Merge pull request 'chore(deps): update ghcr.io/renovatebot/renovate docker tag to v43.149.0' (#6343) from renovate/unified-renovate into main

Reviewed-on: #6339

.gitea/workflows/renovate.yaml

@@ -13,7 +13,7 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-js
-    container: ghcr.io/renovatebot/renovate:43.144.0@sha256:d6c68d8226a0b4f1fc00942f1c14b33d5135c6c52e8c9d29a2588b46f199c14f
+    container: ghcr.io/renovatebot/renovate:43.149.0@sha256:f37c5dd805cfbf83531ef3eaf1456ab5bce22edf6081df2b9ab258953d72788a
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

clusters/cl01tl/helm/argocd/templates/prometheus-rule.yaml

@@ -82,14 +82,6 @@ spec:
           annotations:
             summary: HAProxy pending requests (instance {{ `{{ $labels.instance }}` }})
             description: "Some HAProxy requests are pending on {{ `{{ $labels.proxy }}` }} - {{ `{{ $value | printf \"%.2f\"}}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyHTTPSlowingDown
-          expr: avg by (instance, proxy) (haproxy_backend_max_total_time_seconds) > 1
-          for: 1m
-          labels:
-            severity: warning
-          annotations:
-            summary: HAProxy HTTP slowing down (instance {{ `{{ $labels.instance }}` }})
-            description: "HAProxy backend max total time is above 1s on {{ `{{ $labels.proxy }}` }} - {{ `{{ $value | printf \"%.2f\"}}` }}s\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
         - alert: HAProxyRetryHigh
           expr: sum by (proxy) (rate(haproxy_backend_retry_warnings_total[1m])) > 10
           for: 2m
@@ -98,14 +90,6 @@ spec:
           annotations:
             summary: HAProxy retry high (instance {{ `{{ $labels.instance }}` }})
             description: "High rate of retry on {{ `{{ $labels.proxy }}` }} - {{ `{{ $value | printf \"%.2f\"}}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAproxyHasNoAliveBackends
-          expr: haproxy_backend_active_servers + haproxy_backend_backup_servers == 0
-          for: 0m
-          labels:
-            severity: critical
-          annotations:
-            summary: HAproxy has no alive backends (instance {{ `{{ $labels.instance }}` }})
-            description: "HAProxy has no alive active or backup backends for {{ `{{ $labels.proxy }}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
         - alert: HAProxyFrontendSecurityBlockedRequests
           expr: sum by (proxy) (rate(haproxy_frontend_denied_connections_total[2m])) > 10
           for: 2m

clusters/cl01tl/helm/argocd/values.yaml

@@ -103,7 +103,7 @@ argo-cd:
       enabled: true
       image:
         repository: haproxy
-        tag: 3.3.6-alpine@sha256:4f97a2cb7f02fd08402259e74a65ef12fcfa3dff1ef78fddecb5228a17b7f4ad
+        tag: 3.3.7-alpine@sha256:2afa53c856e4e9fcc7dfb35b807fcb189896d7e62b38d363f9bedea92bce7f9a
       resources:
         requests:
           cpu: 5m

clusters/cl01tl/helm/audiobookshelf/Chart.yaml

@@ -32,4 +32,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/audiobookshelf.png
 # renovate: datasource=github-releases depName=advplyr/audiobookshelf
-appVersion: 2.33.2
+appVersion: 2.34.0

clusters/cl01tl/helm/audiobookshelf/values.yaml

@@ -12,7 +12,7 @@ audiobookshelf:
         main:
           image:
             repository: ghcr.io/advplyr/audiobookshelf
-            tag: 2.33.2@sha256:a44ed89b3e845faa1f7d353f2cc89b2fcd8011737dd14075fa963cf9468da3a5
+            tag: 2.34.0@sha256:4143292c530f6ac6700afd13360c04f477e4f1a81c1c97c4224b1c7e4330c5c4
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/cloudnative-pg/values.yaml

@@ -18,7 +18,7 @@ rclone-postgres-backups-remote:
   nameOverride: postgres-backups-remote-rclone
   cronJob:
     suspend: false
-    schedule: 0 1 * * *
+    schedule: 0 6 * * 6
   rclone:
     source:
       bucketName: postgres-backups
@@ -45,7 +45,7 @@ rclone-postgres-backups-external:
   nameOverride: postgres-backups-external-rclone
   cronJob:
     suspend: true
-    schedule: 20 1 * * *
+    schedule: 0 6 * * 6
   rclone:
     source:
       bucketName: openbao-backups

clusters/cl01tl/helm/dawarich/Chart.yaml

@@ -42,4 +42,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/dawarich.png
 # renovate: datasource=github-releases depName=Freika/dawarich
-appVersion: 1.6.1
+appVersion: 1.7.0

clusters/cl01tl/helm/dawarich/templates/external-secret.yaml

@@ -15,6 +15,18 @@ spec:
       remoteRef:
         key: /cl01tl/dawarich/key
         property: key
+    - secretKey: otp-primary-key
+      remoteRef:
+        key: /cl01tl/dawarich/key
+        property: otp-primary-key
+    - secretKey: otp-deterministic-key
+      remoteRef:
+        key: /cl01tl/dawarich/key
+        property: otp-deterministic-key
+    - secretKey: otp-derivation-salt
+      remoteRef:
+        key: /cl01tl/dawarich/key
+        property: otp-derivation-salt
 
