Update ghcr.io/immich-app/immich-machine-learning Docker tag to v1.136.0

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | minor | `1.17.6` -> `1.18.0` |

---

### Release Notes

<details>
<summary>cilium/cilium (cilium)</summary>

### [`v1.18.0`](https://github.com/cilium/cilium/releases/tag/v1.18.0): 1.18.0

[Compare Source](https://github.com/cilium/cilium/compare/1.17.6...1.18.0)

We are excited to announce the **[Cilium 1.18.0](https://github.com/cilium/cilium/releases/tag/v1.18.0)** release!

A total of **3298 new commits** have been contributed to this release by a growing community of over **955 developers** and over **22,000 GitHub stars**! ⭐

To keep up to date with all the latest Cilium releases, see [Announcements](https://github.com/cilium/cilium/discussions/categories/announcements)

Here's what's new in [v1.18.0](https://github.com/cilium/cilium/releases/tag/v1.18.0):

#### 🚠 Networking

- **⚖️ Load Balancing Redesign**: The service load-balancing control-plane in the Cilium agent has been redesigned to reduce memory usage and improve future extensibility of load-balancing features ([cilium/cilium#38469](https://github.com/cilium/cilium/pull/38469), [@&#8203;joamaki](https://github.com/joamaki))
- **🔌 Virtual Network Devices**: Added support for new virtual network device configurations such as VXLAN in IPsec (VinE) and IPIP tunnels ([cilium/cilium#37723](https://github.com/cilium/cilium/pull/37723), [@&#8203;ldelossa](https://github.com/ldelossa); [cilium/cilium#37346](https://github.com/cilium/cilium/pull/37346), [@&#8203;gyutaeb](https://github.com/gyutaeb))
- **Ⓜ️ Multiple Egress Gateways**: Egress Gateways policies can now direct traffic towards multiple gateway nodes ([cilium/cilium#39304](https://github.com/cilium/cilium/pull/39304), [@&#8203;carlos-abad](https://github.com/carlos-abad))
- **🚦 Ingress Rate Limiting**: The bandwidth manager now supports ingress rate limiting ([cilium/cilium#36351](https://github.com/cilium/cilium/pull/36351), [@&#8203;l1b0k](https://github.com/l1b0k))
- **📢 Multi-Device L2 Announcements**: The L2 pod announcement feature now supports multiple devices ([cilium/cilium#38198](https://github.com/cilium/cilium/pull/38198), [@&#8203;dylandreimerink](https://github.com/dylandreimerink))
- **🏢 Neighbor Subsystem Rework**: The neighbor subsystem was made more resilient through a new system that reconciles desired neighbor entries with the kernel state ([cilium/cilium#39987](https://github.com/cilium/cilium/pull/39987), [@&#8203;dylandreimerink](https://github.com/dylandreimerink))

#### 🌐 IPv6

- **🚇 Tunneling Underlay**: The tunneling datapath mode now supports using an IPv6 network underlay, including when configured with IPsec transparent encryption ([cilium/cilium#38296](https://github.com/cilium/cilium/pull/38296), [cilium/cilium#39497](https://github.com/cilium/cilium/pull/39497), [@&#8203;pchaigno](https://github.com/pchaigno))
- **💬 Kube Proxy Replacement**: Cilium now implements service translation when running on an IPv6 underlay ([cilium/cilium#39074](https://github.com/cilium/cilium/pull/39074), [@&#8203;pchaigno](https://github.com/pchaigno))
- **📋 Delegated IPAM**: When delegating IP address management to a third party plugin, Cilium now configures IPv6 routes for connectivity if the plugin supports IPv6 ([cilium/cilium#38249](https://github.com/cilium/cilium/pull/38249), [@&#8203;caorui-io](https://github.com/caorui-io), [@&#8203;kadevu](https://github.com/kadevu))
- **📦 IP Fragment Support**: Cilium now processes ordered IPv6 fragments to apply policy and routing functionality ([cilium/cilium#38110](https://github.com/cilium/cilium/pull/38110), [@&#8203;gentoo-root](https://github.com/gentoo-root))
- **🚪 Egress gateway policies** can now match IPv6 address ranges ([cilium/cilium#38452](https://github.com/cilium/cilium/pull/38452), [@&#8203;rgo3](https://github.com/rgo3))

#### 🛡️ Policy & Observability

- **🏷️ Policy Names in Hubble-CLI**: Show the names of (C)CNPs that allowed or denied traffic when monitoring flows in Hubble ([cilium/cilium#39453](https://github.com/cilium/cilium/pull/39453), [@&#8203;antonipp](https://github.com/antonipp))
- **📝 Policy Log Fields**: A new free-text log field is added to policies, which is exposed in Hubble flows for easy correlation and searching ([cilium/cilium#39902](https://github.com/cilium/cilium/pull/39902), [@&#8203;squeed](https://github.com/squeed))
- **🛰️ Encapsulated Traffic Decoding**: Hubble decodes encapsulated traffic for deeper introspection into traffic flows ([cilium/cilium#37634](https://github.com/cilium/cilium/pull/37634), [@&#8203;kaworu](https://github.com/kaworu))
- **🏰 ClusterMesh Policy Restriction**: A new option allows the **cluster** entity to apply only to the local cluster in ClusterMesh environment ([cilium/cilium#39338](https://github.com/cilium/cilium/pull/39338), [@&#8203;MrFreezeex](https://github.com/MrFreezeex))
- **✨ Enhanced Policy Dashboard**: The Policy section of the Cilium Grafana dashboard has been improved to show more relevant graphs, including policy drops in both directions ([cilium/cilium#36492](https://github.com/cilium/cilium/pull/36492), [cilium/cilium#37445](https://github.com/cilium/cilium/pull/37445), [@&#8203;squeed](https://github.com/squeed))

#### 🌅 Performance

- **📊 Scale Test Results**: Cilium implements policies and services up to 45% faster in higher scale environments (Various; [@&#8203;marseel](https://github.com/marseel), [cilium/cilium#40227](https://github.com/cilium/cilium/pull/40227))
- **📦 Image Size Reduction**: Docker image sizes are reduced by 32% on arm64 architecture images ([cilium/cilium#40005](https://github.com/cilium/cilium/pull/40005), [@&#8203;marseel](https://github.com/marseel))
- **⚡ Improved Policy Performance**: The DNS proxy can process large numbers of IPs faster, and the EndpointSelector match implementation has been optimized ([cilium/cilium#39340](https://github.com/cilium/cilium/pull/39340), [@&#8203;squeed](https://github.com/squeed); [cilium/cilium#40414](https://github.com/cilium/cilium/pull/40414), [@&#8203;marseel](https://github.com/marseel))
- **🪞 EndpointSlice Mirroring for Multi-Cluster Services**: Clustermesh mirrors EndpointSlice from the local cluster instead of copying the Service selectors when using the MCS-API controller ([cilium/cilium#38596](https://github.com/cilium/cilium/pull/38596), [@&#8203;MrFreezeex](https://github.com/MrFreezeex))
- **🌐 KVStoreMesh Optimization**: Cross-cluster state distribution is optimized by only synchronizing identities keyed by ID, not by value ([cilium/cilium#36471](https://github.com/cilium/cilium/pull/36471), [@&#8203;HadrienPatte](https://github.com/HadrienPatte))
- **🧠 Egress Gateway Processing**: Egress gateway policy processing is significantly improved when matching a large number of pods ([cilium/cilium#37714](https://github.com/cilium/cilium/pull/37714), [@&#8203;giorio94](https://github.com/giorio94))
- **🗑️ Optimized Garbage Collection for Connection Tracking**: Cilium leverages batched iterators for CTMap GC ([cilium/cilium#36288](https://github.com/cilium/cilium/pull/36288), [@&#8203;tommyp1ckles](https://github.com/tommyp1ckles))

