chore(deps): update elasticsearch docker tag to v9

Reviewed-on: #5677

.gitea/workflows/renovate.yaml

@@ -13,7 +13,7 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.104.4@sha256:54369958207b06c85398d8c4dffc70997c89f07546fa0a4703b3774f48f48dab
+    container: ghcr.io/renovatebot/renovate:43.109.0@sha256:262d3c2d7e61da7a7eef61fdbdcf26d80cb0d13f65baaa99ace4163a4d56c0fa
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

clusters/cl01tl/helm/dependency-track/Chart.yaml

@@ -11,6 +11,7 @@ sources:
   - https://hub.docker.com/r/dependencytrack/apiserver
   - https://hub.docker.com/r/dependencytrack/frontend
   - https://github.com/DependencyTrack/helm-charts/tree/main/charts/dependency-track
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/dependency-track/values.yaml

@@ -55,7 +55,7 @@ dependency-track:
       - name: ALPINE_OIDC_TEAM_SYNCHRONIZATION
         value: "true"
       - name: ALPINE_CORS_ENABLED
-        value: "true"
+        value: "false"
       - name: ALPINE_CORS_ALLOW_ORIGIN
         value: dependency-track.alexlebens.net dependency-track.dependency-track
     serviceMonitor:
@@ -74,6 +74,8 @@ dependency-track:
     extraEnv:
       - name: OIDC_ISSUER
         value: https://authentik.alexlebens.net/application/o/dependency-track/
+      - name: OIDC_FLOW
+        value: explicit
       - name: OIDC_CLIENT_ID
         valueFrom:
           secretKeyRef:
@@ -81,7 +83,7 @@ dependency-track:
             key: client
       - name: OIDC_LOGIN_BUTTON_TEXT
         value: Authentik
-    apiBaseUrl: dependency-track.alexlebens.net
+    apiBaseUrl: dependency-track-api-server.dependency-track
   httpRoute:
     enabled: true
     hostnames:

clusters/cl01tl/helm/directus/Chart.yaml

@@ -29,4 +29,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/directus.png
 # renovate: datasource=github-releases depName=directus/directus
-appVersion: 11.17.1
+appVersion: 11.17.2

clusters/cl01tl/helm/directus/values.yaml

@@ -8,7 +8,7 @@ directus:
         main:
           image:
             repository: ghcr.io/directus/directus
-            tag: 11.17.1@sha256:1dd2080a50a9f6df2b6f49df15a7734424bbd1a5902983c4b6e447f22027b80b
+            tag: 11.17.2@sha256:5e5978377f1cc9820ffc5b92597da1573a1350ea57f8aba42efd999139993874
           env:
             - name: PUBLIC_URL
               value: https://directus.alexlebens.net

clusters/cl01tl/helm/element-web/Chart.yaml

@@ -22,4 +22,4 @@ dependencies:
     version: 2.4.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/element.png
 # renovate: datasource=github-releases depName=element-hq/element-web
-appVersion: v1.12.13
+appVersion: v1.12.14

clusters/cl01tl/helm/element-web/values.yaml

@@ -2,7 +2,7 @@ element-web:
   replicaCount: 1
   image:
     repository: ghcr.io/element-hq/element-web
-    tag: v1.12.13@sha256:5107e63026c13ed014f743e485821b7d4b56d275a41e76303859bb14f5f94eb6
+    tag: v1.12.14@sha256:13052614150733892ff06189f0f9baf098bc16092bffc0e0e18ccf2f257abe34
   defaultServer:
     url: https://matrix.alexlebens.dev
     name: alexlebens.dev

clusters/cl01tl/helm/gitea/Chart.lock

@@ -4,7 +4,7 @@ dependencies:
   version: 12.5.0
 - name: actions
   repository: https://dl.gitea.com/charts/
-  version: 0.0.4
+  version: 0.0.5
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
   version: 0.30.0
@@ -23,5 +23,5 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:4dc7ea441a81261a431f917521e528819ab708f6ddb4b3a77412464aecec3598
-generated: "2026-04-04T21:14:18.193631-05:00"
+digest: sha256:ae512dab12cc692921a8cf80f8459fa652ae20f393a34c14f25a851410724096
+generated: "2026-04-07T16:50:50.725821375Z"

clusters/cl01tl/helm/gitea/Chart.yaml

@@ -31,7 +31,7 @@ dependencies:
   - name: actions
     alias: gitea-actions
     repository: https://dl.gitea.com/charts/
-    version: 0.0.4
+    version: 0.0.5
   - name: meilisearch
     version: 0.30.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -23,7 +23,7 @@ home-assistant:
         code-server:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.114.0-ls328@sha256:928e63f0b775d76cda606f181bae9d81c6d3fbd2d1daeef9438e3ba5579f391d
+            tag: 4.114.1-ls330@sha256:4dabed7dc766d3034778aa648ff6b89f0b04755a069fc1071ac0f22484b7c587
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/immich/Chart.yaml

@@ -33,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/immich.png
 # renovate: datasource=github-releases depName=immich-app/immich
-appVersion: v2.6.3
+appVersion: v2.7.0

clusters/cl01tl/helm/immich/values.yaml

@@ -8,7 +8,7 @@ immich:
         main:
           image:
             repository: ghcr.io/immich-app/immich-server
-            tag: v2.6.3@sha256:0cc1f82953d9598eb9e9dd11cbde1f50fe54f9c46c4506b089e8ad7bfc9d1f0c
+            tag: v2.7.0@sha256:ee60b98e7fcc836d61d7f5e7689514f3de7a9480f31ec6ca62d6221056b46ae1
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/karakeep/Chart.yaml

@@ -32,6 +32,6 @@ dependencies:
     alias: volsync-target-data
     version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
-icon: https://cdn.jsdelivr.net/gh/selfhst/icons/webp/karakeep.webp
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/karakeep.png
 # renovate: datasource=github-releases depName=karakeep-app/karakeep
 appVersion: 0.31.0

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,7 +1,7 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 82.18.0
+  version: 83.0.1
 - name: prometheus-operator-crds
   repository: oci://ghcr.io/prometheus-community/charts
   version: 28.0.1
@@ -11,5 +11,5 @@ dependencies:
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.5.0
-digest: sha256:e4632c1c2f0b9d0b37edc7ecf1a008cdf3683737133f2d0b119eab9f968ebf88
-generated: "2026-04-05T19:45:07.805154-05:00"
+digest: sha256:2e80153fbd0bada557ca4a8740cf17489dccc5bc21d16d39a9381763f65ffaeb
+generated: "2026-04-07T17:10:56.476134214Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -19,7 +19,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 82.18.0
+    version: 83.0.1
     repository: oci://ghcr.io/prometheus-community/charts
   - name: prometheus-operator-crds
     version: 28.0.1

clusters/cl01tl/helm/kubernetes-cloudflare-ddns/Chart.yaml

@@ -5,6 +5,7 @@ description: Kubernetes Cloudflare DDNS
 keywords:
   - kubernetes-cloudflare-ddns
   - ddns
+  - job
 home: https://docs.alexlebens.dev/applications/kubelet-serving-cert-approver/
 sources:
   - https://github.com/kubitodev/kubernetes-cloudflare-ddns

clusters/cl01tl/helm/languagetool/Chart.yaml

@@ -23,6 +23,6 @@ dependencies:
     alias: volsync-target-data
     version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
-icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/languagetool.webp
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/languagetool.png
 # renovate: datasource=github-releases depName=Erikvl87/docker-languagetool
 appVersion: "6.7"

clusters/cl01tl/helm/libation/Chart.yaml

@@ -5,6 +5,7 @@ description: Libation
 keywords:
   - libation
   - audible
+  - job
 home: https://docs.alexlebens.dev/applications/languagetool/
 sources:
   - https://github.com/rmcrackan/Libation
@@ -25,4 +26,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/libation.png
 # renovate: datasource=github-releases depName=rmcrackan/Libation
-appVersion: 13.3.2
+appVersion: 13.3.3

clusters/cl01tl/helm/libation/values.yaml

@@ -12,7 +12,7 @@ libation:
         main:
           image:
             repository: rmcrackan/libation
-            tag: 13.3.2@sha256:d1c45260f3ba34b0fb1432c2b51763e00c5174864961856c1c31e7f2b0c3a39e
+            tag: 13.3.3@sha256:fbeb84916c81b654412801367b7e96796ffdba83d987a1ed5fed9896cf7cabee
           env:
             - name: SLEEP_TIME
               value: "-1"
@@ -30,7 +30,7 @@ libation:
         main:
           image:
             repository: ubuntu
-            tag: resolute-20260401@sha256:a072b64036a738e55bff8f9a9682cbb893bf20c213772effc1de8dee8df1cea9
+            tag: resolute-20260404@sha256:cc925e589b7543b910fea57a240468940003fbfc0515245a495dd0ad8fe7cef1
           command:
             - "sleep"
             - "infinity"

clusters/cl01tl/helm/lidarr/values.yaml

@@ -14,7 +14,7 @@ lidarr:
         main:
           image:
             repository: ghcr.io/linuxserver/lidarr
-            tag: 3.1.2-nightly@sha256:034055feee43b11eb2f7a8438a9af1c99ab564dd2b43e5df2fe5b3c9b3b8b1ac
+            tag: 3.1.2-nightly@sha256:0fc8d169a0740a77e03ec0e5eaee1ce2db0d882fc0bb8d0a26fd77a8beaad8e9
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/matrix-synapse/Chart.yaml

@@ -78,4 +78,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/matrix.png
 # renovate: datasource=github-releases depName=element-hq/synapse
-appVersion: v1.150.0
+appVersion: v1.151.0

clusters/cl01tl/helm/matrix-synapse/values.yaml

@@ -463,6 +463,9 @@ volsync-target-discord:
     schedule: 40 10 * * *
 volsync-target-whatsapp:
   pvcTarget: mautrix-whatsapp
+  moverSecurityContext:
+    runAsUser: 1337
+    runAsGroup: 1337
   local:
     enabled: true
     schedule: 42 8 * * *

clusters/cl01tl/helm/music-grabber/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/music-grabber.png
 # renovate: datasource=docker depName=g33kphr33k/musicgrabber
-appVersion: 2.5.6
+appVersion: 2.6.1

clusters/cl01tl/helm/music-grabber/values.yaml

@@ -12,7 +12,7 @@ music-grabber:
         main:
           image:
             repository: g33kphr33k/musicgrabber
-            tag: 2.5.6@sha256:457b149917fa0f525c83c08d2cf3a39b4e42c64513b272ecc2d41edcd4cb6c7c
+            tag: 2.6.1@sha256:52b81df8e69062b4023a416fa4168d4bc0e6d8fba48901a5a5a3080bdd748696
           env:
             - name: MUSIC_DIR
               value: /mnt/store/Music Grabber/

clusters/cl01tl/helm/navidrome/values.yaml

@@ -43,7 +43,7 @@ navidrome:
         main:
           image:
             repository: ghcr.io/jeffvli/feishin
-            tag: 1.9.0@sha256:5e6959afd27dabadd8f68fed8b0485d851593c61ca558194295bf8950262cc07
+            tag: 1.11.0@sha256:1eed97d6272d29d0a7de4c3c1357d4bc9c08cf8e304aa1014089f9111d22619c
           env:
             - name: SERVER_NAME
               value: talos

clusters/cl01tl/helm/ollama/Chart.yaml

@@ -31,4 +31,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ollama.png
 # renovate: datasource=github-releases depName=ollama/ollama
-appVersion: 0.20.2
+appVersion: 0.20.3

clusters/cl01tl/helm/ollama/values.yaml

@@ -21,7 +21,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.20.2@sha256:0455f166da85b1d07f694c33ba09278ca649603c0611ba8e46272b16eed7fccd
+            tag: 0.20.3@sha256:87d71eb588a28c747094ca5d011392a3790f6ea9bd9c87594780ad7c65cc7ed1
           env:
             - name: OLLAMA_KEEP_ALIVE
               value: 24h
@@ -55,7 +55,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.20.2@sha256:0455f166da85b1d07f694c33ba09278ca649603c0611ba8e46272b16eed7fccd
+            tag: 0.20.3@sha256:87d71eb588a28c747094ca5d011392a3790f6ea9bd9c87594780ad7c65cc7ed1
           env:
             - name: OLLAMA_KEEP_ALIVE
               value: 24h
@@ -89,7 +89,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.20.2@sha256:0455f166da85b1d07f694c33ba09278ca649603c0611ba8e46272b16eed7fccd
+            tag: 0.20.3@sha256:87d71eb588a28c747094ca5d011392a3790f6ea9bd9c87594780ad7c65cc7ed1
           env:
             - name: OLLAMA_KEEP_ALIVE
               value: 24h

clusters/cl01tl/helm/plex/Chart.yaml

@@ -20,4 +20,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/plex.png
 # renovate: datasource=github-releases depName=linuxserver/docker-plex
-appVersion: 1.43.0.10492-121068a07-ls298
+appVersion: 1.43.0.10492-121068a07-ls299

clusters/cl01tl/helm/plex/values.yaml

@@ -22,7 +22,7 @@ plex:
         main:
           image:
             repository: ghcr.io/linuxserver/plex
-            tag: 1.43.0.10492-121068a07-ls298@sha256:cbd631f9a972a1c453953a9192c1781dd7d2084db075a1bee78a3cc6387fb103
+            tag: 1.43.0.10492-121068a07-ls299@sha256:a21302c5297943e204e9b262f8c2eca3e0c7ddb52490bfb3f1db47f6103721ab
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/postiz/values.yaml

