feat: change to boot from grimmory (#5030 )

Reviewed-on: #5030
feat: change user
2026-03-24 02:54:59 +00:00 · 2026-03-23 21:49:41 -05:00 · 2026-03-24 02:44:26 +00:00 · 2026-03-24 02:25:28 +00:00 · 2026-03-24 02:10:14 +00:00 · 2026-03-24 01:50:24 +00:00
27 changed files with 559 additions and 18 deletions
--- a/.gitea/workflows/lint-test-helm.yaml
+++ b/.gitea/workflows/lint-test-helm.yaml
@@ -58,7 +58,7 @@ jobs:

      - name: Set Up Helm
        if: steps.branch-exists.outputs.exists == 'true'
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
+        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5
        with:
          token: ${{ secrets.GITEA_TOKEN }}
          # renovate: datasource=github-releases depName=helm/helm
@@ -257,7 +257,7 @@ jobs:
          echo "----"

      - name: Set Up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
+        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5
        with:
          token: ${{ secrets.GITEA_TOKEN }}
          # renovate: datasource=github-releases depName=helm/helm
--- a/.gitea/workflows/render-manifests.yaml
+++ b/.gitea/workflows/render-manifests.yaml
@@ -43,7 +43,7 @@ jobs:
          path: infrastructure-manifests

      - name: Set Up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
+        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5
        with:
          token: ${{ secrets.GITEA_TOKEN }}
          version: v3.17.2 # Pending https://github.com/helm/helm/pull/30743
--- a/clusters/cl01tl/helm/audiobookshelf/values.yaml
+++ b/clusters/cl01tl/helm/audiobookshelf/values.yaml
@@ -4,6 +4,10 @@ audiobookshelf:
      type: deployment
      replicas: 1
      strategy: Recreate
+      pod:
+        securityContext:
+          fsGroup: 1000
+          fsGroupChangePolicy: OnRootMismatch
      containers:
        main:
          image:
--- a/clusters/cl01tl/helm/blocky/values.yaml
+++ b/clusters/cl01tl/helm/blocky/values.yaml
@@ -121,6 +121,7 @@ blocky:
              gatus                           IN      CNAME   traefik-cl01tl
              gitea                           IN      CNAME   traefik-cl01tl
              grafana                         IN      CNAME   traefik-cl01tl
+              grimmory                        IN      CNAME   traefik-cl01tl
              harbor                          IN      CNAME   traefik-cl01tl
              headlamp                        IN      CNAME   traefik-cl01tl
              home                            IN      CNAME   traefik-cl01tl
--- a/clusters/cl01tl/helm/gatus/values.yaml
+++ b/clusters/cl01tl/helm/gatus/values.yaml
@@ -167,6 +167,9 @@ gatus:
      - name: booklore
        url: https://booklore.alexlebens.net
        <<: *defaults
+      - name: grimmory
+        url: https://grimmory.alexlebens.net
+        <<: *defaults
      - name: directus
        url: https://directus.alexlebens.net
        <<: *defaults
--- a/clusters/cl01tl/helm/generic-device-plugin/Chart.lock
+++ b/clusters/cl01tl/helm/generic-device-plugin/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: generic-device-plugin
  repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-  version: 0.20.24
-digest: sha256:36bf651c24198d299458046aaf449e9fb50942e1143389092a746357d402b731
-generated: "2026-03-20T01:18:36.687250976Z"
+  version: 0.20.25
+digest: sha256:04f987ed54b51b4401ab056b4627cfce7d1fe660bb496a459e975f4dcc8ff466
+generated: "2026-03-24T00:12:00.102697457Z"
--- a/clusters/cl01tl/helm/generic-device-plugin/Chart.yaml
+++ b/clusters/cl01tl/helm/generic-device-plugin/Chart.yaml
@@ -15,6 +15,6 @@ maintainers:
 dependencies:
  - name: generic-device-plugin
    repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-    version: 0.20.24
+    version: 0.20.25
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: 1.0.0
--- a/clusters/cl01tl/helm/grimmory/Chart.lock
+++ b/clusters/cl01tl/helm/grimmory/Chart.lock
@@ -0,0 +1,12 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.6.2
+- name: mariadb-cluster
+  repository: https://helm.mariadb.com/mariadb-operator
+  version: 26.3.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.8.0
+digest: sha256:6ee403da03c1bcc0289a9abdef0508344072d51173da996eda69b8305d5feefa
+generated: "2026-03-23T20:35:19.743257-05:00"
--- a/clusters/cl01tl/helm/grimmory/Chart.yaml
+++ b/clusters/cl01tl/helm/grimmory/Chart.yaml
@@ -0,0 +1,31 @@
+apiVersion: v2
+name: grimmory
