Merge pull request 'chore(deps): update home-assistant to v2026.4.4' (#6222 ) from renovate/unified-home-assistant into main

chore(deps): update home-assistant to v2026.4.4
Merge pull request 'chore(deps): update ghcr.io/renovatebot/renovate docker tag to v43.141.5' (#6220 ) from renovate/unified-renovate into main
2026-04-24 19:17:53 +00:00 · 2026-04-24 19:17:30 +00:00 · 2026-04-24 19:13:46 +00:00 · 2026-04-24 19:13:31 +00:00 · 2026-04-24 19:10:25 +00:00 · 2026-04-24 19:03:35 +00:00
67 changed files with 396 additions and 198 deletions
--- a/.gitea/workflows/lint-test-helm.yaml
+++ b/.gitea/workflows/lint-test-helm.yaml
@@ -169,9 +169,10 @@ jobs:

          echo ">> Running linting on changed charts ..."

-          for DIR in ${CHANGED_CHARTS}; do
-            CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
-            CHART_NAME=$(basename "${CHART_PATH}")
+          lint_chart() {
+            local DIR="$1"
+            local CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
+            local CHART_NAME=$(basename "${CHART_PATH}")

            if [ -f "${CHART_PATH}/Chart.yaml" ]; then
              echo ""
@@ -182,15 +183,8 @@ jobs:
              echo ">> Linting helm chart ${CHART_NAME} ..."

              if ! helm lint "${CHART_PATH}" --namespace "default"; then
-                EXIT_CODE=1
-
-                if [ -z "${FAILED_CHARTS}" ]; then
-                  FAILED_CHARTS="${DIR}"
-
-                else
-                  FAILED_CHARTS="${FAILED_CHARTS}, ${DIR}"
-
-                fi
+                echo "${DIR}" > ".failed_chart_${CHART_NAME}"
+                return 1
              fi

            else
@@ -198,8 +192,20 @@ jobs:
              echo ">> Directory ${CHART_PATH} does not contain a Chart.yaml. Skipping ..."

            fi
+          }

-          done
+          export -f lint_chart
+          export CLUSTER
+
+          for DIR in ${CHANGED_CHARTS}; do
+            echo "${DIR}"
+          done | xargs -P 4 -I {} bash -c 'OUT=$(lint_chart "$@" 2>&1); printf "%s\n" "$OUT"' _ {}
+
+          if ls .failed_chart_* 1> /dev/null 2>&1; then
+            EXIT_CODE=1
+            FAILED_CHARTS=$(cat .failed_chart_* | paste -sd ',' - | sed 's/,/, /g')
+            rm -f .failed_chart_*
+          fi

          echo ""
          echo "----"
@@ -329,8 +335,9 @@ jobs:
          EXIT_CODE=0
          FAILED_CHARTS=""

-          for DIR in ${CHANGED_CHARTS}; do
-            CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
+          validate_chart() {
+            local DIR="$1"
+            local CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
            echo ""
            echo ">> Validating: ${DIR}"

@@ -343,18 +350,23 @@ jobs:
                -strict \
                -summary; then

-              EXIT_CODE=1
-
-              if [ -z "${FAILED_CHARTS}" ]; then
-                FAILED_CHARTS="${DIR}"
-
-              else
-                FAILED_CHARTS="${FAILED_CHARTS}, ${DIR}"
-
-              fi
+              echo "${DIR}" > ".failed_chart_${DIR}"
+              return 1
            fi
+          }

-          done
+          export -f validate_chart
+          export CLUSTER SCHEMA_LOCATIONS
+
+          for DIR in ${CHANGED_CHARTS}; do
+            echo "${DIR}"
+          done | xargs -P 4 -I {} bash -c 'OUT=$(validate_chart "$@" 2>&1); printf "%s\n" "$OUT"' _ {}
+
+          if ls .failed_chart_* 1> /dev/null 2>&1; then
+            EXIT_CODE=1
+            FAILED_CHARTS=$(cat .failed_chart_* | paste -sd ',' - | sed 's/,/, /g')
+            rm -f .failed_chart_*
+          fi