@@ -238,7 +238,7 @@ temporal:
         cpu: 10m
         memory: 50Mi
 postgres-18-cluster:
-  mode: standalone
+  mode: recovery
   cluster:
     enableSuperuserAccess: true
   recovery:

clusters/cl01tl/helm/qbittorrent/templates/external-secret.yaml

@@ -48,6 +48,10 @@ spec:
       remoteRef:
         key: /cl01tl/qbittorrent/qbit-manage
         property: ntfy-url
+    - secretKey: config.yml
+      remoteRef:
+        key: /cl01tl/qbittorrent/qbit-manage
+        property: config.yml
 
 ---
 apiVersion: external-secrets.io/v1

clusters/cl01tl/helm/qbittorrent/values.yaml

@@ -6,8 +6,6 @@ qbittorrent:
       strategy: Recreate
       pod:
         securityContext:
-          runAsUser: 1000
-          runAsGroup: 1000
           fsGroup: 1000
           fsGroupChangePolicy: OnRootMismatch
         affinity:
@@ -210,7 +208,7 @@ qbittorrent:
         qui:
           image:
             repository: ghcr.io/autobrr/qui
-            tag: v1.15.0@sha256:da33f8c850f7d6f1bfaee26b9553b21411e872639d54193906fa2cec51af1d0f
+            tag: v1.16.0@sha256:fcdced7cb8395ce039f2c5f920d890d4ad8bd849faec4c4df31701a8f13423cb
           env:
             - name: QUI__METRICS_ENABLED
               value: true
@@ -351,8 +349,8 @@ qbittorrent:
               subPath: update.sh
     qbit-manage-config:
       enabled: true
-      type: configMap
-      name: qbit-manage-config
+      type: secret
+      name: qbittorrent-qbit-manage-config
       advancedMounts:
         qbit-manage:
           init-copy-config:

clusters/cl01tl/helm/radarr-4k/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.6.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.10.0
+  version: 7.11.2
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:d76563fe1a7a9f8ceaf6937831bd0c5511eb7369abb8eb54110dfb69e6dce224
-generated: "2026-03-15T20:08:21.236792423Z"
+digest: sha256:f644b5d539a1aa786eae75f7e397ca12383320bcb52618eaf611c45c08e6f205
+generated: "2026-04-06T15:33:33.355903-05:00"

clusters/cl01tl/helm/radarr-4k/Chart.yaml

@@ -4,20 +4,18 @@ version: 1.0.0
 description: Radarr 4K
 keywords:
   - radarr
-  - servarr
   - movies
-  - 4k
-  - metrics
-home: https://wiki.alexlebens.dev/s/b5687ceb-11db-49b3-9c77-bf27bc322c99
+  - servarr
+home: https://docs.alexlebens.dev/applications/radarr/
 sources:
   - https://github.com/Radarr/Radarr
   - https://github.com/linuxserver/docker-radarr
   - https://github.com/onedr0p/exportarr
-  - https://github.com/cloudnative-pg/cloudnative-pg
   - https://github.com/linuxserver/docker-radarr/pkgs/container/radarr
   - https://github.com/onedr0p/exportarr/pkgs/container/exportarr
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:
@@ -27,12 +25,12 @@ dependencies:
     version: 4.6.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.10.0
+    version: 7.11.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-config
     version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/radarr-4k.png
-# renovate: datasource=github-releases depName=Radarr/Radarr
-appVersion: 6.0.4
+# renovate: datasource=github-releases depName=linuxserver/docker-radarr
+appVersion: 6.1.1.10360-ls298

clusters/cl01tl/helm/radarr-4k/values.yaml

@@ -4,7 +4,6 @@ radarr-4k:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       pod:
         securityContext:
           runAsUser: 1000
@@ -15,24 +14,22 @@ radarr-4k:
         main:
           image:
             repository: ghcr.io/linuxserver/radarr
-            tag: 6.0.4@sha256:ca43905eaf2dd11425efdcfe184892e43806b1ae0a830440c825cecbc2629cfb
-            pullPolicy: IfNotPresent
+            tag: 6.1.1.10360-ls298@sha256:cd70546fc97169788530386b42cf47ba1b16d091b4dc2264cd54099dd13c6f7f
           env:
             - name: TZ
-              value: US/Central
+              value: America/Chicago
             - name: PUID
               value: 1000
             - name: PGID
               value: 1000
           resources:
             requests:
-              cpu: 100m
-              memory: 256Mi
+              cpu: 10m
+              memory: 220Mi
         metrics:
           image:
             repository: ghcr.io/onedr0p/exportarr
-            tag: v2.3.0
-            pullPolicy: IfNotPresent
+            tag: v2.3.0@sha256:af535d94061cf97a52e1661945ffba78c03f9443eae7c0da1a80a5a4be56b520
           args: ["radarr"]
           env:
             - name: URL
@@ -45,10 +42,6 @@ radarr-4k:
               value: false
             - name: ENABLE_UNKNOWN_QUEUE_ITEMS
               value: false
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
   service:
     main:
       controller: main
@@ -56,11 +49,9 @@ radarr-4k:
         http:
           port: 80
           targetPort: 7878
-          protocol: HTTP
         metrics:
           port: 9793
           targetPort: 9793
-          protocol: TCP
   serviceMonitor:
     main:
       selector:
@@ -95,11 +86,8 @@ radarr-4k:
                 type: PathPrefix
                 value: /outpost.goauthentik.io
         - backendRefs:
-            - group: ''
-              kind: Service
-              name: radarr-4k
+            - name: radarr-4k
               port: 80
-              weight: 100
           filters:
             - type: ExtensionRef
               extensionRef:
@@ -116,7 +104,6 @@ radarr-4k:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 20Gi
-      retain: true
       advancedMounts:
         main:
           main:
@@ -150,35 +137,12 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
-      # - name: garage-remote
-      #   index: 1
-      #   destinationBucket: postgres-backups
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   retentionPolicy: "90d"
-      #   data:
-      #     compression: bzip2
-      # - name: external
-      #   index: 1
-      #   endpointURL: https://nyc3.digitaloceanspaces.com
-      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 30 15 * * *"
         backupName: garage-local
-      # - name: weekly-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 4 * * SAT"
-      #   backupName: garage-remote
-      # - name: daily-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 0 * * *"
-      #   backupName: external
 volsync-target-config:
   pvcTarget: radarr-4k-config
   moverSecurityContext:

clusters/cl01tl/helm/radarr-anime/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.6.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.10.0
+  version: 7.11.2
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:21bde3a8778fb94e40f2177383ca418123e69f3f3f463b31d35e9f9bf83dfa9d
-generated: "2026-03-15T20:08:35.497440433Z"
+digest: sha256:ff7a0dc34eba6f1958b56a90fd4b47d5baac88eb5c40349b5b9aa8223fa6ffd6
+generated: "2026-04-06T15:33:41.628584-05:00"

clusters/cl01tl/helm/radarr-anime/Chart.yaml

@@ -4,20 +4,18 @@ version: 1.0.0
 description: Radarr Anime
 keywords:
   - radarr
-  - servarr
   - movies
-  - anime
-  - metrics
-home: https://wiki.alexlebens.dev/s/b5687ceb-11db-49b3-9c77-bf27bc322c99
+  - servarr
+home: https://docs.alexlebens.dev/applications/radarr/
 sources:
   - https://github.com/Radarr/Radarr
   - https://github.com/linuxserver/docker-radarr
   - https://github.com/onedr0p/exportarr
-  - https://github.com/cloudnative-pg/cloudnative-pg
   - https://github.com/linuxserver/docker-radarr/pkgs/container/radarr
   - https://github.com/onedr0p/exportarr/pkgs/container/exportarr
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:
@@ -27,12 +25,12 @@ dependencies:
     version: 4.6.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.10.0
+    version: 7.11.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-config
     version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/radarr-anime.png
-# renovate: datasource=github-releases depName=Radarr/Radarr
-appVersion: 6.0.4
+# renovate: datasource=github-releases depName=linuxserver/docker-radarr
+appVersion: 6.1.1.10360-ls298

clusters/cl01tl/helm/radarr-anime/values.yaml

@@ -4,20 +4,20 @@ radarr-anime:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       pod:
         securityContext:
+          runAsUser: 1000
+          runAsGroup: 1000
           fsGroup: 1000
           fsGroupChangePolicy: OnRootMismatch
       containers:
         main:
           image:
             repository: ghcr.io/linuxserver/radarr
-            tag: 6.0.4@sha256:ca43905eaf2dd11425efdcfe184892e43806b1ae0a830440c825cecbc2629cfb
-            pullPolicy: IfNotPresent
+            tag: 6.1.1.10360-ls298@sha256:cd70546fc97169788530386b42cf47ba1b16d091b4dc2264cd54099dd13c6f7f
           env:
             - name: TZ
-              value: US/Central
+              value: America/Chicago
             - name: PUID
               value: 1000
             - name: PGID
@@ -25,12 +25,11 @@ radarr-anime:
           resources:
             requests:
               cpu: 10m
-              memory: 256Mi
+              memory: 220Mi
         metrics:
           image:
             repository: ghcr.io/onedr0p/exportarr
-            tag: v2.3.0
-            pullPolicy: IfNotPresent
+            tag: v2.3.0@sha256:af535d94061cf97a52e1661945ffba78c03f9443eae7c0da1a80a5a4be56b520
           args: ["radarr"]
           env:
             - name: URL
@@ -43,10 +42,6 @@ radarr-anime:
               value: false
             - name: ENABLE_UNKNOWN_QUEUE_ITEMS
               value: false
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
   service:
     main:
       controller: main
@@ -54,11 +49,9 @@ radarr-anime:
         http:
           port: 80
           targetPort: 7878
-          protocol: HTTP
         metrics:
           port: 9793
           targetPort: 9793
-          protocol: TCP
   serviceMonitor:
     main:
       selector:
@@ -93,11 +86,8 @@ radarr-anime:
                 type: PathPrefix
                 value: /outpost.goauthentik.io
         - backendRefs:
-            - group: ''
-              kind: Service
-              name: radarr-anime
+            - name: radarr-anime
               port: 80
-              weight: 100
           filters:
             - type: ExtensionRef
               extensionRef:
@@ -114,7 +104,6 @@ radarr-anime:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 20Gi
-      retain: true
       advancedMounts:
         main:
           main:
@@ -148,35 +137,12 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
-      # - name: garage-remote
-      #   index: 1
-      #   destinationBucket: postgres-backups
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   retentionPolicy: "90d"
-      #   data:
-      #     compression: bzip2
-      # - name: external
-      #   index: 1
-      #   endpointURL: https://nyc3.digitaloceanspaces.com
-      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 30 15 * * *"
         backupName: garage-local
-      # - name: weekly-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 4 * * SAT"
-      #   backupName: garage-remote
-      # - name: daily-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 0 * * *"
-      #   backupName: external
 volsync-target-config:
   pvcTarget: radarr-anime-config
   moverSecurityContext:

clusters/cl01tl/helm/radarr-standup/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.6.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.10.0
+  version: 7.11.2
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:ebd25d2a12ca1924b66c62d6dd2c69476ae4526825020796198b65c2ebd2c6eb
-generated: "2026-03-15T20:08:49.811429784Z"
+digest: sha256:c032454ad1ce0729f69b7d79571880d4d27af6dc6f638b3a32e0a1633c1ee996
+generated: "2026-04-06T15:33:54.620306-05:00"

clusters/cl01tl/helm/radarr-standup/Chart.yaml

@@ -4,19 +4,18 @@ version: 1.0.0
 description: Radarr Stand Up
 keywords:
   - radarr
+  - movies
   - servarr
-  - standup
-  - metrics
-home: https://wiki.alexlebens.dev/s/b5687ceb-11db-49b3-9c77-bf27bc322c99
+home: https://docs.alexlebens.dev/applications/radarr/
 sources:
   - https://github.com/Radarr/Radarr
   - https://github.com/linuxserver/docker-radarr
   - https://github.com/onedr0p/exportarr
-  - https://github.com/cloudnative-pg/cloudnative-pg
   - https://github.com/linuxserver/docker-radarr/pkgs/container/radarr
   - https://github.com/onedr0p/exportarr/pkgs/container/exportarr
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:
@@ -26,12 +25,12 @@ dependencies:
     version: 4.6.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.10.0
+    version: 7.11.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-config
     version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/radarr.png
-# renovate: datasource=github-releases depName=Radarr/Radarr
-appVersion: 6.0.4
+# renovate: datasource=github-releases depName=linuxserver/docker-radarr
+appVersion: 6.1.1.10360-ls298