+version: 1.0.0
+description: Grimmory
+keywords:
+  - grimmory
+  - books
+home: https://docs.alexlebens.dev/applications/grimmory/
+sources:
+  - https://github.com/grimmory-tools/grimmory
+  - https://github.com/grimmory-tools/grimmory/pkgs/container/grimmory
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+  - https://github.com/mariadb-operator/mariadb-operator/tree/main/deploy/charts/mariadb-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: grimmory
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.6.2
+  - name: mariadb-cluster
+    version: 26.3.0
+    repository: https://helm.mariadb.com/mariadb-operator
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.8.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grimmory.png
+# renovate: datasource=github-releases depName=grimmory-tools/grimmory
+appVersion: v2.3.0
--- a/clusters/cl01tl/helm/grimmory/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/grimmory/templates/external-secret.yaml
@@ -0,0 +1,143 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: grimmory-database-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: grimmory-database-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: password
+      remoteRef:
+        key: /cl01tl/grimmory/database
+        property: password
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: grimmory-data-replication-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: grimmory-data-replication-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: psk.txt
+      remoteRef:
+        key: /cl01tl/grimmory/replication
+        property: psk.txt
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: grimmory-mariadb-cluster-backup-secret-external
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: grimmory-mariadb-cluster-backup-secret-external
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: access
+      remoteRef:
+        key: /digital-ocean/home-infra/mariadb-backups
+        property: access
+    - secretKey: secret
+      remoteRef:
+        key: /digital-ocean/home-infra/mariadb-backups
+        property: secret
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: grimmory-mariadb-cluster-backup-secret-garage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: grimmory-mariadb-cluster-backup-secret-garage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: access
+      remoteRef:
+        key: /garage/home-infra/mariadb-backups
+        property: access
+    - secretKey: secret
+      remoteRef:
+        key: /garage/home-infra/mariadb-backups
+        property: secret
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: booklore-config-backup-secret-local
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: booklore-config-backup-secret-local
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  target:
+    template:
+      engineVersion: v2
+      mergePolicy: Merge
+      data:
+        RESTIC_REPOSITORY: '{{ .BUCKET_ENDPOINT }}/booklore/booklore-config'
+  data:
+    - remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /volsync/restic/garage-local
+        metadataPolicy: None
+        property: BUCKET_ENDPOINT
+      secretKey: BUCKET_ENDPOINT
+    - remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /volsync/restic/garage-local
+        metadataPolicy: None
+        property: RESTIC_PASSWORD
+      secretKey: RESTIC_PASSWORD
+    - remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/volsync-backups
+        metadataPolicy: None
+        property: ACCESS_REGION
+      secretKey: AWS_DEFAULT_REGION
+    - remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/volsync-backups
+        metadataPolicy: None
+        property: ACCESS_KEY_ID
+      secretKey: AWS_ACCESS_KEY_ID
+    - remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/volsync-backups
+        metadataPolicy: None
+        property: ACCESS_SECRET_KEY
+      secretKey: AWS_SECRET_ACCESS_KEY
--- a/clusters/cl01tl/helm/grimmory/templates/namespace.yaml
+++ b/clusters/cl01tl/helm/grimmory/templates/namespace.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: grimmory
+  annotations:
+    volsync.backube/privileged-movers: "true"
+  labels:
+    app.kubernetes.io/name: grimmory
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: privileged
--- a/clusters/cl01tl/helm/grimmory/templates/persistent-volume-claim.yaml
+++ b/clusters/cl01tl/helm/grimmory/templates/persistent-volume-claim.yaml
