chore(deps): update dock.mau.dev/mautrix/whatsapp docker tag to v0.2603.0

The Renovate config in this repository needs migrating. Typically this is because one or more configuration options you are using have been renamed.

  You don't need to merge this PR right away, because Renovate will continue to migrate these fields internally each time it runs. But later some of these fields may be fully deprecated and the migrations removed. So it's a good idea to merge this migration PR soon.

🔕 **Ignore**: Close this PR and you won't be reminded about config migration again, but one day your current config may no longer be valid.

❓ Got questions? Does something look wrong to you? Please don't hesitate to [request help here](https://github.com/renovatebot/renovate/discussions).

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

Reviewed-on: #5258
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

.gitea/workflows/renovate.yaml

@@ -13,7 +13,7 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.96.0@sha256:41af2f21008f8f5785833277ac951b4f44e936b61394dc7edccdc0fe09e59132
+    container: ghcr.io/renovatebot/renovate:43.99.0@sha256:aae697086b93427dcde46eb92e08e334b018946ce19339bf044ce971ca1626e2
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

clusters/cl01tl/helm/argocd/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 9.4.16
-digest: sha256:f9ecc47369d4401df61c17f55cc59c9b2d4543f57cf122653abb1a27a4f7bf35
-generated: "2026-03-26T21:01:52.678525211Z"
+  version: 9.4.17
+digest: sha256:17752dbf03861cf70ee31c9a17373a5175656a2edd00ba5fcd3988a195147da8
+generated: "2026-03-28T01:51:34.832601868Z"

clusters/cl01tl/helm/argocd/Chart.yaml

@@ -13,8 +13,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 9.4.16
+    version: 9.4.17
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-cd
-appVersion: v3.3.5
+appVersion: v3.3.6

clusters/cl01tl/helm/cert-manager/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: cert-manager
   repository: https://charts.jetstack.io
-  version: v1.20.0
-digest: sha256:1543bd17649cb32982de3cce017fcbed1b44c41d50b76c6471b266f33e261c29
-generated: "2026-03-10T16:06:49.332999536Z"
+  version: v1.20.1
+digest: sha256:1bf36eba44cf096b40355a697b8cffb302f07f9135374222aabdf686f017b7a9
+generated: "2026-03-28T01:35:24.542754563Z"

clusters/cl01tl/helm/cert-manager/Chart.yaml

@@ -13,8 +13,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: cert-manager
-    version: v1.20.0
+    version: v1.20.1
     repository: https://charts.jetstack.io
 icon: https://raw.githubusercontent.com/cert-manager/cert-manager/refs/heads/master/logo/logo.png
 # renovate: datasource=github-releases depName=cert-manager/cert-manager
-appVersion: v1.20.0
+appVersion: v1.20.1

clusters/cl01tl/helm/foldergram/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
 # renovate: datasource=github-releases depName=foldergram/foldergram
-appVersion: v1.0.8
+appVersion: v1.0.9

clusters/cl01tl/helm/foldergram/values.yaml

@@ -12,7 +12,7 @@ foldergram:
         main:
           image:
             repository: ghcr.io/foldergram/foldergram
-            tag: 1.0.8@sha256:3546dc1da4ec12cb27aaecbf77896d708ac7601eb0225e0f6e181d7ef35273f9
+            tag: 1.0.9@sha256:aa6707e7456386f2d74b8f2769d0281f4127d1276349583b8531dbaa8f844883
             pullPolicy: IfNotPresent
           env:
             - name: IMAGE_DETAIL_SOURCE

clusters/cl01tl/helm/grafana-operator/Chart.yaml

@@ -5,14 +5,13 @@ description: Grafana Operator
 keywords:
   - grafana-operator
   - dashboard
-  - metrics
-  - logs
-home: https://wiki.alexlebens.dev/s/3e5723e1-2ab7-45ab-b496-b8854907fa39
+home: https://docs.alexlebens.dev/applications/grafana-operator/
 sources:
   - https://github.com/grafana/grafana-operator
-  - https://github.com/cloudnative-pg/cloudnative-pg
+  - https://github.com/grafana/grafana/pkgs/container/grafana%2Fgrafana
   - https://github.com/grafana/grafana-operator/tree/master/deploy/helm/grafana-operator
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/grafana-operator/templates/external-secret.yaml

