Merge pull request 'feat: downgrade' (#6227) from tmp/argocd into main

Reviewed-on: #6227

.gitea/workflows/lint-test-helm.yaml

@@ -169,9 +169,10 @@ jobs:
 
           echo ">> Running linting on changed charts ..."
 
-          for DIR in ${CHANGED_CHARTS}; do
+          lint_chart() {
-            CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
+            local DIR="$1"
-            CHART_NAME=$(basename "${CHART_PATH}")
+            local CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
+            local CHART_NAME=$(basename "${CHART_PATH}")
 
             if [ -f "${CHART_PATH}/Chart.yaml" ]; then
               echo ""
@@ -182,15 +183,8 @@ jobs:
               echo ">> Linting helm chart ${CHART_NAME} ..."
 
               if ! helm lint "${CHART_PATH}" --namespace "default"; then
-                EXIT_CODE=1
+                echo "${DIR}" > ".failed_chart_${CHART_NAME}"
-
+                return 1
-                if [ -z "${FAILED_CHARTS}" ]; then
-                  FAILED_CHARTS="${DIR}"
-
-                else
-                  FAILED_CHARTS="${FAILED_CHARTS}, ${DIR}"
-
-                fi
               fi
 
             else
@@ -198,8 +192,20 @@ jobs:
               echo ">> Directory ${CHART_PATH} does not contain a Chart.yaml. Skipping ..."
 
             fi
+          }
 
-          done
+          export -f lint_chart
+          export CLUSTER
+
+          for DIR in ${CHANGED_CHARTS}; do
+            echo "${DIR}"
+          done | xargs -P 4 -I {} bash -c 'OUT=$(lint_chart "$@" 2>&1); printf "%s\n" "$OUT"' _ {}
+
+          if ls .failed_chart_* 1> /dev/null 2>&1; then
+            EXIT_CODE=1
+            FAILED_CHARTS=$(cat .failed_chart_* | paste -sd ',' - | sed 's/,/, /g')
+            rm -f .failed_chart_*
+          fi
 
           echo ""
           echo "----"
@@ -329,8 +335,9 @@ jobs:
           EXIT_CODE=0
           FAILED_CHARTS=""
 
-          for DIR in ${CHANGED_CHARTS}; do
+          validate_chart() {
-            CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
+            local DIR="$1"
+            local CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
             echo ""
             echo ">> Validating: ${DIR}"
 
@@ -343,18 +350,23 @@ jobs:
                 -strict \
                 -summary; then
 
+              echo "${DIR}" > ".failed_chart_${DIR}"
+              return 1
+            fi
+          }
+
+          export -f validate_chart
+          export CLUSTER SCHEMA_LOCATIONS
+
+          for DIR in ${CHANGED_CHARTS}; do
+            echo "${DIR}"
+          done | xargs -P 4 -I {} bash -c 'OUT=$(validate_chart "$@" 2>&1); printf "%s\n" "$OUT"' _ {}
+
+          if ls .failed_chart_* 1> /dev/null 2>&1; then
             EXIT_CODE=1
-
+            FAILED_CHARTS=$(cat .failed_chart_* | paste -sd ',' - | sed 's/,/, /g')
-              if [ -z "${FAILED_CHARTS}" ]; then
+            rm -f .failed_chart_*
-                FAILED_CHARTS="${DIR}"
-
-              else
-                FAILED_CHARTS="${FAILED_CHARTS}, ${DIR}"
-
           fi
-            fi
-
-          done
 
           echo ""
           echo "----"

.gitea/workflows/renovate.yaml

@@ -13,7 +13,7 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.139.6@sha256:2ed9f867ea7a7d2448847ce704f78af09e9b881c63f843a1aa0f590691737c42
+    container: ghcr.io/renovatebot/renovate:43.141.5@sha256:8fb9e3cfdadc0994fb87f57be624d1c1940c41c1c53c074465caff85a2b6d3a4
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

clusters/cl01tl/helm/argocd/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 9.5.2
+  version: 9.5.4
-digest: sha256:5d9e6405ee944bf94df6af247164ebb9b8899144853b9a7eafabe8606affe84e
+digest: sha256:3d21f3de99812af73615ef0e75f835d41d49b81a840107194b44e06057d7311f
-generated: "2026-04-19T19:53:40.43789-05:00"
+generated: "2026-04-24T18:07:49.106452954Z"

clusters/cl01tl/helm/argocd/Chart.yaml

@@ -13,8 +13,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 9.5.2
+    version: 9.5.4
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-cd
-appVersion: v3.3.7
+appVersion: v3.3.8

clusters/cl01tl/helm/coredns/Chart.yaml

@@ -17,4 +17,4 @@ dependencies:
     repository: https://coredns.github.io/helm
 icon: https://raw.githubusercontent.com/coredns/coredns.io/refs/heads/master/static/images/favicon.png
 # renovate: datasource=github-releases depName=coredns/coredns
-appVersion: v1.14.2
+appVersion: v1.14.3

clusters/cl01tl/helm/excalidraw/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/excalidraw.png
 # renovate: datasource=github-releases depName=excalidraw/excalidraw
-appVersion: v0.18.0
+appVersion: v0.18.1

clusters/cl01tl/helm/external-dns/templates/external-secret.yaml

@@ -13,5 +13,5 @@ spec:
   data:
     - secretKey: api-key
       remoteRef:
-        key: /unifi/auth/cl01tl
+        key: /unifi/users/cl01tl
         property: api-key