@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: grimmory-books-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: grimmory-books-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  volumeName: grimmory-books-nfs-storage
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: grimmory-books-import-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: grimmory-books-import-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  volumeName: grimmory-books-import-nfs-storage
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
--- a/clusters/cl01tl/helm/grimmory/templates/persistent-volume.yaml
+++ b/clusters/cl01tl/helm/grimmory/templates/persistent-volume.yaml
@@ -0,0 +1,48 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: grimmory-books-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: grimmory-books-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: nfs-client
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    path: /volume2/Storage/Books
+    server: synologybond.alexlebens.net
+  mountOptions:
+    - vers=4
+    - minorversion=1
+    - noac
+
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: grimmory-books-import-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: grimmory-books-import-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: nfs-client
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    path: /volume2/Storage/Books Import
+    server: synologybond.alexlebens.net
+  mountOptions:
+    - vers=4
+    - minorversion=1
+    - noac
--- a/clusters/cl01tl/helm/grimmory/templates/replication-destination.yaml
+++ b/clusters/cl01tl/helm/grimmory/templates/replication-destination.yaml
@@ -0,0 +1,19 @@
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationDestination
+metadata:
+  name: grimmory-config-restore
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: grimmory-config-restore
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  trigger:
+    manual: restore-once
+  restic:
+    repository: booklore-config-backup-secret-local
+    destinationPVC: grimmory-config
+    copyMethod: Snapshot
+    moverSecurityContext:
+      runAsUser: 0
+      runAsGroup: 0
--- a/clusters/cl01tl/helm/grimmory/values.yaml
+++ b/clusters/cl01tl/helm/grimmory/values.yaml
@@ -0,0 +1,229 @@
+grimmory:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      pod:
+        securityContext:
+          fsGroup: 1000
+          fsGroupChangePolicy: OnRootMismatch
+      containers:
+        main:
+          image:
+            repository: ghcr.io/grimmory-tools/grimmory
+            tag: v2.3.0@sha256:9014247f591074529894f81115ca40f899db697e89f72c2fe91ec530e3f19597
+          env:
+            - name: TZ
+              value: America/Chicago
+            - name: USER_ID
+              value: 1000
+            - name: GROUP_ID
+              value: 1000
+            - name: DATABASE_URL
+              value: jdbc:mariadb://grimmory-mariadb-cluster-primary.grimmory:3306/booklore
+            - name: DATABASE_USERNAME
+              value: grimmory
+            - name: DATABASE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: grimmory-database-secret
+                  key: password
+            - name: GRIMMORY_PORT
+              value: 6060
+            - name: SWAGGER_ENABLED
+              value: false
+          resources:
+            requests:
+              cpu: 10m
+              memory: 1Gi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 6060
+          protocol: HTTP
+  route:
+    main:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - grimmory.alexlebens.net
+      rules:
+        - backendRefs:
+            - name: grimmory
+              port: 80
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+  persistence:
+    config:
+      forceRename: grimmory-config
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 5Gi
+      advancedMounts:
+        main:
+          main:
+            - path: /app/data
+              readOnly: false
+    books-import:
+      type: emptyDir
+      advancedMounts:
+        main:
+          main:
+            - path: /bookdrop
+              readOnly: false
+    data:
+      existingClaim: grimmory-books-nfs-storage
+      advancedMounts:
+        main:
+          main:
+            - path: /data
+              readOnly: false
+    ingest:
+      existingClaim: grimmory-books-import-nfs-storage
