $TARGET_BRANCH"
          CHANGED_FILES=$(git diff --name-only "$TARGET_BRANCH" -- 'clusters/**')
          echo ">> Found changed files:"
          echo "$CHANGED_FILES"
          # For each changed file, find its parent chart directory (the one with Chart.yaml).
          # Then, create a unique list of those directories.
          CHANGED_CHARTS=$(echo "$CHANGED_FILES" | while read -r file; do
            dir=$(dirname "$file")
            while [[ "$dir" != "." && ! -f "$dir/Chart.yaml" ]]; do
              dir=$(dirname "$dir")
            done
            if [[ "$dir" != "." ]]; then
              echo "$dir"
            fi
          done | sort -u)
          if [[ -z "$CHANGED_CHARTS" ]]; then
            echo ">> Could not determine changed charts. This could happen if only files outside a chart were changed."
            exit 0
          fi
          echo ">> Running helm lint on changed charts:"
          echo "$CHANGED_CHARTS"
          echo "$CHANGED_CHARTS" | while read -r chart; do
            helm dependency list --max-col-width 120 $chart 2> /dev/null \
              | tail +2 | head -n -1 \
              | awk '{ print "helm repo add " $1 " " $3 }' \
              | while read cmd; do echo "$cmd" | sh; done || true
            echo ">> Building dependency for "$chart" ..."
            helm dependency build "$chart"
            echo ">> Linting $chart..."
            helm lint "$chart"
          done
      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: '${{ secrets.NTFY_URL }}'
          topic: '${{ secrets.NTFY_TOPIC }}'
          title: 'Test Failure - Infrastructure'
          priority: 4
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,failed
          details: 'Helm linting on Push for Infrastructure has failed!'
          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-helm-push.yaml", "clear": true}]'
          image: true
--- a/.gitea/workflows/lint-test-helm.yaml
+++ b/.gitea/workflows/lint-test-helm.yaml
@@ -0,0 +1,187 @@
 name: lint-test-helm
 on:
  pull_request:
    branches:
      - main
    paths:
      - 'clusters/cl01tl/helm/**'
  push:
    branches:
      - main
    paths:
      - 'clusters/cl01tl/helm/**'
 env:
  CLUSTER: cl01tl
  BASE_BRANCH: "origin/${{ gitea.base_ref }}"
 jobs:
  lint-helm:
    runs-on: ubuntu-js
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Check Branch Exists
        id: check-branch-exists
        if: github.event_name == 'pull_request'
        uses: GuillaumeFalourd/branch-exists@v1.1
        with:
          branch: ${{ gitea.base_ref }}
      - name: Report Branch Exists
        id: branch-exists
        if: github.event_name == 'push' || steps.check-branch-exists.outputs.exists == 'true' && github.event_name == 'pull_request'
        run: |
          if [ ${{ github.event_name == 'push' }} ]; then
            echo ">> Action is from a push event, will continue with linting"
          else
            echo ">> Branch ${{ gitea.base_ref }} exists, will continue with linting"
          fi
          echo "----"
          echo "exists=true" >> $GITEA_OUTPUT
      - name: Set up Helm
        if: steps.branch-exists.outputs.exists == 'true'
        uses: azure/setup-helm@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}
          version: v3.19.2
      - name: Check Directories for Changes
        id: check-dir-changes
        if: steps.branch-exists.outputs.exists == 'true'
        run: |
          CHANGED_CHARTS=()
          echo ">> Target branch for diff is: ${BASE_BRANCH}"
          if [ "${{ github.event_name }}" == "pull_request" ]; then
            echo ""
            echo ">> Checking for changes in a pull request ..."
            GIT_DIFF=$(git diff --name-only "${BASE_BRANCH}" | xargs -I {} dirname {} | sort -u)
          else
            echo ""
            echo ">> Checking for changes from a push ..."
            GIT_DIFF=$(git diff --name-only ${{ gitea.event.before }}..HEAD | xargs -I {} dirname {} | sort -u)
          fi
          if [ -n "${GIT_DIFF}" ]; then
            echo ""
            echo ">> Changes detected:"
            echo "$GIT_DIFF"
            for path in $GIT_DIFF; do
              if echo "$path" | grep -q -E "clusters/[^/]+/helm/[^/]+"; then
                echo ""
                echo ">> Adding path: $path"
                CHANGED_CHARTS+=$(echo "$path" | awk -F '/' '{print $4}')
                CHANGED_CHARTS+=$(echo "\n")
              fi
            done
          else
            echo ""
            echo ">> No changes detected"
          fi
          if [ -n "${CHANGED_CHARTS}" ]; then
            echo ""
            echo ">> Chart to Lint:"
            echo "$(echo "${CHANGED_CHARTS}" | sort -u)"
            echo "----"
            echo "changes-detected=true" >> $GITEA_OUTPUT
            echo "chart-dir<<EOF" >> $GITEA_OUTPUT
            echo "$(echo "${CHANGED_CHARTS}" | sort -u)" >> $GITEA_OUTPUT
            echo "EOF" >> $GITEA_OUTPUT
          else
            echo ""
            echo ">> Did not find any helm charts files to lint"
            echo "----"
            echo "changes-detected=false" >> $GITEA_OUTPUT
          fi
      - name: Add Repositories
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          CHANGED_CHARTS: ${{ steps.check-dir-changes.outputs.chart-dir }}
        run: |
          echo ">> Adding repositories for chart dependencies ..."
          for dir in ${CHANGED_CHARTS}; do
            helm dependency list --max-col-width 120 clusters/${CLUSTER}/helm/$dir 2> /dev/null \
              | tail +2 | head -n -1 \
              | awk '{ print "helm repo add " $1 " " $3 }' \
              | while read cmd; do
                if [[ "$cmd" == "*oci://*" ]]; then
                  echo ">> Ignoring OCI repo"
                else
                  echo ">> Command: $cmd"
                  echo "$cmd" | sh;
                fi
              done || true
          done
          if helm repo list | tail +2 | read -r; then
            echo ""
            echo ">> Update repository cache ..."
            helm repo update
          fi
          echo "----"
      - name: Lint Helm Chart
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          CHANGED_CHARTS: ${{ steps.check-dir-changes.outputs.chart-dir }}
        run: |
          echo ">> Running linting on changed charts ..."
          for dir in ${CHANGED_CHARTS}; do
            chart_path=clusters/${CLUSTER}/helm/$dir
            chart_name=$(basename "$chart_path")
            if [ -f "$chart_path/Chart.yaml" ]; then
              cd $chart_path
              echo ""
              echo ">> Building helm dependency ..."
              helm dependency build --skip-refresh
              echo ""
              echo ">> Linting helm ..."
              helm lint --namespace "$chart_name"
            else
              echo ""
              echo ">> Directory $chart_path does not contain a Chart.yaml. Skipping ..."
              echo ""
            fi
          done
      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: '${{ secrets.NTFY_URL }}'
          topic: '${{ secrets.NTFY_TOPIC }}'
          title: 'Test Failure - Infrastructure'
          priority: 3
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,failed
          details: 'Helm linting on Pull Request for Infrastructure has failed!'
          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-helm-pull.yaml", "clear": true}]'
          image: true
--- a/.gitea/workflows/render-manifests-automerge.yaml
+++ b/.gitea/workflows/render-manifests-automerge.yaml
@@ -65,13 +65,14 @@ jobs:
          RENDER_DIR=()
          echo ">> Checking for changes from HEAD^..HEAD ..."
-          GIT_DIFF=$(git diff --name-only HEAD^..HEAD | xargs -I {} dirname {} | sort -u | grep "clusters/cl01tl/helm/")
+          GIT_DIFF=$(git diff --name-only HEAD^..HEAD | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+")
          if [ -n "${GIT_DIFF}" ]; then
            echo ">> Changes detected:"
            echo "$GIT_DIFF"
            for path in $GIT_DIFF; do
              RENDER_DIR+=$(echo "$path" | awk -F '/' '{print $4}')
              RENDER_DIR+=$(echo " ")
            done
          else
@@ -81,13 +82,13 @@ jobs:
          if [ -n "${RENDER_DIR}" ]; then
            echo ">> Directories to Render:"
-            echo "$(printf "%s\n" "${RENDER_DIR[@]}" | sort -u)"
+            echo "$(echo "${RENDER_DIR}" | sort -u)"
            echo "----"
            echo "changes-detected=true" >> $GITEA_OUTPUT
            echo "render-dir<<EOF" >> $GITEA_OUTPUT
-            echo "$(printf "%s\n" "${RENDER_DIR[@]}" | sort -u)" >> $GITEA_OUTPUT
+            echo "$(echo "${RENDER_DIR}" | sort -u)" >> $GITEA_OUTPUT
            echo "EOF" >> $GITEA_OUTPUT
          else
            echo "changes-detected=false" >> $GITEA_OUTPUT
@@ -105,7 +106,13 @@ jobs:
            helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
              | tail +2 | head -n -1 \
              | awk '{ print "helm repo add " $1 " " $3 }' \
-              | while read cmd; do echo "$cmd" | sh; done || true
+              | while read cmd; do
                if [[ "$cmd" == "*oci://*" ]]; then
                  echo ">> Ignoring OCI repo"
                else
                  echo "$cmd" | sh;
                fi
              done || true
          done
          if helm repo list | tail +2 | read -r; then
@@ -147,15 +154,23 @@ jobs:
            chart_path=${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir
            chart_name=$(basename "$chart_path")
            echo ""
            echo ""
            echo ">> Rendering chart: $chart_name"
            echo ">> Chart path $chart_path"
            if [ -f "$chart_path/Chart.yaml" ]; then
              OUTPUT_FOLDER="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/"
              TEMPLATE=""
              mkdir -p ${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name
              OUTPUT_FILE="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/$chart_name.yaml"
              cd $chart_path
              echo ""
              echo ">> Updating helm dependency ..."
              helm dependency update --skip-refresh
              echo ""
              echo ">> Building helm dependency ..."
              helm dependency build --skip-refresh
@@ -166,36 +181,36 @@ jobs:
              echo ""
              echo ">> Rendering templates ..."
              case "$chart_name" in
                "stack")
-                  echo ">> Special Rendering for stack ..."
+                  echo ""
-                  helm template stack ./ --namespace argocd --include-crds > "$OUTPUT_FILE"
+                  echo ">> Special Rendering for stack into argocd namespace ..."
                  TEMPLATE=$(helm template $chart_name ./ --namespace argocd --include-crds --dry-run)
                  ;;
-                "cilium")
+                "cilium" | "coredns" | "metrics-server" |"prometheus-operator-crds")
-                  echo ">> Special Rendering for cilium ..."
+                  echo ""
-                  helm template cilium ./ --namespace kube-system --include-crds > "$OUTPUT_FILE"
+                  echo ">> Special Rendering for $chart_name into kube-system namespace ..."
-                  ;;
+                  TEMPLATE=$(helm template $chart_name ./ --namespace kube-system --include-crds --dry-run)
                "coredns")
                  echo ">> Special Rendering for coredns ..."
                  helm template coredns ./ --namespace kube-system --include-crds > "$OUTPUT_FILE"
                  ;;
                "metrics-server")
                  echo ">> Special Rendering for metrics-server ..."
                  helm template metrics-server ./ --namespace kube-system --include-crds > "$OUTPUT_FILE"
                  ;;
                "prometheus-operator-crds")
                  echo ">> Special Rendering for prometheus-operator-crds ..."
                  helm template prometheus-operator-crds ./ --namespace kube-system --include-crds > "$OUTPUT_FILE"
                  ;;
                *)
                  echo ""
                  echo ">> Standard Rendering for $chart_name ..."
-                  helm template "$chart_name" ./ --namespace "$chart_name" --include-crds > "$OUTPUT_FILE"
+                  TEMPLATE=$(helm template "$chart_name" ./ --namespace "$chart_name" --include-crds --dry-run)
                  ;;
              esac
              echo ""
-              echo ">> Manifests for $chart_name rendered to $OUTPUT_FILE"
+              echo ">> Formating rendered template ..."
              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
              # Strip comments again to ensure formatting correctness
              for file in "$OUTPUT_FOLDER"/*; do
                yq -i '... comments=""' $file
              done
              echo ""
              echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
              ls $OUTPUT_FOLDER
              echo ""
            else
              echo ""
@@ -212,13 +227,16 @@ jobs:
        run: |
          cd ${MANIFEST_DIR}
-          if git status --porcelain | grep -q .; then
+          GIT_CHANGES=$(git status --porcelain)
          if [ -n "$GIT_CHANGES" ]; then
            echo ">> Changes detected"
            git status --porcelain
            echo "changes-detected=true" >> $GITEA_OUTPUT
          else
            echo ">> No changes detected, skipping PR creation"
-            exit 0
+
          fi
          echo "----"
@@ -258,9 +276,9 @@ jobs:
          PAYLOAD=$( jq -n \
            --arg head "${BRANCH_NAME}" \
            --arg base "${BASE_BRANCH}" \
-            --arg title "Automated Manifest Update" \
+            --arg title "Automated Manifest Update - Automerge" \
            --arg body "This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow. This is expected to be automerged." \
-            '{head: $head, base: $base, title: $title, body: $body'} )
+            '{head: $head, base: $base, title: $title, body: $body}' )
          echo ">> Creating PR from branch ${BRANCH_NAME} into ${BASE_BRANCH}"
          echo ">> With Endpoint of:"
@@ -292,10 +310,15 @@ jobs:
          if [ "$HTTP_STATUS" == "201" ]; then
            echo ">> Pull Request created successfully!"
            PR_URL=$(cat response_body.json | jq -r .html_url)
            echo ">> Pull Request URL: $PR_URL"
            echo "pull-request-url=${PR_URL}" >> $GITEA_OUTPUT
-            PR_ID=$(cat response_body.json | jq -r .id)
+
-            echo "pull-request-id=${PR_ID}" >> $GITEA_OUTPUT
+            PR_NUMBER=$(cat response_body.json | jq -r .number)
            echo ">> Pull Request Number: $PR_NUMBER"
            echo "pull-request-number=${PR_NUMBER}" >> $GITEA_OUTPUT
            echo "pull-request-operation=created" >> $GITEA_OUTPUT
          elif [ "$HTTP_STATUS" == "422" ]; then
@@ -318,18 +341,17 @@ jobs:
          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
          GITEA_URL: ${{ secrets.REPO_URL }}
          BRANCH_NAME: ${{ steps.prepare-manifest-branch.outputs.BRANCH_NAME }}
-          PR_ID: ${{ steps.prepare-manifest-branch.outputs.pull-request-id }}
+          PR_NUMBER: ${{ steps.create-pull-request.outputs.pull-request-number }}
        run: |
          cd ${MANIFEST_DIR}
-          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls/${PR_ID}/merge"
+          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls/${PR_NUMBER}/merge"
          PAYLOAD=$( jq -n \
            --arg Do "merge" \
-            --arg delete_branch_after_merge "true" \
+            '{Do: $Do}' )
            '{Do: $Do, delete_branch_after_merge: $delete_branch_after_merge'} )
-          echo ">> Merging PR with ID: ${PR_ID}"
+          echo ">> Merging PR with ID: ${PR_NUMBER}"
          echo ">> With Endpoint of:"
          echo "$API_ENDPOINT"
          echo ">> With Payload of:"
@@ -394,7 +416,6 @@ jobs:
          details: "Automerge Manifest rendering for Infrastructure!"
          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
          actions: '[{"action": "view", "label": "Open Gitea", "url": "${{ steps.create-pull-request.outputs.pull-request-url }}", "clear": true}]'
          image: true
      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
--- a/.gitea/workflows/render-manifests-dispatch.yaml
+++ b/.gitea/workflows/render-manifests-dispatch.yaml
@@ -1,12 +1,6 @@
-name: render-manifests
+name: render-manifests-dispatch
 on:
  push:
    branches:
      - main
    paths:
      - 'clusters/cl01tl/helm/**'
  workflow_dispatch:
 env:
@@ -18,7 +12,7 @@ env:
  MANIFEST_DIR: /workspace/alexlebens/infrastructure/infrastructure-manifests
 jobs:
-  render-manifests:
+  render-manifests-dispatch:
    runs-on: ubuntu-js
    steps:
      - name: Checkout Main
@@ -68,36 +62,18 @@ jobs:
          RENDER_DIR=()
-          if [ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]; then
+          echo ">> Triggered on dispatch, will check all paths ..."