clusters/cl01tl/helm/external-secrets/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: external-secrets
   repository: https://charts.external-secrets.io
-  version: 2.3.0
+  version: 2.4.0
-digest: sha256:fedb79c937be24d4bb72f665122b468b445de95f3f02de419903e3136186e42f
+digest: sha256:a31b4ba5b5ec296036576c8d7d26f8b42061eec7142817f9ca0c256a457a2ea1
-generated: "2026-04-10T15:10:52.488487421Z"
+generated: "2026-04-24T19:03:31.856576444Z"

clusters/cl01tl/helm/external-secrets/Chart.yaml

@@ -14,8 +14,8 @@ sources:
 dependencies:
   - name: external-secrets
     alias: external-secrets
-    version: 2.3.0
+    version: 2.4.0
     repository: https://charts.external-secrets.io
 icon: https://raw.githubusercontent.com/external-secrets/external-secrets/refs/heads/main/assets/eso-logo-large.png
 # renovate: datasource=github-releases depName=external-secrets/external-secrets
-appVersion: v2.3.0
+appVersion: v2.4.0

clusters/cl01tl/helm/external-secrets/values.yaml

@@ -2,7 +2,7 @@ external-secrets:
   replicaCount: 3
   image:
     repository: ghcr.io/external-secrets/external-secrets
-    tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
+    tag: v2.4.0@sha256:d2b74514f63f5b55360d08351f1fe5af3b1db794a81fa10389abe2ff2999c566
   installCRDs: true
   crds:
     createClusterExternalSecret: true
@@ -29,7 +29,7 @@ external-secrets:
   webhook:
     image:
       repository: ghcr.io/external-secrets/external-secrets
-      tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
+      tag: v2.4.0@sha256:d2b74514f63f5b55360d08351f1fe5af3b1db794a81fa10389abe2ff2999c566
     resources:
       requests:
         cpu: 1m
@@ -37,7 +37,7 @@ external-secrets:
   certController:
     image:
       repository: ghcr.io/external-secrets/external-secrets
-      tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
+      tag: v2.4.0@sha256:d2b74514f63f5b55360d08351f1fe5af3b1db794a81fa10389abe2ff2999c566
     resources:
       requests:
         cpu: 1m

clusters/cl01tl/helm/foldergram/values.yaml

@@ -70,7 +70,7 @@ foldergram:
       forceRename: foldergram-data
       storageClass: synology-iscsi-delete
       accessMode: ReadWriteOnce
-      size: 250Gi
+      size: 500Gi
       advancedMounts:
         main:
           main:

clusters/cl01tl/helm/gitea/values.yaml

@@ -213,7 +213,7 @@ gitea-actions:
       registry: docker.io
       repository: docker
       # renovate: datasource=docker depName=docker
-      tag: 29.4.0-dind@sha256:f80c26212befc1c1988b529495532c6b9180d9b1dab1611f4a1efbe9da8ec821
+      tag: 29.4.1-dind@sha256:c77e5d7912f9b137cc67051fdc2991d8f5ae22c55ddf532bb836dcb693a04940
       extraVolumeMounts:
         - name: docker-vol
           mountPath: /var/lib/docker

clusters/cl01tl/helm/grimmory/Chart.yaml

@@ -28,4 +28,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grimmory.png
 # renovate: datasource=github-releases depName=grimmory-tools/grimmory
-appVersion: v2.3.0
+appVersion: v3.0.0

clusters/cl01tl/helm/grimmory/templates/external-secret.yaml

@@ -1,10 +1,10 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: grimmory-database-config
+  name: grimmory-database-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: grimmory-database-config
+    app.kubernetes.io/name: grimmory-database-secret
     {{- include "custom.labels" . | nindent 4 }}
 spec:
   secretStoreRef:
@@ -33,11 +33,11 @@ spec:
     - secretKey: access
       remoteRef:
         key: /digital-ocean/home-infra/mariadb-backups
-        property: access
+        property: AWS_ACCESS_KEY_ID
     - secretKey: secret
       remoteRef:
         key: /digital-ocean/home-infra/mariadb-backups
-        property: secret
+        property: AWS_SECRET_ACCESS_KEY
 
 ---
 apiVersion: external-secrets.io/v1

clusters/cl01tl/helm/grimmory/values.yaml

@@ -12,7 +12,7 @@ grimmory:
         main:
           image:
             repository: ghcr.io/grimmory-tools/grimmory
-            tag: v2.3.0@sha256:9014247f591074529894f81115ca40f899db697e89f72c2fe91ec530e3f19597
+            tag: v3.0.0@sha256:0130c338d4c1186f2f6b6acdc4a7ee56388dfdab9cb0b9a23ac0fc91b79e7d75
           env:
             - name: TZ
               value: America/Chicago
@@ -27,7 +27,7 @@ grimmory:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: grimmory-database-config
+                  name: grimmory-database-secret
                   key: password
             - name: GRIMMORY_PORT
               value: 6060
@@ -98,7 +98,7 @@ mariadb-cluster:
   mariadb:
     rootPasswordSecretKeyRef:
       generate: false
-      name: grimmory-database-config
+      name: grimmory-database-secret
       key: password
     storage:
       size: 5Gi

clusters/cl01tl/helm/home-assistant/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/home-assistant.png
 # renovate: datasource=github-releases depName=home-assistant/core
-appVersion: 2026.4.3
+appVersion: 2026.4.4

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -12,7 +12,7 @@ home-assistant:
         main:
           image:
             repository: ghcr.io/home-assistant/home-assistant
-            tag: 2026.4.3@sha256:ae0800c81fea16bc1241ce03bddb9c6260566e90f58b09d3e5a629e4f68bdc0b
+            tag: 2026.4.4@sha256:c1e5f0147f4cb51ccb05bb30b62a1269cc1bd48a6274792d3b38a77ab274dfd2
           env:
             - name: TZ
               value: America/Chicago
@@ -23,7 +23,7 @@ home-assistant:
         code-server:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.116.0-ls333@sha256:4620adace18935dd6ca79d77e3bc1c379e21875392192f970cf5d6b0fb4aefcd
+            tag: 4.117.0-ls334@sha256:1f384394d473c43ab6a39b2227ba3aa9c95af648ce3a67e1b4da1969c16c7c0d
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/jellystat/templates/external-secret.yaml

