change env

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/unpoller/unpoller](https://github.com/unpoller/unpoller) | minor | `v2.19.0` -> `v2.20.1` |

---

### Release Notes

<details>
<summary>unpoller/unpoller (ghcr.io/unpoller/unpoller)</summary>

### [`v2.20.1`](https://github.com/unpoller/unpoller/releases/tag/v2.20.1)

[Compare Source](https://github.com/unpoller/unpoller/compare/v2.20.0...v2.20.1)

#### Changelog

- [`bb4a4c8`](bb4a4c823f) Merge pull request [#&#8203;902](https://github.com/unpoller/unpoller/issues/902) from svennergr/fix/http-timeout-config
- [`7e59c48`](7e59c4883b) fix: add HTTP timeout configuration to prevent indefinite hangs

### [`v2.20.0`](https://github.com/unpoller/unpoller/releases/tag/v2.20.0)

[Compare Source](https://github.com/unpoller/unpoller/compare/v2.19.0...v2.20.0)

#### Changelog

- [`0d39302`](0d39302c19) Merge pull request [#&#8203;901](https://github.com/unpoller/unpoller/issues/901) from svennergr/feature/protect-logs
- [`7e7fd0f`](7e7fd0ff12) chore: upgrade to unifi 5.5.0
- [`07e1e5b`](07e1e5bc4d) feat: add UniFi Protect logs support with Loki integration
- [`703dff9`](703dff9b1e) Merge pull request [#&#8203;900](https://github.com/unpoller/unpoller/issues/900) from svennergr/svennergr/add-syslog
- [`02c7b6a`](02c7b6afa4) chore: upgrade to unifi 5.4.0
- [`4726707`](47267073ac) chore: comment out local replace directive for unifi module in go.mod
- [`a3dc4cd`](a3dc4cd0b2) feat: add save\_syslog option for v2 system-log API
- [`966cac1`](966cac1053) Merge pull request [#&#8203;899](https://github.com/unpoller/unpoller/issues/899) from unpoller/dependabot/go\_modules/all-74468f11a3
- [`0ab6e30`](0ab6e30d42) Bump github.com/DataDog/datadog-go/v5 in the all group

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi4zOS4xIiwidXBkYXRlZEluVmVyIjoiNDIuMzkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW1hZ2UiXX0=-->

Reviewed-on: #2826
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

clusters/cl01tl/helm/argocd/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 9.1.10
+  version: 9.2.1
-digest: sha256:4970c90a7ba115a91006f27161b7fbb2e197250a548ab49f0451aab6cbe12d53
+digest: sha256:e2cb7a8af0a0ecef66b2808325c4fa179d1b598b54bedcdd4f144750fd7e65cb
-generated: "2025-12-23T23:20:06.41177841Z"
+generated: "2025-12-25T16:01:15.118311807Z"

clusters/cl01tl/helm/argocd/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 9.1.10
+    version: 9.2.1
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: github=argoproj/argo-cd

clusters/cl01tl/helm/blocky/values.yaml

@@ -96,11 +96,9 @@ blocky:
               cl01tl-endpoint                 IN      A       10.232.1.22
               cl01tl-endpoint                 IN      A       10.232.1.23
 
-              cl01tl-gateway                  IN      A       10.232.1.200
-
               traefik-cl01tl                  IN      A       10.232.1.21
               blocky                          IN      A       10.232.1.22
-              plex-lb                         IN      A       10.232.1.23
+              cilium-cl01tl                   IN      A       10.232.1.23
 