#### ⚙️ Operations

- **📈 API Server Connections at Scale**: Improve kube-apiserver connections behavior at scale through failover and setting better jitter and backoff configurations ([cilium/cilium#37601](https://github.com/cilium/cilium/pull/37601), [@&#8203;aditighag](https://github.com/aditighag); [cilium/cilium#38031](https://github.com/cilium/cilium/pull/38031), [@&#8203;orange30](https://github.com/orange30); [cilium/cilium#36648](https://github.com/cilium/cilium/pull/36648), [@&#8203;wedaly](https://github.com/wedaly))
- **🔄 ConfigMap Synchronization**: New option to automatically synchronize ConfigMap changes into the agent and report metrics for when the effective configuration is different from the desired configuration ([cilium/cilium#36510](https://github.com/cilium/cilium/pull/36510), [@&#8203;ovidiutirla](https://github.com/ovidiutirla))
- **🎓 CRD Promotion to Stable**: Promote **CiliumCIDRGroup**, **CiliumLoadBalancerIPPool** and all **BGP** CRDs to stable API ([cilium/cilium#38940](https://github.com/cilium/cilium/pull/38940), [@&#8203;christarazi](https://github.com/christarazi); [cilium/cilium#39090](https://github.com/cilium/cilium/pull/39090), [@&#8203;pippolo84](https://github.com/pippolo84); [cilium/cilium#37765](https://github.com/cilium/cilium/pull/37765), [@&#8203;rastislavs](https://github.com/rastislavs))
- **⛔ Node Taints Handling**: The cilium-operator Deployment uses a new default set of taints which avoids deploying to a drained node ([cilium/cilium#40137](https://github.com/cilium/cilium/pull/40137), [@&#8203;Murat](https://github.com/Murat) Parlakisik)
- **🪵 Migrate to Slog**: Cilium now uses slog as log library for all components ([cilium/cilium#39664](https://github.com/cilium/cilium/pull/39664), [@&#8203;aanm](https://github.com/aanm))
- **🔧 Cilium dependencies** were updated to Kubernetes v1.33, Envoy v1.34, LLVM 19.1, and CNI v1.1 ([cilium/cilium#39124](https://github.com/cilium/cilium/pull/39124), [cilium/cilium#40175](https://github.com/cilium/cilium/pull/40175), [cilium/cilium#39632](https://github.com/cilium/cilium/pull/39632), [@&#8203;sayboras](https://github.com/sayboras); [cilium/cilium#38868](https://github.com/cilium/cilium/pull/38868), [@&#8203;squeed](https://github.com/squeed))
- **🐧 Minimum Linux Requirements**: The minimum kernel version for this release series is Linux v5.10 or similar, such as RHEL 8.6 ([cilium/cilium#38308](https://github.com/cilium/cilium/pull/38308), [@&#8203;julianwiedmann](https://github.com/julianwiedmann))

#### 🕸️ Service Mesh & Gateway API

- **⛩️ Gateway API v1.3.0**: Gateway API support is bumped to v1.3.0 ([cilium/cilium#39590](https://github.com/cilium/cilium/pull/39590), [@&#8203;sayboras](https://github.com/sayboras))
- **🔗 Improved GatewayClass Configuration**: The new CiliumGatewayClassConfig object adds service type validation allows the configuration of extra settings on a per-GatewayClass level: LoadBalancerSourceRangesPolicy, ParametersRef fields. This allows Cilium to reconcile multiple GatewayClasses with different configurations ([cilium/cilium#37792](https://github.com/cilium/cilium/pull/37792), [cilium/cilium#37402](https://github.com/cilium/cilium/pull/37402), [cilium/cilium#40138](https://github.com/cilium/cilium/pull/40138), [@&#8203;sayboras](https://github.com/sayboras))
- **🚏 Multiple HTTPRoutes**: GAMMA reconciler now supports attaching multiple HTTPRoutes to the same Service ([cilium/cilium#39922](https://github.com/cilium/cilium/pull/39922), [@&#8203;youngnick](https://github.com/youngnick))
- **🪄 Route Changes Reconciliation**: Reconcile Gateway API based on all changes to routes. This allows label updates to trigger reconciliation correctly, amongst other things ([cilium/cilium#37798](https://github.com/cilium/cilium/pull/37798), [@&#8203;sayboras](https://github.com/sayboras))

#### 🏷️ IP Address Management

- **☁️ AWS Prefix Delegation**: Prefix delegation on AWS bare metal instances is now supported natively in Cilium's AWS ENI IPAM mode ([cilium/cilium#39678](https://github.com/cilium/cilium/pull/39678), [@&#8203;41ks](https://github.com/41ks))
- **🏬 Multi-Pool IPAM with KVStore**: Add support for Multi-Pool IPAM in external KVstore mode ([cilium/cilium#39638](https://github.com/cilium/cilium/pull/39638), [@&#8203;pippolo84](https://github.com/pippolo84))
- **🔐 Multi-Pool IPAM with IPSec**: Add support for Multi-Pool IPAM mode with IPSec transparent encryption in tunnel routing mode ([cilium/cilium#39442](https://github.com/cilium/cilium/pull/39442), [@&#8203;pippolo84](https://github.com/pippolo84))
- **↪️ Multi-Pool Tunnel Routing**: Add support for tunnel routing in multi-pool IPAM mode ([cilium/cilium#38483](https://github.com/cilium/cilium/pull/38483), [@&#8203;pippolo84](https://github.com/pippolo84))

#### 🛣️ BGP

- **📇 Route Aggregation**: Add support for BGP route aggregation in the control plane ([cilium/cilium#37275](https://github.com/cilium/cilium/pull/37275), [@&#8203;romanspb80](https://github.com/romanspb80))
- **🎯 Overlapping Selector Matches**: Support overlapping selector matches in **CiliumBGPAdvertisement** resources ([cilium/cilium#36414](https://github.com/cilium/cilium/pull/36414), [@&#8203;dswaffordcw](https://github.com/dswaffordcw))
- **🆔 New Router ID generation modes**: Generate router-id based on MAC addresses, or from an IP address pool ([cilium/cilium#36451](https://github.com/cilium/cilium/pull/36451), [@&#8203;yushoyamaguchi](https://github.com/yushoyamaguchi); [cilium/cilium#38300](https://github.com/cilium/cilium/pull/38300), [@&#8203;liyihuang](https://github.com/liyihuang))

#### 🧑‍💻 Development Experience

- **🧪 Test attribution**: Identify owners of test in GitHub workflow results to make it easier to connect with other developers on tricky problems ([cilium/cilium#37027](https://github.com/cilium/cilium/pull/37027), [@&#8203;Joe](https://github.com/Joe) Stringer)
- **🛏️ Policy REST API**: The Cilium policy API exposed over a local unix socket is deprecated. The other mechanisms to configure policy via Kubernetes resources or the local filesystem are preferred ([cilium/cilium#40212](https://github.com/cilium/cilium/pull/40212), [@&#8203;squeed](https://github.com/squeed))
- **🏗️ Feature Deprecation**: Deprecate underused features like Custom Calls, Recorder API and External Workloads ([cilium/cilium#38480](https://github.com/cilium/cilium/pull/38480), [cilium/cilium#39642](https://github.com/cilium/cilium/pull/39642), [cilium/cilium#37418](https://github.com/cilium/cilium/pull/37418), [@&#8203;brb](https://github.com/brb))

#### 🏢 Community

- **❤️ Production Case Studies**: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback!
  - [ByteDance](https://www.youtube.com/watch?v=cKPW67D7X10), [Canopus Networks](https://www.youtube.com/watch?v=YXl9xuIxylY), [Corner Banca](https://www.youtube.com/watch?v=HVPKSefazl4), [DB Schenker](https://www.cncf.io/case-studies/db-schenker/), [eBay](https://www.youtube.com/watch?v=xEa4KFf5FzY), [ECCO](https://www.cncf.io/case-studies/ecco/), [G-Research](https://www.youtube.com/watch?v=kjSFN34dROQ), [Social Network Company](https://cilium.io/blog/2025/04/15/tetragon-social-networking-user-story/), and [Preferred Networks](https://www.youtube.com/watch?v=n7_I4zu6f_M)
- **🇬🇧 London Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and the [Cilium Developer Summit](https://github.com/cilium/dev-summits/tree/main/2025-EU) in London
- **🇺🇸 Atlanta Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developers Summit in Atlanta, Georgia
- **👥 SIG Community Meetings**: [SIG Community](https://github.com/cilium/community/tree/main/sig-community) now meets every first and third Thursday to foster, grow, and sustain the Cilium open source community

#### 📔 Full CHANGELOG

- Full CHANGELOG.md can be found [here](https://github.com/cilium/cilium/blob/v1.18.0/CHANGELOG.md).