@@ -21,5 +21,5 @@ spec:
         property: user
     - secretKey: password
       remoteRef:
-        key: /cl01tl/jellystat/cconfig
+        key: /cl01tl/jellystat/config
         property: password

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,7 +1,7 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 83.7.0
+  version: 84.0.1
 - name: prometheus-operator-crds
   repository: oci://ghcr.io/prometheus-community/charts
   version: 28.0.1
@@ -11,5 +11,5 @@ dependencies:
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.6.1
-digest: sha256:d4435b0e182ec588250d52bee0957b22d7b69abc5be8b60606d4811bfc0ed8d6
+digest: sha256:2714de1082a27491925ba1b7adfba884a5ca9e674df22df96e8f6ccf56a54a6e
-generated: "2026-04-21T17:08:18.793790591Z"
+generated: "2026-04-24T17:03:37.423427661Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 83.7.0
+    version: 84.0.1
     repository: oci://ghcr.io/prometheus-community/charts
   - name: prometheus-operator-crds
     version: 28.0.1

clusters/cl01tl/helm/kube-prometheus-stack/templates/external-secret.yaml

@@ -13,7 +13,7 @@ spec:
   data:
     - secretKey: ntfy_password
       remoteRef:
-        key: / cl01tl/ntfy/users/cl01tl
+        key: /cl01tl/kube-prometheus-stack/ntfy-alertmanager
         property: password
 
 ---

clusters/cl01tl/helm/kube-prometheus-stack/values.yaml

@@ -30,7 +30,7 @@ kube-prometheus-stack:
               http_config:
                 basic_auth:
                   username: ntfy-alertmanager
-                  password_file: /etc/alertmanager/secrets/alertmanager-config-secret/ntfy_password
+                  password_file: /etc/alertmanager/secrets/alertmanager-ntfy-config/ntfy_password
     route:
       main:
         enabled: true

clusters/cl01tl/helm/libation/Chart.yaml

@@ -26,4 +26,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/libation.png
 # renovate: datasource=github-releases depName=rmcrackan/Libation
-appVersion: 13.3.4
+appVersion: 13.3.5

clusters/cl01tl/helm/libation/values.yaml

@@ -12,7 +12,7 @@ libation:
         main:
           image:
             repository: rmcrackan/libation
-            tag: 13.3.4@sha256:eb0357e8a880ed0049dffd2a99a9d2eda322ed33b3b9e16f4fb93eb15275f396
+            tag: 13.3.5@sha256:fcfeaa406a3567e3de89d85bf761d17868029c6e8a127922672770cb812b9be8
           env:
             - name: SLEEP_TIME
               value: "-1"

clusters/cl01tl/helm/loki/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 6.55.0
 - name: alloy
   repository: https://grafana.github.io/helm-charts
-  version: 1.7.0
+  version: 1.8.0
-digest: sha256:e6a06dc016858215a461d05c543b937f7a87ecc1bb58381cd6fb825ba524fa66
+digest: sha256:e3c7508c21ed7737f692387ca79a0c001c3393edbedff7b05c60325469a4fb2b
-generated: "2026-04-02T19:05:47.897397013Z"
+generated: "2026-04-24T17:01:55.023153925Z"

clusters/cl01tl/helm/loki/Chart.yaml

@@ -18,7 +18,7 @@ dependencies:
     version: 6.55.0
     repository: https://grafana.github.io/helm-charts
   - name: alloy
-    version: 1.7.0
+    version: 1.8.0
     repository: https://grafana.github.io/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/loki.png
 # renovate: datasource=github-releases depName=grafana/loki

clusters/cl01tl/helm/matrix-synapse/templates/_helpers.tpl

@@ -14,7 +14,7 @@ app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}
 
 {{/*
-NFS names
+ServiceAccount names
 */}}
 {{- define "custom.serviceAccountName" -}}
 matrix-synapse

clusters/cl01tl/helm/matrix-synapse/templates/secret-provider-class.yaml

@@ -16,22 +16,102 @@ spec:
         fileName: config.yaml
         secretPath: secret/data/cl01tl/matrix-synapse/config
         secretKey: config.yaml
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-synapse-oidc-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-synapse-oidc-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
       - objectName: oidc.yaml
         fileName: oidc.yaml
         secretPath: secret/data/cl01tl/matrix-synapse/config
         secretKey: oidc.yaml
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-synapse-hookshot-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-synapse-hookshot-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
       - objectName: hookshot-registration.yaml
         fileName: hookshot-registration.yaml
         secretPath: secret/data/cl01tl/matrix-synapse/hookshot
         secretKey: hookshot-registration.yaml
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-synapse-mautrix-discord-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-synapse-mautrix-discord-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
       - objectName: mautrix-discord-registration.yaml
         fileName: mautrix-discord-registration.yaml
         secretPath: secret/data/cl01tl/matrix-synapse/mautrix-discord
         secretKey: mautrix-discord-registration.yaml
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-synapse-mautrix-whatsapp-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-synapse-mautrix-whatsapp-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
       - objectName: mautrix-whatsapp-registration.yaml
         fileName: mautrix-whatsapp-registration.yaml
         secretPath: secret/data/cl01tl/matrix-synapse/mautrix-whatsapp
         secretKey: mautrix-whatsapp-registration.yaml
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-synapse-double-puppet-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-synapse-double-puppet-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
       - objectName: double-puppet-registration.yaml
         fileName: double-puppet-registration.yaml
         secretPath: secret/data/cl01tl/matrix-synapse/double-puppet

