Merge pull request 'chore(deps): update tailscale/k8s-nameserver docker tag to v1.98.3' (#7256) from renovate/unified-k8s-nameserver into main

Reviewed-on: #7256

.gitea/workflows/lint-test-docker.yaml

@@ -18,7 +18,7 @@ env:
 
 jobs:
   lint-docker-compose:
-    runs-on: ubuntu-js
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

.gitea/workflows/lint-test-helm.yaml

@@ -21,7 +21,7 @@ env:
 
 jobs:
   lint-helm:
-    runs-on: ubuntu-js
+    runs-on: ubuntu-latest
     outputs:
       chart-dir: ${{ steps.check-dir-changes.outputs.chart-dir }}
       chart-dir-csv: ${{ steps.check-dir-changes.outputs.chart-dir-csv }}
@@ -231,7 +231,7 @@ jobs:
 
   validate-kubeconform:
     needs: lint-helm
-    runs-on: ubuntu-js
+    runs-on: ubuntu-latest
     if: |
       needs.lint-helm.result == 'success' &&
       needs.lint-helm.outputs.changes-detected == 'true' &&

.gitea/workflows/render-manifests.yaml

@@ -24,7 +24,7 @@ env:
 
 jobs:
   render-manifests:
-    runs-on: ubuntu-js
+    runs-on: ubuntu-latest
     if: >-
       github.event_name == 'schedule' ||
       github.event_name == 'workflow_dispatch' ||

.gitea/workflows/renovate.yaml

@@ -12,8 +12,8 @@ on:
 
 jobs:
   renovate:
-    runs-on: ubuntu-js
+    runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.191.2@sha256:539b0ce5f22bcd4b0a42681c0c984afd1c293e2ce5bb12bcb4c01e0f608d60c9
+    container: ghcr.io/renovatebot/renovate:43.195.0@sha256:47421f2f3f82048e969b5195dd808d5ac2c5f69d43d192191c4a3dca390afe06
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

clusters/cl01tl/helm/argocd/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 9.5.14
+  version: 9.5.15
-digest: sha256:5cae964bb988089467bc5c46badbe33b67f64abd039f5961e66e412a5c7004a7
+digest: sha256:e9c84de9594f6fb4e05a0f0c1bd87aea8743fcbae08bd8394ea785c167dfcc11
-generated: "2026-05-13T17:58:34.736881783Z"
+generated: "2026-05-22T01:09:44.579860771Z"

clusters/cl01tl/helm/argocd/Chart.yaml

@@ -13,7 +13,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 9.5.14
+    version: 9.5.15
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-cd

clusters/cl01tl/helm/blocky/values.yaml

@@ -164,7 +164,6 @@ blocky:
               sparkyfitness                   IN      CNAME   traefik-cl01tl
               tdarr                           IN      CNAME   traefik-cl01tl
               tubearchivist                   IN      CNAME   traefik-cl01tl
-              vault                           IN      CNAME   traefik-cl01tl
               whodb                           IN      CNAME   traefik-cl01tl
               yamtrack                        IN      CNAME   traefik-cl01tl
               yubal                           IN      CNAME   traefik-cl01tl

clusters/cl01tl/helm/dawarich/Chart.yaml

@@ -42,4 +42,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/dawarich.png
 # renovate: datasource=github-releases depName=Freika/dawarich
-appVersion: 1.7.8
+appVersion: 1.7.9

clusters/cl01tl/helm/dawarich/values.yaml

@@ -8,7 +8,7 @@ dawarich:
         main:
           image:
             repository: freikin/dawarich
-            tag: 1.7.8@sha256:dea326d03e728cd3b8d051b72d293cf375d0db6c00e22c55f338daedfdfdb3a4
+            tag: 1.7.9@sha256:54329b050caab65f39367308ef7a9f2f3bd1fa3b6ba969d6a33bbf4a0f5e7e84
           command:
             - "web-entrypoint.sh"
           args:
@@ -136,7 +136,7 @@ dawarich:
         sidekiq:
           image:
             repository: freikin/dawarich
-            tag: 1.7.8@sha256:dea326d03e728cd3b8d051b72d293cf375d0db6c00e22c55f338daedfdfdb3a4
+            tag: 1.7.9@sha256:54329b050caab65f39367308ef7a9f2f3bd1fa3b6ba969d6a33bbf4a0f5e7e84
           command:
             - "sidekiq-entrypoint.sh"
           args:

clusters/cl01tl/helm/freshrss/Chart.yaml

@@ -33,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/freshrss.png
 # renovate: datasource=github-releases depName=FreshRSS/FreshRSS
-appVersion: 1.29.0
+appVersion: 1.29.1

clusters/cl01tl/helm/freshrss/values.yaml

@@ -8,7 +8,7 @@ freshrss:
         main:
           image:
             repository: freshrss/freshrss
-            tag: 1.29.0@sha256:cca8988d05cd449e1c6c69405971b1e6fc2c2116ceeb45c9fa3fc33837997a75
+            tag: 1.29.1@sha256:ab6b363102ccdbc39f6a62db926f567c61a5289bf25ba460f1c34423d8cc1a4d
           env:
             - name: PGID
               value: "568"