          echo ""
          echo "----"
--- a/.gitea/workflows/renovate.yaml
+++ b/.gitea/workflows/renovate.yaml
@@ -13,7 +13,7 @@ on:
 jobs:
  renovate:
    runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.139.6@sha256:2ed9f867ea7a7d2448847ce704f78af09e9b881c63f843a1aa0f590691737c42
+    container: ghcr.io/renovatebot/renovate:43.141.5@sha256:8fb9e3cfdadc0994fb87f57be624d1c1940c41c1c53c074465caff85a2b6d3a4
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
--- a/clusters/cl01tl/helm/argocd/Chart.lock
+++ b/clusters/cl01tl/helm/argocd/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
  repository: https://argoproj.github.io/argo-helm
-  version: 9.5.2
-digest: sha256:5d9e6405ee944bf94df6af247164ebb9b8899144853b9a7eafabe8606affe84e
-generated: "2026-04-19T19:53:40.43789-05:00"
+  version: 9.5.4
+digest: sha256:3d21f3de99812af73615ef0e75f835d41d49b81a840107194b44e06057d7311f
+generated: "2026-04-24T18:07:49.106452954Z"
--- a/clusters/cl01tl/helm/argocd/Chart.yaml
+++ b/clusters/cl01tl/helm/argocd/Chart.yaml
@@ -13,8 +13,8 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: argo-cd
-    version: 9.5.2
+    version: 9.5.4
    repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-cd
-appVersion: v3.3.7
+appVersion: v3.3.8
--- a/clusters/cl01tl/helm/coredns/Chart.yaml
+++ b/clusters/cl01tl/helm/coredns/Chart.yaml
@@ -17,4 +17,4 @@ dependencies:
    repository: https://coredns.github.io/helm
 icon: https://raw.githubusercontent.com/coredns/coredns.io/refs/heads/master/static/images/favicon.png
 # renovate: datasource=github-releases depName=coredns/coredns
-appVersion: v1.14.2
+appVersion: v1.14.3
--- a/clusters/cl01tl/helm/excalidraw/Chart.yaml
+++ b/clusters/cl01tl/helm/excalidraw/Chart.yaml
@@ -19,4 +19,4 @@ dependencies:
    version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/excalidraw.png
 # renovate: datasource=github-releases depName=excalidraw/excalidraw
-appVersion: v0.18.0
+appVersion: v0.18.1
--- a/clusters/cl01tl/helm/external-dns/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/external-dns/templates/external-secret.yaml
@@ -13,5 +13,5 @@ spec:
  data:
    - secretKey: api-key
      remoteRef:
-        key: /unifi/auth/cl01tl
+        key: /unifi/users/cl01tl
        property: api-key
--- a/clusters/cl01tl/helm/external-secrets/Chart.lock
+++ b/clusters/cl01tl/helm/external-secrets/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: external-secrets
  repository: https://charts.external-secrets.io
-  version: 2.3.0
-digest: sha256:fedb79c937be24d4bb72f665122b468b445de95f3f02de419903e3136186e42f
-generated: "2026-04-10T15:10:52.488487421Z"
+  version: 2.4.0
+digest: sha256:a31b4ba5b5ec296036576c8d7d26f8b42061eec7142817f9ca0c256a457a2ea1
+generated: "2026-04-24T19:03:31.856576444Z"
--- a/clusters/cl01tl/helm/external-secrets/Chart.yaml
+++ b/clusters/cl01tl/helm/external-secrets/Chart.yaml
@@ -14,8 +14,8 @@ sources:
 dependencies:
  - name: external-secrets
    alias: external-secrets
-    version: 2.3.0
+    version: 2.4.0
    repository: https://charts.external-secrets.io
 icon: https://raw.githubusercontent.com/external-secrets/external-secrets/refs/heads/main/assets/eso-logo-large.png
 # renovate: datasource=github-releases depName=external-secrets/external-secrets
-appVersion: v2.3.0
+appVersion: v2.4.0
--- a/clusters/cl01tl/helm/external-secrets/values.yaml
+++ b/clusters/cl01tl/helm/external-secrets/values.yaml
@@ -2,7 +2,7 @@ external-secrets:
  replicaCount: 3
  image:
    repository: ghcr.io/external-secrets/external-secrets
-    tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
+    tag: v2.4.0@sha256:d2b74514f63f5b55360d08351f1fe5af3b1db794a81fa10389abe2ff2999c566
  installCRDs: true
  crds:
    createClusterExternalSecret: true
@@ -29,7 +29,7 @@ external-secrets:
  webhook:
    image:
      repository: ghcr.io/external-secrets/external-secrets
-      tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
+      tag: v2.4.0@sha256:d2b74514f63f5b55360d08351f1fe5af3b1db794a81fa10389abe2ff2999c566
    resources:
      requests:
        cpu: 1m
@@ -37,7 +37,7 @@ external-secrets:
  certController:
    image:
      repository: ghcr.io/external-secrets/external-secrets
-      tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
+      tag: v2.4.0@sha256:d2b74514f63f5b55360d08351f1fe5af3b1db794a81fa10389abe2ff2999c566
    resources:
      requests:
        cpu: 1m
--- a/clusters/cl01tl/helm/foldergram/values.yaml
+++ b/clusters/cl01tl/helm/foldergram/values.yaml
@@ -70,7 +70,7 @@ foldergram:
      forceRename: foldergram-data
      storageClass: synology-iscsi-delete
      accessMode: ReadWriteOnce
-      size: 250Gi
+      size: 500Gi
      advancedMounts:
        main:
          main:
--- a/clusters/cl01tl/helm/gitea/values.yaml
+++ b/clusters/cl01tl/helm/gitea/values.yaml
@@ -213,7 +213,7 @@ gitea-actions:
      registry: docker.io
      repository: docker
      # renovate: datasource=docker depName=docker
-      tag: 29.4.0-dind@sha256:f80c26212befc1c1988b529495532c6b9180d9b1dab1611f4a1efbe9da8ec821
+      tag: 29.4.1-dind@sha256:c77e5d7912f9b137cc67051fdc2991d8f5ae22c55ddf532bb836dcb693a04940
      extraVolumeMounts:
        - name: docker-vol
          mountPath: /var/lib/docker
--- a/clusters/cl01tl/helm/grimmory/Chart.yaml
+++ b/clusters/cl01tl/helm/grimmory/Chart.yaml
@@ -28,4 +28,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grimmory.png
 # renovate: datasource=github-releases depName=grimmory-tools/grimmory
-appVersion: v2.3.0
+appVersion: v3.0.0
--- a/clusters/cl01tl/helm/grimmory/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/grimmory/templates/external-secret.yaml
@@ -1,10 +1,10 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: grimmory-database-config
+  name: grimmory-database-secret
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: grimmory-database-config
+    app.kubernetes.io/name: grimmory-database-secret
    {{- include "custom.labels" . | nindent 4 }}
 spec:
  secretStoreRef:
@@ -33,11 +33,11 @@ spec:
    - secretKey: access
      remoteRef:
        key: /digital-ocean/home-infra/mariadb-backups
-        property: access
+        property: AWS_ACCESS_KEY_ID
    - secretKey: secret
      remoteRef:
        key: /digital-ocean/home-infra/mariadb-backups
-        property: secret
+        property: AWS_SECRET_ACCESS_KEY

