Update docker.io/postgres Docker tag to v18

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [headlamp](https://headlamp.dev/) ([source](https://github.com/kubernetes-sigs/headlamp)) | minor | `0.37.0` -> `0.38.0` |

---

### Release Notes

<details>
<summary>kubernetes-sigs/headlamp (headlamp)</summary>

### [`v0.38.0`](https://github.com/kubernetes-sigs/headlamp/releases/tag/v0.38.0): 0.38.0

[Compare Source](https://github.com/kubernetes-sigs/headlamp/compare/v0.37.0...v0.38.0)

#### ✨ Enhancements:

- Add custom local port input dialog for port forwarding. Thanks [@&#8203;jaehanbyun](https://github.com/jaehanbyun)
- Add concept of "shipped", "user-installed", and "dev" plugin types
- Add ability to specify priorityClassName in the Headlamp Helm chart. This allows setting the relative priority of Headlamp compared to other Pods when Headlamp is deployed in a cluster. Thanks [@&#8203;mcg1024](https://github.com/mcg1024)

##### Custom Local Port Forwarding Dialog

A custom local port selection dialog for port forwarding was added. Allowing people to specify their preferred local ports (e.g., 8080) instead of only using auto-assigned ports.

<https://github.com/user-attachments/assets/27cab13c-773d-421a-bf9e-1678732aa54c>

##### Enhanced Plugin System to Handle Different Types of Plugins Better

The plugin loading system has been enhanced. It now differentiates plugins by type (shipped with app/user-installed/development) and loads them according to a priority-based system. Development plugins have the highest priority, followed by user-installed, then shipped plugins. When multiple versions of the same plugin exist, only the highest priority enabled version is loaded.

The UI has been enhanced to show the different types of plugins. To also make finding where they are easier.

<img width="935" height="817" alt="New Plugins setting view showing the different types of plugins. It shows if they are loaded, if they are user, dev, or shipped plugins." src="https://github.com/user-attachments/assets/957ae036-fd0b-489a-9786-f9a6a590ac06" />

#### 🐞 Bug fixes

- Fix useAccessToken arg not set when using external secrets in Helm chart. Thanks [@&#8203;rickliujh](https://github.com/rickliujh)
- Fix missing PKCE arg in Helm charts. Thanks [@&#8203;rayshoo](https://github.com/rayshoo)
- Fix Add Local Cluster Provider link on Add Cluster view
- Fix so username is displayed in Top Bar for when Headlamp is behind an Oauth2Proxy
- Remove extra 1px border on top of the Side Bar
- Improve headlamp port clashes for the Headlamp app when it is starting and ports are already used
- Fix reloading of app after plugin install when using Windows app

##### Port Clashes Fixed in Headlamp Desktop App

Before Headlamp tried to listen on port 4466 with the desktop app. If that port was already used then Headlamp would just try to use that existing port. This was problematic of course if there are other apps using that port, or other users on the same machine using that port. Now Headlamp will use another port if that port is already used.

#### 💻 Development

- Remove our homebrew and winget package creation automation, because they are handled by them now
- Add action to push chocolatey package automatically
- Update dependencies for security updates
- Fix storybook theme for plugins, and use correct new logo in storybook for plugins

##### For Plugin Developers: Find Plugin Folder in the UI

To make it easier for plugin developers to find where on the local file system plugins are there is an open plugin folder button. In Plugin Settings select the plugin being developed, and then click the open folder icon to open the plugin path with the Desktop file Finder.

<img width="942" height="434" alt="Shows the UI for finding the plugin folder and the open folder where the plugin is" src="https://github.com/user-attachments/assets/e7fe6c1e-ef30-47e1-b66d-f319fe3e6b47" />

#### 📖 Documentation

- Improve [Projects Learn section](https://headlamp.dev/docs/latest/learn/projects/) in docs
- Add [Local Cluster Learn section](https://headlamp.dev/docs/latest/learn/local-cluster/) to docs
- Fix missing commas in OIDC scopes in some OIDC installation tutorials

<!-- end-release-notes -->

**Full Changelog**: <https://github.com/kubernetes-sigs/headlamp/compare/v0.37.0...v0.38.0>

**Container image:** 🐳  [ghcr.io/headlamp-k8s/headlamp:v0.38.0](https://github.com/orgs/headlamp-k8s/packages/container/package/headlamp)