clusters/cl01tl/helm/gatus/values.yaml

@@ -258,9 +258,6 @@ gatus:
       - name: whodb
         url: https://whodb.alexlebens.net
         <<: *defaults
-      - name: vault
-        url: https://vault.alexlebens.net
-        <<: *defaults
       - name: openbao
         url: https://bao.alexlebens.net
         <<: *defaults

clusters/cl01tl/helm/gitea/Chart.lock

@@ -4,7 +4,7 @@ dependencies:
   version: 12.6.0
 - name: actions
   repository: https://dl.gitea.com/charts/
-  version: 0.1.0
+  version: 0.1.1
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
   version: 0.32.0
@@ -23,5 +23,5 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.0.0
-digest: sha256:f9460da517cf3e230d71a2afd2d5e5d4c6b98e8e021a4aa13dfd34d31170790a
+digest: sha256:c6dbbe309deaa50180021a1bd54a16425591f7081c07165db22c971abfd86ee3
-generated: "2026-05-21T20:06:46.936063837Z"
+generated: "2026-05-22T01:09:01.919731791Z"

clusters/cl01tl/helm/gitea/Chart.yaml

@@ -31,7 +31,7 @@ dependencies:
   - name: actions
     alias: gitea-actions
     repository: https://dl.gitea.com/charts/
-    version: 0.1.0
+    version: 0.1.1
   - name: meilisearch
     version: 0.32.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
@@ -56,4 +56,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/gitea.png
 # renovate: datasource=github-releases depName=go-gitea/gitea
-appVersion: 1.26.1
+appVersion: 1.26.2

clusters/cl01tl/helm/gitea/values.yaml

@@ -9,7 +9,7 @@ gitea:
       maxUnavailable: 1
   image:
     repository: gitea/gitea
-    tag: 1.26.1
+    tag: 1.26.2
   service:
     http:
       type: ClusterIP
@@ -190,11 +190,11 @@ gitea-actions:
               resources:
                 requests:
                   storage: 50Gi
-    actRunner:
+    runner:
       registry: docker.io
-      repository: gitea/act_runner
+      repository: gitea/runner
-      # renovate: datasource=docker depName=gitea/act_runner
+      # renovate: datasource=docker depName=gitea/runner
-      tag: 0.6.1@sha256:b5c35d6bdbb9bb25e531230bfc7cc663cb751406cbec90a2a891b85fea54de86
+      tag: 1.0.5@sha256:1fe8fd56be1fe2a88dfe9c58ba602bc1ad758846dcecdc3ebdc28db63be09e73
       extraVolumeMounts:
         - name: workspace-vol
           mountPath: /workspace
@@ -212,7 +212,7 @@ gitea-actions:
       registry: docker.io
       repository: docker
       # renovate: datasource=docker depName=docker
-      tag: 29.5.0-dind@sha256:8e3fae900cbfbdc14e8abca89a9e44363065cb535f34a09283c59cc0dde2de20
+      tag: 29.5.2-dind@sha256:6b9cd914eb9c6b342c040a49a27a5eb3804453bae6ecc90f7ff96133595a95e8
       extraVolumeMounts:
         - name: docker-vol
           mountPath: /var/lib/docker

clusters/cl01tl/helm/grafana-operator/Chart.lock

@@ -1,7 +1,7 @@
 dependencies:
 - name: grafana-operator
   repository: https://grafana.github.io/helm-charts
-  version: 5.22.2
+  version: 5.23.0
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.15.0
@@ -11,5 +11,5 @@ dependencies:
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.9.0
-digest: sha256:ca936c72d73e72ff0c3b98740e86c0ea78d54c5cf52832b7cfb2839e58b63a69
+digest: sha256:8e441f3d69aa8b4186265cd7b265d75f6faae8883fb4ecb8d23db2d61ec2a954
-generated: "2026-05-21T20:07:25.764466564Z"
+generated: "2026-05-22T00:24:27.626131121Z"

clusters/cl01tl/helm/grafana-operator/Chart.yaml

@@ -16,7 +16,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: grafana-operator
-    version: 5.22.2
+    version: 5.23.0
     repository: https://grafana.github.io/helm-charts
   - name: postgres-cluster
     alias: postgres-18-cluster
@@ -32,4 +32,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grafana.png
 # renovate: datasource=github-releases depName=grafana/grafana-operator
-appVersion: v5.22.2
+appVersion: v5.23.0

clusters/cl01tl/helm/grafana-operator/templates/grafana-dashboard.yaml

@@ -591,24 +591,6 @@ spec:
   resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/rclone.json
 
