auto source

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [harbor.alexlebens.net/images/site-profile](https://gitea.alexlebens.dev/alexlebens/site-profile) | patch | `2.1.1` -> `2.1.2` |

---

### Release Notes

<details>
<summary>alexlebens/site-profile (harbor.alexlebens.net/images/site-profile)</summary>

### [`v2.1.2`](https://gitea.alexlebens.dev/alexlebens/site-profile/compare/2.1.1...2.1.2)

[Compare Source](https://gitea.alexlebens.dev/alexlebens/site-profile/compare/2.1.1...2.1.2)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi4zOS4xIiwidXBkYXRlZEluVmVyIjoiNDIuMzkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYXV0b21lcmdlIiwiaW1hZ2UiXX0=-->

Reviewed-on: #2374
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

.gitea/workflows/lint-test-docker.yaml

@@ -36,14 +36,20 @@ jobs:
         id: branch-exists
         if: github.event_name == 'push' || steps.check-branch-exists.outputs.exists == 'true' && github.event_name == 'pull_request'
         run: |
-          echo ">> Branch ${{ gitea.base_ref }} exists, will continue with linting"
+          if [ ${{ github.event_name == 'push' }} ]; then
+            echo ">> Action is from a push event, will continue with linting"
+
+          else
+            echo ">> Branch ${{ gitea.base_ref }} exists, will continue with linting"
+
+          fi
 
           echo "----"
 
           echo "exists=true" >> $GITEA_OUTPUT
 
       - name: Set up Node.js
-        if: steps.check-branch-exists.outputs.exists == 'true'
+        if: steps.branch-exists.outputs.exists == 'true'
         uses: actions/setup-node@v6
         with:
           node-version: '24'
@@ -59,11 +65,11 @@ jobs:
           if [ "${{ github.event_name }}" == "pull_request" ]; then
             echo ""
             echo ">> Checking for changes in a pull request ..."
-            GIT_DIFF=$(git diff --name-only "${BASE_BRANCH}" | xargs -I {} dirname {} | sort -u | grep -E "hosts/[^/]+/[^/]+")
+            GIT_DIFF=$(git diff --name-only "${BASE_BRANCH}" | xargs -I {} dirname {} | sort -u)
           else
             echo ""
             echo ">> Checking for changes from a push ..."
-            GIT_DIFF=$(git diff --name-only ${{ gitea.event.before }}..HEAD | xargs -I {} dirname {} | sort -u | grep -E "hosts/[^/]+/[^/]+")
+            GIT_DIFF=$(git diff --name-only ${{ gitea.event.before }}..HEAD | xargs -I {} dirname {} | sort -u)
           fi
 
           if [ -n "${GIT_DIFF}" ]; then
@@ -72,7 +78,12 @@ jobs:
             echo "$GIT_DIFF"
 
             for path in $GIT_DIFF; do
-              CHANGED_COMPOSE+=$(echo "$path")
+              if echo "$path" | grep -q -E "hosts/[^/]+/[^/]+"; then
+                echo ""
+                echo ">> Adding path: $path"
+                CHANGED_COMPOSE+=$(echo "$path")
+                CHANGED_COMPOSE+=$(echo " ")
+              fi
             done
 
           else
@@ -84,27 +95,32 @@ jobs:
           if [ -n "${CHANGED_COMPOSE}" ]; then
             echo ""
             echo ">> Compose to Lint:"
-            echo "$(echo "${CHANGED_COMPOSE[@]}" | sort -u)"
+            echo "$(echo "${CHANGED_COMPOSE}" | sort -u)"
 
             echo "----"
 
             echo "changes-detected=true" >> $GITEA_OUTPUT
             echo "compose-dir<<EOF" >> $GITEA_OUTPUT
-            echo "$(echo "${CHANGED_COMPOSE[@]}" | sort -u)" >> $GITEA_OUTPUT
+            echo "$(echo "${CHANGED_COMPOSE}" | sort -u)" >> $GITEA_OUTPUT
             echo "EOF" >> $GITEA_OUTPUT
           else
+            echo ""
+            echo ">> Did not find any docker compose files to lint"
+
+            echo "----"
+
             echo "changes-detected=false" >> $GITEA_OUTPUT
           fi
 
       - name: Lint Docker Compose
-        if: steps.check-branch-exists.outputs.exists == 'true'
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
         env:
           CHANGED_COMPOSE: ${{ steps.check-dir-changes.outputs.compose-dir }}
         run: |
           echo ">> Running dclint on changed compose files:"
           echo "$CHANGED_COMPOSE"
 
-          echo "$CHANGED_COMPOSE" | while read -r compose; do
+          for compose in $CHANGED_COMPOSE; do
             echo ">> Linting $compose ..."
             npx dclint $compose
           done

.gitea/workflows/lint-test-helm.yaml

@@ -37,7 +37,13 @@ jobs:
         id: branch-exists
         if: github.event_name == 'push' || steps.check-branch-exists.outputs.exists == 'true' && github.event_name == 'pull_request'
         run: |
-          echo ">> Branch ${{ gitea.base_ref }} exists, will continue with linting"
+          if [ ${{ github.event_name == 'push' }} ]; then
+            echo ">> Action is from a push event, will continue with linting"
+
+          else
+            echo ">> Branch ${{ gitea.base_ref }} exists, will continue with linting"
+
+          fi
 
           echo "----"
 
@@ -48,7 +54,7 @@ jobs:
         uses: azure/setup-helm@v4
         with:
           token: ${{ secrets.GITEA_TOKEN }}
-          version: v3
+          version: v3.19.2
 
       - name: Check Directories for Changes
         id: check-dir-changes
@@ -61,11 +67,11 @@ jobs:
           if [ "${{ github.event_name }}" == "pull_request" ]; then
             echo ""
             echo ">> Checking for changes in a pull request ..."
-            GIT_DIFF=$(git diff --name-only "${BASE_BRANCH}" | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+")
+            GIT_DIFF=$(git diff --name-only "${BASE_BRANCH}" | xargs -I {} dirname {} | sort -u)
           else
             echo ""
             echo ">> Checking for changes from a push ..."
-            GIT_DIFF=$(git diff --name-only ${{ gitea.event.before }}..HEAD | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+")
+            GIT_DIFF=$(git diff --name-only ${{ gitea.event.before }}..HEAD | xargs -I {} dirname {} | sort -u)
           fi
 
           if [ -n "${GIT_DIFF}" ]; then
@@ -74,7 +80,12 @@ jobs:
             echo "$GIT_DIFF"
 
             for path in $GIT_DIFF; do
-              CHANGED_CHARTS+=$(echo "$path" | awk -F '/' '{print $4}')
+              if echo "$path" | grep -q -E "clusters/[^/]+/helm/[^/]+"; then
+                echo ""
+                echo ">> Adding path: $path"
+                CHANGED_CHARTS+=$(echo "$path" | awk -F '/' '{print $4}')
+                CHANGED_CHARTS+=$(echo " ")
+              fi
             done
 
           else
@@ -86,15 +97,20 @@ jobs:
           if [ -n "${CHANGED_CHARTS}" ]; then
             echo ""
             echo ">> Chart to Lint:"
-            echo "$(echo "${CHANGED_CHARTS[@]}" | sort -u)"
+            echo "$(echo "${CHANGED_CHARTS}" | sort -u)"
 
             echo "----"
 
             echo "changes-detected=true" >> $GITEA_OUTPUT
             echo "chart-dir<<EOF" >> $GITEA_OUTPUT
-            echo "$(echo "${CHANGED_CHARTS[@]}" | sort -u)" >> $GITEA_OUTPUT
+            echo "$(echo "${CHANGED_CHARTS}" | sort -u)" >> $GITEA_OUTPUT
             echo "EOF" >> $GITEA_OUTPUT
           else
+            echo ""
+            echo ">> Did not find any helm charts files to lint"
+
+            echo "----"
+
             echo "changes-detected=false" >> $GITEA_OUTPUT
           fi
 

.gitea/workflows/render-manifests-automerge.yaml

@@ -161,6 +161,10 @@ jobs:
 
               cd $chart_path
 
+              echo ""
+              echo ">> Updating helm dependency ..."
+              helm dependency update --skip-refresh
+
               echo ""
               echo ">> Building helm dependency ..."
               helm dependency build --skip-refresh
@@ -191,7 +195,12 @@ jobs:
 
               echo ""
               echo ">> Formating rendered template ..."
-              echo "$TEMPLATE" | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
+              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
+
+              # Strip comments again to ensure formatting correctness
+              for file in "$OUTPUT_FOLDER"/*; do
+                yq -i '... comments=""' $file
+              done
 
               echo ""
               echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"

.gitea/workflows/render-manifests-dispatch.yaml

@@ -146,6 +146,10 @@ jobs:
 
               cd $chart_path
 
+              echo ""
+              echo ">> Updating helm dependency ..."
+              helm dependency update --skip-refresh
+
               echo ""
               echo ">> Building helm dependency ..."
               helm dependency build --skip-refresh
@@ -176,7 +180,12 @@ jobs:
 
               echo ""
               echo ">> Formating rendered template ..."
-              echo "$TEMPLATE" | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
+              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
+
+              # Strip comments again to ensure formatting correctness
+              for file in "$OUTPUT_FOLDER"/*; do
+                yq -i '... comments=""' $file
+              done
 
               echo ""
               echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"

.gitea/workflows/render-manifests-merge.yaml

@@ -166,6 +166,10 @@ jobs:
 
               cd $chart_path
 
+              echo ""
+              echo ">> Updating helm dependency ..."
+              helm dependency update --skip-refresh
+
               echo ""
               echo ">> Building helm dependency ..."
               helm dependency build --skip-refresh
@@ -196,7 +200,12 @@ jobs:
 
               echo ""
               echo ">> Formating rendered template ..."
-              echo "$TEMPLATE" | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
+              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
+
+              # Strip comments again to ensure formatting correctness
+              for file in "$OUTPUT_FOLDER"/*; do
+                yq -i '... comments=""' $file
+              done
 
               echo ""
               echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"

