chore(deps): update cilium to v1.19.2

Reviewed-on: #5916

.gitea/workflows/lint-test-helm.yaml

@@ -16,8 +16,8 @@ on:
 env:
   CLUSTER: cl01tl
   BASE_BRANCH: "origin/${{ github.base_ref }}"
-  # renovate: datasource=github-releases depName=yannh/kubeconform
   KUBECONFORM_VERSION: "v0.6.7"
+  ARGOCD_VERSION: "v3.3.6"
 
 jobs:
   lint-helm:
@@ -102,7 +102,7 @@ jobs:
             echo ""
             echo "${CHANGED_CHARTS}"
 
-            CHANGED_CHARTS_CSV=$(echo "$CHANGED_CHARTS" | paste -sd ',' -)
+            CHANGED_CHARTS_CSV=$(echo "${CHANGED_CHARTS}" | paste -sd ',' -)
 
             echo ""
             echo "----"
@@ -236,7 +236,17 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Cache Kubeconform
+        id: cache-kubeconform
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        with:
+          path: /usr/local/bin/kubeconform
+          key: ${{ runner.os }}-kubeconform-${{ env.KUBECONFORM_VERSION }}
+          restore-keys: |
+            ${{ runner.os }}-kubeconform-
+
       - name: Install Kubeconform
+        if: steps.cache-kubeconform.outputs.cache-hit != 'true'
         run: |
           echo ">> Downloading Kubeconform ${{ env.KUBECONFORM_VERSION }} ..."
           wget -q https://github.com/yannh/kubeconform/releases/download/${{ env.KUBECONFORM_VERSION }}/kubeconform-linux-amd64.tar.gz
@@ -249,6 +259,8 @@ jobs:
           echo ">> Installing Kubeconform ..."
           sudo mv kubeconform /usr/local/bin/
 
+      - name: Verify installation
+        run: |
           echo ""
           echo ">> Verifying installation ..."
           kubeconform -v
@@ -324,7 +336,7 @@ jobs:
 
             helm dependency build "${CHART_PATH}" --skip-refresh
 
-            if ! helm template "${DIR}" "${CHART_PATH}" --include-crds --namespace default --api-versions "gateway.networking.k8s.io/v1/HTTPRoute" | \
+            if ! helm template "${DIR}" "${CHART_PATH}" --include-crds --namespace default --api-versions "gateway.networking.k8s.io/v1/HTTPRoute,monitoring.coreos.com/v1,monitoring.coreos.com/v1/ServiceMonitor" | \
               kubeconform \
                 ${SCHEMA_LOCATIONS} \
                 -ignore-missing-schemas \
@@ -365,3 +377,233 @@ jobs:
           icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
           actions: '[{"action": "view", "label": "View Run", "url": "${{ vars.USER_URL }}/${{ github.repository }}/actions/runs/${{ github.run_id }}", "clear": true}]'
           image: true
+
+  # argo-diff:
+  #   needs: lint-helm
+  #   runs-on: ubuntu-js
+  #   if: |
+  #     needs.lint-helm.result == 'success' &&
+  #     needs.lint-helm.outputs.changes-detected == 'true' &&
+  #     github.event_name == 'pull_request'
+  #   steps:
+  #     - name: Checkout
+  #       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+  #       with:
+  #         fetch-depth: 0
+
+  #     - name: Cache ArgoCD CLI
+  #       id: cache-argocd
+  #       uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+  #       with:
+  #         path: /usr/local/bin/argocd
+  #         key: ${{ runner.os }}-argocd-${{ env.ARGOCD_VERSION }}
+  #         restore-keys: |
+  #           ${{ runner.os }}-argocd-
+
+  #     - name: Install ArgoCD CLI
+  #       if: steps.cache-argocd.outputs.cache-hit != 'true'
+  #       run: |
+  #         echo ">> Downloading ArgoCD CLI, version: ${{ env.ARGOCD_VERSION }} ..."
+  #         curl -sSL -o argocd-linux-amd64 https://github.com/argoproj/argo-cd/releases/download/${{ env.ARGOCD_VERSION }}/argocd-linux-amd64
+
+  #         echo ""
+  #         echo ">> Installing ArgoCD CLI ..."
+  #         sudo install -m 555 argocd-linux-amd64 /usr/local/bin/argocd
+
+  #         echo ""
+  #         echo "----"
+
+  #     - name: Verify installation
+  #       run: |
+  #         echo ""
+  #         echo ">> Verifying installation ..."
+  #         argocd version --client
+
+  #         echo ""
+  #         echo "----"
+
+  #     - name: Set Up Helm
+  #       uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5
+  #       with:
+  #         token: ${{ secrets.GITEA_TOKEN }}
+  #         # renovate: datasource=github-releases depName=helm/helm
+  #         version: v4.1.3
+  #         cache: true
+
+  #     - name: Cache Helm Dependencies
+  #       uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+  #       with:
+  #         path: |
+  #           ~/.cache/helm
+  #           ~/.config/helm
+  #         key: helm-cache-${{ runner.os }}-${{ hashFiles('infrastructure/clusters/cl01tl/helm/**/Chart.yaml', 'infrastructure/clusters/cl01tl/helm/**/Chart.lock') }}
+  #         restore-keys: |
+  #           helm-cache-${{ runner.os }}-
+
+  #     - name: Add Repositories
+  #       env:
+  #         CHANGED_CHARTS: ${{ needs.lint-helm.outputs.chart-dir }}
+  #       run: |
+  #         echo ">> Adding repositories for chart dependencies ..."
+  #         echo ""
+
+  #         for DIR in ${CHANGED_CHARTS}; do
+  #           helm dependency list --max-col-width 120 clusters/${CLUSTER}/helm/${DIR} 2> /dev/null \
+  #             | tail -n +2 \
+  #             | awk 'NF > 0 { print $1, $3 }' \
+  #             | while read -r REPO_NAME REPO_URL; do
+  #               if [[ "${REPO_URL}" == oci://* ]]; then
+  #                 echo ">> Ignoring OCI repo: ${REPO_URL}"
+
+  #               elif [[ -n "${REPO_NAME}" && -n "${REPO_URL}" ]]; then
+  #                 helm repo add "${REPO_NAME}" "${REPO_URL}"
+
+  #               fi
+
+  #             done || true
+  #         done
+
+  #         if helm repo list > /dev/null 2>&1; then
+  #           echo ""
+  #           echo ">> Update repository cache ..."
+  #           helm repo update
+
+  #         fi
+
+  #         echo ""
+  #         echo "----"
+
+  #     - name: Render Templates
+  #       id: render
+  #       env:
+  #         CHANGED_CHARTS: ${{ needs.lint-helm.outputs.chart-dir }}
+  #       run: |
+  #         for APP_NAME in ${CHANGED_CHARTS}; do
+  #           echo ">> Render templates for ${APP_NAME} ..."
+  #           CHART_PATH="clusters/${CLUSTER}/helm/${APP_NAME}"
+  #           OUTPUT_FOLDER="clusters/${CLUSTER}/manifests/${APP_NAME}/"
+
+  #           helm dependency build "${CHART_PATH}" --skip-refresh
+
+  #           NAMESPACE="${APP_NAME}"
+  #           case "${APP_NAME}" in
+  #             "stack")
+  #               NAMESPACE="argocd"
+  #               echo ">> Special Rendering into 'argocd' namespace ..."
+  #               ;;
+  #             "cilium" | "coredns" | "metrics-server")
+  #               NAMESPACE="kube-system"
+  #               echo ">> Special Rendering for ${APP_NAME} into 'kube-system' namespace ..."
+  #               ;;
+  #             *)
+  #               echo ">> Standard Rendering ..."
+  #           esac
+
+  #           TEMPLATE=$(helm template "${APP_NAME}" "${CHART_PATH}" --include-crds --namespace "${NAMESPACE}" --include-crds --api-versions "gateway.networking.k8s.io/v1/HTTPRoute,monitoring.coreos.com/v1,monitoring.coreos.com/v1/ServiceMonitor")
+
+  #           # Format and split rendered template
+  #           echo "${TEMPLATE}" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"${OUTPUT_FOLDER}"'" + .kind + "-" + .metadata.name + ".yaml"'
+
+  #           # Strip comments again to ensure formatting correctness
+  #           for file in "$OUTPUT_FOLDER"/*; do
+  #             yq -i '... comments=""' $file
+
+  #           done
+
+  #           echo ""
+  #           echo ">> Templates in output folder: ${OUTPUT_FOLDER}"
+  #           ls ${OUTPUT_FOLDER}
+  #         done
+
+  #         echo "----"
+
+  #     - name: Run App Diff
+  #       id: diff
+  #       env:
+  #         ARGOCD_SERVER: ${{ secrets.ARGOCD_SERVER }}
+  #         ARGOCD_AUTH_TOKEN: ${{ secrets.ARGOCD_AUTH_TOKEN }}
+  #         CHANGED_CHARTS: ${{ needs.lint-helm.outputs.chart-dir }}
+  #       run: |
+  #         FAILED_CHARTS=""
+  #         DIFF_FOUND="false"
+
+  #         for APP_NAME in ${CHANGED_CHARTS}; do
+  #           echo ">> Running argocd app diff for ${APP_NAME} ..."
+  #           argocd app diff "${APP_NAME}" \
+  #             --server "${ARGOCD_SERVER}" \
+  #             --revision ${{ gitea.sha }} \
+  #             --diff-exit-code 0 \
+  #             --local "clusters/${CLUSTER}/manifests/${APP_NAME}" \
+  #             --local-repo-root "." \
+  #             --grpc-web > "diff_output_${APP_NAME}.txt"
+
+  #           if [ -s "diff_output_${APP_NAME}.txt" ]; then
+  #             echo ">> Argo diff:"
+  #             echo ""
+  #             cat diff_output_${APP_NAME}.txt
+  #             echo ""
+
+  #             DIFF_FOUND="true"
+
+  #           else
+  #             echo ">> No Argo diff found for ${APP_NAME}"
+  #             rm "diff_output_${APP_NAME}.txt"
+
+  #           fi
+  #         done
+
+  #         echo "----"
+  #         echo "diff-detected=${DIFF_FOUND}" >> "$GITHUB_OUTPUT"
+  #         echo "failed-charts=${FAILED_CHARTS}" >> "$GITHUB_OUTPUT"
+
+  #         exit $OVERALL_EXIT_CODE
+
+  #     - name: Post Diff
+  #       if: |
+  #         always() &&
+  #         steps.diff.outputs.diff-detected == 'true' &&
+  #         gitea.event.pull_request.number != null
+  #       env:
+  #         GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+  #       run: |
+  #         COMMENT_BODY="### ArgoCD Diff Results
+  #         "
+
+  #         for f in diff_output_*.txt; do
+  #           APP_NAME=$(echo $f | sed 's/diff_output_//;s/.txt//')
+  #           DIFF_CONTENT=$(cat "$f")
+
+  #           COMMENT_BODY="${COMMENT_BODY}
+  #         #### App: ${APP_NAME}
+  #         "
+
+  #           if [ -z "$DIFF_CONTENT" ]; then
+  #             COMMENT_BODY="${COMMENT_BODY} No changes detected."
+  #           else
+  #             COMMENT_BODY="${COMMENT_BODY}
+  #         \`\`\`diff
+  #         ${DIFF_CONTENT}
+  #         \`\`\`"
+  #           fi
+  #         done
+
+  #         curl -X 'POST' \
+  #           "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/issues/${{ gitea.event.pull_request.number }}/comments" \
+  #           -H "Authorization: token ${GITEA_TOKEN}" \
+  #           -H "Content-Type: application/json" \
+  #           -d "$(jq -n --arg body "$COMMENT_BODY" '{body: $body}')"
+
+  #     - name: ntfy Failed
+  #       uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+  #       if: failure()
+  #       with:
+  #         url: '${{ secrets.NTFY_URL }}'
+  #         topic: '${{ secrets.NTFY_TOPIC }}'
+  #         title: 'ArgoCD Diff Failure'
+  #         priority: 3
+  #         headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+  #         tags: action,failed
+  #         details: "ArgoCD diff for cluster '${{ env.CLUSTER }}' failed on charts: ${{ steps.diff.outputs.failed-charts }}"
+  #         icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+  #         actions: '[{"action": "view", "label": "View Run", "url": "${{ vars.USER_URL }}/${{ github.repository }}/actions/runs/${{ github.run_id }}", "clear": true}]'
+  #         image: true

