Update docker.io/postgres Docker tag to v18

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/traefik/traefik](https://hub.docker.com/_/traefik) ([source](https://github.com/traefik/traefik-library-image)) | patch | `v3.6.2` -> `v3.6.4` |

---

### Release Notes

<details>
<summary>traefik/traefik-library-image (ghcr.io/traefik/traefik)</summary>

### [`v3.6.4`](https://github.com/traefik/traefik-library-image/compare/v3.6.4...v3.6.4)

[Compare Source](https://github.com/traefik/traefik-library-image/compare/v3.6.4...v3.6.4)

### [`v3.6.4`](https://github.com/traefik/traefik-library-image/compare/v3.6.2...v3.6.4)

[Compare Source](https://github.com/traefik/traefik-library-image/compare/v3.6.2...v3.6.4)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi4zOS4xIiwidXBkYXRlZEluVmVyIjoiNDIuMzkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYXV0b21lcmdlIiwiaW1hZ2UiXX0=-->

Co-authored-by: Alex Lebens <alexanderlebens@gmail.com>
Reviewed-on: #2295
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

.gitea/workflows/lint-test-docker.yaml

@@ -6,12 +6,14 @@ on:
       - main
     paths:
       - 'hosts/**'
+      - '!clusters/**'
 
   push:
     branches:
       - main
     paths:
       - 'hosts/**'
+      - '!clusters/**'
 
 env:
   BASE_BRANCH: "origin/${{ gitea.base_ref }}"
@@ -36,14 +38,20 @@ jobs:
         id: branch-exists
         if: github.event_name == 'push' || steps.check-branch-exists.outputs.exists == 'true' && github.event_name == 'pull_request'
         run: |
-          echo ">> Branch ${{ gitea.base_ref }} exists, will continue with linting"
+          if [ ${{ github.event_name == 'push' }} ]; then
+            echo ">> Action is from a push event, will continue with linting"
+
+          else
+            echo ">> Branch ${{ gitea.base_ref }} exists, will continue with linting"
+
+          fi
 
           echo "----"
 
           echo "exists=true" >> $GITEA_OUTPUT
 
       - name: Set up Node.js
-        if: steps.check-branch-exists.outputs.exists == 'true'
+        if: steps.branch-exists.outputs.exists == 'true'
         uses: actions/setup-node@v6
         with:
           node-version: '24'
@@ -73,6 +81,7 @@ jobs:
 
             for path in $GIT_DIFF; do
               CHANGED_COMPOSE+=$(echo "$path")
+              CHANGED_COMPOSE+=$(echo " ")
             done
 
           else
@@ -84,27 +93,27 @@ jobs:
           if [ -n "${CHANGED_COMPOSE}" ]; then
             echo ""
             echo ">> Compose to Lint:"
-            echo "$(echo "${CHANGED_COMPOSE[@]}" | sort -u)"
+            echo "$(echo "${CHANGED_COMPOSE}" | sort -u)"
 
             echo "----"
 
             echo "changes-detected=true" >> $GITEA_OUTPUT
             echo "compose-dir<<EOF" >> $GITEA_OUTPUT
-            echo "$(echo "${CHANGED_COMPOSE[@]}" | sort -u)" >> $GITEA_OUTPUT
+            echo "$(echo "${CHANGED_COMPOSE}" | sort -u)" >> $GITEA_OUTPUT
             echo "EOF" >> $GITEA_OUTPUT
           else
             echo "changes-detected=false" >> $GITEA_OUTPUT
           fi
 
       - name: Lint Docker Compose
-        if: steps.check-branch-exists.outputs.exists == 'true'
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
         env:
           CHANGED_COMPOSE: ${{ steps.check-dir-changes.outputs.compose-dir }}
         run: |
           echo ">> Running dclint on changed compose files:"
           echo "$CHANGED_COMPOSE"
 
-          echo "$CHANGED_COMPOSE" | while read -r compose; do
+          for compose in $CHANGED_COMPOSE; do
             echo ">> Linting $compose ..."
             npx dclint $compose
           done

.gitea/workflows/lint-test-helm.yaml

@@ -6,12 +6,14 @@ on:
       - main
     paths:
       - 'clusters/cl01tl/helm/**'
+      - '!hosts/**'
 
   push:
     branches:
       - main
     paths:
       - 'clusters/cl01tl/helm/**'
+      - '!hosts/**'
 
 env:
   CLUSTER: cl01tl
@@ -37,7 +39,13 @@ jobs:
         id: branch-exists
         if: github.event_name == 'push' || steps.check-branch-exists.outputs.exists == 'true' && github.event_name == 'pull_request'
         run: |
-          echo ">> Branch ${{ gitea.base_ref }} exists, will continue with linting"
+          if [ ${{ github.event_name == 'push' }} ]; then
+            echo ">> Action is from a push event, will continue with linting"
+
+          else
+            echo ">> Branch ${{ gitea.base_ref }} exists, will continue with linting"
+
+          fi
 
           echo "----"
 