               ;; Application Names
               actual                          IN      CNAME   traefik-cl01tl
@@ -115,6 +113,7 @@ blocky:
               ceph                            IN      CNAME   traefik-cl01tl
               code-server                     IN      CNAME   traefik-cl01tl
               ephemera                        IN      CNAME   traefik-cl01tl
+              feishin                         IN      CNAME   traefik-cl01tl
               garage-s3                       IN      CNAME   traefik-cl01tl
               garage-webui                    IN      CNAME   traefik-cl01tl
               gatus                           IN      CNAME   traefik-cl01tl
@@ -125,7 +124,7 @@ blocky:
               home                            IN      CNAME   traefik-cl01tl
               home-assistant                  IN      CNAME   traefik-cl01tl
               home-assistant-code-server      IN      CNAME   traefik-cl01tl
-              hubble                          IN      CNAME   cl01tl-gateway
+              hubble                          IN      CNAME   traefik-cl01tl
               huntarr                         IN      CNAME   traefik-cl01tl
               immich                          IN      CNAME   traefik-cl01tl
               jellyfin                        IN      CNAME   traefik-cl01tl
@@ -137,6 +136,7 @@ blocky:
               listenarr                       IN      CNAME   traefik-cl01tl
               mail                            IN      CNAME   traefik-cl01tl
               n8n                             IN      CNAME   traefik-cl01tl
+              navidrome                       IN      CNAME   traefik-cl01tl
               ntfy                            IN      CNAME   traefik-cl01tl
               objects                         IN      CNAME   traefik-cl01tl
               ollama                          IN      CNAME   traefik-cl01tl
@@ -153,12 +153,14 @@ blocky:
               radarr-4k                       IN      CNAME   traefik-cl01tl
               radarr-anime                    IN      CNAME   traefik-cl01tl
               radarr-standup                  IN      CNAME   traefik-cl01tl
+              rayflume                        IN      CNAME   traefik-cl01tl
               searxng                         IN      CNAME   traefik-cl01tl
               seerr                           IN      CNAME   traefik-cl01tl
               slskd                           IN      CNAME   traefik-cl01tl
               sonarr                          IN      CNAME   traefik-cl01tl
               sonarr-4k                       IN      CNAME   traefik-cl01tl
               sonarr-anime                    IN      CNAME   traefik-cl01tl
+              soulsync                        IN      CNAME   traefik-cl01tl
               stalwart                        IN      CNAME   traefik-cl01tl
               tautulli                        IN      CNAME   traefik-cl01tl
               tdarr                           IN      CNAME   traefik-cl01tl

clusters/cl01tl/helm/cilium/templates/cilium-l2-announcement-policy.yaml

@@ -0,0 +1,19 @@
+apiVersion: "cilium.io/v2alpha1"
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: general-l2-policy
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: general-l2-policy
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  nodeSelector:
+    matchExpressions:
+      - key: kubernetes.io/hostname
+        operator: Exists
+  interfaces:
+    - end0
+    - enp6s0
+  externalIPs: true
+  loadBalancerIPs: true

clusters/cl01tl/helm/cilium/templates/gateway.yaml

@@ -1,7 +1,7 @@
 # apiVersion: gateway.networking.k8s.io/v1
 # kind: Gateway
 # metadata:
-#   name: tls-gateway
+#   name: cilium-tls-gateway
 #   namespace: {{ .Release.Namespace }}
 #   labels:
 #     app.kubernetes.io/name: tls-gateway

clusters/cl01tl/helm/cilium/values.yaml

@@ -26,7 +26,7 @@ cilium:
         - SYS_ADMIN
         - SYS_RESOURCE
   l2announcements:
-    enabled: false
+    enabled: true
   bgpControlPlane:
     enabled: false
     secretsNamespace:

clusters/cl01tl/helm/ephemera/values.yaml

@@ -9,7 +9,7 @@ ephemera:
         main:
           image:
             repository: ghcr.io/orwellianepilogue/ephemera
-            tag: 1.3.1
+            tag: 1.4.1
             pullPolicy: IfNotPresent
           env:
             - name: AA_BASE_URL

clusters/cl01tl/helm/gatus/values.yaml

@@ -134,15 +134,21 @@ gatus:
       - name: tubearchivist
         url: https://tubearchivist.alexlebens.net
         <<: *defaults
+      - name: navidrome
+        url: https://navidrome.alexlebens.net
+        <<: *defaults
+      - name: feishin
+        url: https://feishin.alexlebens.net
+        <<: *defaults
+      - name: audiobookshelf
+        url: https://audiobookshelf.alexlebens.net
+        <<: *defaults
       - name: immich
         url: https://immich.alexlebens.net
         <<: *defaults
       - name: photoview
         url: https://photoview.alexlebens.net
         <<: *defaults
-      - name: audiobookshelf
-        url: https://audiobookshelf.alexlebens.net
-        <<: *defaults
       - name: booklore
         url: https://booklore.alexlebens.net
         <<: *defaults
@@ -310,6 +316,12 @@ gatus:
       - name: lidatube
         url: https://lidatube.alexlebens.net
         <<: *defaults
+      - name: rayflume
+        url: https://rayflume.alexlebens.net
+        <<: *defaults
+      - name: soulsync
+        url: https://soulsync.alexlebens.net
+        <<: *defaults
       - name: slskd
         url: https://slskd.alexlebens.net
         <<: *defaults