And finally, we would like to thank you to all contributors of Cilium that helped directly and indirectly with the project. The success of Cilium could not happen without all of you. ❤️ :people\_holding\_hands:  ❤️

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xLjMiLCJ1cGRhdGVkSW5WZXIiOiI0MS4xLjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImNoYXJ0Il19-->

Reviewed-on: #1062
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

clusters/cl01tl/applications/actual/Chart.yaml

@@ -16,6 +16,6 @@ dependencies:
   - name: app-template
     alias: actual
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/actual-budget.png
 appVersion: v25.5.0

clusters/cl01tl/applications/audiobookshelf/Chart.yaml

@@ -18,6 +18,6 @@ dependencies:
   - name: app-template
     alias: audiobookshelf
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/audiobookshelf.png
 appVersion: 2.21.0

clusters/cl01tl/applications/audiobookshelf/values.yaml

@@ -9,7 +9,7 @@ audiobookshelf:
         main:
           image:
             repository: ghcr.io/advplyr/audiobookshelf
-            tag: 2.26.1
+            tag: 2.26.3
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/bazarr/Chart.yaml

@@ -18,6 +18,6 @@ dependencies:
   - name: app-template
     alias: bazarr
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/bazarr.png
 appVersion: 1.5.2

clusters/cl01tl/applications/bazarr/values.yaml

@@ -15,7 +15,7 @@ bazarr:
         main:
           image:
             repository: ghcr.io/linuxserver/bazarr
-            tag: 1.5.2@sha256:a848b8a1d9e3b2553157ceb72cd3fc6ae2b34e71bcece24561b0944fb7922b46
+            tag: 1.5.2@sha256:911483a9ec04de93e60e649a101eabab5d7c143bcb14fcddb32161d34016e11b
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/calibre-web-automated/Chart.yaml

@@ -16,6 +16,6 @@ dependencies:
   - name: app-template
     alias: calibre-web-automated
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/calibre-web.png
 appVersion: V3.0.4

clusters/cl01tl/applications/calibre-web-automated/values.yaml

@@ -31,7 +31,7 @@ calibre-web-automated:
         main:
           image:
             repository: ghcr.io/calibrain/calibre-web-automated-book-downloader
-            tag: latest@sha256:518908641a2260249513f349eef9f30e580f8f428d1adfa830096b43a818e97b
+            tag: latest@sha256:7d01e56bfb0f0f150f89da59e4ec5627c4dc53d48d5ff5283e7e10877c737f8c
             pullPolicy: IfNotPresent
           env:
             - name: FLASK_PORT

clusters/cl01tl/applications/code-server/Chart.yaml

@@ -19,7 +19,7 @@ dependencies:
   - name: app-template
     alias: code-server
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
   - name: cloudflared
     alias: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/applications/code-server/values.yaml

@@ -9,7 +9,7 @@ code-server:
         main:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.102.1@sha256:61d3d01f1716a0dac5dec2a000a4fa8b48d3c0d9ded31860dbe994f0f6096cb5
+            tag: 4.102.2@sha256:e93e459877c47affef393e81dd6bcd591af96363c0e96748aed4980b6d12de24
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/directus/Chart.yaml

@@ -8,12 +8,10 @@ keywords:
 home: https://wiki.alexlebens.dev/s/c2d242de-dcaa-4801-86a2-c4761dc8bf9b
 sources:
   - https://github.com/directus/directus
-  - https://github.com/valkey-io/valkey
   - https://github.com/cloudflare/cloudflared
   - https://github.com/cloudnative-pg/cloudnative-pg
   - https://hub.docker.com/r/directus/directus
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
@@ -22,10 +20,7 @@ dependencies:
   - name: app-template
     alias: directus
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
-  - name: valkey
-    version: 3.0.22
-    repository: oci://harbor.alexlebens.net/proxy-registry-1.docker.io/bitnamicharts
+    version: 4.2.0
   - name: cloudflared
     alias: cloudflared-directus
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/applications/directus/templates/external-secret.yaml

@@ -68,10 +68,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: directus-valkey-config
+  name: directus-redis-config
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: directus-valkey-config
+    app.kubernetes.io/name: directus-redis-config
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -83,14 +83,14 @@ spec:
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /cl01tl/directus/valkey
+        key: /cl01tl/directus/redis
         metadataPolicy: None
         property: user
     - secretKey: password
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /cl01tl/directus/valkey
+        key: /cl01tl/directus/redis
         metadataPolicy: None
         property: password
 

clusters/cl01tl/applications/directus/templates/redis-replication.yaml

@@ -0,0 +1,35 @@
+apiVersion: redis.redis.opstreelabs.in/v1beta2
+kind: RedisReplication
+metadata:
+  name: redis-replication-directus
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-directus
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  clusterSize: 3
+  podSecurityContext:
+    runAsUser: 1000
+    fsGroup: 1000
+  kubernetesConfig:
+    image: quay.io/opstree/redis:v8.0.3
+    imagePullPolicy: IfNotPresent
+    redisSecret:
+      name: directus-redis-config
+      key: password
+    resources:
+      requests:
+        cpu: 50m
+        memory: 128Mi
+  storage:
+    volumeClaimTemplate:
+      spec:
+        storageClassName: ceph-block
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi
+  redisExporter:
+    enabled: true
+    image: quay.io/opstree/redis-exporter:v1.48.0

clusters/cl01tl/applications/directus/templates/service-monitor.yaml

@@ -20,3 +20,24 @@ spec:
       bearerTokenSecret:
         name: directus-metric-token
         key: metric-token
+
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: redis-replication-directus
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-directus
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    redis-operator: "true"
+    env: production
+spec:
+  selector:
+    matchLabels:
+      redis_setup_type: replication
+  endpoints:
+    - port: redis-exporter
+      interval: 30s
+      scrapeTimeout: 10s

clusters/cl01tl/applications/directus/values.yaml

@@ -66,18 +66,18 @@ directus:
             - name: REDIS_ENABLED
               value: true
             - name: REDIS_HOST
-              value: directus-valkey-primary
+              value: redis-replication-directus-master
             - name: REDIS_PORT
               value: 6379
             - name: REDIS_USERNAME
               valueFrom:
                 secretKeyRef:
-                  name: directus-valkey-config
+                  name: directus-redis-config
                   key: user
             - name: REDIS_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: directus-valkey-config
+                  name: directus-redis-config
                   key: password
             - name: STORAGE_LOCATIONS
               value: s3
@@ -149,30 +149,6 @@ directus:
           port: 80
           targetPort: 8055
           protocol: TCP
-valkey:
-  architecture: replication
-  auth:
-    enabled: true
-    existingSecret: directus-valkey-config
-    existingSecretPasswordKey: password
-    usePasswordFiles: false
-  primary:
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
-  replica:
-    replicaCount: 1
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
 cloudflared-directus:
   name: cloudflared-directus
   existingSecretName: directus-cloudflared-secret

clusters/cl01tl/applications/eigenfocus/Chart.yaml

@@ -16,6 +16,6 @@ dependencies:
   - name: app-template
     alias: eigenfocus
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/eigenfocus.png
 appVersion: 1.1.0

clusters/cl01tl/applications/element-web/values.yaml

@@ -2,7 +2,7 @@ element-web:
   replicaCount: 1
   image:
     repository: vectorim/element-web
-    tag: v1.11.106
+    tag: v1.11.107
     pullPolicy: IfNotPresent
   defaultServer:
     url: https://matrix.alexlebens.dev
@@ -12,8 +12,8 @@ element-web:
     disable_3pid_login: true
     brand: "Alex Lebens"
     branding:
-      welcome_background_url: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/background-4.jpg
-      auth_header_logo_url: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+      welcome_background_url: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/background-5.png
+      auth_header_logo_url: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.png
     sso_redirect_options:
       immediate: true
     default_theme: dark

clusters/cl01tl/applications/freshrss/Chart.yaml

@@ -20,7 +20,7 @@ dependencies:
   - name: app-template
     alias: freshrss
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
   - name: cloudflared
     alias: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/applications/freshrss/values.yaml

@@ -49,7 +49,29 @@ freshrss:
               git checkout;
               rm -rf /var/www/FreshRSS/extensions/xExtension-ImageProxy
               cp -r xExtension-ImageProxy /var/www/FreshRSS/extensions
-              chown -R 568:568 /var/www/FreshRSS/extensions/xExtension-YouTubeChannel2RssFeed
+              chown -R 568:568 /var/www/FreshRSS/extensions/xExtension-ImageProxy
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+        init-download-extension-3:
+          securityContext:
+            runAsUser: 0
+          image:
+            repository: alpine
+            tag: 3.22.1
+            pullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - -ec
+            - |
+              cd /tmp;
+              wget https://github.com/zimmra/xExtension-karakeep-button/archive/refs/tags/v1.1.tar.gz;
+              tar -xvzf *.tar.gz;
+              rm -rf /var/www/FreshRSS/extensions/xExtension-karakeep-button
+              mkdir /var/www/FreshRSS/extensions/xExtension-karakeep-button
+              cp -r /tmp/xExtension-karakeep-button-*/* /var/www/FreshRSS/extensions/xExtension-karakeep-button
+              chown -R 568:568 /var/www/FreshRSS/extensions/xExtension-karakeep-button
           resources:
             requests:
               cpu: 10m
@@ -163,6 +185,9 @@ freshrss:
           init-download-extension-2:
             - path: /var/www/FreshRSS/extensions
               readOnly: false
+          init-download-extension-3:
+            - path: /var/www/FreshRSS/extensions
+              readOnly: false
           main:
             - path: /var/www/FreshRSS/extensions
               readOnly: false

clusters/cl01tl/applications/home-assistant/Chart.yaml

@@ -18,6 +18,6 @@ dependencies:
   - name: app-template
     alias: home-assistant
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/home-assistant.png
 appVersion: 2025.5.2

clusters/cl01tl/applications/home-assistant/values.yaml

@@ -9,7 +9,7 @@ home-assistant:
         main:
           image:
             repository: ghcr.io/home-assistant/home-assistant
-            tag: 2025.7.2
+            tag: 2025.7.4
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -21,7 +21,7 @@ home-assistant:
         code-server:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.102.1@sha256:61d3d01f1716a0dac5dec2a000a4fa8b48d3c0d9ded31860dbe994f0f6096cb5
+            tag: 4.102.2@sha256:e93e459877c47affef393e81dd6bcd591af96363c0e96748aed4980b6d12de24
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/homepage-dev/Chart.yaml