clusters/cl01tl/helm/radarr-standup/values.yaml

@@ -4,20 +4,20 @@ radarr-standup:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       pod:
         securityContext:
+          runAsUser: 1000
+          runAsGroup: 1000
           fsGroup: 1000
           fsGroupChangePolicy: OnRootMismatch
       containers:
         main:
           image:
             repository: ghcr.io/linuxserver/radarr
-            tag: 6.0.4@sha256:ca43905eaf2dd11425efdcfe184892e43806b1ae0a830440c825cecbc2629cfb
-            pullPolicy: IfNotPresent
+            tag: 6.1.1.10360-ls298@sha256:cd70546fc97169788530386b42cf47ba1b16d091b4dc2264cd54099dd13c6f7f
           env:
             - name: TZ
-              value: US/Central
+              value: America/Chicago
             - name: PUID
               value: 1000
             - name: PGID
@@ -25,12 +25,11 @@ radarr-standup:
           resources:
             requests:
               cpu: 10m
-              memory: 256Mi
+              memory: 220Mi
         metrics:
           image:
             repository: ghcr.io/onedr0p/exportarr
-            tag: v2.3.0
-            pullPolicy: IfNotPresent
+            tag: v2.3.0@sha256:af535d94061cf97a52e1661945ffba78c03f9443eae7c0da1a80a5a4be56b520
           args: ["radarr"]
           env:
             - name: URL
@@ -43,10 +42,6 @@ radarr-standup:
               value: false
             - name: ENABLE_UNKNOWN_QUEUE_ITEMS
               value: false
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
   service:
     main:
       controller: main
@@ -54,11 +49,9 @@ radarr-standup:
         http:
           port: 80
           targetPort: 7878
-          protocol: HTTP
         metrics:
           port: 9793
           targetPort: 9793
-          protocol: TCP
   serviceMonitor:
     main:
       selector:
@@ -93,11 +86,8 @@ radarr-standup:
                 type: PathPrefix
                 value: /outpost.goauthentik.io
         - backendRefs:
-            - group: ''
-              kind: Service
-              name: radarr-standup
+            - name: radarr-standup
               port: 80
-              weight: 100
           filters:
             - type: ExtensionRef
               extensionRef:
@@ -114,7 +104,6 @@ radarr-standup:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 20Gi
-      retain: true
       advancedMounts:
         main:
           main:
@@ -148,35 +137,12 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
-      # - name: garage-remote
-      #   index: 1
-      #   destinationBucket: postgres-backups
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   retentionPolicy: "90d"
-      #   data:
-      #     compression: bzip2
-      # - name: external
-      #   index: 1
-      #   endpointURL: https://nyc3.digitaloceanspaces.com
-      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 35 15 * * *"
         backupName: garage-local
-      # - name: weekly-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 4 * * SAT"
-      #   backupName: garage-remote
-      # - name: daily-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 0 * * *"
-      #   backupName: external
 volsync-target-config:
   pvcTarget: radarr-standup-config
   moverSecurityContext:

clusters/cl01tl/helm/radarr/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.6.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.10.0
+  version: 7.11.2
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:05ce0d746d9c42a00338df5e6673fde8baeefa6f598ef8c85a32e6bc393b94ca
-generated: "2026-03-15T20:09:03.538226001Z"
+digest: sha256:26dca3bc43e9b3613d3fe817bf6254ffe8ca31152596fa6a141458734aab6950
+generated: "2026-04-06T15:33:25.009896-05:00"

clusters/cl01tl/helm/radarr/Chart.yaml

@@ -4,19 +4,18 @@ version: 1.0.0
 description: Radarr
 keywords:
   - radarr
-  - servarr
   - movies
-  - metrics
-home: https://wiki.alexlebens.dev/s/b5687ceb-11db-49b3-9c77-bf27bc322c99
+  - servarr
+home: https://docs.alexlebens.dev/applications/radarr/
 sources:
   - https://github.com/Radarr/Radarr
   - https://github.com/linuxserver/docker-radarr
   - https://github.com/onedr0p/exportarr
-  - https://github.com/cloudnative-pg/cloudnative-pg
   - https://github.com/linuxserver/docker-radarr/pkgs/container/radarr
   - https://github.com/onedr0p/exportarr/pkgs/container/exportarr
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:
@@ -26,12 +25,12 @@ dependencies:
     version: 4.6.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.10.0
+    version: 7.11.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-config
     version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/radarr.png
-# renovate: datasource=github-releases depName=Radarr/Radarr
-appVersion: 6.0.4
+# renovate: datasource=github-releases depName=linuxserver/docker-radarr
+appVersion: 6.1.1.10360-ls298

clusters/cl01tl/helm/radarr/values.yaml

@@ -4,7 +4,6 @@ radarr:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       pod:
         securityContext:
           runAsUser: 1000
@@ -15,11 +14,10 @@ radarr:
         main:
           image:
             repository: ghcr.io/linuxserver/radarr
-            tag: 6.0.4@sha256:ca43905eaf2dd11425efdcfe184892e43806b1ae0a830440c825cecbc2629cfb
-            pullPolicy: IfNotPresent
+            tag: 6.1.1.10360-ls298@sha256:cd70546fc97169788530386b42cf47ba1b16d091b4dc2264cd54099dd13c6f7f
           env:
             - name: TZ
-              value: US/Central
+              value: America/Chicago
             - name: PUID
               value: 1000
             - name: PGID
@@ -27,12 +25,11 @@ radarr:
           resources:
             requests:
               cpu: 100m
-              memory: 256Mi
+              memory: 600Mi
         metrics:
           image:
             repository: ghcr.io/onedr0p/exportarr
-            tag: v2.3.0
-            pullPolicy: IfNotPresent
+            tag: v2.3.0@sha256:af535d94061cf97a52e1661945ffba78c03f9443eae7c0da1a80a5a4be56b520
           args: ["radarr"]
           env:
             - name: URL
@@ -45,10 +42,6 @@ radarr:
               value: false
             - name: ENABLE_UNKNOWN_QUEUE_ITEMS
               value: false
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
   service:
     main:
       controller: main
@@ -56,11 +49,9 @@ radarr:
         http:
           port: 80
           targetPort: 7878
-          protocol: HTTP
         metrics:
           port: 9793
           targetPort: 9793
-          protocol: TCP
   serviceMonitor:
     main:
       selector:
@@ -95,11 +86,8 @@ radarr:
                 type: PathPrefix
                 value: /outpost.goauthentik.io
         - backendRefs:
-            - group: ''
-              kind: Service
-              name: radarr
+            - name: radarr
               port: 80
-              weight: 100
           filters:
             - type: ExtensionRef
               extensionRef:
@@ -116,7 +104,6 @@ radarr:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 20Gi
-      retain: true
       advancedMounts:
         main:
           main:
@@ -150,35 +137,12 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
-      # - name: garage-remote
-      #   index: 1
-      #   destinationBucket: postgres-backups
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   retentionPolicy: "90d"
-      #   data:
-      #     compression: bzip2
-      # - name: external
-      #   index: 1
-      #   endpointURL: https://nyc3.digitaloceanspaces.com
-      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 25 15 * * *"
         backupName: garage-local
-      # - name: weekly-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 4 * * SAT"
-      #   backupName: garage-remote
-      # - name: daily-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 0 * * *"
-      #   backupName: external
 volsync-target-config:
   pvcTarget: radarr-config
   moverSecurityContext:

clusters/cl01tl/helm/rclone/Chart.yaml

@@ -4,9 +4,9 @@ version: 1.0.0
 description: Rclone
 keywords:
   - rclone
+  - s3-sync
   - job
-  - kubernetes
-home: https://wiki.alexlebens.dev/s/
+home: https://docs.alexlebens.dev/applications/rclone/
 sources:
   - https://github.com/rclone/rclone
   - https://hub.docker.com/r/rclone/rclone
@@ -18,6 +18,6 @@ dependencies:
     alias: rclone
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
-icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/rclone.webp
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/rclone.png
 # renovate: datasource=github-releases depName=rclone/rclone
 appVersion: v1.73.3

clusters/cl01tl/helm/rclone/values.yaml

@@ -4,20 +4,15 @@ rclone:
       type: cronjob
       cronjob:
         suspend: false
-        concurrencyPolicy: Forbid
-        timeZone: US/Central
-        schedule: "0 0 * * *"
-        startingDeadlineSeconds: 90
-        successfulJobsHistory: 1
-        failedJobsHistory: 1
+        timeZone: America/Chicago
+        schedule: 0 0 * * *
         backoffLimit: 3
         parallelism: 1
       containers:
         sync:
           image:
             repository: rclone/rclone
-            tag: 1.73.3
-            pullPolicy: IfNotPresent
+            tag: 1.73.3@sha256:66af24d7c8809af336dc16068149257cf447c80f8c60aa9f5679153f42017b85
           args:
             - sync
             - src:directus-assets
@@ -87,20 +82,15 @@ rclone:
       type: cronjob
       cronjob:
         suspend: false
-        concurrencyPolicy: Forbid
-        timeZone: US/Central
-        schedule: "10 0 * * *"
-        startingDeadlineSeconds: 90
-        successfulJobsHistory: 1
-        failedJobsHistory: 1
+        timeZone: America/Chicago
+        schedule: 10 0 * * *
         backoffLimit: 3
         parallelism: 1
       containers:
         sync:
           image:
             repository: rclone/rclone
-            tag: 1.73.3
-            pullPolicy: IfNotPresent
+            tag: 1.73.3@sha256:66af24d7c8809af336dc16068149257cf447c80f8c60aa9f5679153f42017b85
           args:
             - sync
             - src:karakeep-assets
@@ -170,20 +160,15 @@ rclone:
       type: cronjob
       cronjob:
         suspend: false
-        concurrencyPolicy: Forbid
-        timeZone: US/Central
-        schedule: "20 0 * * *"
-        startingDeadlineSeconds: 90
-        successfulJobsHistory: 1
-        failedJobsHistory: 1
+        timeZone: America/Chicago
+        schedule: 20 0 * * *
         backoffLimit: 3
         parallelism: 1
       containers:
         sync:
           image:
             repository: rclone/rclone
-            tag: 1.73.3
-            pullPolicy: IfNotPresent
+            tag: 1.73.3@sha256:66af24d7c8809af336dc16068149257cf447c80f8c60aa9f5679153f42017b85
           args:
             - sync
             - src:talos-backups
@@ -254,8 +239,7 @@ rclone:
         prune:
           image:
             repository: rclone/rclone
-            tag: 1.73.3
-            pullPolicy: IfNotPresent
+            tag: 1.73.3@sha256:66af24d7c8809af336dc16068149257cf447c80f8c60aa9f5679153f42017b85
           args:
             - delete
             - dest:talos-backups
@@ -295,20 +279,15 @@ rclone:
       type: cronjob
       cronjob:
         suspend: false
-        concurrencyPolicy: Forbid
-        timeZone: US/Central
-        schedule: "30 0 * * *"
-        startingDeadlineSeconds: 90
-        successfulJobsHistory: 1
-        failedJobsHistory: 1
+        timeZone: America/Chicago
+        schedule: 30 0 * * *
         backoffLimit: 3
         parallelism: 1
       containers:
         sync:
           image:
             repository: rclone/rclone
-            tag: 1.73.3
-            pullPolicy: IfNotPresent
+            tag: 1.73.3@sha256:66af24d7c8809af336dc16068149257cf447c80f8c60aa9f5679153f42017b85
           args:
             - sync
             - src:web-assets
@@ -378,20 +357,15 @@ rclone:
       type: cronjob
       cronjob:
         suspend: false
-        concurrencyPolicy: Forbid
-        timeZone: US/Central
-        schedule: "40 0 * * *"
-        startingDeadlineSeconds: 90
-        successfulJobsHistory: 1
-        failedJobsHistory: 1
+        timeZone: America/Chicago
+        schedule: 40 0 * * *
         backoffLimit: 3
         parallelism: 1
       containers:
         sync:
           image:
             repository: rclone/rclone
-            tag: 1.73.3
-            pullPolicy: IfNotPresent
+            tag: 1.73.3@sha256:66af24d7c8809af336dc16068149257cf447c80f8c60aa9f5679153f42017b85
           args:
             - sync
             - src:postgres-backups
@@ -466,8 +440,7 @@ rclone:
         prune:
           image:
             repository: rclone/rclone
-            tag: 1.73.3
-            pullPolicy: IfNotPresent
+            tag: 1.73.3@sha256:66af24d7c8809af336dc16068149257cf447c80f8c60aa9f5679153f42017b85
           args:
             - delete
             - dest:postgres-backups
@@ -507,20 +480,15 @@ rclone:
       type: cronjob
       cronjob:
         suspend: false
-        concurrencyPolicy: Forbid
-        timeZone: US/Central
-        schedule: "10 0 * * *"
-        startingDeadlineSeconds: 90
-        successfulJobsHistory: 1
-        failedJobsHistory: 1
+        timeZone: America/Chicago
+        schedule: 50 0 * * *
         backoffLimit: 3
         parallelism: 1
       containers:
         sync:
           image:
             repository: rclone/rclone
-            tag: 1.73.3
-            pullPolicy: IfNotPresent
+            tag: 1.73.3@sha256:66af24d7c8809af336dc16068149257cf447c80f8c60aa9f5679153f42017b85
           args:
             - sync
             - src:ntfy-attachments