----
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDashboard
-metadata:
-  name: grafana-dashboard-vault
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: grafana-dashboard-vault
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  instanceSelector:
-    matchLabels:
-      app: grafana-main
-  contentCacheDuration: 6h
-  folderUID: grafana-folder-platform
-  resyncPeriod: 6h
-  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/vault.json
-
 ---
 apiVersion: grafana.integreatly.org/v1beta1
 kind: GrafanaDashboard

clusters/cl01tl/helm/grafana-operator/values.yaml

@@ -3,7 +3,7 @@ grafana-operator:
     registry: ghcr.io
     repository: grafana/grafana-operator
     # renovate: datasource=docker depName=ghcr.io/grafana/grafana-operator
-    tag: v5.22.2@sha256:d45fc24e8f43d83286d81625ee8d919d0fc88255a6500b63f68d7966a4f9e9af
+    tag: v5.23.0@sha256:3abeaccdf54e9e02c2f4b6215be594c8f78b94a866961ada7f92b677bf33c9b4
   replicas: 2
   resources:
     requests:

clusters/cl01tl/helm/home-assistant/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/home-assistant.png
 # renovate: datasource=github-releases depName=home-assistant/core
-appVersion: 2026.5.2
+appVersion: 2026.5.3

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -12,7 +12,7 @@ home-assistant:
         main:
           image:
             repository: ghcr.io/home-assistant/home-assistant
-            tag: 2026.5.3@sha256:ff875078181a0383bf3fca9f061be12d6180896dbd531de04e094e25505b0bb9
+            tag: 2026.5.4@sha256:ceb1202133a5a036e8b03e20a10eb113186cc2f871968323c6fc6c3fc4205716
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/homepage/values.yaml

@@ -601,18 +601,6 @@ homepage:
                   href: https://whodb.alexlebens.net
                   siteMonitor: http://whodb.whodb:80
                   statusStyle: dot
-              - Secrets:
-                  icon: sh-hashicorp-vault.webp
-                  description: Vault
-                  href: https://vault.alexlebens.net
-                  siteMonitor: http://vault.vault:8200
-                  statusStyle: dot
-                  namespace: vault
-                  app: vault
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          vault
-                      )
               - Secrets:
                   icon: sh-openbao.webp
                   description: OpenBao

clusters/cl01tl/helm/jellyfin/Chart.yaml

@@ -30,4 +30,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/jellyfin.png
 # renovate: datasource=github-releases depName=jellyfin/jellyfin
-appVersion: 10.11.8
+appVersion: 10.11.9

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,7 +1,7 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 85.2.0
+  version: 85.2.2
 - name: prometheus-operator-crds
   repository: oci://ghcr.io/prometheus-community/charts
   version: 29.0.0
@@ -11,5 +11,5 @@ dependencies:
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.9.0
-digest: sha256:e3c1fdc244aebd6070497d76b42d104dcb6fa879f2d58b2f6087b7372d800da0
+digest: sha256:1778799905ce3862ad26eecd89ab337fcbf5b8c56e878d67c2a3c464c23c8f63
-generated: "2026-05-21T20:08:30.860041698Z"
+generated: "2026-05-22T18:21:37.821260669Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 85.2.0
+    version: 85.2.2
     repository: oci://ghcr.io/prometheus-community/charts
   - name: prometheus-operator-crds
     version: 29.0.0

clusters/cl01tl/helm/libation/Chart.yaml

@@ -26,4 +26,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/libation.png
 # renovate: datasource=github-releases depName=rmcrackan/Libation
-appVersion: 13.4.2
+appVersion: 13.4.3

clusters/cl01tl/helm/libation/values.yaml

@@ -12,7 +12,7 @@ libation:
         main:
           image:
             repository: rmcrackan/libation
-            tag: 13.4.2@sha256:0544f061512f2c272a153a2d6d4b3cedc276486949808a5e3acd8842dc3cc4c4
+            tag: 13.4.3@sha256:51ba31d839c60599185684615564618dbb669ace677254f56e8419b1ef19c603
           env:
             - name: SLEEP_TIME
               value: "-1"

clusters/cl01tl/helm/openbao/Chart.lock

@@ -1,7 +1,7 @@
 dependencies:
 - name: openbao
   repository: https://openbao.github.io/openbao-helm
-  version: 0.28.2
+  version: 0.28.3
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 5.0.1
@@ -11,5 +11,5 @@ dependencies:
 - name: rclone-bucket
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.11.4
-digest: sha256:bd0ab8f854917701e69215e81bc77899d0365908998d658aba02de4afaffd889
+digest: sha256:5e743ed99053774e3b3bd6afe3c97d85ece29e86f20f81ddfc456e80d10f47a8
-generated: "2026-05-18T02:15:31.062887311Z"
+generated: "2026-05-22T01:11:07.608089959Z"

clusters/cl01tl/helm/openbao/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: openbao
-    version: 0.28.2
+    version: 0.28.3
     repository: https://openbao.github.io/openbao-helm
   - name: app-template
     alias: unseal
@@ -36,4 +36,4 @@ dependencies:
     version: 0.11.4
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/openbao.png
 # renovate: datasource=github-releases depName=openbao/openbao
-appVersion: v2.5.3
+appVersion: v2.5.4

clusters/cl01tl/helm/postiz/values.yaml

@@ -8,7 +8,7 @@ postiz:
         main:
           image:
             repository: ghcr.io/gitroomhq/postiz-app
-            tag: v2.21.7@sha256:29a40ab11ef597c340f7f25764e7f040429c6b72c3eda33d15a429ddb66d0933
+            tag: v2.21.8@sha256:3ec7bc8ecf61f08c22e0954291702b097f944def515dc259cb3a441aba4046c0
           env:
             - name: JWT_SECRET
               valueFrom:

clusters/cl01tl/helm/prowlarr/Chart.yaml

@@ -28,4 +28,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prowlarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-prowlarr
-appVersion: 2.3.5.5327-ls146
+appVersion: 2.3.5.5327-ls147

clusters/cl01tl/helm/rybbit/values.yaml

@@ -112,7 +112,7 @@ rybbit:
         main:
           image:
             repository: clickhouse/clickhouse-server
-            tag: 26.4.2@sha256:6d8f358747b59f7db044749eaf951e828e75cc16f9c487f855b114272c44b82c
+            tag: 26.5.1@sha256:07afc18d8a9706eb9d85c5c5d2752e5270f91bbc2894caeaecb73e4d0f603bf5
           env:
             - name: CLICKHOUSE_DB
               value: analytics

clusters/cl01tl/helm/searxng/values.yaml

@@ -10,7 +10,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:6ba4dc74513d1e3da2bde4a6c419a8c4a0ec3475ada97d9637d8f5a75ec8b595
+            tag: latest@sha256:18ac52ae2235032bb4ce8efaba40548411d93f52644a5cec27fded14e026cb18
           env:
             - name: SEARXNG_BASE_URL
               value: http://searxng-api.searxng:8080
@@ -38,7 +38,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:6ba4dc74513d1e3da2bde4a6c419a8c4a0ec3475ada97d9637d8f5a75ec8b595
+            tag: latest@sha256:18ac52ae2235032bb4ce8efaba40548411d93f52644a5cec27fded14e026cb18
           env:
             - name: SEARXNG_BASE_URL
               value: https://searxng.alexlebens.net/

clusters/cl01tl/helm/site-profile/values.yaml

@@ -10,7 +10,7 @@ site-profile:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-profile
-            tag: 3.20.2@sha256:38dc06984b895fa5efe4ab913990c39c7b603a8daa0bcb06b30d96255be98cc3
+            tag: 3.22.0@sha256:09b0b8635385eb4a18457e0b5fc6e2396d456bf964e54dd073d3524fa29afbf0
           resources:
             requests:
               cpu: 10m

clusters/cl01tl/helm/tailscale-operator/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: tailscale-operator
   repository: https://pkgs.tailscale.com/helmcharts
-  version: 1.96.5
+  version: 1.98.3
-digest: sha256:d7352b6781e248f6fc6bbb06e994c76eed77f06b3beaac6a5707e77df72ccc7d
+digest: sha256:b35ef32920a6099e11aadb3e6f492b2853085c1b1d57d0e421de54922bfeae05
-generated: "2026-04-07T22:47:27.933877961Z"
+generated: "2026-05-22T19:06:26.889427133Z"

clusters/cl01tl/helm/tailscale-operator/Chart.yaml

@@ -17,7 +17,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: tailscale-operator
-    version: 1.96.5
+    version: 1.98.3
     repository: https://pkgs.tailscale.com/helmcharts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tailscale-light.png
 # renovate: datasource=docker depName=tailscale/tailscale

clusters/cl01tl/helm/tailscale-operator/templates/dns-config.yaml

@@ -11,4 +11,4 @@ spec:
     image:
       repo: tailscale/k8s-nameserver
       # renovate: datasource=docker depName=tailscale/k8s-nameserver
-      tag: v1.96.5
+      tag: v1.98.3

clusters/cl01tl/helm/tdarr/values.yaml

@@ -12,7 +12,7 @@ tdarr:
         main:
           image:
             repository: ghcr.io/haveagitgat/tdarr
-            tag: 2.74.01@sha256:4dd21e8aa92f10601c35828566ddaadbb6d9d4335d004411ee69f1e02714d1c8
+            tag: 2.75.01@sha256:d691b283d6498bb43b48753c24d176fc6a849012c33f3518f16394d93d6b6359
           env:
             - name: TZ
               value: America/Chicago
@@ -68,7 +68,7 @@ tdarr:
         main:
           image:
             repository: ghcr.io/haveagitgat/tdarr_node
-            tag: 2.74.01@sha256:1dd3efb3fdb3d29a3aa115bfd0d6a29e87168b44b42614f526dfd9c73410cb5e
+            tag: 2.75.01@sha256:db2b52a1a6fb545a9b0a45952d7f1172e1e23979af638845aea2a76ce2e2e7e6
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/vault/Chart.lock

@@ -1,12 +0,0 @@
-dependencies:
-- name: vault
-  repository: https://helm.releases.hashicorp.com
-  version: 0.32.0
-- name: app-template
-  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.1
-- name: app-template
-  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.1
-digest: sha256:c555a9afad1b13f96d7a94c98182312fae388ab55b26cf177b15a0a4192e879f
-generated: "2026-05-15T00:42:01.447358515Z"