clusters/cl01tl/helm/homepage/values.yaml

@@ -129,18 +129,6 @@ homepage:
                 maximumFractionDigits: 0
         services.yaml: |
           - Media:
-              - Plex:
-                  icon: sh-plex.webp
-                  description: Media server
-                  href: https://plex.alexlebens.net
-                  siteMonitor: http://plex.plex:32400
-                  statusStyle: dot
-              - Jellyfin:
-                  icon: sh-jellyfin.webp
-                  description: Media server
-                  href: https://jellyfin.alexlebens.net
-                  siteMonitor: http://jellyfin.jellyfin:80
-                  statusStyle: dot
               - Media Requests:
                   icon: sh-overseerr.webp
                   description: Overseerr
@@ -159,12 +147,30 @@ homepage:
                   href: https://yamtrack.alexlebens.net
                   siteMonitor: http://yamtrack.yamtrack:80
                   statusStyle: dot
+              - Movies and TV:
+                  icon: sh-jellyfin.webp
+                  description: Jellyfin
+                  href: https://jellyfin.alexlebens.net
+                  siteMonitor: http://jellyfin.jellyfin:80
+                  statusStyle: dot
               - Youtube Archive:
                   icon: sh-tube-archivist-light.webp
-                  description: TubeAchivist
+                  description: TubeArchivist
                   href: https://tubearchivist.alexlebens.net/login
                   siteMonitor: http://tubearchivist.tubearchivist:80
                   statusStyle: dot
+              - Music:
+                  icon: sh-feishin.webp
+                  description: Feishin
+                  href: https://feishin.alexlebens.net
+                  siteMonitor: http://navidrome-feishin.navidrome:80
+                  statusStyle: dot
+              - Podcasts and Audiobooks:
+                  icon: sh-audiobookshelf.webp
+                  description: Audiobookshelf
+                  href: https://audiobookshelf.alexlebens.net
+                  siteMonitor: http://audiobookshelf.audiobookshelf:80
+                  statusStyle: dot
               - Photos:
                   icon: sh-immich.webp
                   description: Immich
@@ -177,12 +183,6 @@ homepage:
                   href: https://photoview.alexlebens.net
                   siteMonitor: http://photoview.photoview:80
                   statusStyle: dot
-              - Podcasts and Audiobooks:
-                  icon: sh-audiobookshelf.webp
-                  description: Audiobookshelf
-                  href: https://audiobookshelf.alexlebens.net
-                  siteMonitor: http://audiobookshelf.audiobookshelf:80
-                  statusStyle: dot
               - Books:
                   icon: sh-booklore.webp
                   description: Booklore
@@ -661,13 +661,25 @@ homepage:
                     url: http://lidarr.lidarr:80
                     key: {{ "{{HOMEPAGE_VAR_LIDARR_KEY}}" }}
                     fields: ["wanted", "queued", "artists"]
+              - RayFlume:
+                  icon: sh-youtubarr.webp
+                  description: Playlist to Lidarr Import
+                  href: https://rayflume.alexlebens.net
+                  siteMonitor: http://rayflume.rayflume:80
+                  statusStyle: dot
               - LidaTube:
                   icon: sh-lidatube.webp
                   description: Searches for Music
                   href: https://lidatube.alexlebens.net
                   siteMonitor: http://lidatube.lidatube:80
                   statusStyle: dot
-              - Soulseek:
+              - SoulSync:
+                  icon: sh-soulsync.webp
+                  description: Playlist Sync
+                  href: https://soulsync.alexlebens.net
+                  siteMonitor: http://soulsync.soulsync:80
+                  statusStyle: dot
+              - slskd:
                   icon: sh-slskd.webp
                   description: slskd
                   href: https://slskd.alexlebens.net

clusters/cl01tl/helm/libation/values.yaml

@@ -16,7 +16,7 @@ libation:
         main:
           image:
             repository: rmcrackan/libation
-            tag: 12.8.2
+            tag: 13.0.0
             pullPolicy: IfNotPresent
           env:
             - name: SLEEP_TIME

clusters/cl01tl/helm/navidrome/Chart.lock

@@ -0,0 +1,9 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.5.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.6.0
+digest: sha256:2d5e357064259b97afb7c8239d6d57da6f59c267a2a530262af9db32d228ae66
+generated: "2025-12-24T14:05:31.844353-06:00"