@@ -18,7 +18,7 @@ dependencies:
   - name: app-template
     alias: homepage
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
   - name: cloudflared
     alias: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/applications/homepage-dev/values.yaml

@@ -27,18 +27,18 @@ homepage:
         docker.yaml: ""
         kubernetes.yaml: ""
         settings.yaml: |
-          favicon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+          favicon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.svg
           headerStyle: clean
           hideVersion: true
           color: zinc
           background:
-            image: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/background-4.jpg
+            image: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/background-5.png
             brightness: 50
           theme: dark
           disableCollapse: true
         widgets.yaml: |
           - logo:
-              icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+              icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.png
           - datetime:
               text_size: xl
               format:
@@ -75,7 +75,7 @@ homepage:
                   siteMonitor: https://codeserver.alexlebens.dev
                   statusStyle: dot
               - Site:
-                  icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+                  icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.png
                   description: Profile Website
                   href: https://www.alexlebens.dev
                   siteMonitor: https://www.alexlebens.dev

clusters/cl01tl/applications/homepage/Chart.yaml

@@ -16,6 +16,6 @@ dependencies:
   - name: app-template
     alias: homepage
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/homepage.png
 appVersion: v1.2.0

clusters/cl01tl/applications/homepage/values.yaml

@@ -39,12 +39,12 @@ homepage:
         kubernetes.yaml: |
           mode: cluster
         settings.yaml: |
-          favicon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+          favicon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.svg
           headerStyle: clean
           hideVersion: true
           color: zinc
           background:
-            image: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/background-4.jpg
+            image: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/background-5.png
             brightness: 50
           theme: dark
           disableCollapse: true
@@ -99,7 +99,7 @@ homepage:
                 icon: mdi-cloud-#ffffff
         widgets.yaml: |
           - logo:
-              icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+              icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.png
           - kubernetes:
               cluster:
                 show: true
@@ -182,7 +182,7 @@ homepage:
                   statusStyle: dot
           - Public:
               - Site:
-                  icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/icon_white.png
+                  icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.png
                   description: Profile Website
                   href: https://www.alexlebens.dev
                   siteMonitor: https://www.alexlebens.dev

clusters/cl01tl/applications/huntarr/Chart.yaml

@@ -16,6 +16,6 @@ dependencies:
   - name: app-template
     alias: huntarr
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/huntarr.png
 appVersion: 7.0.0

clusters/cl01tl/applications/immich/Chart.yaml

@@ -8,10 +8,8 @@ keywords:
 home: https://wiki.alexlebens.dev/s/9377ae08-2041-4b6d-bc2b-61a4f5e8faae
 sources:
   - https://github.com/immich-app/immich
-  - https://github.com/valkey-io/valkey
   - https://github.com/cloudnative-pg/cloudnative-pg
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
   - name: alexlebens
@@ -19,10 +17,7 @@ dependencies:
   - name: app-template
     alias: immich
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
-  - name: valkey
-    version: 3.0.22
-    repository: oci://harbor.alexlebens.net/proxy-registry-1.docker.io/bitnamicharts
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-16-cluster
     version: 5.1.0

clusters/cl01tl/applications/immich/templates/redis-replication.yaml

@@ -0,0 +1,32 @@
+apiVersion: redis.redis.opstreelabs.in/v1beta2
+kind: RedisReplication
+metadata:
+  name: redis-replication-immich
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-immich
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  clusterSize: 3
+  podSecurityContext:
+    runAsUser: 1000
+    fsGroup: 1000
+  kubernetesConfig:
+    image: quay.io/opstree/redis:v8.0.3
+    imagePullPolicy: IfNotPresent
+    resources:
+      requests:
+        cpu: 50m
+        memory: 128Mi
+  storage:
+    volumeClaimTemplate:
+      spec:
+        storageClassName: ceph-block
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi
+  redisExporter:
+    enabled: true
+    image: quay.io/opstree/redis-exporter:v1.48.0

clusters/cl01tl/applications/immich/templates/service-monitor.yaml

@@ -21,3 +21,24 @@ spec:
       interval: 3m
       scrapeTimeout: 1m
       path: /metrics
+
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: redis-replication-immich
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-immich
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    redis-operator: "true"
+    env: production
+spec:
+  selector:
+    matchLabels:
+      redis_setup_type: replication
+  endpoints:
+    - port: redis-exporter
+      interval: 30s
+      scrapeTimeout: 10s

clusters/cl01tl/applications/immich/values.yaml

@@ -21,7 +21,7 @@ immich:
             - name: IMMICH_MACHINE_LEARNING_URL
               value: http://immich-machine-learning.immich:3003
             - name: REDIS_HOSTNAME
-              value: immich-valkey-primary
+              value: redis-replication-immich-master
             - name: DB_VECTOR_EXTENSION
               value: pgvecto.rs
             - name: DB_HOSTNAME
@@ -99,7 +99,7 @@ immich:
         main:
           image:
             repository: ghcr.io/immich-app/immich-machine-learning
-            tag: v1.134.0
+            tag: v1.136.0
             pullPolicy: IfNotPresent
           env:
             - name: TRANSFORMERS_CACHE
@@ -188,28 +188,6 @@ immich:
           main:
             - path: /usr/src/app/upload
               readOnly: false
-valkey:
-  architecture: replication
-  auth:
-    enabled: false
-    usePasswordFiles: false
-  primary:
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
-  replica:
-    replicaCount: 1
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
 postgres-16-cluster:
   # Tensorchord
   #--- https://github.com/immich-app/immich/discussions/9060

clusters/cl01tl/applications/jellyfin/Chart.yaml

@@ -20,6 +20,6 @@ dependencies:
   - name: app-template
     alias: jellyfin
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/jellyfin.png
 appVersion: 10.10.7

clusters/cl01tl/applications/jellystat/Chart.yaml

@@ -18,7 +18,7 @@ dependencies:
   - name: app-template
     alias: jellystat
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/karakeep/Chart.yaml

@@ -1,9 +1,8 @@
 apiVersion: v2
-name: hoarder
+name: karakeep
 version: 1.0.0
 description: Karakeep
 keywords:
-  - hoarder
   - karakeep
   - bookmarks
 home: https://wiki.alexlebens.dev/s/f8177591-8253-4e21-82d5-a556f0aeafad
@@ -19,9 +18,9 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: app-template
-    alias: hoarder
+    alias: karakeep
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
   - name: meilisearch
     version: 0.14.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
@@ -30,4 +29,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
     version: 1.18.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/webp/karakeep.webp
-appVersion: 0.24.1
+appVersion: 0.26.0

clusters/cl01tl/applications/karakeep/templates/external-secret.yaml

@@ -19,6 +19,13 @@ spec:
         key: /cl01tl/karakeep/key
         metadataPolicy: None
         property: key
+    - secretKey: prometheus-token
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/karakeep/key
+        metadataPolicy: None
+        property: prometheus-token
 