clusters/cl01tl/helm/matrix-synapse/values.yaml

@@ -37,17 +37,73 @@ matrix-synapse:
     strategy:
       type: Recreate
     extraVolumes:
-      - name: config
+      - name: synapse-config
         csi:
           driver: secrets-store.csi.k8s.io
           readOnly: true
           volumeAttributes:
             secretProviderClass: matrix-synapse-config
+      - name: oidc-config
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: matrix-synapse-oidc-config
+      - name: hookshot-config
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: matrix-synapse-hookshot-config
+      - name: mautrix-discord-config
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: matrix-synapse-mautrix-discord-config
+      - name: mautrix-whatsapp-config
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: matrix-synapse-mautrix-whatsapp-config
+      - name: double-puppet-config
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: matrix-synapse-double-puppet-config
     extraVolumeMounts:
-      - name: config
+      - name: synapse-config
-        mountPath: /synapse/config/conf.d
+        mountPath: /synapse/config/conf.d/config.yaml
         mountPropagation: None
         readOnly: true
+        subPath: config.yaml
+      - name: oidc-config
+        mountPath: /synapse/config/conf.d/oidc.yaml
+        mountPropagation: None
+        readOnly: true
+        subPath: oidc.yaml
+      - name: hookshot-config
+        mountPath: /synapse/config/conf.d/hookshot-registration.yaml
+        mountPropagation: None
+        readOnly: true
+        subPath: hookshot-registration.yaml
+      - name: mautrix-discord-config
+        mountPath: /synapse/config/conf.d/mautrix-discord-registration.yaml
+        mountPropagation: None
+        readOnly: true
+        subPath: mautrix-discord-registration.yaml
+      - name: mautrix-whatsapp-config
+        mountPath: /synapse/config/conf.d/mautrix-whatsapp-registration.yaml
+        mountPropagation: None
+        readOnly: true
+        subPath: mautrix-whatsapp-registration.yaml
+      - name: double-puppet-config
+        mountPath: /synapse/config/conf.d/double-puppet-registration.yaml
+        mountPropagation: None
+        readOnly: true
+        subPath: double-puppet-registration.yaml
     resources:
       requests:
         cpu: 10m
@@ -109,6 +165,8 @@ matrix-synapse:
     enabled: false
   gateway:
     enabled: false
+  serviceAccount:
+    name: matrix-synapse
 matrix-hookshot:
   global:
     nameOverride: matrix-hookshot
@@ -118,6 +176,8 @@ matrix-hookshot:
       type: deployment
       replicas: 1
       strategy: Recreate
+      serviceAccount:
+        name: matrix-synapse
       containers:
         main:
           image:

clusters/cl01tl/helm/medialyze/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/frederikemmer/MediaLyze/d8f69c0628bac7c047b90f91a66341648029c273/frontend/public/favicon.svg
 # renovate: datasource=github-releases depName=frederikemmer/MediaLyze
-appVersion: 0.8.2
+appVersion: 0.8.3

clusters/cl01tl/helm/medialyze/values.yaml

@@ -12,7 +12,7 @@ medialyze:
         main:
           image:
             repository: ghcr.io/frederikemmer/medialyze
-            tag: 0.8.2@sha256:dd9f034f6daf32f68f386971540f9696c49699063abe553be5f58b4a964ae80f
+            tag: 0.8.3@sha256:ef21e989f3d04c99f0fee4c992a92308156c746e26fb98672a3fa714fc630367
           env:
             - name: HOST_PORT
               value: 8080

clusters/cl01tl/helm/ntfy/Chart.yaml

@@ -23,4 +23,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ntfy.png
 # renovate: datasource=github-releases depName=binwiederhier/ntfy
-appVersion: 2.21.0
+appVersion: 2.22.0

clusters/cl01tl/helm/ntfy/values.yaml

@@ -8,7 +8,7 @@ ntfy:
         main:
           image:
             repository: binwiederhier/ntfy
-            tag: v2.21.0@sha256:2b9e12d56a538f4402da51328eeca02696c4b207ab7fbe031c27e51a22ca9b86
+            tag: v2.22.0@sha256:d8b3408c75d5ae78e03339af6103e7e6195e56573eea6f1ad34bb4dc4f44f340
           args: ["serve"]
           env:
             - name: TZ

clusters/cl01tl/helm/ollama/Chart.yaml

@@ -31,4 +31,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ollama.png
 # renovate: datasource=github-releases depName=ollama/ollama
-appVersion: 0.21.0
+appVersion: 0.21.2