@@ -48,7 +56,7 @@ jobs:
         uses: azure/setup-helm@v4
         with:
           token: ${{ secrets.GITEA_TOKEN }}
-          version: v3
+          version: v3.19.2
 
       - name: Check Directories for Changes
         id: check-dir-changes
@@ -61,6 +69,7 @@ jobs:
           if [ "${{ github.event_name }}" == "pull_request" ]; then
             echo ""
             echo ">> Checking for changes in a pull request ..."
+            git diff --name-only "${BASE_BRANCH}" | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+"
             GIT_DIFF=$(git diff --name-only "${BASE_BRANCH}" | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+")
           else
             echo ""
@@ -75,6 +84,7 @@ jobs:
 
             for path in $GIT_DIFF; do
               CHANGED_CHARTS+=$(echo "$path" | awk -F '/' '{print $4}')
+              CHANGED_CHARTS+=$(echo " ")
             done
 
           else
@@ -86,13 +96,13 @@ jobs:
           if [ -n "${CHANGED_CHARTS}" ]; then
             echo ""
             echo ">> Chart to Lint:"
-            echo "$(echo "${CHANGED_CHARTS[@]}" | sort -u)"
+            echo "$(echo "${CHANGED_CHARTS}" | sort -u)"
 
             echo "----"
 
             echo "changes-detected=true" >> $GITEA_OUTPUT
             echo "chart-dir<<EOF" >> $GITEA_OUTPUT
-            echo "$(echo "${CHANGED_CHARTS[@]}" | sort -u)" >> $GITEA_OUTPUT
+            echo "$(echo "${CHANGED_CHARTS}" | sort -u)" >> $GITEA_OUTPUT
             echo "EOF" >> $GITEA_OUTPUT
           else
             echo "changes-detected=false" >> $GITEA_OUTPUT

clusters/cl01tl/helm/argo-workflows/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 0.46.1
 - name: argo-events
   repository: https://argoproj.github.io/argo-helm
-  version: 2.4.18
+  version: 2.4.19
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 6.16.1
-digest: sha256:6cc24f6ce2b7f67c2eeab9bb6f64ebfedc082a2e809fc1f03f691f99a3006143
-generated: "2025-12-04T01:01:06.532396136Z"
+digest: sha256:1f98e04526d7b61fa9ee690c46542bcc2ae6b69bf7619e1107a1592386de9bf2
+generated: "2025-12-07T03:02:14.909953853Z"

clusters/cl01tl/helm/argo-workflows/Chart.yaml

@@ -21,7 +21,7 @@ dependencies:
     version: 0.46.1
     repository: https://argoproj.github.io/argo-helm
   - name: argo-events
-    version: 2.4.18
+    version: 2.4.19
     repository: https://argoproj.github.io/argo-helm
   - name: postgres-cluster
     alias: postgres-17-cluster

clusters/cl01tl/helm/argocd/values.yaml

@@ -60,7 +60,7 @@ argo-cd:
     enabled: true
     auth: false
   redisSecretInit:
-    enabled: true
+    enabled: false
   server:
     replicas: 2
     extensions:
@@ -279,7 +279,7 @@ argo-cd:
         - description: Application has degraded
           send:
             - app-health-degraded
-          when: app.status.health.status == 'Degraded' and time.Now().Sub(time.Parse(app.status.health.lastTransitionTime).Minutes() >= 15
+          when: app.status.health.status == 'Degraded'
       trigger.on-sync-failed: |
         - description: Application syncing has failed
           send:

clusters/cl01tl/helm/booklore/values.yaml

@@ -9,7 +9,7 @@ booklore:
         main:
           image:
             repository: ghcr.io/booklore-app/booklore
-            tag: v1.13.1
+            tag: v1.13.2
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/gatus/values.yaml