clusters/cl01tl/helm/reloader/Chart.yaml

@@ -5,8 +5,7 @@ description: Reloader
 keywords:
   - reloader
   - config-map
-  - kubernetes
-home: https://wiki.alexlebens.dev/s/e3a68f74-6d9a-484c-a446-4ba32f41d4c8
+home: https://docs.alexlebens.dev/applications/rclone/
 sources:
   - https://github.com/stakater/Reloader
   - https://github.com/stakater/Reloader/tree/master/deployments/kubernetes/chart/reloader

clusters/cl01tl/helm/rook-ceph/Chart.yaml

@@ -4,14 +4,13 @@ version: 1.0.0
 description: Rook Ceph
 keywords:
   - rook-ceph
-  - ceph
   - storage
-  - kubernetes
-home: https://wiki.alexlebens.dev/s/8592da1d-8168-4c6c-a3e4-106902fe878c
+home: https://docs.alexlebens.dev/applications/rook-ceph/
 sources:
   - https://github.com/rook/rook
   - https://quay.io/repository/ceph/ceph?tab=tags
-  - https://github.com/rook/rook/tree/master/deploy/charts
+  - https://github.com/rook/rook/tree/master/deploy/charts/rook-ceph
+  - https://github.com/rook/rook/tree/master/deploy/charts/rook-ceph-cluster
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/rook-ceph/values.yaml

@@ -1,20 +1,30 @@
 rook-ceph:
   crds:
     enabled: true
+  resources:
+    limits:
+      memory: 1Gi
+    requests:
+      cpu: 100m
+      memory: 100Mi
   csi:
-    rookUseCsiOperator: true
     cephFSKernelMountOptions: "ms_mode=secure"
     enableMetadata: true
-    provisionerReplicas: 3
     serviceMonitor:
       enabled: true
   enableDiscoveryDaemon: true
   monitoring:
     enabled: true
-
 rook-ceph-cluster:
   toolbox:
     enabled: true
+    image: quay.io/ceph/ceph:v20.2.1@sha256:0bae386bc859cd9a05b804d1ca16cca8853a64f90809044e2bf43095419dc337
+    resources:
+      limits:
+        memory: 1Gi
+      requests:
+        cpu: 1m
+        memory: 10Mi
   monitoring:
     enabled: true
     createPrometheusRules: true
@@ -22,17 +32,17 @@ rook-ceph-cluster:
       CephNodeDiskspaceWarning:
         disabled: true
   cephImage:
-    # https://quay.io/repository/ceph/ceph?tab=tags
     repository: quay.io/ceph/ceph
-    tag: v19.2.3-20250717
-    imagePullPolicy: IfNotPresent
+    tag: v20.2.1@sha256:0bae386bc859cd9a05b804d1ca16cca8853a64f90809044e2bf43095419dc337
   cephClusterSpec:
     cephConfig:
       osd:
         bluestore_slow_ops_warn_lifetime: "60"
         bluestore_slow_ops_warn_threshold: "10"
+    csi:
+      readAffinity:
+        enabled: true
     mgr:
-      count: 2
       modules:
         - name: pg_autoscaler
           enabled: true
@@ -41,7 +51,6 @@ rook-ceph-cluster:
         - name: volumes
           enabled: true
     dashboard:
-      enabled: true
       ssl: false
     network:
       connections:
@@ -74,29 +83,62 @@ rook-ceph-cluster:
             operator: Exists
     resources:
       mgr:
+        limits:
+          memory: 2Gi
         requests:
           cpu: 100m
-          memory: 512Mi
+          memory: 500Mi
       mon:
+        limits:
+          memory: 4Gi
         requests:
-          cpu: 200m
-          memory: 256Mi
+          cpu: 100m
+          memory: 750Mi
       osd:
+        limits:
+          memory: 8Gi
         requests:
           cpu: 100m
           memory: 2Gi
       prepareosd:
         requests:
           cpu: 100m
-          memory: 128Mi
+          memory: 200Mi
+      mgr-sidecar:
+        limits:
+          memory: 2Gi
+        requests:
+          cpu: 100m
+          memory: 40Mi
+      crashcollector:
+        limits:
+          memory: 2Gi
+        requests:
+          cpu: 10m
+          memory: 20Mi
+      logcollector:
+        limits:
+          memory: 2Gi
+        requests:
+          cpu: 10m
+          memory: 100Mi
+      cleanup:
+        limits:
+          memory: 2Gi
+        requests:
+          cpu: 10m
+          memory: 100Mi
+      exporter:
+        limits:
+          memory: 2Gi
+        requests:
+          cpu: 10m
+          memory: 20Mi
     storage:
       useAllDevices: false
       devicePathFilter: "/dev/disk/by-partlabel/r-csi-disk"
       config:
         osdsPerDevice: "1"
-    csi:
-      readAffinity:
-        enabled: true
   route:
     dashboard:
       host:
@@ -147,9 +189,11 @@ rook-ceph-cluster:
           activeCount: 1
           activeStandby: true
           resources:
+            limits:
+              memory: 4Gi
             requests:
-              cpu: "1000m"
-              memory: "4Gi"
+              cpu: 100m
+              memory: 400Mi
           priorityClassName: system-cluster-critical
       storageClass:
         enabled: true

clusters/cl01tl/helm/roundcube/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.6.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.10.0
+  version: 7.11.2
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:755aa4db5c7142d46af4a80c9fce49c3c558cc81042c9a00a0bdcd607276e856
-generated: "2026-03-15T20:09:18.053504671Z"
+digest: sha256:3385cf67283187e62972293322a24c0bd3cf979cd870a3f157728e50b601e4f6
+generated: "2026-04-06T17:40:21.003745-05:00"

clusters/cl01tl/helm/roundcube/Chart.yaml

@@ -4,12 +4,12 @@ version: 1.0.0
 description: Roundcube
 keywords:
   - roundcube
-  - email
-home: https://wiki.alexlebens.dev/s/68896660-74d8-4166-82bd-f7c282cdb08e
+  - email-client
+home: https://docs.alexlebens.dev/applications/rclone/
 sources:
   - https://github.com/roundcube/roundcubemail
-  - https://github.com/cloudnative-pg/cloudnative-pg
   - https://hub.docker.com/r/roundcube/roundcubemail
+  - https://hub.docker.com/_/nginx
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
@@ -21,7 +21,7 @@ dependencies:
     version: 4.6.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.10.0
+    version: 7.11.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-data

clusters/cl01tl/helm/roundcube/templates/external-secret.yaml

@@ -14,8 +14,5 @@ spec:
   data:
     - secretKey: DES_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/roundcube/key
-        metadataPolicy: None
         property: DES_KEY

clusters/cl01tl/helm/roundcube/values.yaml

@@ -4,13 +4,11 @@ roundcube:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: roundcube/roundcubemail
-            tag: 1.6.15-fpm-alpine
-            pullPolicy: IfNotPresent
+            tag: 1.6.15-fpm-alpine@sha256:0e07c1c66d5a1392f0c47cc79e85e0c60095108f715037d7d0aa3fd8cbe2e780
           env:
             - name: ROUNDCUBEMAIL_DB_TYPE
               value: pgsql
@@ -53,40 +51,32 @@ roundcube:
               value: archive,zipdownload,newmail_notifier
           resources:
             requests:
-              cpu: 10m
-              memory: 256Mi
+              cpu: 1m
+              memory: 40Mi
         nginx:
           image:
             repository: nginx
-            tag: 1.29.7-alpine-slim
-            pullPolicy: IfNotPresent
+            tag: 1.29.7-alpine-slim@sha256:0848ca84c476868cbeb6a5c2c009a98821b8540f96c44b1ba06820db50262e35
           env:
             - name: NGINX_HOST
               value: mail.alexlebens.net
             - name: NGINX_PHP_CGI
               value: roundcube.roundcube:9000
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
     cleandb:
       type: cronjob
       cronjob:
         suspend: false
-        concurrencyPolicy: Forbid
-        timeZone: US/Central
+        timeZone: America/Chicago
         schedule: 30 4 * * *
-        startingDeadlineSeconds: 90
-        successfulJobsHistory: 1
-        failedJobsHistory: 1
         backoffLimit: 3
         parallelism: 1
       containers:
         backup:
           image:
             repository: roundcube/roundcubemail
-            tag: 1.6.15-fpm-alpine
-            pullPolicy: IfNotPresent
+            tag: 1.6.15-fpm-alpine@sha256:0e07c1c66d5a1392f0c47cc79e85e0c60095108f715037d7d0aa3fd8cbe2e780
+          args:
+            - bin/cleandb.sh
           env:
             - name: ROUNDCUBEMAIL_DB_TYPE
               value: pgsql
@@ -123,12 +113,6 @@ roundcube:
               value: elastic
             - name: ROUNDCUBEMAIL_PLUGINS
               value: archive,zipdownload,newmail_notifier
-          args:
-            - bin/cleandb.sh
-          resources:
-            requests:
-              cpu: 100m
-              memory: 128Mi
   configMaps:
     config:
       enabled: true
@@ -167,11 +151,9 @@ roundcube:
         mail:
           port: 9000
           targetPort: 9000
-          protocol: HTTP
         web:
           port: 80
           targetPort: 80
-          protocol: HTTP
   route:
     main:
       kind: HTTPRoute
@@ -184,11 +166,8 @@ roundcube:
         - mail.alexlebens.net
       rules:
         - backendRefs:
-            - group: ''
-              kind: Service
-              name: roundcube
+            - name: roundcube
               port: 80
-              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -210,7 +189,6 @@ roundcube:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 5Gi
-      retain: true
       advancedMounts:
         main:
           main:
@@ -239,35 +217,12 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
-      # - name: garage-remote
-      #   index: 1
-      #   destinationBucket: postgres-backups
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   retentionPolicy: "90d"
-      #   data:
-      #     compression: bzip2
-      # - name: external
-      #   index: 1
-      #   endpointURL: https://nyc3.digitaloceanspaces.com
-      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 40 15 * * *"
         backupName: garage-local
-      # - name: weekly-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 4 * * SAT"
-      #   backupName: garage-remote
-      # - name: daily-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 0 * * *"
-      #   backupName: external
 volsync-target-data:
   pvcTarget: roundcube-data
   local:

clusters/cl01tl/helm/rybbit/Chart.lock

@@ -7,9 +7,9 @@ dependencies:
   version: 2.4.0
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.10.0
+  version: 7.11.2
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:9342eb966ec3e8020aa6b1d6d2ac72d2c4a46c4ed70c5cf52c16ff25d2f2b0fa
-generated: "2026-03-15T20:09:33.800790437Z"
+digest: sha256:95bab760e3dc94ba3affe42d2f91bc274ed520865a461cdaac61ba47eab6f39f
+generated: "2026-04-06T17:43:01.938961-05:00"

clusters/cl01tl/helm/rybbit/Chart.yaml

@@ -5,12 +5,16 @@ description: Rybbit
 keywords:
   - rybbit
   - analytics
-home: https://wiki.alexlebens.dev/s/
+home: https://docs.alexlebens.dev/applications/rybbit/
 sources:
   - https://github.com/rybbit-io/rybbit
+  - https://github.com/rybbit-io/rybbit/pkgs/container/rybbit-backend
+  - https://github.com/rybbit-io/rybbit/pkgs/container/rybbit-client
+  - https://hub.docker.com/r/clickhouse/clickhouse-server/
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:
@@ -23,7 +27,7 @@ dependencies:
     version: 2.4.0
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.10.0
+    version: 7.11.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-clickhouse-data