.gitea/workflows/renovate.yaml

@@ -13,7 +13,7 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.110.4@sha256:7ad99abc53b30d3f6e34df88b3e2b2b75436bba9b290e90d367356526034496f
+    container: ghcr.io/renovatebot/renovate:43.113.0@sha256:9dd3f426078a6ce9461c87264e4bcd1853698dc5ebb594fe5fab1f0afd25ef9b
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

clusters/cl01tl/helm/authentik/Chart.lock

@@ -10,6 +10,6 @@ dependencies:
   version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.6.0
-digest: sha256:6c697902b9c4e997c961b474b55aed3c254d2ef4565f921a1caf023347878718
-generated: "2026-04-10T01:33:14.668094273Z"
+  version: 0.6.1
+digest: sha256:22fe4d9ec592aa74cbff5596e8d900f607bd68ea14c7df70a94b4ef76727614d
+generated: "2026-04-13T20:32:12.748342469Z"

clusters/cl01tl/helm/authentik/Chart.yaml

@@ -29,7 +29,7 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.6.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/authentik.png
 # renovate: datasource=github-releases depName=goauthentik/authentik

clusters/cl01tl/helm/bazarr/values.yaml

@@ -23,10 +23,8 @@ bazarr:
             - name: PGID
               value: 1000
           resources:
-            limits:
-              cpu: 100m
             requests:
-              cpu: 1m
+              cpu: 10m
               memory: 250Mi
         metrics:
           image:

clusters/cl01tl/helm/blocky/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 4.6.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.6.0
-digest: sha256:58bcab9a78afad1037cb9d5047becb7a836fbfb3543883f24764a1bbb8db7290
-generated: "2026-04-10T01:33:35.406965206Z"
+  version: 0.6.1
+digest: sha256:6ed3a7587906fbda581d0091ff2c29a1816b8b0b8ae40add9885e6a68b2b82ae
+generated: "2026-04-13T20:32:34.844998902Z"

clusters/cl01tl/helm/blocky/Chart.yaml

@@ -20,7 +20,7 @@ dependencies:
     version: 4.6.2
   - name: valkey
     alias: valkey
-    version: 0.6.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/blocky.png
 # renovate: datasource=github-releases depName=0xerr0r/blocky

clusters/cl01tl/helm/blocky/values.yaml

@@ -160,6 +160,7 @@ blocky:
               sonarr                          IN      CNAME   traefik-cl01tl
               sonarr-4k                       IN      CNAME   traefik-cl01tl
               sonarr-anime                    IN      CNAME   traefik-cl01tl
+              sparkyfitness                   IN      CNAME   traefik-cl01tl
               stalwart                        IN      CNAME   traefik-cl01tl
               tdarr                           IN      CNAME   traefik-cl01tl
               tubearchivist                   IN      CNAME   traefik-cl01tl

clusters/cl01tl/helm/cert-manager/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: cert-manager
   repository: https://charts.jetstack.io
-  version: v1.20.1
-digest: sha256:1bf36eba44cf096b40355a697b8cffb302f07f9135374222aabdf686f017b7a9
-generated: "2026-03-28T01:35:24.542754563Z"
+  version: v1.20.2
+digest: sha256:f218239b4538c64d57e098a56c69dcbc4e076ffcc3d320c5a5fef1e6309e38cf
+generated: "2026-04-13T23:02:59.380767677Z"

clusters/cl01tl/helm/cert-manager/Chart.yaml

@@ -13,8 +13,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: cert-manager
-    version: v1.20.1
+    version: v1.20.2
     repository: https://charts.jetstack.io
 icon: https://raw.githubusercontent.com/cert-manager/cert-manager/refs/heads/master/logo/logo.png
 # renovate: datasource=github-releases depName=cert-manager/cert-manager
-appVersion: v1.20.1
+appVersion: v1.20.2

clusters/cl01tl/helm/cilium/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: cilium
   repository: https://helm.cilium.io/
-  version: 1.18.6
-digest: sha256:8ea328ac238524b5b423e6289f5e25d05ef64e6aa19cfd5de238f1d5dd533e9b
-generated: "2026-02-05T12:00:20.15778-06:00"
+  version: 1.19.2
+digest: sha256:11f8eef4733b70c2b9a91ce39fe3c1ea1ad3fa3c46750efb015e03ff6ea3655b
+generated: "2026-04-14T01:09:54.031789206Z"

clusters/cl01tl/helm/cilium/Chart.yaml

@@ -14,8 +14,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: cilium
-    version: 1.18.6
+    version: 1.19.2
     repository: https://helm.cilium.io/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/cilium.png
 # renovate: datasource=github-releases depName=cilium/cilium
-appVersion: 1.18.6
+appVersion: 1.19.2

