remove gluetun

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/autobrr/qui](https://github.com/autobrr/qui) | minor | `v1.11.0` → `v1.12.0` |

---

### Release Notes

<details>
<summary>autobrr/qui (ghcr.io/autobrr/qui)</summary>

### [`v1.12.0`](https://github.com/autobrr/qui/releases/tag/v1.12.0)

[Compare Source](https://github.com/autobrr/qui/compare/v1.11.0...v1.12.0)

#### Changelog

##### New Features

- [`202e950`](202e950ae1): feat(automations): Add `free_space` condition ([#&#8203;1061](https://github.com/autobrr/qui/issues/1061)) ([@&#8203;Barcode-eng](https://github.com/Barcode-eng))
- [`3b106d6`](3b106d698d): feat(automations): make conditions optional for non-delete rules and add drag reorder ([#&#8203;939](https://github.com/autobrr/qui/issues/939)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`0684d75`](0684d75e9c): feat(config): Add QUI\_\_OIDC\_CLIENT\_SECRET\_FILE env var ([#&#8203;841](https://github.com/autobrr/qui/issues/841)) ([@&#8203;PedDavid](https://github.com/PedDavid))
- [`dac0173`](dac01738bc): feat(config): allow disabling tracker icon fetching ([#&#8203;823](https://github.com/autobrr/qui/issues/823)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`dc10bad`](dc10badb00): feat(crossseed): add cancel run and opt-in errored torrent recovery ([#&#8203;918](https://github.com/autobrr/qui/issues/918)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`cd1fcc9`](cd1fcc962e): feat(crossseed): add custom category option for cross-seeds ([#&#8203;907](https://github.com/autobrr/qui/issues/907)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`d189fe9`](d189fe92c4): feat(crossseed): add indexerName to webhook apply + fix category mode defaults ([#&#8203;916](https://github.com/autobrr/qui/issues/916)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`03a147e`](03a147e76f): feat(crossseed): add option to skip recheck-required matches ([#&#8203;825](https://github.com/autobrr/qui/issues/825)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`edae00a`](edae00a247): feat(crossseed): add optional hardlink mode for cross-seeding ([#&#8203;849](https://github.com/autobrr/qui/issues/849)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`0938436`](093843661d): feat(crossseed): add source aliasing for WEB/WEB-DL/WEBRip precheck matching ([#&#8203;874](https://github.com/autobrr/qui/issues/874)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`65f6129`](65f6129a1a): feat(crossseed): show failure reasons, prune runs, and add cache cleanup ([#&#8203;923](https://github.com/autobrr/qui/issues/923)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`e10fba8`](e10fba85bf): feat(details): torrent details panel improvements ([#&#8203;884](https://github.com/autobrr/qui/issues/884)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`6921140`](6921140e12): feat(docs): add Docusaurus documentation site ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`6a5a66c`](6a5a66ceea): feat(docs): add Icon and webUI variables to the Unraid install guide ([#&#8203;942](https://github.com/autobrr/qui/issues/942)) ([@&#8203;BaukeZwart](https://github.com/BaukeZwart))
- [`281fce7`](281fce7a25): feat(docs): add local search plugin ([#&#8203;1076](https://github.com/autobrr/qui/issues/1076)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`566de08`](566de08b30): feat(docs): add qui logo, update readme, remove v4 flag ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`b83ac5a`](b83ac5a178): feat(docs): apply minimal.css theme to Docusaurus ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`fe6a6df`](fe6a6dfa9f): feat(docs): improve documentation pages and add support page ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`62a7ad5`](62a7ad5e11): feat(docs): use qui favicon ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`5d124c0`](5d124c0771): feat(orphan): add auto cleanup mode ([#&#8203;897](https://github.com/autobrr/qui/issues/897)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`3172ad9`](3172ad9ca3): feat(settings): add log settings + live log stream ([#&#8203;876](https://github.com/autobrr/qui/issues/876)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`3c1b34b`](3c1b34b9dd): feat(torrents): add "torrent introuvable" to unregistered status ([#&#8203;836](https://github.com/autobrr/qui/issues/836)) ([@&#8203;kephasdev](https://github.com/kephasdev))
- [`afe4d39`](afe4d3932f): feat(torrents): add tracker URL editing for single torrents ([#&#8203;848](https://github.com/autobrr/qui/issues/848)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`76dedd7`](76dedd7aae): feat(torrents): update GeneralTabHorizontal to display limits and improve layout ([#&#8203;1078](https://github.com/autobrr/qui/issues/1078)) ([@&#8203;martylukyy](https://github.com/martylukyy))
- [`6831c24`](6831c249db): feat(ui): unify payment options into single dialog ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`4dcdf7f`](4dcdf7ff63): feat(web): add local file access indicator to instance cards ([#&#8203;911](https://github.com/autobrr/qui/issues/911)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`a560e5e`](a560e5e6cd): feat(web): compact torrent details panel ([#&#8203;833](https://github.com/autobrr/qui/issues/833)) ([@&#8203;martylukyy](https://github.com/martylukyy))
- [`557e7bd`](557e7bd072): feat: add issue/discussion template ([#&#8203;945](https://github.com/autobrr/qui/issues/945)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`8b93719`](8b93719a2c): feat: add workflow automation system with category actions, orphan scanner, and hardlink detection ([#&#8203;818](https://github.com/autobrr/qui/issues/818)) ([@&#8203;s0up4200](https://github.com/s0up4200))

##### Bug Fixes

- [`b85ad6b`](b85ad6b8d7): fix(automations): allow delete rules to match incomplete torrents ([#&#8203;926](https://github.com/autobrr/qui/issues/926)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`ae06200`](ae06200e60): fix(automations): make tags field condition operators tag-aware ([#&#8203;908](https://github.com/autobrr/qui/issues/908)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`ace0101`](ace01014e1): fix(crossseed): detect folder mismatch for bare file to folder cross-seeds ([#&#8203;846](https://github.com/autobrr/qui/issues/846)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`1cc1243`](1cc1243958): fix(crossseed): enforce resolution and language matching with sensible defaults ([#&#8203;855](https://github.com/autobrr/qui/issues/855)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`cefb9cd`](cefb9cd20b): fix(crossseed): execute external program reliably after injection ([#&#8203;1083](https://github.com/autobrr/qui/issues/1083)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`867e2da`](867e2da8c4): fix(crossseed): improve matching with size validation and relaxed audio checks ([#&#8203;845](https://github.com/autobrr/qui/issues/845)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`4b5079b`](4b5079b266): fix(crossseed): persist custom category settings in PATCH handler ([#&#8203;913](https://github.com/autobrr/qui/issues/913)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`cfbbc1f`](cfbbc1fd49): fix(crossseed): prevent season packs matching episodes ([#&#8203;854](https://github.com/autobrr/qui/issues/854)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`c7c1706`](c7c1706b70): fix(crossseed): reconcile interrupted runs on startup ([#&#8203;1084](https://github.com/autobrr/qui/issues/1084)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`7d633bd`](7d633bdf50): fix(crossseed): use ContentPath for manually-managed single-file torrents ([#&#8203;832](https://github.com/autobrr/qui/issues/832)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`d5db761`](d5db761a03): fix(database): include arr\_instances in string pool cleanup + remove auto-recovery ([#&#8203;898](https://github.com/autobrr/qui/issues/898)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`c73ec6f`](c73ec6f4e5): fix(database): prevent race between stmt cache access and db close ([#&#8203;840](https://github.com/autobrr/qui/issues/840)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`a40b872`](a40b872bbd): fix(db): drop legacy hardlink columns from cross\_seed\_settings ([#&#8203;912](https://github.com/autobrr/qui/issues/912)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`e400af3`](e400af3d7b): fix(db): recover wedged SQLite writer + stop cross-seed tight loop ([#&#8203;890](https://github.com/autobrr/qui/issues/890)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`90e15b4`](90e15b4aae): fix(deps): update rls to recognize IP as iPlayer ([#&#8203;922](https://github.com/autobrr/qui/issues/922)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`8e81b9f`](8e81b9f396): fix(proxy): honor TLSSkipVerify for proxied requests ([#&#8203;1051](https://github.com/autobrr/qui/issues/1051)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`eb2bee0`](eb2bee0ce3): fix(security): redact sensitive URL parameters in logs ([#&#8203;853](https://github.com/autobrr/qui/issues/853)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`40982bc`](40982bc2e1): fix(themes): prevent reset on license errors, improve switch performance ([#&#8203;844](https://github.com/autobrr/qui/issues/844)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`a8a32f7`](a8a32f7fbe): fix(ui): incomplete torrents aren't "Completed: 1969-12-31" ([#&#8203;851](https://github.com/autobrr/qui/issues/851)) ([@&#8203;finevan](https://github.com/finevan))
- [`5908bba`](5908bba2c2): fix(ui): preserve category collapse state when toggling incognito mode ([#&#8203;834](https://github.com/autobrr/qui/issues/834)) ([@&#8203;jabloink](https://github.com/jabloink))
- [`25c847e`](25c847ecf1): fix(ui): torrents with no creation metadata don't display 1969 ([#&#8203;873](https://github.com/autobrr/qui/issues/873)) ([@&#8203;finevan](https://github.com/finevan))
- [`6403b6a`](6403b6a126): fix(web): column filter status now matches all states in category ([#&#8203;880](https://github.com/autobrr/qui/issues/880)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`eafc4e7`](eafc4e72ef): fix(web): make delete cross-seed check rely on content\_path matches ([#&#8203;1080](https://github.com/autobrr/qui/issues/1080)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`d57c749`](d57c7490ce): fix(web): only show selection checkbox on normal view ([#&#8203;830](https://github.com/autobrr/qui/issues/830)) ([@&#8203;jabloink](https://github.com/jabloink))
- [`60338f6`](60338f60e9): fix(web): optimize TorrentDetailsPanel for mobile view and make tabs scrollable horizontally ([#&#8203;1066](https://github.com/autobrr/qui/issues/1066)) ([@&#8203;martylukyy](https://github.com/martylukyy))
- [`aedab87`](aedab87318): fix(web): speed limit input reformatting during typing ([#&#8203;881](https://github.com/autobrr/qui/issues/881)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`df7f3e0`](df7f3e04c4): fix(web): truncate file progress percentage instead of rounding ([#&#8203;919](https://github.com/autobrr/qui/issues/919)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`2fadd01`](2fadd01a9a): fix(web): update eslint config for flat config compatibility ([#&#8203;879](https://github.com/autobrr/qui/issues/879)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`721cedd`](721cedd3e6): fix(web): use fixed heights for mobile torrent cards ([#&#8203;812](https://github.com/autobrr/qui/issues/812)) ([@&#8203;jabloink](https://github.com/jabloink))
- [`a7db605`](a7db605edb): fix: remove pnpm-workspace.yaml breaking CI ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`c0ddc0a`](c0ddc0a931): fix: use prefix matching for allowed bash commands ([@&#8203;s0up4200](https://github.com/s0up4200))