clusters/cl01tl/helm/rybbit/templates/external-secret.yaml

@@ -14,29 +14,17 @@ spec:
   data:
     - secretKey: clickhouse-user
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/rybbit/clickhouse
-        metadataPolicy: None
         property: user
     - secretKey: clickhouse-password
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/rybbit/clickhouse
-        metadataPolicy: None
         property: password
     - secretKey: better-auth-secret
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/rybbit/auth
-        metadataPolicy: None
         property: better-auth-secret
     - secretKey: mapbox-token
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/rybbit/auth
-        metadataPolicy: None
         property: mapbox-token

clusters/cl01tl/helm/rybbit/values.yaml

@@ -4,13 +4,11 @@ rybbit:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: ghcr.io/rybbit-io/rybbit-backend
-            tag: v2.5.0
-            pullPolicy: IfNotPresent
+            tag: v2.5.0@sha256:fd00f61abe592f872a0e4ac13f8c7b190ab2810e72f898faea4809d7ced46eef
           env:
             - name: NODE_ENV
               value: production
@@ -71,17 +69,12 @@ rybbit:
                   key: mapbox-token
           probes:
             liveness:
-              enabled: false
+              enabled: true
               custom: true
               spec:
-                exec:
-                  command:
-                  - CMD
-                  - wget
-                  - --no-verbose
-                  - --tries=1
-                  - --spider
-                  - http://127.0.0.1:3001/api/health
+                httpGet:
+                  path: /api/health
+                  port: 3001
                 failureThreshold: 5
                 initialDelaySeconds: 10
                 periodSeconds: 30
@@ -90,18 +83,16 @@ rybbit:
           resources:
             requests:
               cpu: 10m
-              memory: 256Mi
+              memory: 200Mi
     client:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       containers:
         main:
           image:
-            repository: harbor.alexlebens.net/images/rybbit-client
-            tag: v2.4.0
-            pullPolicy: IfNotPresent
+            repository: ghcr.io/rybbit-io/rybbit-client
+            tag: v2.5.0@sha256:741908be311a23ee4e58c5f82c6740bf75bbe4f7430ff2aec420f6189b1378b8
           env:
             - name: NODE_ENV
               value: production
@@ -112,18 +103,16 @@ rybbit:
           resources:
             requests:
               cpu: 10m
-              memory: 256Mi
+              memory: 100Mi
     clickhouse:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: clickhouse/clickhouse-server
-            tag: 26.3.3
-            pullPolicy: IfNotPresent
+            tag: 26.3.3@sha256:5cfbc0598ee3bd850ac1b2ab150e6c9ec7b9207f1a97617e015325fb5df053d0
           env:
             - name: CLICKHOUSE_DB
               value: analytics
@@ -139,17 +128,12 @@ rybbit:
                   key: clickhouse-password
           probes:
             liveness:
-              enabled: false
+              enabled: true
               custom: true
               spec:
-                exec:
-                  command:
-                  - CMD
-                  - wget
-                  - --no-verbose
-                  - --tries=1
-                  - --spider
-                  - http://localhost:8123/ping
+                httpGet:
+                  path: /ping
+                  port: 8123
                 failureThreshold: 5
                 initialDelaySeconds: 10
                 periodSeconds: 30
@@ -157,8 +141,8 @@ rybbit:
                 timeoutSeconds: 5
           resources:
             requests:
-              cpu: 10m
-              memory: 256Mi
+              cpu: 40m
+              memory: 300Mi
   configMaps:
     config:
       enabled: true
@@ -208,28 +192,24 @@ rybbit:
         http:
           port: 3001
           targetPort: 3001
-          protocol: HTTP
     client:
       controller: client
       ports:
         http:
           port: 3002
           targetPort: 3002
-          protocol: TCP
     clickhouse:
       controller: clickhouse
       ports:
         http:
           port: 8123
           targetPort: 8123
-          protocol: TCP
   persistence:
     clickhouse:
       forceRename: clickhouse-data
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 10Gi
-      retain: true
       advancedMounts:
         clickhouse:
           main:
@@ -271,35 +251,12 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
-      # - name: garage-remote
-      #   index: 1
-      #   destinationBucket: postgres-backups
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   retentionPolicy: "90d"
-      #   data:
-      #     compression: bzip2
-      # - name: external
-      #   index: 1
-      #   endpointURL: https://nyc3.digitaloceanspaces.com
-      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 45 15 * * *"
         backupName: garage-local
-      # - name: weekly-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 4 * * SAT"
-      #   backupName: garage-remote
-      # - name: daily-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 0 * * *"
-      #   backupName: external
 volsync-target-clickhouse-data:
   pvcTarget: clickhouse-data
   moverSecurityContext:

clusters/cl01tl/helm/s3-exporter/Chart.yaml

@@ -5,9 +5,7 @@ description: S3 Exporter
 keywords:
   - s3-exporter
   - storage
-  - monitoring
-  - metrics
-home: https://wiki.alexlebens.dev/s/
+home: https://docs.alexlebens.dev/applications/s3-exporter/
 sources:
   - https://github.com/molu8bits/s3bucket_exporter
   - https://hub.docker.com/r/molu8bits/s3bucket_exporter
@@ -19,5 +17,6 @@ dependencies:
     alias: s3-exporter
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/amazon-s3.png
 # renovate: datasource=github-releases depName=molu8bits/s3bucket_exporter
 appVersion: 1.0.2

clusters/cl01tl/helm/s3-exporter/templates/external-secret.yaml

@@ -14,24 +14,15 @@ spec:
   data:
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/all-access
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/all-access
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
     - secretKey: AWS_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/prometheus-exporter
-        metadataPolicy: None
         property: AWS_REGION
 
 ---
@@ -51,15 +42,9 @@ spec:
   data:
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/s3-exporter
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/s3-exporter
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY

clusters/cl01tl/helm/s3-exporter/values.yaml

@@ -4,13 +4,11 @@ s3-exporter:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: molu8bits/s3bucket_exporter
-            tag: 1.0.2
-            pullPolicy: IfNotPresent
+            tag: 1.0.2@sha256:75fc839c5f12cdbf20babab534959c96356b4483743e730409132bbda6944505
           env:
             - name: S3_NAME
               value: digital-ocean
@@ -37,19 +35,17 @@ s3-exporter:
               value: false
           resources:
             requests:
-              cpu: 10m
-              memory: 64Mi
+              cpu: 1m
+              memory: 40Mi
     garage-local:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: molu8bits/s3bucket_exporter
-            tag: 1.0.2
-            pullPolicy: IfNotPresent
+            tag: 1.0.2@sha256:75fc839c5f12cdbf20babab534959c96356b4483743e730409132bbda6944505
           env:
             - name: S3_NAME
               value: garage-local
@@ -73,19 +69,17 @@ s3-exporter:
               value: true
           resources:
             requests:
-              cpu: 10m
-              memory: 64Mi
+              cpu: 1m
+              memory: 40Mi
     garage-remote:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: molu8bits/s3bucket_exporter
-            tag: 1.0.2
-            pullPolicy: IfNotPresent
+            tag: 1.0.2@sha256:75fc839c5f12cdbf20babab534959c96356b4483743e730409132bbda6944505
           env:
             - name: S3_NAME
               value: garage-remote
@@ -109,8 +103,8 @@ s3-exporter:
               value: true
           resources:
             requests:
-              cpu: 10m
-              memory: 64Mi
+              cpu: 1m
+              memory: 40Mi
   service:
     digital-ocean:
       controller: digital-ocean
@@ -118,21 +112,18 @@ s3-exporter:
         metrics:
           port: 9655
           targetPort: 9655
-          protocol: TCP
     garage-local:
       controller: garage-local
       ports:
         metrics:
           port: 9655
           targetPort: 9655
-          protocol: TCP
     garage-remote:
       controller: garage-remote
       ports:
         metrics:
           port: 9655
           targetPort: 9655
-          protocol: TCP
   serviceMonitor:
     digital-ocean:
       selector:

clusters/cl01tl/helm/searxng/Chart.yaml

@@ -5,10 +5,13 @@ description: Searxng
 keywords:
   - searxng
   - search
-home: https://wiki.alexlebens.dev/s/6c6da68a-8725-4439-93c8-990ce824be54
+home: https://docs.alexlebens.dev/applications/searxng/
 sources:
   - https://github.com/searxng/searxng
+  - https://hub.docker.com/r/searxng/searxng
+  - https://hub.docker.com/r/valkey/valkey
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/searxng/templates/external-secret.yaml

@@ -14,17 +14,11 @@ spec:
   data:
     - secretKey: metrics-password
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: cl01tl/searxng/browser
-        metadataPolicy: None
         property: metrics-password
     - secretKey: metrics-username
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: cl01tl/searxng/browser
-        metadataPolicy: None
         property: metrics-username
 
 ---
@@ -44,15 +38,9 @@ spec:
   data:
     - secretKey: settings.yml
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/searxng/api/config
-        metadataPolicy: None
         property: settings.yml
     - secretKey: limiter.toml
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/searxng/api/config
-        metadataPolicy: None
         property: limiter.toml

clusters/cl01tl/helm/searxng/templates/namespace.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: searxng
-  labels:
-    app.kubernetes.io/name: searxng
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-    pod-security.kubernetes.io/audit: privileged
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/warn: privileged

clusters/cl01tl/helm/searxng/values.yaml

@@ -4,13 +4,11 @@ searxng:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:7b924c76c2cd9e960cc6b522eed5faf57ea3e6796020878455d86fcc3e7c26a3
-            pullPolicy: IfNotPresent
+            tag: latest@sha256:6a89a150d0163877caab1982b7a20d0a03fd4b39401a0d3f26f61ad205949442
           env:
             - name: SEARXNG_BASE_URL
               value: http://searxng-api.searxng:8080
@@ -28,19 +26,17 @@ searxng:
               value: 10
           resources:
             requests:
-              cpu: 10m
-              memory: 256Mi
+              cpu: 1m
+              memory: 120Mi
     browser:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:7b924c76c2cd9e960cc6b522eed5faf57ea3e6796020878455d86fcc3e7c26a3
-            pullPolicy: IfNotPresent
+            tag: latest@sha256:6a89a150d0163877caab1982b7a20d0a03fd4b39401a0d3f26f61ad205949442
           env:
             - name: SEARXNG_BASE_URL
               value: https://searxng.alexlebens.net/
@@ -49,7 +45,7 @@ searxng:
             - name: SEARXNG_HOSTNAME
               value: searxng.alexlebens.net
             - name: SEARXNG_VALKEY_URL
-              value: valkey://127.0.0.1:6379/0
+              value: valkey://localhost:6379/0
             - name: GRANIAN_HOST
               value: 0.0.0.0
             - name: GRANIAN_PORT
@@ -57,16 +53,11 @@ searxng:
           resources:
             requests:
               cpu: 10m
-              memory: 256Mi
+              memory: 250Mi
         valkey:
           image:
             repository: valkey/valkey
-            tag: 9.0.0-alpine3.22
-            pullPolicy: IfNotPresent
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
+            tag: 9.0.0-alpine@sha256:bef37d06d4856710973ee31dd1eac1482e4c8e6e7b847f999ad25433e646587b
   service:
     api:
       controller: api
@@ -74,14 +65,12 @@ searxng:
         mail:
           port: 8080
           targetPort: 8080
-          protocol: HTTP
     browser:
       controller: browser
       ports:
         mail:
           port: 80
           targetPort: 8080
-          protocol: HTTP
   serviceMonitor:
     main:
       selector:
@@ -113,11 +102,8 @@ searxng:
         - searxng.alexlebens.net
       rules:
         - backendRefs:
-            - group: ''
-              kind: Service
-              name: searxng-browser
+            - name: searxng-browser
               port: 80
-              weight: 100
           matches:
             - path:
                 type: PathPrefix

clusters/cl01tl/helm/seerr/Chart.yaml

@@ -4,14 +4,14 @@ version: 1.0.0
 description: Seerr
 keywords:
   - seerr
-  - media
-  - movies
-  - tv shows
-home: https://wiki.alexlebens.dev/
+  - media-request
+  - servarr
+home: https://docs.alexlebens.dev/applications/seerr/
 sources:
   - https://github.com/seerr-team/seerr
   - https://github.com/seerr-team/seerr/pkgs/container/seerr
   - https://github.com/seerr-team/seerr/tree/develop/charts/seerr-chart
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/seerr/values.yaml