clusters/cl01tl/helm/dawarich/Chart.lock

@@ -7,7 +7,7 @@ dependencies:
   version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.6.0
+  version: 0.6.1
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
@@ -17,5 +17,5 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:46a4d88528ac64e1f228a8516c0fd00e45c2403bdd713140b82e7ab28506ec74
-generated: "2026-04-10T01:34:00.034582668Z"
+digest: sha256:6ece439d5549b7d7ccd75053846bb9b2e8f9798a2e2163eac6f62bf5cf222587
+generated: "2026-04-13T20:32:54.380897459Z"

clusters/cl01tl/helm/dawarich/Chart.yaml

@@ -26,7 +26,7 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.6.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-storage

clusters/cl01tl/helm/directus/Chart.lock

@@ -7,6 +7,6 @@ dependencies:
   version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.6.0
-digest: sha256:1ef062c01049dc3150f24b4bf1502a1026beda856ecca88df70b61701eaf659e
-generated: "2026-04-10T01:34:22.131775797Z"
+  version: 0.6.1
+digest: sha256:78f5065d1125792c88e4d24f5ac1ee3d6310b4997f552020c44d0615335ea329
+generated: "2026-04-13T20:33:13.909018545Z"

clusters/cl01tl/helm/directus/Chart.yaml

@@ -25,7 +25,7 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.6.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/directus.png
 # renovate: datasource=github-releases depName=directus/directus

clusters/cl01tl/helm/eraser/values.yaml

@@ -48,7 +48,7 @@ eraser-metrics:
         main:
           image:
             repository: ghcr.io/open-telemetry/opentelemetry-collector-releases/opentelemetry-collector
-            tag: 0.149.0@sha256:dd56aed607fd02f8ac01dddb27a859c0c2cc750539abce927803778fafc736ae
+            tag: 0.150.1@sha256:618f7867e49fdb173d9b46d535b01f82254b0b14beac6ab1f6f2eb8cf62c5d42
           command:
             - /otelcol
             - --config=/conf/otel-collector-config.yaml

clusters/cl01tl/helm/external-secrets/Chart.lock

@@ -3,4 +3,4 @@ dependencies:
   repository: https://charts.external-secrets.io
   version: 2.3.0
 digest: sha256:fedb79c937be24d4bb72f665122b468b445de95f3f02de419903e3136186e42f
-generated: "2026-04-10T15:05:57.474486384Z"
+generated: "2026-04-10T15:10:52.488487421Z"

clusters/cl01tl/helm/foldergram/Chart.lock

@@ -2,8 +2,11 @@ dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.6.2
+- name: cloudflared
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 2.5.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:59100c6fbfb829f9d703b9ee1cf869c4fd77b6ff53c63b0c644a757223027e58
-generated: "2026-03-22T12:42:43.150705-05:00"
+digest: sha256:06e321d19ffe0df94b3cd6bcc306804729710f74ca2f9962652628377836c33e
+generated: "2026-04-11T15:26:16.743784-05:00"

clusters/cl01tl/helm/foldergram/Chart.yaml

@@ -10,6 +10,7 @@ sources:
   - https://github.com/foldergram/foldergram
   - https://github.com/foldergram/foldergram/pkgs/container/foldergram
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
@@ -18,8 +19,11 @@ dependencies:
     alias: foldergram
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
+  - name: cloudflared
+    repository: oci://harbor.alexlebens.net/helm-charts
+    version: 2.5.0
   - name: volsync-target
-    alias: volsync-target-data
+    alias: volsync-target-db
     version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png

clusters/cl01tl/helm/foldergram/values.yaml

@@ -23,11 +23,13 @@ foldergram:
             - name: GALLERY_ROOT
               value: /gallery
             - name: CSRF_TRUSTED_ORIGINS
-              value: https://foldergram.alexlebens.net
+              value: https://foldergram.alexlebens.net, https://art.alexlebens.dev
+            # - name: PUBLIC_DEMO_MODE
+            #   value: 1
           resources:
             requests:
-              cpu: 1m
-              memory: 230Mi
+              cpu: 10m
+              memory: 1Gi
   service:
     main:
       controller: main
@@ -54,11 +56,21 @@ foldergram:
                 type: PathPrefix
                 value: /
   persistence:
-    cache:
-      forceRename: foldergram-data
+    db:
+      forceRename: foldergram-db
       storageClass: ceph-block
       accessMode: ReadWriteOnce
-      size: 40Gi
+      size: 10Gi
+      advancedMounts:
+        main:
+          main:
+            - path: /app/data/db
+              readOnly: false
+    data:
+      forceRename: foldergram-data
+      storageClass: synology-iscsi-delete
+      accessMode: ReadWriteOnce
+      size: 100Gi
       advancedMounts:
         main:
           main:
@@ -69,10 +81,10 @@ foldergram:
       advancedMounts:
         main:
           main:
-            - path: /gallery/pictures/collections
+            - path: /gallery
               readOnly: true
-volsync-target-data:
-  pvcTarget: foldergram-data
+volsync-target-db:
+  pvcTarget: foldergram-db
   local:
     enabled: true
     schedule: 46 11 * * *

clusters/cl01tl/helm/gatus/values.yaml

@@ -155,8 +155,8 @@ gatus:
       - name: searxng
         url: https://searxng.alexlebens.net
         <<: *defaults
-      - name: roundcube
-        url: https://mail.alexlebens.net
+      - name: sparkyfitness
+        url: https://sparkyfitness.alexlebens.net
         <<: *defaults
       - name: paperless-ngx
         url: https://paperless-ngx.alexlebens.net
@@ -212,6 +212,9 @@ gatus:
       - name: authentik
         url: https://authentik.alexlebens.net
         <<: *defaults
+      - name: roundcube
+        url: https://mail.alexlebens.net
+        <<: *defaults
       - name: stalwart
         url: https://stalwart.alexlebens.net
         <<: *defaults

clusters/cl01tl/helm/generic-device-plugin/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: generic-device-plugin
   repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-  version: 0.20.28
-digest: sha256:16e4470b394110a11721fe38a57ad1cfa7c994bca440bfbbc5b3b7a46a79f165
-generated: "2026-04-05T02:12:22.980217268Z"
+  version: 0.20.30
+digest: sha256:9bc92f3ced6f5bad9f656ce355f5a633c200183f1ab6fa26c897bea9f76054ee
+generated: "2026-04-14T00:59:53.650540444Z"

clusters/cl01tl/helm/generic-device-plugin/Chart.yaml

@@ -14,6 +14,6 @@ maintainers:
 dependencies:
   - name: generic-device-plugin
     repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-    version: 0.20.28
+    version: 0.20.30
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: 1.0.0

clusters/cl01tl/helm/gitea/Chart.lock

@@ -16,12 +16,12 @@ dependencies:
   version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.6.0
+  version: 0.6.1
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.6.0
+  version: 0.6.1
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:1834a2f731f3dfd1f2c1997ef827c941f63436e3d4766b7713771f6ab147a285
-generated: "2026-04-10T01:34:45.637993565Z"
+digest: sha256:c2d6fcbbaffacda0598d81d7d3745e83040d59525ecaccd35d57dce773cf5309
+generated: "2026-04-13T20:33:29.673072156Z"

clusters/cl01tl/helm/gitea/Chart.yaml

@@ -44,11 +44,11 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-gitea
-    version: 0.6.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-renovate
-    version: 0.6.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-storage

clusters/cl01tl/helm/gitea/templates/config-map.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitea-custom-templates
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: gitea-custom-templates
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+data:
+  header.tmpl: |
+    <script defer src="https://rybbit.alexlebens.dev/api/script.js" data-site-id="b515c34a6dcc"></script>

clusters/cl01tl/helm/gitea/values.yaml

@@ -32,6 +32,9 @@ gitea:
     - name: gitea-themes-storage
       persistentVolumeClaim:
         claimName: gitea-themes-storage
+    - name: gitea-custom-templates
+      configMap:
+        name: gitea-custom-templates
   extraInitVolumeMounts:
     - name: gitea-themes-storage
       readOnly: false
@@ -40,6 +43,10 @@ gitea:
     - name: gitea-themes-storage
       readOnly: true
       mountPath: /data/gitea/public/assets/css
+    - name: gitea-custom-templates
+      mountPath: /data/gitea/templates/custom/header.tmpl
+      subPath: header.tmpl
+      readOnly: true
   initPreScript: |
     wget https://github.com/catppuccin/gitea/releases/latest/download/catppuccin-gitea.tar.gz;
     tar -xvzf catppuccin-gitea.tar.gz -C /data/gitea/public/assets/css;