##### Other Changes

- [`fff52ce`](fff52cea2f): chore(ci): disable reviewer ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`7ef2a38`](7ef2a38b29): chore(ci): fix automated triage and deduplication workflows ([#&#8203;1057](https://github.com/autobrr/qui/issues/1057)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`d84910b`](d84910b1eb): chore(docs): move Tailwind to documentation workspace only ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`37ebe05`](37ebe05784): chore(docs): move netlify.toml to documentation directory ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`e25de38`](e25de3830a): chore(docs): remove disclaimer ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`c59b809`](c59b8098e6): chore(docs): update support sections ([#&#8203;1063](https://github.com/autobrr/qui/issues/1063)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`b723523`](b7235233de): chore(tests): remove dead tests and optimize slow test cases ([#&#8203;842](https://github.com/autobrr/qui/issues/842)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`662a1c6`](662a1c66f0): chore(workflows): update runners from 4vcpu to 2vcpu for all jobs ([#&#8203;859](https://github.com/autobrr/qui/issues/859)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`46f2a1c`](46f2a1ccf5): chore: clean up repo root by moving Docker, scripts, and community docs ([#&#8203;1054](https://github.com/autobrr/qui/issues/1054)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`2f27c0d`](2f27c0d7c5): chore: remove old issue templates ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`04f361a`](04f361ad00): ci(triage): add labeling for feature-requests-ideas discussions ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`f249c69`](f249c692da): ci(triage): remove needs-triage label after applying labels ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`bdda1de`](bdda1debb6): ci(workflows): add self-dispatch workaround for discussion events ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`a9732a2`](a9732a2d13): ci(workflows): increase max-turns to 25 for Claude workflows ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`d7d830d`](d7d830d1f3): docs(README): add Buy Me a Coffee link ([#&#8203;863](https://github.com/autobrr/qui/issues/863)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`266d92e`](266d92e451): docs(readme): Clarify ignore pattern ([#&#8203;878](https://github.com/autobrr/qui/issues/878)) ([@&#8203;quorn23](https://github.com/quorn23))
- [`9586084`](95860849e1): docs(readme): add banner linking to stable docs ([#&#8203;925](https://github.com/autobrr/qui/issues/925)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`e36a621`](e36a62120d): docs(readme): use markdown link for Polar URL ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`9394676`](9394676fdc): docs: add frontmatter titles and descriptions, remove marketing language ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`ba9d45e`](ba9d45ee26): docs: add local filesystem access snippet and swizzle Details component ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`4329edd`](4329edd6a0): docs: disclaimer about unreleased features ([#&#8203;943](https://github.com/autobrr/qui/issues/943)) ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`735d065`](735d065890): docs: improve external programs, orphan scan, reverse proxy, tracker icons documentation ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`78faef2`](78faef2c28): docs: remove premature tip and fix stat command ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`eaad3bf`](eaad3bfb68): docs: update social card image in Docusaurus configuration ([@&#8203;s0up4200](https://github.com/s0up4200))
- [`02a68e5`](02a68e5f36): refactor(crossseed): hardcode ignore patterns for file matching ([#&#8203;915](https://github.com/autobrr/qui/issues/915)) ([@&#8203;s0up4200](https://github.com/s0up4200))

**Full Changelog**: <https://github.com/autobrr/qui/compare/v1.11.0...v1.12.0>

#### Docker images

- `docker pull ghcr.io/autobrr/qui:v1.12.0`
- `docker pull ghcr.io/autobrr/qui:latest`

#### What to do next?

- Join our [Discord server](https://discord.autobrr.com/qui)

Thank you for using qui!

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi42OS4yIiwidXBkYXRlZEluVmVyIjoiNDIuNjkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW1hZ2UiXX0=-->

Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/3060
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

.gitea/workflows/render-manifests-dispatch.yaml

@@ -1,6 +1,9 @@
 name: render-manifests-dispatch
 
 on:
+  schedule:
+    - cron: '0 3 * * *'
+
   workflow_dispatch:
 
 env:

clusters/cl01tl/helm/actual/values.yaml

@@ -9,7 +9,7 @@ actual:
         main:
           image:
             repository: ghcr.io/actualbudget/actual
-            tag: 25.12.0
+            tag: 26.1.0
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -78,7 +78,7 @@ actual:
 volsync-target-data:
   pvcTarget: actual-data
   local:
-    enabled: false
+    enabled: true
     schedule: 0 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/argocd/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 9.2.3
-digest: sha256:b23d6a5b7b9fee9d1807259bfa2dd53d1f4dfbbeba7ec747c41a6ba991dadbba
-generated: "2025-12-28T21:53:37.447568505Z"
+  version: 9.2.4
+digest: sha256:ad9fc8f132ba717e9da4564ca1c90eab88c1d1ec251d015542b938f2bd5af7bd
+generated: "2026-01-03T23:01:53.96861459Z"

clusters/cl01tl/helm/argocd/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 9.2.3
+    version: 9.2.4
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: github=argoproj/argo-cd

clusters/cl01tl/helm/audiobookshelf/values.yaml

@@ -124,7 +124,7 @@ audiobookshelf:
 volsync-target-config:
   pvcTarget: audiobookshelf-config
   local:
-    enabled: false
+    enabled: true
     schedule: 2 8 * * *
   remote:
     enabled: false
@@ -134,7 +134,7 @@ volsync-target-config:
 volsync-target-metadata:
   pvcTarget: audiobookshelf-metadata
   local:
-    enabled: false
+    enabled: true
     schedule: 4 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/authentik/values.yaml

@@ -109,7 +109,7 @@ redis-replication:
   existingSecret:
     enabled: false
   redisReplication:
-    clusterSize: 1
-  redisSentinel:
-    enabled: false
+    clusterSize: 3
+  redisSentinel:
+    enabled: true
     clusterSize: 3

clusters/cl01tl/helm/backrest/values.yaml

@@ -108,7 +108,7 @@ backrest:
 volsync-target-data:
   pvcTarget: backrest-data
   local:
-    enabled: false
+    enabled: true
     schedule: 6 8 * * *
   remote:
     enabled: false
@@ -118,7 +118,7 @@ volsync-target-data:
 volsync-target-config:
   pvcTarget: backrest-config
   local:
-    enabled: false
+    enabled: true
     schedule: 8 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/bazarr/values.yaml

@@ -15,7 +15,7 @@ bazarr:
         main:
           image:
             repository: ghcr.io/linuxserver/bazarr
-            tag: 1.5.3@sha256:001875e61839c8a50743f0bc0fa4da2a55ed8a038b9b5ed0dd2c663dd3d0bfc7
+            tag: 1.5.4@sha256:f00df1c88545a23d3d22ca10f5ae5b7ee9359db1d28756b7f8a43cec624042fd
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -84,7 +84,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: false
+    enabled: true
     schedule: 10 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/blocky/values.yaml