 ---
 apiVersion: external-secrets.io/v1
--- a/clusters/cl01tl/helm/grimmory/values.yaml
+++ b/clusters/cl01tl/helm/grimmory/values.yaml
@@ -12,7 +12,7 @@ grimmory:
        main:
          image:
            repository: ghcr.io/grimmory-tools/grimmory
-            tag: v2.3.0@sha256:9014247f591074529894f81115ca40f899db697e89f72c2fe91ec530e3f19597
+            tag: v3.0.0@sha256:0130c338d4c1186f2f6b6acdc4a7ee56388dfdab9cb0b9a23ac0fc91b79e7d75
          env:
            - name: TZ
              value: America/Chicago
@@ -27,7 +27,7 @@ grimmory:
            - name: DATABASE_PASSWORD
              valueFrom:
                secretKeyRef:
-                  name: grimmory-database-config
+                  name: grimmory-database-secret
                  key: password
            - name: GRIMMORY_PORT
              value: 6060
@@ -98,7 +98,7 @@ mariadb-cluster:
  mariadb:
    rootPasswordSecretKeyRef:
      generate: false
-      name: grimmory-database-config
+      name: grimmory-database-secret
      key: password
    storage:
      size: 5Gi
--- a/clusters/cl01tl/helm/home-assistant/Chart.yaml
+++ b/clusters/cl01tl/helm/home-assistant/Chart.yaml
@@ -24,4 +24,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/home-assistant.png
 # renovate: datasource=github-releases depName=home-assistant/core
-appVersion: 2026.4.3
+appVersion: 2026.4.4
--- a/clusters/cl01tl/helm/home-assistant/values.yaml
+++ b/clusters/cl01tl/helm/home-assistant/values.yaml
@@ -12,7 +12,7 @@ home-assistant:
        main:
          image:
            repository: ghcr.io/home-assistant/home-assistant
-            tag: 2026.4.3@sha256:ae0800c81fea16bc1241ce03bddb9c6260566e90f58b09d3e5a629e4f68bdc0b
+            tag: 2026.4.4@sha256:c1e5f0147f4cb51ccb05bb30b62a1269cc1bd48a6274792d3b38a77ab274dfd2
          env:
            - name: TZ
              value: America/Chicago
@@ -23,7 +23,7 @@ home-assistant:
        code-server:
          image:
            repository: ghcr.io/linuxserver/code-server
-            tag: 4.116.0-ls333@sha256:4620adace18935dd6ca79d77e3bc1c379e21875392192f970cf5d6b0fb4aefcd
+            tag: 4.117.0-ls334@sha256:1f384394d473c43ab6a39b2227ba3aa9c95af648ce3a67e1b4da1969c16c7c0d
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/jellystat/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/jellystat/templates/external-secret.yaml
@@ -21,5 +21,5 @@ spec:
        property: user
    - secretKey: password
      remoteRef:
-        key: /cl01tl/jellystat/cconfig
+        key: /cl01tl/jellystat/config
        property: password
--- a/clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock
@@ -1,7 +1,7 @@
 dependencies:
 - name: kube-prometheus-stack
  repository: oci://ghcr.io/prometheus-community/charts
-  version: 83.7.0
+  version: 84.0.1
 - name: prometheus-operator-crds
  repository: oci://ghcr.io/prometheus-community/charts
  version: 28.0.1
@@ -11,5 +11,5 @@ dependencies:
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.6.1
-digest: sha256:d4435b0e182ec588250d52bee0957b22d7b69abc5be8b60606d4811bfc0ed8d6
-generated: "2026-04-21T17:08:18.793790591Z"
+digest: sha256:2714de1082a27491925ba1b7adfba884a5ca9e674df22df96e8f6ccf56a54a6e
+generated: "2026-04-24T17:03:37.423427661Z"
--- a/clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml
@@ -20,7 +20,7 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: kube-prometheus-stack
-    version: 83.7.0
+    version: 84.0.1
    repository: oci://ghcr.io/prometheus-community/charts
  - name: prometheus-operator-crds
    version: 28.0.1
--- a/clusters/cl01tl/helm/kube-prometheus-stack/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/templates/external-secret.yaml
@@ -13,7 +13,7 @@ spec:
  data:
    - secretKey: ntfy_password
      remoteRef:
-        key: / cl01tl/ntfy/users/cl01tl
+        key: /cl01tl/kube-prometheus-stack/ntfy-alertmanager
        property: password

 ---
--- a/clusters/cl01tl/helm/kube-prometheus-stack/values.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/values.yaml
@@ -30,7 +30,7 @@ kube-prometheus-stack:
              http_config:
                basic_auth:
                  username: ntfy-alertmanager
-                  password_file: /etc/alertmanager/secrets/alertmanager-config-secret/ntfy_password
+                  password_file: /etc/alertmanager/secrets/alertmanager-ntfy-config/ntfy_password
    route:
      main:
        enabled: true
--- a/clusters/cl01tl/helm/libation/Chart.yaml
+++ b/clusters/cl01tl/helm/libation/Chart.yaml
@@ -26,4 +26,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/libation.png
 # renovate: datasource=github-releases depName=rmcrackan/Libation
-appVersion: 13.3.4
+appVersion: 13.3.5
--- a/clusters/cl01tl/helm/libation/values.yaml
+++ b/clusters/cl01tl/helm/libation/values.yaml
@@ -12,7 +12,7 @@ libation:
        main:
          image:
            repository: rmcrackan/libation
-            tag: 13.3.4@sha256:eb0357e8a880ed0049dffd2a99a9d2eda322ed33b3b9e16f4fb93eb15275f396
+            tag: 13.3.5@sha256:fcfeaa406a3567e3de89d85bf761d17868029c6e8a127922672770cb812b9be8
          env:
            - name: SLEEP_TIME
              value: "-1"
--- a/clusters/cl01tl/helm/loki/Chart.lock
+++ b/clusters/cl01tl/helm/loki/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 6.55.0
 - name: alloy
  repository: https://grafana.github.io/helm-charts
-  version: 1.7.0
-digest: sha256:e6a06dc016858215a461d05c543b937f7a87ecc1bb58381cd6fb825ba524fa66
-generated: "2026-04-02T19:05:47.897397013Z"
+  version: 1.8.0
+digest: sha256:e3c7508c21ed7737f692387ca79a0c001c3393edbedff7b05c60325469a4fb2b
+generated: "2026-04-24T17:01:55.023153925Z"
--- a/clusters/cl01tl/helm/loki/Chart.yaml
+++ b/clusters/cl01tl/helm/loki/Chart.yaml
@@ -18,7 +18,7 @@ dependencies:
    version: 6.55.0
    repository: https://grafana.github.io/helm-charts
  - name: alloy
-    version: 1.7.0
+    version: 1.8.0
    repository: https://grafana.github.io/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/loki.png
 # renovate: datasource=github-releases depName=grafana/loki
--- a/clusters/cl01tl/helm/matrix-synapse/templates/_helpers.tpl
+++ b/clusters/cl01tl/helm/matrix-synapse/templates/_helpers.tpl
@@ -14,7 +14,7 @@ app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}