clusters/cl01tl/helm/ollama/values.yaml

@@ -21,7 +21,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.21.0@sha256:d3d553bdfbcc7f55dd5ddf42c4cbe3a927aa9bb1802710d35e94656ca5aea02b
+            tag: 0.21.2@sha256:2038a264392af4d21f7f14e1568e8dd9aa0f2bd0f31d7d9a59a8cca1e9829663
           env:
             - name: OLLAMA_KEEP_ALIVE
               value: 24h
@@ -55,7 +55,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.21.0@sha256:d3d553bdfbcc7f55dd5ddf42c4cbe3a927aa9bb1802710d35e94656ca5aea02b
+            tag: 0.21.2@sha256:2038a264392af4d21f7f14e1568e8dd9aa0f2bd0f31d7d9a59a8cca1e9829663
           env:
             - name: OLLAMA_KEEP_ALIVE
               value: 24h
@@ -89,7 +89,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.21.0@sha256:d3d553bdfbcc7f55dd5ddf42c4cbe3a927aa9bb1802710d35e94656ca5aea02b
+            tag: 0.21.2@sha256:2038a264392af4d21f7f14e1568e8dd9aa0f2bd0f31d7d9a59a8cca1e9829663
           env:
             - name: OLLAMA_KEEP_ALIVE
               value: 24h
@@ -110,7 +110,7 @@ ollama:
         main:
           image:
             repository: ghcr.io/open-webui/open-webui
-            tag: v0.9.1@sha256:03d2b006989f0fe6559391a0c5d4ccac12688d7813d23cb4de86e5cc0ab22978
+            tag: v0.9.2@sha256:a7e4796ae894d1e2a0c1824860ade472f35c507608a01c3581377b5c19b0ed49
           env:
             - name: ENV
               value: prod
@@ -127,7 +127,7 @@ ollama:
             - name: WEBUI_SECRET_KEY
               valueFrom:
                 secretKeyRef:
-                  name: ollama-key
+                  name: open-webui-key
                   key: key
             - name: DATABASE_URL
               valueFrom:

clusters/cl01tl/helm/openbao/Chart.yaml

@@ -19,7 +19,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: openbao
-    version: 0.27.1
+    version: 0.27.2
     repository: https://openbao.github.io/openbao-helm
   - name: app-template
     alias: unseal

clusters/cl01tl/helm/openbao/templates/external-secret.yaml

@@ -9,7 +9,7 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
@@ -40,24 +40,20 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: ENVIRONMENT
       remoteRef:
         key: /cl01tl/openbao/unseal
-        property: ENVIRONMENT
+        property: environment
     - secretKey: NODES
       remoteRef:
         key: /cl01tl/openbao/unseal
-        property: NODES
+        property: nodes
     - secretKey: TOKENS
       remoteRef:
         key: /cl01tl/openbao/unseal
-        property: TOKENS_1
+        property: tokens-1
-    - secretKey: NOTIFY_QUEUE_URLS
-      remoteRef:
-        key: /cl01tl/openbao/unseal
-        property: NOTIFY_QUEUE_URLS
 
 ---
 apiVersion: external-secrets.io/v1
@@ -71,24 +67,20 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: ENVIRONMENT
       remoteRef:
         key: /cl01tl/openbao/unseal
-        property: ENVIRONMENT
+        property: environment
     - secretKey: NODES
       remoteRef:
         key: /cl01tl/openbao/unseal
-        property: NODES
+        property: nodes
     - secretKey: TOKENS
       remoteRef:
         key: /cl01tl/openbao/unseal
-        property: TOKENS_2
+        property: tokens-2
-    - secretKey: NOTIFY_QUEUE_URLS
-      remoteRef:
-        key: /cl01tl/openbao/unseal
-        property: NOTIFY_QUEUE_URLS
 
 ---
 apiVersion: external-secrets.io/v1
@@ -102,61 +94,46 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: ENVIRONMENT
       remoteRef:
         key: /cl01tl/openbao/unseal
-        property: ENVIRONMENT
+        property: environment
     - secretKey: NODES
       remoteRef:
         key: /cl01tl/openbao/unseal
-        property: NODES
+        property: nodes
     - secretKey: TOKENS
       remoteRef:
         key: /cl01tl/openbao/unseal
-        property: TOKENS_3
+        property: tokens-3
-    - secretKey: NOTIFY_QUEUE_URLS
-      remoteRef:
-        key: /cl01tl/openbao/unseal
-        property: NOTIFY_QUEUE_URLS
 
-# ---
+---
-# apiVersion: external-secrets.io/v1
+apiVersion: external-secrets.io/v1
-# kind: ExternalSecret
+kind: ExternalSecret
-# metadata:
+metadata:
-#   name: openbao-token
+  name: openbao-ntfy-unseal-config
-#   namespace: {{ .Release.Namespace }}
+  namespace: {{ .Release.Namespace }}
-#   labels:
+  labels:
-#     app.kubernetes.io/name: openbao-token
+    app.kubernetes.io/name: openbao-ntfy-unseal-config
-#     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- include "custom.labels" . | nindent 4 }}
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
-# spec:
+  secretStoreRef:
-#   secretStoreRef:
+    kind: ClusterSecretStore
-#     kind: ClusterSecretStore
+    name: openbao
-#     name: openbao
+  target:
-#   data:
+    template:
-#     - secretKey: token
+      mergePolicy: Merge
-#       remoteRef:
+      engineVersion: v2
-#         key: /cl01tl/openbao/token
+      data:
-#         property: token
+        NOTIFY_QUEUE_URLS: "{{ `{{ .endpoint }}` }}/{{ `{{ .topic }}` }}/?priority=4&tags=vault,unseal&title=Vault+Unsealed"
-#     - secretKey: unseal_key_1
+  data:
-#       remoteRef:
+    - secretKey: endpoint
-#         key: /cl01tl/openbao/token
+      remoteRef:
-#         property: unseal_key_1
+        key: /cl01tl/ntfy/users/cl01tl
-#     - secretKey: unseal_key_2
+        property: internal-endpoint-credential
-#       remoteRef:
+    - secretKey: topic
-#         key: /cl01tl/openbao/token
+      remoteRef:
-#         property: unseal_key_2
+        key: /cl01tl/ntfy/topics
-#     - secretKey: unseal_key_3
+        property: openbao
-#       remoteRef:
-#         key: /cl01tl/openbao/token
-#         property: unseal_key_3
-#     - secretKey: unseal_key_4
-#       remoteRef:
-#         key: /cl01tl/openbao/token
-#         property: unseal_key_4
-#     - secretKey: unseal_key_5
-#       remoteRef:
-#         key: /cl01tl/openbao/token
-#         property: unseal_key_5