clusters/cl01tl/helm/navidrome/Chart.yaml

@@ -0,0 +1,27 @@
+apiVersion: v2
+name: navidrome
+version: 1.0.0
+description: Navidrome
+keywords:
+  - navidrome
+  - feishin
+  - music
+home: https://wiki.alexlebens.dev/s/
+sources:
+  - https://github.com/navidrome/navidrome
+  - https://github.com/jeffvli/feishin
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: navidrome
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.5.0
+  - name: volsync-target
+    alias: volsync-target-data
+    version: 0.6.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/navidrome.png
+# renovate: github=navidrome/navidrome
+appVersion: 1.42.2

clusters/cl01tl/helm/navidrome/templates/persistent-volume-claim.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: navidrome-music-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: navidrome-music-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  volumeName: navidrome-music-nfs-storage
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi

clusters/cl01tl/helm/navidrome/templates/persistent-volume.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: navidrome-music-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: navidrome-music-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: nfs-client
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    path: /volume2/Storage/Music
+    server: synologybond.alexlebens.net
+  mountOptions:
+    - vers=4
+    - minorversion=1
+    - noac

clusters/cl01tl/helm/navidrome/values.yaml

@@ -0,0 +1,155 @@
+navidrome:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: deluan/navidrome
+            tag: 0.59.0@sha256:4edc8a1de3e042f30b78a478325839f4395177eb8201c27543dccc0eba674f23
+            pullPolicy: IfNotPresent
+          env:
+            - name: ND_MUSICFOLDER
+              value: /music
+            - name: ND_DATAFOLDER
+              value: /data
+            - name: ND_CACHEFOLDER
+              value: /cache
+            - name: ND_BASEURL
+              value: https://navidrome.alexlebens.net
+            - name: ND_ENABLEINSIGHTSCOLLECTOR
+              value: false
+            - name: ND_PROMETHEUS_ENABLED
+              value: true
+          resources:
+            limits:
+              gpu.intel.com/i915: 1
+            requests:
+              gpu.intel.com/i915: 1
+              cpu: 10m
+              memory: 128Mi
+    feishin:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: ghcr.io/jeffvli/feishin
+            tag: 1.0.1-beta.1@sha256:61239641f23a33f99c2858419b14afb66683f3cd82010363fba92be3993fd894
+            pullPolicy: IfNotPresent
+          env:
+            - name: SERVER_NAME
+              value: talos
+            - name: SERVER_LOCK
+              value: true
+            - name: SERVER_TYPE
+              value: navidrome
+            - name: SERVER_URL
+              value: https://navidrome.alexlebens.net
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 4533
+          protocol: HTTP
+    feishin:
+      controller: feishin
+      ports:
+        http:
+          port: 80
+          targetPort: 9180
+          protocol: HTTP
+  serviceMonitor:
+    main:
+      selector:
+        matchLabels:
+          app.kubernetes.io/name: navidrome
+          app.kubernetes.io/instance: navidrome
+          app.kubernetes.io/service: navidrome-main
+      serviceName: '{{ include "bjw-s.common.lib.chart.names.fullname" $ }}'
+      endpoints:
+        - port: http
+          scheme: http
+          path: /metrics
+          interval: 30s
+          scrapeTimeout: 15s
+  route:
+    main:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - navidrome.alexlebens.net
+      rules:
+        - backendRefs:
+            - group: ''
+              kind: Service
+              name: navidrome-main
+              port: 80
+              weight: 100
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+    feishin:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - feishin.alexlebens.net
+      rules:
+        - backendRefs:
+            - group: ''
+              kind: Service
+              name: navidrome-feishin
+              port: 80
+              weight: 100
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+  persistence:
+    data:
+      forceRename: navidrome-data
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      advancedMounts:
+        main:
+          main:
+            - path: /data
+              readOnly: false
+    cache:
+      type: emptyDir
+      advancedMounts:
+        main:
+          main:
+            - path: /cache
+              readOnly: false
+    music:
+      existingClaim: navidrome-music-nfs-storage
+      advancedMounts:
+        main:
+          main:
+            - path: /music
+              readOnly: true
+volsync-target-data:
+  pvcTarget: navidrome-data
+  moverSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch

