Update docker.io/postgres Docker tag to v18

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `1.0.0` -> `1.1.0` |

---

### Release Notes

<details>
<summary>external-secrets/external-secrets (external-secrets)</summary>

### [`v1.1.0`](https://github.com/external-secrets/external-secrets/releases/tag/v1.1.0)

[Compare Source](https://github.com/external-secrets/external-secrets/compare/v1.0.0...v1.1.0)

Image: `ghcr.io/external-secrets/external-secrets:v1.1.0`
Image: `ghcr.io/external-secrets/external-secrets:v1.1.0-ubi`
Image: `ghcr.io/external-secrets/external-secrets:v1.1.0-ubi-boringssl`

<!-- Release notes generated using configuration in .github/release.yml at main -->

#### What's Changed

!*NOTE*!: During last community meeting we discussed that we are retiring our scarf account. With that, we will be changing back to [ghcr.io/external-secrets/external-secrets](http://ghcr.io/external-secrets/external-secrets) instead of [oci.external-secrets.io/external-secrets/external-secrets](http://oci.external-secrets.io/external-secrets/external-secrets).

For now, the old domain will live for a couple months to give people to change back. With this release , the helm chart switched back to ghcr.

##### General

- chore(chart): release helm chart 1.0.0 by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;5552](https://github.com/external-secrets/external-secrets/pull/5552)
- feat(security): add support for ECDSA ssh keys by [@&#8203;bigjazzsound](https://github.com/bigjazzsound) in [#&#8203;5559](https://github.com/external-secrets/external-secrets/pull/5559)
- fix: minor typo in comment of KeeperSecurity example by [@&#8203;mdjong1](https://github.com/mdjong1) in [#&#8203;5573](https://github.com/external-secrets/external-secrets/pull/5573)
- docs(gcp): update documentation for using WorkloadIdentityFederation in non-GKE cluster by [@&#8203;jennweir](https://github.com/jennweir) in [#&#8203;5556](https://github.com/external-secrets/external-secrets/pull/5556)
- chore(release): add darwin\_arm64 releases by [@&#8203;lbordowitz](https://github.com/lbordowitz) in [#&#8203;5583](https://github.com/external-secrets/external-secrets/pull/5583)
- feat: support override IAM endpoint in IBM provider for APIkey auth by [@&#8203;fidel-ruiz](https://github.com/fidel-ruiz) in [#&#8203;5550](https://github.com/external-secrets/external-secrets/pull/5550)
- feat(security): build tags for all the providers to disable them on d… by [@&#8203;ShimonDarshan](https://github.com/ShimonDarshan) in [#&#8203;5578](https://github.com/external-secrets/external-secrets/pull/5578)
- fix: do not include the last element of the path in the iteration by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;5588](https://github.com/external-secrets/external-secrets/pull/5588)
- fix(k8s): support deleting whole secret by [@&#8203;tiagolobocastro](https://github.com/tiagolobocastro) in [#&#8203;5538](https://github.com/external-secrets/external-secrets/pull/5538)
- fix(provider): configure TLS for secret server provider by [@&#8203;Lumexralph](https://github.com/Lumexralph) in [#&#8203;5558](https://github.com/external-secrets/external-secrets/pull/5558)
- chore(aws): remove any usage of aws-sdk-v1 by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;5590](https://github.com/external-secrets/external-secrets/pull/5590)
- fix(gcp): check for secret version exists in PushSecret by [@&#8203;bpalko](https://github.com/bpalko) in [#&#8203;5593](https://github.com/external-secrets/external-secrets/pull/5593)
- feat(vault): add GCP Workload Identity authentication support by [@&#8203;SamuelMolling](https://github.com/SamuelMolling) in [#&#8203;5356](https://github.com/external-secrets/external-secrets/pull/5356)
- chore: fix sonar cloud issues by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;5405](https://github.com/external-secrets/external-secrets/pull/5405)
- chore(aws-sdk-v2): update dependencies to accept new aws regions by [@&#8203;damienpuig](https://github.com/damienpuig) in [#&#8203;5577](https://github.com/external-secrets/external-secrets/pull/5577)
- feat(chart): use ghcr.io instead of our own domain by [@&#8203;evrardjp](https://github.com/evrardjp) in [#&#8203;5617](https://github.com/external-secrets/external-secrets/pull/5617)