clusters/cl01tl/helm/openbao/values.yaml

@@ -100,6 +100,11 @@ openbao:
       requests:
         cpu: 50m
         memory: 100Mi
+    pod:
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
     agent:
       image:
         registry: quay.io
@@ -160,6 +165,8 @@ unseal:
           envFrom:
             - secretRef:
                 name: openbao-unseal-config-1
+            - secretRef:
+                name: openbao-ntfy-unseal-config
           resources:
             requests:
               cpu: 1m
@@ -176,6 +183,8 @@ unseal:
           envFrom:
             - secretRef:
                 name: openbao-unseal-config-2
+            - secretRef:
+                name: openbao-ntfy-unseal-config
           resources:
             requests:
               cpu: 1m
@@ -192,6 +201,8 @@ unseal:
           envFrom:
             - secretRef:
                 name: openbao-unseal-config-3
+            - secretRef:
+                name: openbao-ntfy-unseal-config
           resources:
             requests:
               cpu: 1m

clusters/cl01tl/helm/outline/values.yaml

@@ -96,12 +96,8 @@ outline:
                 secretKeyRef:
                   name: outline-oidc-authentik
                   key: secret
-            - name: OIDC_AUTH_URI
+            - name: OIDC_ISSUER_URL
-              value: https://auth.alexlebens.dev/application/o/authorize/
+              value: https://auth.alexlebens.dev/application/o/outline
-            - name: OIDC_TOKEN_URI
-              value: https://auth.alexlebens.dev/application/o/token/
-            - name: OIDC_USERINFO_URI
-              value: https://auth.alexlebens.dev/application/o/userinfo/
             - name: OIDC_USERNAME_CLAIM
               value: email
             - name: OIDC_DISPLAY_NAME

clusters/cl01tl/helm/paperless-ngx/templates/external-secret.yaml

@@ -55,5 +55,5 @@ spec:
   data:
     - secretKey: PAPERLESS_SOCIALACCOUNT_PROVIDERS
       remoteRef:
-        key: /authentik/oidc/paperless-ngx
+        key: /cl01tl/authentik/oidc/paperless-ngx
         property: PAPERLESS_SOCIALACCOUNT_PROVIDERS

clusters/cl01tl/helm/postiz/values.yaml

@@ -232,7 +232,7 @@ temporal:
   web:
     image:
       repository: temporalio/ui
-      tag: 2.48.4@sha256:b01df917af27067914b716a347eff78d232dfd47cc2c8527c621ce85e5bc15e3
+      tag: 2.49.1@sha256:a066bdf5c4de689cabaf80cc357871f1db5e6d750a6bcfc42e877b913e31ef24
     resources:
       requests:
         cpu: 10m

clusters/cl01tl/helm/prowlarr/Chart.yaml

@@ -28,4 +28,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prowlarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-prowlarr
-appVersion: 2.3.5.5327-ls142
+appVersion: 2.3.5.5327-ls143

clusters/cl01tl/helm/prowlarr/values.yaml

@@ -12,7 +12,7 @@ prowlarr:
         main:
           image:
             repository: ghcr.io/linuxserver/prowlarr
-            tag: 2.3.5.5327-ls142@sha256:6df73ab9e99d0dbaad27c39d8a47c600333eebea80fcb56253a0bb8b630c8115
+            tag: 2.3.5.5327-ls143@sha256:c5de2a8758a05594319263e7691c1dce56899442ed1720d6eca216c0958f4caf
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/qbittorrent/values.yaml

@@ -55,7 +55,7 @@ qbittorrent:
         gluetun:
           image:
             repository: ghcr.io/qdm12/gluetun
-            tag: v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab
+            tag: latest@sha256:725d3e51091dde4ca43e3e3f26e2e6d3d0ccc66821e92d505c3da04958f7d472
           lifecycle:
             postStart:
               exec:
@@ -71,11 +71,11 @@ qbittorrent:
                   name: protonvpn-wireguard-conf
                   key: private-key
             - name: FIREWALL_OUTBOUND_SUBNETS
-              value: 192.168.1.0/24,10.244.0.0/16
+              value: 192.168.1.0/24,10.244.0.0/16,10.96.0.0/16
             - name: FIREWALL_INPUT_PORTS
-              value: 5030,50300
+              value: 8080,9022
             - name: VPN_PORT_FORWARDING
-              value: 'on'
+              value: "on"
             - name: VPN_PORT_FORWARDING_UP_COMMAND
               value: '/bin/sh -c "/gluetun/update.sh {{ printf "{{PORTS}}" }}"'
             - name: DNS_UPSTREAM_RESOLVER_TYPE

clusters/cl01tl/helm/rclone/templates/external-secret.yaml

@@ -44,7 +44,7 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
@@ -79,7 +79,7 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
@@ -114,7 +114,7 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
@@ -149,7 +149,7 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
@@ -184,7 +184,7 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:

clusters/cl01tl/helm/roundcube/values.yaml

@@ -103,7 +103,7 @@ roundcube:
             - name: ROUNDCUBEMAIL_DES_KEY
               valueFrom:
                 secretKeyRef:
-                  name: roundcube-key-secret
+                  name: roundcube-key
                   key: DES_KEY
             - name: ROUNDCUBEMAIL_DEFAULT_HOST
               value: tls://stalwart.stalwart

clusters/cl01tl/helm/s3-exporter/templates/external-secret.yaml

@@ -13,15 +13,15 @@ spec:
   data:
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        key: /digital-ocean/home-infra/s3-exporter
+        key: /digital-ocean/home-infra/all-access
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        key: /digital-ocean/home-infra/s3-exporter
+        key: /digital-ocean/home-infra/all-access
         property: AWS_SECRET_ACCESS_KEY
     - secretKey: AWS_REGION
       remoteRef:
-        key: /digital-ocean/home-infra/s3-exporter
+        key: /digital-ocean/home-infra/all-access
         property: AWS_REGION
 