.gitea/workflows/render-manifests-push.yaml

@@ -164,6 +164,10 @@ jobs:
 
               cd $chart_path
 
+              echo ""
+              echo ">> Updating helm dependency ..."
+              helm dependency update --skip-refresh
+
               echo ""
               echo ">> Building helm dependency ..."
               helm dependency build --skip-refresh
@@ -194,7 +198,12 @@ jobs:
 
               echo ""
               echo ">> Formating rendered template ..."
-              echo "$TEMPLATE" | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
+              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
+
+              # Strip comments again to ensure formatting correctness
+              for file in "$OUTPUT_FOLDER"/*; do
+                yq -i '... comments=""' $file
+              done
 
               echo ""
               echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"

clusters/cl01tl/helm/actual/Chart.yaml

@@ -18,4 +18,4 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/actual-budget.png
-appVersion: 25.11.0
+appVersion: 25.12.0

clusters/cl01tl/helm/argo-workflows/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: argo-workflows
   repository: https://argoproj.github.io/argo-helm
-  version: 0.46.1
+  version: 0.46.2
 - name: argo-events
   repository: https://argoproj.github.io/argo-helm
-  version: 2.4.18
+  version: 2.4.19
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 6.16.1
-digest: sha256:6cc24f6ce2b7f67c2eeab9bb6f64ebfedc082a2e809fc1f03f691f99a3006143
+digest: sha256:40a93dfcabbc5746682bac631e9a620588cf0cb6fdf79a42446a823e93a531c8
-generated: "2025-12-04T01:01:06.532396136Z"
+generated: "2025-12-11T15:49:57.970719-06:00"

clusters/cl01tl/helm/argo-workflows/Chart.yaml

@@ -18,14 +18,14 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-workflows
-    version: 0.46.1
+    version: 0.46.2
     repository: https://argoproj.github.io/argo-helm
   - name: argo-events
-    version: 2.4.18
+    version: 2.4.19
     repository: https://argoproj.github.io/argo-helm
   - name: postgres-cluster
-    alias: postgres-17-cluster
+    alias: postgres-18-cluster
     version: 6.16.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
-appVersion: v3.6.7
+appVersion: v3.7.6

clusters/cl01tl/helm/argo-workflows/templates/external-secret.yaml

@@ -31,10 +31,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: argo-workflows-postgresql-17-cluster-backup-secret
+  name: argo-workflows-postgresql-18-cluster-backup-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: argo-workflows-postgresql-17-cluster-backup-secret
+    app.kubernetes.io/name: argo-workflows-postgresql-18-cluster-backup-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -61,10 +61,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: argo-workflows-postgresql-17-cluster-backup-secret-garage
+  name: argo-workflows-postgresql-18-cluster-backup-secret-garage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: argo-workflows-postgresql-17-cluster-backup-secret-garage
+    app.kubernetes.io/name: argo-workflows-postgresql-18-cluster-backup-secret-garage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:

clusters/cl01tl/helm/argo-workflows/values.yaml

@@ -9,15 +9,15 @@ argo-workflows:
       nodeStatusOffLoad: true
       archive: true
       postgresql:
-        host: argo-workflows-postgresql-17-cluster-rw
+        host: argo-workflows-postgresql-18-cluster-rw
         port: 5432
         database: app
         tableName: app
         userNameSecret:
-          name: argo-workflows-postgresql-17-cluster-app
+          name: argo-workflows-postgresql-18-cluster-app
           key: username
         passwordSecret:
-          name: argo-workflows-postgresql-17-cluster-app
+          name: argo-workflows-postgresql-18-cluster-app
           key: password
         ssl: false
         sslMode: disable
@@ -59,20 +59,6 @@ argo-workflows:
   useStaticCredentials: true
   artifactRepository:
     archiveLogs: false
-    s3: {}
-      # accessKeySecret:
-      #   name: "{{ .Release.Name }}-minio"
-      #   key: accesskey
-      # secretKeySecret:
-      #   name: "{{ .Release.Name }}-minio"
-      #   key: secretkey
-      # insecure: true
-      # bucket:
-      # endpoint:
-      # region:
-      # encryptionOptions:
-      #   enableEncryption: true
-
 argo-events:
   controller:
     resources:
@@ -89,9 +75,12 @@ argo-events:
       requests:
         cpu: 10m
         memory: 128Mi
-postgres-17-cluster:
+postgres-18-cluster:
   mode: recovery
   cluster:
+    image:
+      repository: ghcr.io/cloudnative-pg/postgresql
+      tag: 18.1-standard-trixie
     storage:
       storageClass: local-path
     walStorage:
@@ -103,30 +92,30 @@ postgres-17-cluster:
   recovery:
     method: objectStore
     objectStore:
-      destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-17-cluster
+      destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
       endpointURL: http://garage-main.garage:3900
       index: 1
-      endpointCredentials: argo-workflows-postgresql-17-cluster-backup-secret-garage
+      endpointCredentials: argo-workflows-postgresql-18-cluster-backup-secret-garage
   backup:
     objectStore:
       - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/argo-workflows/argo-workflows-postgresql-17-cluster
+        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
         index: 1
         retentionPolicy: "30d"
         isWALArchiver: false
       - name: garage-local
-        destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-17-cluster
+        destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
         index: 1
         endpointURL: http://garage-main.garage:3900
-        endpointCredentials: argo-workflows-postgresql-17-cluster-backup-secret-garage
+        endpointCredentials: argo-workflows-postgresql-18-cluster-backup-secret-garage
         endpointCredentialsIncludeRegion: true
         retentionPolicy: "3d"
         isWALArchiver: true
       # - name: garage-remote
-      #   destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-17-cluster
+      #   destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
       #   index: 1
       #   endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
-      #   endpointCredentials: argo-workflows-postgresql-17-cluster-backup-secret-garage
+      #   endpointCredentials: argo-workflows-postgresql-18-cluster-backup-secret-garage
       #   endpointCredentialsIncludeRegion: true
       #   retentionPolicy: "30d"
       #   data:
@@ -134,6 +123,7 @@ postgres-17-cluster:
     scheduledBackups:
       - name: daily-backup
         suspend: false
+        immediate: true
         schedule: "0 0 0 * * *"
         backupName: external
       - name: live-backup
@@ -143,5 +133,6 @@ postgres-17-cluster:
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: true
+      #   immediate: true
       #   schedule: "0 0 4 * * SAT"
       #   backupName: garage-remote

clusters/cl01tl/helm/argocd/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 9.1.6
+  version: 9.1.7
-digest: sha256:488b8e826e7cc7179f154c1b7555e2cec78b69becb9f8cdbe4937b3546d87e5d
+digest: sha256:ed1ae26f3e642750f6dd970c1adc4fa14a627fad13daf74169213199f74425b3
-generated: "2025-12-05T04:02:40.060511766Z"
+generated: "2025-12-09T23:01:55.027301875Z"

clusters/cl01tl/helm/argocd/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 9.1.6
+    version: 9.1.7
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
-appVersion: 3.0.0
+appVersion: v3.2.1

clusters/cl01tl/helm/argocd/values.yaml

@@ -60,7 +60,7 @@ argo-cd:
     enabled: true
     auth: false
   redisSecretInit:
-    enabled: true
+    enabled: false
   server:
     replicas: 2
     extensions:
@@ -279,7 +279,7 @@ argo-cd:
         - description: Application has degraded
           send:
             - app-health-degraded
-          when: app.status.health.status == 'Degraded' and time.Now().Sub(time.Parse(app.status.health.lastTransitionTime).Minutes() >= 15
+          when: app.status.health.status == 'Degraded'
       trigger.on-sync-failed: |
         - description: Application syncing has failed
           send:

clusters/cl01tl/helm/audiobookshelf/Chart.yaml

@@ -20,4 +20,4 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/audiobookshelf.png
-appVersion: 2.21.0
+appVersion: 2.31.0

clusters/cl01tl/helm/authentik/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 2025.10.2
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.1
+  version: 1.23.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 6.16.1
-digest: sha256:c3bafb322ca02710c8f325fefef20678957a8c6fd86894e44e5e318997e5cb80
+digest: sha256:fdd5cc597cf958ca0f6f43dd403915c89c45718eff80920c2d322264dc8b09e1
-generated: "2025-12-03T23:59:57.54998859Z"
+generated: "2025-12-11T16:14:14.729827-06:00"

clusters/cl01tl/helm/authentik/Chart.yaml

@@ -26,10 +26,10 @@ dependencies:
   - name: cloudflared
     alias: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.1
+    version: 1.23.2
   - name: postgres-cluster
-    alias: postgres-17-cluster
+    alias: postgres-18-cluster
     version: 6.16.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/authentik.png
-appVersion: 2025.4.1
+appVersion: 2025.10.2

clusters/cl01tl/helm/authentik/templates/external-secret.yaml

@@ -47,10 +47,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: authentik-postgresql-17-cluster-backup-secret
+  name: authentik-postgresql-18-cluster-backup-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: authentik-postgresql-17-cluster-backup-secret
+    app.kubernetes.io/name: authentik-postgresql-18-cluster-backup-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -77,10 +77,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: authentik-postgresql-17-cluster-backup-secret-garage
+  name: authentik-postgresql-18-cluster-backup-secret-garage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: authentik-postgresql-17-cluster-backup-secret-garage
+    app.kubernetes.io/name: authentik-postgresql-18-cluster-backup-secret-garage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:

clusters/cl01tl/helm/authentik/templates/redis-replication.yaml

@@ -13,7 +13,7 @@ spec:
     runAsUser: 1000
     fsGroup: 1000
   kubernetesConfig:
-    image: quay.io/opstree/redis:v8.0.3
+    image: quay.io/opstree/redis:v8.4.0
     imagePullPolicy: IfNotPresent
     resources:
       requests:
@@ -29,4 +29,4 @@ spec:
             storage: 1Gi
   redisExporter:
     enabled: true
-    image: quay.io/opstree/redis-exporter:v1.48.0
+    image: quay.io/opstree/redis-exporter:v1.80.1