-            echo ">> Triggered on dispatch, will check all paths ..."
+          RENDER_DIR+=$(ls clusters/cl01tl/helm/)
            RENDER_DIR+=$(ls clusters/cl01tl/helm/)
          else
            echo ">> Checking for changes ..."
            GIT_DIFF=$(git diff --name-only ${{ gitea.event.before }}..HEAD | xargs -I {} dirname {} | sort -u | grep "clusters/cl01tl/helm/")
            if [ -n "${GIT_DIFF}" ]; then
              echo ">> Changes detected:"
              echo "$GIT_DIFF"
              for path in $GIT_DIFF; do
                RENDER_DIR+=$(echo "$path" | awk -F '/' '{print $4}')
              done
            else
              echo ">> No changes detected"
            fi
          fi
          if [ -n "${RENDER_DIR}" ]; then
            echo ">> Directories to Render:"
-            echo "$(printf "%s\n" "${RENDER_DIR[@]}" | sort -u)"
+            echo "$(echo "${RENDER_DIR}" | sort -u)"
            echo "----"
            echo "changes-detected=true" >> $GITEA_OUTPUT
            echo "render-dir<<EOF" >> $GITEA_OUTPUT
-            echo "$(printf "%s\n" "${RENDER_DIR[@]}" | sort -u)" >> $GITEA_OUTPUT
+            echo "$(echo "${RENDER_DIR}" | sort -u)" >> $GITEA_OUTPUT
            echo "EOF" >> $GITEA_OUTPUT
          else
            echo "changes-detected=false" >> $GITEA_OUTPUT
@@ -115,7 +91,13 @@ jobs:
            helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
              | tail +2 | head -n -1 \
              | awk '{ print "helm repo add " $1 " " $3 }' \
-              | while read cmd; do echo "$cmd" | sh; done || true
+              | while read cmd; do
                if [[ "$cmd" == "*oci://*" ]]; then
                  echo ">> Ignoring OCI repo"
                else
                  echo "$cmd" | sh;
                fi
              done || true
          done
          if helm repo list | tail +2 | read -r; then
@@ -157,15 +139,23 @@ jobs:
            chart_path=${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir
            chart_name=$(basename "$chart_path")
            echo ""
            echo ""
            echo ">> Rendering chart: $chart_name"
            echo ">> Chart path $chart_path"
            if [ -f "$chart_path/Chart.yaml" ]; then
              OUTPUT_FOLDER="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/"
              TEMPLATE=""
              mkdir -p ${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name
              OUTPUT_FILE="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/$chart_name.yaml"
              cd $chart_path
              echo ""
              echo ">> Updating helm dependency ..."
              helm dependency update --skip-refresh
              echo ""
              echo ">> Building helm dependency ..."
              helm dependency build --skip-refresh
@@ -176,36 +166,36 @@ jobs:
              echo ""
              echo ">> Rendering templates ..."
              case "$chart_name" in
                "stack")
-                  echo ">> Special Rendering for stack ..."
+                  echo ""
-                  helm template stack ./ --namespace argocd --include-crds > "$OUTPUT_FILE"
+                  echo ">> Special Rendering for stack into argocd namespace ..."
                  TEMPLATE=$(helm template $chart_name ./ --namespace argocd --include-crds --dry-run)
                  ;;
-                "cilium")
+                "cilium" | "coredns" | "metrics-server" |"prometheus-operator-crds")
-                  echo ">> Special Rendering for cilium ..."
+                  echo ""
-                  helm template cilium ./ --namespace kube-system --include-crds > "$OUTPUT_FILE"
+                  echo ">> Special Rendering for $chart_name into kube-system namespace ..."
-                  ;;
+                  TEMPLATE=$(helm template $chart_name ./ --namespace kube-system --include-crds --dry-run)
                "coredns")
                  echo ">> Special Rendering for coredns ..."
                  helm template coredns ./ --namespace kube-system --include-crds > "$OUTPUT_FILE"
                  ;;
                "metrics-server")
                  echo ">> Special Rendering for metrics-server ..."
                  helm template metrics-server ./ --namespace kube-system --include-crds > "$OUTPUT_FILE"
                  ;;
                "prometheus-operator-crds")
                  echo ">> Special Rendering for prometheus-operator-crds ..."
                  helm template prometheus-operator-crds ./ --namespace kube-system --include-crds > "$OUTPUT_FILE"
                  ;;
                *)
                  echo ""
                  echo ">> Standard Rendering for $chart_name ..."
-                  helm template "$chart_name" ./ --namespace "$chart_name" --include-crds > "$OUTPUT_FILE"
+                  TEMPLATE=$(helm template "$chart_name" ./ --namespace "$chart_name" --include-crds --dry-run)
                  ;;
              esac
              echo ""
-              echo ">> Manifests for $chart_name rendered to $OUTPUT_FILE"
+              echo ">> Formating rendered template ..."
              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
              # Strip comments again to ensure formatting correctness
              for file in "$OUTPUT_FOLDER"/*; do
                yq -i '... comments=""' $file
              done
              echo ""
              echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
              ls $OUTPUT_FOLDER
              echo ""
            else
              echo ""
@@ -222,13 +212,16 @@ jobs:
        run: |
          cd ${MANIFEST_DIR}
-          if git status --porcelain | grep -q .; then
+          GIT_CHANGES=$(git status --porcelain)
          if [ -n "$GIT_CHANGES" ]; then
            echo ">> Changes detected"
            git status --porcelain
            echo "changes-detected=true" >> $GITEA_OUTPUT
          else
            echo ">> No changes detected, skipping PR creation"
-            exit 0
+
          fi
          echo "----"
@@ -324,7 +317,7 @@ jobs:
            --arg assignee "${ASSIGNEE}" \
            --arg title "Automated Manifest Update" \
            --arg body "This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow." \
-            '{head: $head, base: $base, assignee: $assignee, title: $title, body: $body'} )
+            '{head: $head, base: $base, assignee: $assignee, title: $title, body: $body}' )
          echo ">> Creating PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
          echo ">> With Endpoint of:"
@@ -385,10 +378,9 @@ jobs:
          priority: 3
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,successfully,completed
-          details: "Manifest rendering for Infrastructure has created a new Pull Request!"
+          details: "Manifest rendering for Infrastructure has created a new Pull Request with ID: ${{ steps.create-pull-request.outputs.pull-request-id }}!"
          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
          actions: '[{"action": "view", "label": "Open Gitea", "url": "${{ steps.create-pull-request.outputs.pull-request-url }}", "clear": true}]'
          image: true
      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
--- a/.gitea/workflows/render-manifests-merge.yaml
+++ b/.gitea/workflows/render-manifests-merge.yaml
@@ -0,0 +1,418 @@
 name: render-manifests-merge
 on:
  pull_request:
    branches:
      - main
    paths:
      - 'clusters/cl01tl/helm/**'
    types:
      - closed
 env:
  CLUSTER: cl01tl
  BASE_BRANCH: manifests
  BRANCH_NAME: auto/update-manifests
  ASSIGNEE: alexlebens
  MAIN_DIR: /workspace/alexlebens/infrastructure/infrastructure
  MANIFEST_DIR: /workspace/alexlebens/infrastructure/infrastructure-manifests
 jobs:
  render-manifests-merge:
    runs-on: ubuntu-js
    if: ${{ (github.event.pull_request.merged == true) && !(contains(github.event.pull_request.labels.*.name, 'automerge')) }}
    steps:
      - name: Checkout Main
        uses: actions/checkout@v6
        with:
          path: infrastructure
          fetch-depth: 0
      - name: Checkout Manifests
        uses: actions/checkout@v6
        with:
          ref: manifests
          path: infrastructure-manifests
      - name: Set up Helm
        uses: azure/setup-helm@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}
          version: v3.17.2 # Pending https://github.com/helm/helm/pull/30743
      - name: Prepare Manifest Branch
        run: |
          cd ${MANIFEST_DIR}
          echo ">> Configure git to use gitea-bot as user ..."
          git config user.name "gitea-bot"
          git config user.email "gitea-bot@alexlebens.net"
          echo ">> Checking if PR branch exists ..."
          if [[ $(git ls-remote --heads origin "${BRANCH_NAME}" | wc -l) -gt 0 ]]; then
            echo ">> Branch '${BRANCH_NAME}' exists, pulling changes ..."
            git fetch origin "${BRANCH_NAME}"
            git checkout "${BRANCH_NAME}"
            git pull --rebase
          else
            echo ">> Branch '${BRANCH_NAME}' does not exist, creating ..."
            git checkout -b $BRANCH_NAME
          fi
          echo "----"
      - name: Check which Directories have Changes
        id: check-dir-changes
        run: |
          cd ${MAIN_DIR}
          RENDER_DIR=()
          echo ">> Checking for changes from HEAD^..HEAD ..."
          GIT_DIFF=$(git diff --name-only HEAD^..HEAD | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+")
          if [ -n "${GIT_DIFF}" ]; then
            echo ">> Changes detected:"
            echo "$GIT_DIFF"
            for path in $GIT_DIFF; do
              RENDER_DIR+=$(echo "$path" | awk -F '/' '{print $4}')
              RENDER_DIR+=$(echo " ")
            done
          else
            echo ">> No changes detected"
          fi
          if [ -n "${RENDER_DIR}" ]; then
            echo ">> Directories to Render:"
            echo "$(echo "${RENDER_DIR}" | sort -u)"
            echo "----"
            echo "changes-detected=true" >> $GITEA_OUTPUT
            echo "render-dir<<EOF" >> $GITEA_OUTPUT
            echo "$(echo "${RENDER_DIR}" | sort -u)" >> $GITEA_OUTPUT
            echo "EOF" >> $GITEA_OUTPUT
          else
            echo "changes-detected=false" >> $GITEA_OUTPUT
          fi
      - name: Add Repositories
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
        run: |
          cd ${MAIN_DIR}
          echo ">> Adding repositories for chart dependencies ..."
          for dir in ${RENDER_DIR}; do
            helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
              | tail +2 | head -n -1 \
              | awk '{ print "helm repo add " $1 " " $3 }' \
              | while read cmd; do
                if [[ "$cmd" == "*oci://*" ]]; then
                  echo ">> Ignoring OCI repo"
                else
                  echo "$cmd" | sh;
                fi
              done || true
          done
          if helm repo list | tail +2 | read -r; then
            echo ">> Update repository cache ..."
            helm repo update
          fi
          echo "----"
      - name: Remove Changed Manifest Files
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
        run: |
          cd ${MANIFEST_DIR}
          echo ">> Remove manfiest files and rebuild from source ..."
          for dir in ${RENDER_DIR}; do
            chart_path=${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$dir
            echo "$chart_path"
            rm -rf $chart_path/*
          done
          echo "----"
      - name: Render Helm Manifests
        id: render-manifests
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
        run: |
          cd ${MAIN_DIR}
          echo ">> Rendering Manifests ..."
          for dir in ${RENDER_DIR}; do
            chart_path=${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir
            chart_name=$(basename "$chart_path")
            echo ""
            echo ""
            echo ">> Rendering chart: $chart_name"
            echo ">> Chart path $chart_path"
            if [ -f "$chart_path/Chart.yaml" ]; then
              OUTPUT_FOLDER="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/"
              TEMPLATE=""
              mkdir -p ${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name
              cd $chart_path
              echo ""
              echo ">> Updating helm dependency ..."
              helm dependency update --skip-refresh
              echo ""
              echo ">> Building helm dependency ..."
              helm dependency build --skip-refresh
              echo ""
              echo ">> Linting helm ..."
              helm lint --namespace "$chart_name"
              echo ""
              echo ">> Rendering templates ..."
              case "$chart_name" in
                "stack")
                  echo ""
                  echo ">> Special Rendering for stack into argocd namespace ..."
                  TEMPLATE=$(helm template $chart_name ./ --namespace argocd --include-crds --dry-run)
                  ;;
                "cilium" | "coredns" | "metrics-server" |"prometheus-operator-crds")
                  echo ""
                  echo ">> Special Rendering for $chart_name into kube-system namespace ..."
                  TEMPLATE=$(helm template $chart_name ./ --namespace kube-system --include-crds --dry-run)
                  ;;
                *)
                  echo ""
                  echo ">> Standard Rendering for $chart_name ..."
                  TEMPLATE=$(helm template "$chart_name" ./ --namespace "$chart_name" --include-crds --dry-run)
                  ;;
              esac
              echo ""
              echo ">> Formating rendered template ..."
              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
              # Strip comments again to ensure formatting correctness
              for file in "$OUTPUT_FOLDER"/*; do
                yq -i '... comments=""' $file
              done
              echo ""
              echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
              ls $OUTPUT_FOLDER
              echo ""
            else
              echo ""
              echo ">> Directory $chart_path does not contain a Chart.yaml. Skipping ..."
              echo ""
            fi
          done
          echo "----"
      - name: Check for Changes
        id: check-changes
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        run: |
          cd ${MANIFEST_DIR}
          GIT_CHANGES=$(git status --porcelain)
          if [ -n "$GIT_CHANGES" ]; then
            echo ">> Changes detected"
            git status --porcelain
            echo "changes-detected=true" >> $GITEA_OUTPUT
          else
            echo ">> No changes detected, skipping PR creation"
          fi
          echo "----"
      - name: Commit and Push Changes
        id: commit-push
        if: steps.check-changes.outputs.changes-detected == 'true'
        run: |
          cd ${MANIFEST_DIR}
          echo ">> Commiting changes to ${BRANCH_NAME} ..."
          git add .
          git commit -m "chore: Update manifests after change"
          REPO_URL="${{ secrets.REPO_URL }}/${{ gitea.repository }}"
          echo ">> Pushing changes to $REPO_URL ..."
          git push -u "https://oauth2:${{ secrets.BOT_TOKEN }}@$(echo $REPO_URL | sed -e 's|https://||')" ${BRANCH_NAME}
          echo "----"
          echo "HEAD_BRANCH=${BRANCH_NAME}" >> $GITEA_OUTPUT
          echo "push=true" >> $GITEA_OUTPUT
      - name: Check for Pull Request
        id: check-for-pull-requst
        if: steps.commit-push.outputs.push == 'true'
        env:
          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
          GITEA_URL: ${{ secrets.REPO_URL }}
          HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
        run: |
          cd ${MANIFEST_DIR}
          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls?base_branch=${BASE_BRANCH}&state=open&page=1"
          echo ">> Checking if PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
          echo ">> With Endpoint of:"
          echo "$API_ENDPOINT"
          HTTP_STATUS=$(
            curl -X GET \
              --silent \
              --write-out '%{http_code}' \
              --output response_body.json \
              --dump-header response_headers.txt \
              -H "Authorization: token ${GITEA_TOKEN}" \
              -H "Content-Type: application/json" \
              "$API_ENDPOINT" 2> response_errors.txt
          )
          echo ">> HTTP Status Code: $HTTP_STATUS"
          echo ">> Response Output ..."
          echo "----"
          cat response_body.json
          echo "----"
          cat response_headers.txt
          echo "----"
          cat response_errors.txt
          echo "----"
          if [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "open" ]; then
            echo ">> Pull Request has been found open, will update"
            PR_INDEX=$(cat response_body.json | jq -r .[0].number)
            echo "pull-request-exists=${PR_INDEX}" >> $GITEA_OUTPUT
            echo "pull-request-index=true" >> $GITEA_OUTPUT
          elif [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "closed" ]; then
            echo ">> Pull Request found, but was closed"
            echo "pull-request-exists=false" >> $GITEA_OUTPUT
          else
            echo ">> Pull Request not found"
            echo "pull-request-exists=false" >> $GITEA_OUTPUT
          fi
          echo "----"
      - name: Create Pull Request
        id: create-pull-request
        if: steps.commit-push.outputs.push == 'true' && steps.check-for-pull-requst.outputs.pull-request-exists == 'false'
        env:
          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
          GITEA_URL: ${{ secrets.REPO_URL }}
          HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
        run: |
          cd ${MANIFEST_DIR}
          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls"
          PAYLOAD=$( jq -n \
            --arg head "${HEAD_BRANCH}" \
            --arg base "${BASE_BRANCH}" \
            --arg assignee "${ASSIGNEE}" \
            --arg title "Automated Manifest Update" \
            --arg body "This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow." \
            '{head: $head, base: $base, assignee: $assignee, title: $title, body: $body}' )
          echo ">> Creating PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
          echo ">> With Endpoint of:"
          echo "$API_ENDPOINT"
          echo ">> With Payload of:"
          echo "$PAYLOAD"
          HTTP_STATUS=$(
            curl -X POST \
              --silent \
              --write-out '%{http_code}' \
              --output response_body.json \
              --dump-header response_headers.txt \
              --data "$PAYLOAD" \
              -H "Authorization: token ${GITEA_TOKEN}" \
              -H "Content-Type: application/json" \
              "$API_ENDPOINT" 2> response_errors.txt
          )
          echo ">> HTTP Status Code: $HTTP_STATUS"
          echo ">> Response Output ..."
          echo "----"
          cat response_body.json
          echo "----"
          cat response_headers.txt
          echo "----"
          cat response_errors.txt
          echo "----"
          if [ "$HTTP_STATUS" == "201" ]; then
            echo ">> Pull Request created successfully!"