@@ -3,32 +3,16 @@ seerr-chart:
     registry: ghcr.io
     repository: seerr-team/seerr
     tag: v3.1.0
-  probes:
-    livenessProbe:
-      initialDelaySeconds: 60
-      periodSeconds: 30
-      timeoutSeconds: 5
-      successThreshold: 1
-      failureThreshold: 5
-    readinessProbe:
-      initialDelaySeconds: 60
-      periodSeconds: 30
-      timeoutSeconds: 5
-      successThreshold: 1
-      failureThreshold: 5
+    sha: b35ba0461c4a1033d117ac1e5968fd4cbe777899e4cbfbdeaf3d10a42a0eb7e9
   config:
     persistence:
       size: 5Gi
       accessModes:
         - ReadWriteOnce
       storageClass: ceph-block
-  ingress:
-    enabled: false
   route:
     main:
       enabled: true
-      apiVersion: gateway.networking.k8s.io/v1
-      kind: HTTPRoute
       parentRefs:
         - group: gateway.networking.k8s.io
           kind: Gateway
@@ -36,14 +20,10 @@ seerr-chart:
           namespace: traefik
       hostnames:
         - seerr.alexlebens.net
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
   resources:
     requests:
       cpu: 10m
-      memory: 128Mi
+      memory: 500Mi
 volsync-target-config:
   pvcTarget: seerr-seerr-chart-config
   local:

clusters/cl01tl/helm/shelfmark/Chart.yaml

@@ -5,11 +5,12 @@ description: Shelfmark
 keywords:
   - shelfmark
   - books
-home: https://wiki.alexlebens.dev/s/
+home: https://docs.alexlebens.dev/applications/shelfmark/
 sources:
   - https://github.com/calibrain/shelfmark
   - https://github.com/calibrain/shelfmark/pkgs/container/shelfmark
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:
@@ -21,6 +22,6 @@ dependencies:
     alias: volsync-target-config
     version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
-icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/shelfmark.webp
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/shelfmark.png
 # renovate: datasource=github-releases depName=calibrain/shelfmark
 appVersion: v1.2.1

clusters/cl01tl/helm/shelfmark/templates/external-secret.yaml

@@ -14,22 +14,13 @@ spec:
   data:
     - secretKey: grimmory-user
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/shelfmark/booklore
-        metadataPolicy: None
         property: user
     - secretKey: grimmory-password
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/shelfmark/booklore
-        metadataPolicy: None
         property: password
     - secretKey: prowlarr-key
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/prowlarr/key
-        metadataPolicy: None
         property: key

clusters/cl01tl/helm/shelfmark/values.yaml

@@ -4,13 +4,15 @@ shelfmark:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
+      pod:
+        securityContext:
+          fsGroup: 1000
+          fsGroupChangePolicy: OnRootMismatch
       containers:
         main:
           image:
             repository: ghcr.io/calibrain/shelfmark
-            tag: v1.2.1
-            pullPolicy: IfNotPresent
+            tag: v1.2.1@sha256:5e00d47cccaa3b67234855d950d016c50691b78197a68adf15a624f6c08acee2
           env:
             - name: FLASK_PORT
               value: 8084
@@ -88,27 +90,24 @@ shelfmark:
               enabled: true
               custom: true
               spec:
-                exec:
-                  command:
-                    - /bin/sh
-                    - -c
-                    - "curl -sf http://localhost:8084/api/health"
+                httpGet:
+                  path: /api/health
+                  port: 8084
                 failureThreshold: 5
-                initialDelaySeconds: 60
+                initialDelaySeconds: 30
                 periodSeconds: 30
                 successThreshold: 1
-                timeoutSeconds: 30
+                timeoutSeconds: 5
           resources:
             requests:
               cpu: 10m
-              memory: 256Mi
+              memory: 140Mi
   service:
     main:
       ports:
         http:
           port: 80
           targetPort: 8084
-          protocol: HTTP
   route:
     main:
       kind: HTTPRoute
@@ -121,11 +120,8 @@ shelfmark:
         - shelfmark.alexlebens.net
       rules:
         - backendRefs:
-            - group: ''
-              kind: Service
-              name: shelfmark
+            - name: shelfmark
               port: 80
-              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -136,7 +132,6 @@ shelfmark:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 1Gi
-      retain: true
       advancedMounts:
         main:
           main:

clusters/cl01tl/helm/shelly-plug/Chart.yaml

@@ -5,9 +5,10 @@ description: Shelly Plug
 keywords:
   - shelly-plug
   - metrics
-home: https://wiki.alexlebens.dev/s/18b5575c-3a57-4515-89a0-b23d6df8dec4
+home: https://docs.alexlebens.dev/applications/shelly-plug/
 sources:
   - https://github.com/geerlingguy/shelly-plug-prometheus
+  - https://hub.docker.com/r/alpine/git
   - https://hub.docker.com/_/php
   - https://github.com/bjw-s/helm-charts/blob/main/charts/other/app-template/values.yaml
 maintainers:
@@ -17,4 +18,5 @@ dependencies:
     alias: shelly-plug
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/shelly.png
 appVersion: 1.0.0

clusters/cl01tl/helm/shelly-plug/templates/external-secret.yaml

@@ -14,15 +14,9 @@ spec:
   data:
     - secretKey: SHELLY_HTTP_USERNAME
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /shelly-plug/auth/it05sp
-        metadataPolicy: None
         property: SHELLY_HTTP_USERNAME
     - secretKey: SHELLY_HTTP_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /shelly-plug/auth/it05sp
-        metadataPolicy: None
         property: SHELLY_HTTP_PASSWORD

clusters/cl01tl/helm/shelly-plug/values.yaml

@@ -4,15 +4,13 @@ shelly-plug:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       initContainers:
         init-fetch-repo:
           securityContext:
             runAsUser: 0
           image:
             repository: alpine/git
-            tag: latest
-            pullPolicy: IfNotPresent
+            tag: 2.52.0@sha256:d453f54c83320412aa89c391b076930bd8569bc1012285e8c68ce2d4435826a3
           command:
             - /bin/sh
             - -ec
@@ -28,16 +26,11 @@ shelly-plug:
                 git fetch origin
                 git checkout origin/master -ft
               fi
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
       containers:
         main:
           image:
             repository: php
-            tag: 8.5.4-apache-bookworm
-            pullPolicy: IfNotPresent
+            tag: 8.5.4-apache@sha256:e55a9f8e4caa09c6a31ec752b307675d847bb8546d975f379128cb2a99842b96
           env:
             - name: SHELLY_HOSTNAME
               value: it05sp.alexlebens.net
@@ -48,8 +41,8 @@ shelly-plug:
                 name: shelly-plug-config-secret
           resources:
             requests:
-              cpu: 10m
-              memory: 64Mi
+              cpu: 1m
+              memory: 20Mi
   service:
     main:
       controller: main
@@ -57,7 +50,6 @@ shelly-plug:
         metrics:
           port: 80
           targetPort: 80
-          protocol: TCP
   serviceMonitor:
     main:
       selector:
@@ -75,7 +67,6 @@ shelly-plug:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 1Gi
-      retain: true
       advancedMounts:
         main:
           init-fetch-repo:

clusters/cl01tl/helm/site-documentation/Chart.yaml

@@ -5,12 +5,11 @@ description: Site Documentation
 keywords:
   - site-documentation
   - astro
-home: https://wiki.alexlebens.dev/s/1c39adb6-e0c6-4b01-b71f-278631adf584
+home: https://docs.alexlebens.dev/applications/site-documentation/
 sources:
-  - https://github.com/alexlebens/site-documentation
+  - https://gitea.alexlebens.dev/alexlebens/site-documentation
   - https://github.com/withastro/astro
-  - https://github.com/cloudflare/cloudflared
-  - https://github.com/alexlebens/site-documentation/pkgs/container/site-documentation
+  - https://harbor.alexlebens.net/harbor/projects/11/repositories/site-documentation
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
 maintainers:
@@ -23,5 +22,6 @@ dependencies:
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
     version: 2.4.0
-icon: https://d21zlbwtcn424f.cloudfront.net/logo-new-round.png
-appVersion: 0.0.5
+icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.svg
+# renovate: datasource=gitea-releases registryUrl=https://gitea.alexlebens.dev depName=alexlebens/site-documentation
+appVersion: 0.20.0

clusters/cl01tl/helm/site-documentation/values.yaml

@@ -6,17 +6,15 @@ site-documentation:
       type: deployment
       replicas: 3
       strategy: RollingUpdate
-      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-documentation
-            tag: 0.20.0
-            pullPolicy: IfNotPresent
+            tag: 0.21.0@sha256:556d92724306b0949c38185ffbaa7e3f05b9ba0d9b8dcfee0fc7a21985d10199
           resources:
             requests:
               cpu: 10m
-              memory: 128Mi
+              memory: 40Mi
   service:
     main:
       controller: main
@@ -24,4 +22,3 @@ site-documentation:
         http:
           port: 80
           targetPort: 4321
-          protocol: HTTP

clusters/cl01tl/helm/site-profile/Chart.yaml

@@ -5,12 +5,11 @@ description: Site Profile
 keywords:
   - site-profile
   - astro
-home: https://wiki.alexlebens.dev/s/1c39adb6-e0c6-4b01-b71f-278631adf584
+home: https://docs.alexlebens.dev/applications/site-profile/
 sources:
-  - https://github.com/alexlebens/site-profile
+  - https://gitea.alexlebens.dev/alexlebens/site-profile
   - https://github.com/withastro/astro
-  - https://github.com/cloudflare/cloudflared
-  - https://github.com/alexlebens/site-profile/pkgs/container/site-profile
+  - https://harbor.alexlebens.net/harbor/projects/11/repositories/site-profile
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
 maintainers:
@@ -23,5 +22,6 @@ dependencies:
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
     version: 2.4.0
-icon: https://d21zlbwtcn424f.cloudfront.net/logo-new-round.png
-appVersion: 2.3.2
+icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.svg
+# renovate: datasource=gitea-releases registryUrl=https://gitea.alexlebens.dev depName=alexlebens/site-profile
+appVersion: 3.16.1

clusters/cl01tl/helm/site-profile/values.yaml

@@ -6,17 +6,15 @@ site-profile:
       type: deployment
       replicas: 3
       strategy: RollingUpdate
-      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-profile
-            tag: 3.16.1
-            pullPolicy: IfNotPresent
+            tag: 3.16.1@sha256:656182fade379a0e8f1e6780c36bb64fe1374afbc8f06894126043105f66d29a
           resources:
             requests:
               cpu: 10m
-              memory: 128Mi
+              memory: 60Mi
   service:
     main:
       controller: main
@@ -24,4 +22,3 @@ site-profile:
         http:
           port: 80
           targetPort: 4321
-          protocol: HTTP

clusters/cl01tl/helm/slskd/Chart.yaml

@@ -4,15 +4,14 @@ version: 1.0.0
 description: slskd
 keywords:
   - slskd
-  - soularr
-  - lidarr
-  - music
-home: https://wiki.alexlebens.dev/s/ea931f86-1e70-480c-8002-64380b267cd7
+  - soulseek
+home: https://docs.alexlebens.dev/applications/slskd/
 sources:
   - https://github.com/slskd/slskd
-  - https://github.com/mrusse/soularr
-  - https://hub.docker.com/r/slskd/slskd
-  - https://hub.docker.com/r/mrusse08/soularr
+  - https://github.com/qdm12/gluetun
+  - https://github.com/slskd/slskd/pkgs/container/slskd
+  - https://github.com/qdm12/gluetun/pkgs/container/gluetun
+  - https://hub.docker.com/_/busybox
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
 maintainers:
   - name: alexlebens

clusters/cl01tl/helm/slskd/templates/external-secret.yaml

@@ -14,34 +14,9 @@ spec:
   data:
     - secretKey: slskd.yml
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/slskd/config
-        metadataPolicy: None
-        property: slskd.yml
 
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: soularr-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: soularr-config-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.ini
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/slskd/soularr
-        metadataPolicy: None
-        property: config.ini
+        property: slskd.yml
 