clusters/cl01tl/helm/authentik/values.yaml

@@ -9,22 +9,22 @@ authentik:
       - name: AUTHENTIK_POSTGRESQL__HOST
         valueFrom:
           secretKeyRef:
-            name: authentik-postgresql-17-cluster-app
+            name: authentik-postgresql-18-cluster-app
             key: host
       - name: AUTHENTIK_POSTGRESQL__NAME
         valueFrom:
           secretKeyRef:
-            name: authentik-postgresql-17-cluster-app
+            name: authentik-postgresql-18-cluster-app
             key: dbname
       - name: AUTHENTIK_POSTGRESQL__USER
         valueFrom:
           secretKeyRef:
-            name: authentik-postgresql-17-cluster-app
+            name: authentik-postgresql-18-cluster-app
             key: user
       - name: AUTHENTIK_POSTGRESQL__PASSWORD
         valueFrom:
           secretKeyRef:
-            name: authentik-postgresql-17-cluster-app
+            name: authentik-postgresql-18-cluster-app
             key: password
   authentik:
     redis:
@@ -50,9 +50,12 @@ authentik:
     enabled: false
 cloudflared:
   existingSecretName: authentik-cloudflared-secret
-postgres-17-cluster:
+postgres-18-cluster:
   mode: recovery
   cluster:
+    image:
+      repository: ghcr.io/cloudnative-pg/postgresql
+      tag: 18.1-standard-trixie
     storage:
       storageClass: local-path
     walStorage:
@@ -64,30 +67,30 @@ postgres-17-cluster:
   recovery:
     method: objectStore
     objectStore:
-      destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-17-cluster
+      destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-18-cluster
       endpointURL: http://garage-main.garage:3900
       index: 1
-      endpointCredentials: authentik-postgresql-17-cluster-backup-secret-garage
+      endpointCredentials: authentik-postgresql-18-cluster-backup-secret-garage
   backup:
     objectStore:
       - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/authentik/authentik-postgresql-17-cluster
+        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/authentik/authentik-postgresql-18-cluster
         index: 1
         retentionPolicy: "30d"
         isWALArchiver: false
       - name: garage-local
-        destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-17-cluster
+        destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-18-cluster
         index: 1
         endpointURL: http://garage-main.garage:3900
-        endpointCredentials: authentik-postgresql-17-cluster-backup-secret-garage
+        endpointCredentials: authentik-postgresql-18-cluster-backup-secret-garage
         endpointCredentialsIncludeRegion: true
         retentionPolicy: "3d"
         isWALArchiver: true
       # - name: garage-remote
-      #   destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-17-cluster
+      #   destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-18-cluster
       #   index: 1
       #   endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
-      #   endpointCredentials: authentik-postgresql-17-cluster-backup-secret-garage
+      #   endpointCredentials: authentik-postgresql-18-cluster-backup-secret-garage
       #   retentionPolicy: "30d"
       #   data:
       #     compression: bzip2
@@ -95,6 +98,7 @@ postgres-17-cluster:
     scheduledBackups:
       - name: daily-backup
         suspend: false
+        immediate: true
         schedule: "0 0 0 * * *"
         backupName: external
       - name: live-backup
@@ -104,5 +108,6 @@ postgres-17-cluster:
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: false
+      #   immediate: true
       #   schedule: "0 0 4 * * SAT"
       #   backupName: garage-remote

clusters/cl01tl/helm/bazarr/Chart.yaml

@@ -20,4 +20,4 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/bazarr.png
-appVersion: 1.5.2
+appVersion: 1.5.3

clusters/cl01tl/helm/bazarr/values.yaml

@@ -15,7 +15,7 @@ bazarr:
         main:
           image:
             repository: ghcr.io/linuxserver/bazarr
-            tag: 1.5.3@sha256:ec11e988e8e13411c994a4d9f43ed9b97409aa92c1da54d9f23926c3da7c2032
+            tag: 1.5.3@sha256:4aa1e82d1e96ae712095d881b7e3840e6db6ca862c335be5b00001f31156650b
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/blocky/Chart.yaml

@@ -18,4 +18,4 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/blocky.png
-appVersion: v0.25
+appVersion: v0.28.2

clusters/cl01tl/helm/blocky/templates/redis-replication.yaml

@@ -13,7 +13,7 @@ spec:
     runAsUser: 1000
     fsGroup: 1000
   kubernetesConfig:
-    image: quay.io/opstree/redis:v8.0.3
+    image: quay.io/opstree/redis:v8.4.0
     imagePullPolicy: IfNotPresent
     resources:
       requests:
@@ -29,4 +29,4 @@ spec:
             storage: 1Gi
   redisExporter:
     enabled: true
-    image: quay.io/opstree/redis-exporter:v1.48.0
+    image: quay.io/opstree/redis-exporter:v1.80.1

clusters/cl01tl/helm/blocky/values.yaml

@@ -156,6 +156,7 @@ blocky:
               radarr-anime                    IN      CNAME   traefik-cl01tl
               radarr-standup                  IN      CNAME   traefik-cl01tl
               searxng                         IN      CNAME   traefik-cl01tl
+              seerr                           IN      CNAME   traefik-cl01tl
               slskd                           IN      CNAME   traefik-cl01tl
               sonarr                          IN      CNAME   traefik-cl01tl
               sonarr-4k                       IN      CNAME   traefik-cl01tl

clusters/cl01tl/helm/booklore/Chart.yaml

@@ -21,4 +21,4 @@ dependencies:
     version: 25.10.2
     repository: https://helm.mariadb.com/mariadb-operator
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/booklore.png
-appVersion: v.1.10.0
+appVersion: v1.13.2

clusters/cl01tl/helm/booklore/values.yaml

@@ -9,7 +9,7 @@ booklore:
         main:
           image:
             repository: ghcr.io/booklore-app/booklore
-            tag: v1.13.1
+            tag: v1.13.2
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/cert-manager/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: cert-manager
   repository: https://charts.jetstack.io
-  version: v1.19.1
+  version: v1.19.2
-digest: sha256:0b1238a5552bc6d457d4b1a2a1f387a3e7f2c19f820ecb64e14d20481a1ed1ce
+digest: sha256:b02bda9b9f2fc886af11d017a27a5761513defee603f9e3aa1d7add2749b925c
-generated: "2025-12-01T20:25:17.762628-06:00"
+generated: "2025-12-10T15:01:57.196895547Z"

clusters/cl01tl/helm/cert-manager/Chart.yaml

@@ -14,7 +14,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: cert-manager
-    version: v1.19.1
+    version: v1.19.2
     repository: https://charts.jetstack.io
 icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/cert-manager.png
-appVersion: v1.17.2
+appVersion: v1.19.2

clusters/cl01tl/helm/cilium/Chart.yaml

@@ -18,4 +18,4 @@ dependencies:
     version: 1.18.4
     repository: https://helm.cilium.io/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/cilium.png
-appVersion: 1.17.3
+appVersion: 1.18.4

clusters/cl01tl/helm/cilium/values.yaml

@@ -55,6 +55,9 @@ cilium:
     metrics:
       serviceMonitor:
         enabled: true
+    tls:
+      auto:
+        method: cronJob
     relay:
       enabled: true
       metrics:

clusters/cl01tl/helm/cloudnative-pg/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: cloudnative-pg
   repository: https://cloudnative-pg.io/charts/
-  version: 0.26.1
+  version: 0.27.0
 - name: plugin-barman-cloud
   repository: https://cloudnative-pg.io/charts/
   version: 0.3.1
-digest: sha256:b38e5104d77ab1737a27a2542eda958e82038443940f07b7c2cbe3b0a477e1e6
+digest: sha256:14aa30b7bf75571b03bda19af68cd50c1e7908b883351b196a260609a5b85551
-generated: "2025-12-01T20:25:20.341325-06:00"
+generated: "2025-12-10T19:25:17.952954019Z"

clusters/cl01tl/helm/cloudnative-pg/Chart.yaml

@@ -16,10 +16,10 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: cloudnative-pg
-    version: 0.26.1
+    version: 0.27.0
     repository: https://cloudnative-pg.io/charts/
   - name: plugin-barman-cloud
     version: 0.3.1
     repository: https://cloudnative-pg.io/charts/
 icon: https://avatars.githubusercontent.com/u/100373852?s=200&v=4
-appVersion: 1.26.0
+appVersion: 1.28.0

clusters/cl01tl/helm/code-server/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 4.5.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.1
+  version: 1.23.2
-digest: sha256:97b29950cc5c263835abebd7ef2ca9c98510eb4122b4a0877af6f305c4615673
+digest: sha256:3cf78630cd7670e1157a87fc7ccbeca248ef4ced8a3170e69140ea3e1b0ff564
-generated: "2025-12-05T17:03:32.780722525Z"
+generated: "2025-12-07T02:54:11.675097664Z"

clusters/cl01tl/helm/code-server/Chart.yaml

@@ -23,6 +23,6 @@ dependencies:
   - name: cloudflared
     alias: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.1
+    version: 1.23.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/visual-studio-code.png
-appVersion: 4.100.2
+appVersion: 4.106.3

clusters/cl01tl/helm/coredns/Chart.yaml

@@ -18,4 +18,4 @@ dependencies:
     version: 1.45.0
     repository: https://coredns.github.io/helm
 icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/coredns.png
-appVersion: v1.12.1
+appVersion: v1.13.2

clusters/cl01tl/helm/descheduler/Chart.yaml

@@ -17,4 +17,4 @@ dependencies:
     version: 0.34.0
     repository: https://kubernetes-sigs.github.io/descheduler/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
-appVersion: 0.33.0
+appVersion: 0.34.0

clusters/cl01tl/helm/descheduler/values.yaml

@@ -39,16 +39,27 @@ descheduler:
           - name: RemovePodsViolatingNodeTaints
           - name: RemovePodsViolatingInterPodAntiAffinity
           - name: RemovePodsViolatingTopologySpreadConstraint
+          - name: "HighNodeUtilization"
+            args:
+              thresholds:
+                cpu : 80
+                memory: 80
+                pods: 90
+              evictableNamespaces:
+                exclude:
+                  - "kube-system"
+              evictionModes:
+                - "OnlyThresholdingResources"
           - name: LowNodeUtilization
             args:
               thresholds:
-                cpu: 20
+                cpu: 30
-                memory: 20
+                memory: 30
-                pods: 20
+                pods: 50
               targetThresholds:
                 cpu: 60
-                memory: 60
+                memory: 40
-                pods: 60
+                pods: 80
         plugins:
           balance:
             enabled:

clusters/cl01tl/helm/directus/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.5.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.1
+  version: 1.23.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 6.16.1
-digest: sha256:0d195cd3f8ac9e0a48b4c793a29b9a35f880aa2a695e605825109d3f461573f6
+digest: sha256:636b200b79efdd6ea36afdf29a5e85f3741b362dfcbf2af47c7aff9e55f02812
-generated: "2025-12-05T17:03:46.167997289Z"
+generated: "2025-12-11T16:47:16.317535-06:00"

clusters/cl01tl/helm/directus/Chart.yaml

@@ -24,10 +24,10 @@ dependencies:
   - name: cloudflared
     alias: cloudflared-directus
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.1
+    version: 1.23.2
   - name: postgres-cluster
-    alias: postgres-17-cluster
+    alias: postgres-18-cluster
     version: 6.16.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/directus.png
-appVersion: 11.7.2
+appVersion: 11.14.0

clusters/cl01tl/helm/directus/templates/external-secret.yaml

@@ -151,10 +151,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: directus-postgresql-17-cluster-backup-secret
+  name: directus-postgresql-18-cluster-backup-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: directus-postgresql-17-cluster-backup-secret
+    app.kubernetes.io/name: directus-postgresql-18-cluster-backup-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -181,40 +181,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: directus-postgresql-17-cluster-backup-secret-weekly
+  name: directus-postgresql-18-cluster-backup-secret-garage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: directus-postgresql-17-cluster-backup-secret-weekly
+    app.kubernetes.io/name: directus-postgresql-18-cluster-backup-secret-garage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
-        property: ACCESS_KEY_ID
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
-        property: ACCESS_SECRET_KEY
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: directus-postgresql-17-cluster-backup-secret-garage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: directus-postgresql-17-cluster-backup-secret-garage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:

clusters/cl01tl/helm/directus/templates/redis-replication.yaml

@@ -13,7 +13,7 @@ spec:
     runAsUser: 1000
     fsGroup: 1000
   kubernetesConfig:
-    image: quay.io/opstree/redis:v8.2.1
+    image: quay.io/opstree/redis:v8.4.0
     imagePullPolicy: IfNotPresent
     redisSecret:
       name: directus-redis-config
@@ -32,4 +32,4 @@ spec:
             storage: 1Gi
   redisExporter:
     enabled: true
-    image: quay.io/opstree/redis-exporter:v1.76.0
+    image: quay.io/opstree/redis-exporter:v1.80.1

clusters/cl01tl/helm/directus/templates/redis-sentinel.yaml

@@ -19,7 +19,7 @@ spec:
         name: directus-redis-config
         key: password
   kubernetesConfig:
-    image: quay.io/opstree/redis-sentinel:v7.0.15
+    image: quay.io/opstree/redis-sentinel:v8.4.0
     imagePullPolicy: IfNotPresent
     redisSecret:
       name: directus-redis-config

clusters/cl01tl/helm/directus/values.yaml

@@ -9,7 +9,7 @@ directus:
         main:
           image:
             repository: directus/directus
-            tag: 11.13.4
+            tag: 11.14.0
             pullPolicy: IfNotPresent
           env:
             - name: PUBLIC_URL
@@ -41,27 +41,27 @@ directus:
             - name: DB_HOST
               valueFrom:
                 secretKeyRef:
-                  name: directus-postgresql-17-cluster-app
+                  name: directus-postgresql-18-cluster-app
                   key: host
             - name: DB_DATABASE
               valueFrom:
                 secretKeyRef:
-                  name: directus-postgresql-17-cluster-app
+                  name: directus-postgresql-18-cluster-app
                   key: dbname
             - name: DB_PORT
               valueFrom:
                 secretKeyRef:
-                  name: directus-postgresql-17-cluster-app
+                  name: directus-postgresql-18-cluster-app
                   key: port
             - name: DB_USER
               valueFrom:
                 secretKeyRef:
-                  name: directus-postgresql-17-cluster-app
+                  name: directus-postgresql-18-cluster-app
                   key: user
             - name: DB_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: directus-postgresql-17-cluster-app
+                  name: directus-postgresql-18-cluster-app
                   key: password
             - name: SYNCHRONIZATION_STORE
               value: redis
@@ -156,9 +156,12 @@ directus:
 cloudflared-directus:
   name: cloudflared-directus
   existingSecretName: directus-cloudflared-secret
-postgres-17-cluster:
+postgres-18-cluster:
   mode: recovery
   cluster:
+    image:
+      repository: ghcr.io/cloudnative-pg/postgresql
+      tag: 18.1-standard-trixie
     storage:
       storageClass: local-path
     walStorage:
@@ -170,30 +173,30 @@ postgres-17-cluster:
   recovery:
     method: objectStore
     objectStore:
-      destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-17-cluster
+      destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-18-cluster
       endpointURL: http://garage-main.garage:3900
       index: 1
-      endpointCredentials: directus-postgresql-17-cluster-backup-secret-garage
+      endpointCredentials: directus-postgresql-18-cluster-backup-secret-garage
   backup:
     objectStore:
       - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/directus/directus-postgresql-17-cluster
+        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/directus/directus-postgresql-18-cluster
         index: 1
         retentionPolicy: "30d"
         isWALArchiver: false
       - name: garage-local
-        destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-17-cluster
+        destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-18-cluster
         index: 1
         endpointURL: http://garage-main.garage:3900
-        endpointCredentials: directus-postgresql-17-cluster-backup-secret-garage
+        endpointCredentials: directus-postgresql-18-cluster-backup-secret-garage
         endpointCredentialsIncludeRegion: true
         retentionPolicy: "3d"
         isWALArchiver: true
       # - name: garage-remote
-      #   destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-17-cluster
+      #   destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-18-cluster
       #   index: 1
       #   endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
-      #   endpointCredentials: directus-postgresql-17-cluster-backup-secret-garage
+      #   endpointCredentials: directus-postgresql-18-cluster-backup-secret-garage
       #   retentionPolicy: "30d"
       #   data:
       #     compression: bzip2
@@ -201,6 +204,7 @@ postgres-17-cluster:
     scheduledBackups:
       - name: daily-backup
         suspend: false
+        immediate: true
         schedule: "0 0 0 * * *"
         backupName: external
       - name: live-backup
@@ -210,5 +214,6 @@ postgres-17-cluster:
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: false
+      #   immediate: true
       #   schedule: "0 0 4 * * SAT"
       #   backupName: garage-remote

clusters/cl01tl/helm/elastic-operator/Chart.yaml

@@ -18,4 +18,4 @@ dependencies:
     version: 3.2.0
     repository: https://helm.elastic.co
 icon: https://helm.elastic.co/icons/eck.png
-appVersion: 1.26.0
+appVersion: v3.2.0

clusters/cl01tl/helm/element-web/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 1.4.26
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.1
+  version: 1.23.2
-digest: sha256:601cbb43296add7470b663f64b7bc18a2220d3cfff7bef397f72174929d9ff76
+digest: sha256:f9196cbede894c6da6ecedd9ae05d3f1fd0e20304eca8ca38c18334a923b2235
-generated: "2025-12-03T23:41:18.74872215Z"
+generated: "2025-12-07T02:54:29.895481505Z"

clusters/cl01tl/helm/element-web/Chart.yaml

@@ -22,6 +22,6 @@ dependencies:
   - name: cloudflared
     alias: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.1
+    version: 1.23.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/element.png
-appVersion: v1.11.100
+appVersion: v1.12.6

clusters/cl01tl/helm/eraser/Chart.yaml

@@ -17,4 +17,4 @@ dependencies:
     version: 1.4.1
     repository: https://eraser-dev.github.io/eraser/charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
-appVersion: v1.3.1
+appVersion: v1.4.1

clusters/cl01tl/helm/external-dns/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     version: 1.19.0
     repository: https://kubernetes-sigs.github.io/external-dns/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
-appVersion: 1.16.1
+appVersion: v0.20.0

clusters/cl01tl/helm/external-secrets/Chart.yaml

@@ -15,4 +15,4 @@ dependencies:
     version: 1.1.1
     repository: https://charts.external-secrets.io
 icon: https://avatars.githubusercontent.com/u/68335991?s=48&v=4
-appVersion: 0.17.0
+appVersion: v1.1.1

clusters/cl01tl/helm/freshrss/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.5.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.1
+  version: 1.23.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 6.16.1
-digest: sha256:9b9282efd9c59c36abcc2cad640a57a402f99474bd4154efcf4e6850a096b5ba
+digest: sha256:dc8829a1f2cea88033bfda5d412dee8124154e26bfbe9e1bd67b8bb351ad7904
-generated: "2025-12-05T17:04:16.909780215Z"
+generated: "2025-12-11T17:07:50.35548-06:00"

clusters/cl01tl/helm/freshrss/Chart.yaml

@@ -24,10 +24,10 @@ dependencies:
   - name: cloudflared
     alias: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.1
+    version: 1.23.2
   - name: postgres-cluster
-    alias: postgres-17-cluster
+    alias: postgres-18-cluster
     version: 6.16.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/freshrss.png
-appVersion: 1.26.2
+appVersion: 1.27.1

clusters/cl01tl/helm/freshrss/templates/external-secret.yaml

@@ -155,10 +155,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: freshrss-postgresql-17-cluster-backup-secret
+  name: freshrss-postgresql-18-cluster-backup-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: freshrss-postgresql-17-cluster-backup-secret
+    app.kubernetes.io/name: freshrss-postgresql-18-cluster-backup-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -185,10 +185,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: freshrss-postgresql-17-cluster-backup-secret-garage
+  name: freshrss-postgresql-18-cluster-backup-secret-garage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: freshrss-postgresql-17-cluster-backup-secret-garage
+    app.kubernetes.io/name: freshrss-postgresql-18-cluster-backup-secret-garage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:

clusters/cl01tl/helm/freshrss/values.yaml

@@ -98,22 +98,22 @@ freshrss:
             - name: DB_HOST
               valueFrom:
                 secretKeyRef:
-                  name: freshrss-postgresql-17-cluster-app
+                  name: freshrss-postgresql-18-cluster-app
                   key: host
             - name: DB_BASE
               valueFrom:
                 secretKeyRef:
-                  name: freshrss-postgresql-17-cluster-app
+                  name: freshrss-postgresql-18-cluster-app
                   key: dbname
             - name: DB_USER
               valueFrom:
                 secretKeyRef:
-                  name: freshrss-postgresql-17-cluster-app
+                  name: freshrss-postgresql-18-cluster-app
                   key: user
             - name: DB_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: freshrss-postgresql-17-cluster-app
+                  name: freshrss-postgresql-18-cluster-app
                   key: password
             - name: FRESHRSS_INSTALL
               value: |
@@ -193,9 +193,12 @@ freshrss:
               readOnly: false
 cloudflared:
   existingSecretName: freshrss-cloudflared-secret
-postgres-17-cluster:
+postgres-18-cluster:
   mode: recovery
   cluster:
+    image:
+      repository: ghcr.io/cloudnative-pg/postgresql
+      tag: 18.1-standard-trixie
     storage:
       storageClass: local-path
     walStorage:
@@ -207,30 +210,30 @@ postgres-17-cluster:
   recovery:
     method: objectStore
     objectStore:
-      destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-17-cluster
+      destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-18-cluster
       endpointURL: http://garage-main.garage:3900
       index: 1
-      endpointCredentials: freshrss-postgresql-17-cluster-backup-secret-garage
+      endpointCredentials: freshrss-postgresql-18-cluster-backup-secret-garage
   backup:
     objectStore:
       - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/freshrss/freshrss-postgresql-17-cluster
+        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/freshrss/freshrss-postgresql-18-cluster
         index: 1
         retentionPolicy: "30d"
         isWALArchiver: false
       - name: garage-local
-        destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-17-cluster
+        destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-18-cluster
         index: 1
         endpointURL: http://garage-main.garage:3900
-        endpointCredentials: freshrss-postgresql-17-cluster-backup-secret-garage
+        endpointCredentials: freshrss-postgresql-18-cluster-backup-secret-garage
         endpointCredentialsIncludeRegion: true
         retentionPolicy: "3d"
         isWALArchiver: true
       # - name: garage-remote
-      #   destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-17-cluster
+      #   destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-18-cluster
       #   index: 1
       #   endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
-      #   endpointCredentials: freshrss-postgresql-17-cluster-backup-secret-garage
+      #   endpointCredentials: freshrss-postgresql-18-cluster-backup-secret-garage
       #   retentionPolicy: "30d"
       #   data:
       #     compression: bzip2
@@ -238,6 +241,7 @@ postgres-17-cluster:
     scheduledBackups:
       - name: daily-backup
         suspend: false
+        immediate: true
         schedule: "0 0 0 * * *"
         backupName: external
       - name: live-backup
@@ -247,5 +251,6 @@ postgres-17-cluster:
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: false
+      #   immediate: true
       #   schedule: "0 2 4 * * SAT"
       #   backupName: garage-remote

clusters/cl01tl/helm/gatus/Chart.lock

@@ -5,5 +5,5 @@ dependencies:
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 6.16.1
-digest: sha256:53e3b31b3fa3916ac4478c0ca3733a18f7145a0129b6a9c7aefdaf8169cb525c
+digest: sha256:11d46f37e9f98a5562239e1b827a4caccc0ca14dc738681465e27ef5c5edd6d0
-generated: "2025-12-04T00:00:45.882393108Z"
+generated: "2025-12-11T17:23:01.072262-06:00"

clusters/cl01tl/helm/gatus/Chart.yaml

@@ -21,8 +21,8 @@ dependencies:
     repository: https://twin.github.io/helm-charts
     version: 1.4.4
   - name: postgres-cluster
-    alias: postgres-17-cluster
+    alias: postgres-18-cluster
     version: 6.16.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/gatus.png
-appVersion: v5.12.0
+appVersion: v5.33.0

clusters/cl01tl/helm/gatus/templates/external-secret.yaml

@@ -54,10 +54,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: gatus-postgresql-17-cluster-backup-secret
+  name: gatus-postgresql-18-cluster-backup-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: gatus-postgresql-17-cluster-backup-secret
+    app.kubernetes.io/name: gatus-postgresql-18-cluster-backup-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -84,10 +84,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: gatus-postgresql-17-cluster-backup-secret-garage
+  name: gatus-postgresql-18-cluster-backup-secret-garage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: gatus-postgresql-17-cluster-backup-secret-garage
+    app.kubernetes.io/name: gatus-postgresql-18-cluster-backup-secret-garage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:

clusters/cl01tl/helm/gatus/values.yaml

@@ -36,27 +36,27 @@ gatus:
     POSTGRES_USER:
       valueFrom:
         secretKeyRef:
-          name: gatus-postgresql-17-cluster-app
+          name: gatus-postgresql-18-cluster-app
           key: username
     POSTGRES_PASSWORD:
       valueFrom:
         secretKeyRef:
-          name: gatus-postgresql-17-cluster-app
+          name: gatus-postgresql-18-cluster-app
           key: password
     POSTGRES_HOST:
       valueFrom:
         secretKeyRef:
-          name: gatus-postgresql-17-cluster-app
+          name: gatus-postgresql-18-cluster-app
           key: host
     POSTGRES_PORT:
       valueFrom:
         secretKeyRef:
-          name: gatus-postgresql-17-cluster-app
+          name: gatus-postgresql-18-cluster-app
           key: port
     POSTGRES_DB:
       valueFrom:
         secretKeyRef:
-          name: gatus-postgresql-17-cluster-app
+          name: gatus-postgresql-18-cluster-app
           key: dbname
   resources:
     requests:
@@ -125,6 +125,9 @@ gatus:
       - name: overseerr
         url: https://overseerr.alexlebens.net
         <<: *defaults
+      - name: seerr
+        url: https://seerr.alexlebens.net
+        <<: *defaults
       - name: yamtrack
         url: https://yamtrack.alexlebens.net
         <<: *defaults
@@ -140,6 +143,9 @@ gatus:
       - name: audiobookshelf
         url: https://audiobookshelf.alexlebens.net
         <<: *defaults
+      - name: booklore
+        url: https://booklore.alexlebens.net
+        <<: *defaults
       - name: home-assistant
         url: https://home-assistant.alexlebens.net
         <<: *defaults
@@ -176,6 +182,11 @@ gatus:
       - name: n8n
         url: https://n8n.alexlebens.net
         <<: *defaults
+      - name: kronic
+        url: https://kronic.alexlebens.net
+        <<: *defaults
+        conditions:
+          - "[STATUS] == 401"
       - name: omni-tools
         url: https://omni-tools.alexlebens.net
         <<: *defaults
@@ -245,6 +256,9 @@ gatus:
       - name: ceph
         url: https://ceph.alexlebens.net
         <<: *defaults
+      - name: garage
+        url: https://garage-webui.alexlebens.net
+        <<: *defaults
       - name: pgadmin
         url: https://pgadmin.alexlebens.net
         <<: *defaults
@@ -254,6 +268,29 @@ gatus:
       - name: vault
         url: https://vault.alexlebens.net
         <<: *defaults
+      - name: backrest
+        url: https://backrest.alexlebens.net
+        <<: *defaults
+      - name: qui
+        url: https://qui.alexlebens.net
+        <<: *defaults
+      - name: qbittorrent
+        url: https://qbittorrent.alexlebens.net
+        <<: *defaults
+      - name: prowlarr
+        url: https://prowlarr.alexlebens.net
+        <<: *defaults
+      - name: huntarr
+        url: https://huntarr.alexlebens.net
+        <<: *defaults
+      - name: bazarr
+        url: https://bazarr.alexlebens.net
+        <<: *defaults
+        conditions:
+          - "[STATUS] == 401"
+      - name: tdarr
+        url: https://tdarr.alexlebens.net
+        <<: *defaults
       - name: sonarr
         url: https://sonarr.alexlebens.net
         <<: *defaults
@@ -284,25 +321,11 @@ gatus:
       - name: slskd
         url: https://slskd.alexlebens.net
         <<: *defaults
-      - name: qui
+      - name: ephemera
-        url: https://qui.alexlebens.net
+        url: https://ephemera.alexlebens.net
         <<: *defaults
-      - name: qbittorrent
+      - name: listenarr
-        url: https://qbittorrent.alexlebens.net
+        url: https://listenarr.alexlebens.net
-        <<: *defaults
-      - name: prowlarr
-        url: https://prowlarr.alexlebens.net
-        <<: *defaults
-      - name: bazarr
-        url: https://bazarr.alexlebens.net
-        <<: *defaults
-        conditions:
-          - "[STATUS] == 401"
-      - name: huntarr
-        url: https://huntarr.alexlebens.net
-        <<: *defaults
-      - name: tdarr
-        url: https://tdarr.alexlebens.net
         <<: *defaults
       - name: www
         url: https://www.alexlebens.dev
@@ -347,27 +370,20 @@ gatus:
         url: https://codeserver.alexlebens.dev
         <<: *defaults
         group: external
+      - name: authentik
+        url: https://auth.alexlebens.dev
+        <<: *defaults
+        group: external
       - name: public homepage
         url: https://home.alexlebens.dev
         <<: *defaults
         group: external
-      - name: discord
+postgres-18-cluster:
-        group: public
-        url: https://discord.com/app
-        conditions:
-          - "[STATUS] == 200"
-          - "[RESPONSE_TIME] < 400"
-        interval: 10s
-      - name: reddit
-        group: public
-        url: https://reddit.com
-        conditions:
-          - "[STATUS] == 200"
-          - "[RESPONSE_TIME] < 400"
-        interval: 10s
-postgres-17-cluster:
   mode: recovery
   cluster:
+    image:
+      repository: ghcr.io/cloudnative-pg/postgresql
+      tag: 18.1-standard-trixie
     storage:
       storageClass: local-path
     walStorage:
@@ -379,19 +395,19 @@ postgres-17-cluster:
   recovery:
     method: objectStore
     objectStore:
-      destinationPath: s3://postgres-backups/cl01tl/gatus/gatus-postgresql-17-cluster
+      destinationPath: s3://postgres-backups/cl01tl/gatus/gatus-postgresql-18-cluster
       endpointURL: http://garage-main.garage:3900
       index: 1
-      endpointCredentials: gatus-postgresql-17-cluster-backup-secret-garage
+      endpointCredentials: gatus-postgresql-18-cluster-backup-secret-garage
   backup:
     objectStore:
       - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/gatus/gatus-postgresql-17-cluster
+        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/gatus/gatus-postgresql-18-cluster
         index: 2
         retentionPolicy: "30d"
         isWALArchiver: false
       - name: garage-local
-        destinationPath: s3://postgres-backups/cl01tl/gatus/gatus-postgresql-17-cluster
+        destinationPath: s3://postgres-backups/cl01tl/gatus/gatus-postgresql-18-cluster
         index: 1
         endpointURL: http://garage-main.garage:3900
         endpointCredentials: gatus-postgresql-17-cluster-backup-secret-garage
@@ -399,10 +415,10 @@ postgres-17-cluster:
         retentionPolicy: "3d"
         isWALArchiver: true
       # - name: garage-remote
-      #   destinationPath: s3://postgres-backups/cl01tl/gatus/gatus-postgresql-17-cluster
+      #   destinationPath: s3://postgres-backups/cl01tl/gatus/gatus-postgresql-18-cluster
       #   index: 1
       #   endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
-      #   endpointCredentials: gatus-postgresql-17-cluster-backup-secret-garage
+      #   endpointCredentials: gatus-postgresql-18-cluster-backup-secret-garage
       #   retentionPolicy: "30d"
       #   data:
       #     compression: bzip2
@@ -410,6 +426,7 @@ postgres-17-cluster:
     scheduledBackups:
       - name: daily-backup
         suspend: false
+        immediate: true
         schedule: "0 0 0 * * *"
         backupName: external
       - name: live-backup
@@ -419,5 +436,6 @@ postgres-17-cluster:
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: false
+      #   immediate: true
       #   schedule: "0 0 4 * * SAT"
       #   backupName: garage-remote