@@ -152,14 +152,12 @@ blocky:
               radarr-4k                       IN      CNAME   traefik-cl01tl
               radarr-anime                    IN      CNAME   traefik-cl01tl
               radarr-standup                  IN      CNAME   traefik-cl01tl
-              rayflume                        IN      CNAME   traefik-cl01tl
               searxng                         IN      CNAME   traefik-cl01tl
               seerr                           IN      CNAME   traefik-cl01tl
               slskd                           IN      CNAME   traefik-cl01tl
               sonarr                          IN      CNAME   traefik-cl01tl
               sonarr-4k                       IN      CNAME   traefik-cl01tl
               sonarr-anime                    IN      CNAME   traefik-cl01tl
-              soulsync                        IN      CNAME   traefik-cl01tl
               stalwart                        IN      CNAME   traefik-cl01tl
               tautulli                        IN      CNAME   traefik-cl01tl
               tdarr                           IN      CNAME   traefik-cl01tl
@@ -167,6 +165,7 @@ blocky:
               vault                           IN      CNAME   traefik-cl01tl
               whodb                           IN      CNAME   traefik-cl01tl
               yamtrack                        IN      CNAME   traefik-cl01tl
+              yubal-playlist                  IN      CNAME   traefik-cl01tl
 
           blocking:
             denylists:

clusters/cl01tl/helm/booklore/values.yaml

@@ -9,7 +9,7 @@ booklore:
         main:
           image:
             repository: ghcr.io/booklore-app/booklore
-            tag: v1.16.1
+            tag: v1.16.4
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -218,7 +218,7 @@ mariadb-cluster:
 volsync-target-config:
   pvcTarget: booklore-config
   local:
-    enabled: false
+    enabled: true
     schedule: 12 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/cilium/templates/cilium-l2-announcement-policy.yaml

@@ -1,19 +1,19 @@
-apiVersion: "cilium.io/v2alpha1"
-kind: CiliumL2AnnouncementPolicy
-metadata:
-  name: general-l2-policy
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: general-l2-policy
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  nodeSelector:
-    matchExpressions:
-      - key: kubernetes.io/hostname
-        operator: Exists
-  interfaces:
-    - end0
-    - enp6s0
-  externalIPs: true
-  loadBalancerIPs: true
+# apiVersion: "cilium.io/v2alpha1"
+# kind: CiliumL2AnnouncementPolicy
+# metadata:
+#   name: general-l2-policy
+#   namespace: {{ .Release.Namespace }}
+#   labels:
+#     app.kubernetes.io/name: general-l2-policy
+#     app.kubernetes.io/instance: {{ .Release.Name }}
+#     app.kubernetes.io/part-of: {{ .Release.Name }}
+# spec:
+#   nodeSelector:
+#     matchExpressions:
+#       - key: kubernetes.io/hostname
+#         operator: Exists
+#   interfaces:
+#     - end0
+#     - enp6s0
+#   externalIPs: true
+#   loadBalancerIPs: true

clusters/cl01tl/helm/cilium/values.yaml

@@ -26,7 +26,7 @@ cilium:
         - SYS_ADMIN
         - SYS_RESOURCE
   l2announcements:
-    enabled: true
+    enabled: false
   bgpControlPlane:
     enabled: false
     secretsNamespace:

clusters/cl01tl/helm/cloudnative-pg/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 0.27.0
 - name: plugin-barman-cloud
   repository: https://cloudnative-pg.io/charts/
-  version: 0.3.1
-digest: sha256:14aa30b7bf75571b03bda19af68cd50c1e7908b883351b196a260609a5b85551
-generated: "2025-12-10T19:25:17.952954019Z"
+  version: 0.4.0
+digest: sha256:5e2a32fa5ed8b180ae5e556d65c67eeb3dcf38e2974b0d668eff4ee3c83258ce
+generated: "2025-12-30T21:01:48.755246408Z"

clusters/cl01tl/helm/cloudnative-pg/Chart.yaml

@@ -19,7 +19,7 @@ dependencies:
     version: 0.27.0
     repository: https://cloudnative-pg.io/charts/
   - name: plugin-barman-cloud
-    version: 0.3.1
+    version: 0.4.0
     repository: https://cloudnative-pg.io/charts/
 icon: https://avatars.githubusercontent.com/u/100373852?s=200&v=4
 # renovate: github=cloudnative-pg/cloudnative-pg

clusters/cl01tl/helm/cloudnative-pg/values.yaml

@@ -7,10 +7,10 @@ plugin-barman-cloud:
   image:
     registry: ghcr.io
     repository: cloudnative-pg/plugin-barman-cloud
-    tag: v0.9.0
+    tag: v0.10.0
   sidecarImage:
     registry: ghcr.io
     repository: cloudnative-pg/plugin-barman-cloud-sidecar
-    tag: v0.9.0
+    tag: v0.10.0
   crds:
     create: true

clusters/cl01tl/helm/code-server/values.yaml

@@ -76,7 +76,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: false
+    enabled: true
     schedule: 16 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/directus/values.yaml

@@ -216,7 +216,7 @@ redis-replication:
     name: directus-redis-config
     key: password
   redisReplication:
-    clusterSize: 1
-  redisSentinel:
-    enabled: false
+    clusterSize: 3
+  redisSentinel:
+    enabled: true
     clusterSize: 3

clusters/cl01tl/helm/ephemera/values.yaml

@@ -130,7 +130,7 @@ ephemera:
 volsync-target-config:
   pvcTarget: ephemera
   local:
-    enabled: false
+    enabled: true
     schedule: 16 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/external-dns/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: external-dns
   repository: https://kubernetes-sigs.github.io/external-dns/
-  version: 1.19.0
-digest: sha256:2216b442cc820ebe561d611fbcca3955d5c94e227a0b3288e5db9f8da7d6ac00
-generated: "2025-12-01T20:25:38.288305-06:00"
+  version: 1.20.0
+digest: sha256:0da4dec408239ea48de1d95fa8ad7701c4fdc0efe67baa8743507c75e62e2a47
+generated: "2026-01-03T23:04:25.142170083Z"

clusters/cl01tl/helm/external-dns/Chart.yaml

@@ -16,7 +16,7 @@ maintainers:
 dependencies:
   - name: external-dns
     alias: external-dns-unifi
-    version: 1.19.0
+    version: 1.20.0
     repository: https://kubernetes-sigs.github.io/external-dns/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 # renovate: github=kubernetes-sigs/external-dns

clusters/cl01tl/helm/external-secrets/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: external-secrets
   repository: https://charts.external-secrets.io
-  version: 1.2.0
-digest: sha256:6e713c4b50c14d9daf1758d9f169d10a8c7274d2c42490846817b6fb1a3ce558
-generated: "2025-12-20T01:04:35.136580598Z"
+  version: 1.2.1
+digest: sha256:20d4fe97e96c6bd5ba958b23121d807d8154c39d58b01511b80025166713a141
+generated: "2026-01-03T23:02:15.181743082Z"

clusters/cl01tl/helm/external-secrets/Chart.yaml

@@ -12,7 +12,7 @@ sources:
   - https://github.com/external-secrets/external-secrets/tree/main/deploy/charts/external-secrets
 dependencies:
   - name: external-secrets
-    version: 1.2.0
+    version: 1.2.1
     repository: https://charts.external-secrets.io
 icon: https://avatars.githubusercontent.com/u/68335991?s=48&v=4
 # renovate: github=external-secrets/external-secrets

clusters/cl01tl/helm/freshrss/values.yaml

@@ -247,7 +247,7 @@ volsync-target-data:
       - 109
       - 65539
   local:
-    enabled: false
+    enabled: true
     schedule: 18 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/garage/values.yaml

@@ -403,20 +403,20 @@ garage:
               readOnly: true
               mountPropagation: None
               subPath: garage-1.toml
-    # db-1:
-    #   forceRename: garage-db-1
-    #   storageClass: ceph-block
-    #   accessMode: ReadWriteOnce
-    #   size: 50Gi
-    #   retain: true
-    #   advancedMounts:
-    #     server-1:
-    #       main:
-    #         - path: /var/lib/garage/meta
-    #           readOnly: false
-    #       debug:
-    #         - path: /var/lib/garage/meta
-    #           readOnly: false
+    db-1:
+      forceRename: garage-db-1
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 50Gi
+      retain: true
+      advancedMounts:
+        server-1:
+          main:
+            - path: /var/lib/garage/meta
+              readOnly: false
+          debug:
+            - path: /var/lib/garage/meta
+              readOnly: false
     db-2:
       forceRename: garage-db-2
       storageClass: ceph-block