 ---
 apiVersion: external-secrets.io/v1
@@ -100,10 +107,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: hoarder-data-backup-secret
+  name: karakeep-data-backup-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: hoarder-data-backup-secret
+    app.kubernetes.io/name: karakeep-data-backup-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -115,7 +122,7 @@ spec:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/hoarder/hoarder-data"
+        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/karakeep/karakeep-data"
   data:
     - secretKey: BUCKET_ENDPOINT
       remoteRef:

clusters/cl01tl/applications/karakeep/templates/object-bucket-claim.yaml

@@ -0,0 +1,11 @@
+apiVersion: objectbucket.io/v1alpha1
+kind: ObjectBucketClaim
+metadata:
+  name: ceph-bucket-karakeep
+  labels:
+    app.kubernetes.io/name: ceph-bucket-karakeep
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  generateBucketName: bucket-karakeep
+  storageClassName: ceph-bucket

clusters/cl01tl/applications/karakeep/templates/replication-source.yaml

@@ -1,19 +1,19 @@
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
-  name: hoarder-data-backup-source
+  name: karakeep-data-backup-source
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: hoarder-data-backup-source
+    app.kubernetes.io/name: karakeep-data-backup-source
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
-  sourcePVC: hoarder-data
+  sourcePVC: karakeep-data
   trigger:
     schedule: 0 4 * * *
   restic:
     pruneIntervalDays: 7
-    repository: hoarder-data-backup-secret
+    repository: karakeep-data-backup-secret
     retain:
       hourly: 1
       daily: 3

clusters/cl01tl/applications/karakeep/templates/service-monitor.yaml

@@ -0,0 +1,23 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: karakeep
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: karakeep
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  endpoints:
+    - port: http
+      interval: 30s
+      scrapeTimeout: 15s
+      path: /api/metrics
+      authorization:
+        credentials:
+          key: prometheus-token
+          name: karakeep-key-secret
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: karakeep
+      app.kubernetes.io/instance: {{ .Release.Name }}

clusters/cl01tl/applications/karakeep/values.yaml

@@ -1,4 +1,4 @@
-hoarder:
+karakeep:
   controllers:
     main:
       type: deployment
@@ -9,11 +9,13 @@ hoarder:
         main:
           image:
             repository: ghcr.io/karakeep-app/karakeep
-            tag: 0.25.0
+            tag: 0.26.0
             pullPolicy: IfNotPresent
           env:
             - name: DATA_DIR
               value: /data
+            - name: DB_WAL_MODE
+              value: true
             - name: NEXTAUTH_URL
               value: https://karakeep.alexlebens.dev/
             - name: NEXTAUTH_SECRET
@@ -21,15 +23,41 @@ hoarder:
                 secretKeyRef:
                   name: karakeep-key-secret
                   key: key
+            - name: PROMETHEUS_AUTH_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: karakeep-key-secret
+                  key: prometheus-token
+            - name: ASSET_STORE_S3_ENDPOINT
+              value: http://rook-ceph-rgw-ceph-objectstore.rook-ceph.svc:80
+            - name: ASSET_STORE_S3_REGION
+              value: us-east-1
+            - name: ASSET_STORE_S3_BUCKET
+              valueFrom:
+                configMapKeyRef:
+                  name: ceph-bucket-karakeep
+                  key: BUCKET_NAME
+            - name: ASSET_STORE_S3_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: ceph-bucket-karakeep
+                  key: AWS_ACCESS_KEY_ID
+            - name: ASSET_STORE_S3_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: ceph-bucket-karakeep
+                  key: AWS_SECRET_ACCESS_KEY
+            - name: ASSET_STORE_S3_FORCE_PATH_STYLE
+              value: true
             - name: MEILI_ADDR
-              value: http://hoarder-meilisearch.hoarder:7700
+              value: http://karakeep-meilisearch.karakeep:7700
             - name: MEILI_MASTER_KEY
               valueFrom:
                 secretKeyRef:
                   name: karakeep-meilisearch-master-key-secret
                   key: MEILI_MASTER_KEY
             - name: BROWSER_WEB_URL
-              value: http://hoarder.hoarder:9222
+              value: http://karakeep.karakeep:9222
             - name: DISABLE_SIGNUPS
               value: false
             - name: OAUTH_PROVIDER_NAME
@@ -49,13 +77,13 @@ hoarder:
                   name: karakeep-oidc-secret
                   key: AUTHENTIK_CLIENT_SECRET
             - name: OLLAMA_BASE_URL
-              value: http://ollama-server-1.ollama:11434
+              value: http://ollama-server-3.ollama:11434
             - name: OLLAMA_KEEP_ALIVE
               value: 5m
             - name: INFERENCE_TEXT_MODEL
-              value: llama3.1:8b
+              value: gemma3:4b
             - name: INFERENCE_IMAGE_MODEL
-              value: llama3.2-vision:11b
+              value: granite3.2-vision:2b
             - name: EMBEDDING_TEXT_MODEL
               value: mxbai-embed-large
             - name: INFERENCE_JOB_TIMEOUT_SEC
@@ -94,7 +122,6 @@ hoarder:
           protocol: HTTP
   persistence:
     data:
-      forceRename: hoarder-data
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 10Gi

clusters/cl01tl/applications/kiwix/Chart.yaml

@@ -16,6 +16,6 @@ dependencies:
   - name: app-template
     alias: kiwix
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kiwix-dark.png
 appVersion: 3.7.0

clusters/cl01tl/applications/libation/Chart.yaml

@@ -17,6 +17,6 @@ dependencies:
   - name: app-template
     alias: libation
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/libation.png
 appVersion: 12.4.3

clusters/cl01tl/applications/libation/values.yaml

@@ -16,7 +16,7 @@ libation:
         main:
           image:
             repository: rmcrackan/libation
-            tag: 12.4.7
+            tag: 12.4.11
             pullPolicy: IfNotPresent
           env:
             - name: SLEEP_TIME

clusters/cl01tl/applications/lidarr/Chart.yaml

@@ -21,7 +21,7 @@ dependencies:
   - name: app-template
     alias: lidarr
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/lidarr/values.yaml

@@ -15,7 +15,7 @@ lidarr:
         main:
           image:
             repository: ghcr.io/linuxserver/lidarr
-            tag: 2.12.4@sha256:d902a742ec417cc0f8fb87977f0d1e8df2c6f8dd43c96ff7b16e29c70b4776b8
+            tag: 2.12.4@sha256:2231bc5581589de7c5373b19f7f16e1a5bfa48c5a365ca9b928e232b4c985dce
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/lidatube/Chart.yaml

@@ -17,6 +17,6 @@ dependencies:
   - name: app-template
     alias: lidatube
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/lidatube.png
 appVersion: 0.2.22

clusters/cl01tl/applications/lidatube/values.yaml

@@ -13,7 +13,7 @@ lidatube:
         main:
           image:
             repository: thewicklowwolf/lidatube
-            tag: 0.2.29
+            tag: 0.2.30
             pullPolicy: IfNotPresent
           env:
             - name: PUID

clusters/cl01tl/applications/omni-tools/Chart.yaml

@@ -15,6 +15,6 @@ dependencies:
   - name: app-template
     alias: omni-tools
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/omnitools.png
 appVersion: 0.4.0

clusters/cl01tl/applications/outline/Chart.yaml

@@ -9,12 +9,10 @@ keywords:
 home: https://wiki.alexlebens.dev/s/c530c2b9-82b7-44df-b7ef-870c8b29242f
 sources:
   - https://github.com/outline/outline
-  - https://github.com/valkey-io/valkey
   - https://github.com/cloudflare/cloudflared
   - https://github.com/cloudnative-pg/cloudnative-pg
   - https://hub.docker.com/r/outlinewiki/outline
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
@@ -23,10 +21,7 @@ dependencies:
   - name: app-template
     alias: outline
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
-  - name: valkey
-    version: 3.0.22
-    repository: oci://harbor.alexlebens.net/proxy-registry-1.docker.io/bitnamicharts
+    version: 4.2.0
   - name: cloudflared
     alias: cloudflared-outline
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/applications/outline/templates/redis-replication.yaml

@@ -0,0 +1,32 @@
+apiVersion: redis.redis.opstreelabs.in/v1beta2
+kind: RedisReplication
+metadata:
+  name: redis-replication-outline
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-outline
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  clusterSize: 3
+  podSecurityContext:
+    runAsUser: 1000
+    fsGroup: 1000
+  kubernetesConfig:
+    image: quay.io/opstree/redis:v8.0.3
+    imagePullPolicy: IfNotPresent
+    resources:
+      requests:
+        cpu: 50m
+        memory: 128Mi
+  storage:
+    volumeClaimTemplate:
+      spec:
+        storageClassName: ceph-block
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi
+  redisExporter:
+    enabled: true
+    image: quay.io/opstree/redis-exporter:v1.48.0

clusters/cl01tl/applications/outline/templates/service-monitor.yaml

@@ -0,0 +1,19 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: redis-replication-outline
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-outline
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    redis-operator: "true"
+    env: production
+spec:
+  selector:
+    matchLabels:
+      redis_setup_type: replication
+  endpoints:
+    - port: redis-exporter
+      interval: 30s
+      scrapeTimeout: 10s

clusters/cl01tl/applications/outline/values.yaml

@@ -64,7 +64,7 @@ outline:
             - name: PGSSLMODE
               value: disable
             - name: REDIS_URL
-              value: redis://outline-valkey-primary.outline:6379
+              value: redis://redis-replication-outline-master.outline:6379
             - name: FILE_STORAGE
               value: s3
             - name: AWS_ACCESS_KEY_ID
@@ -142,28 +142,6 @@ outline:
           port: 3000
           targetPort: 3000
           protocol: HTTP
-valkey:
-  architecture: replication
-  auth:
-    enabled: false
-    usePasswordFiles: false
-  primary:
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
-  replica:
-    replicaCount: 1
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
 cloudflared-outline:
   existingSecretName: outline-cloudflared-secret
   name: cloudflared-outline

clusters/cl01tl/applications/overseerr/Chart.yaml

@@ -16,6 +16,6 @@ maintainers:
 dependencies:
   - name: app-template
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/overseerr.png
 appVersion: 1.34.0

clusters/cl01tl/applications/photoview/Chart.yaml

@@ -17,7 +17,7 @@ dependencies:
   - name: app-template
     alias: photoview
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/plex/Chart.yaml