clusters/cl01tl/helm/generic-device-plugin/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: generic-device-plugin
   repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-  version: 0.20.4
+  version: 0.20.5
-digest: sha256:4aa24e57233783f99d3de453f997ff4dddecaea729ab09b78745ee89ffa0e4a8
+digest: sha256:329b2d00301ab1467a8654dd92febfd7078db121c00c0960548010c01dee66b6
-generated: "2025-12-06T01:01:30.343689275Z"
+generated: "2025-12-08T03:02:06.697075532Z"

clusters/cl01tl/helm/generic-device-plugin/Chart.yaml

@@ -15,6 +15,6 @@ maintainers:
 dependencies:
   - name: generic-device-plugin
     repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-    version: 0.20.4
+    version: 0.20.5
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: 1.0.0

clusters/cl01tl/helm/gitea/Chart.lock

@@ -13,9 +13,9 @@ dependencies:
   version: 0.17.2
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.1
+  version: 1.23.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 6.16.1
-digest: sha256:8850bad801d100185e4748ee90848d28c31c9e9e9e75da9051ee4da900e7e2af
+digest: sha256:ecb6e0283b564f37b5d60bb64860b71c3b68acc2835364c0488fd7a9e932b941
-generated: "2025-12-05T17:04:42.441262591Z"
+generated: "2025-12-11T17:38:49.087683-06:00"

clusters/cl01tl/helm/gitea/Chart.yaml

@@ -41,10 +41,10 @@ dependencies:
   - name: cloudflared
     alias: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.1
+    version: 1.23.2
   - name: postgres-cluster
-    alias: postgres-17-cluster
+    alias: postgres-18-cluster
     version: 6.16.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/gitea.png
-appVersion: 1.23.7
+appVersion: 1.25.2

clusters/cl01tl/helm/gitea/templates/external-secret.yaml

@@ -254,10 +254,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: gitea-postgresql-17-cluster-backup-secret
+  name: gitea-postgresql-18-cluster-backup-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: gitea-postgresql-17-cluster-backup-secret
+    app.kubernetes.io/name: gitea-postgresql-18-cluster-backup-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -284,10 +284,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: gitea-postgresql-17-cluster-backup-secret-garage
+  name: gitea-postgresql-18-cluster-backup-secret-garage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: gitea-postgresql-17-cluster-backup-secret-garage
+    app.kubernetes.io/name: gitea-postgresql-18-cluster-backup-secret-garage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:

clusters/cl01tl/helm/gitea/templates/redis-replication.yaml

@@ -13,7 +13,7 @@ spec:
     runAsUser: 1000
     fsGroup: 1000
   kubernetesConfig:
-    image: quay.io/opstree/redis:v8.0.3
+    image: quay.io/opstree/redis:v8.4.0
     imagePullPolicy: IfNotPresent
     resources:
       requests:
@@ -29,7 +29,7 @@ spec:
             storage: 10Gi
   redisExporter:
     enabled: true
-    image: quay.io/opstree/redis-exporter:v1.48.0
+    image: quay.io/opstree/redis-exporter:v1.80.1
 
 ---
 apiVersion: redis.redis.opstreelabs.in/v1beta2
@@ -47,7 +47,7 @@ spec:
     runAsUser: 1000
     fsGroup: 1000
   kubernetesConfig:
-    image: quay.io/opstree/redis:v8.0.3
+    image: quay.io/opstree/redis:v8.4.0
     imagePullPolicy: IfNotPresent
     resources:
       requests:
@@ -63,4 +63,4 @@ spec:
             storage: 1Gi
   redisExporter:
     enabled: true
-    image: quay.io/opstree/redis-exporter:v1.48.0
+    image: quay.io/opstree/redis-exporter:v1.80.1

clusters/cl01tl/helm/gitea/templates/redis-sentinel.yaml

@@ -0,0 +1,23 @@
+apiVersion: redis.redis.opstreelabs.in/v1beta2
+kind: RedisSentinel
+metadata:
+  name: redis-sentinel-gitea
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: redis-sentinel-gitea
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  clusterSize: 3
+  podSecurityContext:
+    runAsUser: 1000
+    fsGroup: 1000
+  redisSentinelConfig:
+    redisReplicationName: redis-replication-gitea
+  kubernetesConfig:
+    image: quay.io/opstree/redis-sentinel:v8.4.0
+    imagePullPolicy: IfNotPresent
+    resources:
+      requests:
+        cpu: 10m
+        memory: 128Mi

clusters/cl01tl/helm/gitea/templates/service-monitor.yaml

@@ -12,8 +12,6 @@ spec:
     matchLabels:
       app.kubernetes.io/name: gitea
       app.kubernetes.io/instance: {{ .Release.Name }}
-    matchExpressions:
-      - { key: app.kubernetes.io/controller, operator: NotIn, values: [backup] }
   endpoints:
     - port: http
 

clusters/cl01tl/helm/gitea/values.yaml

@@ -108,22 +108,22 @@ gitea:
       - name: GITEA__DATABASE__HOST
         valueFrom:
           secretKeyRef:
-            name: gitea-postgresql-17-cluster-app
+            name: gitea-postgresql-18-cluster-app
             key: host
       - name: GITEA__DATABASE__NAME
         valueFrom:
           secretKeyRef:
-            name: gitea-postgresql-17-cluster-app
+            name: gitea-postgresql-18-cluster-app
             key: dbname
       - name: GITEA__DATABASE__USER
         valueFrom:
           secretKeyRef:
-            name: gitea-postgresql-17-cluster-app
+            name: gitea-postgresql-18-cluster-app
             key: user
       - name: GITEA__DATABASE__PASSWD
         valueFrom:
           secretKeyRef:
-            name: gitea-postgresql-17-cluster-app
+            name: gitea-postgresql-18-cluster-app
             key: password
       - name: GITEA__INDEXER__ISSUE_INDEXER_CONN_STR
         valueFrom:
@@ -174,6 +174,9 @@ gitea-actions:
 backup:
   global:
     fullnameOverride: gitea-backup
+    labels:
+      app.kubernetes.io/instance: gitea-backup
+      app.kubernetes.io/name: gitea-backup
   controllers:
     backup:
       type: cronjob
@@ -191,6 +194,9 @@ backup:
         name: gitea-backup
       pod:
         automountServiceAccountToken: true
+        labels:
+          app.kubernetes.io/instance: gitea-backup
+          app.kubernetes.io/name: gitea-backup
       initContainers:
         backup:
           image:
@@ -212,7 +218,7 @@ backup:
         s3-backup:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:590c42746db1252be8aad33e287c7910698c32b58b4fc34f67592a5bd0841551
+            tag: latest@sha256:a4ef406e37628ee56e608b1567aeb0345e51142f56741b715322111be3b6ebcc
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -236,7 +242,7 @@ backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:590c42746db1252be8aad33e287c7910698c32b58b4fc34f67592a5bd0841551
+            tag: latest@sha256:a4ef406e37628ee56e608b1567aeb0345e51142f56741b715322111be3b6ebcc
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -316,9 +322,12 @@ meilisearch:
     enabled: true
 cloudflared:
   existingSecretName: gitea-cloudflared-secret
-postgres-17-cluster:
+postgres-18-cluster:
   mode: recovery
   cluster:
+    image:
+      repository: ghcr.io/cloudnative-pg/postgresql
+      tag: 18.1-standard-trixie
     storage:
       storageClass: local-path
     walStorage:
@@ -334,30 +343,30 @@ postgres-17-cluster:
   recovery:
     method: objectStore
     objectStore:
-      destinationPath: s3://postgres-backups/cl01tl/gitea/gitea-postgresql-17-cluster
+      destinationPath: s3://postgres-backups/cl01tl/gitea/gitea-postgresql-18-cluster
       endpointURL: http://garage-main.garage:3900
       index: 1
-      endpointCredentials: gitea-postgresql-17-cluster-backup-secret-garage
+      endpointCredentials: gitea-postgresql-18-cluster-backup-secret-garage
   backup:
     objectStore:
       - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/gitea/gitea-postgresql-17-cluster
+        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/gitea/gitea-postgresql-18-cluster
         index: 1
         retentionPolicy: "30d"
         isWALArchiver: false
       - name: garage-local
-        destinationPath: s3://postgres-backups/cl01tl/gitea/gitea-postgresql-17-cluster
+        destinationPath: s3://postgres-backups/cl01tl/gitea/gitea-postgresql-18-cluster
         index: 1
         endpointURL: http://garage-main.garage:3900
-        endpointCredentials: gitea-postgresql-17-cluster-backup-secret-garage
+        endpointCredentials: gitea-postgresql-18-cluster-backup-secret-garage
         endpointCredentialsIncludeRegion: true
         retentionPolicy: "3d"
         isWALArchiver: true
       # - name: garage-remote
-      #   destinationPath: s3://postgres-backups/cl01tl/gitea/gitea-postgresql-17-cluster
+      #   destinationPath: s3://postgres-backups/cl01tl/gitea/gitea-postgresql-18-cluster
       #   index: 1
       #   endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
-      #   endpointCredentials: gitea-postgresql-17-cluster-backup-secret-garage
+      #   endpointCredentials: gitea-postgresql-18-cluster-backup-secret-garage
       #   retentionPolicy: "30d"
       #   data:
       #     compression: bzip2
@@ -365,6 +374,7 @@ postgres-17-cluster:
     scheduledBackups:
       - name: daily-backup
         suspend: false
+        immediate: true
         schedule: "0 0 0 * * *"
         backupName: external
       - name: live-backup
@@ -374,5 +384,6 @@ postgres-17-cluster:
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: false
+      #   immediate: true
       #   schedule: "0 0 4 * * SAT"
       #   backupName: garage-remote