            PR_URL=$(cat response_body.json | jq -r .html_url)
            echo "pull-request-url=${PR_URL}" >> $GITEA_OUTPUT
            PR_ID=$(cat response_body.json | jq -r .id)
            echo "pull-request-id=${PR_ID}" >> $GITEA_OUTPUT
            echo "pull-request-operation=created" >> $GITEA_OUTPUT
          elif [ "$HTTP_STATUS" == "422" ]; then
            echo ">> Failed to create PR (HTTP 422: Unprocessable Entity), PR may already exist"
          elif [ "$HTTP_STATUS" == "409" ]; then
            echo ">> Failed to create PR (HTTP 409: Conflict), PR already exists"
          else
            echo ">> Failed to create PR, HTTP status code: $HTTP_STATUS"
            exit 1
          fi
          echo "----"
      - name: ntfy Created
        uses: niniyas/ntfy-action@master
        if: steps.create-pull-request.outputs.pull-request-operation == 'created'
        with:
          url: "${{ secrets.NTFY_URL }}"
          topic: "${{ secrets.NTFY_TOPIC }}"
          title: "Manifest Render PR Created - Infrastructure"
          priority: 3
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,successfully,completed
          details: "Manifest rendering for Infrastructure has created a new Pull Request with ID: ${{ steps.create-pull-request.outputs.pull-request-id }}!"
          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
          actions: '[{"action": "view", "label": "Open Gitea", "url": "${{ steps.create-pull-request.outputs.pull-request-url }}", "clear": true}]'
      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: "${{ secrets.NTFY_URL }}"
          topic: "${{ secrets.NTFY_TOPIC }}"
          title: "Manifest Render Failure - Infrastructure"
          priority: 4
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,failed
          details: "Manifest rendering for Infrastructure has failed!"
          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=render-manifests.yaml", "clear": true}]'
          image: true
--- a/.gitea/workflows/render-manifests-push.yaml
+++ b/.gitea/workflows/render-manifests-push.yaml
@@ -0,0 +1,416 @@
 name: render-manifests-push
 on:
  push:
    branches:
      - main
    paths:
      - 'clusters/cl01tl/helm/**'
 env:
  CLUSTER: cl01tl
  BASE_BRANCH: manifests
  BRANCH_NAME: auto/update-manifests
  ASSIGNEE: alexlebens
  MAIN_DIR: /workspace/alexlebens/infrastructure/infrastructure
  MANIFEST_DIR: /workspace/alexlebens/infrastructure/infrastructure-manifests
 jobs:
  render-manifests-push:
    runs-on: ubuntu-js
    if: gitea.event.commits[0].author.username != 'renovate-bot'
    steps:
      - name: Checkout Main
        uses: actions/checkout@v6
        with:
          path: infrastructure
          fetch-depth: 0
      - name: Checkout Manifests
        uses: actions/checkout@v6
        with:
          ref: manifests
          path: infrastructure-manifests
      - name: Set up Helm
        uses: azure/setup-helm@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}
          version: v3.17.2 # Pending https://github.com/helm/helm/pull/30743
      - name: Prepare Manifest Branch
        run: |
          cd ${MANIFEST_DIR}
          echo ">> Configure git to use gitea-bot as user ..."
          git config user.name "gitea-bot"
          git config user.email "gitea-bot@alexlebens.net"
          echo ">> Checking if PR branch exists ..."
          if [[ $(git ls-remote --heads origin "${BRANCH_NAME}" | wc -l) -gt 0 ]]; then
            echo ">> Branch '${BRANCH_NAME}' exists, pulling changes ..."
            git fetch origin "${BRANCH_NAME}"
            git checkout "${BRANCH_NAME}"
            git pull --rebase
          else
            echo ">> Branch '${BRANCH_NAME}' does not exist, creating ..."
            git checkout -b $BRANCH_NAME
          fi
          echo "----"
      - name: Check which Directories have Changes
        id: check-dir-changes
        run: |
          cd ${MAIN_DIR}
          RENDER_DIR=()
          echo ">> Checking for changes ..."
          GIT_DIFF=$(git diff --name-only ${{ gitea.event.before }}..HEAD | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+")
          if [ -n "${GIT_DIFF}" ]; then
            echo ">> Changes detected:"
            echo "$GIT_DIFF"
            for path in $GIT_DIFF; do
              RENDER_DIR+=$(echo "$path" | awk -F '/' '{print $4}')
              RENDER_DIR+=$(echo " ")
            done
          else
            echo ">> No changes detected"
          fi
          if [ -n "${RENDER_DIR}" ]; then
            echo ">> Directories to Render:"
            echo "$(echo "${RENDER_DIR}" | sort -u)"
            echo "----"
            echo "changes-detected=true" >> $GITEA_OUTPUT
            echo "render-dir<<EOF" >> $GITEA_OUTPUT
            echo "$(echo "${RENDER_DIR}" | sort -u)" >> $GITEA_OUTPUT
            echo "EOF" >> $GITEA_OUTPUT
          else
            echo "changes-detected=false" >> $GITEA_OUTPUT
          fi
      - name: Add Repositories
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
        run: |
          cd ${MAIN_DIR}
          echo ">> Adding repositories for chart dependencies ..."
          for dir in ${RENDER_DIR}; do
            helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
              | tail +2 | head -n -1 \
              | awk '{ print "helm repo add " $1 " " $3 }' \
              | while read cmd; do
                if [[ "$cmd" == "*oci://*" ]]; then
                  echo ">> Ignoring OCI repo"
                else
                  echo "$cmd" | sh;
                fi
              done || true
          done
          if helm repo list | tail +2 | read -r; then
            echo ">> Update repository cache ..."
            helm repo update
          fi
          echo "----"
      - name: Remove Changed Manifest Files
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
        run: |
          cd ${MANIFEST_DIR}
          echo ">> Remove manfiest files and rebuild from source ..."
          for dir in ${RENDER_DIR}; do
            chart_path=${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$dir
            echo "$chart_path"
            rm -rf $chart_path/*
          done
          echo "----"
      - name: Render Helm Manifests
        id: render-manifests
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
        run: |
          cd ${MAIN_DIR}
          echo ">> Rendering Manifests ..."
          for dir in ${RENDER_DIR}; do
            chart_path=${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir
            chart_name=$(basename "$chart_path")
            echo ""
            echo ""
            echo ">> Rendering chart: $chart_name"
            echo ">> Chart path $chart_path"
            if [ -f "$chart_path/Chart.yaml" ]; then
              OUTPUT_FOLDER="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/"
              TEMPLATE=""
              mkdir -p ${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name
              cd $chart_path
              echo ""
              echo ">> Updating helm dependency ..."
              helm dependency update --skip-refresh
              echo ""
              echo ">> Building helm dependency ..."
              helm dependency build --skip-refresh
              echo ""
              echo ">> Linting helm ..."
              helm lint --namespace "$chart_name"
              echo ""
              echo ">> Rendering templates ..."
              case "$chart_name" in
                "stack")
                  echo ""
                  echo ">> Special Rendering for stack into argocd namespace ..."
                  TEMPLATE=$(helm template $chart_name ./ --namespace argocd --include-crds --dry-run)
                  ;;
                "cilium" | "coredns" | "metrics-server" |"prometheus-operator-crds")
                  echo ""
                  echo ">> Special Rendering for $chart_name into kube-system namespace ..."
                  TEMPLATE=$(helm template $chart_name ./ --namespace kube-system --include-crds --dry-run)
                  ;;
                *)
                  echo ""
                  echo ">> Standard Rendering for $chart_name ..."
                  TEMPLATE=$(helm template "$chart_name" ./ --namespace "$chart_name" --include-crds --dry-run)
                  ;;
              esac
              echo ""
              echo ">> Formating rendered template ..."
              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
              # Strip comments again to ensure formatting correctness
              for file in "$OUTPUT_FOLDER"/*; do
                yq -i '... comments=""' $file
              done
              echo ""
              echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
              ls $OUTPUT_FOLDER
              echo ""
            else
              echo ""
              echo ">> Directory $chart_path does not contain a Chart.yaml. Skipping ..."
              echo ""
            fi
          done
          echo "----"
      - name: Check for Changes
        id: check-changes
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        run: |
          cd ${MANIFEST_DIR}
          GIT_CHANGES=$(git status --porcelain)
          if [ -n "$GIT_CHANGES" ]; then
            echo ">> Changes detected"
            git status --porcelain
            echo "changes-detected=true" >> $GITEA_OUTPUT
          else
            echo ">> No changes detected, skipping PR creation"
          fi
          echo "----"
      - name: Commit and Push Changes
        id: commit-push
        if: steps.check-changes.outputs.changes-detected == 'true'
        run: |
          cd ${MANIFEST_DIR}
          echo ">> Commiting changes to ${BRANCH_NAME} ..."
          git add .
          git commit -m "chore: Update manifests after change"
          REPO_URL="${{ secrets.REPO_URL }}/${{ gitea.repository }}"
          echo ">> Pushing changes to $REPO_URL ..."
          git push -u "https://oauth2:${{ secrets.BOT_TOKEN }}@$(echo $REPO_URL | sed -e 's|https://||')" ${BRANCH_NAME}
          echo "----"
          echo "HEAD_BRANCH=${BRANCH_NAME}" >> $GITEA_OUTPUT
          echo "push=true" >> $GITEA_OUTPUT
      - name: Check for Pull Request
        id: check-for-pull-requst
        if: steps.commit-push.outputs.push == 'true'
        env:
          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
          GITEA_URL: ${{ secrets.REPO_URL }}
          HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
        run: |
          cd ${MANIFEST_DIR}
          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls?base_branch=${BASE_BRANCH}&state=open&page=1"
          echo ">> Checking if PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
          echo ">> With Endpoint of:"
          echo "$API_ENDPOINT"
          HTTP_STATUS=$(
            curl -X GET \
              --silent \
              --write-out '%{http_code}' \
              --output response_body.json \
              --dump-header response_headers.txt \
              -H "Authorization: token ${GITEA_TOKEN}" \
              -H "Content-Type: application/json" \
              "$API_ENDPOINT" 2> response_errors.txt
          )
          echo ">> HTTP Status Code: $HTTP_STATUS"
          echo ">> Response Output ..."
          echo "----"
          cat response_body.json
          echo "----"
          cat response_headers.txt
          echo "----"
          cat response_errors.txt
          echo "----"
          if [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "open" ]; then
            echo ">> Pull Request has been found open, will update"
            PR_INDEX=$(cat response_body.json | jq -r .[0].number)
            echo "pull-request-exists=${PR_INDEX}" >> $GITEA_OUTPUT
            echo "pull-request-index=true" >> $GITEA_OUTPUT
          elif [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "closed" ]; then
            echo ">> Pull Request found, but was closed"
            echo "pull-request-exists=false" >> $GITEA_OUTPUT
          else
            echo ">> Pull Request not found"
            echo "pull-request-exists=false" >> $GITEA_OUTPUT
          fi
          echo "----"
      - name: Create Pull Request
        id: create-pull-request
        if: steps.commit-push.outputs.push == 'true' && steps.check-for-pull-requst.outputs.pull-request-exists == 'false'
        env:
          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
          GITEA_URL: ${{ secrets.REPO_URL }}
          HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
        run: |
          cd ${MANIFEST_DIR}
          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls"
          PAYLOAD=$( jq -n \
            --arg head "${HEAD_BRANCH}" \
            --arg base "${BASE_BRANCH}" \
            --arg assignee "${ASSIGNEE}" \
            --arg title "Automated Manifest Update" \
            --arg body "This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow." \
            '{head: $head, base: $base, assignee: $assignee, title: $title, body: $body}' )
          echo ">> Creating PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
          echo ">> With Endpoint of:"
          echo "$API_ENDPOINT"
          echo ">> With Payload of:"
          echo "$PAYLOAD"
          HTTP_STATUS=$(
            curl -X POST \
              --silent \
              --write-out '%{http_code}' \
              --output response_body.json \
              --dump-header response_headers.txt \
              --data "$PAYLOAD" \
              -H "Authorization: token ${GITEA_TOKEN}" \
              -H "Content-Type: application/json" \
              "$API_ENDPOINT" 2> response_errors.txt
          )
          echo ">> HTTP Status Code: $HTTP_STATUS"
          echo ">> Response Output ..."
          echo "----"
          cat response_body.json
          echo "----"
          cat response_headers.txt
          echo "----"
          cat response_errors.txt
          echo "----"
          if [ "$HTTP_STATUS" == "201" ]; then
            echo ">> Pull Request created successfully!"
            PR_URL=$(cat response_body.json | jq -r .html_url)
            echo "pull-request-url=${PR_URL}" >> $GITEA_OUTPUT
            PR_ID=$(cat response_body.json | jq -r .id)
            echo "pull-request-id=${PR_ID}" >> $GITEA_OUTPUT
            echo "pull-request-operation=created" >> $GITEA_OUTPUT
          elif [ "$HTTP_STATUS" == "422" ]; then
            echo ">> Failed to create PR (HTTP 422: Unprocessable Entity), PR may already exist"
          elif [ "$HTTP_STATUS" == "409" ]; then
            echo ">> Failed to create PR (HTTP 409: Conflict), PR already exists"
          else
            echo ">> Failed to create PR, HTTP status code: $HTTP_STATUS"
            exit 1
          fi
          echo "----"
      - name: ntfy Created
        uses: niniyas/ntfy-action@master
        if: steps.create-pull-request.outputs.pull-request-operation == 'created'
        with:
          url: "${{ secrets.NTFY_URL }}"
          topic: "${{ secrets.NTFY_TOPIC }}"
          title: "Manifest Render PR Created - Infrastructure"
          priority: 3
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,successfully,completed
          details: "Manifest rendering for Infrastructure has created a new Pull Request with ID: ${{ steps.create-pull-request.outputs.pull-request-id }}!"
          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
          actions: '[{"action": "view", "label": "Open Gitea", "url": "${{ steps.create-pull-request.outputs.pull-request-url }}", "clear": true}]'
      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: "${{ secrets.NTFY_URL }}"
          topic: "${{ secrets.NTFY_TOPIC }}"
          title: "Manifest Render Failure - Infrastructure"
          priority: 4
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,failed
          details: "Manifest rendering for Infrastructure has failed!"