@@ -140,6 +140,9 @@ gatus:
       - name: audiobookshelf
         url: https://audiobookshelf.alexlebens.net
         <<: *defaults
+      - name: booklore
+        url: https://booklore.alexlebens.net
+        <<: *defaults
       - name: home-assistant
         url: https://home-assistant.alexlebens.net
         <<: *defaults
@@ -176,6 +179,11 @@ gatus:
       - name: n8n
         url: https://n8n.alexlebens.net
         <<: *defaults
+      - name: kronic
+        url: https://kronic.alexlebens.net
+        <<: *defaults
+        conditions:
+          - "[STATUS] == 401"
       - name: omni-tools
         url: https://omni-tools.alexlebens.net
         <<: *defaults
@@ -245,6 +253,9 @@ gatus:
       - name: ceph
         url: https://ceph.alexlebens.net
         <<: *defaults
+      - name: garage
+        url: https://garage-webui.alexlebens.net
+        <<: *defaults
       - name: pgadmin
         url: https://pgadmin.alexlebens.net
         <<: *defaults
@@ -254,6 +265,29 @@ gatus:
       - name: vault
         url: https://vault.alexlebens.net
         <<: *defaults
+      - name: backrest
+        url: https://backrest.alexlebens.net
+        <<: *defaults
+      - name: qui
+        url: https://qui.alexlebens.net
+        <<: *defaults
+      - name: qbittorrent
+        url: https://qbittorrent.alexlebens.net
+        <<: *defaults
+      - name: prowlarr
+        url: https://prowlarr.alexlebens.net
+        <<: *defaults
+      - name: huntarr
+        url: https://huntarr.alexlebens.net
+        <<: *defaults
+      - name: bazarr
+        url: https://bazarr.alexlebens.net
+        <<: *defaults
+        conditions:
+          - "[STATUS] == 401"
+      - name: tdarr
+        url: https://tdarr.alexlebens.net
+        <<: *defaults
       - name: sonarr
         url: https://sonarr.alexlebens.net
         <<: *defaults
@@ -284,25 +318,11 @@ gatus:
       - name: slskd
         url: https://slskd.alexlebens.net
         <<: *defaults
-      - name: qui
-        url: https://qui.alexlebens.net
+      - name: ephemera
+        url: https://ephemera.alexlebens.net
         <<: *defaults
-      - name: qbittorrent
-        url: https://qbittorrent.alexlebens.net
-        <<: *defaults
-      - name: prowlarr
-        url: https://prowlarr.alexlebens.net
-        <<: *defaults
-      - name: bazarr
-        url: https://bazarr.alexlebens.net
-        <<: *defaults
-        conditions:
-          - "[STATUS] == 401"
-      - name: huntarr
-        url: https://huntarr.alexlebens.net
-        <<: *defaults
-      - name: tdarr
-        url: https://tdarr.alexlebens.net
+      - name: listenarr
+        url: https://listenarr.alexlebens.net
         <<: *defaults
       - name: www
         url: https://www.alexlebens.dev
@@ -347,24 +367,14 @@ gatus:
         url: https://codeserver.alexlebens.dev
         <<: *defaults
         group: external
+      - name: authentik
+        url: https://auth.alexlebens.dev
+        <<: *defaults
+        group: external
       - name: public homepage
         url: https://home.alexlebens.dev
         <<: *defaults
         group: external
-      - name: discord
-        group: public
-        url: https://discord.com/app
-        conditions:
-          - "[STATUS] == 200"
-          - "[RESPONSE_TIME] < 400"
-        interval: 10s
-      - name: reddit
-        group: public
-        url: https://reddit.com
-        conditions:
-          - "[STATUS] == 200"
-          - "[RESPONSE_TIME] < 400"
-        interval: 10s
 postgres-17-cluster:
   mode: recovery
   cluster:

clusters/cl01tl/helm/generic-device-plugin/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: generic-device-plugin
   repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-  version: 0.20.4
-digest: sha256:4aa24e57233783f99d3de453f997ff4dddecaea729ab09b78745ee89ffa0e4a8
-generated: "2025-12-06T01:01:30.343689275Z"
+  version: 0.20.5
+digest: sha256:329b2d00301ab1467a8654dd92febfd7078db121c00c0960548010c01dee66b6
+generated: "2025-12-08T03:02:06.697075532Z"

clusters/cl01tl/helm/generic-device-plugin/Chart.yaml

@@ -15,6 +15,6 @@ maintainers:
 dependencies:
   - name: generic-device-plugin
     repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-    version: 0.20.4
+    version: 0.20.5
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: 1.0.0

clusters/cl01tl/helm/gitea/templates/service-monitor.yaml

@@ -12,8 +12,6 @@ spec:
     matchLabels:
       app.kubernetes.io/name: gitea
       app.kubernetes.io/instance: {{ .Release.Name }}
-    matchExpressions:
-      - { key: app.kubernetes.io/controller, operator: NotIn, values: [backup] }
   endpoints:
     - port: http
 

clusters/cl01tl/helm/gitea/values.yaml

@@ -174,6 +174,9 @@ gitea-actions:
 backup:
   global:
     fullnameOverride: gitea-backup
+    labels:
+      app.kubernetes.io/instance: gitea-backup
+      app.kubernetes.io/name: gitea-backup
   controllers:
     backup:
       type: cronjob

clusters/cl01tl/helm/headlamp/templates/cluster-role-binding.yaml

@@ -13,7 +13,7 @@ roleRef:
   apiGroup: rbac.authorization.k8s.io
 subjects:
   - kind: User
-    name: alexanderlebens@gmail.com
+    name: https://authentik.alexlebens.net/application/o/headlamp/#alexanderlebens@gmail.com
     apiGroup: rbac.authorization.k8s.io
   - kind: ServiceAccount
     name: headlamp-admin