 ---

clusters/cl01tl/helm/s3-exporter/values.yaml

@@ -91,15 +91,18 @@ s3-exporter:
             - name: S3_ACCESS_KEY
               valueFrom:
                 secretKeyRef:
-                  name: s3-garage-secret
+                  name: garage-s3-exporter-credentials
                   key: AWS_ACCESS_KEY_ID
             - name: S3_SECRET_KEY
               valueFrom:
                 secretKeyRef:
-                  name: s3-garage-secret
+                  name: garage-s3-exporter-credentials
                   key: AWS_SECRET_ACCESS_KEY
             - name: S3_REGION
-              value: us-east-1
+              valueFrom:
+                secretKeyRef:
+                  name: garage-s3-exporter-credentials
+                  key: ACCESS_REGION
             - name: LOG_LEVEL
               value: debug
             - name: S3_FORCE_PATH_STYLE

clusters/cl01tl/helm/searxng/templates/external-secret.yaml

@@ -9,7 +9,7 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: metrics-password
       remoteRef:

clusters/cl01tl/helm/searxng/values.yaml

@@ -10,7 +10,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:37c616a774b90fb5df9239eb143f1b11866ddf7b830cd1ebcca6ba11b38cc2bf
+            tag: latest@sha256:c9100c29c14a77d5289263a671580226c3b8a396a1a0130d2f500f57076a0119
           env:
             - name: SEARXNG_BASE_URL
               value: http://searxng-api.searxng:8080
@@ -38,7 +38,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:37c616a774b90fb5df9239eb143f1b11866ddf7b830cd1ebcca6ba11b38cc2bf
+            tag: latest@sha256:c9100c29c14a77d5289263a671580226c3b8a396a1a0130d2f500f57076a0119
           env:
             - name: SEARXNG_BASE_URL
               value: https://searxng.alexlebens.net/

clusters/cl01tl/helm/slskd/values.yaml

@@ -73,7 +73,7 @@ slskd:
                   name: protonvpn-wireguard-conf
                   key: private-key
             - name: FIREWALL_OUTBOUND_SUBNETS
-              value: 192.168.1.0/24,10.244.0.0/16
+              value: 192.168.1.0/24,10.0.0.0/8
             - name: FIREWALL_INPUT_PORTS
               value: 5030,50300
             - name: DNS_UPSTREAM_RESOLVER_TYPE

clusters/cl01tl/helm/talos/templates/_helpers.tpl

@@ -12,3 +12,13 @@ Selector labels
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}
+
+{{/*
+ServiceAccount names
+*/}}
+{{- define "custom.serviceAccountName" -}}
+talos-backup
+{{- end -}}
+{{- define "custom.serviceAccountSecretsName" -}}
+talos-backup-secrets
+{{- end -}}

clusters/cl01tl/helm/talos/templates/secret-provider-class.yaml

@@ -10,7 +10,7 @@ spec:
   provider: openbao
   parameters:
     baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: {{ include "custom.serviceAccountName" . }}
     objects: |
       - objectName: .s3cfg
         fileName: .s3cfg
@@ -30,7 +30,7 @@ spec:
   provider: openbao
   parameters:
     baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: {{ include "custom.serviceAccountName" . }}
     objects: |
       - objectName: .s3cfg
         fileName: .s3cfg
@@ -50,7 +50,7 @@ spec:
   provider: openbao
   parameters:
     baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: {{ include "custom.serviceAccountName" . }}
     objects: |
       - objectName: .s3cfg
         fileName: .s3cfg
@@ -70,7 +70,7 @@ spec:
   provider: openbao
   parameters:
     baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: {{ include "custom.serviceAccountName" . }}
     objects: |
       - objectName: config
         fileName: config

clusters/cl01tl/helm/talos/templates/service-account.yaml

@@ -1,10 +1,20 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "custom.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
+
+---
 apiVersion: talos.dev/v1alpha1
 kind: ServiceAccount
 metadata:
-  name: talos-backup-secrets
+  name: {{ include "custom.serviceAccountSecretsName" . }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: talos-backup-secrets
+    app.kubernetes.io/name: {{ include "custom.serviceAccountSecretsName" . }}
     {{- include "custom.labels" . | nindent 4 }}
 spec:
   roles:

clusters/cl01tl/helm/talos/values.yaml

@@ -15,6 +15,8 @@ etcd-backup:
         schedule: 0 2 * * *
         backoffLimit: 3
         parallelism: 1
+      serviceAccount:
+        name: talos-backup
       containers:
         backup:
           image:
@@ -95,6 +97,8 @@ etcd-backup:
         schedule: 0 3 * * *
         backoffLimit: 3
         parallelism: 1
+      serviceAccount:
+        name: talos-backup
       containers:
         backup:
           image:
@@ -175,6 +179,8 @@ etcd-backup:
         schedule: 0 4 * * *
         backoffLimit: 3
         parallelism: 1
+      serviceAccount:
+        name: talos-backup
       containers:
         backup:
           image:

clusters/cl01tl/helm/traefik/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 39.0.8
 - name: traefik-crds
   repository: https://traefik.github.io/charts
-  version: 1.16.0
+  version: 1.17.0
-digest: sha256:e63ea5a588f53e421e33372390b0755609974029827762aa17ff5caec3ddd90c
+digest: sha256:93a74b11097a301c811ad03080fd1d6a1c1e695b6794b2c6cff7d61ae98ecc4f
-generated: "2026-04-17T16:08:27.772737904Z"
+generated: "2026-04-24T16:35:47.354173673Z"