##### Dependencies

- chore(deps): bump golang from 1.25.3 to 1.25.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5560](https://github.com/external-secrets/external-secrets/pull/5560)
- chore(deps): bump golang from 1.25.3-bookworm to 1.25.4-bookworm in /e2e by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5568](https://github.com/external-secrets/external-secrets/pull/5568)
- chore(deps): bump step-security/harden-runner from 2.13.1 to 2.13.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5561](https://github.com/external-secrets/external-secrets/pull/5561)
- chore(deps): bump softprops/action-gh-release from 2.4.1 to 2.4.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5564](https://github.com/external-secrets/external-secrets/pull/5564)
- chore(deps): bump helm/chart-testing-action from 2.7.0 to 2.8.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5565](https://github.com/external-secrets/external-secrets/pull/5565)
- chore(deps): bump aws-actions/configure-aws-credentials from [`0d00a56`](0d00a56e02) to [`2475ef7`](2475ef7675) by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5562](https://github.com/external-secrets/external-secrets/pull/5562)
- chore(deps): bump helm/kind-action from 1.12.0 to 1.13.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5563](https://github.com/external-secrets/external-secrets/pull/5563)
- chore(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5567](https://github.com/external-secrets/external-secrets/pull/5567)
- chore(deps): bump regex from 2025.10.23 to 2025.11.3 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5570](https://github.com/external-secrets/external-secrets/pull/5570)
- chore(deps): bump markdown from 3.9 to 3.10 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5569](https://github.com/external-secrets/external-secrets/pull/5569)
- chore(deps): bump hashicorp/setup-terraform from [`982f6f0`](982f6f017c) to [`4c5fdab`](4c5fdabea2) by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5566](https://github.com/external-secrets/external-secrets/pull/5566)
- chore(deps): bump golang from `d3f0cf7` to `d3f0cf7` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5595](https://github.com/external-secrets/external-secrets/pull/5595)
- chore(deps): bump github/codeql-action from 4.31.2 to 4.31.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5596](https://github.com/external-secrets/external-secrets/pull/5596)
- chore(deps): bump click from 8.3.0 to 8.3.1 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5602](https://github.com/external-secrets/external-secrets/pull/5602)
- chore(deps): bump ubi9/ubi from `dec374e` to `dcd8128` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5594](https://github.com/external-secrets/external-secrets/pull/5594)
- chore(deps): bump aws-actions/configure-aws-credentials from [`2475ef7`](2475ef7675) to [`f2964c7`](f2964c7281) by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5597](https://github.com/external-secrets/external-secrets/pull/5597)
- chore(deps): bump actions/dependency-review-action from 4.8.1 to 4.8.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5598](https://github.com/external-secrets/external-secrets/pull/5598)
- chore(deps): bump pymdown-extensions from 10.16.1 to 10.17.1 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5599](https://github.com/external-secrets/external-secrets/pull/5599)
- chore(deps): bump certifi from 2025.10.5 to 2025.11.12 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5600](https://github.com/external-secrets/external-secrets/pull/5600)
- chore(deps): bump mkdocs-material from 9.6.23 to 9.7.0 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5601](https://github.com/external-secrets/external-secrets/pull/5601)
- chore(deps): bump mkdocs-macros-plugin from 1.4.1 to 1.5.0 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;5603](https://github.com/external-secrets/external-secrets/pull/5603)

#### New Contributors

- [@&#8203;bigjazzsound](https://github.com/bigjazzsound) made their first contribution in [#&#8203;5559](https://github.com/external-secrets/external-secrets/pull/5559)
- [@&#8203;mdjong1](https://github.com/mdjong1) made their first contribution in [#&#8203;5573](https://github.com/external-secrets/external-secrets/pull/5573)
- [@&#8203;jennweir](https://github.com/jennweir) made their first contribution in [#&#8203;5556](https://github.com/external-secrets/external-secrets/pull/5556)
- [@&#8203;lbordowitz](https://github.com/lbordowitz) made their first contribution in [#&#8203;5583](https://github.com/external-secrets/external-secrets/pull/5583)
- [@&#8203;fidel-ruiz](https://github.com/fidel-ruiz) made their first contribution in [#&#8203;5550](https://github.com/external-secrets/external-secrets/pull/5550)
- [@&#8203;ShimonDarshan](https://github.com/ShimonDarshan) made their first contribution in [#&#8203;5578](https://github.com/external-secrets/external-secrets/pull/5578)
- [@&#8203;bpalko](https://github.com/bpalko) made their first contribution in [#&#8203;5593](https://github.com/external-secrets/external-secrets/pull/5593)
- [@&#8203;SamuelMolling](https://github.com/SamuelMolling) made their first contribution in [#&#8203;5356](https://github.com/external-secrets/external-secrets/pull/5356)
- [@&#8203;damienpuig](https://github.com/damienpuig) made their first contribution in [#&#8203;5577](https://github.com/external-secrets/external-secrets/pull/5577)