 ---
 apiVersion: external-secrets.io/v1
@@ -60,29 +35,17 @@ spec:
   data:
     - secretKey: private-key
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /airvpn/conf/cl01tl
-        metadataPolicy: None
         property: private-key
     - secretKey: preshared-key
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /airvpn/conf/cl01tl
-        metadataPolicy: None
         property: preshared-key
     - secretKey: addresses
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /airvpn/conf/cl01tl
-        metadataPolicy: None
         property: addresses
     - secretKey: input-ports
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /airvpn/conf/cl01tl
-        metadataPolicy: None
         property: input-ports

clusters/cl01tl/helm/slskd/values.yaml

@@ -4,8 +4,10 @@ slskd:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       pod:
+        securityContext:
+          fsGroup: 1000
+          fsGroupChangePolicy: OnRootMismatch
         affinity:
           podAntiAffinity:
             requiredDuringSchedulingIgnoredDuringExecution:
@@ -20,14 +22,9 @@ slskd:
         init-sysctl:
           image:
             repository: busybox
-            tag: 1.37.0
-            pullPolicy: IfNotPresent
+            tag: 1.37.0@sha256:1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e
           securityContext:
             privileged: True
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
           command:
             - /bin/sh
           args:
@@ -39,11 +36,10 @@ slskd:
         main:
           image:
             repository: slskd/slskd
-            tag: 0.24.5
-            pullPolicy: IfNotPresent
+            tag: 0.24.5@sha256:17ef977563be206f3b5932080b1e23883b2cb39dc9010640f6f39b4eaec887e3
           env:
             - name: TZ
-              value: US/Central
+              value: America/Chicago
             - name: PUID
               value: 1000
             - name: PGID
@@ -53,12 +49,11 @@ slskd:
           resources:
             requests:
               cpu: 100m
-              memory: 512Mi
+              memory: 330Mi
         gluetun:
           image:
             repository: ghcr.io/qdm12/gluetun
             tag: v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab
-            pullPolicy: IfNotPresent
           lifecycle:
             postStart:
               exec:
@@ -125,36 +120,6 @@ slskd:
               devic.es/tun: "1"
             requests:
               devic.es/tun: "1"
-              cpu: 10m
-              memory: 128Mi
-    soularr:
-      type: deployment
-      replicas: 0
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      pod:
-        securityContext:
-          fsGroup: 1000
-          fsGroupChangePolicy: OnRootMismatch
-      containers:
-        main:
-          image:
-            repository: mrusse08/soularr
-            tag: latest@sha256:69bc29f2072d6256c30f94fb1a0bfe8034c197791a2103d87f15ef1761347ce9
-            pullPolicy: IfNotPresent
-          env:
-            - name: TZ
-              value: US/Central
-            - name: PUID
-              value: 1000
-            - name: PGID
-              value: 1000
-            - name: SCRIPT_INTERVAL
-              value: 300
-          resources:
-            requests:
-              cpu: 10m
-              memory: 256Mi
   service:
     main:
       controller: main
@@ -162,7 +127,6 @@ slskd:
         http:
           port: 5030
           targetPort: 5030
-          protocol: HTTP
   serviceMonitor:
     main:
       selector:
@@ -187,11 +151,8 @@ slskd:
         - slskd.alexlebens.net
       rules:
         - backendRefs:
-            - group: ''
-              kind: Service
-              name: slskd
+            - name: slskd
               port: 5030
-              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -208,17 +169,6 @@ slskd:
               readOnly: true
               mountPropagation: None
               subPath: slskd.yml
-    soularr-config:
-      enabled: true
-      type: secret
-      name: soularr-config-secret
-      advancedMounts:
-        soularr:
-          main:
-            - path: /data/config.ini
-              readOnly: true
-              mountPropagation: None
-              subPath: config.ini
     data:
       existingClaim: slskd-nfs-storage
       advancedMounts:
@@ -226,7 +176,3 @@ slskd:
           main:
             - path: /mnt/store
               readOnly: false
-        soularr:
-          main:
-            - path: /mnt/store
-              readOnly: false

clusters/cl01tl/helm/snapshot-controller/Chart.yaml

@@ -4,10 +4,8 @@ version: 1.0.0
 description: Snapshot Controller
 keywords:
   - snapshot-controller
-  - snapshots
   - storage
-  - kubernetes
-home: https://wiki.alexlebens.dev/s/67c065ac-bbc7-4d35-be62-af5b65ed8330
+home: https://docs.alexlebens.dev/applications/snapshot-controller/
 sources:
   - https://github.com/kubernetes-csi/external-snapshotter
   - https://github.com/piraeusdatastore/helm-charts/tree/main/charts/snapshot-controller

clusters/cl01tl/helm/snapshot-controller/values.yaml

@@ -1,15 +1,21 @@
 snapshot-controller:
+  installCRDs: true
   controller:
     replicaCount: 3
+    revisionHistoryLimit: 3
     args:
       leaderElection: true
       leaderElectionNamespace: snapshot-controller
     image:
       repository: registry.k8s.io/sig-storage/snapshot-controller
-      tag: v8.5.0
+      tag: v8.5.0@sha256:74ca61ab13e978f03cf0f336a607281d15f04cda0a38a881306365473b28a3d8
     resources:
       requests:
-        cpu: 50m
-        memory: 128Mi
+        cpu: 10m
+        memory: 40Mi
     serviceMonitor:
       create: true
+  webhook:
+    image:
+      repository: registry.k8s.io/sig-storage/snapshot-conversion-webhook
+      tag: v8.5.0@sha256:1299486676accf16661d8a040c8715ce03fc5df0351a076f14247a873bfbfc0d

clusters/cl01tl/helm/sonarr-4k/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.6.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.10.0
+  version: 7.11.2
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:27cc019786592c0e7fce9509543792c9f281a4e676c463ce5d6ba2a6df05e3b2
-generated: "2026-03-15T20:09:49.767646568Z"
+digest: sha256:83fca5b0c0428efe33183648047cb649ee6ee7931e1441c360bcf63aad3ced20
+generated: "2026-04-06T19:13:18.268013-05:00"

clusters/cl01tl/helm/sonarr-4k/Chart.yaml

@@ -4,20 +4,18 @@ version: 1.0.0
 description: Sonarr 4K
 keywords:
   - sonarr
-  - servarr
   - tv shows
-  - 4k
-  - metrics
-home: https://wiki.alexlebens.dev/s/3f8f5392-2e05-4bff-a798-7faf1bb24991
+  - servarr
+home: https://docs.alexlebens.dev/applications/sonarr/
 sources:
   - https://github.com/Sonarr/Sonarr
   - https://github.com/linuxserver/docker-sonarr
   - https://github.com/onedr0p/exportarr
-  - https://github.com/cloudnative-pg/cloudnative-pg
   - https://github.com/linuxserver/docker-sonarr/pkgs/container/sonarr
   - https://github.com/onedr0p/exportarr/pkgs/container/exportarr
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:
@@ -27,12 +25,12 @@ dependencies:
     version: 4.6.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.10.0
+    version: 7.11.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-config
     version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/sonarr.png
-# renovate: datasource=github-releases depName=Sonarr/Sonarr
-appVersion: 4.0.14
+# renovate: datasource=github-releases depName=linuxserver/docker-sonarr
+appVersion: 4.0.17.2952-ls306

clusters/cl01tl/helm/sonarr-4k/values.yaml

@@ -13,11 +13,10 @@ sonarr-4k:
         main:
           image:
             repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.17@sha256:76414c033f290d3c9f1f9dfad71150abe71d92592369a3377a5903d579e6e2b2
-            pullPolicy: IfNotPresent
+            tag: 4.0.17.2952-ls306@sha256:b5670a3adb0f8a8b0f277feeaa69a5fbe3869ba4bb9fa7c0f0764c3b3f0e698f
           env:
             - name: TZ
-              value: US/Central
+              value: America/Chicago
             - name: PUID
               value: 1000
             - name: PGID
@@ -25,12 +24,11 @@ sonarr-4k:
           resources:
             requests:
               cpu: 10m
-              memory: 256Mi
+              memory: 200Mi
         metrics:
           image:
             repository: ghcr.io/onedr0p/exportarr
-            tag: v2.3.0
-            pullPolicy: IfNotPresent
+            tag: v2.3.0@sha256:af535d94061cf97a52e1661945ffba78c03f9443eae7c0da1a80a5a4be56b520
           args: ["sonarr"]
           env:
             - name: URL
@@ -43,10 +41,6 @@ sonarr-4k:
               value: false
             - name: ENABLE_UNKNOWN_QUEUE_ITEMS
               value: false
-          resources:
-            requests:
-              cpu: 10m
-              memory: 256Mi
   service:
     main:
       controller: main
@@ -54,11 +48,9 @@ sonarr-4k:
         http:
           port: 80
           targetPort: 8989
-          protocol: HTTP
         metrics:
           port: 9794
           targetPort: 9794
-          protocol: TCP
   serviceMonitor:
     main:
       selector:
@@ -93,11 +85,8 @@ sonarr-4k:
                 type: PathPrefix
                 value: /outpost.goauthentik.io
         - backendRefs:
-            - group: ''
-              kind: Service
-              name: sonarr-4k
+            - name: sonarr-4k
               port: 80
-              weight: 100
           filters:
             - type: ExtensionRef
               extensionRef:
@@ -114,7 +103,6 @@ sonarr-4k:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 20Gi
-      retain: true
       advancedMounts:
         main:
           main:
@@ -148,35 +136,12 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
-      # - name: garage-remote
-      #   index: 1
-      #   destinationBucket: postgres-backups
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   retentionPolicy: "90d"
-      #   data:
-      #     compression: bzip2
-      # - name: external
-      #   index: 1
-      #   endpointURL: https://nyc3.digitaloceanspaces.com
-      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 55 15 * * *"
         backupName: garage-local
-      # - name: weekly-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 4 * * SAT"
-      #   backupName: garage-remote
-      # - name: daily-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 0 * * *"
-      #   backupName: external
 volsync-target-config:
   pvcTarget: sonarr-4k-config
   moverSecurityContext:

clusters/cl01tl/helm/sonarr-anime/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.6.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.10.0
+  version: 7.11.2
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:0f8016577e9fedaf8e5bd36688da2bf19b51185bc8100b817b64ce48ec87433b
-generated: "2026-03-15T20:10:04.000906771Z"
+digest: sha256:d5bb985d028ae1d477dc2b7796e82515ee173232334c3441269cbd0b2a359ab5
+generated: "2026-04-06T19:13:52.394776-05:00"

clusters/cl01tl/helm/sonarr-anime/Chart.yaml

@@ -4,19 +4,18 @@ version: 1.0.0
 description: Sonarr Anime
 keywords:
   - sonarr
+  - tv shows
   - servarr
-  - anime
-  - metrics
-home: https://wiki.alexlebens.dev/s/3f8f5392-2e05-4bff-a798-7faf1bb24991
+home: https://docs.alexlebens.dev/applications/sonarr/
 sources:
   - https://github.com/Sonarr/Sonarr
   - https://github.com/linuxserver/docker-sonarr
   - https://github.com/onedr0p/exportarr
-  - https://github.com/cloudnative-pg/cloudnative-pg
   - https://github.com/linuxserver/docker-sonarr/pkgs/container/sonarr
   - https://github.com/onedr0p/exportarr/pkgs/container/exportarr
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:
@@ -26,12 +25,12 @@ dependencies:
     version: 4.6.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.10.0
+    version: 7.11.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-config
     version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/sonarr.png
-# renovate: datasource=github-releases depName=Sonarr/Sonarr
-appVersion: 4.0.14
+# renovate: datasource=github-releases depName=linuxserver/docker-sonarr
+appVersion: 4.0.17.2952-ls306

clusters/cl01tl/helm/sonarr-anime/values.yaml

@@ -13,11 +13,10 @@ sonarr-anime:
         main:
           image:
             repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.17@sha256:76414c033f290d3c9f1f9dfad71150abe71d92592369a3377a5903d579e6e2b2
-            pullPolicy: IfNotPresent
+            tag: 4.0.17.2952-ls306@sha256:b5670a3adb0f8a8b0f277feeaa69a5fbe3869ba4bb9fa7c0f0764c3b3f0e698f
           env:
             - name: TZ
-              value: US/Central
+              value: America/Chicago
             - name: PUID
               value: 1000
             - name: PGID
@@ -25,12 +24,11 @@ sonarr-anime:
           resources:
             requests:
               cpu: 10m
-              memory: 256Mi
+              memory: 200Mi
         metrics:
           image:
             repository: ghcr.io/onedr0p/exportarr
-            tag: v2.3.0
-            pullPolicy: IfNotPresent
+            tag: v2.3.0@sha256:af535d94061cf97a52e1661945ffba78c03f9443eae7c0da1a80a5a4be56b520
           args: ["sonarr"]
           env:
             - name: URL
@@ -43,10 +41,6 @@ sonarr-anime:
               value: false
             - name: ENABLE_UNKNOWN_QUEUE_ITEMS
               value: false
-          resources:
-            requests:
-              cpu: 10m
-              memory: 256Mi
   service:
     main:
       controller: main
@@ -54,11 +48,9 @@ sonarr-anime:
         http:
           port: 80
           targetPort: 8989
-          protocol: HTTP
         metrics:
           port: 9794
           targetPort: 9794
-          protocol: TCP
   serviceMonitor:
     main:
       selector:
@@ -93,11 +85,8 @@ sonarr-anime:
                 type: PathPrefix
                 value: /outpost.goauthentik.io
         - backendRefs:
-            - group: ''
-              kind: Service
-              name: sonarr-anime
+            - name: sonarr-anime
               port: 80
-              weight: 100
           filters:
             - type: ExtensionRef
               extensionRef:
@@ -114,7 +103,6 @@ sonarr-anime:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 20Gi
-      retain: true
       advancedMounts:
         main:
           main:
@@ -148,35 +136,12 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
-      # - name: garage-remote
-      #   index: 1
-      #   destinationBucket: postgres-backups
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   retentionPolicy: "90d"
-      #   data:
-      #     compression: bzip2
-      # - name: external
-      #   index: 1
-      #   endpointURL: https://nyc3.digitaloceanspaces.com
-      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 0 16 * * *"
         backupName: garage-local
-      # - name: weekly-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 4 * * SAT"
-      #   backupName: garage-remote
-      # - name: daily-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 0 * * *"
-      #   backupName: external
 volsync-target-config:
   pvcTarget: sonarr-anime-config
   moverSecurityContext:

clusters/cl01tl/helm/sonarr/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.6.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.10.0
+  version: 7.11.2
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:a20b4dd7e2f0c8777ed2be1bd2c702bc4d7cfeb51e4a29d781c041c555821aa1
-generated: "2026-03-15T20:10:17.242764683Z"
+digest: sha256:56992d382fb09e68be6f3b20736b323868fe8a0eb694b76c8b5e98635576be7e
+generated: "2026-04-06T19:13:09.43392-05:00"

clusters/cl01tl/helm/sonarr/Chart.yaml

@@ -4,19 +4,18 @@ version: 1.0.0
 description: Sonarr
 keywords:
   - sonarr
-  - servarr
   - tv shows
-  - metrics
-home: https://wiki.alexlebens.dev/s/3f8f5392-2e05-4bff-a798-7faf1bb24991
+  - servarr
+home: https://docs.alexlebens.dev/applications/sonarr/
 sources:
   - https://github.com/Sonarr/Sonarr
   - https://github.com/linuxserver/docker-sonarr
   - https://github.com/onedr0p/exportarr
-  - https://github.com/cloudnative-pg/cloudnative-pg
   - https://github.com/linuxserver/docker-sonarr/pkgs/container/sonarr
   - https://github.com/onedr0p/exportarr/pkgs/container/exportarr
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:
@@ -26,12 +25,12 @@ dependencies:
     version: 4.6.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.10.0
+    version: 7.11.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-config
     version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/sonarr.png
-# renovate: datasource=github-releases depName=Sonarr/Sonarr
-appVersion: 4.0.16
+# renovate: datasource=github-releases depName=linuxserver/docker-sonarr
+appVersion: 4.0.17.2952-ls306

clusters/cl01tl/helm/sonarr/values.yaml

@@ -4,7 +4,6 @@ sonarr:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       pod:
         securityContext:
           fsGroup: 1000
@@ -13,11 +12,10 @@ sonarr:
         main:
           image:
             repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.17@sha256:76414c033f290d3c9f1f9dfad71150abe71d92592369a3377a5903d579e6e2b2
-            pullPolicy: IfNotPresent
+            tag: 4.0.17.2952-ls306@sha256:b5670a3adb0f8a8b0f277feeaa69a5fbe3869ba4bb9fa7c0f0764c3b3f0e698f
           env:
             - name: TZ
-              value: US/Central
+              value: America/Chicago
             - name: PUID
               value: 1000
             - name: PGID
@@ -25,12 +23,11 @@ sonarr:
           resources:
             requests:
               cpu: 100m
-              memory: 256Mi
+              memory: 250Mi
         metrics:
           image:
             repository: ghcr.io/onedr0p/exportarr
-            tag: v2.3.0
-            pullPolicy: IfNotPresent
+            tag: v2.3.0@sha256:af535d94061cf97a52e1661945ffba78c03f9443eae7c0da1a80a5a4be56b520
           args: ["sonarr"]
           env:
             - name: URL
@@ -43,10 +40,6 @@ sonarr:
               value: false
             - name: ENABLE_UNKNOWN_QUEUE_ITEMS
               value: false
-          resources:
-            requests:
-              cpu: 10m
-              memory: 256Mi
   service:
     main:
       controller: main
@@ -54,11 +47,9 @@ sonarr:
         http:
           port: 80
           targetPort: 8989
-          protocol: HTTP
         metrics:
           port: 9794
           targetPort: 9794
-          protocol: TCP
   serviceMonitor:
     main:
       selector:
@@ -93,11 +84,8 @@ sonarr:
                 type: PathPrefix
                 value: /outpost.goauthentik.io
         - backendRefs:
-            - group: ''
-              kind: Service
-              name: sonarr
+            - name: sonarr
               port: 80
-              weight: 100
           filters:
             - type: ExtensionRef
               extensionRef:
@@ -114,7 +102,6 @@ sonarr:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 20Gi
-      retain: true
       advancedMounts:
         main:
           main:
@@ -148,35 +135,12 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
-      # - name: garage-remote
-      #   index: 1
-      #   destinationBucket: postgres-backups
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   retentionPolicy: "90d"
-      #   data:
-      #     compression: bzip2
-      # - name: external
-      #   index: 1
-      #   endpointURL: https://nyc3.digitaloceanspaces.com
-      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 50 15 * * *"
         backupName: garage-local
-      # - name: weekly-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 4 * * SAT"
-      #   backupName: garage-remote
-      # - name: daily-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 0 * * *"
-      #   backupName: external
 volsync-target-config:
   pvcTarget: sonarr-config
   moverSecurityContext:

clusters/cl01tl/helm/speedtest-exporter/Chart.yaml

@@ -4,11 +4,11 @@ version: 1.0.0
 description: Speedtest Exporter
 keywords:
   - speedtest-exporter
-  - internet
-  - metrics
-home: https://wiki.alexlebens.dev/s/843d4622-ea44-40bc-8fd1-1a6b71ba9a57
+  - internet-speed
+home: https://docs.alexlebens.dev/applications/speedtest-exporter/
 sources:
   - https://github.com/MiguelNdeCarvalho/speedtest-exporter
+  - https://github.com/miguelndecarvalho/speedtest-exporter/pkgs/container/speedtest-exporter
   - https://gitlab.com/alexander-chernov/helm/speedtest-exporter
 maintainers:
   - name: alexlebens

clusters/cl01tl/helm/speedtest-exporter/values.yaml

@@ -1,7 +1,7 @@
 speedtest-exporter:
   image:
     repository: ghcr.io/miguelndecarvalho/speedtest-exporter
-    tag: v3.5.4
+    tag: v3.5.4@sha256:f1064d49124c7fc45faabb87c6c876a2fd04e92b3dc14d4b871301217ba30fed
   securityContext:
     capabilities:
       drop:
@@ -9,8 +9,9 @@ speedtest-exporter:
     readOnlyRootFilesystem: true
     runAsNonRoot: true
     runAsUser: 1000
+  resources:
+    limits:
+      cpu: 1m
+      memory: 30Mi
   serviceMonitor:
-    enabled: true
-    namespace: speedtest-exporter
-    interval: "180m"
-    scrapeTimeout: "2m"
+    interval: 180m

clusters/cl01tl/helm/stack/Chart.yaml

@@ -3,11 +3,9 @@ name: stack
 version: 1.0.0
 description: Stack
 keywords:
-  - argocd
-  - application
   - stack
-  - deployment
-home: https://wiki.alexlebens.dev/s/0c2d1896-710d-4972-9bc8-08d71987428a
+  - argocd
+home: https://docs.alexlebens.dev/applications/stack/
 sources:
   - https://github.com/argoproj/argo-cd
   - https://gitea.alexlebens.dev/alexlebens/infrastructure

clusters/cl01tl/helm/stalwart/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 4.6.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.10.0
+  version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.0
+  version: 0.5.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:6ffe4bd6af377f2ba5134389027e86085928d5e1108bb5ecf0d4b1e4cc908b67
-generated: "2026-03-15T20:10:31.966910173Z"
+digest: sha256:c4a92f0283952a59f2e4add1a1b9522d2f9eb0a37dce32aa6104e3087c0b5503
+generated: "2026-04-06T20:21:29.186267-05:00"

clusters/cl01tl/helm/stalwart/Chart.yaml

@@ -5,15 +5,14 @@ description: Stalwart
 keywords:
   - stalwart
   - email
-  - smtp
-home: https://wiki.alexlebens.dev/s/e10d3a19-9329-4443-a023-6ab70ffaff6e
+home: https://docs.alexlebens.dev/applications/stalwart/
 sources:
   - https://github.com/stalwartlabs/mail-server
-  - https://github.com/elastic/elasticsearch
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://hub.docker.com/r/stalwartlabs/mail-server
+  - https://github.com/stalwartlabs/stalwart/pkgs/container/stalwart
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:
@@ -23,11 +22,11 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.10.0
+    version: 7.11.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-config

clusters/cl01tl/helm/stalwart/templates/elasticsearch.yaml

@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   # renovate: datasource=docker depName=elasticsearch
-  version: 8.19.8
+  version: 9.3.2
   auth:
     fileRealm:
       - secretName: stalwart-elasticsearch-secret

clusters/cl01tl/helm/stalwart/templates/external-secret.yaml

@@ -14,22 +14,13 @@ spec:
   data:
     - secretKey: username
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/stalwart/elasticsearch
-        metadataPolicy: None
         property: username
     - secretKey: password
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/stalwart/elasticsearch
-        metadataPolicy: None
         property: password
     - secretKey: roles
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/stalwart/elasticsearch
-        metadataPolicy: None
         property: roles

clusters/cl01tl/helm/stalwart/values.yaml

@@ -4,17 +4,15 @@ stalwart:
       type: deployment
       replicas: 1
       strategy: Recreate
-      revisionHistoryLimit: 3
       containers:
         main:
           image:
-            repository: stalwartlabs/stalwart
-            tag: v0.15.5
-            pullPolicy: IfNotPresent
+            repository: ghcr.io/stalwartlabs/stalwart
+            tag: v0.15.5@sha256:dcf575db2d53d9ef86d6ced8abe4ba491984659a0f8862cc6079ee7b41c3c568
           resources:
             requests:
               cpu: 10m
-              memory: 128Mi
+              memory: 100Mi
   service:
     main:
       controller: main
@@ -22,23 +20,18 @@ stalwart:
         http:
           port: 80
           targetPort: 8080
-          protocol: HTTP
         smtp:
           port: 25
           targetPort: 25
-          protocol: TCP
         smtps:
           port: 465
           targetPort: 465
-          protocol: TCP
         imap:
           port: 143
           targetPort: 143
-          protocol: TCP
         imaps:
           port: 993
           targetPort: 993
-          protocol: TCP
   route:
     main:
       kind: HTTPRoute
@@ -51,11 +44,8 @@ stalwart:
         - stalwart.alexlebens.net
       rules:
         - backendRefs:
-            - group: ''
-              kind: Service
-              name: stalwart
+            - name: stalwart
               port: 80
-              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -66,7 +56,6 @@ stalwart:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 10Gi
-      retain: true
       advancedMounts:
         main:
           main:
@@ -85,35 +74,12 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
-      # - name: garage-remote
-      #   index: 1
-      #   destinationBucket: postgres-backups
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   retentionPolicy: "90d"
-      #   data:
-      #     compression: bzip2
-      # - name: external
-      #   index: 1
-      #   endpointURL: https://nyc3.digitaloceanspaces.com
-      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 5 16 * * *"
         backupName: garage-local
-      # - name: weekly-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 4 * * SAT"
-      #   backupName: garage-remote
-      # - name: daily-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 0 * * *"
-      #   backupName: external
 volsync-target-config:
   pvcTarget: stalwart-config
   local:

clusters/cl01tl/helm/tailscale-operator/Chart.yaml

@@ -4,14 +4,14 @@ version: 1.0.0
 description: Tailscale Operator
 keywords:
   - tailscale-operator
-  - tailscale
   - wireguard
-  - vpn
-  - kubernetes
-home: https://wiki.alexlebens.dev/s/673177ef-e91b-43ad-9b80-d5037ec77852
+  - operator
+home: https://docs.alexlebens.dev/applications/tailscale-operator/
 sources:
   - https://github.com/tailscale/tailscale
+  - https://hub.docker.com/r/tailscale/tailscale
   - https://hub.docker.com/r/tailscale/k8s-operator
+  - https://hub.docker.com/r/tailscale/k8s-nameserver
   - https://github.com/tailscale/tailscale/tree/main/cmd/k8s-operator/deploy/chart
 maintainers:
   - name: alexlebens
@@ -20,5 +20,5 @@ dependencies:
     version: 1.94.2
     repository: https://pkgs.tailscale.com/helmcharts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tailscale-light.png
-# renovate: datasource=github-releases depName=tailscale/tailscale
-appVersion: v1.96.4
+# renovate: datasource=docker depName=tailscale/tailscale
+appVersion: v1.94.2

clusters/cl01tl/helm/tailscale-operator/templates/external-secrets.yaml

@@ -14,15 +14,9 @@ spec:
   data:
     - secretKey: client_id
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /tailscale/k8s-operator
-        metadataPolicy: None
         property: clientId
     - secretKey: client_secret
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /tailscale/k8s-operator
-        metadataPolicy: None
         property: clientSecret