clusters/cl01tl/helm/headlamp/templates/external-secret.yaml

@@ -40,14 +40,14 @@ spec:
         key: /authentik/oidc/headlamp
         metadataPolicy: None
         property: scopes
-    - secretKey: OIDC_VALIDATOR_ISSUER_URL
+    - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_IDP_ISSUER_URL
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
         key: /authentik/oidc/headlamp
         metadataPolicy: None
         property: validator-issuer-url
-    - secretKey: OIDC_VALIDATOR_CLIENT_ID
+    - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_CLIENT_ID
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None

clusters/cl01tl/helm/kubelet-serving-cert-approver/values.yaml

@@ -38,7 +38,7 @@ kubelet-serving-cert-approver:
         main:
           image:
             repository: ghcr.io/alex1989hu/kubelet-serving-cert-approver
-            tag: 0.10.0
+            tag: 0.10.1
             pullPolicy: Always
           args:
             - serve

clusters/cl01tl/helm/n8n/values.yaml

@@ -9,7 +9,7 @@ n8n:
         main:
           image:
             repository: ghcr.io/n8n-io/n8n
-            tag: 1.123.1
+            tag: 1.123.3
             pullPolicy: IfNotPresent
           env:
             - name: GENERIC_TIMEZONE
@@ -93,7 +93,7 @@ n8n:
         main:
           image:
             repository: ghcr.io/n8n-io/n8n
-            tag: 1.123.1
+            tag: 1.123.3
             pullPolicy: IfNotPresent
           command:
             - n8n
@@ -188,7 +188,7 @@ n8n:
         main:
           image:
             repository: ghcr.io/n8n-io/n8n
-            tag: 1.123.1
+            tag: 1.123.3
             pullPolicy: IfNotPresent
           command:
             - n8n

clusters/cl01tl/helm/postiz/values.yaml

@@ -9,7 +9,7 @@ postiz:
         main:
           image:
             repository: ghcr.io/gitroomhq/postiz-app
-            tag: v2.9.0
+            tag: v2.10.1
             pullPolicy: IfNotPresent
           env:
             - name: MAIN_URL

clusters/cl01tl/helm/qbittorrent/values.yaml

@@ -28,7 +28,7 @@ qbittorrent:
         qbittorrent:
           image:
             repository: ghcr.io/linuxserver/qbittorrent
-            tag: 5.1.4@sha256:f0465dbb2aa14397fd205a0240ee562eb062354c036ccc444084fe46c6c75091
+            tag: 5.1.4@sha256:043498de39c3dd63eec94360c5ad966a51271d1581070f42cb73ab0cf4776f29
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/searxng/templates/namespace.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: searxng
+  labels:
+    app.kubernetes.io/name: searxng
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: privileged

clusters/cl01tl/helm/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:c25c6b671382f0464318b2de3b142f1c9fe3721e46fdad027f4d6caf399728ea
+            tag: latest@sha256:8354c2e3fdc4e400379c0fa906e42961dfc55a570d9769c70ab07e410dfb1468
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -43,7 +43,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:c25c6b671382f0464318b2de3b142f1c9fe3721e46fdad027f4d6caf399728ea
+            tag: latest@sha256:8354c2e3fdc4e400379c0fa906e42961dfc55a570d9769c70ab07e410dfb1468
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL

clusters/cl01tl/helm/tubearchivist/templates/redis-replication.yaml

@@ -26,7 +26,7 @@ spec:
         accessModes: ["ReadWriteOnce"]
         resources:
           requests:
-            storage: 1Gi
+            storage: 5Gi
   redisExporter:
     enabled: true
     image: quay.io/opstree/redis-exporter:v1.48.0

clusters/cl01tl/helm/whodb/values.yaml

@@ -8,7 +8,7 @@ whodb:
         main:
           image:
             repository: clidey/whodb
-            tag: 0.81.0
+            tag: 0.82.0
             pullPolicy: IfNotPresent
           env:
             - name: WHODB_OLLAMA_HOST

hosts/ps08rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.2
+        image: ghcr.io/traefik/traefik:v3.6.4
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

hosts/ps09rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.2
+        image: ghcr.io/traefik/traefik:v3.6.4
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

hosts/ps10rp/gitea/compose.yaml

@@ -19,7 +19,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     postgresql:
-        image: docker.io/postgres:17.7-alpine3.21
+        image: docker.io/postgres:18.1-alpine3.21
         container_name: gitea-postgres
         env_file:
             - .env

hosts/ps10rp/traefik/compose.yaml

@@ -20,7 +20,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.2
+        image: ghcr.io/traefik/traefik:v3.6.4
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"