clusters/cl01tl/helm/traefik/Chart.yaml

@@ -17,8 +17,8 @@ dependencies:
     version: 39.0.8
     repository: https://traefik.github.io/charts
   - name: traefik-crds
-    version: 1.16.0
+    version: 1.17.0
     repository: https://traefik.github.io/charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/traefik.png
 # renovate: datasource=github-releases depName=traefik/traefik
-appVersion: v3.6.13
+appVersion: v3.6.14

clusters/cl01tl/helm/traefik/values.yaml

@@ -2,7 +2,7 @@ traefik:
   image:
     registry: docker.io
     repository: traefik
-    tag: v3.6.13@sha256:abb4f51887319c9b9d9cfe1d3cdf9379a771138003bf683f10e97697e148f95f
+    tag: v3.6.14@sha256:1c1be62608b6a484c585a917203b01a8226cff13df6a2a78705eeb66b52e667e
   deployment:
     kind: DaemonSet
   ingressClass:

clusters/cl01tl/helm/tubearchivist/values.yaml

@@ -62,7 +62,7 @@ tubearchivist:
                   name: protonvpn-wireguard-conf
                   key: private-key
             - name: FIREWALL_OUTBOUND_SUBNETS
-              value: 192.168.1.0/24,10.244.0.0/16
+              value: 192.168.1.0/24,10.0.0.0/8
             - name: FIREWALL_INPUT_PORTS
               value: 80,8000,24000
             - name: DNS_UPSTREAM_RESOLVER_TYPE

clusters/cl01tl/helm/unpoller/values.yaml

@@ -38,7 +38,7 @@ unpoller:
               value: 'false'
           envFrom:
             - secretRef:
-                name: unpoller-unifi-secret
+                name: unpoller-unifi-credentials
           resources:
             requests:
               cpu: 10m

clusters/cl01tl/helm/vault/templates/_helpers.tpl

@@ -12,3 +12,10 @@ Selector labels
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}
+
+{{/*
+ServiceAccount names
+*/}}
+{{- define "custom.serviceAccountName" -}}
+vault
+{{- end -}}

clusters/cl01tl/helm/vault/templates/external-secret.yaml

@@ -1,5 +1,24 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
+metadata:
+  name: vault-token
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-token
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: token
+      remoteRef:
+        key: /cl01tl/vault/token
+        property: root
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: vault-snapshot-agent-role
   namespace: {{ .Release.Namespace }}
@@ -74,7 +93,7 @@ spec:
   data:
     - secretKey: BUCKET
       remoteRef:
-        key: /digital-ocean/home-infra/vault-backup
+        key: /digital-ocean/home-infra/vault-backups
         property: BUCKET_PATH
 
 ---
@@ -174,12 +193,12 @@ spec:
   data:
     - secretKey: NTFY_TOKEN
       remoteRef:
-        key: /ntfy/user/cl01tl
+        key: /cl01tl/ntfy/users/cl01tl
         property: token
     - secretKey: NTFY_ENDPOINT
       remoteRef:
-        key: /ntfy/user/cl01tl
+        key: /cl01tl/ntfy/config
-        property: endpoint
+        property: internal-endpoint
     - secretKey: NTFY_TOPIC
       remoteRef:
         key: /cl01tl/ntfy/topics

clusters/cl01tl/helm/vault/templates/secret-provider-class.yaml

@@ -10,7 +10,7 @@ spec:
   provider: openbao
   parameters:
     baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: vault
     objects: |
       - objectName: .s3cfg
         fileName: .s3cfg
@@ -30,7 +30,7 @@ spec:
   provider: openbao
   parameters:
     baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: vault
     objects: |
       - objectName: .s3cfg
         fileName: .s3cfg
@@ -50,7 +50,7 @@ spec:
   provider: openbao
   parameters:
     baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: vault
     objects: |
       - objectName: .s3cfg
         fileName: .s3cfg

clusters/cl01tl/helm/vault/templates/service-account.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "custom.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
+    {{- include "custom.labels" . | nindent 4 }}

clusters/cl01tl/helm/vault/values.yaml

@@ -107,6 +107,8 @@ snapshot:
         schedule: 0 4 * * *
         backoffLimit: 3
         parallelism: 1
+      serviceAccount:
+        name: vault
       initContainers:
         snapshot:
           image:

clusters/cl01tl/helm/yamtrack/templates/external-secret.yaml

@@ -14,7 +14,7 @@ spec:
     - secretKey: SECRET
       remoteRef:
         key: /cl01tl/yamtrack/config
-        property: SECRET
+        property: secret
 
 ---
 apiVersion: external-secrets.io/v1

hosts/ps08rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.13@sha256:abb4f51887319c9b9d9cfe1d3cdf9379a771138003bf683f10e97697e148f95f
+        image: ghcr.io/traefik/traefik:v3.6.14@sha256:1c1be62608b6a484c585a917203b01a8226cff13df6a2a78705eeb66b52e667e
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

hosts/ps09rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.13@sha256:abb4f51887319c9b9d9cfe1d3cdf9379a771138003bf683f10e97697e148f95f
+        image: ghcr.io/traefik/traefik:v3.6.14@sha256:1c1be62608b6a484c585a917203b01a8226cff13df6a2a78705eeb66b52e667e
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

hosts/ps10rp/traefik/compose.yaml

@@ -20,7 +20,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.13@sha256:abb4f51887319c9b9d9cfe1d3cdf9379a771138003bf683f10e97697e148f95f
+        image: ghcr.io/traefik/traefik:v3.6.14@sha256:1c1be62608b6a484c585a917203b01a8226cff13df6a2a78705eeb66b52e667e
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"