clusters/cl01tl/helm/grafana-operator/Chart.lock

@@ -7,9 +7,9 @@ dependencies:
   version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.6.0
+  version: 0.6.1
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.6.0
-digest: sha256:92931c4ed7e060931fd1aa0e4c3021cc548c1375bdd8a150ed61c858496af72c
-generated: "2026-04-10T01:35:19.405893161Z"
+  version: 0.6.1
+digest: sha256:6c086da896f573fdb1b81abab43b90181f2af7bf57a62333c4426f3f30496ffa
+generated: "2026-04-13T20:33:58.123069628Z"

clusters/cl01tl/helm/grafana-operator/Chart.yaml

@@ -24,11 +24,11 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-unified-alerting
-    version: 0.6.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-remote-cache
-    version: 0.6.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grafana.png
 # renovate: datasource=github-releases depName=grafana/grafana-operator

clusters/cl01tl/helm/harbor/Chart.lock

@@ -7,6 +7,6 @@ dependencies:
   version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.6.0
-digest: sha256:b153dff647b1657cca3e2efc2ad188214496374eed1137f9ecb887184f8a4470
-generated: "2026-04-10T01:35:42.967388076Z"
+  version: 0.6.1
+digest: sha256:fc508a58ea7dffe1b92049a89c3fe2f0034d05ecdad38807bb6e02c68a1cb957
+generated: "2026-04-13T20:34:25.515547207Z"

clusters/cl01tl/helm/harbor/Chart.yaml

@@ -24,7 +24,7 @@ dependencies:
     repository: https://gitea.alexlebens.net/api/packages/alexlebens/helm
   - name: valkey
     alias: valkey
-    version: 0.6.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/harbor.png
 # renovate: datasource=github-releases depName=goharbor/harbor

clusters/cl01tl/helm/home-assistant/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/home-assistant.png
 # renovate: datasource=github-releases depName=home-assistant/core
-appVersion: 2026.4.1
+appVersion: 2026.4.2

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -12,7 +12,7 @@ home-assistant:
         main:
           image:
             repository: ghcr.io/home-assistant/home-assistant
-            tag: 2026.4.1@sha256:8848691147f01a6eee7753de2ade21b04d6168fcd2e2a7089f6f84e3b7b86960
+            tag: 2026.4.2@sha256:4c940155cfd5b0187a6faee2db5d52b98bb573edc1aeee95d0818bb17b6534d7
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/homepage/values.yaml

@@ -285,11 +285,11 @@ homepage:
                   href: https://searxng.alexlebens.net/
                   siteMonitor: http://searxng-browser.searxng:80
                   statusStyle: dot
-              - Email:
-                  icon: sh-roundcube.webp
-                  description: Roundcube
-                  href: https://mail.alexlebens.net
-                  siteMonitor: http://roundcube.roundcube:80
+              - Fitness Tracker:
+                  icon: sh-sparkyfitness.webp
+                  description: Sparky Fitness
+                  href: https://sparkyfitness.alexlebens.net
+                  siteMonitor: http://sparkyfitness-frontend.sparkyfitness:80
                   statusStyle: dot
               - Documents:
                   icon: sh-paperless-ngx.webp
@@ -487,7 +487,13 @@ homepage:
                   href: https://authentik.alexlebens.net
                   siteMonitor: http://authentik-server.authentik:80
                   statusStyle: dot
-              - Email:
+              - Email Client:
+                  icon: sh-roundcube.webp
+                  description: Roundcube
+                  href: https://mail.alexlebens.net
+                  siteMonitor: http://roundcube.roundcube:80
+                  statusStyle: dot
+              - Email Server:
                   icon: sh-stalwart.webp
                   description: Stalwart
                   href: https://stalwart.alexlebens.net

clusters/cl01tl/helm/immich/Chart.lock

@@ -7,9 +7,9 @@ dependencies:
   version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.6.0
+  version: 0.6.1
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:cc71770c9558038b988a2d7a893fffe6ba64a77e8b0d8c403b1183e48d168cd9
-generated: "2026-04-10T01:36:07.229979615Z"
+digest: sha256:73ee46c366adf205ca50a7382a404ccd0e548a2ebeb39fa5f5afbadf6e0d539f
+generated: "2026-04-13T20:34:57.11369553Z"

clusters/cl01tl/helm/immich/Chart.yaml

@@ -25,7 +25,7 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.6.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-data
@@ -33,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/immich.png
 # renovate: datasource=github-releases depName=immich-app/immich
-appVersion: v2.7.2
+appVersion: v2.7.5

clusters/cl01tl/helm/immich/values.yaml

@@ -8,7 +8,7 @@ immich:
         main:
           image:
             repository: ghcr.io/immich-app/immich-server
-            tag: v2.7.2@sha256:6a2952539e2a9c8adcf6fb74850bb1ba7e1db2804050acea21baafdc9154c430
+            tag: v2.7.5@sha256:c15bff75068effb03f4355997d03dc7e0fc58720c2b54ad6f7f10d1bc57efaa5
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/komodo/Chart.yaml

@@ -31,4 +31,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/komodo.png
 # renovate: datasource=github-releases depName=moghtech/komodo
-appVersion: v2.1.1
+appVersion: v2.1.2

clusters/cl01tl/helm/komodo/values.yaml

@@ -8,7 +8,7 @@ komodo:
         main:
           image:
             repository: ghcr.io/moghtech/komodo-core
-            tag: 2.1.1@sha256:2bbbb1efd3534211dac35091e0818f10398d9bdd98fdbf0ddef09e9e0b5ec4ba
+            tag: 2.1.2@sha256:8a7dbba232e4e49797bb412be5f78207c89fcf22cc2727b38631ae30f7518a4c
           env:
             - name: COMPOSE_LOGGING_DRIVER
               value: local

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,7 +1,7 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 83.2.0
+  version: 83.4.1
 - name: prometheus-operator-crds
   repository: oci://ghcr.io/prometheus-community/charts
   version: 28.0.1
@@ -10,6 +10,6 @@ dependencies:
   version: 4.6.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.6.0
-digest: sha256:53540696af31c47db50fcbfef6b74fe08912acb2591f8b911bb292567af29772
-generated: "2026-04-10T01:36:25.114003661Z"
+  version: 0.6.1
+digest: sha256:cdc5f72d9531ec26bfa06a71819a17ba9944ceb6ec8fbf67d3ac8f22431535a5
+generated: "2026-04-13T22:34:25.816994271Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 83.2.0
+    version: 83.4.1
     repository: oci://ghcr.io/prometheus-community/charts
   - name: prometheus-operator-crds
     version: 28.0.1
@@ -31,7 +31,7 @@ dependencies:
     version: 4.6.2
   - name: valkey
     alias: valkey
-    version: 0.6.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prometheus.png
 # renovate: datasource=github-releases depName=prometheus-operator/prometheus-operator

clusters/cl01tl/helm/matrix-synapse/Chart.lock

@@ -22,10 +22,10 @@ dependencies:
   version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.6.0
+  version: 0.6.1
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.6.0
+  version: 0.6.1
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
@@ -38,5 +38,5 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:a3ec2977db9a8d902c8691281e5305f2dfb4501d64591bc67dc2c86e59743133
-generated: "2026-04-10T01:36:45.779720254Z"
+digest: sha256:e3b47e528b086c6f1b2aefb3b429026e77a5e7b95ff3946ef0769b366542ba5a
+generated: "2026-04-13T20:35:45.244907297Z"

clusters/cl01tl/helm/matrix-synapse/Chart.yaml

@@ -54,11 +54,11 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-matrix-synapse
-    version: 0.6.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-hookshot
-    version: 0.6.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-synapse

clusters/cl01tl/helm/medialyze/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/frederikemmer/MediaLyze/d8f69c0628bac7c047b90f91a66341648029c273/frontend/public/favicon.svg
 # renovate: datasource=github-releases depName=frederikemmer/MediaLyze
-appVersion: 0.4.1
+appVersion: 0.6.0

clusters/cl01tl/helm/medialyze/values.yaml

@@ -12,7 +12,7 @@ medialyze:
         main:
           image:
             repository: ghcr.io/frederikemmer/medialyze
-            tag: 0.4.1@sha256:d4f2e04d3759f308bea605c9b7242ab6da98813adc0b276dc3cbe9c283071eb8
+            tag: 0.6.0@sha256:7bf772454c7baeaf5c86ad59eee7fe59ef47b5366248e253647cfc79642a72bf
           env:
             - name: HOST_PORT
               value: 8080

clusters/cl01tl/helm/music-grabber/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/music-grabber.png
 # renovate: datasource=docker depName=g33kphr33k/musicgrabber
-appVersion: 2.6.1
+appVersion: 2.6.2