**Desktop Apps:**

🐧  [Flatpak / Linux (AMD64)](https://flathub.org/apps/details/io.kinvolk.Headlamp)
🐧  Linux AppImage [AMD64](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/Headlamp-0.38.0-linux-x64.AppImage), [ARM64](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/Headlamp-0.38.0-linux-arm64.AppImage),  [ARMv7l](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/Headlamp-0.38.0-linux-armv7l.AppImage)
🐧 Linux Tarball [AMD64](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/Headlamp-0.38.0-linux-x64.tar.gz), [ARM64](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/Headlamp-0.38.0-linux-arm64.tar.gz), [ARMv7l](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/Headlamp-0.38.0-linux-armv7l.tar.gz)
🐧 Debian / Linux [AMD64](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/headlamp_0.38.0-1_amd64.deb)
:green\_apple:  [Mac (AMD64)](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/Headlamp-0.38.0-mac-x64.dmg)
:green\_apple: [Mac (ARM/M1)](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/Headlamp-0.38.0-mac-arm64.dmg)
:blue\_square:  [Windows (AMD64)](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/Headlamp-0.38.0-win-x64.exe)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi41LjAiLCJ1cGRhdGVkSW5WZXIiOiI0Mi41LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImNoYXJ0Il19-->

Reviewed-on: #2019
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

clusters/cl01tl/applications/element-web/Chart.yaml

@@ -17,7 +17,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: element-web
-    version: 1.4.22
+    version: 1.4.23
     repository: https://ananace.gitlab.io/charts
   - name: cloudflared
     alias: cloudflared

clusters/cl01tl/applications/homepage/values.yaml

@@ -522,6 +522,12 @@ homepage:
                   href: https://vault.alexlebens.net
                   siteMonitor: http://vault.vault:8200
                   statusStyle: dot
+              - Backups:
+                  icon: sh-backrest-light.webp
+                  description: Backrest
+                  href: https://backrest.alexlebens.net
+                  siteMonitor: http://backrest.backrest:80
+                  statusStyle: dot
           - TV Shows:
               - Sonarr:
                   icon: sh-sonarr.webp

clusters/cl01tl/applications/lidatube/values.yaml

@@ -13,7 +13,7 @@ lidatube:
         main:
           image:
             repository: thewicklowwolf/lidatube
-            tag: 0.2.40
+            tag: 0.2.41
             pullPolicy: IfNotPresent
           env:
             - name: PUID

clusters/cl01tl/applications/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:d477c0460cc06afa57541f24c7adcae3846303a125c3ae785b9893c9c2c2186f
+            tag: latest@sha256:7b763e6a95da4c5d320ba48c886fa0cae8745337f7510cdf216e96eabdbe0e65
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -43,7 +43,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:d477c0460cc06afa57541f24c7adcae3846303a125c3ae785b9893c9c2c2186f
+            tag: latest@sha256:7b763e6a95da4c5d320ba48c886fa0cae8745337f7510cdf216e96eabdbe0e65
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL

clusters/cl01tl/deployment/argocd/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 9.1.0
+    version: 9.1.1
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 appVersion: 3.0.0

clusters/cl01tl/management/headlamp/Chart.yaml

@@ -14,7 +14,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: headlamp
-    version: 0.37.0
+    version: 0.38.0
     repository: https://kubernetes-sigs.github.io/headlamp/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/headlamp.png
 appVersion: 0.37.0

clusters/cl01tl/platform/matrix-synapse/Chart.yaml

@@ -29,7 +29,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: matrix-synapse
-    version: 3.12.13
+    version: 3.12.14
     repository: https://ananace.gitlab.io/charts
   - name: app-template
     alias: matrix-hookshot

clusters/cl01tl/services/blocky/values.yaml

@@ -109,6 +109,7 @@ blocky:
               argocd                          IN      CNAME   traefik-cl01tl
               audiobookshelf                  IN      CNAME   traefik-cl01tl
               authentik                       IN      CNAME   traefik-cl01tl
+              backrest                        IN      CNAME   traefik-cl01tl
               bazarr                          IN      CNAME   traefik-cl01tl
               calibre                         IN      CNAME   traefik-cl01tl
               calibre-downloader              IN      CNAME   traefik-cl01tl

clusters/cl01tl/standalone/cilium/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: cilium
-    version: 1.18.3
+    version: 1.18.4
     repository: https://helm.cilium.io/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/cilium.png
 appVersion: 1.17.3