@@ -14,17 +14,11 @@ spec:
   data:
     - secretKey: admin-user
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/grafana/auth
-        metadataPolicy: None
         property: admin-user
     - secretKey: admin-password
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/grafana/auth
-        metadataPolicy: None
         property: admin-password
 
 ---
@@ -44,17 +38,11 @@ spec:
   data:
     - secretKey: AUTH_CLIENT_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/grafana
-        metadataPolicy: None
         property: client
     - secretKey: AUTH_CLIENT_SECRET
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/grafana
-        metadataPolicy: None
         property: secret
 
 ---
@@ -74,17 +62,11 @@ spec:
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
         property: access
     - secretKey: ACCESS_SECRET_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
         property: secret
 
 ---
@@ -104,22 +86,13 @@ spec:
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: ACCESS_SECRET_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
     - secretKey: ACCESS_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
         property: ACCESS_REGION

clusters/cl01tl/helm/grafana-operator/templates/grafana-dashboard.yaml

@@ -11,9 +11,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/ceph.json
 
 ---
@@ -30,9 +30,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/coredns.json
 
 ---
@@ -49,9 +49,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/etcd.json
 
 ---
@@ -68,9 +68,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/garage.json
 
 ---
@@ -87,9 +87,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/loki.json
 
 ---
@@ -106,9 +106,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/node-full.json
 
 ---
@@ -125,9 +125,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/node-short.json
 
 ---
@@ -144,9 +144,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-system
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/pods.json
 
 ---
@@ -163,9 +163,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/argocd.json
 
 ---
@@ -182,9 +182,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/blocky.json
 
 ---
@@ -201,9 +201,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/cert-manager.json
 
 ---
@@ -220,9 +220,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/cloudnative-pg.json
 
 ---
@@ -239,9 +239,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/descheduler.json
 
 ---
@@ -258,9 +258,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/gatus.json
 
 ---
@@ -277,9 +277,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/grafana-operator.json
 
 ---
@@ -296,9 +296,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/harbor.json
 
 ---
@@ -315,9 +315,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/speedtest-exporter.json
 
 ---
@@ -334,9 +334,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/spegel.json
 
 ---
@@ -353,9 +353,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/traefik.json
 
 ---
@@ -372,9 +372,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/tdarr.json
 
 ---
@@ -391,9 +391,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/unpoller.json
 
 ---
@@ -410,9 +410,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-service
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/volsync.json
 
 ---
@@ -429,9 +429,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/s3.json
 
 ---
@@ -448,9 +448,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/authentik.json
 
 ---
@@ -467,9 +467,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/gitea.json
 
 ---
@@ -486,9 +486,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/ntfy.json
 
 ---
@@ -505,9 +505,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/qbittorrent.json
 
 ---
@@ -524,9 +524,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-platform
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/vault.json
 
 ---
@@ -543,9 +543,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-iot
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/iot/airgradient.json
 
 ---
@@ -562,9 +562,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-iot
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/iot/server-power-consumption.json
 
 ---
@@ -581,9 +581,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-application
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/immich.json
 
 ---
@@ -600,9 +600,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-application
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/jellyfin.json
 
 ---
@@ -619,9 +619,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-application
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/radarr.json
 
 ---
@@ -638,7 +638,7 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 1h
+  contentCacheDuration: 6h
   folderUID: grafana-folder-application
-  resyncPeriod: 1h
+  resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/sonarr.json

clusters/cl01tl/helm/grafana-operator/templates/grafana.yaml

@@ -56,11 +56,12 @@ spec:
         spec:
           containers:
             - name: grafana
-              image: grafana/grafana:12.0.0
+              # renovate: datasource=docker depName=grafana/grafana
+              image: grafana/grafana:12.4.2@sha256:83749231c3835e390a3144e5e940203e42b9589761f20ef3169c716e734ad505
               resources:
                 requests:
-                  cpu: 100m
-                  memory: 128Mi
+                  cpu: 20m
+                  memory: 120Mi
               env:
                 - name: AUTH_CLIENT_ID
                   valueFrom:
@@ -107,3 +108,12 @@ spec:
                     secretKeyRef:
                       name: grafana-operator-postgresql-18-cluster-app
                       key: password
+  httpRoute:
+    spec:
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - grafana.alexlebens.net