@@ -21,6 +21,6 @@ dependencies:
   - name: app-template
     alias: plex
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/plex.png
 appVersion: 1.41.6

clusters/cl01tl/applications/plex/values.yaml

@@ -9,7 +9,7 @@ plex:
         main:
           image:
             repository: ghcr.io/linuxserver/plex
-            tag: 1.41.9@sha256:27303d7568496ba2faa1951d219940f00a1cd96c1d25ca204789d9fbd0153d3e
+            tag: 1.41.9@sha256:3f124bbd4d58a588187a87b75427cba35d5de05a071f2252f908abbb95edf7bb
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/postiz/Chart.yaml

@@ -8,12 +8,10 @@ keywords:
 home: https://wiki.alexlebens.dev/s/f483a06b-860b-423c-8d51-a1ce82e0fd43
 sources:
   - https://github.com/gitroomhq/postiz-app
-  - https://github.com/valkey-io/valkey
   - https://github.com/cloudflare/cloudflared
   - https://github.com/cloudnative-pg/cloudnative-pg
   - https://github.com/gitroomhq/postiz-app/pkgs/container/postiz-app
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
@@ -22,10 +20,7 @@ dependencies:
   - name: app-template
     alias: postiz
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
-  - name: valkey
-    version: 3.0.22
-    repository: oci://harbor.alexlebens.net/proxy-registry-1.docker.io/bitnamicharts
+    version: 4.2.0
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
     version: 1.18.0

clusters/cl01tl/applications/postiz/templates/external-secret.yaml

@@ -24,10 +24,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: postiz-valkey-config
+  name: postiz-redis-config
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: postiz-valkey-config
+    app.kubernetes.io/name: postiz-redis-config
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -35,27 +35,27 @@ spec:
     kind: ClusterSecretStore
     name: vault
   data:
+    - secretKey: REDIS_URL
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/postiz/redis
+        metadataPolicy: None
+        property: REDIS_URL
     - secretKey: user
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /cl01tl/postiz/valkey
+        key: /cl01tl/postiz/redis
         metadataPolicy: None
         property: user
     - secretKey: password
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /cl01tl/postiz/valkey
+        key: /cl01tl/postiz/redis
         metadataPolicy: None
         property: password
-    - secretKey: REDIS_URL
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/postiz/valkey
-        metadataPolicy: None
-        property: REDIS_URL
 
 ---
 apiVersion: external-secrets.io/v1

clusters/cl01tl/applications/postiz/templates/redis-replication.yaml

@@ -0,0 +1,35 @@
+apiVersion: redis.redis.opstreelabs.in/v1beta2
+kind: RedisReplication
+metadata:
+  name: redis-replication-postiz
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-postiz
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  clusterSize: 3
+  podSecurityContext:
+    runAsUser: 1000
+    fsGroup: 1000
+  kubernetesConfig:
+    image: quay.io/opstree/redis:v8.0.3
+    imagePullPolicy: IfNotPresent
+    redisSecret:
+      name: postiz-redis-config
+      key: password
+    resources:
+      requests:
+        cpu: 50m
+        memory: 128Mi
+  storage:
+    volumeClaimTemplate:
+      spec:
+        storageClassName: ceph-block
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi
+  redisExporter:
+    enabled: true
+    image: quay.io/opstree/redis-exporter:v1.48.0

clusters/cl01tl/applications/postiz/templates/service-monitor.yaml

@@ -0,0 +1,19 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: redis-replication-postiz
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-postiz
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    redis-operator: "true"
+    env: production
+spec:
+  selector:
+    matchLabels:
+      redis_setup_type: replication
+  endpoints:
+    - port: redis-exporter
+      interval: 30s
+      scrapeTimeout: 10s

clusters/cl01tl/applications/postiz/values.yaml

@@ -9,7 +9,7 @@ postiz:
         main:
           image:
             repository: ghcr.io/gitroomhq/postiz-app
-            tag: v1.65.1
+            tag: v2.0.8
             pullPolicy: IfNotPresent
           env:
             - name: MAIN_URL
@@ -31,7 +31,7 @@ postiz:
             - name: REDIS_URL
               valueFrom:
                 secretKeyRef:
-                  name: postiz-valkey-config
+                  name: postiz-redis-config
                   key: REDIS_URL
             - name: BACKEND_INTERNAL_URL
               value: http://localhost:3000
@@ -102,30 +102,6 @@ postiz:
           main:
             - path: /uploads
               readOnly: false
-valkey:
-  architecture: replication
-  auth:
-    enabled: true
-    existingSecret: postiz-valkey-config
-    existingSecretPasswordKey: password
-    usePasswordFiles: false
-  primary:
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
-  replica:
-    replicaCount: 1
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
 cloudflared:
   name: cloudflared-postiz
   existingSecretName: postiz-cloudflared-secret

clusters/cl01tl/applications/prowlarr/Chart.yaml

@@ -18,6 +18,6 @@ dependencies:
   - name: app-template
     alias: prowlarr
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prowlarr.png
 appVersion: 1.35.1

clusters/cl01tl/applications/prowlarr/values.yaml

@@ -20,7 +20,7 @@ prowlarr:
         main:
           image:
             repository: ghcr.io/linuxserver/prowlarr
-            tag: 1.37.0@sha256:89eac63d2099477094df8c2329a6a750b8b5e382f8975dd18e7861678b55cca4
+            tag: 1.37.0@sha256:d2462d470891c70073e31d158657a9b247b317c90238c40534d8be8f98671057
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/radarr-4k/Chart.yaml

@@ -24,7 +24,7 @@ dependencies:
   - name: app-template
     alias: radarr-4k
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/radarr-4k/values.yaml

@@ -15,7 +15,7 @@ radarr-4k:
         main:
           image:
             repository: ghcr.io/linuxserver/radarr
-            tag: 5.26.2@sha256:dd31e90d63f2e4a941893aaa7648dfb42fd12ccd242823fc4e22d1904bc0eca9
+            tag: 5.26.2@sha256:ae89f05ad7023258730ed62f5fcca63aab1e27ee5adcca1edb55d716f7cef356
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/radarr-anime/Chart.yaml

@@ -24,7 +24,7 @@ dependencies:
   - name: app-template
     alias: radarr-anime
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/radarr-anime/values.yaml

@@ -13,7 +13,7 @@ radarr-anime:
         main:
           image:
             repository: ghcr.io/linuxserver/radarr
-            tag: 5.26.2@sha256:dd31e90d63f2e4a941893aaa7648dfb42fd12ccd242823fc4e22d1904bc0eca9
+            tag: 5.26.2@sha256:ae89f05ad7023258730ed62f5fcca63aab1e27ee5adcca1edb55d716f7cef356
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/radarr-standup/Chart.yaml

@@ -23,7 +23,7 @@ dependencies:
   - name: app-template
     alias: radarr-standup
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/radarr-standup/values.yaml

@@ -13,7 +13,7 @@ radarr-standup:
         main:
           image:
             repository: ghcr.io/linuxserver/radarr
-            tag: 5.26.2@sha256:dd31e90d63f2e4a941893aaa7648dfb42fd12ccd242823fc4e22d1904bc0eca9
+            tag: 5.26.2@sha256:ae89f05ad7023258730ed62f5fcca63aab1e27ee5adcca1edb55d716f7cef356
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/radarr/Chart.yaml

@@ -23,7 +23,7 @@ dependencies:
   - name: app-template
     alias: radarr
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/radarr/values.yaml

@@ -15,7 +15,7 @@ radarr:
         main:
           image:
             repository: ghcr.io/linuxserver/radarr
-            tag: 5.26.2@sha256:dd31e90d63f2e4a941893aaa7648dfb42fd12ccd242823fc4e22d1904bc0eca9
+            tag: 5.26.2@sha256:ae89f05ad7023258730ed62f5fcca63aab1e27ee5adcca1edb55d716f7cef356
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/roundcube/Chart.yaml