clusters/cl01tl/helm/outline/templates/object-bucket-claim.yaml

@@ -1,30 +1,30 @@
-# apiVersion: objectbucket.io/v1alpha1
+apiVersion: objectbucket.io/v1alpha1
-# kind: ObjectBucketClaim
+kind: ObjectBucketClaim
-# metadata:
+metadata:
-#   name: ceph-bucket-outline
+  name: ceph-bucket-outline
-#   labels:
+  labels:
-#     app.kubernetes.io/name: ceph-bucket-outline
+    app.kubernetes.io/name: ceph-bucket-outline
-#     app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
+spec:
-#   generateBucketName: bucket-outline
+  generateBucketName: bucket-outline
-#   storageClassName: ceph-bucket
+  storageClassName: ceph-bucket
-#   additionalConfig:
+  # additionalConfig:
-#     bucketPolicy: |
+  #   bucketPolicy: |
-#         {
+  #       {
-#             "Version": "2012-10-17",
+  #           "Version": "2012-10-17",
-#             "Statement": [
+  #           "Statement": [
-#                 {
+  #               {
-#                     "Sid": "VisualEditor",
+  #                   "Sid": "VisualEditor",
-#                     "Effect": "Allow",
+  #                   "Effect": "Allow",
-#                     "Action": [
+  #                   "Action": [
-#                         "s3:GetObjectAcl",
+  #                       "s3:GetObjectAcl",
-#                         "s3:DeleteObject",
+  #                       "s3:DeleteObject",
-#                         "s3:PutObject",
+  #                       "s3:PutObject",
-#                         "s3:GetObject",
+  #                       "s3:GetObject",
-#                         "s3:PutObjectAcl"
+  #                       "s3:PutObjectAcl"
-#                     ],
+  #                   ],
-#                     "Resource": "arn:aws:s3:::bucket-outline-630c57e0-d475-4d78-926c-c1c082291d73/*"
+  #                   "Resource": "arn:aws:s3:::bucket-outline-630c57e0-d475-4d78-926c-c1c082291d73/*"
-#                 }
+  #               }
-#             ]
+  #           ]
-#         }
+  #       }

clusters/cl01tl/helm/plex/values.yaml

@@ -16,8 +16,6 @@ plex:
               value: US/Central
             - name: VERSION
               value: docker
-            - name: PLEX_CLAIM
-              value: claim-XmGK2o9x54PbCzQaqj-J
           resources:
             limits:
               gpu.intel.com/i915: 1
@@ -28,7 +26,6 @@ plex:
   service:
     main:
       controller: main
-      type: LoadBalancer
       ports:
         http:
           port: 32400

clusters/cl01tl/helm/rayflume/Chart.lock

@@ -0,0 +1,12 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.5.0
+- name: redis-replication
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.6.0
+digest: sha256:b6407c3cb6cb6b71d289f73e943111899c8e7711c3141c86774d103014543af2
+generated: "2025-12-25T21:03:03.423717-06:00"

clusters/cl01tl/helm/rayflume/Chart.yaml

@@ -0,0 +1,27 @@
+apiVersion: v2
+name: rayflume
+version: 1.0.0
+description: RayFlume
+keywords:
+  - rayflume
+  - music
+  - lidarr
+home: https://wiki.alexlebens.dev/s/
+sources:
+  - https://gitea.alexlebens.dev/alexlebens/RayFlume
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: rayflume
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.5.0
+  - name: redis-replication
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-data
+    version: 0.6.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+appVersion: 0.0.1

clusters/cl01tl/helm/rayflume/templates/external-secret.yaml

@@ -0,0 +1,42 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: rayflume-config-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: rayflume-config-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: SECRET_KEY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/rayflume/config
+        metadataPolicy: None
+        property: SECRET_KEY
+    - secretKey: LIDARR_TOKEN
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/rayflume/config
+        metadataPolicy: None
+        property: LIDARR_TOKEN
+    - secretKey: YOUTUBE_API_KEY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/rayflume/config
+        metadataPolicy: None
+        property: YOUTUBE_API_KEY
+    - secretKey: MB_USER_AGENT
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/rayflume/config
+        metadataPolicy: None
+        property: MB_USER_AGENT