clusters/cl01tl/helm/gatus/values.yaml

@@ -7,7 +7,7 @@ gatus:
     enabled: true
   image:
     repository: ghcr.io/twin/gatus
-    tag: v5.33.1
+    tag: v5.34.0
   annotations:
     reloader.stakater.com/auto: "true"
   service:
@@ -313,11 +313,8 @@ gatus:
       - name: lidatube
         url: https://lidatube.alexlebens.net
         <<: *defaults
-      - name: rayflume
-        url: https://rayflume.alexlebens.net
-        <<: *defaults
-      - name: soulsync
-        url: https://soulsync.alexlebens.net
+      - name: yubal-playlist
+        url: https://yubal-playlist.alexlebens.net
         <<: *defaults
       - name: slskd
         url: https://slskd.alexlebens.net
@@ -424,7 +421,7 @@ postgres-18-cluster:
 volsync-target-data:
   pvcTarget: gatus
   local:
-    enabled: false
+    enabled: true
     schedule: 22 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/generic-device-plugin/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: generic-device-plugin
   repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-  version: 0.20.10
-digest: sha256:bb4fe0fe2e95889b3fbf028e1eff923fcc71d8bd1bc7887eee08010cfb28f4db
-generated: "2025-12-27T23:08:24.592060217Z"
+  version: 0.20.11
+digest: sha256:638754658519c268ac93bef8dec82332cded8e99b734ef61db45ee63e4b7c6ce
+generated: "2025-12-30T22:23:45.633280279Z"

clusters/cl01tl/helm/generic-device-plugin/Chart.yaml

@@ -15,6 +15,6 @@ maintainers:
 dependencies:
   - name: generic-device-plugin
     repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-    version: 0.20.10
+    version: 0.20.11
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: 1.0.0

clusters/cl01tl/helm/gitea/Chart.lock

@@ -7,7 +7,7 @@ dependencies:
   version: 0.2.1
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.19.0
+  version: 0.20.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.1.4
@@ -23,5 +23,5 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
-digest: sha256:c0ea42d1a2fc3712ac0481e0a40330704f0f2d1d290b7d30c36a536f0d0ee384
-generated: "2025-12-27T19:45:48.293310777Z"
+digest: sha256:6636f6ead8089c19ad702fb58170d942e11150fdda9470f1b97f4f8fa533d00e
+generated: "2025-12-30T16:03:12.004386065Z"

clusters/cl01tl/helm/gitea/Chart.yaml

@@ -32,7 +32,7 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
     version: 0.2.1
   - name: meilisearch
-    version: 0.19.0
+    version: 0.20.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/helm/harbor/values.yaml

@@ -142,7 +142,7 @@ redis-replication:
   existingSecret:
     enabled: false
   redisReplication:
-    clusterSize: 1
-  redisSentinel:
-    enabled: false
+    clusterSize: 3
+  redisSentinel:
+    enabled: true
     clusterSize: 3

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -9,7 +9,7 @@ home-assistant:
         main:
           image:
             repository: ghcr.io/home-assistant/home-assistant
-            tag: 2025.12.4
+            tag: 2025.12.5
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -133,7 +133,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: false
+    enabled: true
     schedule: 24 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/homepage/values.yaml

@@ -655,11 +655,11 @@ homepage:
                     url: http://lidarr.lidarr:80
                     key: {{ "{{HOMEPAGE_VAR_LIDARR_KEY}}" }}
                     fields: ["wanted", "queued", "artists"]
-              - RayFlume:
-                  icon: sh-youtubarr.webp
-                  description: Playlist to Lidarr Import
-                  href: https://rayflume.alexlebens.net
-                  siteMonitor: http://rayflume.rayflume:80
+              - Yubal Playlist:
+                  icon: sh-yubal.webp
+                  description: Replicate Youtube playlist
+                  href: https://yubal-playlist.alexlebens.net
+                  siteMonitor: http://yubal-playlist.yubal-playlist:80
                   statusStyle: dot
               - LidaTube:
                   icon: sh-lidatube.webp
@@ -667,12 +667,6 @@ homepage:
                   href: https://lidatube.alexlebens.net
                   siteMonitor: http://lidatube.lidatube:80
                   statusStyle: dot
-              - SoulSync:
-                  icon: sh-soulsync.webp
-                  description: Playlist Sync
-                  href: https://soulsync.alexlebens.net
-                  siteMonitor: http://soulsync.soulsync:80
-                  statusStyle: dot
               - slskd:
                   icon: sh-slskd.webp
                   description: slskd

clusters/cl01tl/helm/huntarr/values.yaml

@@ -61,7 +61,7 @@ huntarr:
 volsync-target-config:
   pvcTarget: huntarr-config
   local:
-    enabled: false
+    enabled: true
     schedule: 26 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/immich/values.yaml

@@ -226,9 +226,9 @@ redis-replication:
   existingSecret:
     enabled: false
   redisReplication:
-    clusterSize: 1
+    clusterSize: 3
   redisSentinel:
-    enabled: false
+    enabled: true
     clusterSize: 3
 volsync-target-data:
   pvcTarget: immich

clusters/cl01tl/helm/jellyfin/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.5.0
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.19.0
+  version: 0.20.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
-digest: sha256:dc914dfc86c2b638fae6f580418dafebcddb09a25e6f534f89983fb592196245
-generated: "2025-12-27T13:30:57.814394-06:00"
+digest: sha256:20665aefeaea3e853d5c977cdce05089a87c6d83e43aa946a088f43bcc7eebf9
+generated: "2025-12-30T16:03:25.803286869Z"

clusters/cl01tl/helm/jellyfin/Chart.yaml

@@ -25,7 +25,7 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
   - name: meilisearch
-    version: 0.19.0
+    version: 0.20.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: volsync-target
     alias: volsync-target-config

clusters/cl01tl/helm/jellyfin/values.yaml

@@ -142,7 +142,7 @@ meilisearch:
 volsync-target-config:
   pvcTarget: jellyfin-config
   local:
-    enabled: false
+    enabled: true
     schedule: 30 8 * * *
     restic:
       cacheCapacity: 10Gi

clusters/cl01tl/helm/jellystat/values.yaml

@@ -144,7 +144,7 @@ postgres-18-cluster:
 volsync-target-data:
   pvcTarget: jellystat-data
   local:
-    enabled: false
+    enabled: true
     schedule: 32 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/karakeep/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 4.5.0
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.19.0
+  version: 0.20.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.1.4
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
-digest: sha256:e750d8cab228de94d920f80137981e24e795d97040e92dd4cf0d80e463b2bd19
-generated: "2025-12-27T13:31:02.732529-06:00"
+digest: sha256:d65ca3de6fd1095c4dfe2515ed84c4705495c0725773ec95ea49331a38721785
+generated: "2025-12-30T16:03:37.441539588Z"

clusters/cl01tl/helm/karakeep/Chart.yaml

@@ -22,7 +22,7 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
   - name: meilisearch
-    version: 0.19.0
+    version: 0.20.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/helm/karakeep/values.yaml

@@ -9,7 +9,7 @@ karakeep:
         main:
           image:
             repository: ghcr.io/karakeep-app/karakeep
-            tag: 0.29.3
+            tag: 0.30.0
             pullPolicy: IfNotPresent
           env:
             - name: DATA_DIR
@@ -171,7 +171,7 @@ meilisearch:
 volsync-target-data:
   pvcTarget: karakeep
   local:
-    enabled: false
+    enabled: true
     schedule: 34 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 80.8.0
+  version: 80.9.1
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.5.0
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.5.0
-digest: sha256:8e4076f0ba94134eb91dc12364fde4f50bffc6dc3c4cc32a5ea6b9ede777a3b6
-generated: "2025-12-28T21:56:15.664575212Z"
+digest: sha256:91fcf8234e006b8e412e15ddd159ef3450a51bfdb6866a1ea2759741f78b70cd
+generated: "2025-12-30T22:24:25.338726593Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 80.8.0
+    version: 80.9.1
     repository: oci://ghcr.io/prometheus-community/charts
   - name: app-template
     alias: ntfy-alertmanager

clusters/cl01tl/helm/kube-prometheus-stack/values.yaml

@@ -174,12 +174,12 @@ redis-replication:
   existingSecret:
     enabled: false
   redisReplication:
-    clusterSize: 1
+    clusterSize: 3
     volumeClaimTemplate:
       spec:
         resources:
           requests:
             storage: 10Gi
   redisSentinel:
-    enabled: false
+    enabled: true
     clusterSize: 3

clusters/cl01tl/helm/libation/values.yaml

@@ -16,7 +16,7 @@ libation:
         main:
           image:
             repository: rmcrackan/libation
-            tag: 13.0.0
+            tag: 13.1.0
             pullPolicy: IfNotPresent
           env:
             - name: SLEEP_TIME
@@ -74,7 +74,7 @@ libation:
 volsync-target-config:
   pvcTarget: libation
   local:
-    enabled: false
+    enabled: true
     schedule: 36 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/lidarr/values.yaml

@@ -171,7 +171,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: false
+    enabled: true
     schedule: 38 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/lidatube/values.yaml

@@ -93,7 +93,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: false
+    enabled: true
     schedule: 40 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/listenarr/values.yaml

@@ -74,7 +74,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: false
+    enabled: true
     schedule: 42 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/local-path-provisioner/values.yaml