clusters/cl01tl/helm/music-grabber/values.yaml

@@ -12,7 +12,7 @@ music-grabber:
         main:
           image:
             repository: g33kphr33k/musicgrabber
-            tag: 2.6.1@sha256:52b81df8e69062b4023a416fa4168d4bc0e6d8fba48901a5a5a3080bdd748696
+            tag: 2.6.2@sha256:620441179d3ba9e82eb3ccedef45ee470e30da685891e0defa40ad16cf758d63
           env:
             - name: MUSIC_DIR
               value: /mnt/store/Music Grabber/

clusters/cl01tl/helm/navidrome/values.yaml

@@ -12,7 +12,7 @@ navidrome:
         main:
           image:
             repository: ghcr.io/navidrome/navidrome
-            tag: 0.61.1@sha256:1e1660054a856cc09f227d6929252e45a519fdb16004b464dd637f7294ca3ec1
+            tag: 0.61.2@sha256:9fa40b3d8dec43ceb2213d1fa551da3dcfef6ac6d19c2e534efb92527c2bafd2
           env:
             - name: ND_MUSICFOLDER
               value: /music

clusters/cl01tl/helm/ollama/Chart.yaml

@@ -31,4 +31,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ollama.png
 # renovate: datasource=github-releases depName=ollama/ollama
-appVersion: 0.20.4
+appVersion: 0.20.6

clusters/cl01tl/helm/ollama/values.yaml

@@ -21,7 +21,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.20.3@sha256:87d71eb588a28c747094ca5d011392a3790f6ea9bd9c87594780ad7c65cc7ed1
+            tag: 0.20.6@sha256:d5034f60974be528e0a5523ba5e89156e4a9ffd12d0b2b18475fb148237f3d4c
           env:
             - name: OLLAMA_KEEP_ALIVE
               value: 24h
@@ -55,7 +55,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.20.3@sha256:87d71eb588a28c747094ca5d011392a3790f6ea9bd9c87594780ad7c65cc7ed1
+            tag: 0.20.6@sha256:d5034f60974be528e0a5523ba5e89156e4a9ffd12d0b2b18475fb148237f3d4c
           env:
             - name: OLLAMA_KEEP_ALIVE
               value: 24h
@@ -89,7 +89,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.20.3@sha256:87d71eb588a28c747094ca5d011392a3790f6ea9bd9c87594780ad7c65cc7ed1
+            tag: 0.20.6@sha256:d5034f60974be528e0a5523ba5e89156e4a9ffd12d0b2b18475fb148237f3d4c
           env:
             - name: OLLAMA_KEEP_ALIVE
               value: 24h

clusters/cl01tl/helm/outline/Chart.lock

@@ -10,9 +10,9 @@ dependencies:
   version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.6.0
+  version: 0.6.1
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:dfed4e1149e3daaad1a36f00ad63a3353895799f0bb0c8f4cfa3e5190f04b062
-generated: "2026-04-10T01:37:10.437687272Z"
+digest: sha256:9b15e04e7fc3cec27b64509c22f95e70ae0e8d65f6c1f2ea42ddcdd342545509
+generated: "2026-04-13T20:36:08.758439372Z"

clusters/cl01tl/helm/outline/Chart.yaml

@@ -30,7 +30,7 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.6.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-data

clusters/cl01tl/helm/paperless-ngx/Chart.lock

@@ -7,7 +7,7 @@ dependencies:
   version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.6.0
+  version: 0.6.1
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
@@ -20,5 +20,5 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:d9a1a2c899d5f8cb9cb00d749ea313af889ded789e1d3dadc1df12b7567b9cd1
-generated: "2026-04-10T01:37:28.340143265Z"
+digest: sha256:88f27775fa063ed8595dd46c1c7467f1ee684ea6f68dd47e1198a105757ebcee
+generated: "2026-04-13T20:36:24.921277015Z"

clusters/cl01tl/helm/paperless-ngx/Chart.yaml

@@ -28,7 +28,7 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.6.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-data

clusters/cl01tl/helm/plex/Chart.yaml

@@ -20,4 +20,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/plex.png
 # renovate: datasource=github-releases depName=linuxserver/docker-plex
-appVersion: 1.43.1.10576-06378bdcd-ls300
+appVersion: 1.43.1.10611-1e34174b1-ls301

clusters/cl01tl/helm/plex/values.yaml

@@ -22,7 +22,7 @@ plex:
         main:
           image:
             repository: ghcr.io/linuxserver/plex
-            tag: 1.43.1.10576-06378bdcd-ls300@sha256:09fe33e5efd991681ea3cbd3e3cb262cd1ae26d4a0145a4141ead284d8f21de6
+            tag: 1.43.1.10611-1e34174b1-ls301@sha256:1dd281365d61fb76fd4474ba67e36ec94d2e8dbc67a8032ba10731c01701c97e
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/postiz/Chart.lock

@@ -13,12 +13,12 @@ dependencies:
   version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.6.0
+  version: 0.6.1
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:baf167465e08bfba842267aeb17c8aacc598342766761ceba7e82839d5952e11
-generated: "2026-04-10T01:37:49.479823098Z"
+digest: sha256:5534bfc9e9086db50f191d6369d92dcee2aef4736f40b1a905dfa7b967d3e0b9
+generated: "2026-04-13T20:36:42.977624488Z"

clusters/cl01tl/helm/postiz/Chart.yaml

@@ -39,7 +39,7 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.6.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-config
@@ -51,4 +51,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/postiz.png
 # renovate: datasource=github-releases depName=gitroomhq/postiz-app
-appVersion: v2.21.4
+appVersion: v2.21.6

clusters/cl01tl/helm/postiz/values.yaml

@@ -8,7 +8,7 @@ postiz:
         main:
           image:
             repository: ghcr.io/gitroomhq/postiz-app
-            tag: v2.21.4@sha256:a339e9ee256537526d0eda19e5919e01fa7649a40596ebec5d9e1389850836bc
+            tag: v2.21.6@sha256:c140cd81e4b8269e386e149a9595fdc22a0de3b41368ba6767aeb087c1d14257
           env:
             - name: JWT_SECRET
               valueFrom:
@@ -150,7 +150,7 @@ temporal:
   server:
     image:
       repository: temporalio/server
-      tag: 1.30.3@sha256:a3d0f727caad0ecca5dc6e94766135aab448551f2c6c0d33d3c67576458e6a0d
+      tag: 1.30.4@sha256:0aacc0c00d079aeaf6797b6e845e3e387746733ee077564bfe57ac847fa56837
     metrics:
       serviceMonitor:
         enabled: true
@@ -224,7 +224,7 @@ temporal:
   admintools:
     image:
       repository: temporalio/admin-tools
-      tag: 1.30.3@sha256:2c2272b008f1af295b3719963e6feeef64f838d1105d895cf6acfcf96dd31741
+      tag: 1.30.4@sha256:9ac15d500f4020f7cc694ecc17085dfcfc2d4b1d0d2020dbe83b6f3d49e156e0
     resources:
       requests:
         cpu: 10m
@@ -232,7 +232,7 @@ temporal:
   web:
     image:
       repository: temporalio/ui
-      tag: 2.48.1@sha256:edb5dd1b3e0ddb35611939dde9b573533afd6fbafbbf077b73c7131a30ca91ff
+      tag: 2.48.2@sha256:8625626deb0b2447eff6fc81a1fba1d782c9e41e72d527016f1297a62e715241
     resources:
       requests:
         cpu: 10m

clusters/cl01tl/helm/radarr-4k/Chart.yaml

@@ -33,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/radarr-4k.png
 # renovate: datasource=github-releases depName=linuxserver/docker-radarr
-appVersion: 6.1.1.10360-ls298
+appVersion: 6.1.1.10360-ls299

clusters/cl01tl/helm/radarr-4k/values.yaml

@@ -14,7 +14,7 @@ radarr-4k:
         main:
           image:
             repository: ghcr.io/linuxserver/radarr
-            tag: 6.1.1.10360-ls298@sha256:cd70546fc97169788530386b42cf47ba1b16d091b4dc2264cd54099dd13c6f7f
+            tag: 6.1.1.10360-ls299@sha256:6f1dda18354ea7f28cead8f6d099fc8222498c3ae165f567d504ed04d70980d7
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/radarr-anime/Chart.yaml