clusters/cl01tl/helm/grafana-operator/Chart.lock

@@ -5,5 +5,5 @@ dependencies:
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 6.16.1
-digest: sha256:3bd7096e4401df5818733b3e0b08f281c12af9b54a272fbe3e753b2616d725dd
+digest: sha256:9640766b4a15b50a759edbc8a2aad816f9240be72bf06364acb387464245d51a
-generated: "2025-12-04T00:01:28.278027037Z"
+generated: "2025-12-11T19:19:12.375716-06:00"

clusters/cl01tl/helm/grafana-operator/Chart.yaml

@@ -20,8 +20,8 @@ dependencies:
     version: v5.20.0
     repository: https://grafana.github.io/helm-charts
   - name: postgres-cluster
-    alias: postgres-17-cluster
+    alias: postgres-18-cluster
     version: 6.16.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grafana.png
-appVersion: v5.18.0
+appVersion: v5.20.0

clusters/cl01tl/helm/grafana-operator/templates/external-secret.yaml

@@ -61,10 +61,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: grafana-operator-postgresql-17-cluster-backup-secret
+  name: grafana-operator-postgresql-18-cluster-backup-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: grafana-operator-postgresql-17-cluster-backup-secret
+    app.kubernetes.io/name: grafana-operator-postgresql-18-cluster-backup-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -91,10 +91,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: grafana-operator-postgresql-17-cluster-backup-secret-garage
+  name: grafana-operator-postgresql-18-cluster-backup-secret-garage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: grafana-operator-postgresql-17-cluster-backup-secret-garage
+    app.kubernetes.io/name: grafana-operator-postgresql-18-cluster-backup-secret-garage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:

clusters/cl01tl/helm/grafana-operator/templates/grafana.yaml

@@ -85,25 +85,25 @@ spec:
                 - name: DB_HOST
                   valueFrom:
                     secretKeyRef:
-                      name: grafana-operator-postgresql-17-cluster-app
+                      name: grafana-operator-postgresql-18-cluster-app
                       key: host
                 - name: DB_DATABASE
                   valueFrom:
                     secretKeyRef:
-                      name: grafana-operator-postgresql-17-cluster-app
+                      name: grafana-operator-postgresql-18-cluster-app
                       key: dbname
                 - name: DB_PORT
                   valueFrom:
                     secretKeyRef:
-                      name: grafana-operator-postgresql-17-cluster-app
+                      name: grafana-operator-postgresql-18-cluster-app
                       key: port
                 - name: DB_USER
                   valueFrom:
                     secretKeyRef:
-                      name: grafana-operator-postgresql-17-cluster-app
+                      name: grafana-operator-postgresql-18-cluster-app
                       key: user
                 - name: DB_PASSWORD
                   valueFrom:
                     secretKeyRef:
-                      name: grafana-operator-postgresql-17-cluster-app
+                      name: grafana-operator-postgresql-18-cluster-app
                       key: password

clusters/cl01tl/helm/grafana-operator/templates/redis-replication.yaml

@@ -13,7 +13,7 @@ spec:
     runAsUser: 1000
     fsGroup: 1000
   kubernetesConfig:
-    image: quay.io/opstree/redis:v8.0.3
+    image: quay.io/opstree/redis:v8.4.0
     imagePullPolicy: IfNotPresent
     resources:
       requests:
@@ -29,7 +29,7 @@ spec:
             storage: 1Gi
   redisExporter:
     enabled: true
-    image: quay.io/opstree/redis-exporter:v1.48.0
+    image: quay.io/opstree/redis-exporter:v1.80.1
 
 ---
 apiVersion: redis.redis.opstreelabs.in/v1beta2
@@ -47,7 +47,7 @@ spec:
     runAsUser: 1000
     fsGroup: 1000
   kubernetesConfig:
-    image: quay.io/opstree/redis:v8.0.3
+    image: quay.io/opstree/redis:v8.4.0
     imagePullPolicy: IfNotPresent
     resources:
       requests:
@@ -63,4 +63,4 @@ spec:
             storage: 1Gi
   redisExporter:
     enabled: true
-    image: quay.io/opstree/redis-exporter:v1.48.0
+    image: quay.io/opstree/redis-exporter:v1.80.1

clusters/cl01tl/helm/grafana-operator/values.yaml

@@ -12,9 +12,12 @@ grafana-operator:
     enabled: true
   dashboard:
     enabled: false
-postgres-17-cluster:
+postgres-18-cluster:
   mode: recovery
   cluster:
+    image:
+      repository: ghcr.io/cloudnative-pg/postgresql
+      tag: 18.1-standard-trixie
     storage:
       storageClass: local-path
     walStorage:
@@ -26,30 +29,30 @@ postgres-17-cluster:
   recovery:
     method: objectStore
     objectStore:
-      destinationPath: s3://postgres-backups/cl01tl/grafana-operator/grafana-operator-postgresql-17-cluster
+      destinationPath: s3://postgres-backups/cl01tl/grafana-operator/grafana-operator-postgresql-18-cluster
       endpointURL: http://garage-main.garage:3900
       index: 1
-      endpointCredentials: grafana-operator-postgresql-17-cluster-backup-secret-garage
+      endpointCredentials: grafana-operator-postgresql-18-cluster-backup-secret-garage
   backup:
     objectStore:
       - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/grafana-operator/grafana-operator-postgresql-17-cluster
+        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/grafana-operator/grafana-operator-postgresql-18-cluster
-        index: 2
+        index: 1
         retentionPolicy: "30d"
         isWALArchiver: false
       - name: garage-local
-        destinationPath: s3://postgres-backups/cl01tl/grafana-operator/grafana-operator-postgresql-17-cluster
+        destinationPath: s3://postgres-backups/cl01tl/grafana-operator/grafana-operator-postgresql-18-cluster
         index: 1
         endpointURL: http://garage-main.garage:3900
-        endpointCredentials: grafana-operator-postgresql-17-cluster-backup-secret-garage
+        endpointCredentials: grafana-operator-postgresql-18-cluster-backup-secret-garage
         endpointCredentialsIncludeRegion: true
         retentionPolicy: "3d"
         isWALArchiver: true
       # - name: garage-remote
-      #   destinationPath: s3://postgres-backups/cl01tl/grafana-operator/grafana-operator-postgresql-17-cluster
+      #   destinationPath: s3://postgres-backups/cl01tl/grafana-operator/grafana-operator-postgresql-18-cluster
       #   index: 1
       #   endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
-      #   endpointCredentials: grafana-operator-postgresql-17-cluster-backup-secret-garage
+      #   endpointCredentials: grafana-operator-postgresql-18-cluster-backup-secret-garage
       #   retentionPolicy: "30d"
       #   data:
       #     compression: bzip2
@@ -57,6 +60,7 @@ postgres-17-cluster:
     scheduledBackups:
       - name: daily-backup
         suspend: false
+        immediate: true
         schedule: "0 0 0 * * *"
         backupName: external
       - name: live-backup
@@ -66,5 +70,6 @@ postgres-17-cluster:
         backupName: garage-local
       # - name: weekly-backup
       #   suspend: false
+      #   immediate: true
       #   schedule: "0 0 4 * * SAT"
       #   backupName: garage-remote

clusters/cl01tl/helm/harbor/Chart.lock

@@ -0,0 +1,9 @@
+dependencies:
+- name: harbor
+  repository: https://helm.goharbor.io
+  version: 1.18.1
+- name: postgres-cluster
+  repository: https://gitea.alexlebens.net/api/packages/alexlebens/helm
+  version: 6.16.1
+digest: sha256:547d6956a0adfd074a0ef6e0928076426174065588675be704f551056a5f3604
+generated: "2025-12-11T19:33:32.993993-06:00"

clusters/cl01tl/helm/harbor/Chart.yaml

@@ -17,11 +17,11 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: harbor
-    version: 1.18.0
+    version: 1.18.1
     repository: https://helm.goharbor.io
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 6.16.1
-    repository: http://gitea-http.gitea:3000/api/packages/alexlebens/helm
+    repository: https://gitea.alexlebens.net/api/packages/alexlebens/helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/harbor.png
-appVersion: v2.13.0
+appVersion: v2.14.1

clusters/cl01tl/helm/harbor/values.yaml

@@ -1,9 +1,17 @@
 harbor:
   expose:
-    type: clusterIP
+    type: route
     tls:
-      auto:
+      enabled: true
-        commonName: harbor.alexlebens.net
+      certSource: auto
+    route:
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hosts:
+        - harbor.alexlebens.net
   externalURL: https://harbor.alexlebens.net
   persistence:
     enabled: true
@@ -31,11 +39,6 @@ harbor:
       enabled: true
   cache:
     enabled: true
-  nginx:
-    image:
-      repository: goharbor/nginx-photon
-      tag: v2.14.1
-    replicas: 0
   portal:
     image:
       repository: goharbor/harbor-portal

clusters/cl01tl/helm/headlamp/templates/cluster-role-binding.yaml

@@ -13,7 +13,7 @@ roleRef:
   apiGroup: rbac.authorization.k8s.io
 subjects:
   - kind: User
-    name: alexanderlebens@gmail.com
+    name: https://authentik.alexlebens.net/application/o/headlamp/#alexanderlebens@gmail.com
     apiGroup: rbac.authorization.k8s.io
   - kind: ServiceAccount
     name: headlamp-admin

clusters/cl01tl/helm/headlamp/templates/external-secret.yaml

@@ -40,14 +40,14 @@ spec:
         key: /authentik/oidc/headlamp
         metadataPolicy: None
         property: scopes
-    - secretKey: OIDC_VALIDATOR_ISSUER_URL
+    - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_IDP_ISSUER_URL
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
         key: /authentik/oidc/headlamp
         metadataPolicy: None
         property: validator-issuer-url
-    - secretKey: OIDC_VALIDATOR_CLIENT_ID
+    - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_CLIENT_ID
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None

clusters/cl01tl/helm/headlamp/values.yaml

@@ -26,6 +26,9 @@ headlamp:
         - name: trivy
           source: https://artifacthub.io/packages/headlamp/headlamp-trivy/headlamp_trivy
           version: 0.3.1
+        - name: external-secrets-operator
+          source: https://artifacthub.io/packages/headlamp/external-secrets-operator-headlamp-plugin/external-secrets-operator
+          version: 0.1.0-beta7
       installOptions:
-        parallel: true
+        parallel: false
-        maxConcurrent: 2
+        maxConcurrent: 1