**Full Changelog**: <https://github.com/external-secrets/external-secrets/compare/v1.0.0...v1.1.0>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi41LjAiLCJ1cGRhdGVkSW5WZXIiOiI0Mi41LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImNoYXJ0Il19-->

Reviewed-on: #2081
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

.gitea/workflows/lint-test-docker-pull.yaml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-js
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 

.gitea/workflows/lint-test-docker-push.yaml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-js
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 

.gitea/workflows/lint-test-helm-pull.yaml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-js
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 

.gitea/workflows/lint-test-helm-push.yaml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-js
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 

.gitea/workflows/renovate.yaml

@@ -16,7 +16,7 @@ jobs:
     container: ghcr.io/renovatebot/renovate:42
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Renovate
         run: renovate

clusters/cl01tl/applications/booklore/templates/namespace.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: booklore
+  annotations:
+    volsync.backube/privileged-movers: "true"
+  labels:
+    app.kubernetes.io/name: booklore
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}

clusters/cl01tl/applications/booklore/templates/replication-source.yaml

@@ -13,7 +13,7 @@ spec:
     schedule: "0 0 * * *"
   rsyncTLS:
     keySecret: booklore-data-replication-secret
-    address: placeholder
+    address: 10.97.132.22
     copyMethod: Snapshot
 
 ---

clusters/cl01tl/applications/directus/values.yaml

@@ -9,7 +9,7 @@ directus:
         main:
           image:
             repository: directus/directus
-            tag: 11.13.3
+            tag: 11.13.4
             pullPolicy: IfNotPresent
           env:
             - name: PUBLIC_URL

clusters/cl01tl/applications/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:6a4ca3058a439d96805b7340ae84dacce6ade5456c24a1dde0bc6415ad76c1c6
+            tag: latest@sha256:7914267d4a3b91132aa888b889dbe0657bdb9e1af5a13eb6fbab99a94990c235
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -43,7 +43,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:6a4ca3058a439d96805b7340ae84dacce6ade5456c24a1dde0bc6415ad76c1c6
+            tag: latest@sha256:7914267d4a3b91132aa888b889dbe0657bdb9e1af5a13eb6fbab99a94990c235
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL

clusters/cl01tl/platform/external-secrets/Chart.yaml

@@ -12,7 +12,7 @@ sources:
   - https://github.com/external-secrets/external-secrets/tree/main/deploy/charts/external-secrets
 dependencies:
   - name: external-secrets
-    version: 1.0.0
+    version: 1.1.0
     repository: https://charts.external-secrets.io
 icon: https://avatars.githubusercontent.com/u/68335991?s=48&v=4
 appVersion: 0.17.0

clusters/cl01tl/platform/matrix-synapse/Chart.yaml

@@ -29,7 +29,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: matrix-synapse
-    version: 3.12.14
+    version: 3.12.15
     repository: https://ananace.gitlab.io/charts
   - name: app-template
     alias: matrix-hookshot

clusters/cl01tl/platform/ollama/values.yaml

@@ -22,7 +22,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.12.11
+            tag: 0.13.0
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE
@@ -58,7 +58,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.12.11
+            tag: 0.13.0
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE
@@ -94,7 +94,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.12.11
+            tag: 0.13.0
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE

clusters/cl01tl/services/traefik/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: traefik
-    version: 37.3.0
+    version: 37.4.0
     repository: https://traefik.github.io/charts
   # enable pending:
   # https://github.com/traefik/traefik-helm-chart/pull/1340

clusters/cl01tl/storage/volsync/Chart.yaml

@@ -16,7 +16,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: volsync
-    version: 0.13.1
+    version: 0.14.0
     repository: https://backube.github.io/helm-charts/
 icon: https://raw.githubusercontent.com/backube/volsync/main/docs/media/volsync.svg?sanitize=true
 appVersion: 0.12.1

hosts/ps10rp/gitea/compose.yaml

@@ -19,7 +19,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     postgresql:
-        image: docker.io/postgres:17.7-alpine3.21
+        image: docker.io/postgres:18.1-alpine3.21
         container_name: gitea-postgres
         env_file:
             - .env