 ---
 apiVersion: external-secrets.io/v1

clusters/cl01tl/helm/dawarich/values.yaml

@@ -8,7 +8,7 @@ dawarich:
         main:
           image:
             repository: freikin/dawarich
-            tag: 1.6.1@sha256:a884f69f19ce0f66992f3872d24544d1e587e133b8a003e072711aafc1e02429
+            tag: 1.7.0@sha256:7d5f99c61121fcfa4cbdd6a153392630d9f059ffb0156759278d3e049085ec62
           command:
             - "web-entrypoint.sh"
           args:
@@ -83,6 +83,21 @@ dawarich:
                 secretKeyRef:
                   name: dawarich-key
                   key: key
+            - name: OTP_ENCRYPTION_PRIMARY_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: dawarich-key
+                  key: otp-primary-key
+            - name: OTP_ENCRYPTION_DETERMINISTIC_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: dawarich-key
+                  key: otp-deterministic-key
+            - name: OTP_ENCRYPTION_KEY_DERIVATION_SALT
+              valueFrom:
+                secretKeyRef:
+                  name: dawarich-key
+                  key: otp-derivation-salt
             - name: RAILS_LOG_TO_STDOUT
               value: true
             - name: SELF_HOSTED
@@ -111,7 +126,7 @@ dawarich:
         sidekiq:
           image:
             repository: freikin/dawarich
-            tag: 1.6.1@sha256:a884f69f19ce0f66992f3872d24544d1e587e133b8a003e072711aafc1e02429
+            tag: 1.7.0@sha256:7d5f99c61121fcfa4cbdd6a153392630d9f059ffb0156759278d3e049085ec62
           command:
             - "sidekiq-entrypoint.sh"
           args:
@@ -161,12 +176,12 @@ dawarich:
             - name: OIDC_CLIENT_ID
               valueFrom:
                 secretKeyRef:
-                  name: dawarich-oidc-secret
+                  name: dawarich-oidc-authentik
                   key: client
             - name: OIDC_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: dawarich-oidc-secret
+                  name: dawarich-oidc-authentik
                   key: secret
             - name: OIDC_PROVIDER_NAME
               value: Authentik
@@ -181,8 +196,23 @@ dawarich:
             - name: SECRET_KEY_BASE
               valueFrom:
                 secretKeyRef:
-                  name: dawarich-key-secret
+                  name: dawarich-key
                   key: key
+            - name: OTP_ENCRYPTION_PRIMARY_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: dawarich-key
+                  key: otp-primary-key
+            - name: OTP_ENCRYPTION_DETERMINISTIC_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: dawarich-key
+                  key: otp-deterministic-key
+            - name: OTP_ENCRYPTION_KEY_DERIVATION_SALT
+              valueFrom:
+                secretKeyRef:
+                  name: dawarich-key
+                  key: otp-derivation-salt
             - name: RAILS_LOG_TO_STDOUT
               value: true
             - name: SELF_HOSTED

clusters/cl01tl/helm/democratic-csi-synology-iscsi/values.yaml

@@ -47,6 +47,8 @@ democratic-csi:
         fsType: ext4
   node:
     hostPID: true
+    rbac:
+      enabled: true
     driver:
       extraEnv:
         - name: ISCSIADM_HOST_STRATEGY

clusters/cl01tl/helm/kube-prometheus-stack/values.yaml

@@ -98,8 +98,8 @@ kube-prometheus-stack:
             namespace: traefik
     prometheusSpec:
       scrapeInterval: 30s
-      retention: 45d
+      retention: 60d
-      retentionSize: 240GiB
+      retentionSize: 450GiB
       externalUrl: https://prometheus.alexlebens.net
       ruleSelectorNilUsesHelmValues: false
       serviceMonitorSelectorNilUsesHelmValues: false
@@ -112,7 +112,7 @@ kube-prometheus-stack:
             accessModes: ["ReadWriteOnce"]
             resources:
               requests:
-                storage: 250Gi
+                storage: 500Gi
 ntfy-alertmanager:
   global:
     fullnameOverride: ntfy-alertmanager

clusters/cl01tl/helm/paperless-ngx/Chart.yaml

@@ -48,4 +48,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/paperless-ngx.png
 # renovate: datasource=github-releases depName=paperless-ngx/paperless-ngx
-appVersion: 2.20.14
+appVersion: 2.20.15