          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=render-manifests.yaml", "clear": true}]'
          image: true
--- a/clusters/cl01tl/helm/actual/Chart.lock
+++ b/clusters/cl01tl/helm/actual/Chart.lock
@@ -1,6 +1,9 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.4.0
+  version: 4.5.0
-digest: sha256:b5d823171e1b4dc1d3856f782f0c67cbb5d49e4fa170df2f21b06303c7aff7f5
+- name: volsync-target
-generated: "2025-11-30T21:05:19.732832-06:00"
+  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.3.0
 digest: sha256:3763d6c5c0b45219235229aa1d72bfa426abd29aa8d92c1b1ca958b6afb3bfc8
 generated: "2025-12-15T17:43:51.908308-06:00"
--- a/clusters/cl01tl/helm/actual/Chart.yaml
+++ b/clusters/cl01tl/helm/actual/Chart.yaml
@@ -16,6 +16,10 @@ dependencies:
  - name: app-template
    alias: actual
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.4.0
+    version: 4.5.0
  - name: volsync-target
    alias: volsync-target-data
    version: 0.3.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/actual-budget.png
-appVersion: 25.11.0
+appVersion: 25.12.0
--- a/clusters/cl01tl/helm/actual/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/actual/templates/replication-source.yaml
@@ -1,25 +0,0 @@
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: actual-data-backup-source
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: actual-data-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: actual-data
  trigger:
    schedule: 0 4 * * *
  restic:
    pruneIntervalDays: 7
    repository: actual-data-backup-secret
    retain:
      hourly: 1
      daily: 3
      weekly: 2
      monthly: 2
      yearly: 4
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
--- a/clusters/cl01tl/helm/actual/values.yaml
+++ b/clusters/cl01tl/helm/actual/values.yaml
@@ -9,7 +9,7 @@ actual:
        main:
          image:
            repository: ghcr.io/actualbudget/actual
-            tag: 25.11.0
+            tag: 25.12.0
            pullPolicy: IfNotPresent
          env:
            - name: TZ
@@ -54,3 +54,5 @@ actual:
          main:
            - path: /data
              readOnly: false
 volsync-target-data:
  pvcTarget: actual-data
--- a/clusters/cl01tl/helm/argo-workflows/Chart.lock
+++ b/clusters/cl01tl/helm/argo-workflows/Chart.lock
@@ -1,12 +1,12 @@
 dependencies:
 - name: argo-workflows
  repository: https://argoproj.github.io/argo-helm
-  version: 0.45.28
+  version: 0.46.2
 - name: argo-events
  repository: https://argoproj.github.io/argo-helm
-  version: 2.4.17
+  version: 2.4.19
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 6.16.0
+  version: 7.1.1
-digest: sha256:b00fd479a9d9e606661b3799182c8e24395b4f531f8d2bda87bdc5db16a8d66c
+digest: sha256:796a0f9ae054268c9a4e2752f29004b6547e5ee41e623b8506b531f6836b7313
-generated: "2025-12-01T19:55:40.18149-06:00"
+generated: "2025-12-15T14:27:02.068848-06:00"
--- a/clusters/cl01tl/helm/argo-workflows/Chart.yaml
+++ b/clusters/cl01tl/helm/argo-workflows/Chart.yaml
@@ -18,14 +18,14 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: argo-workflows
-    version: 0.45.28
+    version: 0.46.2
    repository: https://argoproj.github.io/argo-helm
  - name: argo-events
-    version: 2.4.17
+    version: 2.4.19
    repository: https://argoproj.github.io/argo-helm
  - name: postgres-cluster
-    alias: postgres-17-cluster
+    alias: postgres-18-cluster
-    version: 6.16.0
+    version: 7.1.1
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
-appVersion: v3.6.7
+appVersion: v3.7.6
--- a/clusters/cl01tl/helm/argo-workflows/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/argo-workflows/templates/external-secret.yaml
@@ -31,10 +31,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: argo-workflows-postgresql-17-cluster-backup-secret
+  name: argo-workflows-postgresql-18-cluster-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: argo-workflows-postgresql-17-cluster-backup-secret
+    app.kubernetes.io/name: argo-workflows-postgresql-18-cluster-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -61,10 +61,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: argo-workflows-postgresql-17-cluster-backup-secret-garage
+  name: argo-workflows-postgresql-18-cluster-backup-secret-garage
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: argo-workflows-postgresql-17-cluster-backup-secret-garage
+    app.kubernetes.io/name: argo-workflows-postgresql-18-cluster-backup-secret-garage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
--- a/clusters/cl01tl/helm/argo-workflows/values.yaml
+++ b/clusters/cl01tl/helm/argo-workflows/values.yaml
@@ -9,15 +9,15 @@ argo-workflows:
      nodeStatusOffLoad: true
      archive: true
      postgresql:
-        host: argo-workflows-postgresql-17-cluster-rw
+        host: argo-workflows-postgresql-18-cluster-rw
        port: 5432
        database: app
        tableName: app
        userNameSecret:
-          name: argo-workflows-postgresql-17-cluster-app
+          name: argo-workflows-postgresql-18-cluster-app
          key: username
        passwordSecret:
-          name: argo-workflows-postgresql-17-cluster-app
+          name: argo-workflows-postgresql-18-cluster-app
          key: password
        ssl: false
        sslMode: disable
@@ -59,20 +59,6 @@ argo-workflows:
  useStaticCredentials: true
  artifactRepository:
    archiveLogs: false
    s3: {}
      # accessKeySecret:
      #   name: "{{ .Release.Name }}-minio"
      #   key: accesskey
      # secretKeySecret:
      #   name: "{{ .Release.Name }}-minio"
      #   key: secretkey
      # insecure: true
      # bucket:
      # endpoint:
      # region:
      # encryptionOptions:
      #   enableEncryption: true
 argo-events:
  controller:
    resources:
@@ -89,59 +75,57 @@ argo-events:
      requests:
        cpu: 10m
        memory: 128Mi
-postgres-17-cluster:
+postgres-18-cluster:
  mode: recovery
  cluster:
    storage:
      storageClass: local-path
    walStorage:
      storageClass: local-path
    monitoring:
      enabled: true
      prometheusRule:
        enabled: true
  recovery:
    method: objectStore
    objectStore:
-      destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-17-cluster
+      destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
      endpointURL: http://garage-main.garage:3900
      index: 1
-      endpointCredentials: argo-workflows-postgresql-17-cluster-backup-secret-garage
+      endpointCredentials: argo-workflows-postgresql-18-cluster-backup-secret-garage
  backup:
    objectStore:
      - name: external
        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/argo-workflows/argo-workflows-postgresql-17-cluster
        index: 1
        retentionPolicy: "30d"
        isWALArchiver: false
      - name: garage-local
-        destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-17-cluster
+        destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
        index: 1
        endpointURL: http://garage-main.garage:3900
-        endpointCredentials: argo-workflows-postgresql-17-cluster-backup-secret-garage
+        endpointCredentials: argo-workflows-postgresql-18-cluster-backup-secret-garage
        endpointCredentialsIncludeRegion: true
        retentionPolicy: "3d"
        isWALArchiver: true
      # - name: external
      #   destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
      #   index: 1
      #   retentionPolicy: "30d"
      #   isWALArchiver: false
      # - name: garage-remote
-      #   destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-17-cluster
+      #   destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
      #   index: 1
      #   endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
-      #   endpointCredentials: argo-workflows-postgresql-17-cluster-backup-secret-garage
+      #   endpointCredentials: argo-workflows-postgresql-18-cluster-backup-secret-garage
      #   endpointCredentialsIncludeRegion: true
      #   retentionPolicy: "30d"
      #   data:
      #     compression: bzip2
    scheduledBackups:
      - name: daily-backup
        suspend: false
        schedule: "0 0 0 * * *"
        backupName: external
      - name: live-backup
        suspend: false
        immediate: true
        schedule: "0 0 0 * * *"
        backupName: garage-local
      # - name: daily-backup
      #   suspend: false
      #   immediate: true
      #   schedule: "0 0 0 * * *"
      #   backupName: external
      # - name: weekly-backup
      #   suspend: true
      #   immediate: true
      #   schedule: "0 0 4 * * SAT"
      #   backupName: garage-remote
--- a/clusters/cl01tl/helm/argocd/Chart.lock
+++ b/clusters/cl01tl/helm/argocd/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
  repository: https://argoproj.github.io/argo-helm
-  version: 9.1.5
+  version: 9.1.7
-digest: sha256:07f7f6d369af426cdd213ddbc58373a4e5b4f54724efd4612662d7da0315232d
+digest: sha256:ed1ae26f3e642750f6dd970c1adc4fa14a627fad13daf74169213199f74425b3
-generated: "2025-12-02T21:27:41.876154-06:00"
+generated: "2025-12-09T23:01:55.027301875Z"
--- a/clusters/cl01tl/helm/argocd/Chart.yaml
+++ b/clusters/cl01tl/helm/argocd/Chart.yaml
@@ -15,7 +15,7 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: argo-cd
-    version: 9.1.5
+    version: 9.1.7
    repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
-appVersion: 3.0.0
+appVersion: v3.2.1
--- a/clusters/cl01tl/helm/argocd/values.yaml
+++ b/clusters/cl01tl/helm/argocd/values.yaml
@@ -25,6 +25,7 @@ argo-cd:
          id: authentik
    params:
      server.insecure: true
      controller.diff.server.side: true
    rbac:
      policy.csv: |
        g, ArgoCD Admins, role:admin
@@ -60,7 +61,7 @@ argo-cd:
    enabled: true
    auth: false
  redisSecretInit:
-    enabled: true
+    enabled: false
  server:
    replicas: 2
    extensions:
@@ -279,7 +280,7 @@ argo-cd:
        - description: Application has degraded
          send:
            - app-health-degraded
-          when: app.status.health.status == 'Degraded' and time.Now().Sub(time.Parse(app.status.health.lastTransitionTime).Minutes() >= 15
+          when: app.status.health.status == 'Degraded'
      trigger.on-sync-failed: |
        - description: Application syncing has failed
          send:
--- a/clusters/cl01tl/helm/audiobookshelf/Chart.lock
+++ b/clusters/cl01tl/helm/audiobookshelf/Chart.lock
@@ -1,6 +1,12 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.4.0
+  version: 4.5.0
-digest: sha256:f3a9990542f24965fadad0b5493059b78cdc3fae91c8214577fa6f41ca5f7de3
+- name: volsync-target
-generated: "2025-11-30T21:05:21.317114-06:00"
+  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.3.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.3.0
 digest: sha256:88e0d8008795451a64f3a2e4fa4fc120d48cef4badb4305e8e60afbb494352c5
 generated: "2025-12-15T18:19:02.989735-06:00"
--- a/clusters/cl01tl/helm/audiobookshelf/Chart.yaml
+++ b/clusters/cl01tl/helm/audiobookshelf/Chart.yaml
@@ -18,6 +18,14 @@ dependencies:
  - name: app-template
    alias: audiobookshelf
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.4.0
+    version: 4.5.0
  - name: volsync-target
    alias: volsync-target-config
    version: 0.3.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-metadata
    version: 0.3.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/audiobookshelf.png
-appVersion: 2.21.0
+appVersion: 2.31.0
--- a/clusters/cl01tl/helm/audiobookshelf/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/audiobookshelf/templates/external-secret.yaml
@@ -19,117 +19,3 @@ spec:
        key: /cl01tl/audiobookshelf/apprise
        metadataPolicy: None
        property: ntfy-url
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: audiobookshelf-config-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audiobookshelf-config-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/audiobookshelf/audiobookshelf-config"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: S3_BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: AWS_DEFAULT_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: access_key
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: secret_key
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: audiobookshelf-metadata-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audiobookshelf-metadata-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/audiobookshelf/audiobookshelf-metadata"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: S3_BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: AWS_DEFAULT_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: access_key
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: secret_key
--- a/clusters/cl01tl/helm/audiobookshelf/templates/persistent-volume-claim.yaml
+++ b/clusters/cl01tl/helm/audiobookshelf/templates/persistent-volume-claim.yaml
@@ -1,24 +1,5 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: audiobookshelf-nfs-storage-backup
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audiobookshelf-nfs-storage-backup
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeMode: Filesystem
  storageClassName: nfs-client
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: audiobookshelf-nfs-storage
  namespace: {{ .Release.Namespace }}
--- a/clusters/cl01tl/helm/audiobookshelf/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/audiobookshelf/templates/replication-source.yaml
@@ -1,52 +0,0 @@
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: audiobookshelf-config-backup-source
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audiobookshelf-config-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: audiobookshelf-config
  trigger:
    schedule: 0 4 * * *
  restic:
    pruneIntervalDays: 7
    repository: audiobookshelf-config-backup-secret
    retain:
      hourly: 1
      daily: 3
      weekly: 2
      monthly: 2
      yearly: 4
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
 ---
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: audiobookshelf-metadata-backup-source
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audiobookshelf-metadata-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: audiobookshelf-metadata
  trigger:
    schedule: 0 4 * * *
  restic:
    pruneIntervalDays: 7
    repository: audiobookshelf-metadata-backup-secret
    retain:
      hourly: 1
      daily: 3
      weekly: 2
      monthly: 2
      yearly: 4
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
--- a/clusters/cl01tl/helm/audiobookshelf/values.yaml
+++ b/clusters/cl01tl/helm/audiobookshelf/values.yaml
@@ -21,7 +21,7 @@ audiobookshelf:
        apprise-api:
          image:
            repository: caronc/apprise
-            tag: 1.2.6
+            tag: 1.3.0
            pullPolicy: IfNotPresent
          env:
            - name: TZ
@@ -59,6 +59,7 @@ audiobookshelf:
          protocol: HTTP
  persistence:
    config:
      forceRename: audiobookshelf-config
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 2Gi
@@ -69,6 +70,7 @@ audiobookshelf:
            - path: /config
              readOnly: false
    metadata:
      forceRename: audiobookshelf-metadata
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 10Gi
@@ -78,13 +80,6 @@ audiobookshelf:
          main:
            - path: /metadata
              readOnly: false
    backup:
      existingClaim: audiobookshelf-nfs-storage-backup
      advancedMounts:
        main:
          main:
            - path: /metadata/backups
              readOnly: false
    audiobooks:
      existingClaim: audiobookshelf-nfs-storage
      advancedMounts:
@@ -92,3 +87,7 @@ audiobookshelf:
          main:
            - path: /mnt/store/
              readOnly: false
 volsync-target-config:
  pvcTarget: audiobookshelf-config
 volsync-target-metadata:
  pvcTarget: audiobookshelf-metadata
--- a/clusters/cl01tl/helm/authentik/Chart.lock
+++ b/clusters/cl01tl/helm/authentik/Chart.lock
@@ -4,9 +4,12 @@ dependencies:
  version: 2025.10.2
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.1
+  version: 1.23.2
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 6.16.0
+  version: 7.1.1
-digest: sha256:2c3f84ecf3c8cabb7aa7e7e8a1b38cced65156c1e1db9b984154f514c33c9f69
+- name: redis-replication
-generated: "2025-12-03T06:02:07.501444093Z"
+  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.5.0
 digest: sha256:e593d25ebf07b1274768045f028e1ceeccbcdc1c8e35414d6bbd9a8d09086991
 generated: "2025-12-15T14:36:33.783343-06:00"
--- a/clusters/cl01tl/helm/authentik/Chart.yaml
+++ b/clusters/cl01tl/helm/authentik/Chart.yaml
@@ -26,10 +26,13 @@ dependencies:
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.1
+    version: 1.23.2
  - name: postgres-cluster
-    alias: postgres-17-cluster
+    alias: postgres-18-cluster
-    version: 6.16.0
+    version: 7.1.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: redis-replication
    version: 0.5.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/authentik.png
-appVersion: 2025.4.1
+appVersion: 2025.10.2
--- a/clusters/cl01tl/helm/authentik/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/authentik/templates/external-secret.yaml
@@ -47,10 +47,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: authentik-postgresql-17-cluster-backup-secret
+  name: authentik-postgresql-18-cluster-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: authentik-postgresql-17-cluster-backup-secret