@@ -18,7 +18,7 @@ dependencies:
   - name: app-template
     alias: roundcube
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/searxng/Chart.yaml

@@ -8,18 +8,13 @@ keywords:
 home: https://wiki.alexlebens.dev/s/6c6da68a-8725-4439-93c8-990ce824be54
 sources:
   - https://github.com/searxng/searxng
-  - https://github.com/valkey-io/valkey
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
 maintainers:
   - name: alexlebens
 dependencies:
   - name: app-template
     alias: searxng
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
-  - name: valkey
-    version: 3.0.22
-    repository: oci://harbor.alexlebens.net/proxy-registry-1.docker.io/bitnamicharts
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/searxng.png
 appVersion: 1.0.0

clusters/cl01tl/applications/searxng/templates/redis-replication.yaml

@@ -0,0 +1,32 @@
+apiVersion: redis.redis.opstreelabs.in/v1beta2
+kind: RedisReplication
+metadata:
+  name: redis-replication-searxng
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-searxng
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  clusterSize: 3
+  podSecurityContext:
+    runAsUser: 1000
+    fsGroup: 1000
+  kubernetesConfig:
+    image: quay.io/opstree/redis:v8.0.3
+    imagePullPolicy: IfNotPresent
+    resources:
+      requests:
+        cpu: 50m
+        memory: 128Mi
+  storage:
+    volumeClaimTemplate:
+      spec:
+        storageClassName: ceph-block
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi
+  redisExporter:
+    enabled: true
+    image: quay.io/opstree/redis-exporter:v1.48.0

clusters/cl01tl/applications/searxng/templates/service-monitor.yaml

@@ -0,0 +1,19 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: redis-replication-searxng
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-searxng
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    redis-operator: "true"
+    env: production
+spec:
+  selector:
+    matchLabels:
+      redis_setup_type: replication
+  endpoints:
+    - port: redis-exporter
+      interval: 30s
+      scrapeTimeout: 10s

clusters/cl01tl/applications/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:8f1196f03960ebae2292ba7b6d3e074c643abded31ad5bb0d0e971e20670156c
+            tag: latest@sha256:8ee06648ea025780c4805cf58fd66e48245bf7e81466751afae4bf84e5ef29ca
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -43,7 +43,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:8f1196f03960ebae2292ba7b6d3e074c643abded31ad5bb0d0e971e20670156c
+            tag: latest@sha256:8ee06648ea025780c4805cf58fd66e48245bf7e81466751afae4bf84e5ef29ca
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -53,7 +53,7 @@ searxng:
             - name: SEARXNG_HOSTNAME
               value: searxng.alexlebens.net
             - name: SEARXNG_REDIS_URL
-              value: redis://searxng-valkey-primary.searxng:6379/0
+              value: redis://redis-replication-searxng-master.searxng:6379/0
             - name: UWSGI_WORKERS
               value: 4
             - name: UWSGI_THREADS
@@ -111,25 +111,3 @@ searxng:
           main:
             - path: /etc/searxng
               readOnly: false
-valkey:
-  architecture: replication
-  auth:
-    enabled: false
-    usePasswordFiles: false
-  primary:
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
-  replica:
-    replicaCount: 1
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi

clusters/cl01tl/applications/site-profile/Chart.yaml

@@ -19,10 +19,10 @@ dependencies:
   - name: app-template
     alias: site-profile
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
   - name: cloudflared
     alias: cloudflared-site
     repository: oci://harbor.alexlebens.net/helm-charts
     version: 1.18.0
-icon: https://d21zlbwtcn424f.cloudfront.net/icon_white.png
+icon: https://d21zlbwtcn424f.cloudfront.net/logo-new-round.png
 appVersion: 0.8.1

clusters/cl01tl/applications/site-profile/values.yaml

@@ -5,13 +5,13 @@ site-profile:
     main:
       type: deployment
       replicas: 3
-      strategy: Recreate
+      strategy: RollingUpdate
       revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-profile
-            tag: 0.11.0
+            tag: 1.0.1
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/applications/slskd/Chart.yaml

@@ -20,6 +20,6 @@ dependencies:
   - name: app-template
     alias: slskd
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/slskd.png
 appVersion: 0.22.5

clusters/cl01tl/applications/sonarr-4k/Chart.yaml

@@ -24,7 +24,7 @@ dependencies:
   - name: app-template
     alias: sonarr-4k
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/sonarr-4k/values.yaml

@@ -13,7 +13,7 @@ sonarr-4k:
         main:
           image:
             repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.15@sha256:b0ac15772c04f329964ed79cb446ab23fd1ee28f33b58b10f0264feac17d33cd
+            tag: 4.0.15@sha256:c0836f49c20000e603170dc95d74c2527e690d50309977d94fc171eaa49351a4
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/sonarr-anime/Chart.yaml

@@ -23,7 +23,7 @@ dependencies:
   - name: app-template
     alias: sonarr-anime
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/sonarr-anime/values.yaml

@@ -13,7 +13,7 @@ sonarr-anime:
         main:
           image:
             repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.15@sha256:b0ac15772c04f329964ed79cb446ab23fd1ee28f33b58b10f0264feac17d33cd
+            tag: 4.0.15@sha256:c0836f49c20000e603170dc95d74c2527e690d50309977d94fc171eaa49351a4
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/sonarr/Chart.yaml

@@ -23,7 +23,7 @@ dependencies:
   - name: app-template
     alias: sonarr
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/sonarr/values.yaml

@@ -13,7 +13,7 @@ sonarr:
         main:
           image:
             repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.15@sha256:b0ac15772c04f329964ed79cb446ab23fd1ee28f33b58b10f0264feac17d33cd
+            tag: 4.0.15@sha256:c0836f49c20000e603170dc95d74c2527e690d50309977d94fc171eaa49351a4
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/applications/tautulli/Chart.yaml

@@ -16,6 +16,6 @@ dependencies:
   - name: app-template
     alias: tautulli
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tautulli.png
 appVersion: v2.15.2

clusters/cl01tl/applications/tdarr/Chart.yaml

@@ -21,7 +21,7 @@ dependencies:
   - name: app-template
     alias: tdarr
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
   - name: tdarr-exporter
     version: 1.1.7
     repository: https://homeylab.github.io/helm-charts/

clusters/cl01tl/applications/tubearchivist/Chart.yaml

@@ -11,23 +11,14 @@ home: https://wiki.alexlebens.dev/s/9a5f89bb-3cae-43ab-b651-d39f69a05e93
 sources:
   - https://github.com/tubearchivist/tubearchivist
   - https://github.com/elastic/elasticsearch
-  - https://github.com/valkey-io/valkey
   - https://hub.docker.com/r/bbilly1/tubearchivist
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
-  - https://github.com/bitnami/charts/tree/main/bitnami/elasticsearch
 maintainers:
   - name: alexlebens
 dependencies:
   - name: app-template
     alias: tubearchivist
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
-  - name: valkey
-    version: 3.0.22
-    repository: oci://harbor.alexlebens.net/proxy-registry-1.docker.io/bitnamicharts
-  - name: elasticsearch
-    version: 22.0.13
-    repository: oci://harbor.alexlebens.net/proxy-registry-1.docker.io/bitnamicharts
+    version: 4.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tube-archivist.png
 appVersion: v0.5.2

clusters/cl01tl/applications/tubearchivist/templates/elasticsearch.yaml

@@ -0,0 +1,42 @@
+apiVersion: elasticsearch.k8s.elastic.co/v1
+kind: Elasticsearch
+metadata:
+  name: elasticsearch-tubearchivist
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: elasticsearch-tubearchivist
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  version: 8.18.0
+  auth:
+    fileRealm:
+      - secretName: tubearchivist-elasticsearch-secret
+  nodeSets:
+    - name: default
+      count: 1
+      config:
+        node.store.allow_mmap: false
+        path.repo: /usr/share/elasticsearch/data/snapshot
+      podTemplate:
+        spec:
+          volumes:
+            - name: tubearchivist-snapshot-nfs-storage
+              nfs:
+                path: /volume2/Storage/TubeArchivist
+                server: synologybond.alexlebens.net
+          containers:
+            - name: elasticsearch
+              volumeMounts:
+                - name: tubearchivist-snapshot-nfs-storage
+                  mountPath: /usr/share/elasticsearch/data/snapshot
+      volumeClaimTemplates:
+        - metadata:
+            name: elasticsearch-data
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 10Gi
+            storageClassName: ceph-block

clusters/cl01tl/applications/tubearchivist/templates/external-secret.yaml

@@ -42,13 +42,27 @@ spec:
     kind: ClusterSecretStore
     name: vault
   data:
-    - secretKey: ELASTIC_PASSWORD
+    - secretKey: username
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /cl01tl/tubearchivist/env
+        key: /cl01tl/tubearchivist/elasticsearch
         metadataPolicy: None
-        property: ELASTIC_PASSWORD
+        property: username
+    - secretKey: password
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/tubearchivist/elasticsearch
+        metadataPolicy: None
+        property: password
+    - secretKey: roles
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/tubearchivist/elasticsearch
+        metadataPolicy: None
+        property: roles
 