 {{/*
-NFS names
+ServiceAccount names
 */}}
 {{- define "custom.serviceAccountName" -}}
 matrix-synapse
--- a/clusters/cl01tl/helm/matrix-synapse/templates/secret-provider-class.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/templates/secret-provider-class.yaml
@@ -16,22 +16,102 @@ spec:
        fileName: config.yaml
        secretPath: secret/data/cl01tl/matrix-synapse/config
        secretKey: config.yaml
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-synapse-oidc-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-synapse-oidc-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
      - objectName: oidc.yaml
        fileName: oidc.yaml
        secretPath: secret/data/cl01tl/matrix-synapse/config
        secretKey: oidc.yaml
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-synapse-hookshot-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-synapse-hookshot-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
      - objectName: hookshot-registration.yaml
        fileName: hookshot-registration.yaml
        secretPath: secret/data/cl01tl/matrix-synapse/hookshot
        secretKey: hookshot-registration.yaml
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-synapse-mautrix-discord-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-synapse-mautrix-discord-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
      - objectName: mautrix-discord-registration.yaml
        fileName: mautrix-discord-registration.yaml
        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-discord
        secretKey: mautrix-discord-registration.yaml
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-synapse-mautrix-whatsapp-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-synapse-mautrix-whatsapp-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
      - objectName: mautrix-whatsapp-registration.yaml
        fileName: mautrix-whatsapp-registration.yaml
        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-whatsapp
        secretKey: mautrix-whatsapp-registration.yaml
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-synapse-double-puppet-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-synapse-double-puppet-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
      - objectName: double-puppet-registration.yaml
        fileName: double-puppet-registration.yaml
        secretPath: secret/data/cl01tl/matrix-synapse/double-puppet
--- a/clusters/cl01tl/helm/matrix-synapse/values.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/values.yaml
@@ -37,17 +37,73 @@ matrix-synapse:
    strategy:
      type: Recreate
    extraVolumes:
-      - name: config
+      - name: synapse-config
        csi:
          driver: secrets-store.csi.k8s.io
          readOnly: true
          volumeAttributes:
            secretProviderClass: matrix-synapse-config
+      - name: oidc-config
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: matrix-synapse-oidc-config
+      - name: hookshot-config
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: matrix-synapse-hookshot-config
+      - name: mautrix-discord-config
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: matrix-synapse-mautrix-discord-config
+      - name: mautrix-whatsapp-config
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: matrix-synapse-mautrix-whatsapp-config
+      - name: double-puppet-config
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: matrix-synapse-double-puppet-config
    extraVolumeMounts:
-      - name: config
-        mountPath: /synapse/config/conf.d
+      - name: synapse-config
+        mountPath: /synapse/config/conf.d/config.yaml
        mountPropagation: None
        readOnly: true
+        subPath: config.yaml
+      - name: oidc-config
+        mountPath: /synapse/config/conf.d/oidc.yaml
+        mountPropagation: None
+        readOnly: true
+        subPath: oidc.yaml
+      - name: hookshot-config
+        mountPath: /synapse/config/conf.d/hookshot-registration.yaml
+        mountPropagation: None
+        readOnly: true
+        subPath: hookshot-registration.yaml
+      - name: mautrix-discord-config
+        mountPath: /synapse/config/conf.d/mautrix-discord-registration.yaml
+        mountPropagation: None
+        readOnly: true
+        subPath: mautrix-discord-registration.yaml
+      - name: mautrix-whatsapp-config
+        mountPath: /synapse/config/conf.d/mautrix-whatsapp-registration.yaml
+        mountPropagation: None
+        readOnly: true
+        subPath: mautrix-whatsapp-registration.yaml
+      - name: double-puppet-config
+        mountPath: /synapse/config/conf.d/double-puppet-registration.yaml
+        mountPropagation: None
+        readOnly: true
+        subPath: double-puppet-registration.yaml
    resources:
      requests:
        cpu: 10m
@@ -109,6 +165,8 @@ matrix-synapse:
    enabled: false
  gateway:
    enabled: false
+  serviceAccount:
+    name: matrix-synapse
 matrix-hookshot:
  global:
    nameOverride: matrix-hookshot
@@ -118,6 +176,8 @@ matrix-hookshot:
      type: deployment
      replicas: 1
      strategy: Recreate
+      serviceAccount:
+        name: matrix-synapse
      containers:
        main:
          image:
--- a/clusters/cl01tl/helm/medialyze/Chart.yaml
+++ b/clusters/cl01tl/helm/medialyze/Chart.yaml
@@ -24,4 +24,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/frederikemmer/MediaLyze/d8f69c0628bac7c047b90f91a66341648029c273/frontend/public/favicon.svg
 # renovate: datasource=github-releases depName=frederikemmer/MediaLyze
-appVersion: 0.8.2
+appVersion: 0.8.3
--- a/clusters/cl01tl/helm/medialyze/values.yaml
+++ b/clusters/cl01tl/helm/medialyze/values.yaml
@@ -12,7 +12,7 @@ medialyze:
        main:
          image:
            repository: ghcr.io/frederikemmer/medialyze
-            tag: 0.8.2@sha256:dd9f034f6daf32f68f386971540f9696c49699063abe553be5f58b4a964ae80f
+            tag: 0.8.3@sha256:ef21e989f3d04c99f0fee4c992a92308156c746e26fb98672a3fa714fc630367
          env:
            - name: HOST_PORT
              value: 8080
--- a/clusters/cl01tl/helm/ntfy/Chart.yaml
+++ b/clusters/cl01tl/helm/ntfy/Chart.yaml
@@ -23,4 +23,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ntfy.png
 # renovate: datasource=github-releases depName=binwiederhier/ntfy
-appVersion: 2.21.0
+appVersion: 2.22.0
--- a/clusters/cl01tl/helm/ntfy/values.yaml
+++ b/clusters/cl01tl/helm/ntfy/values.yaml
@@ -8,7 +8,7 @@ ntfy:
        main:
          image:
            repository: binwiederhier/ntfy
-            tag: v2.21.0@sha256:2b9e12d56a538f4402da51328eeca02696c4b207ab7fbe031c27e51a22ca9b86
+            tag: v2.22.0@sha256:d8b3408c75d5ae78e03339af6103e7e6195e56573eea6f1ad34bb4dc4f44f340
          args: ["serve"]
          env:
            - name: TZ
--- a/clusters/cl01tl/helm/ollama/Chart.yaml
+++ b/clusters/cl01tl/helm/ollama/Chart.yaml
@@ -31,4 +31,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ollama.png
 # renovate: datasource=github-releases depName=ollama/ollama
-appVersion: 0.21.0
+appVersion: 0.21.2
--- a/clusters/cl01tl/helm/ollama/values.yaml
+++ b/clusters/cl01tl/helm/ollama/values.yaml
@@ -21,7 +21,7 @@ ollama:
        main:
          image:
            repository: ollama/ollama
-            tag: 0.21.0@sha256:d3d553bdfbcc7f55dd5ddf42c4cbe3a927aa9bb1802710d35e94656ca5aea02b
+            tag: 0.21.2@sha256:2038a264392af4d21f7f14e1568e8dd9aa0f2bd0f31d7d9a59a8cca1e9829663
          env:
            - name: OLLAMA_KEEP_ALIVE
              value: 24h
@@ -55,7 +55,7 @@ ollama:
        main:
          image:
            repository: ollama/ollama
-            tag: 0.21.0@sha256:d3d553bdfbcc7f55dd5ddf42c4cbe3a927aa9bb1802710d35e94656ca5aea02b
+            tag: 0.21.2@sha256:2038a264392af4d21f7f14e1568e8dd9aa0f2bd0f31d7d9a59a8cca1e9829663
          env:
            - name: OLLAMA_KEEP_ALIVE
              value: 24h
@@ -89,7 +89,7 @@ ollama:
        main:
          image:
            repository: ollama/ollama
-            tag: 0.21.0@sha256:d3d553bdfbcc7f55dd5ddf42c4cbe3a927aa9bb1802710d35e94656ca5aea02b
+            tag: 0.21.2@sha256:2038a264392af4d21f7f14e1568e8dd9aa0f2bd0f31d7d9a59a8cca1e9829663
          env:
            - name: OLLAMA_KEEP_ALIVE
              value: 24h
@@ -110,7 +110,7 @@ ollama:
        main:
          image:
            repository: ghcr.io/open-webui/open-webui
-            tag: v0.9.1@sha256:03d2b006989f0fe6559391a0c5d4ccac12688d7813d23cb4de86e5cc0ab22978
+            tag: v0.9.2@sha256:a7e4796ae894d1e2a0c1824860ade472f35c507608a01c3581377b5c19b0ed49
          env:
            - name: ENV
              value: prod
@@ -127,7 +127,7 @@ ollama:
            - name: WEBUI_SECRET_KEY
              valueFrom:
                secretKeyRef:
-                  name: ollama-key
+                  name: open-webui-key
                  key: key
            - name: DATABASE_URL
              valueFrom:
--- a/clusters/cl01tl/helm/openbao/Chart.yaml
+++ b/clusters/cl01tl/helm/openbao/Chart.yaml
@@ -19,7 +19,7 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: openbao
-    version: 0.27.1
+    version: 0.27.2
    repository: https://openbao.github.io/openbao-helm
  - name: app-template
    alias: unseal
--- a/clusters/cl01tl/helm/openbao/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/openbao/templates/external-secret.yaml
@@ -9,7 +9,7 @@ metadata:
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
@@ -40,24 +40,20 @@ metadata:
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: ENVIRONMENT
      remoteRef:
        key: /cl01tl/openbao/unseal
-        property: ENVIRONMENT
+        property: environment
    - secretKey: NODES
      remoteRef:
        key: /cl01tl/openbao/unseal
-        property: NODES
+        property: nodes
    - secretKey: TOKENS
      remoteRef:
        key: /cl01tl/openbao/unseal
-        property: TOKENS_1
-    - secretKey: NOTIFY_QUEUE_URLS
-      remoteRef:
-        key: /cl01tl/openbao/unseal
-        property: NOTIFY_QUEUE_URLS
+        property: tokens-1