clusters/cl01tl/helm/rayflume/values.yaml

@@ -0,0 +1,96 @@
+rayflume:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: harbor.alexlebens.net/images/rayflume
+            tag: 0.0.2
+            pullPolicy: IfNotPresent
+          env:
+            - name: DEBUG
+              value: True
+            - name: ALLOWED_HOSTS
+              value: rayflume.alexlebens.net
+            - name: SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: rayflume-config-secret
+                  key: SECRET_KEY
+            - name: LIDARR_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: rayflume-config-secret
+                  key: LIDARR_TOKEN
+            - name: YOUTUBE_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: rayflume-config-secret
+                  key: YOUTUBE_API_KEY
+            - name: MB_USER_AGENT
+              valueFrom:
+                secretKeyRef:
+                  name: rayflume-config-secret
+                  key: MB_USER_AGENT
+            - name: CELERY_BROKER_URL
+              value: redis://redis-replication-rayflume-master.rayflume:6379/0
+            - name: CELERY_RESULT_BACKEND
+              value: redis://redis-replication-rayflume-master.rayflume:6379/0
+          resources:
+            requests:
+              cpu: 10m
+              memory: 64Mi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 80
+          protocol: HTTP
+  route:
+    main:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - rayflume.alexlebens.net
+      rules:
+        - backendRefs:
+            - group: ''
+              kind: Service
+              name: rayflume
+              port: 80
+              weight: 100
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+  persistence:
+    data:
+      forceRename: rayflume-data
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 1Gi
+      advancedMounts:
+        main:
+          main:
+            - path: /data
+              readOnly: false
+redis-replication:
+  existingSecret:
+    enabled: false
+  redisReplication:
+    clusterSize: 3
+  redisSentinel:
+    enabled: true
+    clusterSize: 3
+volsync-target-data:
+  pvcTarget: rayflume-data

clusters/cl01tl/helm/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:13de9d465bd2d9da6a6718f2a57d96e6e5fa3b8aba3c0bec077a5b7e5f24e4e9
+            tag: latest@sha256:624151caf80802e85fe145c70315b3ce47721d720b64f4bd4d1867afa82d0023
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -39,7 +39,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:13de9d465bd2d9da6a6718f2a57d96e6e5fa3b8aba3c0bec077a5b7e5f24e4e9
+            tag: latest@sha256:624151caf80802e85fe145c70315b3ce47721d720b64f4bd4d1867afa82d0023
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL

clusters/cl01tl/helm/soulsync/Chart.lock

@@ -0,0 +1,12 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.5.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.6.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.6.0
+digest: sha256:60836915fb9a8028b084171ac4228520e9edc9ee6626b257c6d37db723d91f49
+generated: "2025-12-24T15:26:54.904687-06:00"

clusters/cl01tl/helm/soulsync/Chart.yaml

@@ -0,0 +1,29 @@
+apiVersion: v2
+name: soulsync
+version: 1.0.0
+description: SoulSync
+keywords:
+  - soulsync
+  - music
+home: https://wiki.alexlebens.dev/s/
+sources:
+  - https://github.com/Nezreka/SoulSync
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: soulsync
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.5.0
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.6.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-database
+    version: 0.6.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/soulsync.png
+# renovate: github=Nezreka/SoulSync
+appVersion: 1.42.2

clusters/cl01tl/helm/soulsync/templates/external-secret.yaml

@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: soulsync-config-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: soulsync-config-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: config.json
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/soulsync/config
+        metadataPolicy: None
+        property: config.json

clusters/cl01tl/helm/soulsync/templates/persistent-volume-claim.yaml

@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: soulsync-music-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: soulsync-music-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  volumeName: soulsync-music-nfs-storage
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: soulsync-slskd-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: soulsync-slskd-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  volumeName: soulsync-slskd-nfs-storage
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi

clusters/cl01tl/helm/soulsync/templates/persistent-volume.yaml

@@ -0,0 +1,48 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: soulsync-music-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: soulsync-music-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: nfs-client
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    path: /volume2/Storage/Music
+    server: synologybond.alexlebens.net
+  mountOptions:
+    - vers=4
+    - minorversion=1
+    - noac
+
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: soulsync-slskd-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: soulsync-slskd-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: nfs-client
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    path: /volume2/Storage/slskd/Downloads
+    server: synologybond.alexlebens.net
+  mountOptions:
+    - vers=4
+    - minorversion=1
+    - noac