 ---
 apiVersion: external-secrets.io/v1

clusters/cl01tl/applications/tubearchivist/templates/redis-replication.yaml

@@ -0,0 +1,32 @@
+apiVersion: redis.redis.opstreelabs.in/v1beta2
+kind: RedisReplication
+metadata:
+  name: redis-replication-tubearchivist
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-tubearchivist
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  clusterSize: 3
+  podSecurityContext:
+    runAsUser: 1000
+    fsGroup: 1000
+  kubernetesConfig:
+    image: quay.io/opstree/redis:v8.0.3
+    imagePullPolicy: IfNotPresent
+    resources:
+      requests:
+        cpu: 50m
+        memory: 128Mi
+  storage:
+    volumeClaimTemplate:
+      spec:
+        storageClassName: ceph-block
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi
+  redisExporter:
+    enabled: true
+    image: quay.io/opstree/redis-exporter:v1.48.0

clusters/cl01tl/applications/tubearchivist/templates/service-monitor.yaml

@@ -0,0 +1,19 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: redis-replication-tubearchivist
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-tubearchivist
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    redis-operator: "true"
+    env: production
+spec:
+  selector:
+    matchLabels:
+      redis_setup_type: replication
+  endpoints:
+    - port: redis-exporter
+      interval: 30s
+      scrapeTimeout: 10s

clusters/cl01tl/applications/tubearchivist/values.yaml

@@ -19,9 +19,11 @@ tubearchivist:
             - name: HOST_GID
               value: 1000
             - name: ES_URL
-              value: http://tubearchivist-elasticsearch:9200
+              value: https://elasticsearch-tubearchivist-es-http.tubearchivist:9200
+            - name: ES_DISABLE_VERIFY_SSL
+              value: true
             - name: REDIS_CON
-              value: redis://tubearchivist-valkey-primary.tubearchivist:6379
+              value: redis://redis-replication-tubearchivist-master.tubearchivist:6379
             - name: TA_HOST
               value: https://tubearchivist.alexlebens.net http://tubearchivist.tubearchivist:80/
             - name: TA_PORT
@@ -103,60 +105,3 @@ tubearchivist:
           main:
             - path: /youtube
               readOnly: false
-valkey:
-  architecture: replication
-  auth:
-    enabled: false
-    usePasswordFiles: false
-  primary:
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
-  replica:
-    replicaCount: 1
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
-elasticsearch:
-  global:
-    storageClass: ceph-block
-  image:
-    registry: docker.io
-    repository: bitnami/elasticsearch
-    tag: 8.18.0-debian-12-r2
-  extraEnvVars:
-    - name: discovery.type
-      value: single-node
-    - name: xpack.security.enabled
-      value: "true"
-  extraEnvVarsSecret: tubearchivist-elasticsearch-secret
-  extraConfig:
-    path:
-      repo: /usr/share/elasticsearch/data/snapshot
-  extraVolumes:
-    - name: snapshot
-      nfs:
-        path: /volume2/Storage/TubeArchivist
-        server: synologybond.alexlebens.net
-  extraVolumeMounts:
-    - name: snapshot
-      mountPath: /usr/share/elasticsearch/data/snapshot
-  snapshotRepoPath: /usr/share/elasticsearch/data/snapshot
-  master:
-    masterOnly: false
-    replicaCount: 1
-  data:
-    replicaCount: 0
-  coordinating:
-    replicaCount: 0
-  ingest:
-    enabled: false
-    replicaCount: 0

clusters/cl01tl/applications/vaultwarden/Chart.yaml

@@ -21,7 +21,7 @@ dependencies:
   - name: app-template
     alias: vaultwarden
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
+    version: 4.2.0
   - name: cloudflared
     alias: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/applications/vaultwarden/values.yaml

@@ -9,7 +9,7 @@ vaultwarden:
         main:
           image:
             repository: vaultwarden/server
-            tag: 1.34.1
+            tag: 1.34.2
             pullPolicy: IfNotPresent
           env:
             - name: DOMAIN

clusters/cl01tl/applications/yamtrack/Chart.yaml

@@ -8,12 +8,10 @@ keywords:
   - jellyfin
 home: https://wiki.alexlebens.dev/s/74f31779-734e-42d0-852e-efd57ebdc797
 sources:
-  - https://github.com/FuzzyGrim/Yamtrack/
-  - https://github.com/valkey-io/valkey
+  - https://github.com/FuzzyGrim/Yamtrack
   - https://github.com/cloudnative-pg/cloudnative-pg
   - https://github.com/FuzzyGrim/Yamtrack/pkgs/container/yamtrack
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
   - name: alexlebens
@@ -21,10 +19,7 @@ dependencies:
   - name: app-template
     alias: yamtrack
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.1.2
-  - name: valkey
-    version: 3.0.22
-    repository: oci://harbor.alexlebens.net/proxy-registry-1.docker.io/bitnamicharts
+    version: 4.2.0
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 5.1.0

clusters/cl01tl/applications/yamtrack/templates/external-secret.yaml

@@ -19,13 +19,6 @@ spec:
         key: /cl01tl/yamtrack/config
         metadataPolicy: None
         property: SECRET
-    - secretKey: REDIS_URL
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/yamtrack/config
-        metadataPolicy: None
-        property: REDIS_URL
 
 ---
 apiVersion: external-secrets.io/v1

clusters/cl01tl/applications/yamtrack/templates/redis-replication.yaml

@@ -0,0 +1,32 @@
+apiVersion: redis.redis.opstreelabs.in/v1beta2
+kind: RedisReplication
+metadata:
+  name: redis-replication-yamtrack
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-yamtrack
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  clusterSize: 3
+  podSecurityContext:
+    runAsUser: 1000
+    fsGroup: 1000
+  kubernetesConfig:
+    image: quay.io/opstree/redis:v8.0.3
+    imagePullPolicy: IfNotPresent
+    resources:
+      requests:
+        cpu: 50m
+        memory: 128Mi
+  storage:
+    volumeClaimTemplate:
+      spec:
+        storageClassName: ceph-block
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi
+  redisExporter:
+    enabled: true
+    image: quay.io/opstree/redis-exporter:v1.48.0

clusters/cl01tl/applications/yamtrack/templates/service-monitor.yaml

@@ -0,0 +1,19 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: redis-replication-yamtrack
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-replication-yamtrack
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    redis-operator: "true"
+    env: production
+spec:
+  selector:
+    matchLabels:
+      redis_setup_type: replication
+  endpoints:
+    - port: redis-exporter
+      interval: 30s
+      scrapeTimeout: 10s

clusters/cl01tl/applications/yamtrack/values.yaml

@@ -9,7 +9,7 @@ yamtrack:
         main:
           image:
             repository: ghcr.io/fuzzygrim/yamtrack
-            tag: 0.24.6
+            tag: 0.24.7
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -31,10 +31,7 @@ yamtrack:
                   name: yamtrack-config-secret
                   key: SECRET
             - name: REDIS_URL
-              valueFrom:
-                secretKeyRef:
-                  name: yamtrack-config-secret
-                  key: REDIS_URL
+              value: redis://redis-replication-yamtrack-master.yamtrack:6379
             - name: DB_USER
               valueFrom:
                 secretKeyRef:
@@ -72,28 +69,6 @@ yamtrack:
           port: 80
           targetPort: 8000
           protocol: HTTP
-valkey:
-  architecture: replication
-  auth:
-    enabled: false
-    usePasswordFiles: false
-  primary:
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
-  replica:
-    replicaCount: 1
-    resources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-    persistence:
-      enabled: true
-      size: 1Gi
 postgres-17-cluster:
   mode: standalone
   cluster:

clusters/cl01tl/deployment/argocd/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 8.1.3
+    version: 8.2.3
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 appVersion: 3.0.0

clusters/cl01tl/management/argo-workflows/Chart.yaml

@@ -18,7 +18,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-workflows
-    version: 0.45.20
+    version: 0.45.21
     repository: https://argoproj.github.io/argo-helm
   - name: argo-events
     version: 2.4.16

clusters/cl01tl/management/headlamp/Chart.yaml

@@ -14,7 +14,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: headlamp
-    version: 0.32.1
+    version: 0.33.0
     repository: https://kubernetes-sigs.github.io/headlamp/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/headlamp.png
 appVersion: 0.30.1