@@ -13,26 +13,16 @@ local-path-provisioner:
     reclaimPolicy: Delete
     volumeBindingMode: WaitForFirstConsumer
   nodePathMap:
-    - node: talos-2di-ktg
+    - node: DEFAULT_PATH_FOR_NON_LISTED_NODES
       paths:
-        - /var/local-path-provisioner
-    - node: talos-9vs-6hh
-      paths:
-        - /var/local-path-provisioner
-    - node: talos-aoq-hpv
-      paths:
-        - /var/local-path-provisioner
+        - /var/mnt/local-storage
   affinity:
     nodeAffinity:
       requiredDuringSchedulingIgnoredDuringExecution:
         nodeSelectorTerms:
           - matchExpressions:
-            - key: kubernetes.io/hostname
-              operator: In
-              values:
-                - talos-2di-ktg
-                - talos-9vs-6hh
-                - talos-aoq-hpv
+              - key: node-role.kubernetes.io/local-storage-node
+                operator: Exists
   configmap:
     name: local-path-config
     setup: |-

clusters/cl01tl/helm/matrix-synapse/values.yaml

@@ -478,7 +478,7 @@ redis-replication-hookshot:
 volsync-target-synapse:
   pvcTarget: matrix-synapse
   local:
-    enabled: false
+    enabled: true
     schedule: 44 8 * * *
   remote:
     enabled: false
@@ -488,7 +488,7 @@ volsync-target-synapse:
 volsync-target-hookshot:
   pvcTarget: matrix-hookshot
   local:
-    enabled: false
+    enabled: true
     schedule: 46 8 * * *
   remote:
     enabled: false
@@ -501,7 +501,7 @@ volsync-target-discord:
     runAsUser: 1337
     runAsGroup: 1337
   local:
-    enabled: false
+    enabled: true
     schedule: 48 8 * * *
   remote:
     enabled: false
@@ -514,7 +514,7 @@ volsync-target-whatsapp:
     runAsUser: 1337
     runAsGroup: 1337
   local:
-    enabled: false
+    enabled: true
     schedule: 50 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/navidrome/values.yaml

@@ -161,7 +161,7 @@ volsync-target-data:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: false
+    enabled: true
     schedule: 52 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/ollama/values.yaml

@@ -307,7 +307,7 @@ volsync-target-data:
     runAsUser: 1337
     runAsGroup: 1337
   local:
-    enabled: false
+    enabled: true
     schedule: 54 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/outline/values.yaml

@@ -188,7 +188,7 @@ redis-replication:
   existingSecret:
     enabled: false
   redisReplication:
-    clusterSize: 1
-  redisSentinel:
-    enabled: false
+    clusterSize: 3
+  redisSentinel:
+    enabled: true
     clusterSize: 3

clusters/cl01tl/helm/postiz/values.yaml

@@ -9,7 +9,7 @@ postiz:
         main:
           image:
             repository: ghcr.io/gitroomhq/postiz-app
-            tag: v2.11.2
+            tag: v2.11.3
             pullPolicy: IfNotPresent
           env:
             - name: MAIN_URL
@@ -173,14 +173,14 @@ redis-replication:
     name: postiz-redis-config
     key: password
   redisReplication:
-    clusterSize: 1
+    clusterSize: 3
   redisSentinel:
-    enabled: false
+    enabled: true
     clusterSize: 3
 volsync-target-config:
   pvcTarget: postiz-config
   local:
-    enabled: false
+    enabled: true
     schedule: 56 8 * * *
   remote:
     enabled: false
@@ -190,7 +190,7 @@ volsync-target-config:
 volsync-target-upload:
   pvcTarget: postiz-uploads
   local:
-    enabled: false
+    enabled: true
     schedule: 58 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/prowlarr/values.yaml

@@ -83,7 +83,7 @@ volsync-target-config:
       - 109
       - 65539
   local:
-    enabled: false
+    enabled: true
     schedule: 0 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/qbittorrent/templates/external-secret.yaml

@@ -19,6 +19,20 @@ spec:
         key: /protonvpn/conf/cl01tl
         metadataPolicy: None
         property: private-key
+    - secretKey: proton-email
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /protonvpn/conf/cl01tl
+        metadataPolicy: None
+        property: email
+    - secretKey: proton-password
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /protonvpn/conf/cl01tl
+        metadataPolicy: None
+        property: password
 
 ---
 apiVersion: external-secrets.io/v1

clusters/cl01tl/helm/qbittorrent/values.yaml

@@ -28,7 +28,7 @@ qbittorrent:
         qbittorrent:
           image:
             repository: ghcr.io/linuxserver/qbittorrent
-            tag: 5.1.4@sha256:1497b6e047ad47b738f94739219f0e5c5b2ad7a5953b7cf0050f2fedddd8c601
+            tag: 5.1.4@sha256:e0cedcadd62f809efdeddfd32e4d1192f9a74e6e64ed6753bfc6e2c3ed4a714a
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -64,6 +64,16 @@ qbittorrent:
                 secretKeyRef:
                   name: qbittorrent-wireguard-conf
                   key: private-key
+            - name: UPDATER_PROTONVPN_EMAIL
+              valueFrom:
+                secretKeyRef:
+                  name: qbittorrent-wireguard-conf
+                  key: proton-email
+            - name: UPDATER_PROTONVPN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: qbittorrent-wireguard-conf
+                  key: proton-password
             - name: VPN_PORT_FORWARDING
               value: "on"
             - name: VPN_PORT_FORWARDING_UP_COMMAND
@@ -74,8 +84,8 @@ qbittorrent:
               value: 192.168.1.0/24,10.244.0.0/16
             - name: FIREWALL_INPUT_PORTS
               value: 8080,9022
-            - name: DOT
-              value: "off"
+            - name: DNS_UPSTREAM_RESOLVER_TYPE
+              value: dot
           securityContext:
             privileged: True
             capabilities:
@@ -202,7 +212,7 @@ qbittorrent:
         qui:
           image:
             repository: ghcr.io/autobrr/qui
-            tag: v1.11.0
+            tag: v1.12.0
             pullPolicy: IfNotPresent
           env:
             - name: QUI__METRICS_ENABLED
@@ -437,7 +447,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: false
+    enabled: true
     schedule: 2 11 * * *
     restic:
       copyMethod: Snapshot
@@ -458,7 +468,7 @@ volsync-target-config:
 volsync-target-qbit-manage-config:
   pvcTarget: qbittorrent-qbit-manage-config-data
   local:
-    enabled: false
+    enabled: true
     schedule: 4 11 * * *
   remote:
     enabled: false
@@ -468,7 +478,7 @@ volsync-target-qbit-manage-config:
 volsync-target-qui-config:
   pvcTarget: qbittorrent-qui-config-data
   local:
-    enabled: false
+    enabled: true
     schedule: 6 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/radarr-4k/values.yaml

@@ -171,7 +171,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: false
+    enabled: true
     schedule: 10 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/radarr-anime/values.yaml

@@ -169,7 +169,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: false
+    enabled: true
     schedule: 12 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/radarr-standup/values.yaml

@@ -169,7 +169,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: false
+    enabled: true
     schedule: 14 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/radarr/values.yaml

@@ -171,7 +171,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: false
+    enabled: true
     schedule: 8 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/rayflume/Chart.lock

@@ -1,12 +0,0 @@
-dependencies:
-- name: app-template
-  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.5.0
-- name: redis-replication
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
-digest: sha256:8ffb9b2d1e452cad49196824787d52f55fcc0309722fbb433a1eb2a99e9d19e1
-generated: "2025-12-27T13:32:17.225782-06:00"

clusters/cl01tl/helm/rayflume/Chart.yaml

@@ -1,27 +0,0 @@
-apiVersion: v2
-name: rayflume
-version: 1.0.0
-description: RayFlume
-keywords:
-  - rayflume
-  - music
-  - lidarr
-home: https://wiki.alexlebens.dev/s/
-sources:
-  - https://gitea.alexlebens.dev/alexlebens/RayFlume
-  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: rayflume
-    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.5.0
-  - name: redis-replication
-    version: 0.5.0
-    repository: oci://harbor.alexlebens.net/helm-charts
-  - name: volsync-target
-    alias: volsync-target-data
-    version: 0.7.0
-    repository: oci://harbor.alexlebens.net/helm-charts
-appVersion: 0.0.3

clusters/cl01tl/helm/rayflume/templates/external-secret.yaml

@@ -1,42 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: rayflume-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: rayflume-config-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/rayflume/config
-        metadataPolicy: None
-        property: SECRET_KEY
-    - secretKey: LIDARR_TOKEN
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/rayflume/config
-        metadataPolicy: None
-        property: LIDARR_TOKEN
-    - secretKey: YOUTUBE_API_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/rayflume/config
-        metadataPolicy: None
-        property: YOUTUBE_API_KEY
-    - secretKey: MB_USER_AGENT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/rayflume/config
-        metadataPolicy: None
-        property: MB_USER_AGENT