clusters/cl01tl/helm/grafana-operator/templates/http-route.yaml

@@ -1,28 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: grafana
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: grafana
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-  hostnames:
-    - grafana.alexlebens.net
-  rules:
-    - matches:
-      - path:
-          type: PathPrefix
-          value: /
-      backendRefs:
-        - group: ''
-          kind: Service
-          name: grafana-main-service
-          port: 3000
-          weight: 100

clusters/cl01tl/helm/grafana-operator/values.yaml

@@ -1,17 +1,11 @@
 grafana-operator:
   replicas: 2
-  serviceAccount:
-    create: true
-  rbac:
-    create: true
   resources:
     requests:
-      cpu: 10m
-      memory: 64Mi
+      cpu: 1m
+      memory: 50Mi
   serviceMonitor:
     enabled: true
-  dashboard:
-    enabled: false
 postgres-18-cluster:
   mode: recovery
   recovery:
@@ -25,35 +19,12 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
-      # - name: garage-remote
-      #   index: 1
-      #   destinationBucket: postgres-backups
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   retentionPolicy: "90d"
-      #   data:
-      #     compression: bzip2
-      # - name: external
-      #   index: 1
-      #   endpointURL: https://nyc3.digitaloceanspaces.com
-      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
-      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
-      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 30 14 * * *"
         backupName: garage-local
-      # - name: weekly-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 4 * * SAT"
-      #   backupName: garage-remote
-      # - name: daily-backup
-      #   suspend: true
-      #   immediate: true
-      #   schedule: "0 0 0 * * *"
-      #   backupName: external
 valkey-unified-alerting:
   valkey:
     nameOverride: valkey-unified-alerting

clusters/cl01tl/helm/homepage/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/homepage.png
 # renovate: datasource=github-releases depName=gethomepage/homepage
-appVersion: v1.11.0
+appVersion: v1.12.0

clusters/cl01tl/helm/homepage/values.yaml

@@ -16,7 +16,7 @@ homepage:
         main:
           image:
             repository: ghcr.io/gethomepage/homepage
-            tag: v1.11.0
+            tag: v1.12.1
             pullPolicy: IfNotPresent
           env:
             - name: HOMEPAGE_ALLOWED_HOSTS

clusters/cl01tl/helm/houndarr/values.yaml

@@ -9,7 +9,7 @@ houndarr:
         main:
           image:
             repository: ghcr.io/av1155/houndarr
-            tag: v1.6.2
+            tag: v1.6.3
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/immich/values.yaml

@@ -9,7 +9,7 @@ immich:
         main:
           image:
             repository: ghcr.io/immich-app/immich-server
-            tag: v2.6.2
+            tag: v2.6.3
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 82.15.0
+  version: 82.15.1
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.6.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
-digest: sha256:524759b57f9500d5742b962bcdb114ec556d80ec4418921c93a722e00df57647
-generated: "2026-03-26T23:02:03.558664114Z"
+digest: sha256:7be2f0d61a12e674af175046960df7ba06a7248dc92db0b2d9c9b63a77a5bc17
+generated: "2026-03-28T01:54:34.406941487Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 82.15.0
+    version: 82.15.1
     repository: oci://ghcr.io/prometheus-community/charts
   - name: app-template
     alias: ntfy-alertmanager

clusters/cl01tl/helm/loki/Chart.yaml

@@ -23,4 +23,4 @@ dependencies:
     repository: https://grafana.github.io/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/loki.png
 # renovate: datasource=github-releases depName=grafana/loki
-appVersion: 3.7.0
+appVersion: 3.7.1

clusters/cl01tl/helm/matrix-synapse/values.yaml

@@ -345,7 +345,7 @@ mautrix-whatsapp:
         main:
           image:
             repository: dock.mau.dev/mautrix/whatsapp
-            tag: v0.2602.0
+            tag: v0.2603.0
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/movie-roulette/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     version: 4.6.2
 icon: https://raw.githubusercontent.com/sahara101/Movie-Roulette/refs/heads/main/static/icons/icon.png
 # renovate: datasource=github-releases depName=sahara101/Movie-Roulette
-appVersion: v5.3.0
+appVersion: v5.4.0