@@ -33,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/radarr-anime.png
 # renovate: datasource=github-releases depName=linuxserver/docker-radarr
-appVersion: 6.1.1.10360-ls298
+appVersion: 6.1.1.10360-ls299

clusters/cl01tl/helm/radarr-anime/values.yaml

@@ -14,7 +14,7 @@ radarr-anime:
         main:
           image:
             repository: ghcr.io/linuxserver/radarr
-            tag: 6.1.1.10360-ls298@sha256:cd70546fc97169788530386b42cf47ba1b16d091b4dc2264cd54099dd13c6f7f
+            tag: 6.1.1.10360-ls299@sha256:6f1dda18354ea7f28cead8f6d099fc8222498c3ae165f567d504ed04d70980d7
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/radarr-standup/Chart.yaml

@@ -33,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/radarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-radarr
-appVersion: 6.1.1.10360-ls298
+appVersion: 6.1.1.10360-ls299

clusters/cl01tl/helm/radarr-standup/values.yaml

@@ -14,7 +14,7 @@ radarr-standup:
         main:
           image:
             repository: ghcr.io/linuxserver/radarr
-            tag: 6.1.1.10360-ls298@sha256:cd70546fc97169788530386b42cf47ba1b16d091b4dc2264cd54099dd13c6f7f
+            tag: 6.1.1.10360-ls299@sha256:6f1dda18354ea7f28cead8f6d099fc8222498c3ae165f567d504ed04d70980d7
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/radarr/Chart.yaml

@@ -33,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/radarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-radarr
-appVersion: 6.1.1.10360-ls298
+appVersion: 6.1.1.10360-ls299

clusters/cl01tl/helm/radarr/values.yaml

@@ -14,7 +14,7 @@ radarr:
         main:
           image:
             repository: ghcr.io/linuxserver/radarr
-            tag: 6.1.1.10360-ls298@sha256:cd70546fc97169788530386b42cf47ba1b16d091b4dc2264cd54099dd13c6f7f
+            tag: 6.1.1.10360-ls299@sha256:6f1dda18354ea7f28cead8f6d099fc8222498c3ae165f567d504ed04d70980d7
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/reloader/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: reloader
   repository: https://stakater.github.io/stakater-charts
-  version: 2.2.9
-digest: sha256:9926bf770a774f391fae9ec2d8db4bd5f37f5fe14439326da1c1b592795f0d2b
-generated: "2026-03-06T04:03:42.972601201Z"
+  version: 2.2.10
+digest: sha256:87ae8d844f1b602a109e306e00b2f06060443fd9ef5d97689e89a84950b9fdd6
+generated: "2026-04-13T20:31:19.310944569Z"

clusters/cl01tl/helm/reloader/Chart.yaml

@@ -13,8 +13,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: reloader
-    version: 2.2.9
+    version: 2.2.10
     repository: https://stakater.github.io/stakater-charts
 icon: https://raw.githubusercontent.com/stakater/Reloader/refs/heads/master/assets/web/reloader.jpg
 # renovate: datasource=github-releases depName=stakater/Reloader
-appVersion: v1.4.14
+appVersion: v1.4.15

clusters/cl01tl/helm/rybbit/values.yaml

@@ -112,7 +112,7 @@ rybbit:
         main:
           image:
             repository: clickhouse/clickhouse-server
-            tag: 26.3.4@sha256:e9de4678349386db2bd6282aa71e93ef465912ae9fa419ead2e83eb1cbce7a4a
+            tag: 26.3.8@sha256:b8143a77145db9409f818f3617c114ffef4d37a5022052723aa2915e2f72c124
           env:
             - name: CLICKHOUSE_DB
               value: analytics

clusters/cl01tl/helm/searxng/values.yaml

@@ -8,7 +8,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:e314fcbbfb221777f5599ce20c0c48c5d78a876a278bad4a50adc9aa5b661d3a
+            tag: latest@sha256:4c6b4f3e1fc10a907a40b7eaaf5b92d50f5b4097d6fb5b02041c0f9926233b36
           env:
             - name: SEARXNG_BASE_URL
               value: http://searxng-api.searxng:8080
@@ -36,7 +36,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:e314fcbbfb221777f5599ce20c0c48c5d78a876a278bad4a50adc9aa5b661d3a
+            tag: latest@sha256:4c6b4f3e1fc10a907a40b7eaaf5b92d50f5b4097d6fb5b02041c0f9926233b36
           env:
             - name: SEARXNG_BASE_URL
               value: https://searxng.alexlebens.net/

clusters/cl01tl/helm/seerr/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: seerr-chart
   repository: oci://ghcr.io/seerr-team/seerr
-  version: 3.4.1
+  version: 3.4.2
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:821fc73d7411c89f0eba2c35a7a455523dadaa4f9d5149b17b2c96cf594f5e1a
-generated: "2026-04-08T17:24:50.724009386Z"
+digest: sha256:f9f2649fcd5ae23d2e8bedc81c8dec7c65464328901c4fd4e47b00549e315514
+generated: "2026-04-13T18:43:39.927316242Z"

clusters/cl01tl/helm/seerr/Chart.yaml

@@ -17,11 +17,11 @@ maintainers:
 dependencies:
   - name: seerr-chart
     repository: oci://ghcr.io/seerr-team/seerr
-    version: 3.4.1
+    version: 3.4.2
   - name: volsync-target
     alias: volsync-target-config
     version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/seerr.png
 # renovate: datasource=github-releases depName=seerr-team/seerr
-appVersion: v3.1.0
+appVersion: v3.1.1

clusters/cl01tl/helm/seerr/values.yaml

@@ -2,7 +2,7 @@ seerr-chart:
   image:
     registry: ghcr.io
     repository: seerr-team/seerr
-    tag: v3.1.0
+    tag: v3.1.1
     sha: b35ba0461c4a1033d117ac1e5968fd4cbe777899e4cbfbdeaf3d10a42a0eb7e9
   config:
     persistence:

clusters/cl01tl/helm/shelly-plug/values.yaml

@@ -30,7 +30,7 @@ shelly-plug:
         main:
           image:
             repository: php
-            tag: 8.5.4-apache@sha256:e55a9f8e4caa09c6a31ec752b307675d847bb8546d975f379128cb2a99842b96
+            tag: 8.5.5-apache@sha256:103a8cd59a029b387470deace9736a7bc5aeb167a746774c68da82bb469c578c
           env:
             - name: SHELLY_HOSTNAME
               value: it05sp.alexlebens.net

clusters/cl01tl/helm/site-documentation/values.yaml

@@ -10,7 +10,7 @@ site-documentation:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-documentation
-            tag: 0.23.0@sha256:d185fc8513362aab1663016deb2ce43ed6b4e6077685848f500c28d2d2cfd290
+            tag: 0.25.0@sha256:1509b20e703617ce8e6fc78fa599a56c09be178541adc82da406632f9af15d97
           resources:
             requests:
               cpu: 10m

clusters/cl01tl/helm/site-profile/values.yaml

@@ -10,7 +10,7 @@ site-profile:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-profile
-            tag: 3.17.0@sha256:22c5bebe1148c019cdd50c2da06d9e8679e1b2653762cb3f3febf1aba75c309f
+            tag: 3.18.1@sha256:94c120ecd381b4e1568e1fe6619b3472d58870a5a5c5da4bc4b40e0e6b6cbfb1
           resources:
             requests:
               cpu: 10m

clusters/cl01tl/helm/site-saralebens/values.yaml

@@ -10,7 +10,7 @@ site-saralebens:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-saralebens
-            tag: 1.1.0@sha256:118dd5c65edcc0c77b00bbb6d9c70aab307aa04ba211f3fd74435e9b06c38304
+            tag: 1.1.1@sha256:b1a92f492127dd0e6b1756dd6798e72fbc991c7b334c0bec87ba39cb9bb14ee3
           resources:
             requests:
               cpu: 10m

clusters/cl01tl/helm/sonarr-4k/Chart.yaml

@@ -33,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/sonarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-sonarr
-appVersion: 4.0.17.2952-ls306
+appVersion: 4.0.17.2952-ls307

clusters/cl01tl/helm/sonarr-4k/values.yaml

@@ -13,7 +13,7 @@ sonarr-4k:
         main:
           image:
             repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.17.2952-ls306@sha256:b5670a3adb0f8a8b0f277feeaa69a5fbe3869ba4bb9fa7c0f0764c3b3f0e698f
+            tag: 4.0.17.2952-ls307@sha256:6854df9de20b8c82e1982604f39473d64dbb4c4584b1013f18f9ade1ee92af13
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/sonarr-anime/Chart.yaml

@@ -33,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/sonarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-sonarr
-appVersion: 4.0.17.2952-ls306
+appVersion: 4.0.17.2952-ls307

clusters/cl01tl/helm/sonarr-anime/values.yaml

@@ -13,7 +13,7 @@ sonarr-anime:
         main:
           image:
             repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.17.2952-ls306@sha256:b5670a3adb0f8a8b0f277feeaa69a5fbe3869ba4bb9fa7c0f0764c3b3f0e698f
+            tag: 4.0.17.2952-ls307@sha256:6854df9de20b8c82e1982604f39473d64dbb4c4584b1013f18f9ade1ee92af13
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/sonarr/Chart.yaml