clusters/cl01tl/helm/rayflume/values.yaml

@@ -1,104 +0,0 @@
-rayflume:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: harbor.alexlebens.net/images/rayflume
-            tag: 0.0.7
-            pullPolicy: IfNotPresent
-          env:
-            - name: DEBUG
-              value: True
-            - name: ALLOWED_HOSTS
-              value: rayflume.alexlebens.net,rayflume.rayflume
-            - name: SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: rayflume-config-secret
-                  key: SECRET_KEY
-            - name: LIDARR_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: rayflume-config-secret
-                  key: LIDARR_TOKEN
-            - name: YOUTUBE_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: rayflume-config-secret
-                  key: YOUTUBE_API_KEY
-            - name: MB_USER_AGENT
-              valueFrom:
-                secretKeyRef:
-                  name: rayflume-config-secret
-                  key: MB_USER_AGENT
-            - name: CELERY_BROKER_URL
-              value: redis://redis-replication-rayflume-master.rayflume:6379/0
-            - name: CELERY_RESULT_BACKEND
-              value: redis://redis-replication-rayflume-master.rayflume:6379/0
-          resources:
-            requests:
-              cpu: 10m
-              memory: 64Mi
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 80
-          protocol: HTTP
-  route:
-    main:
-      kind: HTTPRoute
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: traefik-gateway
-          namespace: traefik
-      hostnames:
-        - rayflume.alexlebens.net
-      rules:
-        - backendRefs:
-            - group: ''
-              kind: Service
-              name: rayflume
-              port: 80
-              weight: 100
-          matches:
-            - path:
-                type: PathPrefix
-                value: /
-  persistence:
-    data:
-      forceRename: rayflume-data
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 1Gi
-      advancedMounts:
-        main:
-          main:
-            - path: /data
-              readOnly: false
-redis-replication:
-  existingSecret:
-    enabled: false
-  redisReplication:
-    clusterSize: 1
-  redisSentinel:
-    enabled: false
-    clusterSize: 3
-volsync-target-data:
-  pvcTarget: rayflume-data
-  local:
-    enabled: false
-    schedule: 16 11 * * *
-  remote:
-    enabled: false
-  external:
-    enabled: true
-    schedule: 16 12 * * *

clusters/cl01tl/helm/rook-ceph/values.yaml

@@ -85,7 +85,8 @@ rook-ceph-cluster:
           cpu: 100m
           memory: 128Mi
     storage:
-      deviceFilter: sda
+      useAllDevices: false
+      devicePathFilter: "/dev/disk/by-partlabel/r-csi-disk"
       config:
         osdsPerDevice: "1"
     csi:

clusters/cl01tl/helm/roundcube/values.yaml

@@ -271,7 +271,7 @@ postgres-18-cluster:
 volsync-target-data:
   pvcTarget: roundcube-data
   local:
-    enabled: false
+    enabled: true
     schedule: 16 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/searxng/templates/external-secret.yaml

@@ -1,28 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
-metadata:
-  name: searxng-wireguard-conf
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: searxng-wireguard-conf
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: private-key
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
-        metadataPolicy: None
-        property: private-key
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
 metadata:
   name: searxng-browser-metrics-auth
   namespace: {{ .Release.Namespace }}

clusters/cl01tl/helm/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:6f3a875c64bd804d1ccf2fe3c8df35e985b75ffbf0322f216544e79912fabab2
+            tag: latest@sha256:472dd0c84b8e2a05bca773b4a430b9fc9e4e92cd4fa0afaa223efab925ab752a
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -39,7 +39,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:6f3a875c64bd804d1ccf2fe3c8df35e985b75ffbf0322f216544e79912fabab2
+            tag: latest@sha256:472dd0c84b8e2a05bca773b4a430b9fc9e4e92cd4fa0afaa223efab925ab752a
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -67,56 +67,6 @@ searxng:
             requests:
               cpu: 10m
               memory: 128Mi
-        gluetun:
-          image:
-            repository: ghcr.io/qdm12/gluetun
-            tag: v3.41.0@sha256:6b54856716d0de56e5bb00a77029b0adea57284cf5a466f23aad5979257d3045
-            pullPolicy: IfNotPresent
-          lifecycle:
-            postStart:
-              exec:
-                command: ["/bin/sh", "-c", "(ip rule del table 51820; ip -6 rule del table 51820) || true"]
-          env:
-            - name: VPN_SERVICE_PROVIDER
-              value: protonvpn
-            - name: VPN_TYPE
-              value: wireguard
-            - name: WIREGUARD_PRIVATE_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: searxng-wireguard-conf
-                  key: private-key
-            - name: FIREWALL_OUTBOUND_SUBNETS
-              value: 192.168.1.0/24,10.244.0.0/16
-            - name: FIREWALL_INPUT_PORTS
-              value: 8080
-          securityContext:
-            privileged: True
-            capabilities:
-              add:
-                - NET_ADMIN
-                - SYS_MODULE
-          probes:
-            liveness:
-              enabled: true
-              custom: true
-              spec:
-                exec:
-                  command:
-                    - /gluetun-entrypoint
-                    - healthcheck
-                failureThreshold: 5
-                initialDelaySeconds: 30
-                periodSeconds: 30
-                successThreshold: 1
-                timeoutSeconds: 15
-          resources:
-            limits:
-              devic.es/tun: "1"
-            requests:
-              devic.es/tun: "1"
-              cpu: 10m
-              memory: 64Mi
   service:
     api:
       controller: api
@@ -220,7 +170,7 @@ searxng:
 volsync-target-data:
   pvcTarget: searxng-browser-data
   local:
-    enabled: false
+    enabled: true
     schedule: 18 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/seerr/values.yaml

@@ -32,7 +32,7 @@ seerr-chart:
 volsync-target-config:
   pvcTarget: seerr-seerr-chart-config
   local:
-    enabled: false
+    enabled: true
     schedule: 20 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/site-documentation/values.yaml

@@ -11,7 +11,7 @@ site-documentation:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-documentation
-            tag: 0.0.5
+            tag: 0.0.7
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/site-profile/values.yaml

@@ -11,7 +11,7 @@ site-profile:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-profile
-            tag: 2.1.2
+            tag: 2.1.4
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/slskd/templates/external-secret.yaml

@@ -65,3 +65,17 @@ spec:
         key: /protonvpn/conf/cl01tl
         metadataPolicy: None
         property: private-key
+    - secretKey: proton-email
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /protonvpn/conf/cl01tl
+        metadataPolicy: None
+        property: email
+    - secretKey: proton-password
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /protonvpn/conf/cl01tl
+        metadataPolicy: None
+        property: password

clusters/cl01tl/helm/slskd/values.yaml

@@ -62,6 +62,16 @@ slskd:
                 secretKeyRef:
                   name: slskd-wireguard-conf
                   key: private-key
+            - name: UPDATER_PROTONVPN_EMAIL
+              valueFrom:
+                secretKeyRef:
+                  name: slskd-wireguard-conf
+                  key: proton-email
+            - name: UPDATER_PROTONVPN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: slskd-wireguard-conf
+                  key: proton-password
             - name: VPN_PORT_FORWARDING
               value: "on"
             - name: PORT_FORWARD_ONLY
@@ -70,8 +80,8 @@ slskd:
               value: 192.168.1.0/24,10.244.0.0/16
             - name: FIREWALL_INPUT_PORTS
               value: 5030,50300
-            - name: DOT
-              value: "off"
+            - name: DNS_UPSTREAM_RESOLVER_TYPE
+              value: dot
           securityContext:
             privileged: true
             capabilities:

clusters/cl01tl/helm/sonarr-4k/values.yaml

@@ -169,7 +169,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: false
+    enabled: true
     schedule: 24 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/sonarr-anime/values.yaml

@@ -169,7 +169,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: false
+    enabled: true
     schedule: 26 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/sonarr/values.yaml

@@ -169,7 +169,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: false
+    enabled: true
     schedule: 22 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/soulsync/Chart.lock

@@ -1,12 +0,0 @@
-dependencies:
-- name: app-template
-  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.5.0
-- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
-- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
-digest: sha256:3f2befd8dc0c7cc73090a5e1648d200a757dbc3e58f7735940fc11b172ada4f9
-generated: "2025-12-27T13:32:51.138317-06:00"

clusters/cl01tl/helm/soulsync/Chart.yaml

@@ -1,29 +0,0 @@
-apiVersion: v2
-name: soulsync
-version: 1.0.0
-description: SoulSync
-keywords:
-  - soulsync
-  - music
-home: https://wiki.alexlebens.dev/s/
-sources:
-  - https://github.com/Nezreka/SoulSync
-  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: soulsync
-    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.5.0
-  - name: volsync-target
-    alias: volsync-target-config
-    version: 0.7.0
-    repository: oci://harbor.alexlebens.net/helm-charts
-  - name: volsync-target
-    alias: volsync-target-database
-    version: 0.7.0
-    repository: oci://harbor.alexlebens.net/helm-charts
-icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/soulsync.png
-# renovate: github=Nezreka/SoulSync
-appVersion: 1.42.2

clusters/cl01tl/helm/soulsync/templates/persistent-volume-claim.yaml

@@ -1,36 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: soulsync-music-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: soulsync-music-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: soulsync-music-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: soulsync-slskd-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: soulsync-slskd-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: soulsync-slskd-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/helm/soulsync/templates/persistent-volume.yaml

@@ -1,48 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: soulsync-music-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: soulsync-music-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage/Music
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac
-
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: soulsync-slskd-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: soulsync-slskd-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage/slskd/Downloads
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/helm/soulsync/values.yaml