clusters/cl01tl/helm/vault/Chart.yaml

@@ -1,34 +0,0 @@
-apiVersion: v2
-name: vault
-version: 1.0.0
-description: Vault
-keywords:
-  - vault
-  - secrets
-home: https://docs.alexlebens.dev/applications/vault/
-sources:
-  - https://github.com/hashicorp/vault
-  - https://github.com/Angatar/s3cmd
-  - https://github.com/lrstanley/vault-unseal
-  - https://hub.docker.com/r/hashicorp/vault
-  - https://hub.docker.com/r/d3fk/s3cmd/
-  - https://github.com/lrstanley/vault-unseal/pkgs/container/vault-unseal
-  - https://github.com/hashicorp/vault-helm
-  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: vault
-    version: 0.32.0
-    repository: https://helm.releases.hashicorp.com
-  - name: app-template
-    alias: snapshot
-    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.1
-  - name: app-template
-    alias: unseal
-    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.1
-icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/hashicorp-vault.png
-# renovate: datasource=github-releases depName=hashicorp/vault
-appVersion: 2.0.0

clusters/cl01tl/helm/vault/templates/_helpers.tpl

@@ -1,21 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}
-
-{{/*
-ServiceAccount names
-*/}}
-{{- define "custom.serviceAccountName" -}}
-vault
-{{- end -}}

clusters/cl01tl/helm/vault/templates/config-map.yaml

@@ -1,49 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: vault-snapshot-script
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-snapshot-script
-    {{- include "custom.labels" . | nindent 4 }}
-data:
-  snapshot.sh: |
-    DATE=$(date +"%Y%m%d-%H-%M")
-
-    echo " "
-    echo ">> Running Vault Snapshot Script ..."
-
-    echo " "
-    echo ">> Fetching Vault token ..."
-    export VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id=$VAULT_APPROLE_ROLE_ID secret_id=$VAULT_APPROLE_SECRET_ID)
-
-    if [ -z "$VAULT_TOKEN" ]; then
-        echo ">> ERROR: Failed to fetch Vault token! Exiting..."
-        exit 1
-    fi
-
-    echo " "
-    echo ">> Taking Vault snapshot ..."
-    vault operator raft snapshot save /opt/backup/vault-snapshot-$DATE.snap
-
-    echo " "
-    echo ">> Setting ownership of Vault snapshot ..."
-    chown 100:1000 /opt/backup/vault-snapshot-$DATE.snap
-
-    echo " "
-    echo ">> Completed Vault snapshot"
-
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: vault-backup-script
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-backup-script
-    {{- include "custom.labels" . | nindent 4 }}
-data:
-  backup.sh: |
-    echo " ";
-    echo ">> Running S3 backup for Vault snapshot";
-    OUTPUT=$(s3cmd sync --no-check-certificate -v /opt/backup/* "${BUCKET}/cl01tl/cl01tl-vault-snapshots/" 2>&1)

clusters/cl01tl/helm/vault/templates/external-secret.yaml

@@ -1,215 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: vault-token
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-token
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  data:
-    - secretKey: token
-      remoteRef:
-        key: /cl01tl/vault/token
-        property: root
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: vault-snapshot-agent-role
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-snapshot-agent-role
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  data:
-    - secretKey: VAULT_APPROLE_ROLE_ID
-      remoteRef:
-        key: /cl01tl/vault/role/snapshot
-        property: role-id
-    - secretKey: VAULT_APPROLE_SECRET_ID
-      remoteRef:
-        key: /cl01tl/vault/role/snapshot
-        property: secret-id
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: vault-backup-local-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-backup-local-config
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  data:
-    - secretKey: BUCKET
-      remoteRef:
-        key: /garage/home-infra/vault-backups
-        property: BUCKET_PATH
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: vault-backup-remote-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-backup-remote-config
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  data:
-    - secretKey: BUCKET
-      remoteRef:
-        key: /garage/home-infra/vault-backups
-        property: BUCKET_PATH
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: vault-unseal-config-1
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-unseal-config-1
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  data:
-    - secretKey: ENVIRONMENT
-      remoteRef:
-        key: /cl01tl/vault/unseal
-        property: environment
-    - secretKey: NODES
-      remoteRef:
-        key: /cl01tl/vault/unseal
-        property: nodes
-    - secretKey: TOKENS
-      remoteRef:
-        key: /cl01tl/vault/unseal
-        property: tokens-1
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: vault-unseal-config-2
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-unseal-config-2
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  data:
-    - secretKey: ENVIRONMENT
-      remoteRef:
-        key: /cl01tl/vault/unseal
-        property: environment
-    - secretKey: NODES
-      remoteRef:
-        key: /cl01tl/vault/unseal
-        property: nodes
-    - secretKey: TOKENS
-      remoteRef:
-        key: /cl01tl/vault/unseal
-        property: tokens-2
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: vault-unseal-config-3
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-unseal-config-3
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  data:
-    - secretKey: ENVIRONMENT
-      remoteRef:
-        key: /cl01tl/vault/unseal
-        property: environment
-    - secretKey: NODES
-      remoteRef:
-        key: /cl01tl/vault/unseal
-        property: nodes
-    - secretKey: TOKENS
-      remoteRef:
-        key: /cl01tl/vault/unseal
-        property: tokens-3
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: vault-ntfy-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-ntfy-config
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  data:
-    - secretKey: NTFY_TOKEN
-      remoteRef:
-        key: /cl01tl/ntfy/users/cl01tl
-        property: token
-    - secretKey: NTFY_ENDPOINT
-      remoteRef:
-        key: /cl01tl/ntfy/config
-        property: internal-endpoint
-    - secretKey: NTFY_TOPIC
-      remoteRef:
-        key: /cl01tl/ntfy/topics
-        property: vault
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: vault-ntfy-unseal-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-ntfy-unseal-config
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        NOTIFY_QUEUE_URLS: "{{ `{{ .endpoint }}` }}/{{ `{{ .topic }}` }}/?priority=4&tags=vault,unseal&title=Vault+Unsealed"
-  data:
-    - secretKey: endpoint
-      remoteRef:
-        key: /cl01tl/ntfy/users/cl01tl
-        property: internal-endpoint-credential
-    - secretKey: topic
-      remoteRef:
-        key: /cl01tl/ntfy/topics
-        property: vault