+    app.kubernetes.io/name: authentik-postgresql-18-cluster-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -77,10 +77,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: authentik-postgresql-17-cluster-backup-secret-garage
+  name: authentik-postgresql-18-cluster-backup-secret-garage
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: authentik-postgresql-17-cluster-backup-secret-garage
+    app.kubernetes.io/name: authentik-postgresql-18-cluster-backup-secret-garage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
--- a/clusters/cl01tl/helm/authentik/templates/redis-replication.yaml
+++ b/clusters/cl01tl/helm/authentik/templates/redis-replication.yaml
@@ -1,32 +0,0 @@
 apiVersion: redis.redis.opstreelabs.in/v1beta2
 kind: RedisReplication
 metadata:
  name: redis-replication-authentik
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: redis-replication-authentik
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  clusterSize: 3
  podSecurityContext:
    runAsUser: 1000
    fsGroup: 1000
  kubernetesConfig:
    image: quay.io/opstree/redis:v8.0.3
    imagePullPolicy: IfNotPresent
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
  storage:
    volumeClaimTemplate:
      spec:
        storageClassName: ceph-block
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 1Gi
  redisExporter:
    enabled: true
    image: quay.io/opstree/redis-exporter:v1.48.0
--- a/clusters/cl01tl/helm/authentik/templates/service-monitor.yaml
+++ b/clusters/cl01tl/helm/authentik/templates/service-monitor.yaml
@@ -1,19 +0,0 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  name: redis-replication-authentik
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: redis-replication-authentik
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
    redis-operator: "true"
    env: production
 spec:
  selector:
    matchLabels:
      redis_setup_type: replication
  endpoints:
    - port: redis-exporter
      interval: 30s
      scrapeTimeout: 10s
--- a/clusters/cl01tl/helm/authentik/values.yaml
+++ b/clusters/cl01tl/helm/authentik/values.yaml
@@ -9,22 +9,22 @@ authentik:
      - name: AUTHENTIK_POSTGRESQL__HOST
        valueFrom:
          secretKeyRef:
-            name: authentik-postgresql-17-cluster-app
+            name: authentik-postgresql-18-cluster-app
            key: host
      - name: AUTHENTIK_POSTGRESQL__NAME
        valueFrom:
          secretKeyRef:
-            name: authentik-postgresql-17-cluster-app
+            name: authentik-postgresql-18-cluster-app
            key: dbname
      - name: AUTHENTIK_POSTGRESQL__USER
        valueFrom:
          secretKeyRef:
-            name: authentik-postgresql-17-cluster-app
+            name: authentik-postgresql-18-cluster-app
            key: user
      - name: AUTHENTIK_POSTGRESQL__PASSWORD
        valueFrom:
          secretKeyRef:
-            name: authentik-postgresql-17-cluster-app
+            name: authentik-postgresql-18-cluster-app
            key: password
  authentik:
    redis:
@@ -50,59 +50,65 @@ authentik:
    enabled: false
 cloudflared:
  existingSecretName: authentik-cloudflared-secret
-postgres-17-cluster:
+postgres-18-cluster:
  mode: recovery
  cluster:
    storage:
      storageClass: local-path
    walStorage:
      storageClass: local-path
    monitoring:
      enabled: true
      prometheusRule:
        enabled: true
  recovery:
    method: objectStore
    objectStore:
-      destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-17-cluster
+      destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-18-cluster
      endpointURL: http://garage-main.garage:3900
      index: 1
-      endpointCredentials: authentik-postgresql-17-cluster-backup-secret-garage
+      endpointCredentials: authentik-postgresql-18-cluster-backup-secret-garage
  backup:
    objectStore:
      - name: external
        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/authentik/authentik-postgresql-17-cluster
        index: 1
        retentionPolicy: "30d"
        isWALArchiver: false
      - name: garage-local
-        destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-17-cluster
+        destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-18-cluster
        index: 1
        endpointURL: http://garage-main.garage:3900
-        endpointCredentials: authentik-postgresql-17-cluster-backup-secret-garage
+        endpointCredentials: authentik-postgresql-18-cluster-backup-secret-garage
        endpointCredentialsIncludeRegion: true
        retentionPolicy: "3d"
        isWALArchiver: true
      # - name: external
      #   destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/authentik/authentik-postgresql-18-cluster
      #   index: 1
      #   retentionPolicy: "30d"
      #   isWALArchiver: false
      # - name: garage-remote
-      #   destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-17-cluster
+      #   destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-18-cluster
      #   index: 1
      #   endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
-      #   endpointCredentials: authentik-postgresql-17-cluster-backup-secret-garage
+      #   endpointCredentials: authentik-postgresql-18-cluster-backup-secret-garage
      #   retentionPolicy: "30d"
      #   data:
      #     compression: bzip2
      #     jobs: 2
    scheduledBackups:
      - name: daily-backup
        suspend: false
        schedule: "0 0 0 * * *"
        backupName: external
      - name: live-backup
        suspend: false
        immediate: true
        schedule: "0 0 0 * * *"
        backupName: garage-local
      # - name: daily-backup
      #   suspend: false
      #   immediate: true
      #   schedule: "0 0 0 * * *"
      #   backupName: external
      # - name: weekly-backup
      #   suspend: false
      #   immediate: true
      #   schedule: "0 0 4 * * SAT"
      #   backupName: garage-remote
 redis-replication:
  existingSecret:
    enabled: false
  redisReplication:
    clusterSize: 3
  redisSentinel:
    enabled: true
    clusterSize: 3
--- a/clusters/cl01tl/helm/backrest/Chart.lock
+++ b/clusters/cl01tl/helm/backrest/Chart.lock
@@ -1,6 +1,12 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.4.0
+  version: 4.5.0
-digest: sha256:aa797b99d6d8b7aafe142811938408b7f234df6d429a7e076196337cc63876cb
+- name: volsync-target
-generated: "2025-12-01T20:25:09.888407-06:00"
+  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.3.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.3.0
 digest: sha256:13c950ad5cd6accd192e6768557c0df74af2cd767d2372dc38c1cdb7e1563399
 generated: "2025-12-15T18:33:59.961957-06:00"
--- a/clusters/cl01tl/helm/backrest/Chart.yaml
+++ b/clusters/cl01tl/helm/backrest/Chart.yaml
@@ -16,6 +16,14 @@ dependencies:
  - name: app-template
    alias: backrest
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.4.0
+    version: 4.5.0
  - name: volsync-target
    alias: volsync-target-config
    version: 0.3.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-data
    version: 0.3.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/backrest.png
 appVersion: v1.10.1
--- a/clusters/cl01tl/helm/backrest/values.yaml
+++ b/clusters/cl01tl/helm/backrest/values.yaml
@@ -35,6 +35,7 @@ backrest:
          protocol: TCP
  persistence:
    data:
      forceRename: backrest-data
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 10Gi
@@ -45,6 +46,7 @@ backrest:
            - path: /data
              readOnly: false
    config:
      forceRename: backrest-config
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 1Gi
@@ -82,3 +84,7 @@ backrest:
          main:
            - path: /mnt/share
              readOnly: true
 volsync-target-data:
  pvcTarget: backrest-data
 volsync-target-config:
  pvcTarget: backrest-config
--- a/clusters/cl01tl/helm/bazarr/Chart.lock
+++ b/clusters/cl01tl/helm/bazarr/Chart.lock
@@ -1,6 +1,9 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.4.0
+  version: 4.5.0
-digest: sha256:c6f6d1f2fb9fedf54094920737a6f0bd1a2ab89f0a4122966ca98f6c9d3f11fa
+- name: volsync-target
-generated: "2025-11-30T21:05:22.694344-06:00"
+  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.5.0
 digest: sha256:cb702f316026bdb487ace1abec56cc3c505376cf14a45528e3e593e4cc7effab
 generated: "2025-12-15T19:04:05.574701-06:00"
--- a/clusters/cl01tl/helm/bazarr/Chart.yaml
+++ b/clusters/cl01tl/helm/bazarr/Chart.yaml
@@ -18,6 +18,10 @@ dependencies:
  - name: app-template
    alias: bazarr
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.4.0
+    version: 4.5.0
  - name: volsync-target
    alias: volsync-target-config
    version: 0.5.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/bazarr.png
-appVersion: 1.5.2
+appVersion: 1.5.3
--- a/clusters/cl01tl/helm/bazarr/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/bazarr/templates/external-secret.yaml
@@ -1,55 +0,0 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: bazarr-config-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: bazarr-config-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/bazarr/bazarr-config"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: S3_BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: AWS_DEFAULT_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: access_key
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: secret_key
--- a/clusters/cl01tl/helm/bazarr/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/bazarr/templates/replication-source.yaml
@@ -1,30 +0,0 @@
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: bazarr-config-backup-source
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: bazarr-config-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: bazarr-config
  trigger:
    schedule: 0 4 * * *
  restic:
    pruneIntervalDays: 7
    repository: bazarr-config-backup-secret
    retain:
      hourly: 1
      daily: 3
      weekly: 2
      monthly: 2
      yearly: 4
    moverSecurityContext:
      runAsUser: 1000
      runAsGroup: 1000
      fsGroup: 1000
      fsGroupChangePolicy: OnRootMismatch
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
--- a/clusters/cl01tl/helm/bazarr/values.yaml
+++ b/clusters/cl01tl/helm/bazarr/values.yaml
@@ -15,7 +15,7 @@ bazarr:
        main:
          image:
            repository: ghcr.io/linuxserver/bazarr
-            tag: 1.5.3@sha256:ec11e988e8e13411c994a4d9f43ed9b97409aa92c1da54d9f23926c3da7c2032
+            tag: 1.5.3@sha256:4aa1e82d1e96ae712095d881b7e3840e6db6ca862c335be5b00001f31156650b
            pullPolicy: IfNotPresent
          env:
            - name: TZ
@@ -55,3 +55,10 @@ bazarr:
          main:
            - path: /mnt/store
              readOnly: false
 volsync-target-config:
  pvcTarget: bazarr-config
  moverSecurityContext:
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
--- a/clusters/cl01tl/helm/blocky/Chart.lock
+++ b/clusters/cl01tl/helm/blocky/Chart.lock
@@ -1,6 +1,9 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.4.0
+  version: 4.5.0
-digest: sha256:0009729bcf7f1941401b767fd4ae952b7a8d44f80053090b4a9224de912a14ef
+- name: redis-replication
-generated: "2025-12-01T20:25:13.511406-06:00"
+  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.5.0
 digest: sha256:a7840240d52d7c66aa2e542132e32907dd0c48d3051eb15190a209215cbd4dce
 generated: "2025-12-15T20:06:31.995318697Z"
--- a/clusters/cl01tl/helm/blocky/Chart.yaml
+++ b/clusters/cl01tl/helm/blocky/Chart.yaml
@@ -16,6 +16,9 @@ dependencies:
  - name: app-template
    alias: blocky
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.4.0
+    version: 4.5.0
  - name: redis-replication
    version: 0.5.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/blocky.png
-appVersion: v0.25
+appVersion: v0.28.2
--- a/clusters/cl01tl/helm/blocky/templates/redis-replication.yaml
+++ b/clusters/cl01tl/helm/blocky/templates/redis-replication.yaml
@@ -1,32 +0,0 @@
 apiVersion: redis.redis.opstreelabs.in/v1beta2
 kind: RedisReplication
 metadata:
  name: redis-replication-blocky
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: redis-replication-blocky
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  clusterSize: 3
  podSecurityContext:
    runAsUser: 1000
    fsGroup: 1000
  kubernetesConfig:
    image: quay.io/opstree/redis:v8.0.3
    imagePullPolicy: IfNotPresent
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
  storage:
    volumeClaimTemplate:
      spec:
        storageClassName: ceph-block
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 1Gi
  redisExporter:
    enabled: true
    image: quay.io/opstree/redis-exporter:v1.48.0
--- a/clusters/cl01tl/helm/blocky/templates/service-monitor.yaml
+++ b/clusters/cl01tl/helm/blocky/templates/service-monitor.yaml
@@ -17,24 +17,3 @@ spec:
      interval: 30s
      scrapeTimeout: 10s
      path: /metrics
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  name: redis-replication-blocky
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: redis-replication-blocky
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
    redis-operator: "true"
    env: production
 spec:
  selector:
    matchLabels:
      redis_setup_type: replication
  endpoints:
    - port: redis-exporter
      interval: 30s
      scrapeTimeout: 10s
--- a/clusters/cl01tl/helm/blocky/values.yaml
+++ b/clusters/cl01tl/helm/blocky/values.yaml
@@ -129,10 +129,10 @@ blocky:
              huntarr                         IN      CNAME   traefik-cl01tl
              immich                          IN      CNAME   traefik-cl01tl
              jellyfin                        IN      CNAME   traefik-cl01tl
              jellyfin-vue                    IN      CNAME   traefik-cl01tl
              jellystat                       IN      CNAME   traefik-cl01tl
              kiwix                           IN      CNAME   traefik-cl01tl
              komodo                          IN      CNAME   traefik-cl01tl
              kronic                          IN      CNAME   traefik-cl01tl
              lidarr                          IN      CNAME   traefik-cl01tl
              lidatube                        IN      CNAME   traefik-cl01tl
              listenarr                       IN      CNAME   traefik-cl01tl
@@ -143,7 +143,6 @@ blocky:
              ollama                          IN      CNAME   traefik-cl01tl
              omni-tools                      IN      CNAME   traefik-cl01tl
              overseerr                       IN      CNAME   traefik-cl01tl
              pgadmin                         IN      CNAME   traefik-cl01tl
              photoview                       IN      CNAME   traefik-cl01tl
              plex                            IN      CNAME   traefik-cl01tl
              postiz                          IN      CNAME   traefik-cl01tl
@@ -156,6 +155,7 @@ blocky:
              radarr-anime                    IN      CNAME   traefik-cl01tl
              radarr-standup                  IN      CNAME   traefik-cl01tl
              searxng                         IN      CNAME   traefik-cl01tl
              seerr                           IN      CNAME   traefik-cl01tl
              slskd                           IN      CNAME   traefik-cl01tl
              sonarr                          IN      CNAME   traefik-cl01tl
              sonarr-4k                       IN      CNAME   traefik-cl01tl
@@ -301,3 +301,10 @@ blocky:
              readOnly: true
              mountPropagation: None
              subPath: config.yml
 redis-replication:
  existingSecret:
    enabled: false
  redisReplication:
    clusterSize: 3
  redisSentinel:
    enabled: false
--- a/clusters/cl01tl/helm/booklore/Chart.lock
+++ b/clusters/cl01tl/helm/booklore/Chart.lock
@@ -1,9 +1,15 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.4.0
+  version: 4.5.0
 - name: mariadb-cluster
  repository: https://helm.mariadb.com/mariadb-operator
  version: 25.10.2
-digest: sha256:264725306c1d1f38140293c0820abdc7e8aa4f39764b4d91e20200705ce2ec91
+- name: volsync-target
-generated: "2025-11-30T21:05:24.649316-06:00"
+  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.5.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.5.0
 digest: sha256:6981b2c060c19bac6517578bd9b5b11a300a4deb431110bf90da317237a4a252
 generated: "2025-12-15T19:15:49.886575-06:00"
--- a/clusters/cl01tl/helm/booklore/Chart.yaml
+++ b/clusters/cl01tl/helm/booklore/Chart.yaml
@@ -16,9 +16,17 @@ dependencies:
  - name: app-template
    alias: booklore
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.4.0
+    version: 4.5.0
  - name: mariadb-cluster
    version: 25.10.2
    repository: https://helm.mariadb.com/mariadb-operator
  - name: volsync-target
    alias: volsync-target-config
    version: 0.5.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-data
    version: 0.5.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/booklore.png
-appVersion: v.1.10.0
+appVersion: v1.13.2
--- a/clusters/cl01tl/helm/booklore/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/booklore/templates/external-secret.yaml
@@ -43,234 +43,6 @@ spec:
        metadataPolicy: None
        property: psk.txt
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: booklore-config-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-config-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/booklore/booklore-config"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/digital-ocean
        metadataPolicy: None
        property: BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/digital-ocean