 ---
 apiVersion: external-secrets.io/v1
@@ -71,24 +67,20 @@ metadata:
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: ENVIRONMENT
      remoteRef:
        key: /cl01tl/openbao/unseal
-        property: ENVIRONMENT
+        property: environment
    - secretKey: NODES
      remoteRef:
        key: /cl01tl/openbao/unseal
-        property: NODES
+        property: nodes
    - secretKey: TOKENS
      remoteRef:
        key: /cl01tl/openbao/unseal
-        property: TOKENS_2
-    - secretKey: NOTIFY_QUEUE_URLS
-      remoteRef:
-        key: /cl01tl/openbao/unseal
-        property: NOTIFY_QUEUE_URLS
+        property: tokens-2

 ---
 apiVersion: external-secrets.io/v1
@@ -102,61 +94,46 @@ metadata:
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: ENVIRONMENT
      remoteRef:
        key: /cl01tl/openbao/unseal
-        property: ENVIRONMENT
+        property: environment
    - secretKey: NODES
      remoteRef:
        key: /cl01tl/openbao/unseal
-        property: NODES
+        property: nodes
    - secretKey: TOKENS
      remoteRef:
        key: /cl01tl/openbao/unseal
-        property: TOKENS_3
-    - secretKey: NOTIFY_QUEUE_URLS
-      remoteRef:
-        key: /cl01tl/openbao/unseal
-        property: NOTIFY_QUEUE_URLS
+        property: tokens-3