clusters/cl01tl/helm/vault/templates/http-route.yaml

@@ -1,26 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: vault
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-  hostnames:
-    - vault.alexlebens.net
-  rules:
-    - matches:
-      - path:
-          type: PathPrefix
-          value: /
-      backendRefs:
-        - group: ''
-          kind: Service
-          name: vault-active
-          port: 8200

clusters/cl01tl/helm/vault/templates/ingress.yaml

@@ -1,28 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: vault-tailscale
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-tailscale
-    {{- include "custom.labels" . | nindent 4 }}
-    tailscale.com/proxy-class: no-metrics
-  annotations:
-    tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"
-spec:
-  ingressClassName: tailscale
-  tls:
-    - hosts:
-        - vault-cl01tl
-      secretName: vault-cl01tl
-  rules:
-    - host: vault-cl01tl
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: vault-active
-                port:
-                  number: 8200

clusters/cl01tl/helm/vault/templates/persistent-volume-claim.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: vault-storage-backup
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-storage-backup
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  volumeMode: Filesystem
-  storageClassName: ceph-filesystem
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/helm/vault/templates/secret-provider-class.yaml

@@ -1,38 +0,0 @@
-apiVersion: secrets-store.csi.x-k8s.io/v1
-kind: SecretProviderClass
-metadata:
-  name: vault-backup-local-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-backup-local-config
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  provider: openbao
-  parameters:
-    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: vault
-    objects: |
-      - objectName: .s3cfg
-        fileName: .s3cfg
-        secretPath: secret/data/garage/home-infra/vault-backups
-        secretKey: s3cfg-local
-
----
-apiVersion: secrets-store.csi.x-k8s.io/v1
-kind: SecretProviderClass
-metadata:
-  name: vault-backup-remote-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-backup-remote-config
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  provider: openbao
-  parameters:
-    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: vault
-    objects: |
-      - objectName: .s3cfg
-        fileName: .s3cfg
-        secretPath: secret/data/garage/home-infra/vault-backups
-        secretKey: s3cfg-remote

clusters/cl01tl/helm/vault/templates/service-account.yaml

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "custom.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
-    {{- include "custom.labels" . | nindent 4 }}