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: AWS_DEFAULT_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: AWS_ACCESS_KEY_ID
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: AWS_SECRET_ACCESS_KEY
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: booklore-data-backup-secret-local
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-data-backup-secret-local
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/booklore/booklore-data"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/garage-local
        metadataPolicy: None
        property: BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/garage-local
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_SECRET_KEY
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: booklore-data-backup-secret-remote
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-data-backup-secret-remote
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/booklore/booklore-data"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/garage-remote
        metadataPolicy: None
        property: BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/garage-remote
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_SECRET_KEY
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: booklore-data-backup-secret-external
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-data-backup-secret-external
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/booklore/booklore-data"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/digital-ocean
        metadataPolicy: None
        property: BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/digital-ocean
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: AWS_DEFAULT_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: AWS_ACCESS_KEY_ID
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: AWS_SECRET_ACCESS_KEY
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
--- a/clusters/cl01tl/helm/booklore/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/booklore/templates/replication-source.yaml
@@ -15,115 +15,3 @@ spec:
    keySecret: booklore-data-replication-secret
    address: volsync-rsync-tls-dst-booklore-data-replication-destination
    copyMethod: Snapshot
 ---
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: booklore-config-backup-source
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-config-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: booklore-config
  trigger:
    schedule: 0 4 * * *
  restic:
    pruneIntervalDays: 7
    repository: booklore-config-backup-secret
    retain:
      hourly: 1
      daily: 3
      weekly: 2
      monthly: 2
      yearly: 4
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
    cacheCapacity: 10Gi
 ---
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: booklore-data-backup-source-local
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-data-backup-source-local
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: booklore-data
  trigger:
    schedule: 0 2 * * *
  restic:
    pruneIntervalDays: 7
    repository: booklore-data-backup-secret-local
    retain:
      hourly: 1
      daily: 3
      weekly: 2
      monthly: 2
      yearly: 4
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
    cacheCapacity: 10Gi
 ---
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: booklore-data-backup-source-remote
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-data-backup-source-remote
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: booklore-data
  trigger:
    schedule: 0 3 * * *
  restic:
    pruneIntervalDays: 7
    repository: booklore-data-backup-secret-remote
    retain:
      hourly: 1
      daily: 3
      weekly: 2
      monthly: 2
      yearly: 4
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
    cacheCapacity: 10Gi
 ---
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: booklore-data-backup-source-external
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-data-backup-source-external
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: booklore-data
  trigger:
    schedule: 0 4 * * *
  restic:
    pruneIntervalDays: 7
    repository: booklore-data-backup-secret-external
    retain:
      hourly: 1
      daily: 3
      weekly: 2
      monthly: 2
      yearly: 4
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
    cacheCapacity: 10Gi
--- a/clusters/cl01tl/helm/booklore/values.yaml
+++ b/clusters/cl01tl/helm/booklore/values.yaml
@@ -9,7 +9,7 @@ booklore:
        main:
          image:
            repository: ghcr.io/booklore-app/booklore
-            tag: v1.12.0
+            tag: v1.13.2
            pullPolicy: IfNotPresent
          env:
            - name: TZ
@@ -41,6 +41,7 @@ booklore:
          protocol: HTTP
  persistence:
    config:
      forceRename: booklore-config
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 5Gi
@@ -51,6 +52,7 @@ booklore:
            - path: /app/data
              readOnly: false
    data:
      forceRename: booklore-data
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 10Gi
@@ -119,7 +121,8 @@ mariadb-cluster:
        suspend: false
        immediate: true
      compression: gzip
-      maxRetention: 720h
+      maxRetention: 2160h
      successfulJobsHistoryLimit: 1
      storage:
        s3:
          bucket: mariadb-backups-b230a2f5aecf080a4b372c08
@@ -134,6 +137,28 @@ mariadb-cluster:
            key: secret
          tls:
            enabled: true
    - name: backup-remote
      schedule:
        cron: "0 0 * * 0"
        suspend: false
        immediate: true
      compression: gzip
      maxRetention: 2160h
      successfulJobsHistoryLimit: 1
      storage:
        s3:
          bucket: mariadb-backups
          prefix: cl01tl/booklore
          endpoint: garage-ps10rp.boreal-beaufort.ts.net:3900
          region: us-east-1
          accessKeyIdSecretKeyRef:
            name: booklore-mariadb-cluster-backup-secret-garage
            key: access
          secretAccessKeySecretKeyRef:
            name: booklore-mariadb-cluster-backup-secret-garage
            key: secret
          tls:
            enabled: true
    - name: backup-garage
      schedule:
        cron: "0 0 * * *"
@@ -141,6 +166,7 @@ mariadb-cluster:
        immediate: true
      compression: gzip
      maxRetention: 360h
      successfulJobsHistoryLimit: 1
      storage:
        s3:
          bucket: mariadb-backups
@@ -153,3 +179,16 @@ mariadb-cluster:
          secretAccessKeySecretKeyRef:
            name: booklore-mariadb-cluster-backup-secret-garage
            key: secret
 volsync-target-config:
  pvcTarget: booklore-config
 volsync-target-data:
  pvcTarget: booklore-data
  local:
    restic:
      cacheCapacity: 10Gi
  remote:
    restic:
      cacheCapacity: 10Gi
  external:
    restic:
      cacheCapacity: 10Gi
--- a/clusters/cl01tl/helm/cert-manager/Chart.lock
+++ b/clusters/cl01tl/helm/cert-manager/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: cert-manager
  repository: https://charts.jetstack.io
-  version: v1.19.1
+  version: v1.19.2
-digest: sha256:0b1238a5552bc6d457d4b1a2a1f387a3e7f2c19f820ecb64e14d20481a1ed1ce
+digest: sha256:b02bda9b9f2fc886af11d017a27a5761513defee603f9e3aa1d7add2749b925c
-generated: "2025-12-01T20:25:17.762628-06:00"
+generated: "2025-12-10T15:01:57.196895547Z"
--- a/clusters/cl01tl/helm/cert-manager/Chart.yaml
+++ b/clusters/cl01tl/helm/cert-manager/Chart.yaml
@@ -14,7 +14,7 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: cert-manager
-    version: v1.19.1
+    version: v1.19.2
    repository: https://charts.jetstack.io
 icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/cert-manager.png
-appVersion: v1.17.2
+appVersion: v1.19.2
--- a/clusters/cl01tl/helm/cilium/Chart.yaml
+++ b/clusters/cl01tl/helm/cilium/Chart.yaml
@@ -18,4 +18,4 @@ dependencies:
    version: 1.18.4
    repository: https://helm.cilium.io/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/cilium.png
-appVersion: 1.17.3
+appVersion: 1.18.4
--- a/clusters/cl01tl/helm/cilium/values.yaml
+++ b/clusters/cl01tl/helm/cilium/values.yaml
@@ -55,6 +55,9 @@ cilium:
    metrics:
      serviceMonitor:
        enabled: true
    tls:
      auto:
        method: cronJob
    relay:
      enabled: true
      metrics:
--- a/clusters/cl01tl/helm/cloudnative-pg/Chart.lock
+++ b/clusters/cl01tl/helm/cloudnative-pg/Chart.lock
@@ -1,9 +1,9 @@
 dependencies:
 - name: cloudnative-pg
  repository: https://cloudnative-pg.io/charts/
-  version: 0.26.1
+  version: 0.27.0
 - name: plugin-barman-cloud
  repository: https://cloudnative-pg.io/charts/
  version: 0.3.1
-digest: sha256:b38e5104d77ab1737a27a2542eda958e82038443940f07b7c2cbe3b0a477e1e6
+digest: sha256:14aa30b7bf75571b03bda19af68cd50c1e7908b883351b196a260609a5b85551
-generated: "2025-12-01T20:25:20.341325-06:00"
+generated: "2025-12-10T19:25:17.952954019Z"
--- a/clusters/cl01tl/helm/cloudnative-pg/Chart.yaml
+++ b/clusters/cl01tl/helm/cloudnative-pg/Chart.yaml
@@ -16,10 +16,10 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: cloudnative-pg
-    version: 0.26.1
+    version: 0.27.0
    repository: https://cloudnative-pg.io/charts/
  - name: plugin-barman-cloud
    version: 0.3.1
    repository: https://cloudnative-pg.io/charts/
 icon: https://avatars.githubusercontent.com/u/100373852?s=200&v=4
-appVersion: 1.26.0
+appVersion: 1.28.0
--- a/clusters/cl01tl/helm/code-server/Chart.lock
+++ b/clusters/cl01tl/helm/code-server/Chart.lock
@@ -1,9 +1,12 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.4.0
+  version: 4.5.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.1
+  version: 1.23.2
-digest: sha256:dd687a71edc2f7f03cba6d5f3e3221e2bb5172ed4c00659e327c79da5c01e89f
+- name: volsync-target
-generated: "2025-12-03T06:02:20.44367742Z"
+  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.5.0
 digest: sha256:bd1cbd66ccb360978a342ee218bfb01006a486fb85c5714acd593b9e1389b151
 generated: "2025-12-15T21:50:58.968382-06:00"
--- a/clusters/cl01tl/helm/code-server/Chart.yaml
+++ b/clusters/cl01tl/helm/code-server/Chart.yaml
@@ -19,10 +19,14 @@ dependencies:
  - name: app-template
    alias: code-server
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.4.0
+    version: 4.5.0
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.1
+    version: 1.23.2
  - name: volsync-target
    alias: volsync-target-config
    version: 0.5.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/visual-studio-code.png
-appVersion: 4.100.2
+appVersion: 4.106.3
--- a/clusters/cl01tl/helm/code-server/templates/persistent-volume-claim.yaml
+++ b/clusters/cl01tl/helm/code-server/templates/persistent-volume-claim.yaml
@@ -1,17 +0,0 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: code-server-nfs-storage
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: code-server-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeMode: Filesystem
  storageClassName: nfs-client
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
--- a/clusters/cl01tl/helm/code-server/values.yaml
+++ b/clusters/cl01tl/helm/code-server/values.yaml
@@ -9,7 +9,7 @@ code-server:
        main:
          image:
            repository: ghcr.io/linuxserver/code-server
-            tag: 4.106.3@sha256:aab9520fe923b2d93dccc2c806f3dc60649c2f4a2847fcd40c942227d0f1ae8f
+            tag: 4.106.3@sha256:83793e4460090d6c46f4842ff6ab8aa26ad8a567885112bbe754b45c61935055
            pullPolicy: IfNotPresent
          env:
            - name: TZ
@@ -37,7 +37,11 @@ code-server:
          protocol: HTTP
  persistence:
    config:
-      existingClaim: code-server-nfs-storage
+      forceRename: code-server-config
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 2Gi
      retain: true
      advancedMounts:
        main:
          main:
@@ -45,3 +49,10 @@ code-server:
              readOnly: false
 cloudflared:
  existingSecretName: code-server-cloudflared-secret
 volsync-target-config:
  pvcTarget: code-server-config
  moverSecurityContext:
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
--- a/clusters/cl01tl/helm/coredns/Chart.yaml
+++ b/clusters/cl01tl/helm/coredns/Chart.yaml
@@ -18,4 +18,4 @@ dependencies:
    version: 1.45.0
    repository: https://coredns.github.io/helm
 icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/coredns.png
-appVersion: v1.12.1
+appVersion: v1.13.2
--- a/clusters/cl01tl/helm/descheduler/Chart.yaml
+++ b/clusters/cl01tl/helm/descheduler/Chart.yaml
@@ -17,4 +17,4 @@ dependencies:
    version: 0.34.0
    repository: https://kubernetes-sigs.github.io/descheduler/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
-appVersion: 0.33.0
+appVersion: 0.34.0
--- a/clusters/cl01tl/helm/descheduler/values.yaml
+++ b/clusters/cl01tl/helm/descheduler/values.yaml
@@ -39,16 +39,27 @@ descheduler:
          - name: RemovePodsViolatingNodeTaints
          - name: RemovePodsViolatingInterPodAntiAffinity
          - name: RemovePodsViolatingTopologySpreadConstraint
          - name: "HighNodeUtilization"
            args:
              thresholds:
                cpu : 80
                memory: 80
                pods: 90
              evictableNamespaces:
                exclude:
                  - "kube-system"
              evictionModes:
                - "OnlyThresholdingResources"
          - name: LowNodeUtilization
            args:
              thresholds:
-                cpu: 20
+                cpu: 30
-                memory: 20
+                memory: 30
-                pods: 20
+                pods: 50
              targetThresholds:
                cpu: 60
-                memory: 60
+                memory: 40
-                pods: 60
+                pods: 80
        plugins:
          balance:
            enabled:
--- a/clusters/cl01tl/helm/directus/Chart.lock
+++ b/clusters/cl01tl/helm/directus/Chart.lock
@@ -1,12 +1,15 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.4.0
+  version: 4.5.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.1
+  version: 1.23.2
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 6.16.0
+  version: 7.1.1
-digest: sha256:2291640ab25754ded07da90a6cb617df92262a9b33635e8a9c80adda00034937
+- name: redis-replication
-generated: "2025-12-03T06:02:33.2806347Z"
+  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.5.0
 digest: sha256:1035fe225f5439c73fdc8b498c2164bad362e0198bc2ad40eab6b5d0bae9f86d
 generated: "2025-12-15T14:37:45.474556-06:00"
--- a/clusters/cl01tl/helm/directus/Chart.yaml
+++ b/clusters/cl01tl/helm/directus/Chart.yaml
@@ -20,14 +20,17 @@ dependencies:
  - name: app-template
    alias: directus
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.4.0
+    version: 4.5.0
  - name: cloudflared
    alias: cloudflared-directus
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.1
+    version: 1.23.2
  - name: postgres-cluster
-    alias: postgres-17-cluster
+    alias: postgres-18-cluster
-    version: 6.16.0
+    version: 7.1.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: redis-replication
    version: 0.5.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/directus.png
-appVersion: 11.7.2
+appVersion: 11.14.0
--- a/clusters/cl01tl/helm/directus/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/directus/templates/external-secret.yaml
@@ -151,10 +151,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: directus-postgresql-17-cluster-backup-secret
+  name: directus-postgresql-18-cluster-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: directus-postgresql-17-cluster-backup-secret
+    app.kubernetes.io/name: directus-postgresql-18-cluster-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -181,40 +181,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: directus-postgresql-17-cluster-backup-secret-weekly
+  name: directus-postgresql-18-cluster-backup-secret-garage
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: directus-postgresql-17-cluster-backup-secret-weekly
+    app.kubernetes.io/name: directus-postgresql-18-cluster-backup-secret-garage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: ACCESS_SECRET_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
        metadataPolicy: None
        property: ACCESS_SECRET_KEY
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: directus-postgresql-17-cluster-backup-secret-garage
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: directus-postgresql-17-cluster-backup-secret-garage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
--- a/clusters/cl01tl/helm/directus/templates/redis-replication.yaml
+++ b/clusters/cl01tl/helm/directus/templates/redis-replication.yaml
@@ -1,35 +0,0 @@
 apiVersion: redis.redis.opstreelabs.in/v1beta2
 kind: RedisReplication
 metadata:
  name: redis-replication-directus
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: redis-replication-directus
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  clusterSize: 3
  podSecurityContext:
    runAsUser: 1000
    fsGroup: 1000
  kubernetesConfig:
    image: quay.io/opstree/redis:v8.2.1
    imagePullPolicy: IfNotPresent
    redisSecret:
      name: directus-redis-config
      key: password
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
  storage:
    volumeClaimTemplate:
      spec:
        storageClassName: ceph-block
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 1Gi
  redisExporter:
    enabled: true
    image: quay.io/opstree/redis-exporter:v1.76.0
--- a/clusters/cl01tl/helm/directus/templates/redis-sentinel.yaml
+++ b/clusters/cl01tl/helm/directus/templates/redis-sentinel.yaml
@@ -1,30 +0,0 @@
 apiVersion: redis.redis.opstreelabs.in/v1beta2