clusters/cl01tl/helm/movie-roulette/values.yaml

@@ -9,7 +9,7 @@ movie-roulette:
         main:
           image:
             repository: ghcr.io/sahara101/movie-roulette
-            tag: v5.3.0
+            tag: v5.4.0
             pullPolicy: IfNotPresent
           env:
             - name: FLASK_SECRET_KEY

clusters/cl01tl/helm/music-grabber/Chart.yaml

@@ -17,4 +17,5 @@ dependencies:
     alias: music-grabber
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
-appVersion: 2.0.4
+# renovate: datasource=docker depName=g33kphr33k/musicgrabber
+appVersion: 2.5.3

clusters/cl01tl/helm/music-grabber/values.yaml

@@ -9,7 +9,7 @@ music-grabber:
         main:
           image:
             repository: g33kphr33k/musicgrabber
-            tag: 2.5.2
+            tag: 2.5.3
             pullPolicy: IfNotPresent
           env:
             - name: MUSIC_DIR

clusters/cl01tl/helm/ntfy/Chart.yaml

@@ -20,4 +20,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ntfy.png
 # renovate: datasource=github-releases depName=binwiederhier/ntfy
-appVersion: 2.20.0
+appVersion: 2.20.1

clusters/cl01tl/helm/ntfy/values.yaml

@@ -9,7 +9,7 @@ ntfy:
         main:
           image:
             repository: binwiederhier/ntfy
-            tag: v2.20.0
+            tag: v2.20.1
             pullPolicy: IfNotPresent
           args: ["serve"]
           env:

clusters/cl01tl/helm/ollama/values.yaml

@@ -117,7 +117,7 @@ ollama:
         main:
           image:
             repository: ghcr.io/open-webui/open-webui
-            tag: v0.8.10
+            tag: v0.8.12
             pullPolicy: IfNotPresent
           env:
             - name: ENV

clusters/cl01tl/helm/postiz/values.yaml

@@ -9,7 +9,7 @@ postiz:
         main:
           image:
             repository: ghcr.io/gitroomhq/postiz-app
-            tag: v2.21.0
+            tag: v2.21.3
             pullPolicy: IfNotPresent
           env:
             - name: MAIN_URL

clusters/cl01tl/helm/rybbit/values.yaml

@@ -122,7 +122,7 @@ rybbit:
         main:
           image:
             repository: clickhouse/clickhouse-server
-            tag: 26.2.5
+            tag: 26.3.2
             pullPolicy: IfNotPresent
           env:
             - name: CLICKHOUSE_DB

clusters/cl01tl/helm/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:032eec8dcd3799007059d0753e9d04837fc8dba8d8b749a08469118a8039b703
+            tag: latest@sha256:4d7ed8b7035ecf827bd901ba6d32f5c32d8119bc09bb3cdafeb0ce58f1b951c1
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -39,7 +39,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:032eec8dcd3799007059d0753e9d04837fc8dba8d8b749a08469118a8039b703
+            tag: latest@sha256:4d7ed8b7035ecf827bd901ba6d32f5c32d8119bc09bb3cdafeb0ce58f1b951c1
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL

clusters/cl01tl/helm/tailscale-operator/Chart.yaml

@@ -21,4 +21,4 @@ dependencies:
     repository: https://pkgs.tailscale.com/helmcharts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tailscale-light.png
 # renovate: datasource=github-releases depName=tailscale/tailscale
-appVersion: v1.96.3
+appVersion: v1.96.4

clusters/cl01tl/helm/tdarr/values.yaml

@@ -166,7 +166,7 @@ tdarr-exporter:
   image:
     name: homeylab/tdarr-exporter
     # renovate: datasource=docker depName=homeylab/tdarr-exporter
-    tag: 1.4.2
+    tag: 1.4.3
   metrics:
     serviceMonitor:
       enabled: true

clusters/cl01tl/helm/whodb/Chart.yaml

@@ -20,4 +20,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/whodb.png
 # renovate: datasource=github-releases depName=clidey/whodb
-appVersion: 0.101.0
+appVersion: 0.103.0

clusters/cl01tl/helm/whodb/values.yaml

@@ -8,7 +8,7 @@ whodb:
         main:
           image:
             repository: clidey/whodb
-            tag: 0.101.0
+            tag: 0.103.0
             pullPolicy: IfNotPresent
           env:
             - name: WHODB_OLLAMA_HOST