clusters/cl01tl/helm/soulsync/values.yaml

@@ -0,0 +1,154 @@
+soulsync:
+  controllers:
+    main:
+      type: deployment
+      replicas: 0
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      initContainers:
+        init-copy-config:
+          image:
+            repository: busybox
+            tag: 1.37.0
+            pullPolicy: IfNotPresent
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+          command:
+            - /bin/sh
+            - -ec
+            - |
+              echo ">> Coping files ..."
+              ls /tmp
+              cp -fv /tmp/config.json /app/config/config.json
+              echo ">> Files in config:"
+              ls /app/config
+      containers:
+        main:
+          image:
+            repository: boulderbadgedad/soulsync
+            tag: latest
+            pullPolicy: IfNotPresent
+          env:
+            - name: TZ
+              value: US/Central
+            - name: PUID
+              value: 1000
+            - name: PGID
+              value: 1000
+            - name: FLASK_ENV
+              value: production
+            - name: PYTHONPATH
+              value: /app
+            - name: SOULSYNC_CONFIG_PATH
+              value: /app/config/config.json
+          probes:
+            liveness:
+              enabled: true
+              custom: true
+              spec:
+                exec:
+                  command:
+                  - CMD
+                  - curl
+                  - -f
+                  - http://localhost:8888/
+                failureThreshold: 5
+                initialDelaySeconds: 60
+                periodSeconds: 30
+                successThreshold: 1
+                timeoutSeconds: 10
+          resources:
+            requests:
+              cpu: 100m
+              memory: 512Mi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 8008
+          protocol: HTTP
+  route:
+    main:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - soulsync.alexlebens.net
+      rules:
+        - backendRefs:
+            - group: ''
+              kind: Service
+              name: soulsync
+              port: 80
+              weight: 100
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+  persistence:
+    secret:
+      enabled: true
+      type: secret
+      name: soulsync-config-secret
+      advancedMounts:
+        main:
+          init-copy-config:
+            - path: /tmp/config.json
+              readOnly: true
+              mountPropagation: None
+              subPath: config.json
+    config:
+      forceRename: soulsync-config
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      advancedMounts:
+        main:
+          main:
+            - path: /app/config
+              readOnly: false
+          init-copy-config:
+            - path: /app/config
+              readOnly: false
+    database:
+      forceRename: soulsync-database
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      advancedMounts:
+        main:
+          main:
+            - path: /app/database
+              readOnly: false
+    downloads:
+      existingClaim: soulsync-slskd-nfs-storage
+      advancedMounts:
+        main:
+          main:
+            - path: /app/downloads
+              readOnly: false
+    transfer:
+      type: emptyDir
+      advancedMounts:
+        main:
+          main:
+            - path: /app/Transfer
+              readOnly: false
+    music:
+      existingClaim: soulsync-music-nfs-storage
+      advancedMounts:
+        main:
+          main:
+            - path: /music
+              readOnly: true
+volsync-target-config:
+  pvcTarget: soulsync-config
+volsync-target-database:
+  pvcTarget: soulsync-database

clusters/cl01tl/helm/unpoller/values.yaml

@@ -9,7 +9,7 @@ unpoller:
         main:
           image:
             repository: ghcr.io/unpoller/unpoller
-            tag: v2.19.0
+            tag: v2.20.1
             pullPolicy: IfNotPresent
           env:
             - name: UP_UNIFI_CONTROLLER_0_SAVE_ALARMS

hosts/ps08rp/blocky/config.yml

@@ -71,11 +71,9 @@ customDNS:
     cl01tl-endpoint                 IN      A       10.232.1.22
     cl01tl-endpoint                 IN      A       10.232.1.23
 
-    cl01tl-gateway                  IN      A       10.232.1.200
-
     traefik-cl01tl                  IN      A       10.232.1.21
     blocky                          IN      A       10.232.1.22
-    plex-lb                         IN      A       10.232.1.23
+    cilium-cl01tl                   IN      A       10.232.1.23
 