-# ---
-# apiVersion: external-secrets.io/v1
-# kind: ExternalSecret
-# metadata:
-#   name: openbao-token
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: openbao-token
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   secretStoreRef:
-#     kind: ClusterSecretStore
-#     name: openbao
-#   data:
-#     - secretKey: token
-#       remoteRef:
-#         key: /cl01tl/openbao/token
-#         property: token
-#     - secretKey: unseal_key_1
-#       remoteRef:
-#         key: /cl01tl/openbao/token
-#         property: unseal_key_1
-#     - secretKey: unseal_key_2
-#       remoteRef:
-#         key: /cl01tl/openbao/token
-#         property: unseal_key_2
-#     - secretKey: unseal_key_3
-#       remoteRef:
-#         key: /cl01tl/openbao/token
-#         property: unseal_key_3
-#     - secretKey: unseal_key_4
-#       remoteRef:
-#         key: /cl01tl/openbao/token
-#         property: unseal_key_4
-#     - secretKey: unseal_key_5
-#       remoteRef:
-#         key: /cl01tl/openbao/token
-#         property: unseal_key_5
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: openbao-ntfy-unseal-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: openbao-ntfy-unseal-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    template:
+      mergePolicy: Merge
+      engineVersion: v2
+      data:
+        NOTIFY_QUEUE_URLS: "{{ `{{ .endpoint }}` }}/{{ `{{ .topic }}` }}/?priority=4&tags=vault,unseal&title=Vault+Unsealed"
+  data:
+    - secretKey: endpoint
+      remoteRef:
+        key: /cl01tl/ntfy/users/cl01tl
+        property: internal-endpoint-credential
+    - secretKey: topic
+      remoteRef:
+        key: /cl01tl/ntfy/topics
+        property: openbao
--- a/clusters/cl01tl/helm/openbao/values.yaml
+++ b/clusters/cl01tl/helm/openbao/values.yaml
@@ -100,6 +100,11 @@ openbao:
      requests:
        cpu: 50m
        memory: 100Mi
+    pod:
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
    agent:
      image:
        registry: quay.io
@@ -160,6 +165,8 @@ unseal:
          envFrom:
            - secretRef:
                name: openbao-unseal-config-1
+            - secretRef:
+                name: openbao-ntfy-unseal-config
          resources:
            requests:
              cpu: 1m
@@ -176,6 +183,8 @@ unseal:
          envFrom:
            - secretRef:
                name: openbao-unseal-config-2
+            - secretRef:
+                name: openbao-ntfy-unseal-config
          resources:
            requests:
              cpu: 1m
@@ -192,6 +201,8 @@ unseal:
          envFrom:
            - secretRef:
                name: openbao-unseal-config-3
+            - secretRef:
+                name: openbao-ntfy-unseal-config
          resources:
            requests:
              cpu: 1m
--- a/clusters/cl01tl/helm/outline/values.yaml
+++ b/clusters/cl01tl/helm/outline/values.yaml
@@ -96,12 +96,8 @@ outline:
                secretKeyRef:
                  name: outline-oidc-authentik
                  key: secret
-            - name: OIDC_AUTH_URI
-              value: https://auth.alexlebens.dev/application/o/authorize/
-            - name: OIDC_TOKEN_URI
-              value: https://auth.alexlebens.dev/application/o/token/
-            - name: OIDC_USERINFO_URI
-              value: https://auth.alexlebens.dev/application/o/userinfo/
+            - name: OIDC_ISSUER_URL
+              value: https://auth.alexlebens.dev/application/o/outline
            - name: OIDC_USERNAME_CLAIM
              value: email
            - name: OIDC_DISPLAY_NAME
--- a/clusters/cl01tl/helm/paperless-ngx/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/paperless-ngx/templates/external-secret.yaml
@@ -55,5 +55,5 @@ spec:
  data:
    - secretKey: PAPERLESS_SOCIALACCOUNT_PROVIDERS
      remoteRef:
-        key: /authentik/oidc/paperless-ngx
+        key: /cl01tl/authentik/oidc/paperless-ngx
        property: PAPERLESS_SOCIALACCOUNT_PROVIDERS
--- a/clusters/cl01tl/helm/postiz/values.yaml
+++ b/clusters/cl01tl/helm/postiz/values.yaml
@@ -232,7 +232,7 @@ temporal:
  web:
    image:
      repository: temporalio/ui
-      tag: 2.48.4@sha256:b01df917af27067914b716a347eff78d232dfd47cc2c8527c621ce85e5bc15e3
+      tag: 2.49.1@sha256:a066bdf5c4de689cabaf80cc357871f1db5e6d750a6bcfc42e877b913e31ef24
    resources:
      requests:
        cpu: 10m
--- a/clusters/cl01tl/helm/prowlarr/Chart.yaml
+++ b/clusters/cl01tl/helm/prowlarr/Chart.yaml
@@ -28,4 +28,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prowlarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-prowlarr
-appVersion: 2.3.5.5327-ls142
+appVersion: 2.3.5.5327-ls143
--- a/clusters/cl01tl/helm/prowlarr/values.yaml
+++ b/clusters/cl01tl/helm/prowlarr/values.yaml
@@ -12,7 +12,7 @@ prowlarr:
        main:
          image:
            repository: ghcr.io/linuxserver/prowlarr
-            tag: 2.3.5.5327-ls142@sha256:6df73ab9e99d0dbaad27c39d8a47c600333eebea80fcb56253a0bb8b630c8115
+            tag: 2.3.5.5327-ls143@sha256:c5de2a8758a05594319263e7691c1dce56899442ed1720d6eca216c0958f4caf
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/qbittorrent/values.yaml
+++ b/clusters/cl01tl/helm/qbittorrent/values.yaml
@@ -55,7 +55,7 @@ qbittorrent:
        gluetun:
          image:
            repository: ghcr.io/qdm12/gluetun
-            tag: v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab
+            tag: latest@sha256:725d3e51091dde4ca43e3e3f26e2e6d3d0ccc66821e92d505c3da04958f7d472
          lifecycle:
            postStart:
              exec:
@@ -71,11 +71,11 @@ qbittorrent:
                  name: protonvpn-wireguard-conf
                  key: private-key
            - name: FIREWALL_OUTBOUND_SUBNETS
-              value: 192.168.1.0/24,10.244.0.0/16
+              value: 192.168.1.0/24,10.244.0.0/16,10.96.0.0/16
            - name: FIREWALL_INPUT_PORTS
-              value: 5030,50300
+              value: 8080,9022
            - name: VPN_PORT_FORWARDING
-              value: 'on'
+              value: "on"
            - name: VPN_PORT_FORWARDING_UP_COMMAND
              value: '/bin/sh -c "/gluetun/update.sh {{ printf "{{PORTS}}" }}"'
            - name: DNS_UPSTREAM_RESOLVER_TYPE
--- a/clusters/cl01tl/helm/rclone/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/rclone/templates/external-secret.yaml
@@ -44,7 +44,7 @@ metadata:
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
@@ -79,7 +79,7 @@ metadata:
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
@@ -114,7 +114,7 @@ metadata:
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
@@ -149,7 +149,7 @@ metadata:
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
@@ -184,7 +184,7 @@ metadata:
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
--- a/clusters/cl01tl/helm/roundcube/values.yaml
+++ b/clusters/cl01tl/helm/roundcube/values.yaml
@@ -103,7 +103,7 @@ roundcube:
            - name: ROUNDCUBEMAIL_DES_KEY
              valueFrom:
                secretKeyRef:
-                  name: roundcube-key-secret
+                  name: roundcube-key
                  key: DES_KEY
            - name: ROUNDCUBEMAIL_DEFAULT_HOST
              value: tls://stalwart.stalwart
--- a/clusters/cl01tl/helm/s3-exporter/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/s3-exporter/templates/external-secret.yaml
@@ -13,15 +13,15 @@ spec:
  data:
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
-        key: /digital-ocean/home-infra/s3-exporter
+        key: /digital-ocean/home-infra/all-access
        property: AWS_ACCESS_KEY_ID
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
-        key: /digital-ocean/home-infra/s3-exporter
+        key: /digital-ocean/home-infra/all-access
        property: AWS_SECRET_ACCESS_KEY
    - secretKey: AWS_REGION
      remoteRef:
-        key: /digital-ocean/home-infra/s3-exporter
+        key: /digital-ocean/home-infra/all-access
        property: AWS_REGION