clusters/cl01tl/storage/backrest/Chart.yaml

@@ -0,0 +1,21 @@
+apiVersion: v2
+name: backrest
+version: 1.0.0
+description: backrest
+keywords:
+  - backrest
+  - backup
+home: https://wiki.alexlebens.dev/
+sources:
+  - https://github.com/garethgeorge/backrest
+  - https://hub.docker.com/r/garethgeorge/backrest
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: backrest
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.4.0
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/backrest.png
+appVersion: v1.10.1

clusters/cl01tl/storage/backrest/templates/http-route.yaml

@@ -0,0 +1,28 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-route-backrest
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: http-route-backrest
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+  hostnames:
+    - backrest.alexlebens.net
+  rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: /
+      backendRefs:
+        - group: ''
+          kind: Service
+          name: backrest
+          port: 80
+          weight: 100

clusters/cl01tl/storage/backrest/templates/persistent-volume-claim.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: backrest-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: backrest-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  volumeName: backrest-nfs-storage
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi

clusters/cl01tl/storage/backrest/templates/persistent-volume.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: backrest-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: backrest-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: nfs-client
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    path: /volume2/Storage
+    server: synologybond.alexlebens.net
+  mountOptions:
+    - vers=4
+    - minorversion=1
+    - noac

clusters/cl01tl/storage/backrest/templates/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: garage-ps10rp
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: garage-ps10rp
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+  annotations:
+    tailscale.com/tailnet-fqdn: garage-ps10rp.boreal-beaufort.ts.net
+spec:
+  externalName: placeholder
+  type: ExternalName

clusters/cl01tl/storage/backrest/values.yaml

@@ -0,0 +1,77 @@
+backrest:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      containers:
+        main:
+          image:
+            repository: garethgeorge/backrest
+            tag: v1.10.1
+            pullPolicy: IfNotPresent
+          env:
+            - name: TZ
+              value: America/Chicago
+            - name: BACKREST_DATA
+              value: /data
+            - name: BACKREST_CONFIG
+              value: /config/config.json
+            - name: XDG_CACHE_HOME
+              value: /cache
+            - name: TMPDIR
+              value: /tmp
+          resources:
+            requests:
+              cpu: 10m
+              memory: 256Mi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 9898
+          protocol: TCP
+  persistence:
+    data:
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      retain: true
+      advancedMounts:
+        main:
+          main:
+            - path: /data
+              readOnly: false
+    config:
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 1Gi
+      retain: true
+      advancedMounts:
+        main:
+          main:
+            - path: /config
+              readOnly: false
+    cache:
+      type: emptyDir
+      advancedMounts:
+        main:
+          main:
+            - path: /cache
+              readOnly: false
+    tmp:
+      type: emptyDir
+      advancedMounts:
+        main:
+          main:
+            - path: /tmp
+              readOnly: false
+    storage:
+      existingClaim: backrest-nfs-storage
+      advancedMounts:
+        main:
+          main:
+            - path: /userdata
+              readOnly: true

clusters/cl01tl/storage/whodb/values.yaml

@@ -8,7 +8,7 @@ whodb:
         main:
           image:
             repository: clidey/whodb
-            tag: 0.71.0
+            tag: 0.72.0
             pullPolicy: IfNotPresent
           env:
             - name: WHODB_OLLAMA_HOST

hosts/ps08rp/blocky/config.yml

@@ -85,6 +85,7 @@ customDNS:
     argocd                          IN      CNAME   traefik-cl01tl
     audiobookshelf                  IN      CNAME   traefik-cl01tl
     authentik                       IN      CNAME   traefik-cl01tl
+    backrest                        IN      CNAME   traefik-cl01tl
     bazarr                          IN      CNAME   traefik-cl01tl
     calibre                         IN      CNAME   traefik-cl01tl
     calibre-downloader              IN      CNAME   traefik-cl01tl

hosts/ps09rp/blocky/config.yml

@@ -85,6 +85,7 @@ customDNS:
     argocd                          IN      CNAME   traefik-cl01tl
     audiobookshelf                  IN      CNAME   traefik-cl01tl
     authentik                       IN      CNAME   traefik-cl01tl
+    backrest                        IN      CNAME   traefik-cl01tl
     bazarr                          IN      CNAME   traefik-cl01tl
     calibre                         IN      CNAME   traefik-cl01tl
     calibre-downloader              IN      CNAME   traefik-cl01tl

hosts/ps10rp/gitea/compose.yaml

@@ -19,7 +19,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     postgresql:
-        image: docker.io/postgres:17.6-alpine3.21
+        image: docker.io/postgres:18.0-alpine3.21
         container_name: gitea-postgres
         env_file:
             - .env