 kind: RedisSentinel
 metadata:
  name: redis-sentinel-directus
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: redis-sentinel-directus
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  clusterSize: 3
  podSecurityContext:
    runAsUser: 1000
    fsGroup: 1000
  redisSentinelConfig:
    redisReplicationName: redis-replication-directus
    redisReplicationPassword:
      secretKeyRef:
        name: directus-redis-config
        key: password
  kubernetesConfig:
    image: quay.io/opstree/redis-sentinel:v7.0.15
    imagePullPolicy: IfNotPresent
    redisSecret:
      name: directus-redis-config
      key: password
    resources:
      requests:
        cpu: 10m
        memory: 128Mi
--- a/clusters/cl01tl/helm/directus/templates/service-monitor.yaml
+++ b/clusters/cl01tl/helm/directus/templates/service-monitor.yaml
@@ -20,24 +20,3 @@ spec:
      bearerTokenSecret:
        name: directus-metric-token
        key: metric-token
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  name: redis-replication-directus
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: redis-replication-directus
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
    redis-operator: "true"
    env: production
 spec:
  selector:
    matchLabels:
      redis_setup_type: replication
  endpoints:
    - port: redis-exporter
      interval: 30s
      scrapeTimeout: 10s
--- a/clusters/cl01tl/helm/directus/values.yaml
+++ b/clusters/cl01tl/helm/directus/values.yaml
@@ -9,7 +9,7 @@ directus:
        main:
          image:
            repository: directus/directus
-            tag: 11.13.4
+            tag: 11.14.0
            pullPolicy: IfNotPresent
          env:
            - name: PUBLIC_URL
@@ -41,27 +41,27 @@ directus:
            - name: DB_HOST
              valueFrom:
                secretKeyRef:
-                  name: directus-postgresql-17-cluster-app
+                  name: directus-postgresql-18-cluster-app
                  key: host
            - name: DB_DATABASE
              valueFrom:
                secretKeyRef:
-                  name: directus-postgresql-17-cluster-app
+                  name: directus-postgresql-18-cluster-app
                  key: dbname
            - name: DB_PORT
              valueFrom:
                secretKeyRef:
-                  name: directus-postgresql-17-cluster-app
+                  name: directus-postgresql-18-cluster-app
                  key: port
            - name: DB_USER
              valueFrom:
                secretKeyRef:
-                  name: directus-postgresql-17-cluster-app
+                  name: directus-postgresql-18-cluster-app
                  key: user
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
-                  name: directus-postgresql-17-cluster-app
+                  name: directus-postgresql-18-cluster-app
                  key: password
            - name: SYNCHRONIZATION_STORE
              value: redis
@@ -156,59 +156,67 @@ directus:
 cloudflared-directus:
  name: cloudflared-directus
  existingSecretName: directus-cloudflared-secret
-postgres-17-cluster:
+postgres-18-cluster:
  mode: recovery
  cluster:
    storage:
      storageClass: local-path
    walStorage:
      storageClass: local-path
    monitoring:
      enabled: true
      prometheusRule:
        enabled: true
  recovery:
    method: objectStore
    objectStore:
-      destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-17-cluster
+      destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-18-cluster
      endpointURL: http://garage-main.garage:3900
      index: 1
-      endpointCredentials: directus-postgresql-17-cluster-backup-secret-garage
+      endpointCredentials: directus-postgresql-18-cluster-backup-secret-garage
  backup:
    objectStore:
      - name: external
        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/directus/directus-postgresql-17-cluster
        index: 1
        retentionPolicy: "30d"
        isWALArchiver: false
      - name: garage-local
-        destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-17-cluster
+        destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-18-cluster
        index: 1
        endpointURL: http://garage-main.garage:3900
-        endpointCredentials: directus-postgresql-17-cluster-backup-secret-garage
+        endpointCredentials: directus-postgresql-18-cluster-backup-secret-garage
        endpointCredentialsIncludeRegion: true
        retentionPolicy: "3d"
        isWALArchiver: true
      # - name: external
      #   destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/directus/directus-postgresql-18-cluster
      #   index: 1
      #   retentionPolicy: "30d"
      #   isWALArchiver: false
      # - name: garage-remote
-      #   destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-17-cluster
+      #   destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-18-cluster
      #   index: 1
      #   endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
-      #   endpointCredentials: directus-postgresql-17-cluster-backup-secret-garage
+      #   endpointCredentials: directus-postgresql-18-cluster-backup-secret-garage
      #   retentionPolicy: "30d"
      #   data:
      #     compression: bzip2
      #     jobs: 2
    scheduledBackups:
      - name: daily-backup
        suspend: false
        schedule: "0 0 0 * * *"
        backupName: external
      - name: live-backup
        suspend: false
        immediate: true
        schedule: "0 0 0 * * *"
        backupName: garage-local
      # - name: daily-backup
      #   suspend: false
      #   immediate: true
      #   schedule: "0 0 0 * * *"
      #   backupName: external
      # - name: weekly-backup
      #   suspend: false
      #   immediate: true
      #   schedule: "0 0 4 * * SAT"
      #   backupName: garage-remote
 redis-replication:
  existingSecret:
    enabled: true
    name: directus-redis-config
    key: password
  redisReplication:
    clusterSize: 3
  redisSentinel:
    enabled: true
    clusterSize: 3
--- a/clusters/cl01tl/helm/elastic-operator/Chart.yaml
+++ b/clusters/cl01tl/helm/elastic-operator/Chart.yaml
@@ -18,4 +18,4 @@ dependencies:
    version: 3.2.0
    repository: https://helm.elastic.co
 icon: https://helm.elastic.co/icons/eck.png
-appVersion: 1.26.0
+appVersion: v3.2.0
--- a/clusters/cl01tl/helm/element-web/Chart.lock
+++ b/clusters/cl01tl/helm/element-web/Chart.lock
@@ -1,9 +1,9 @@
 dependencies:
 - name: element-web
  repository: https://ananace.gitlab.io/charts
-  version: 1.4.25
+  version: 1.4.26
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.1
+  version: 1.23.2
-digest: sha256:06208f8ba47fc2e2c0e56ea2e08b3539cb4c5d3ac5eeaf22936e84925b7add90
+digest: sha256:f9196cbede894c6da6ecedd9ae05d3f1fd0e20304eca8ca38c18334a923b2235
-generated: "2025-12-03T17:03:58.859116734Z"
+generated: "2025-12-07T02:54:29.895481505Z"
--- a/clusters/cl01tl/helm/element-web/Chart.yaml
+++ b/clusters/cl01tl/helm/element-web/Chart.yaml
@@ -17,11 +17,11 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: element-web
-    version: 1.4.25
+    version: 1.4.26
    repository: https://ananace.gitlab.io/charts
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.1
+    version: 1.23.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/element.png
-appVersion: v1.11.100
+appVersion: v1.12.6
--- a/clusters/cl01tl/helm/element-web/values.yaml
+++ b/clusters/cl01tl/helm/element-web/values.yaml
@@ -2,7 +2,7 @@ element-web:
  replicaCount: 1
  image:
    repository: vectorim/element-web
-    tag: v1.12.5
+    tag: v1.12.6
    pullPolicy: IfNotPresent
  defaultServer:
    url: https://matrix.alexlebens.dev
--- a/clusters/cl01tl/helm/ephemera/Chart.lock
+++ b/clusters/cl01tl/helm/ephemera/Chart.lock
@@ -1,6 +1,9 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.4.0
+  version: 4.5.0
-digest: sha256:9900009eb6415344d8c5387371a0052259092d92f34c21774f6a6abe9f11f43e
+- name: volsync-target
-generated: "2025-11-30T21:05:32.524168-06:00"
+  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.3.0
 digest: sha256:476021b852fbbd829570bcb88309eea92bd096cb4ec79efe2d895ee0c46f1c49
 generated: "2025-12-15T21:43:24.262051-06:00"
--- a/clusters/cl01tl/helm/ephemera/Chart.yaml
+++ b/clusters/cl01tl/helm/ephemera/Chart.yaml
@@ -18,6 +18,10 @@ dependencies:
  - name: app-template
    alias: ephemera
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.4.0
+    version: 4.5.0
  - name: volsync-target
    alias: volsync-target-config
    version: 0.3.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ephemera.png
 appVersion: 1.3.1
--- a/clusters/cl01tl/helm/ephemera/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/ephemera/templates/external-secret.yaml
@@ -42,60 +42,3 @@ spec:
        key: /cl01tl/ephemera/config
        metadataPolicy: None
        property: ntfy-url
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: ephemera-config-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: ephemera-config-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/ephemera/ephemera-config"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: S3_BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: AWS_DEFAULT_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: access_key
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: secret_key
--- a/clusters/cl01tl/helm/ephemera/values.yaml
+++ b/clusters/cl01tl/helm/ephemera/values.yaml
@@ -52,7 +52,7 @@ ephemera:
        apprise-api:
          image:
            repository: caronc/apprise
-            tag: 1.2.6
+            tag: 1.3.0
            pullPolicy: IfNotPresent
          env:
            - name: TZ
@@ -82,6 +82,7 @@ ephemera:
          protocol: HTTP
  persistence:
    config:
      forceRename: ephemera
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 5Gi
@@ -105,3 +106,5 @@ ephemera:
          main:
            - path: /app/ingest
              readOnly: false
 volsync-target-config:
  pvcTarget: ephemera
--- a/clusters/cl01tl/helm/eraser/Chart.lock
+++ b/clusters/cl01tl/helm/eraser/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: eraser
  repository: https://eraser-dev.github.io/eraser/charts
-  version: 1.3.1
+  version: 1.4.1
-digest: sha256:17b561a00acc809810dccd226e7b6d757db39b34a6095dee879da761098125f9
+digest: sha256:da828de684b0cd82e99994586f3db4f55c43c01607c4d8d0e70e204c7bbbbf5b
-generated: "2025-12-01T20:25:36.491841-06:00"
+generated: "2025-12-03T22:53:20.200917773Z"
--- a/clusters/cl01tl/helm/eraser/Chart.yaml
+++ b/clusters/cl01tl/helm/eraser/Chart.yaml
@@ -14,7 +14,7 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: eraser
-    version: v1.3.1
+    version: 1.4.1
    repository: https://eraser-dev.github.io/eraser/charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
-appVersion: v1.3.1
+appVersion: v1.4.1
--- a/clusters/cl01tl/helm/external-dns/Chart.yaml
+++ b/clusters/cl01tl/helm/external-dns/Chart.yaml
@@ -19,4 +19,4 @@ dependencies:
    version: 1.19.0
    repository: https://kubernetes-sigs.github.io/external-dns/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
-appVersion: 1.16.1
+appVersion: v0.20.0
--- a/clusters/cl01tl/helm/external-secrets/Chart.lock
+++ b/clusters/cl01tl/helm/external-secrets/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: external-secrets
  repository: https://charts.external-secrets.io
-  version: 1.1.0
+  version: 1.1.1
-digest: sha256:543c98c4f4014f91b05c823444d87990dcdcd9710a0e5ccd953c5dc4e70006ee
+digest: sha256:d346563864c95c4ca3fe5f04f6b292e417069d171f5866b5af0fe84277481493
-generated: "2025-12-01T20:25:40.642486-06:00"
+generated: "2025-12-06T18:01:23.564488208Z"
--- a/clusters/cl01tl/helm/external-secrets/Chart.yaml
+++ b/clusters/cl01tl/helm/external-secrets/Chart.yaml
@@ -12,7 +12,7 @@ sources:
  - https://github.com/external-secrets/external-secrets/tree/main/deploy/charts/external-secrets
 dependencies:
  - name: external-secrets
-    version: 1.1.0
+    version: 1.1.1
    repository: https://charts.external-secrets.io
 icon: https://avatars.githubusercontent.com/u/68335991?s=48&v=4
-appVersion: 0.17.0
+appVersion: v1.1.1
--- a/clusters/cl01tl/helm/freshrss/Chart.lock
+++ b/clusters/cl01tl/helm/freshrss/Chart.lock
@@ -1,12 +1,15 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.4.0
+  version: 4.5.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.1
+  version: 1.23.2
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 6.16.0
+  version: 7.1.1
-digest: sha256:f6a701b51fe03506e02c754e02549982d5d8d27d558d8ec329c86b4f5ae24142
+- name: volsync-target
-generated: "2025-12-03T06:02:59.168313662Z"
+  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.5.0
 digest: sha256:80a27ffb18fd1a635f16e70b90c2395f2de300ed50d072a8b87353f1ec3304cb
 generated: "2025-12-15T21:47:10.578165-06:00"
--- a/clusters/cl01tl/helm/freshrss/Chart.yaml
+++ b/clusters/cl01tl/helm/freshrss/Chart.yaml
@@ -20,14 +20,18 @@ dependencies:
  - name: app-template
    alias: freshrss
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.4.0
+    version: 4.5.0
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.1
+    version: 1.23.2
  - name: postgres-cluster
-    alias: postgres-17-cluster
+    alias: postgres-18-cluster
-    version: 6.16.0
+    version: 7.1.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-data
    version: 0.5.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/freshrss.png
-appVersion: 1.26.2
+appVersion: 1.27.1
--- a/clusters/cl01tl/helm/freshrss/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/freshrss/templates/external-secret.yaml
@@ -98,67 +98,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: freshrss-data-backup-secret
+  name: freshrss-postgresql-18-cluster-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: freshrss-data-backup-secret
+    app.kubernetes.io/name: freshrss-postgresql-18-cluster-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/freshrss/freshrss-data"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: S3_BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: AWS_DEFAULT_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: access_key
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: secret_key
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: freshrss-postgresql-17-cluster-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: freshrss-postgresql-17-cluster-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -185,10 +128,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: freshrss-postgresql-17-cluster-backup-secret-garage
+  name: freshrss-postgresql-18-cluster-backup-secret-garage
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: freshrss-postgresql-17-cluster-backup-secret-garage
+    app.kubernetes.io/name: freshrss-postgresql-18-cluster-backup-secret-garage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
--- a/clusters/cl01tl/helm/freshrss/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/freshrss/templates/replication-source.yaml
@@ -1,35 +0,0 @@
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: freshrss-data-backup-source
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: freshrss-data-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: freshrss-data
  trigger:
    schedule: 0 4 * * *
  restic:
    pruneIntervalDays: 7
    repository: freshrss-data-backup-secret
    retain:
      hourly: 1
      daily: 3
      weekly: 2
      monthly: 2
      yearly: 4
    moverSecurityContext:
      runAsUser: 568
      runAsGroup: 568
      fsGroup: 568
      fsGroupChangePolicy: OnRootMismatch
      supplementalGroups:
        - 44
        - 100
        - 109
        - 65539
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
--- a/clusters/cl01tl/helm/freshrss/values.yaml
+++ b/clusters/cl01tl/helm/freshrss/values.yaml
@@ -11,7 +11,7 @@ freshrss:
            runAsUser: 0
          image:
            repository: alpine
-            tag: 3.22.2
+            tag: 3.23.0
            pullPolicy: IfNotPresent
          command:
            - /bin/sh
@@ -35,7 +35,7 @@ freshrss:
            runAsUser: 0
          image:
            repository: alpine
-            tag: 3.22.2
+            tag: 3.23.0
            pullPolicy: IfNotPresent
          command:
            - /bin/sh
@@ -59,7 +59,7 @@ freshrss:
            runAsUser: 0
          image:
            repository: alpine
-            tag: 3.22.2
+            tag: 3.23.0
            pullPolicy: IfNotPresent
          command:
            - /bin/sh
@@ -98,22 +98,22 @@ freshrss:
            - name: DB_HOST
              valueFrom:
                secretKeyRef:
-                  name: freshrss-postgresql-17-cluster-app
+                  name: freshrss-postgresql-18-cluster-app
                  key: host
            - name: DB_BASE
              valueFrom:
                secretKeyRef:
-                  name: freshrss-postgresql-17-cluster-app
+                  name: freshrss-postgresql-18-cluster-app
                  key: dbname
            - name: DB_USER
              valueFrom:
                secretKeyRef:
-                  name: freshrss-postgresql-17-cluster-app
+                  name: freshrss-postgresql-18-cluster-app
                  key: user
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
-                  name: freshrss-postgresql-17-cluster-app
+                  name: freshrss-postgresql-18-cluster-app
                  key: password
            - name: FRESHRSS_INSTALL