 ---
--- a/clusters/cl01tl/helm/searxng/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/searxng/templates/external-secret.yaml
@@ -9,7 +9,7 @@ metadata:
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: metrics-password
      remoteRef:
--- a/clusters/cl01tl/helm/searxng/values.yaml
+++ b/clusters/cl01tl/helm/searxng/values.yaml
@@ -10,7 +10,7 @@ searxng:
        main:
          image:
            repository: searxng/searxng
-            tag: latest@sha256:37c616a774b90fb5df9239eb143f1b11866ddf7b830cd1ebcca6ba11b38cc2bf
+            tag: latest@sha256:c9100c29c14a77d5289263a671580226c3b8a396a1a0130d2f500f57076a0119
          env:
            - name: SEARXNG_BASE_URL
              value: http://searxng-api.searxng:8080
@@ -38,7 +38,7 @@ searxng:
        main:
          image:
            repository: searxng/searxng
-            tag: latest@sha256:37c616a774b90fb5df9239eb143f1b11866ddf7b830cd1ebcca6ba11b38cc2bf
+            tag: latest@sha256:c9100c29c14a77d5289263a671580226c3b8a396a1a0130d2f500f57076a0119
          env:
            - name: SEARXNG_BASE_URL
              value: https://searxng.alexlebens.net/
--- a/clusters/cl01tl/helm/slskd/values.yaml
+++ b/clusters/cl01tl/helm/slskd/values.yaml
@@ -73,7 +73,7 @@ slskd:
                  name: protonvpn-wireguard-conf
                  key: private-key
            - name: FIREWALL_OUTBOUND_SUBNETS
-              value: 192.168.1.0/24,10.244.0.0/16
+              value: 192.168.1.0/24,10.0.0.0/8
            - name: FIREWALL_INPUT_PORTS
              value: 5030,50300
            - name: DNS_UPSTREAM_RESOLVER_TYPE
--- a/clusters/cl01tl/helm/talos/templates/_helpers.tpl
+++ b/clusters/cl01tl/helm/talos/templates/_helpers.tpl
@@ -12,3 +12,13 @@ Selector labels
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}
+
+{{/*
+ServiceAccount names
+*/}}
+{{- define "custom.serviceAccountName" -}}
+talos-backup
+{{- end -}}
+{{- define "custom.serviceAccountSecretsName" -}}
+talos-backup-secrets
+{{- end -}}
--- a/clusters/cl01tl/helm/talos/templates/secret-provider-class.yaml
+++ b/clusters/cl01tl/helm/talos/templates/secret-provider-class.yaml
@@ -10,7 +10,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: {{ include "custom.serviceAccountName" . }}
    objects: |
      - objectName: .s3cfg
        fileName: .s3cfg
@@ -30,7 +30,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: {{ include "custom.serviceAccountName" . }}
    objects: |
      - objectName: .s3cfg
        fileName: .s3cfg
@@ -50,7 +50,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: {{ include "custom.serviceAccountName" . }}
    objects: |
      - objectName: .s3cfg
        fileName: .s3cfg
@@ -70,7 +70,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: {{ include "custom.serviceAccountName" . }}
    objects: |
      - objectName: config
        fileName: config
--- a/clusters/cl01tl/helm/talos/templates/service-account.yaml
+++ b/clusters/cl01tl/helm/talos/templates/service-account.yaml
@@ -1,10 +1,20 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "custom.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
+
+---
 apiVersion: talos.dev/v1alpha1
 kind: ServiceAccount
 metadata:
-  name: talos-backup-secrets
+  name: {{ include "custom.serviceAccountSecretsName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: talos-backup-secrets
+    app.kubernetes.io/name: {{ include "custom.serviceAccountSecretsName" . }}
    {{- include "custom.labels" . | nindent 4 }}
 spec:
  roles:
--- a/clusters/cl01tl/helm/talos/values.yaml
+++ b/clusters/cl01tl/helm/talos/values.yaml
@@ -15,6 +15,8 @@ etcd-backup:
        schedule: 0 2 * * *
        backoffLimit: 3
        parallelism: 1
+      serviceAccount:
+        name: talos-backup
      containers:
        backup:
          image:
@@ -95,6 +97,8 @@ etcd-backup:
        schedule: 0 3 * * *
        backoffLimit: 3
        parallelism: 1
+      serviceAccount:
+        name: talos-backup
      containers:
        backup:
          image:
@@ -175,6 +179,8 @@ etcd-backup:
        schedule: 0 4 * * *
        backoffLimit: 3
        parallelism: 1
+      serviceAccount:
+        name: talos-backup
      containers:
        backup:
          image:
--- a/clusters/cl01tl/helm/traefik/Chart.lock
+++ b/clusters/cl01tl/helm/traefik/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 39.0.8
 - name: traefik-crds
  repository: https://traefik.github.io/charts
-  version: 1.16.0
-digest: sha256:e63ea5a588f53e421e33372390b0755609974029827762aa17ff5caec3ddd90c
-generated: "2026-04-17T16:08:27.772737904Z"
+  version: 1.17.0
+digest: sha256:93a74b11097a301c811ad03080fd1d6a1c1e695b6794b2c6cff7d61ae98ecc4f
+generated: "2026-04-24T16:35:47.354173673Z"
--- a/clusters/cl01tl/helm/traefik/Chart.yaml
+++ b/clusters/cl01tl/helm/traefik/Chart.yaml
@@ -17,8 +17,8 @@ dependencies:
    version: 39.0.8
    repository: https://traefik.github.io/charts
  - name: traefik-crds
-    version: 1.16.0
+    version: 1.17.0
    repository: https://traefik.github.io/charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/traefik.png
 # renovate: datasource=github-releases depName=traefik/traefik
-appVersion: v3.6.13
+appVersion: v3.6.14
--- a/clusters/cl01tl/helm/traefik/values.yaml
+++ b/clusters/cl01tl/helm/traefik/values.yaml
@@ -2,7 +2,7 @@ traefik:
  image:
    registry: docker.io
    repository: traefik
-    tag: v3.6.13@sha256:abb4f51887319c9b9d9cfe1d3cdf9379a771138003bf683f10e97697e148f95f
+    tag: v3.6.14@sha256:1c1be62608b6a484c585a917203b01a8226cff13df6a2a78705eeb66b52e667e
  deployment:
    kind: DaemonSet
  ingressClass:
--- a/clusters/cl01tl/helm/tubearchivist/values.yaml
+++ b/clusters/cl01tl/helm/tubearchivist/values.yaml
@@ -62,7 +62,7 @@ tubearchivist:
                  name: protonvpn-wireguard-conf
                  key: private-key
            - name: FIREWALL_OUTBOUND_SUBNETS
-              value: 192.168.1.0/24,10.244.0.0/16
+              value: 192.168.1.0/24,10.0.0.0/8
            - name: FIREWALL_INPUT_PORTS
              value: 80,8000,24000
            - name: DNS_UPSTREAM_RESOLVER_TYPE
--- a/clusters/cl01tl/helm/vault/templates/_helpers.tpl
+++ b/clusters/cl01tl/helm/vault/templates/_helpers.tpl
@@ -12,3 +12,10 @@ Selector labels
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}
+
+{{/*
+ServiceAccount names
+*/}}
+{{- define "custom.serviceAccountName" -}}
+vault
+{{- end -}}
--- a/clusters/cl01tl/helm/vault/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/vault/templates/external-secret.yaml
@@ -1,5 +1,24 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
+metadata:
+  name: vault-token
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-token
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: token
+      remoteRef:
+        key: /cl01tl/vault/token
+        property: root
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
  name: vault-snapshot-agent-role
  namespace: {{ .Release.Namespace }}
@@ -74,7 +93,7 @@ spec:
  data:
    - secretKey: BUCKET
      remoteRef:
-        key: /digital-ocean/home-infra/vault-backup
+        key: /digital-ocean/home-infra/vault-backups
        property: BUCKET_PATH

