Merge pull request 'feat: change audit' (#6018) from tmp/openbao-6 into main

Reviewed-on: #6018

.gitea/workflows/renovate.yaml

@@ -13,7 +13,7 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.123.4@sha256:118803cb3c32cdc39ff654c18baabf30f214d4158873277a154ec815d85ceb1d
+    container: ghcr.io/renovatebot/renovate:43.125.1@sha256:c85cf1a918a3deaaed3d60ffb885ae8b0afaf9eb43effef0e857a2fe246a234a
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

clusters/cl01tl/helm/argocd/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 9.5.0
+  version: 9.5.1
-digest: sha256:69daada0822f796cd49eeda2d9e39dd5c0c42bb61b6898af68123c8c49f25fa1
+digest: sha256:52a9bcfdc287dac30b8833cd34654b7e62c864aa3d23bda7644a8acf5f75eb78
-generated: "2026-04-08T22:05:49.003208408Z"
+generated: "2026-04-16T15:57:15.168206017Z"

clusters/cl01tl/helm/argocd/Chart.yaml

@@ -13,8 +13,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 9.5.0
+    version: 9.5.1
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-cd
-appVersion: v3.3.6
+appVersion: v3.3.7

clusters/cl01tl/helm/garage/Chart.yaml

@@ -21,4 +21,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/garage.png
 # renovate: datasource=docker depName=dxflrs/garage
-appVersion: v2.2.0
+appVersion: v2.3.0

clusters/cl01tl/helm/garage/values.yaml

@@ -21,7 +21,7 @@ garage:
         main:
           image:
             repository: dxflrs/garage
-            tag: v2.2.0@sha256:45a61ce3f7c9c24fc23d9ed2b09b27ed560ab87b34605d175d5c588f539c24e4
+            tag: v2.3.0@sha256:866bd13ed2038ba7e7190e840482bc27234c4afaf77be8cfa439ae088c1e4690
           envFrom:
             - secretRef:
                 name: garage-token-secret
@@ -50,7 +50,7 @@ garage:
         main:
           image:
             repository: dxflrs/garage
-            tag: v2.2.0@sha256:45a61ce3f7c9c24fc23d9ed2b09b27ed560ab87b34605d175d5c588f539c24e4
+            tag: v2.3.0@sha256:866bd13ed2038ba7e7190e840482bc27234c4afaf77be8cfa439ae088c1e4690
           envFrom:
             - secretRef:
                 name: garage-token-secret
@@ -79,7 +79,7 @@ garage:
         main:
           image:
             repository: dxflrs/garage
-            tag: v2.2.0@sha256:45a61ce3f7c9c24fc23d9ed2b09b27ed560ab87b34605d175d5c588f539c24e4
+            tag: v2.3.0@sha256:866bd13ed2038ba7e7190e840482bc27234c4afaf77be8cfa439ae088c1e4690
           envFrom:
             - secretRef:
                 name: garage-token-secret

clusters/cl01tl/helm/gitea/Chart.lock

@@ -4,10 +4,10 @@ dependencies:
   version: 12.5.3
 - name: actions
   repository: https://dl.gitea.com/charts/
-  version: 0.0.5
+  version: 0.1.0
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.31.0
+  version: 0.32.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.5.0
@@ -23,5 +23,5 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:3b2cd7914718ca5857531c466deb3b7f88a49ce4d67484efcffac7e5accf5263
+digest: sha256:2144d55ea34ba25bd81c1e479ee5cd27097fafb5676b96e63aa0e32ad2868925
-generated: "2026-04-15T18:58:48.48174558Z"
+generated: "2026-04-16T20:09:26.031592859Z"

clusters/cl01tl/helm/gitea/Chart.yaml

@@ -31,9 +31,9 @@ dependencies:
   - name: actions
     alias: gitea-actions
     repository: https://dl.gitea.com/charts/
-    version: 0.0.5
+    version: 0.1.0
   - name: meilisearch
-    version: 0.31.0
+    version: 0.32.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/helm/gitea/values.yaml

@@ -194,7 +194,7 @@ gitea-actions:
       registry: docker.io
       repository: gitea/act_runner
       # renovate: datasource=docker depName=gitea/act_runner
-      tag: 0.3.1@sha256:c2a169c5e99864c25e32527cef3d82203225e09558773022bf3dc164a2e6d762
+      tag: 0.4.0@sha256:e7364b8252e74d5eb047abe64c98a856da37d9dad848af51e011b249206b36ba
       extraVolumeMounts:
         - name: workspace-vol
           mountPath: /workspace