              value: |
@@ -163,6 +163,7 @@ freshrss:
          protocol: HTTP
  persistence:
    data:
      forceRename: freshrss-data
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 5Gi
@@ -193,59 +194,69 @@ freshrss:
              readOnly: false
 cloudflared:
  existingSecretName: freshrss-cloudflared-secret
-postgres-17-cluster:
+postgres-18-cluster:
  mode: recovery
  cluster:
    storage:
      storageClass: local-path
    walStorage:
      storageClass: local-path
    monitoring:
      enabled: true
      prometheusRule:
        enabled: true
  recovery:
    method: objectStore
    objectStore:
-      destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-17-cluster
+      destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-18-cluster
      endpointURL: http://garage-main.garage:3900
      index: 1
-      endpointCredentials: freshrss-postgresql-17-cluster-backup-secret-garage
+      endpointCredentials: freshrss-postgresql-18-cluster-backup-secret-garage
  backup:
    objectStore:
      - name: external
        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/freshrss/freshrss-postgresql-17-cluster
        index: 1
        retentionPolicy: "30d"
        isWALArchiver: false
      - name: garage-local
-        destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-17-cluster
+        destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-18-cluster
        index: 1
        endpointURL: http://garage-main.garage:3900
-        endpointCredentials: freshrss-postgresql-17-cluster-backup-secret-garage
+        endpointCredentials: freshrss-postgresql-18-cluster-backup-secret-garage
        endpointCredentialsIncludeRegion: true
        retentionPolicy: "3d"
        isWALArchiver: true
      # - name: external
      #   destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/freshrss/freshrss-postgresql-18-cluster
      #   index: 1
      #   retentionPolicy: "30d"
      #   isWALArchiver: false
      # - name: garage-remote
-      #   destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-17-cluster
+      #   destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-18-cluster
      #   index: 1
      #   endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
-      #   endpointCredentials: freshrss-postgresql-17-cluster-backup-secret-garage
+      #   endpointCredentials: freshrss-postgresql-18-cluster-backup-secret-garage
      #   retentionPolicy: "30d"
      #   data:
      #     compression: bzip2
      #     jobs: 2
    scheduledBackups:
      - name: daily-backup
        suspend: false
        schedule: "0 0 0 * * *"
        backupName: external
      - name: live-backup
        suspend: false
        immediate: true
        schedule: "0 0 0 * * *"
        backupName: garage-local
-      # - name: weekly-backup
+      # - name: daily-backup
      #   suspend: false
-      #   schedule: "0 2 4 * * SAT"
+      #   immediate: true
      #   schedule: "0 0 0 * * *"
      #   backupName: external
      # - name: weekly-backup
      #   suspend: true
      #   immediate: true
      #   schedule: "0 0 4 * * SAT"
      #   backupName: garage-remote
 volsync-target-data:
  pvcTarget: freshrss-data
  moverSecurityContext:
    runAsUser: 568
    runAsGroup: 568
    fsGroup: 568
    fsGroupChangePolicy: OnRootMismatch
    supplementalGroups:
      - 44
      - 100
      - 109
      - 65539
--- a/clusters/cl01tl/helm/garage/Chart.lock
+++ b/clusters/cl01tl/helm/garage/Chart.lock
@@ -1,6 +1,9 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.4.0
+  version: 4.5.0
-digest: sha256:7977708d7681e8d5cbc066bcda4241144b0c8b5b590be89a394740df167c90da
+- name: volsync-target
-generated: "2025-12-01T20:25:44.910074-06:00"
+  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.5.0
 digest: sha256:3d3469c5177b9501cbb34a5faf376fbe4d9b98bd033ad51ee51487a1c2f28d4e
 generated: "2025-12-15T22:10:00.495878-06:00"
--- a/clusters/cl01tl/helm/garage/Chart.yaml
+++ b/clusters/cl01tl/helm/garage/Chart.yaml
@@ -17,6 +17,10 @@ dependencies:
  - name: app-template
    alias: garage
    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.4.0
+    version: 4.5.0
  - name: volsync-target
    alias: volsync-target-db
    version: 0.5.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: v2.1.0
--- a/clusters/cl01tl/helm/garage/values.yaml
+++ b/clusters/cl01tl/helm/garage/values.yaml
@@ -123,9 +123,10 @@ garage:
              mountPropagation: None
              subPath: garage.toml
    db:
      forceRename: garage-db
      storageClass: ceph-block
      accessMode: ReadWriteOnce
-      size: 10Gi
+      size: 50Gi
      retain: true
      advancedMounts:
        main:
@@ -152,3 +153,12 @@ garage:
          main:
            - path: /var/lib/garage/snapshots
              readOnly: false
 volsync-target-db:
  pvcTarget: garage-db
  local:
    enabled: false
  remote:
    restic:
      cacheCapacity: 10Gi
  external:
    enabled: false
--- a/clusters/cl01tl/helm/gatus/Chart.lock
+++ b/clusters/cl01tl/helm/gatus/Chart.lock
@@ -4,6 +4,9 @@ dependencies:
  version: 1.4.4
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 6.16.0
+  version: 7.1.1
-digest: sha256:9424c70bc46b5582f19b695196586546c69862ccca8950b906d5532cf03c7792
+- name: volsync-target
-generated: "2025-12-01T19:55:44.159963-06:00"
+  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.5.0
 digest: sha256:367bfee3e6811bfd4591cf76f09a419f312007d797b83311e76c8d01318e73fe
 generated: "2025-12-15T22:11:48.014486-06:00"
--- a/clusters/cl01tl/helm/gatus/Chart.yaml
+++ b/clusters/cl01tl/helm/gatus/Chart.yaml
@@ -21,8 +21,12 @@ dependencies:
    repository: https://twin.github.io/helm-charts
    version: 1.4.4
  - name: postgres-cluster
-    alias: postgres-17-cluster
+    alias: postgres-18-cluster
-    version: 6.16.0
+    version: 7.1.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-data
    version: 0.5.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/gatus.png
-appVersion: v5.12.0
+appVersion: v5.33.0
--- a/clusters/cl01tl/helm/gatus/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/gatus/templates/external-secret.yaml
@@ -54,10 +54,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: gatus-postgresql-17-cluster-backup-secret
+  name: gatus-postgresql-18-cluster-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: gatus-postgresql-17-cluster-backup-secret
+    app.kubernetes.io/name: gatus-postgresql-18-cluster-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -84,10 +84,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: gatus-postgresql-17-cluster-backup-secret-garage
+  name: gatus-postgresql-18-cluster-backup-secret-garage
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: gatus-postgresql-17-cluster-backup-secret-garage
+    app.kubernetes.io/name: gatus-postgresql-18-cluster-backup-secret-garage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
--- a/clusters/cl01tl/helm/gatus/values.yaml
+++ b/clusters/cl01tl/helm/gatus/values.yaml
@@ -36,27 +36,27 @@ gatus:
    POSTGRES_USER:
      valueFrom:
        secretKeyRef:
-          name: gatus-postgresql-17-cluster-app
+          name: gatus-postgresql-18-cluster-app
          key: username
    POSTGRES_PASSWORD:
      valueFrom:
        secretKeyRef:
-          name: gatus-postgresql-17-cluster-app
+          name: gatus-postgresql-18-cluster-app
          key: password
    POSTGRES_HOST:
      valueFrom:
        secretKeyRef:
-          name: gatus-postgresql-17-cluster-app
+          name: gatus-postgresql-18-cluster-app
          key: host
    POSTGRES_PORT:
      valueFrom:
        secretKeyRef:
-          name: gatus-postgresql-17-cluster-app
+          name: gatus-postgresql-18-cluster-app
          key: port
    POSTGRES_DB:
      valueFrom:
        secretKeyRef:
-          name: gatus-postgresql-17-cluster-app
+          name: gatus-postgresql-18-cluster-app
          key: dbname
  resources:
    requests:
@@ -122,9 +122,15 @@ gatus:
      - name: jellyfin
        url: https://jellyfin.alexlebens.net
        <<: *defaults
      - name: jellyfin-vue
        url: https://jellyfin-vue.alexlebens.net
        <<: *defaults
      - name: overseerr
        url: https://overseerr.alexlebens.net
        <<: *defaults
      - name: seerr
        url: https://seerr.alexlebens.net
        <<: *defaults
      - name: yamtrack
        url: https://yamtrack.alexlebens.net
        <<: *defaults
@@ -140,6 +146,9 @@ gatus:
      - name: audiobookshelf
        url: https://audiobookshelf.alexlebens.net
        <<: *defaults
      - name: booklore
        url: https://booklore.alexlebens.net
        <<: *defaults
      - name: home-assistant
        url: https://home-assistant.alexlebens.net
        <<: *defaults
@@ -245,8 +254,8 @@ gatus:
      - name: ceph
        url: https://ceph.alexlebens.net
        <<: *defaults
-      - name: pgadmin
+      - name: garage
-        url: https://pgadmin.alexlebens.net
+        url: https://garage-webui.alexlebens.net
        <<: *defaults
      - name: whodb
        url: https://whodb.alexlebens.net
@@ -254,6 +263,29 @@ gatus:
      - name: vault
        url: https://vault.alexlebens.net
        <<: *defaults
      - name: backrest
        url: https://backrest.alexlebens.net
        <<: *defaults
      - name: qui
        url: https://qui.alexlebens.net
        <<: *defaults
      - name: qbittorrent
        url: https://qbittorrent.alexlebens.net
        <<: *defaults
      - name: prowlarr
        url: https://prowlarr.alexlebens.net
        <<: *defaults
      - name: huntarr
        url: https://huntarr.alexlebens.net
        <<: *defaults
      - name: bazarr
        url: https://bazarr.alexlebens.net
        <<: *defaults
        conditions:
          - "[STATUS] == 401"
      - name: tdarr
        url: https://tdarr.alexlebens.net
        <<: *defaults
      - name: sonarr
        url: https://sonarr.alexlebens.net
        <<: *defaults
@@ -284,25 +316,11 @@ gatus:
      - name: slskd
        url: https://slskd.alexlebens.net
        <<: *defaults
-      - name: qui
+      - name: ephemera
-        url: https://qui.alexlebens.net
+        url: https://ephemera.alexlebens.net
        <<: *defaults
-      - name: qbittorrent
+      - name: listenarr
-        url: https://qbittorrent.alexlebens.net
+        url: https://listenarr.alexlebens.net
        <<: *defaults
      - name: prowlarr
        url: https://prowlarr.alexlebens.net
        <<: *defaults
      - name: bazarr
        url: https://bazarr.alexlebens.net
        <<: *defaults
        conditions:
          - "[STATUS] == 401"
      - name: huntarr
        url: https://huntarr.alexlebens.net
        <<: *defaults
      - name: tdarr
        url: https://tdarr.alexlebens.net
        <<: *defaults
      - name: www
        url: https://www.alexlebens.dev
@@ -347,77 +365,67 @@ gatus:
        url: https://codeserver.alexlebens.dev
        <<: *defaults
        group: external
      - name: authentik
        url: https://auth.alexlebens.dev
        <<: *defaults
        group: external
      - name: public homepage
        url: https://home.alexlebens.dev
        <<: *defaults
        group: external
-      - name: discord
+postgres-18-cluster:
        group: public
        url: https://discord.com/app
        conditions:
          - "[STATUS] == 200"
          - "[RESPONSE_TIME] < 400"
        interval: 10s
      - name: reddit
        group: public
        url: https://reddit.com
        conditions:
          - "[STATUS] == 200"
          - "[RESPONSE_TIME] < 400"
        interval: 10s
 postgres-17-cluster:
  mode: recovery
  cluster:
    storage:
      storageClass: local-path
    walStorage:
      storageClass: local-path
    monitoring:
      enabled: true
      prometheusRule:
        enabled: true
  recovery:
    method: objectStore
    objectStore:
-      destinationPath: s3://postgres-backups/cl01tl/gatus/gatus-postgresql-17-cluster
+      destinationPath: s3://postgres-backups/cl01tl/gatus/gatus-postgresql-18-cluster
      endpointURL: http://garage-main.garage:3900
      index: 1
-      endpointCredentials: gatus-postgresql-17-cluster-backup-secret-garage
+      endpointCredentials: gatus-postgresql-18-cluster-backup-secret-garage
  backup:
    objectStore:
      - name: external
        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/gatus/gatus-postgresql-17-cluster
        index: 2
        retentionPolicy: "30d"
        isWALArchiver: false
      - name: garage-local
-        destinationPath: s3://postgres-backups/cl01tl/gatus/gatus-postgresql-17-cluster
+        destinationPath: s3://postgres-backups/cl01tl/gatus/gatus-postgresql-18-cluster
        index: 1
        endpointURL: http://garage-main.garage:3900
-        endpointCredentials: gatus-postgresql-17-cluster-backup-secret-garage
+        endpointCredentials: gatus-postgresql-18-cluster-backup-secret-garage
        endpointCredentialsIncludeRegion: true
        retentionPolicy: "3d"
        isWALArchiver: true
      # - name: external
      #   destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/gatus/gatus-postgresql-18-cluster
      #   index: 1
      #   retentionPolicy: "30d"
      #   isWALArchiver: false
      # - name: garage-remote
-      #   destinationPath: s3://postgres-backups/cl01tl/gatus/gatus-postgresql-17-cluster
+      #   destinationPath: s3://postgres-backups/cl01tl/gatus/gatus-postgresql-18-cluster
      #   index: 1
      #   endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
-      #   endpointCredentials: gatus-postgresql-17-cluster-backup-secret-garage
+      #   endpointCredentials: gatus-postgresql-18-cluster-backup-secret-garage
      #   retentionPolicy: "30d"
      #   data:
      #     compression: bzip2
      #     jobs: 2
    scheduledBackups:
      - name: daily-backup
        suspend: false
        schedule: "0 0 0 * * *"
        backupName: external
      - name: live-backup
        suspend: false
        immediate: true
        schedule: "0 0 0 * * *"
        backupName: garage-local
-      # - name: weekly-backup
+      # - name: daily-backup
      #   suspend: false
      #   immediate: true
      #   schedule: "0 0 0 * * *"
      #   backupName: external
      # - name: weekly-backup
      #   suspend: true
      #   immediate: true
      #   schedule: "0 0 4 * * SAT"
      #   backupName: garage-remote
 volsync-target-data:
  pvcTarget: gatus
--- a/clusters/cl01tl/helm/generic-device-plugin/Chart.lock
+++ b/clusters/cl01tl/helm/generic-device-plugin/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: generic-device-plugin
  repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-  version: 0.20.3
+  version: 0.20.7
-digest: sha256:70771f4cfa2fa64d06b94cd60f51b1ae36da429232017954d77e675e1df39a56
+digest: sha256:62b0fc210d0c87dd396b7b12df9221d1a0351d605ea0cfab995ada58ff26a7bb
-generated: "2025-12-03T00:32:22.249565107Z"
+generated: "2025-12-16T00:20:50.401681968Z"
--- a/clusters/cl01tl/helm/generic-device-plugin/Chart.yaml
+++ b/clusters/cl01tl/helm/generic-device-plugin/Chart.yaml
@@ -15,6 +15,6 @@ maintainers:
 dependencies:
  - name: generic-device-plugin
    repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-    version: 0.20.3
+    version: 0.20.7
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: 1.0.0
--- a/clusters/cl01tl/helm/gitea/Chart.lock
+++ b/clusters/cl01tl/helm/gitea/Chart.lock
@@ -5,17 +5,20 @@ dependencies:
 - name: gitea-actions
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.2.1
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.4.0
 - name: meilisearch
  repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.17.1
+  version: 0.18.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.1
+  version: 1.23.2
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 6.16.0
+  version: 7.1.1
-digest: sha256:780521d4d2340f3804a54d46b8e05c967868db273d53173ea7c457c299508b62
+- name: redis-replication
-generated: "2025-12-03T06:03:13.680747765Z"
+  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.5.0
 - name: redis-replication
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.5.0
 digest: sha256:6ba40bb2558ce298d05c6330d3eb34a6beae2b22f9c100649d6bba11efc5092d
 generated: "2025-12-15T23:46:50.99338-06:00"
--- a/clusters/cl01tl/helm/gitea/Chart.yaml
+++ b/clusters/cl01tl/helm/gitea/Chart.yaml
@@ -31,20 +31,28 @@ dependencies:
  - name: gitea-actions
    repository: oci://harbor.alexlebens.net/helm-charts
    version: 0.2.1
  - name: app-template
    alias: backup
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.4.0
  - name: meilisearch
-    version: 0.17.1
+    version: 0.18.0
    repository: https://meilisearch.github.io/meilisearch-kubernetes
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.1
+    version: 1.23.2
  - name: postgres-cluster
-    alias: postgres-17-cluster
+    alias: postgres-18-cluster
-    version: 6.16.0
+    version: 7.1.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: redis-replication
    alias: redis-replication-gitea
    version: 0.5.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: redis-replication
    alias: redis-replication-renovate
    version: 0.5.0
    repository: oci://harbor.alexlebens.net/helm-charts
  # - name: volsync-target
  #   alias: volsync-target-storage
  #   version: 0.5.0
  #   repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/gitea.png
-appVersion: 1.23.7
+appVersion: 1.25.2
--- a/Show More
+++ b/Show More