hosts/ps08rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.11@sha256:acfc80650104f0194a15f73dc1648f517561bc1645391a15705332a064cfc33c
+        image: ghcr.io/traefik/traefik:v3.6.12@sha256:171c9c3565b29f6c133f1c1b43c5d4e5853415198e9e1078c001f8702ff66aec
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

hosts/ps09rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.11@sha256:acfc80650104f0194a15f73dc1648f517561bc1645391a15705332a064cfc33c
+        image: ghcr.io/traefik/traefik:v3.6.12@sha256:171c9c3565b29f6c133f1c1b43c5d4e5853415198e9e1078c001f8702ff66aec
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

hosts/ps10rp/homepage/compose.yaml

@@ -32,7 +32,7 @@ services:
             - /var/run/docker.sock:/var/run/docker.sock:ro
 
     homepage:
-        image: ghcr.io/gethomepage/homepage:v1.11.0@sha256:b129cb0f674bd6d204e215bde2c2fc3f11d6ad0e82f6d20007cf80f74e1acbb1
+        image: ghcr.io/gethomepage/homepage:v1.12.1@sha256:9627769818fbfb14147d3e633e57cef9c27c0c5f07585f5a1d6c3d3425b3b33c
         container_name: homepage
         labels:
             traefik.enable: true

hosts/ps10rp/traefik/compose.yaml

@@ -20,7 +20,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.11@sha256:acfc80650104f0194a15f73dc1648f517561bc1645391a15705332a064cfc33c
+        image: ghcr.io/traefik/traefik:v3.6.12@sha256:171c9c3565b29f6c133f1c1b43c5d4e5853415198e9e1078c001f8702ff66aec
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