clusters/cl01tl/helm/paperless-ngx/values.yaml

@@ -8,7 +8,7 @@ paperless-ngx:
         main:
           image:
             repository: ghcr.io/paperless-ngx/paperless-ngx
-            tag: 2.20.14@sha256:b89f83345532cfba72690185257eb6c4f92fc2a782332a42abe19c07b7a6595f
+            tag: 2.20.15@sha256:6c86cad803970ea782683a8e80e7403444c5bf3cf70de63b4d3c8e87500db92f
           env:
             - name: PAPERLESS_REDIS
               value: redis://paperless-ngx-valkey.paperless-ngx:6379

clusters/cl01tl/helm/plex/Chart.yaml

@@ -20,4 +20,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/plex.png
 # renovate: datasource=github-releases depName=linuxserver/docker-plex
-appVersion: 1.43.1.10611-1e34174b1-ls302
+appVersion: 1.43.1.10611-1e34174b1-ls303

clusters/cl01tl/helm/plex/values.yaml

@@ -22,7 +22,7 @@ plex:
         main:
           image:
             repository: ghcr.io/linuxserver/plex
-            tag: 1.43.1.10611-1e34174b1-ls302@sha256:e5c7c283b242966416a4bed2d666acf6f3fb8f957c704be8333f8dc987364825
+            tag: 1.43.1.10611-1e34174b1-ls303@sha256:b785bdd60e781662f16e0526a6b54c07856739df95ab558a674a3c084dbde423
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/secrets-store-csi-driver/values.yaml

@@ -3,12 +3,12 @@ secrets-store-csi-driver:
     enabled: true
     image:
       repository: registry.k8s.io/csi-secrets-store/driver
-      tag: v1.5.6@sha256:6df2b3b3817136d2ade3d53306dbbd98385c1c01e8b3c373192c0e5b8d183f7b
+      tag: v1.6.0@sha256:110344819630bfd41e0c6d3f215d325ad1a4d5d5b1d298f8af7d0edf4df64a4e
     crds:
       enabled: true
       image:
         repository: registry.k8s.io/csi-secrets-store/driver-crds
-        tag: v1.5.6@sha256:d40d9212beb62ee0f9f09b75d024ed807816879f38e75eca309497c3df89568c
+        tag: v1.6.0@sha256:2419b318a1c17bd741686bf1994cd37cee7162039c019435b8f534f2846fe488
     driver:
       resources:
         limits:

clusters/cl01tl/helm/site-documentation/values.yaml

@@ -10,7 +10,7 @@ site-documentation:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-documentation
-            tag: 0.27.1@sha256:a9e8659827375e7ee65ea8bc8550f4c0604316b48f39da7fa255fa9f3b5a17d6
+            tag: 0.28.0@sha256:dabb2c9a8c306a01ccf1d85e797f6a5cc81d8d3b5db8d28ab1b5969f1b56cf74
           resources:
             requests:
               cpu: 10m

clusters/cl01tl/helm/site-profile/values.yaml

@@ -10,7 +10,7 @@ site-profile:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-profile
-            tag: 3.18.7@sha256:d2e31d00b58aa8e843eeaa5ba75d1bb73dd9d1587185b82e5451a585285de6a0
+            tag: 3.19.1@sha256:bf8f7f065867c605fe42955f12aaec68c5d1e667a3325bb30ad6d028b523bcd5
           resources:
             requests:
               cpu: 10m

clusters/cl01tl/helm/stalwart/values.yaml

@@ -25,10 +25,11 @@ stalwart:
             tag: v1.10.0@sha256:a6a4d4403f670faf6a94b8c7f9adbca3ead91f26dd64e5ccf95fa69025dc6e58
           args:
             - '--es.uri=https://elasticsearch-stalwart-es-http.tubearchivist:9200'
+            - '--es.ssl-skip-verify'
           resources:
             requests:
               cpu: 1m
-              memory: 10mi
+              memory: 10Mi
   service:
     main:
       controller: main

clusters/cl01tl/helm/tubearchivist/values.yaml

@@ -1,7 +1,7 @@
 tubearchivist:
   controllers:
     main:
-      forceRename: stalwart
+      forceRename: tubearchivist
       type: deployment
       replicas: 1
       strategy: Recreate
@@ -108,10 +108,11 @@ tubearchivist:
             tag: v1.10.0@sha256:a6a4d4403f670faf6a94b8c7f9adbca3ead91f26dd64e5ccf95fa69025dc6e58
           args:
             - '--es.uri=https://elasticsearch-tubearchivist-es-http.tubearchivist:9200'
+            - '--es.ssl-skip-verify'
           resources:
             requests:
               cpu: 1m
-              memory: 10mi
+              memory: 10Mi
   service:
     main:
       controller: main