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -23,7 +23,7 @@ home-assistant:
         code-server:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.115.0-ls331@sha256:308f49acac8734542560f797d79b15e4c872c4d3f97d1b22862633fcce2af62a
+            tag: 4.116.0-ls333@sha256:4620adace18935dd6ca79d77e3bc1c379e21875392192f970cf5d6b0fb4aefcd
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/houndarr/Chart.yaml

@@ -25,4 +25,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/houndarr.png
 # renovate: datasource=github-releases depName=av1155/houndarr
-appVersion: v1.7.0
+appVersion: v1.8.0

clusters/cl01tl/helm/houndarr/values.yaml

@@ -8,7 +8,7 @@ houndarr:
         main:
           image:
             repository: ghcr.io/av1155/houndarr
-            tag: v1.7.0@sha256:8ae2a8b86497cbc54d11591c12220f3be3319039c2bdd0c8b041b2b7c2fd7943
+            tag: v1.8.0@sha256:6d213dadb625e0cebdd6e28358e2815f9ceccf133bb5469b6bc837cf1a70c9e2
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/jellyfin/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.6.2
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.31.0
+  version: 0.32.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:ea0f20c4c1b5566288185283141ece9938f8bbce246e27ec464cb1e6fd376fba
+digest: sha256:09e0de3cf33b4b463b07237d547172ad72fcc77c0fcb8e5ed7542f9ee3b1df3a
-generated: "2026-04-14T17:48:23.813297015Z"
+generated: "2026-04-16T14:10:45.330521031Z"

clusters/cl01tl/helm/jellyfin/Chart.yaml

@@ -22,7 +22,7 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
   - name: meilisearch
-    version: 0.31.0
+    version: 0.32.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: volsync-target
     alias: volsync-target-config

clusters/cl01tl/helm/karakeep/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 4.6.2
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.31.0
+  version: 0.32.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.5.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:f0f26138eeca6430c2b9ad7dc6d6ad8467b0db2a5660015b2755efc802e8ac84
+digest: sha256:a5074b9aa3d0ad4e8e3f0d5d10e92e7112bf1fd263d6bade8ae47e36d544cb6d
-generated: "2026-04-14T17:48:43.81459819Z"
+generated: "2026-04-16T14:11:10.620563905Z"

clusters/cl01tl/helm/karakeep/Chart.yaml

@@ -23,7 +23,7 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
   - name: meilisearch
-    version: 0.31.0
+    version: 0.32.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,7 +1,7 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 83.4.3
+  version: 83.5.0
 - name: prometheus-operator-crds
   repository: oci://ghcr.io/prometheus-community/charts
   version: 28.0.1
@@ -11,5 +11,5 @@ dependencies:
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.6.1
-digest: sha256:3396044aeb04c8a204c50941528e7292ece35349445cb86632eac5dcb2200447
+digest: sha256:555ebcb0a43ef44e1c0eb4b0603a54027e757eb24c6041e0051075641656fdd2
-generated: "2026-04-15T18:45:01.915091109Z"
+generated: "2026-04-16T16:11:08.272959931Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 83.4.3
+    version: 83.5.0
     repository: oci://ghcr.io/prometheus-community/charts
   - name: prometheus-operator-crds
     version: 28.0.1

clusters/cl01tl/helm/libation/Chart.yaml

@@ -26,4 +26,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/libation.png
 # renovate: datasource=github-releases depName=rmcrackan/Libation
-appVersion: 13.3.3
+appVersion: 13.3.4

clusters/cl01tl/helm/libation/values.yaml

@@ -12,7 +12,7 @@ libation:
         main:
           image:
             repository: rmcrackan/libation
-            tag: 13.3.3@sha256:fbeb84916c81b654412801367b7e96796ffdba83d987a1ed5fed9896cf7cabee
+            tag: 13.3.4@sha256:eb0357e8a880ed0049dffd2a99a9d2eda322ed33b3b9e16f4fb93eb15275f396
           env:
             - name: SLEEP_TIME
               value: "-1"

clusters/cl01tl/helm/matrix-synapse/values.yaml

@@ -332,7 +332,7 @@ mautrix-whatsapp:
         main:
           image:
             repository: dock.mau.dev/mautrix/whatsapp
-            tag: v0.2603.0@sha256:b49009312361d9ea0d7090716fd09f2323f477b32bd119648c6ca2d558a3e236
+            tag: v0.2604.0@sha256:9f28c04c746af9fe8e93163489dae0f4191626e2ca02a9302df62afbeefc9eba
           resources:
             requests:
               cpu: 1m

clusters/cl01tl/helm/openbao/values.yaml

@@ -25,6 +25,15 @@ openbao:
             kind: Gateway
             name: traefik-gateway
             namespace: traefik
+      httpRoute:
+        enabled: true
+        hosts:
+          - bao.alexlebens.net
+        parentRefs:
+          - group: gateway.networking.k8s.io
+            kind: Gateway
+            name: traefik-gateway
+            namespace: traefik
     authDelegator:
       enabled: true
     livenessProbe:
@@ -68,6 +77,13 @@ openbao:
             }
           }
 