renovate.json

@@ -3,40 +3,40 @@
   "extends": [
     "config:recommended",
     "mergeConfidence:all-badges",
-    ":rebaseStalePrs",
-    "group:recommended",
-    "group:monorepos",
-    "group:kubernetesMonorepo"
+    ":rebaseStalePrs"
   ],
   "timezone": "America/Chicago",
   "labels": [],
   "prHourlyLimit": 0,
   "prConcurrentLimit": 0,
   "pinDigests": true,
+  "minimumReleaseAgeBehaviour": "timestamp-optional",
   "baseBranchPatterns": [
     "main"
   ],
   "customManagers": [
     {
-      "description": "Update appVersion in Chart.yaml",
+      "description": "Renovate tag matcher for Helm chart appVersion",
       "customType": "regex",
       "managerFilePatterns": [
         "/(^|/)Chart\\.yaml$/"
       ],
       "matchStrings": [
-        "#\\s*renovate:\\s*datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+appVersion:\\s*[\"']?(?<currentValue>[^\"'\\s]+)[\"']?"
+        "#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)(?:\\s+versioning=(?<versioning>\\S+))?\\s+appVersion:\\s*[\"']?(?<currentValue>[^\\s\"']+)[\"']?"
       ],
       "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver-coerced{{/if}}"
     },
     {
-      "description": "Update images in templates",
+      "description": "Renovate tag matcher for Helm values and templates",
       "customType": "regex",
       "managerFilePatterns": [
+        "/(^|/)values\\.yaml$/",
         "/(^|/)templates/.*\\.yaml$/"
       ],
       "matchStrings": [
-        "# renovate: datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)\\s+tag:\\s*[\"']?(?<currentValue>[^@\"'\\s\n]+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?[\"']?"
-      ]
+        "#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)(?:\\s+versioning=(?<versioning>\\S+))?\\s+tag:\\s*[\"']?(?<currentValue>[^@\\s\"']+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?[\"']?"
+      ],
+      "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}docker{{/if}}"
     },
     {
       "description": "Update Helm CLI version in GitHub Actions",
@@ -74,42 +74,48 @@
       "enabled": false
     },
     {
-      "description": "Label by datasource",
+      "description": "Label Helm updates",
       "matchDatasources": [
-        "helm",
-        "docker",
-        "github-actions"
+        "helm"
       ],
       "addLabels": [
-        "{{{datasource}}}"
+        "helm"
+      ]
+    },
+    {
+      "description": "Label Docker updates",
+      "matchDatasources": [
+        "docker"
+      ],
+      "addLabels": [
+        "docker"
       ]
     },
     {
       "description": "Versioning for LinuxServer images",
       "versioning": "regex:^v?(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-ls(?<revision>\\d+)$",
       "matchPackageNames": [
-        "/^linuxserver\\//",
-        "/^ghcr\\.io/linuxserver\\//",
-        "/^lscr\\.io/linuxserver\\//"
+        "/^linuxserver//",
+        "/^ghcr\\.io/linuxserver//",
+        "/^lscr\\.io/linuxserver//"
       ]
     },
     {
-      "description": "Group packages together when stripping registry",
-      "matchManagers": [
-        "custom.regex",
-        "helm-values"
-      ],
-      "groupName": "{{#if packageName}}{{{replace 'ghcr.io/' '' (replace 'docker.io/' '' packageName)}}}{{else}}{{{replace 'ghcr.io/' '' (replace 'docker.io/' '' depName)}}}{{/if}}",
-      "groupSlug": "unified-{{{groupName}}}"
+      "description": "Group packages together by stripping all registry/namespace prefixes",
+      "groupName": "{{#if packageName}}{{{replace '^.*/([^/]+)$' '$1' packageName}}}{{else}}{{{replace '^.*/([^/]+)$' '$1' depName}}}{{/if}}",
+      "groupSlug": "unified-{{{groupName}}}",
+      "matchPackageNames": [
+        "*"
+      ]
     },
     {
       "description": "Group for specific apps",
+      "groupName": "{{{replace '^.*(argo-cd|bazarr|cilium|code-server|dawarich|element-web|home-assistant|immich|komodo|rook-ceph|tdarr|traefik).*$' '$1' depName}}}",
+      "groupSlug": "unified-{{{groupName}}}",
       "matchPackageNames": [
-        "/(^|/)(dawarich|komodo|immich|home-assistant|element-web|cilium|tdarr|argo-cd|traefik|bazarr|code-server)/",
-        "/^rook(-ceph|\\/rook|\\/ceph)/"
-      ],
-      "groupName": "{{{replace '^.*(dawarich|komodo|immich|home-assistant|element-web|cilium|tdarr|argo-cd|traefik|bazarr|code-server|rook-ceph).*$' '$1' depName}}}",
-      "groupSlug": "unified-{{{groupName}}}"
+        "/(^|/)(argo-cd|bazarr|cilium|code-server|dawarich|element-web|home-assistant|immich|komodo|rook-ceph|tdarr|traefik)/",
+        "/^rook(-ceph|/rook|/ceph)/"
+      ]
     },
     {
       "description": "Automerge helm chart lock files",
@@ -120,6 +126,7 @@
         "enabled": true
       },
       "addLabels": [
+        "{{{datasource}}}",
         "automerge"
       ],
       "automerge": true,
@@ -140,13 +147,11 @@
       "matchUpdateTypes": [
         "digest"
       ],
-      "matchDatasources": [
-        "docker"
-      ],
       "matchPackageNames": [
         "searxng/searxng"
       ],
       "addLabels": [
+        "{{{datasource}}}",
         "automerge"
       ],
       "enabled": true,
@@ -158,34 +163,30 @@
         "patch",
         "pinDigest"
       ],
-      "matchDatasources": [
-        "helm",
-        "docker",
-        "github-actions"
-      ],
       "addLabels": [
+        "{{{datasource}}}",
         "automerge"
       ],
       "automerge": true,
-      "minimumReleaseAge": "1 days"
+      "minimumReleaseAge": "3 days"
     },
     {
       "description": "Automerge images, specific packages",
       "matchUpdateTypes": [
+        "minor",
         "patch",
-        "minor"
-      ],
-      "matchDatasources": [
-        "docker"
+        "pinDigest"
       ],
       "matchPackageNames": [
         "ghcr.io/renovatebot/renovate",
         "ghcr.io/prometheus-community/charts/kube-prometheus-stack"
       ],
       "addLabels": [
+        "{{{datasource}}}",
         "automerge"
       ],
-      "automerge": true
+      "automerge": true,
+      "minimumReleaseAge": "3 days"
     }
   ]
 }