clusters/cl01tl/helm/vault/values.yaml

@@ -1,314 +0,0 @@
-vault:
-  global:
-    serverTelemetry:
-      prometheusOperator: true
-  injector:
-    enabled: false
-  server:
-    enabled: true
-    image:
-      repository: hashicorp/vault
-      tag: 2.0.0@sha256:e40c741ed95bb271425e3e6ca6c222d620cf8682f6f7a1b1e7c9d49d0aba484b
-    updateStrategyType: RollingUpdate
-    logLevel: debug
-    logFormat: standard
-    resources:
-      requests:
-        cpu: 50m
-        memory: 512Mi
-    authDelegator:
-      enabled: false
-    livenessProbe:
-      enabled: false
-    volumes:
-      - name: vault-storage-backup
-        persistentVolumeClaim:
-          claimName: vault-storage-backup
-    volumeMounts:
-      - mountPath: /opt/backups/
-        name: vault-storage-backup
-        readOnly: false
-    dataStorage:
-      size: 1Gi
-      storageClass: ceph-block
-    auditStorage:
-      enabled: false
-      size: 5Gi
-      storageClass: ceph-block
-    standalone:
-      enabled: false
-    ha:
-      enabled: true
-      raft:
-        enabled: true
-        config: |
-          ui = true
-
-          listener "tcp" {
-            tls_disable = 1
-            address = "[::]:8200"
-            cluster_address = "[::]:8201"
-            telemetry {
-              unauthenticated_metrics_access = "true"
-            }
-          }
-
-          storage "raft" {
-            path = "/vault/data"
-            retry_join {
-              leader_api_addr = "http://vault-0.vault-internal:8200"
-            }
-            retry_join {
-              leader_api_addr = "http://vault-1.vault-internal:8200"
-            }
-            retry_join {
-              leader_api_addr = "http://vault-2.vault-internal:8200"
-            }
-          }
-
-          service_registration "kubernetes" {}
-
-          telemetry {
-            prometheus_retention_time = "30s"
-            disable_hostname = true
-          }
-      disruptionBudget:
-        enabled: true
-        maxUnavailable: 1
-  serverTelemetry:
-    serviceMonitor:
-      enabled: true
-    prometheusRules:
-      enabled: true
-      rules:
-        - alert: vault-HighResponseTime
-          annotations:
-            message: The response time of Vault is over 500ms on average over the last 5 minutes.
-          expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 500
-          for: 5m
-          labels:
-            severity: warning
-        - alert: vault-HighResponseTime
-          annotations:
-            message: The response time of Vault is over 1s on average over the last 5 minutes.
-          expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 1000
-          for: 5m
-          labels:
-            severity: critical
-snapshot:
-  global:
-    fullnameOverride: vault-snapshot
-  controllers:
-    snapshot:
-      type: cronjob
-      pod:
-        automountServiceAccountToken: true
-      cronjob:
-        suspend: false
-        timeZone: America/Chicago
-        schedule: 0 4 * * *
-        backoffLimit: 3
-        parallelism: 1
-      initContainers:
-        snapshot:
-          image:
-            repository: hashicorp/vault
-            tag: 2.0.0@sha256:e40c741ed95bb271425e3e6ca6c222d620cf8682f6f7a1b1e7c9d49d0aba484b
-          command:
-            - /bin/ash
-          args:
-            - -ec
-            - /scripts/snapshot.sh
-          envFrom:
-            - secretRef:
-                name: vault-snapshot-agent-role
-          env:
-            - name: VAULT_ADDR
-              value: http://vault-active.vault.svc.cluster.local:8200
-      containers:
-        s3-backup-local:
-          image:
-            repository: d3fk/s3cmd
-            tag: latest@sha256:d66cc5677b30b31a7981f9fde0af064a9072e8b8a57d5e9b4cc02f44f02acbf2
-          command:
-            - /bin/sh
-          args:
-            - -ec
-            - /scripts/backup.sh
-          envFrom:
-            - secretRef:
-                name: vault-ntfy-config
-          env:
-            - name: BUCKET
-              valueFrom:
-                secretKeyRef:
-                  name: vault-backup-local-config
-                  key: BUCKET
-            - name: TARGET
-              value: Local
-        s3-backup-remote:
-          image:
-            repository: d3fk/s3cmd
-            tag: latest@sha256:d66cc5677b30b31a7981f9fde0af064a9072e8b8a57d5e9b4cc02f44f02acbf2
-          command:
-            - /bin/sh
-          args:
-            - -ec
-            - /scripts/backup.sh
-          envFrom:
-            - secretRef:
-                name: vault-ntfy-config
-          env:
-            - name: BUCKET
-              valueFrom:
-                secretKeyRef:
-                  name: vault-backup-remote-config
-                  key: BUCKET
-            - name: TARGET
-              value: Remote
-  persistence:
-    snapshot-script:
-      enabled: true
-      type: configMap
-      name: vault-snapshot-script
-      defaultMode: 0755
-      advancedMounts:
-        snapshot:
-          snapshot:
-            - path: /scripts/snapshot.sh
-              subPath: snapshot.sh
-    backup-script:
-      enabled: true
-      type: configMap
-      name: vault-backup-script
-      defaultMode: 0755
-      advancedMounts:
-        snapshot:
-          s3-backup-local:
-            - path: /scripts/backup.sh
-              subPath: backup.sh
-          s3-backup-remote:
-            - path: /scripts/backup.sh
-              subPath: backup.sh
-          s3-backup-external:
-            - path: /scripts/backup.sh
-              subPath: backup.sh
-    backup-local-config:
-      type: custom
-      volumeSpec:
-        csi:
-          driver: secrets-store.csi.k8s.io
-          readOnly: true
-          volumeAttributes:
-            secretProviderClass: vault-backup-local-config
-      advancedMounts:
-        snapshot:
-          s3-backup-local:
-            - path: /root/.s3cfg
-              readOnly: true
-              mountPropagation: None
-              subPath: .s3cfg
-    backup-remote-config:
-      type: custom
-      volumeSpec:
-        csi:
-          driver: secrets-store.csi.k8s.io
-          readOnly: true
-          volumeAttributes:
-            secretProviderClass: vault-backup-remote-config
-      advancedMounts:
-        snapshot:
-          s3-backup-remote:
-            - path: /root/.s3cfg
-              readOnly: true
-              mountPropagation: None
-              subPath: .s3cfg
-    backup-external-config:
-      type: custom
-      volumeSpec:
-        csi:
-          driver: secrets-store.csi.k8s.io
-          readOnly: true
-          volumeAttributes:
-            secretProviderClass: vault-backup-external-config
-      advancedMounts:
-        snapshot:
-          s3-backup-external:
-            - path: /root/.s3cfg
-              readOnly: true
-              mountPropagation: None
-              subPath: .s3cfg
-    backup:
-      existingClaim: vault-storage-backup
-      advancedMounts:
-        snapshot:
-          snapshot:
-            - path: /opt/backup
-              readOnly: false
-          s3-backup-local:
-            - path: /opt/backup
-              readOnly: false
-          s3-backup-remote:
-            - path: /opt/backup
-              readOnly: false
-          s3-backup-external:
-            - path: /opt/backup
-              readOnly: false
-unseal:
-  global:
-    fullnameOverride: vault-unseal
-  controllers:
-    unseal-1:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      containers:
-        main:
-          image:
-            repository: ghcr.io/lrstanley/vault-unseal
-            tag: 1.0.0@sha256:9b936fadc8dea2a473972806bffc218a4dd2fbc3b373566138a60e058cc544aa
-          envFrom:
-            - secretRef:
-                name: vault-unseal-config-1
-            - secretRef:
-                name: vault-ntfy-unseal-config
-          resources:
-            requests:
-              cpu: 1m
-              memory: 10Mi
-    unseal-2:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      containers:
-        main:
-          image:
-            repository: ghcr.io/lrstanley/vault-unseal
-            tag: 1.0.0@sha256:9b936fadc8dea2a473972806bffc218a4dd2fbc3b373566138a60e058cc544aa
-          envFrom:
-            - secretRef:
-                name: vault-unseal-config-2
-            - secretRef:
-                name: vault-ntfy-unseal-config
-          resources:
-            requests:
-              cpu: 1m
-              memory: 10Mi
-    unseal-3:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      containers:
-        main:
-          image:
-            repository: ghcr.io/lrstanley/vault-unseal
-            tag: 1.0.0@sha256:9b936fadc8dea2a473972806bffc218a4dd2fbc3b373566138a60e058cc544aa
-          envFrom:
-            - secretRef:
-                name: vault-unseal-config-3
-            - secretRef:
-                name: vault-ntfy-unseal-config
-          resources:
-            requests:
-              cpu: 1m
-              memory: 10Mi