+          audit "file" "to-stdout" {
+            options {
+              file_path = "/openbao/audit/openbao_audit.log"
+              log_raw = "true"
+            }
+          }
+
           service_registration "kubernetes" {}
 
           telemetry {
@@ -125,7 +141,7 @@ openbao:
       s3Bucket: openbao-backups
       s3Uri: s3://openbao-backups
       s3ExpireDays: "30"
-      s3cmdExtraFlag: "-v"
+      s3cmdExtraFlag: "-v --no-ssl"
       baoAuthPath: kubernetes
       baoRole: bao-snapshot
 unseal:

clusters/cl01tl/helm/searxng/values.yaml

@@ -8,7 +8,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:4c6b4f3e1fc10a907a40b7eaaf5b92d50f5b4097d6fb5b02041c0f9926233b36
+            tag: latest@sha256:222b4c11534e0bd9b5ed80081680094a1d663413cbe1d142e184515c4035fc23
           env:
             - name: SEARXNG_BASE_URL
               value: http://searxng-api.searxng:8080
@@ -36,7 +36,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:4c6b4f3e1fc10a907a40b7eaaf5b92d50f5b4097d6fb5b02041c0f9926233b36
+            tag: latest@sha256:222b4c11534e0bd9b5ed80081680094a1d663413cbe1d142e184515c4035fc23
           env:
             - name: SEARXNG_BASE_URL
               value: https://searxng.alexlebens.net/

clusters/cl01tl/helm/secrets-store-csi-driver/Chart.yaml

@@ -21,4 +21,4 @@ dependencies:
     repository: https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 # renovate: datasource=github-releases depName=kubernetes-sigs/secrets-store-csi-driver
-appVersion: 0.8.1
+appVersion: v1.5.6

clusters/cl01tl/helm/seerr/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: seerr-chart
   repository: oci://ghcr.io/seerr-team/seerr
-  version: 3.4.2
+  version: 3.5.1
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:f9f2649fcd5ae23d2e8bedc81c8dec7c65464328901c4fd4e47b00549e315514
+digest: sha256:84f0e23ceedb5b4eedbad1de94ea4e18785360d2125d465ed6f2bcccd7e38e5d
-generated: "2026-04-13T18:43:39.927316242Z"
+generated: "2026-04-16T14:11:50.866475988Z"

clusters/cl01tl/helm/seerr/Chart.yaml

@@ -17,7 +17,7 @@ maintainers:
 dependencies:
   - name: seerr-chart
     repository: oci://ghcr.io/seerr-team/seerr
-    version: 3.4.2
+    version: 3.5.1
   - name: volsync-target
     alias: volsync-target-config
     version: 0.8.0

clusters/cl01tl/helm/site-documentation/values.yaml

@@ -10,7 +10,7 @@ site-documentation:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-documentation
-            tag: 0.25.0@sha256:1509b20e703617ce8e6fc78fa599a56c09be178541adc82da406632f9af15d97
+            tag: 0.26.0@sha256:fbd3167788a75a637aef0be6ef32bef685ce4af59f45e955cc6eb57ed8b1fd87
           resources:
             requests:
               cpu: 10m

clusters/cl01tl/helm/site-profile/values.yaml

@@ -10,7 +10,7 @@ site-profile:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-profile
-            tag: 3.18.1@sha256:94c120ecd381b4e1568e1fe6619b3472d58870a5a5c5da4bc4b40e0e6b6cbfb1
+            tag: 3.18.2@sha256:8deb9624b2564fabd1f5cc6822306fd198b245858317be2d9ab4ca044ae3ded5
           resources:
             requests:
               cpu: 10m

hosts/ps10rp/garage/compose.yaml

@@ -39,7 +39,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     garage:
-        image: dxflrs/garage:v2.2.0@sha256:45a61ce3f7c9c24fc23d9ed2b09b27ed560ab87b34605d175d5c588f539c24e4
+        image: dxflrs/garage:v2.3.0@sha256:866bd13ed2038ba7e7190e840482bc27234c4afaf77be8cfa439ae088c1e4690
         container_name: garage
         env_file:
             - .env