+      advancedMounts:
+        main:
+          main:
+            - path: /bookdrop/ingest
+              readOnly: false
+mariadb-cluster:
+  mariadb:
+    rootPasswordSecretKeyRef:
+      generate: false
+      name: grimmory-database-secret
+      key: password
+    storage:
+      size: 5Gi
+    replicas: 3
+    galera:
+      enabled: true
+    bootstrapFrom:
+      s3:
+        bucket: mariadb-backups-b230a2f5aecf080a4b372c08
+        prefix: cl01tl/grimmory
+        endpoint: nyc3.digitaloceanspaces.com
+        region: us-east-1
+        accessKeyIdSecretKeyRef:
+          name: grimmory-mariadb-cluster-backup-secret-external
+          key: access
+        secretAccessKeySecretKeyRef:
+          name: grimmory-mariadb-cluster-backup-secret-external
+          key: secret
+        tls:
+          enabled: true
+      backupContentType: Physical
+  databases:
+    - name: booklore
+      characterSet: utf8
+      collate: utf8_general_ci
+      cleanupPolicy: Delete
+      requeueInterval: 10h
+  users:
+    - name: grimmory
+      passwordSecretKeyRef:
+        name: grimmory-database-secret
+        key: password
+      host: '%'
+      cleanupPolicy: Delete
+      requeueInterval: 10h
+      retryInterval: 30s
+  grants:
+    - name: grimmory
+      privileges:
+        - "ALL PRIVILEGES"
+      database: "booklore"
+      table: "*"
+      username: grimmory
+      grantOption: true
+      host: '%'
+      cleanupPolicy: Delete
+      requeueInterval: 10h
+      retryInterval: 30s
+  physicalBackups:
+    - name: backup-external
+      schedule:
+        cron: "0 0 * * 0"
+        suspend: false
+        immediate: true
+      compression: gzip
+      maxRetention: 2160h
+      successfulJobsHistoryLimit: 1
+      storage:
+        s3:
+          bucket: mariadb-backups-b230a2f5aecf080a4b372c08
+          prefix: cl01tl/grimmory
+          endpoint: nyc3.digitaloceanspaces.com
+          region: us-east-1
+          accessKeyIdSecretKeyRef:
+            name: grimmory-mariadb-cluster-backup-secret-external
+            key: access
+          secretAccessKeySecretKeyRef:
+            name: grimmory-mariadb-cluster-backup-secret-external
+            key: secret
+          tls:
+            enabled: true
+    - name: backup-remote
+      schedule:
+        cron: "0 0 * * 0"
+        suspend: false
+        immediate: true
+      compression: gzip
+      maxRetention: 2160h
+      successfulJobsHistoryLimit: 1
+      storage:
+        s3:
+          bucket: mariadb-backups
+          prefix: cl01tl/grimmory
+          endpoint: garage-ps10rp.boreal-beaufort.ts.net:3900
+          region: us-east-1
+          accessKeyIdSecretKeyRef:
+            name: grimmory-mariadb-cluster-backup-secret-garage
+            key: access
+          secretAccessKeySecretKeyRef:
+            name: grimmory-mariadb-cluster-backup-secret-garage
+            key: secret
+          tls:
+            enabled: true
+    - name: backup-garage
+      schedule:
+        cron: "0 0 * * *"
+        suspend: false
+        immediate: true
+      compression: gzip
+      maxRetention: 360h
+      successfulJobsHistoryLimit: 1
+      storage:
+        s3:
+          bucket: mariadb-backups
+          prefix: cl01tl/grimmory
+          endpoint: garage-main.garage:3900
+          region: us-east-1
+          accessKeyIdSecretKeyRef:
+            name: grimmory-mariadb-cluster-backup-secret-garage
+            key: access
+          secretAccessKeySecretKeyRef:
+            name: grimmory-mariadb-cluster-backup-secret-garage
+            key: secret
+volsync-target-config:
+  pvcTarget: grimmory-config
+  moverSecurityContext:
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
+  local:
+    enabled: true
+    schedule: 12 8 * * *
+  remote:
+    enabled: true
+    schedule: 12 9 * * *
+  external:
+    enabled: true
+    schedule: 12 10 * * *
--- a/clusters/cl01tl/helm/headlamp/Chart.yaml
+++ b/clusters/cl01tl/helm/headlamp/Chart.yaml
@@ -18,4 +18,4 @@ dependencies:
    repository: https://kubernetes-sigs.github.io/headlamp/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/headlamp.png
 # renovate: datasource=github-releases depName=headlamp-k8s/headlamp
-appVersion: v0.40.1
+appVersion: v0.41.0
--- a/clusters/cl01tl/helm/homepage/values.yaml
+++ b/clusters/cl01tl/helm/homepage/values.yaml
@@ -211,8 +211,8 @@ homepage:
              - Books:
                  icon: sh-booklore.webp
                  description: Grimmory
-                  href: https://booklore.alexlebens.net
-                  siteMonitor: http://booklore.booklore:80
+                  href: https://grimmory.alexlebens.net
+                  siteMonitor: http://grimmory.grimmory:80
                  statusStyle: dot
          - Public:
              - Site:
--- a/clusters/cl01tl/helm/movie-roulette/Chart.yaml
+++ b/clusters/cl01tl/helm/movie-roulette/Chart.yaml
@@ -19,4 +19,4 @@ dependencies:
    version: 4.6.2
 icon: https://raw.githubusercontent.com/sahara101/Movie-Roulette/refs/heads/main/static/icons/icon.png
 # renovate: datasource=github-releases depName=sahara101/Movie-Roulette
-appVersion: v5.2.1
+appVersion: v5.3.0
--- a/clusters/cl01tl/helm/movie-roulette/values.yaml
+++ b/clusters/cl01tl/helm/movie-roulette/values.yaml
@@ -9,7 +9,7 @@ movie-roulette:
        main:
          image:
            repository: ghcr.io/sahara101/movie-roulette
-            tag: v5.2.1
+            tag: v5.3.0
            pullPolicy: IfNotPresent
          env:
            - name: FLASK_SECRET_KEY
--- a/clusters/cl01tl/helm/music-grabber/values.yaml
+++ b/clusters/cl01tl/helm/music-grabber/values.yaml
@@ -9,7 +9,7 @@ music-grabber:
        main:
          image:
            repository: g33kphr33k/musicgrabber
-            tag: 2.5.0
+            tag: 2.5.1
            pullPolicy: IfNotPresent
          env:
            - name: MUSIC_DIR
--- a/clusters/cl01tl/helm/tdarr/values.yaml
+++ b/clusters/cl01tl/helm/tdarr/values.yaml
@@ -48,7 +48,7 @@ tdarr:
        main:
          image:
            repository: ghcr.io/haveagitgat/tdarr_node
-            tag: 2.64.02
+            tag: 2.65.01
            pullPolicy: IfNotPresent
          env:
            - name: TZ
--- a/clusters/cl01tl/helm/unpoller/Chart.yaml
+++ b/clusters/cl01tl/helm/unpoller/Chart.yaml
@@ -21,4 +21,4 @@ dependencies:
    version: 4.6.2
 icon: https://camo.githubusercontent.com/c5d07a5b3acfeac8e1c25bf56f440ffe032b86e4e7f15de82357f022a43fc927/68747470733a2f2f756e706f6c6c65722e636f6d2f696d672f6c6f676f2e706e67
 # renovate: datasource=github-releases depName=unpoller/unpoller
-appVersion: v2.35.0
+appVersion: v2.37.0
--- a/clusters/cl01tl/helm/unpoller/values.yaml
+++ b/clusters/cl01tl/helm/unpoller/values.yaml
@@ -9,7 +9,7 @@ unpoller:
        main:
          image:
            repository: ghcr.io/unpoller/unpoller
-            tag: v2.35.0
+            tag: v2.37.0
            pullPolicy: IfNotPresent
          env:
            - name: UP_UNIFI_CONTROLLER_0_SAVE_ALARMS
--- a/clusters/cl01tl/helm/whodb/Chart.yaml
+++ b/clusters/cl01tl/helm/whodb/Chart.yaml
@@ -20,4 +20,4 @@ dependencies:
    version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/whodb.png
 # renovate: datasource=github-releases depName=clidey/whodb
-appVersion: 0.100.0
+appVersion: 0.101.0
--- a/clusters/cl01tl/helm/whodb/values.yaml
+++ b/clusters/cl01tl/helm/whodb/values.yaml
@@ -8,7 +8,7 @@ whodb:
        main:
          image:
            repository: clidey/whodb
-            tag: 0.100.0
+            tag: 0.101.0
            pullPolicy: IfNotPresent
          env:
            - name: WHODB_OLLAMA_HOST
--- a/hosts/ps08rp/blocky/config.yml
+++ b/hosts/ps08rp/blocky/config.yml
@@ -98,6 +98,7 @@ customDNS:
    gatus                           IN      CNAME   traefik-cl01tl
    gitea                           IN      CNAME   traefik-cl01tl
    grafana                         IN      CNAME   traefik-cl01tl
+    grimmory                        IN      CNAME   traefik-cl01tl
    harbor                          IN      CNAME   traefik-cl01tl
    headlamp                        IN      CNAME   traefik-cl01tl
    home                            IN      CNAME   traefik-cl01tl
--- a/hosts/ps09rp/blocky/config.yml
+++ b/hosts/ps09rp/blocky/config.yml
@@ -119,6 +119,7 @@ customDNS:
    gatus                           IN      CNAME   traefik-cl01tl
    gitea                           IN      CNAME   traefik-cl01tl
    grafana                         IN      CNAME   traefik-cl01tl
+    grimmory                        IN      CNAME   traefik-cl01tl
    harbor                          IN      CNAME   traefik-cl01tl
    headlamp                        IN      CNAME   traefik-cl01tl
    home                            IN      CNAME   traefik-cl01tl