@@ -33,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/sonarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-sonarr
-appVersion: 4.0.17.2952-ls306
+appVersion: 4.0.17.2952-ls307

clusters/cl01tl/helm/sonarr/values.yaml

@@ -12,7 +12,7 @@ sonarr:
         main:
           image:
             repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.17.2952-ls306@sha256:b5670a3adb0f8a8b0f277feeaa69a5fbe3869ba4bb9fa7c0f0764c3b3f0e698f
+            tag: 4.0.17.2952-ls307@sha256:6854df9de20b8c82e1982604f39473d64dbb4c4584b1013f18f9ade1ee92af13
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/sparkyfitness/Chart.lock

@@ -0,0 +1,12 @@
+dependencies:
+- name: sparkyfitness
+  repository: oci://ghcr.io/codewithcj/charts
+  version: 0.16.5-7
+- name: postgres-cluster
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 7.11.2
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.8.0
+digest: sha256:cbe47d5c90cb22ba40b6de948b0a49733c6ce40b1be92555d5df3f0f1e610950
+generated: "2026-04-13T19:27:44.289967-05:00"

clusters/cl01tl/helm/sparkyfitness/Chart.yaml

@@ -0,0 +1,32 @@
+apiVersion: v2
+name: sparkyfitness
+version: 1.0.0
+description: Sparky Fitness
+keywords:
+  - sparky-fitness
+  - fitness-tracking
+home: https://docs.alexlebens.dev/applications/sparkyfitness/
+sources:
+  - https://github.com/CodeWithCJ/SparkyFitness
+  - https://github.com/CodeWithCJ/SparkyFitness/pkgs/container/sparkyfitness-server
+  - https://github.com/CodeWithCJ/SparkyFitness/pkgs/container/sparkyfitness-frontend
+  - https://github.com/CodeWithCJ/SparkyFitness/tree/main/helm/chart
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: sparkyfitness
+    version: 0.16.5-7
+    repository: oci://ghcr.io/codewithcj/charts
+  - name: postgres-cluster
+    alias: postgres-18-cluster
+    version: 7.11.2
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-backup
+    version: 0.8.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/sparkyfitness.png
+# renovate: datasource=github-releases depName=CodeWithCJ/SparkyFitness
+appVersion: v0.16.5.7

clusters/cl01tl/helm/sparkyfitness/templates/external-secret.yaml

@@ -0,0 +1,46 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: sparkyfitness-key-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: sparkyfitness-key-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: api_encryption_key
+      remoteRef:
+        key: /cl01tl/sparkyfitness/key
+        property: api_encryption_key
+    - secretKey: better_auth_secret
+      remoteRef:
+        key: /cl01tl/sparkyfitness/key
+        property: better_auth_secret
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: sparkyfitness-oidc-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: sparkyfitness-oidc-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: client_id
+      remoteRef:
+        key: /authentik/oidc/sparkyfitness
+        property: client
+    - secretKey: client_secret
+      remoteRef:
+        key: /authentik/oidc/sparkyfitness
+        property: secret

clusters/cl01tl/helm/sparkyfitness/values.yaml

@@ -0,0 +1,101 @@
+sparkyfitness:
+  config:
+    timezone: America/Chicago
+    allowPrivateNetworkCors: true
+    extraTrustedOrigins: https://sparkyfitness.alexlebens.net
+    oidc:
+      enabled: true
+      providerSlug: sparky-fitness
+      providerName: Authentik
+      issuerUrl: https://authentik.alexlebens.net/application/o/sparky-fitness
+      logoUrl: https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/authentik.webp
+      secrets:
+        existingSecret: sparkyfitness-oidc-secret
+  httpRoute:
+    enabled: true
+    hostname: sparkyfitness.alexlebens.net
+    parentRef:
+      name: traefik-gateway
+      namespace: traefik
+  server:
+    image:
+      repository: ghcr.io/codewithcj/sparkyfitness-server
+      tag: v0.16.5.7@sha256:7cdb8cb3ae7f90c7590dac3b92cea3a8e24d51b28eb836a1f6d5201cd45bc080
+    resources:
+      requests:
+        cpu: 100m
+        memory: 200Mi
+      limits:
+        cpu: null
+        memory: null
+    secrets:
+      generate: false
+      existingSecret: sparkyfitness-key-secret
+    appDatabase:
+      existingSecret: sparkyfitness-postgresql-18-cluster-app
+    persistence:
+      backup:
+        size: 5Gi
+        accessMode: ReadWriteOnce
+        storageClass: ceph-block
+      uploads:
+        size: 10Gi
+        accessMode: ReadWriteOnce
+        storageClass: ceph-block
+  frontend:
+    image:
+      repository: ghcr.io/codewithcj/sparkyfitness-frontend
+      tag: v0.16.5.7@sha256:c57a0a07b3470bd0c280d63d02b45adfe7360441b396e9bd445d7b0d22823356
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+      limits:
+        cpu: null
+        memory: null
+  postgresql:
+    enabled: false
+  externalDatabase:
+    host: sparkyfitness-postgresql-18-cluster-rw
+    port: 5432
+    database: app
+    auth:
+      existingSecret: sparkyfitness-postgresql-18-cluster-superuser
+postgres-18-cluster:
+  mode: recovery
+  cluster:
+    enableSuperuserAccess: true
+    initdb:
+      postInitTemplateSQL:
+        - CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+        - CREATE EXTENSION IF NOT EXISTS "pgcrypto";
+        - CREATE EXTENSION IF NOT EXISTS "pg_stat_statements";
+        - GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO "app" WITH GRANT OPTION;
+  recovery:
+    method: objectStore
+    objectStore:
+      index: 1
+  backup:
+    objectStore:
+      - name: garage-local
+        index: 1
+        destinationBucket: postgres-backups
+        externalSecretCredentialPath: /garage/home-infra/postgres-backups
+        isWALArchiver: true
+    scheduledBackups:
+      - name: live-backup
+        suspend: false
+        immediate: true
+        schedule: "0 0 16 * * *"
+        backupName: garage-local
+volsync-target-backup:
+  pvcTarget: sparkyfitness-server-backup
+  local:
+    enabled: true
+    schedule: 26 11 * * *
+  remote:
+    enabled: true
+    schedule: 26 12 * * *
+  external:
+    enabled: true
+    schedule: 26 13 * * *

clusters/cl01tl/helm/speedtest-exporter/values.yaml

@@ -10,8 +10,8 @@ speedtest-exporter:
     runAsNonRoot: true
     runAsUser: 1000
   resources:
-    limits:
-      cpu: 1m
+    requests:
+      cpu: 10m
       memory: 30Mi
   serviceMonitor:
     interval: 180m

clusters/cl01tl/helm/stalwart/Chart.lock

@@ -7,9 +7,9 @@ dependencies:
   version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.6.0
+  version: 0.6.1
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:d7c2cebff885977642306d8f55fe9547ab80d26f360986f873f3106789f50083
-generated: "2026-04-10T01:38:12.691274606Z"
+digest: sha256:43cd8aaed427de6d753914a639d497393bea839a37431db8b4461d977299b378
+generated: "2026-04-13T20:37:07.401151724Z"

clusters/cl01tl/helm/stalwart/Chart.yaml

@@ -26,7 +26,7 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.6.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-config

clusters/cl01tl/helm/tubearchivist/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 4.6.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.6.0
-digest: sha256:2b8f3071852e7025428e57e8460f981fbd9192184ac4afb4cd23ba6b4d90f097
-generated: "2026-04-10T01:38:33.594012137Z"
+  version: 0.6.1
+digest: sha256:30856a39a1cd1670a9ab26be30c64d82c19e1283e998b9eeab2df058ea28d284
+generated: "2026-04-13T20:37:24.431820385Z"

clusters/cl01tl/helm/tubearchivist/Chart.yaml

@@ -24,7 +24,7 @@ dependencies:
     version: 4.6.2
   - name: valkey
     alias: valkey
-    version: 0.6.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tube-archivist.png
 # renovate: datasource=github-releases depName=tubearchivist/tubearchivist