 
     ;; Application Names
@@ -91,6 +89,7 @@ customDNS:
     ceph                            IN      CNAME   traefik-cl01tl
     code-server                     IN      CNAME   traefik-cl01tl
     ephemera                        IN      CNAME   traefik-cl01tl
+    feishin                         IN      CNAME   traefik-cl01tl
     garage-s3                       IN      CNAME   traefik-cl01tl
     garage-webui                    IN      CNAME   traefik-cl01tl
     gatus                           IN      CNAME   traefik-cl01tl
@@ -101,7 +100,7 @@ customDNS:
     home                            IN      CNAME   traefik-cl01tl
     home-assistant                  IN      CNAME   traefik-cl01tl
     home-assistant-code-server      IN      CNAME   traefik-cl01tl
-    hubble                          IN      CNAME   cl01tl-gateway
+    hubble                          IN      CNAME   traefik-cl01tl
     huntarr                         IN      CNAME   traefik-cl01tl
     immich                          IN      CNAME   traefik-cl01tl
     jellyfin                        IN      CNAME   traefik-cl01tl
@@ -113,6 +112,7 @@ customDNS:
     listenarr                       IN      CNAME   traefik-cl01tl
     mail                            IN      CNAME   traefik-cl01tl
     n8n                             IN      CNAME   traefik-cl01tl
+    navidrome                       IN      CNAME   traefik-cl01tl
     ntfy                            IN      CNAME   traefik-cl01tl
     objects                         IN      CNAME   traefik-cl01tl
     ollama                          IN      CNAME   traefik-cl01tl
@@ -129,12 +129,14 @@ customDNS:
     radarr-4k                       IN      CNAME   traefik-cl01tl
     radarr-anime                    IN      CNAME   traefik-cl01tl
     radarr-standup                  IN      CNAME   traefik-cl01tl
+    rayflume                        IN      CNAME   traefik-cl01tl
     searxng                         IN      CNAME   traefik-cl01tl
     seerr                           IN      CNAME   traefik-cl01tl
     slskd                           IN      CNAME   traefik-cl01tl
     sonarr                          IN      CNAME   traefik-cl01tl
     sonarr-4k                       IN      CNAME   traefik-cl01tl
     sonarr-anime                    IN      CNAME   traefik-cl01tl
+    soulsync                        IN      CNAME   traefik-cl01tl
     stalwart                        IN      CNAME   traefik-cl01tl
     tautulli                        IN      CNAME   traefik-cl01tl
     tdarr                           IN      CNAME   traefik-cl01tl

hosts/ps09rp/blocky/config.yml

@@ -71,11 +71,9 @@ customDNS:
     cl01tl-endpoint                 IN      A       10.232.1.22
     cl01tl-endpoint                 IN      A       10.232.1.23
 
-    cl01tl-gateway                  IN      A       10.232.1.200
-
     traefik-cl01tl                  IN      A       10.232.1.21
     blocky                          IN      A       10.232.1.22
-    plex-lb                         IN      A       10.232.1.23
+    cilium-cl01tl                   IN      A       10.232.1.23
 
 
     ;; Application Names
@@ -91,6 +89,7 @@ customDNS:
     ceph                            IN      CNAME   traefik-cl01tl
     code-server                     IN      CNAME   traefik-cl01tl
     ephemera                        IN      CNAME   traefik-cl01tl
+    feishin                         IN      CNAME   traefik-cl01tl
     garage-s3                       IN      CNAME   traefik-cl01tl
     garage-webui                    IN      CNAME   traefik-cl01tl
     gatus                           IN      CNAME   traefik-cl01tl
@@ -101,7 +100,7 @@ customDNS:
     home                            IN      CNAME   traefik-cl01tl
     home-assistant                  IN      CNAME   traefik-cl01tl
     home-assistant-code-server      IN      CNAME   traefik-cl01tl
-    hubble                          IN      CNAME   cl01tl-gateway
+    hubble                          IN      CNAME   traefik-cl01tl
     huntarr                         IN      CNAME   traefik-cl01tl
     immich                          IN      CNAME   traefik-cl01tl
     jellyfin                        IN      CNAME   traefik-cl01tl
@@ -113,6 +112,7 @@ customDNS:
     listenarr                       IN      CNAME   traefik-cl01tl
     mail                            IN      CNAME   traefik-cl01tl
     n8n                             IN      CNAME   traefik-cl01tl
+    navidrome                       IN      CNAME   traefik-cl01tl
     ntfy                            IN      CNAME   traefik-cl01tl
     objects                         IN      CNAME   traefik-cl01tl
     ollama                          IN      CNAME   traefik-cl01tl
@@ -129,12 +129,14 @@ customDNS:
     radarr-4k                       IN      CNAME   traefik-cl01tl
     radarr-anime                    IN      CNAME   traefik-cl01tl
     radarr-standup                  IN      CNAME   traefik-cl01tl
+    rayflume                        IN      CNAME   traefik-cl01tl
     searxng                         IN      CNAME   traefik-cl01tl
     seerr                           IN      CNAME   traefik-cl01tl
     slskd                           IN      CNAME   traefik-cl01tl
     sonarr                          IN      CNAME   traefik-cl01tl
     sonarr-4k                       IN      CNAME   traefik-cl01tl
     sonarr-anime                    IN      CNAME   traefik-cl01tl
+    soulsync                        IN      CNAME   traefik-cl01tl
     stalwart                        IN      CNAME   traefik-cl01tl
     tautulli                        IN      CNAME   traefik-cl01tl
     tdarr                           IN      CNAME   traefik-cl01tl