hosts/pd05wd/invoke-ai/compose.yaml

@@ -1,6 +1,6 @@
 services:
     tailscale-invoke-ai:
-        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
+        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
         container_name: tailscale-invoke-ai
         cap_add:
             - net_admin

hosts/pd05wd/ollama/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-ollama:
-        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
+        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
         container_name: tailscale-ollama
         cap_add:
             - net_admin

hosts/pd05wd/stable-diffusion/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-stable-diffusion:
-        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
+        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
         container_name: tailscale-stable-diffusion
         cap_add:
             - net_admin

hosts/ps08rp/blocky/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-blocky:
-        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
+        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
         container_name: tailscale-blocky
         cap_add:
             - net_admin

hosts/ps08rp/blocky/config.yml

@@ -142,7 +142,6 @@ customDNS:
     sparkyfitness                   IN      CNAME   traefik-cl01tl
     tdarr                           IN      CNAME   traefik-cl01tl
     tubearchivist                   IN      CNAME   traefik-cl01tl
-    vault                           IN      CNAME   traefik-cl01tl
     whodb                           IN      CNAME   traefik-cl01tl
     yamtrack                        IN      CNAME   traefik-cl01tl
     yubal                           IN      CNAME   traefik-cl01tl

hosts/ps09rp/blocky/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-blocky:
-        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
+        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
         container_name: tailscale-blocky
         cap_add:
             - net_admin

hosts/ps09rp/blocky/config.yml

@@ -163,7 +163,6 @@ customDNS:
     sparkyfitness                   IN      CNAME   traefik-cl01tl
     tdarr                           IN      CNAME   traefik-cl01tl
     tubearchivist                   IN      CNAME   traefik-cl01tl
-    vault                           IN      CNAME   traefik-cl01tl
     whodb                           IN      CNAME   traefik-cl01tl
     yamtrack                        IN      CNAME   traefik-cl01tl
     yubal                           IN      CNAME   traefik-cl01tl

hosts/ps10rp/blocky/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-blocky:
-        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
+        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
         container_name: tailscale-blocky
         cap_add:
             - net_admin

hosts/ps10rp/garage/compose.yaml

@@ -1,6 +1,6 @@
 services:
     tailscale-garage:
-        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
+        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
         container_name: tailscale-garage
         cap_add:
             - net_admin
@@ -20,7 +20,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     tailscale-garage-ui:
-        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
+        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
         container_name: tailscale-garage-ui
         cap_add:
             - net_admin

hosts/ps10rp/gitea/compose.yaml

@@ -1,6 +1,6 @@
 services:
     tailscale-gitea:
-        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
+        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
         container_name: tailscale-gitea
         cap_add:
             - net_admin
@@ -33,7 +33,7 @@ services:
             - postgresql18:/var/lib/postgresql
 
     gitea:
-        image: gitea/gitea:1.26.1@sha256:d8667667b4ccbd1f67b86a376bffcc0a17b16cf71309ed04e3918231776d47dd
+        image: gitea/gitea:1.26.2@sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031
         container_name: gitea
         depends_on:
             - postgresql

hosts/ps10rp/homepage/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-homepage:
-        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
+        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
         container_name: tailscale-homepage
         cap_add:
             - net_admin

hosts/ps10rp/komodo-periphery/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-komodo-periphery:
-        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
+        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
         container_name: tailscale-komodo-periphery
         cap_add:
             - net_admin

hosts/ps10rp/node-exporter/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-node-exporter:
-        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
+        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
         container_name: tailscale-node-exporter
         cap_add:
             - net_admin

hosts/ps10rp/tailscale-subnet/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale:
-        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
+        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
         container_name: tailscale-subnet
         cap_add:
             - net_admin

hosts/ps10rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-traefik:
-        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
+        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
         container_name: tailscale-traefik
         cap_add:
             - net_admin