@@ -1,170 +0,0 @@
-soulsync:
-  controllers:
-    main:
-      type: deployment
-      replicas: 0
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      initContainers:
-        init-copy-config:
-          image:
-            repository: busybox
-            tag: 1.37.0
-            pullPolicy: IfNotPresent
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-          command:
-            - /bin/sh
-            - -ec
-            - |
-              echo ">> Coping files ..."
-              ls /tmp
-              cp -fv /tmp/config.json /app/config/config.json
-              echo ">> Files in config:"
-              ls /app/config
-      containers:
-        main:
-          image:
-            repository: boulderbadgedad/soulsync
-            tag: latest
-            pullPolicy: IfNotPresent
-          env:
-            - name: TZ
-              value: US/Central
-            - name: PUID
-              value: 1000
-            - name: PGID
-              value: 1000
-            - name: FLASK_ENV
-              value: production
-            - name: PYTHONPATH
-              value: /app
-            - name: SOULSYNC_CONFIG_PATH
-              value: /app/config/config.json
-          probes:
-            liveness:
-              enabled: true
-              custom: true
-              spec:
-                exec:
-                  command:
-                  - CMD
-                  - curl
-                  - -f
-                  - http://localhost:8888/
-                failureThreshold: 5
-                initialDelaySeconds: 60
-                periodSeconds: 30
-                successThreshold: 1
-                timeoutSeconds: 10
-          resources:
-            requests:
-              cpu: 100m
-              memory: 512Mi
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 8008
-          protocol: HTTP
-  route:
-    main:
-      kind: HTTPRoute
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: traefik-gateway
-          namespace: traefik
-      hostnames:
-        - soulsync.alexlebens.net
-      rules:
-        - backendRefs:
-            - group: ''
-              kind: Service
-              name: soulsync
-              port: 80
-              weight: 100
-          matches:
-            - path:
-                type: PathPrefix
-                value: /
-  persistence:
-    secret:
-      enabled: true
-      type: secret
-      name: soulsync-config-secret
-      advancedMounts:
-        main:
-          init-copy-config:
-            - path: /tmp/config.json
-              readOnly: true
-              mountPropagation: None
-              subPath: config.json
-    config:
-      forceRename: soulsync-config
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 10Gi
-      advancedMounts:
-        main:
-          main:
-            - path: /app/config
-              readOnly: false
-          init-copy-config:
-            - path: /app/config
-              readOnly: false
-    database:
-      forceRename: soulsync-database
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 10Gi
-      advancedMounts:
-        main:
-          main:
-            - path: /app/database
-              readOnly: false
-    downloads:
-      existingClaim: soulsync-slskd-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /app/downloads
-              readOnly: false
-    transfer:
-      type: emptyDir
-      advancedMounts:
-        main:
-          main:
-            - path: /app/Transfer
-              readOnly: false
-    music:
-      existingClaim: soulsync-music-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /music
-              readOnly: true
-volsync-target-config:
-  pvcTarget: soulsync-config
-  local:
-    enabled: false
-    schedule: 28 11 * * *
-  remote:
-    enabled: false
-  external:
-    enabled: true
-    schedule: 28 12 * * *
-volsync-target-database:
-  pvcTarget: soulsync-database
-  local:
-    enabled: false
-    schedule: 30 11 * * *
-  remote:
-    enabled: false
-  external:
-    enabled: true
-    schedule: 30 12 * * *

clusters/cl01tl/helm/stalwart/values.yaml

@@ -9,7 +9,7 @@ stalwart:
         main:
           image:
             repository: stalwartlabs/stalwart
-            tag: v0.15.2
+            tag: v0.15.3
             pullPolicy: IfNotPresent
           resources:
             requests:
@@ -118,14 +118,14 @@ redis-replication:
   existingSecret:
     enabled: false
   redisReplication:
-    clusterSize: 1
+    clusterSize: 3
   redisSentinel:
-    enabled: false
+    enabled: true
     clusterSize: 3
 volsync-target-config:
   pvcTarget: stalwart-config
   local:
-    enabled: false
+    enabled: true
     schedule: 32 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/talos/values.yaml

@@ -69,7 +69,7 @@ etcd-backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:64a23903ee1b156ae7d795efc756b68ad802bce695f5608343edadba3dea1dc1
+            tag: latest@sha256:8aeb104edaba11f086506024b22d543a0771e0b01cd50243043002e2d61c2f71
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -155,7 +155,7 @@ etcd-backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:64a23903ee1b156ae7d795efc756b68ad802bce695f5608343edadba3dea1dc1
+            tag: latest@sha256:8aeb104edaba11f086506024b22d543a0771e0b01cd50243043002e2d61c2f71
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -241,7 +241,7 @@ etcd-backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:64a23903ee1b156ae7d795efc756b68ad802bce695f5608343edadba3dea1dc1
+            tag: latest@sha256:8aeb104edaba11f086506024b22d543a0771e0b01cd50243043002e2d61c2f71
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -405,7 +405,7 @@ etcd-defrag:
         main:
           image:
             repository: ghcr.io/siderolabs/talosctl
-            tag: v1.11.6
+            tag: v1.12.0
             pullPolicy: IfNotPresent
           args:
             - etcd
@@ -438,7 +438,7 @@ etcd-defrag:
         main:
           image:
             repository: ghcr.io/siderolabs/talosctl
-            tag: v1.11.6
+            tag: v1.12.0
             pullPolicy: IfNotPresent
           args:
             - etcd
@@ -471,7 +471,7 @@ etcd-defrag:
         main:
           image:
             repository: ghcr.io/siderolabs/talosctl
-            tag: v1.11.6
+            tag: v1.12.0
             pullPolicy: IfNotPresent
           args:
             - etcd

clusters/cl01tl/helm/tautulli/values.yaml

@@ -170,7 +170,7 @@ tautulli:
 volsync-target-config:
   pvcTarget: tautulli-config
   local:
-    enabled: false
+    enabled: true
     schedule: 34 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/tdarr/values.yaml

@@ -180,7 +180,7 @@ tdarr-exporter:
 volsync-target-config:
   pvcTarget: tdarr-config
   local:
-    enabled: false
+    enabled: true
     schedule: 36 11 * * *
   remote:
     enabled: false
@@ -190,7 +190,7 @@ volsync-target-config:
 volsync-target-server:
   pvcTarget: tdarr-server
   local:
-    enabled: false
+    enabled: true
     schedule: 38 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/tubearchivist/templates/external-secret.yaml

@@ -86,3 +86,17 @@ spec:
         key: /protonvpn/conf/cl01tl
         metadataPolicy: None
         property: private-key
+    - secretKey: proton-email
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /protonvpn/conf/cl01tl
+        metadataPolicy: None
+        property: email
+    - secretKey: proton-password
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /protonvpn/conf/cl01tl
+        metadataPolicy: None
+        property: password

clusters/cl01tl/helm/tubearchivist/values.yaml

@@ -56,6 +56,16 @@ tubearchivist:
                 secretKeyRef:
                   name: tubearchivist-wireguard-conf
                   key: private-key
+            - name: UPDATER_PROTONVPN_EMAIL
+              valueFrom:
+                secretKeyRef:
+                  name: tubearchivist-wireguard-conf
+                  key: proton-email
+            - name: UPDATER_PROTONVPN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: tubearchivist-wireguard-conf
+                  key: proton-password
             - name: VPN_PORT_FORWARDING
               value: "on"
             - name: PORT_FORWARD_ONLY
@@ -64,12 +74,8 @@ tubearchivist:
               value: 10.0.0.0/8
             - name: FIREWALL_INPUT_PORTS
               value: 80,8000,24000
-            - name: DOT
-              value: off
-            - name: DNS_KEEP_NAMESERVER
-              value: on
-            - name: DNS_PLAINTEXT_ADDRESS
-              value: 10.96.0.10
+            - name: DNS_UPSTREAM_RESOLVER_TYPE
+              value: dot
           securityContext:
             privileged: True
             capabilities:
@@ -148,7 +154,7 @@ redis-replication:
   existingSecret:
     enabled: false
   redisReplication:
-    clusterSize: 1
+    clusterSize: 3
     resources:
       requests:
         cpu: 200m
@@ -159,5 +165,5 @@ redis-replication:
           requests:
             storage: 10Gi
   redisSentinel:
-    enabled: false
+    enabled: true
     clusterSize: 3

clusters/cl01tl/helm/vault/values.yaml

@@ -187,7 +187,7 @@ snapshot:
         s3-backup-local:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:64a23903ee1b156ae7d795efc756b68ad802bce695f5608343edadba3dea1dc1
+            tag: latest@sha256:8aeb104edaba11f086506024b22d543a0771e0b01cd50243043002e2d61c2f71
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -208,7 +208,7 @@ snapshot:
         s3-backup-remote:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:64a23903ee1b156ae7d795efc756b68ad802bce695f5608343edadba3dea1dc1
+            tag: latest@sha256:8aeb104edaba11f086506024b22d543a0771e0b01cd50243043002e2d61c2f71
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -229,7 +229,7 @@ snapshot:
         s3-backup-external:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:64a23903ee1b156ae7d795efc756b68ad802bce695f5608343edadba3dea1dc1
+            tag: latest@sha256:8aeb104edaba11f086506024b22d543a0771e0b01cd50243043002e2d61c2f71
             pullPolicy: IfNotPresent
           command:
             - /bin/sh