clusters/cl01tl/helm/vault/templates/external-secret.yaml

@@ -138,40 +138,20 @@ spec:
   data:
     - secretKey: ENVIRONMENT
       remoteRef:
-        key: /cl01tl/vault/unseal/config-1
+        key: /cl01tl/vault/unseal
         property: ENVIRONMENT
-    - secretKey: CHECK_INTERVAL
-      remoteRef:
-        key: /cl01tl/vault/unseal/config-1
-        property: CHECK_INTERVAL
-    - secretKey: MAX_CHECK_INTERVAL
-      remoteRef:
-        key: /cl01tl/vault/unseal/config-1
-        property: MAX_CHECK_INTERVAL
     - secretKey: NODES
       remoteRef:
-        key: /cl01tl/vault/unseal/config-1
+        key: /cl01tl/vault/unseal
         property: NODES
-    - secretKey: TLS_SKIP_VERIFY
-      remoteRef:
-        key: /cl01tl/vault/unseal/config-1
-        property: TLS_SKIP_VERIFY
     - secretKey: TOKENS
       remoteRef:
-        key: /cl01tl/vault/unseal/config-1
-        property: TOKENS
-    - secretKey: EMAIL_ENABLED
+        key: /cl01tl/vault/unseal
+        property: TOKENS_1
+    - secretKey: NOTIFY_QUEUE_URLS
       remoteRef:
-        key: /cl01tl/vault/unseal/config-1
-        property: EMAIL_ENABLED
-    - secretKey: NOTIFY_MAX_ELAPSED
-      remoteRef:
-        key: /cl01tl/vault/unseal/config-1
-        property: NOTIFY_MAX_ELAPSED
-    - secretKey: NOTIFY_QUEUE_DELAY
-      remoteRef:
-        key: /cl01tl/vault/unseal/config-1
-        property: NOTIFY_QUEUE_DELAY
+        key: /cl01tl/vault/unseal
+        property: NOTIFY_QUEUE_URLS
 
 ---
 apiVersion: external-secrets.io/v1
@@ -190,40 +170,20 @@ spec:
   data:
     - secretKey: ENVIRONMENT
       remoteRef:
-        key: /cl01tl/vault/unseal/config-2
+        key: /cl01tl/vault/unseal
         property: ENVIRONMENT
-    - secretKey: CHECK_INTERVAL
-      remoteRef:
-        key: /cl01tl/vault/unseal/config-2
-        property: CHECK_INTERVAL
-    - secretKey: MAX_CHECK_INTERVAL
-      remoteRef:
-        key: /cl01tl/vault/unseal/config-2
-        property: MAX_CHECK_INTERVAL
     - secretKey: NODES
       remoteRef:
-        key: /cl01tl/vault/unseal/config-2
+        key: /cl01tl/vault/unseal
         property: NODES
-    - secretKey: TLS_SKIP_VERIFY
-      remoteRef:
-        key: /cl01tl/vault/unseal/config-2
-        property: TLS_SKIP_VERIFY
     - secretKey: TOKENS
       remoteRef:
-        key: /cl01tl/vault/unseal/config-2
-        property: TOKENS
-    - secretKey: EMAIL_ENABLED
+        key: /cl01tl/vault/unseal
+        property: TOKENS_2
+    - secretKey: NOTIFY_QUEUE_URLS
       remoteRef:
-        key: /cl01tl/vault/unseal/config-2
-        property: EMAIL_ENABLED
-    - secretKey: NOTIFY_MAX_ELAPSED
-      remoteRef:
-        key: /cl01tl/vault/unseal/config-2
-        property: NOTIFY_MAX_ELAPSED
-    - secretKey: NOTIFY_QUEUE_DELAY
-      remoteRef:
-        key: /cl01tl/vault/unseal/config-2
-        property: NOTIFY_QUEUE_DELAY
+        key: /cl01tl/vault/unseal
+        property: NOTIFY_QUEUE_URLS
 
 ---
 apiVersion: external-secrets.io/v1
@@ -242,40 +202,20 @@ spec:
   data:
     - secretKey: ENVIRONMENT
       remoteRef:
-        key: /cl01tl/vault/unseal/config-3
+        key: /cl01tl/vault/unseal
         property: ENVIRONMENT
-    - secretKey: CHECK_INTERVAL
-      remoteRef:
-        key: /cl01tl/vault/unseal/config-3
-        property: CHECK_INTERVAL
-    - secretKey: MAX_CHECK_INTERVAL
-      remoteRef:
-        key: /cl01tl/vault/unseal/config-3
-        property: MAX_CHECK_INTERVAL
     - secretKey: NODES
       remoteRef:
-        key: /cl01tl/vault/unseal/config-3
+        key: /cl01tl/vault/unseal
         property: NODES
-    - secretKey: TLS_SKIP_VERIFY
-      remoteRef:
-        key: /cl01tl/vault/unseal/config-3
-        property: TLS_SKIP_VERIFY
     - secretKey: TOKENS
       remoteRef:
-        key: /cl01tl/vault/unseal/config-3
-        property: TOKENS
-    - secretKey: EMAIL_ENABLED
+        key: /cl01tl/vault/unseal
+        property: TOKENS_3
+    - secretKey: NOTIFY_QUEUE_URLS
       remoteRef:
-        key: /cl01tl/vault/unseal/config-3
-        property: EMAIL_ENABLED
-    - secretKey: NOTIFY_MAX_ELAPSED
-      remoteRef:
-        key: /cl01tl/vault/unseal/config-3
-        property: NOTIFY_MAX_ELAPSED
-    - secretKey: NOTIFY_QUEUE_DELAY
-      remoteRef:
-        key: /cl01tl/vault/unseal/config-3
-        property: NOTIFY_QUEUE_DELAY
+        key: /cl01tl/vault/unseal
+        property: NOTIFY_QUEUE_URLS
 
 ---
 apiVersion: external-secrets.io/v1

clusters/cl01tl/helm/vault/values.yaml

@@ -272,7 +272,7 @@ unseal:
         main:
           image:
             repository: ghcr.io/lrstanley/vault-unseal
-            tag: 0.7.2@sha256:b25d0c2f6a73d1b9a3907befa473f08fe9fac828d248d7e9702517c5b967733c
+            tag: 1.0.0@sha256:24ca9bceccdb0a22ae57574346dee4bec107c9b849f836811972b8f7f1baa4ef
           envFrom:
             - secretRef:
                 name: vault-unseal-config-1
@@ -288,7 +288,7 @@ unseal:
         main:
           image:
             repository: ghcr.io/lrstanley/vault-unseal
-            tag: 0.7.2@sha256:b25d0c2f6a73d1b9a3907befa473f08fe9fac828d248d7e9702517c5b967733c
+            tag: 1.0.0@sha256:24ca9bceccdb0a22ae57574346dee4bec107c9b849f836811972b8f7f1baa4ef
           envFrom:
             - secretRef:
                 name: vault-unseal-config-2
@@ -304,7 +304,7 @@ unseal:
         main:
           image:
             repository: ghcr.io/lrstanley/vault-unseal
-            tag: 0.7.2@sha256:b25d0c2f6a73d1b9a3907befa473f08fe9fac828d248d7e9702517c5b967733c
+            tag: 1.0.0@sha256:24ca9bceccdb0a22ae57574346dee4bec107c9b849f836811972b8f7f1baa4ef
           envFrom:
             - secretRef:
                 name: vault-unseal-config-3

clusters/cl01tl/helm/vaultwarden/Chart.yaml

@@ -33,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/vaultwarden.png
 # renovate: datasource=github-releases depName=dani-garcia/vaultwarden
-appVersion: 1.35.4
+appVersion: 1.35.7

clusters/cl01tl/helm/vaultwarden/values.yaml

@@ -8,7 +8,7 @@ vaultwarden:
         main:
           image:
             repository: ghcr.io/dani-garcia/vaultwarden
-            tag: 1.35.4@sha256:43498a94b22f9563f2a94b53760ab3e710eefc0d0cac2efda4b12b9eb8690664
+            tag: 1.35.7@sha256:9a8eec71f4a52411cc43edc7a50f33e9b6f62b5baca0dd95f0c6e7fd60f1a341
           env:
             - name: DOMAIN
               value: https://passwords.alexlebens.dev

clusters/cl01tl/helm/whodb/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/whodb.png
 # renovate: datasource=github-releases depName=clidey/whodb
-appVersion: 0.104.0
+appVersion: 0.105.0

clusters/cl01tl/helm/whodb/values.yaml

@@ -7,7 +7,7 @@ whodb:
         main:
           image:
             repository: clidey/whodb
-            tag: 0.104.0@sha256:ab485c021b862aac50bb88658f3342ca01d3eba33e933353692bc9989b2912c4
+            tag: 0.105.0@sha256:f4c7139554ef65e162b88792b9d28f793d1b3e50c3838f3d35f37c05a1b51413
           env:
             - name: WHODB_OLLAMA_HOST
               value: ollama-server-2.ollama