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -9,7 +9,7 @@ home-assistant:
         main:
           image:
             repository: ghcr.io/home-assistant/home-assistant
-            tag: 2025.12.0
+            tag: 2025.12.2
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/homepage-dev/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 4.5.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.1
+  version: 1.23.2
-digest: sha256:c376b4c3c32f4d2e60a64248073f971e0e78d21b016d75832f5deb504b1cec6b
+digest: sha256:fbfdebf734560044cfe5d2c4771b63cbcabc121d13c44b751f914877b5bdc83f
-generated: "2025-12-05T17:05:10.9852779Z"
+generated: "2025-12-07T02:55:01.91141803Z"

clusters/cl01tl/helm/homepage-dev/Chart.yaml

@@ -22,6 +22,6 @@ dependencies:
   - name: cloudflared
     alias: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.1
+    version: 1.23.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/homepage.png
 appVersion: v1.2.0

clusters/cl01tl/helm/homepage-dev/values.yaml

@@ -11,7 +11,7 @@ homepage:
         main:
           image:
             repository: ghcr.io/gethomepage/homepage
-            tag: v1.7.0
+            tag: v1.8.0
             pullPolicy: IfNotPresent
           env:
             - name: HOMEPAGE_ALLOWED_HOSTS

clusters/cl01tl/helm/homepage/values.yaml

@@ -15,7 +15,7 @@ homepage:
         main:
           image:
             repository: ghcr.io/gethomepage/homepage
-            tag: v1.7.0
+            tag: v1.8.0
             pullPolicy: IfNotPresent
           env:
             - name: HOMEPAGE_ALLOWED_HOSTS
@@ -143,10 +143,16 @@ homepage:
                   statusStyle: dot
               - Media Requests:
                   icon: sh-overseerr.webp
-                  description: Overseer
+                  description: Overseerr
                   href: https://overseerr.alexlebens.net
                   siteMonitor: http://overseerr.overseerr:80
                   statusStyle: dot
+              - Media Requests (New):
+                  icon: sh-overseerr.webp
+                  description: Seerr
+                  href: https://seerr.alexlebens.net
+                  siteMonitor: http://seerr-seerr-chart.seerr:80
+                  statusStyle: dot
               - Media Tracking:
                   icon: sh-yamtrack.webp
                   description: Yamtrack

clusters/cl01tl/helm/karakeep/Chart.lock

@@ -7,6 +7,6 @@ dependencies:
   version: 0.17.2
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.1
+  version: 1.23.2
-digest: sha256:d322e5d85648cebd8d7bc6228b2d84904bfcea705e01ebecba1d2f2ed869f548
+digest: sha256:c291962defb9fb8614db91ea3eef795b2bdf82e0364595a27cbd335e7f9a3179
-generated: "2025-12-05T17:06:25.81244037Z"
+generated: "2025-12-07T02:55:11.250839916Z"

clusters/cl01tl/helm/karakeep/Chart.yaml

@@ -27,6 +27,6 @@ dependencies:
   - name: cloudflared
     alias: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.1
+    version: 1.23.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/webp/karakeep.webp
 appVersion: 0.26.0

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 79.12.0
+  version: 80.2.0
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.5.0
-digest: sha256:e7edbec86ffbb16885333a6e1eeffec5c336bed8c161c52165949987eca4392d
+digest: sha256:78e60a6bd6407b1a2d0e1bb9f7717faedd7ad43ded9cb4b6a93e29e85bdf294a
-generated: "2025-12-05T21:30:48.985834989Z"
+generated: "2025-12-10T21:05:54.967633057Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -19,7 +19,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 79.12.0
+    version: 80.2.0
     repository: oci://ghcr.io/prometheus-community/charts
   - name: app-template
     alias: ntfy-alertmanager

clusters/cl01tl/helm/kubelet-serving-cert-approver/values.yaml

@@ -38,7 +38,7 @@ kubelet-serving-cert-approver:
         main:
           image:
             repository: ghcr.io/alex1989hu/kubelet-serving-cert-approver
-            tag: 0.10.0
+            tag: 0.10.1
             pullPolicy: Always
           args:
             - serve

clusters/cl01tl/helm/lidatube/values.yaml

@@ -13,7 +13,7 @@ lidatube:
         main:
           image:
             repository: thewicklowwolf/lidatube
-            tag: 0.2.41
+            tag: 0.2.42
             pullPolicy: IfNotPresent
           env:
             - name: PUID

clusters/cl01tl/helm/loki/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: loki
   repository: https://grafana.github.io/helm-charts
-  version: 6.46.0
+  version: 6.48.0
 - name: promtail
   repository: https://grafana.github.io/helm-charts
   version: 6.17.1
-digest: sha256:ff5441b35309842526f15b544bf3a7cb80508b1547bbd0eb58fa584172b716be
+digest: sha256:218f6fdff5df62e43f081f045ab7ccba541a792b42750e3ebb8ac28308072724
-generated: "2025-12-01T19:55:56.473483-06:00"
+generated: "2025-12-10T18:02:17.566041524Z"

clusters/cl01tl/helm/loki/Chart.yaml

@@ -16,7 +16,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: loki
-    version: 6.46.0
+    version: 6.48.0
     repository: https://grafana.github.io/helm-charts
   - name: promtail
     version: 6.17.1

clusters/cl01tl/helm/matrix-synapse/Chart.lock

@@ -1,18 +1,18 @@
 dependencies:
 - name: matrix-synapse
   repository: https://ananace.gitlab.io/charts
-  version: 3.12.16
+  version: 3.12.17
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.5.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.1
+  version: 1.23.2
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.1
+  version: 1.23.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 6.16.1
-digest: sha256:8a50907ebe63a29d2219d824391e0cd1ed76e80adc234d0bc4dd48414cc24a83
+digest: sha256:b1df95bd8c258c15178f35b229b2d2aee28fc2fff2b5176ed734a7aaeffaa372
-generated: "2025-12-05T17:08:37.566169937Z"
+generated: "2025-12-10T17:01:51.601498219Z"

clusters/cl01tl/helm/matrix-synapse/Chart.yaml

@@ -29,7 +29,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: matrix-synapse
-    version: 3.12.16
+    version: 3.12.17
     repository: https://ananace.gitlab.io/charts
   - name: app-template
     alias: matrix-hookshot
@@ -45,11 +45,11 @@ dependencies:
   #   version: 4.0.1
   - name: cloudflared
     alias: cloudflared-synapse
-    version: 1.23.1
+    version: 1.23.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: cloudflared
     alias: cloudflared-hookshot
-    version: 1.23.1
+    version: 1.23.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: postgres-cluster
     alias: postgres-17-cluster

clusters/cl01tl/helm/n8n/values.yaml

@@ -9,7 +9,7 @@ n8n:
         main:
           image:
             repository: ghcr.io/n8n-io/n8n
-            tag: 1.123.1
+            tag: 2.0.1
             pullPolicy: IfNotPresent
           env:
             - name: GENERIC_TIMEZONE
@@ -93,7 +93,7 @@ n8n:
         main:
           image:
             repository: ghcr.io/n8n-io/n8n
-            tag: 1.123.1
+            tag: 2.0.1
             pullPolicy: IfNotPresent
           command:
             - n8n
@@ -188,7 +188,7 @@ n8n:
         main:
           image:
             repository: ghcr.io/n8n-io/n8n
-            tag: 1.123.1
+            tag: 2.0.1
             pullPolicy: IfNotPresent
           command:
             - n8n

clusters/cl01tl/helm/ollama/values.yaml

@@ -22,7 +22,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.13.1
+            tag: 0.13.2
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE
@@ -58,7 +58,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.13.1
+            tag: 0.13.2
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE
@@ -94,7 +94,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.13.1
+            tag: 0.13.2
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE

clusters/cl01tl/helm/outline/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.5.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.1
+  version: 1.23.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 6.16.1
-digest: sha256:968e3af0f01ea3a0597f8bfb17e5f82145a3503bb500e4369f70911c5377e822
+digest: sha256:6ef789f9db4ad00ce2178a138c3c39a4e90eaef1e4244f52282bc0cb3094f4f5
-generated: "2025-12-05T17:09:44.110984861Z"
+generated: "2025-12-07T02:55:32.91116723Z"

clusters/cl01tl/helm/outline/Chart.yaml

@@ -25,7 +25,7 @@ dependencies:
   - name: cloudflared
     alias: cloudflared-outline
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.1
+    version: 1.23.2
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 6.16.1

clusters/cl01tl/helm/postiz/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.5.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.1
+  version: 1.23.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 6.16.1
-digest: sha256:0a1164bd6ef443f53cf93365fab60ecd6bf2623bf612ee860449cc47301da723
+digest: sha256:6ed7bd8fa055ec4def561bbd391d49544a6cea8cef596b279845290b666d5316
-generated: "2025-12-05T17:10:43.908497892Z"
+generated: "2025-12-07T02:55:42.350284796Z"

clusters/cl01tl/helm/postiz/Chart.yaml

@@ -23,7 +23,7 @@ dependencies:
     version: 4.5.0
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.1
+    version: 1.23.2
   - name: postgres-cluster
     alias: postgres-17-cluster
     version: 6.16.1