 ---
@@ -174,12 +193,12 @@ spec:
  data:
    - secretKey: NTFY_TOKEN
      remoteRef:
-        key: /ntfy/user/cl01tl
+        key: /cl01tl/ntfy/users/cl01tl
        property: token
    - secretKey: NTFY_ENDPOINT
      remoteRef:
-        key: /ntfy/user/cl01tl
-        property: endpoint
+        key: /cl01tl/ntfy/config
+        property: internal-endpoint
    - secretKey: NTFY_TOPIC
      remoteRef:
        key: /cl01tl/ntfy/topics
--- a/clusters/cl01tl/helm/vault/templates/secret-provider-class.yaml
+++ b/clusters/cl01tl/helm/vault/templates/secret-provider-class.yaml
@@ -10,7 +10,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: vault
    objects: |
      - objectName: .s3cfg
        fileName: .s3cfg
@@ -30,7 +30,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: vault
    objects: |
      - objectName: .s3cfg
        fileName: .s3cfg
@@ -50,7 +50,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: vault
    objects: |
      - objectName: .s3cfg
        fileName: .s3cfg
--- a/clusters/cl01tl/helm/vault/templates/service-account.yaml
+++ b/clusters/cl01tl/helm/vault/templates/service-account.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "custom.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
--- a/clusters/cl01tl/helm/vault/values.yaml
+++ b/clusters/cl01tl/helm/vault/values.yaml
@@ -107,6 +107,8 @@ snapshot:
        schedule: 0 4 * * *
        backoffLimit: 3
        parallelism: 1
+      serviceAccount:
+        name: vault
      initContainers:
        snapshot:
          image:
--- a/clusters/cl01tl/helm/yamtrack/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/yamtrack/templates/external-secret.yaml
@@ -14,7 +14,7 @@ spec:
    - secretKey: SECRET
      remoteRef:
        key: /cl01tl/yamtrack/config
-        property: SECRET
+        property: secret

 ---
 apiVersion: external-secrets.io/v1
--- a/hosts/ps08rp/traefik/compose.yaml
+++ b/hosts/ps08rp/traefik/compose.yaml
@@ -1,7 +1,7 @@
 ---
 services:
    traefik:
-        image: ghcr.io/traefik/traefik:v3.6.13@sha256:abb4f51887319c9b9d9cfe1d3cdf9379a771138003bf683f10e97697e148f95f
+        image: ghcr.io/traefik/traefik:v3.6.14@sha256:1c1be62608b6a484c585a917203b01a8226cff13df6a2a78705eeb66b52e667e
        container_name: traefik
        command:
            - "--global.checkNewVersion=false"
--- a/hosts/ps09rp/traefik/compose.yaml
+++ b/hosts/ps09rp/traefik/compose.yaml
@@ -1,7 +1,7 @@
 ---
 services:
    traefik:
-        image: ghcr.io/traefik/traefik:v3.6.13@sha256:abb4f51887319c9b9d9cfe1d3cdf9379a771138003bf683f10e97697e148f95f
+        image: ghcr.io/traefik/traefik:v3.6.14@sha256:1c1be62608b6a484c585a917203b01a8226cff13df6a2a78705eeb66b52e667e
        container_name: traefik
        command:
            - "--global.checkNewVersion=false"
--- a/hosts/ps10rp/traefik/compose.yaml
+++ b/hosts/ps10rp/traefik/compose.yaml
@@ -20,7 +20,7 @@ services:
            - /dev/net/tun:/dev/net/tun

    traefik:
-        image: ghcr.io/traefik/traefik:v3.6.13@sha256:abb4f51887319c9b9d9cfe1d3cdf9379a771138003bf683f10e97697e148f95f
+        image: ghcr.io/traefik/traefik:v3.6.14@sha256:1c1be62608b6a484c585a917203b01a8226cff13df6a2a78705eeb66b52e667e
        container_name: traefik
        command:
            - "--global.checkNewVersion=false"