clusters/cl01tl/helm/vaultwarden/values.yaml

@@ -9,7 +9,7 @@ vaultwarden:
         main:
           image:
             repository: vaultwarden/server
-            tag: 1.35.0
+            tag: 1.35.1
             pullPolicy: IfNotPresent
           env:
             - name: DOMAIN

clusters/cl01tl/helm/whodb/values.yaml

@@ -8,7 +8,7 @@ whodb:
         main:
           image:
             repository: clidey/whodb
-            tag: 0.86.0
+            tag: 0.87.0
             pullPolicy: IfNotPresent
           env:
             - name: WHODB_OLLAMA_HOST

clusters/cl01tl/helm/yamtrack/values.yaml

@@ -136,7 +136,7 @@ redis-replication:
   existingSecret:
     enabled: false
   redisReplication:
-    clusterSize: 1
-  redisSentinel:
-    enabled: false
+    clusterSize: 3
+  redisSentinel:
+    enabled: true
     clusterSize: 3

clusters/cl01tl/helm/ytdl-sub/values.yaml

@@ -1,81 +0,0 @@
-ytdl-sub:
-  controllers:
-    main:
-      type: cronjob
-      cronjob:
-        suspend: false
-        concurrencyPolicy: Forbid
-        timeZone: US/Central
-        schedule: 0 0 1 1 *
-        startingDeadlineSeconds: 90
-        successfulJobsHistory: 1
-        failedJobsHistory: 1
-        backoffLimit: 3
-        parallelism: 1
-      containers:
-        main:
-          image:
-            repository: ghcr.io/jmbannon/ytdl-sub
-            tag: 2025.12.26
-            pullPolicy: IfNotPresent
-          command:
-            - ytdl-sub
-            - -c
-            - /config/config.yaml
-            - sub
-          env:
-            - name: TZ
-              value: America/Chicago
-            - name: CRON_RUN_ON_START
-              value: false
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  configMaps:
-    config:
-      enabled: true
-      data:
-        config.yaml: |
-          configuration:
-            working_directory: /cache
-        subscriptions.yaml: |
-          __preset__:
-            embed_thumbnail: True
-            square_thumbnail: True
-            overrides:
-              music_directory: /music
-          YouTube Releases | Max MP3 Quality:
-            = YouTube:
-              "Music Saved": "https://www.youtube.com/playlist?list=PLtiOoYqxYXtKK3fMya_xhqK0Wit0i10Gy&si=8wNBH-kGT9Nx0XBK"
-
-  persistence:
-    config:
-      enabled: true
-      type: configMap
-      name: ytdl-sub
-      advancedMounts:
-        main:
-          main:
-            - path: /config/config.yaml
-              readOnly: true
-              mountPropagation: None
-              subPath: config.yaml
-            - path: /config/subscriptions.yaml
-              readOnly: true
-              mountPropagation: None
-              subPath: subscriptions.yaml
-    cache:
-      type: emptyDir
-      advancedMounts:
-        main:
-          main:
-            - path: /cache
-              readOnly: false
-    music:
-      existingClaim: ytdl-sub-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /music
-              readOnly: false

clusters/cl01tl/helm/yubal-playlist/Chart.yaml

@@ -1,22 +1,22 @@
 apiVersion: v2
-name: ytdl-sub
+name: yubal-playlist
 version: 1.0.0
-description: ytdl-sub
+description: yubal-playlist
 keywords:
-  - ytdl-sub
+  - yubal-playlist
   - music
   - youtube
 home: https://wiki.alexlebens.dev/s/
 sources:
-  - https://github.com/jmbannon/ytdl-sub
-  - https://github.com/jmbannon/ytdl-sub/pkgs/container/ytdl-sub
+  - https://gitea.alexlebens.dev/alexlebens/yubal-playlist
+  - https://github.com/guillevc/yubal
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
 maintainers:
   - name: alexlebens
 dependencies:
   - name: app-template
-    alias: ytdl-sub
+    alias: yubal-playlist
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
-# renovate: github=jmbannon/ytdl-sub
-appVersion: 2025.12.26
+# renovate: github=alexlebens/yubal-playlist
+appVersion: 0.0.5

clusters/cl01tl/helm/yubal-playlist/templates/external-secret.yaml

@@ -1,10 +1,10 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: soulsync-config-secret
+  name: yubal-playlist-config-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: soulsync-config-secret
+    app.kubernetes.io/name: yubal-playlist-config-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -12,10 +12,10 @@ spec:
     kind: ClusterSecretStore
     name: vault
   data:
-    - secretKey: config.json
+    - secretKey: lidarr-key
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /cl01tl/soulsync/config
+        key: /cl01tl/lidarr2/key
         metadataPolicy: None
-        property: config.json
+        property: key

clusters/cl01tl/helm/yubal-playlist/templates/persistent-volume-claim.yaml

@@ -1,14 +1,14 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: ytdl-sub-nfs-storage
+  name: yubal-playlist-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: ytdl-sub-nfs-storage
+    app.kubernetes.io/name: yubal-playlist-nfs-storage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
-  volumeName: ytdl-sub-nfs-storage
+  volumeName: yubal-playlist-nfs-storage
   storageClassName: nfs-client
   accessModes:
     - ReadWriteMany

clusters/cl01tl/helm/yubal-playlist/templates/persistent-volume.yaml

@@ -1,10 +1,10 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: ytdl-sub-nfs-storage
+  name: yubal-playlist-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: ytdl-sub-nfs-storage
+    app.kubernetes.io/name: yubal-playlist-nfs-storage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:

clusters/cl01tl/helm/yubal-playlist/values.yaml

@@ -0,0 +1,77 @@
+yubal-playlist:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: harbor.alexlebens.net/images/yubal-playlist
+            tag: 0.0.5
+            pullPolicy: IfNotPresent
+          env:
+            - name: YUBAL_TZ
+              value: America/Chicago
+            - name: YUBAL_PORT
+              value: 8000
+            - name: YUBAL_DEBUG
+              value: true
+            - name: YUBAL_MB_USER_AGENT
+              value: alexanderlebens@gmail.com
+            - name: YUBAL_LIDARR_ENDPOINT
+              value: http://lidarr.lidarr:80
+            - name: YUBAL_LIDARR_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: yubal-playlist-config-secret
+                  key: lidarr-key
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 8000
+          protocol: HTTP
+  route:
+    main:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - yubal-playlist.alexlebens.net
+      rules:
+        - backendRefs:
+            - group: ''
+              kind: Service
+              name: yubal-playlist
+              port: 80
+              weight: 100
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+  persistence:
+    cache:
+      type: emptyDir
+      advancedMounts:
+        main:
+          main:
+            - path: /app/ytdlp
+              readOnly: false
+    music:
+      existingClaim: yubal-playlist-nfs-storage
+      advancedMounts:
+        main:
+          main:
+            - path: /app/data
+              readOnly: false

hosts/ps08rp/blocky/config.yml

@@ -75,7 +75,6 @@ customDNS:
     blocky                          IN      A       10.232.1.22
     cilium-cl01tl                   IN      A       10.232.1.23
 
-
     ;; Application Names
     actual                          IN      CNAME   traefik-cl01tl
     alertmanager                    IN      CNAME   traefik-cl01tl
@@ -128,14 +127,12 @@ customDNS:
     radarr-4k                       IN      CNAME   traefik-cl01tl
     radarr-anime                    IN      CNAME   traefik-cl01tl
     radarr-standup                  IN      CNAME   traefik-cl01tl
-    rayflume                        IN      CNAME   traefik-cl01tl
     searxng                         IN      CNAME   traefik-cl01tl
     seerr                           IN      CNAME   traefik-cl01tl
     slskd                           IN      CNAME   traefik-cl01tl
     sonarr                          IN      CNAME   traefik-cl01tl
     sonarr-4k                       IN      CNAME   traefik-cl01tl
     sonarr-anime                    IN      CNAME   traefik-cl01tl
-    soulsync                        IN      CNAME   traefik-cl01tl
     stalwart                        IN      CNAME   traefik-cl01tl
     tautulli                        IN      CNAME   traefik-cl01tl
     tdarr                           IN      CNAME   traefik-cl01tl
@@ -143,6 +140,7 @@ customDNS:
     vault                           IN      CNAME   traefik-cl01tl
     whodb                           IN      CNAME   traefik-cl01tl
     yamtrack                        IN      CNAME   traefik-cl01tl
+    yubal-playlist                  IN      CNAME   traefik-cl01tl
 
 blocking:
   denylists:

hosts/ps08rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.5
+        image: ghcr.io/traefik/traefik:v3.6.6
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"