prep to migrate to new storage layout

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/siderolabs/talosctl](https://github.com/siderolabs/talos) | minor | `v1.11.6` → `v1.12.0` |

---

### Release Notes

<details>
<summary>siderolabs/talos (ghcr.io/siderolabs/talosctl)</summary>

### [`v1.12.0`](https://github.com/siderolabs/talos/blob/HEAD/CHANGELOG.md#Changes-since-v1120-alpha1)

[Compare Source](https://github.com/siderolabs/talos/compare/v1.11.6...v1.12.0)

<details><summary>66 commits</summary>
<p>

- [`3d811a4c8`](3d811a4c81) release(v1.12.0-alpha.2): prepare release
- [`fb4bfe851`](fb4bfe851c) chore: fix LVM test
- [`f4ee0d112`](f4ee0d1128) chore: disable VIP operator test
- [`288f63872`](288f638726) feat: bump deps
- [`b66482c52`](b66482c529) feat: allow disabling injection of extra cmdline in cluster create
- [`704b5f99e`](704b5f99e6) feat: update Kubernetes to 1.35.0-alpha.2
- [`1dffa5d99`](1dffa5d996) feat: implement virtual IP operator config
- [`43b1d7537`](43b1d75375) fix: validate provisioner when destroying local clusters
- [`b494c54c8`](b494c54c81) fix: talos import on non-linux
- [`61e95cb4b`](61e95cb4b7) feat: support bootloader option for ISO
- [`d11072726`](d110727263) fix: provide offset for partitions in discovered volumes
- [`39eeae963`](39eeae9631) feat: update dependencies
- [`9890a9a31`](9890a9a31d) test: fix OOM test
- [`c0772b8ed`](c0772b8eda) feat: add airgapped mode to QEMU backed talos
- [`ac60a9e27`](ac60a9e27d) fix: update test for PCI driver rebind/IOMMU
- [`6c98f4cdb`](6c98f4cdb0) feat: implement new DHCP network configuration
- [`da92a756d`](da92a756d9) fix: drop 'ro' falg from defaults
- [`28fd2390c`](28fd2390cb) fix: imager build on arm64
- [`4e12df8c5`](4e12df8c5c) test: integration test for OOM controller
- [`7e498faba`](7e498faba9) feat: use image signer
- [`eccb21dd3`](eccb21dd3b) feat: add presets to the 'cluster create qemu' command
- [`ec0a813fa`](ec0a813fac) feat: unify cmdline handling GRUB/systemd-boot
- [`37e4c40c6`](37e4c40c6a) fix: skip module signature tests on docker provisioner only
- [`8124efb42`](8124efb42f) fix: cache e2e
- [`4adcda0f5`](4adcda0f54) fix: reserve the apid and trustd ports from the ephemeral port range
- [`ced57b047`](ced57b047a) feat: support optionally disabling module sig verification
- [`1e5c4ed64`](1e5c4ed644) fix: build talosctl image cache-serve non-linux
- [`dbdd2b237`](dbdd2b237e) feat: add static registry to talosctl
- [`77d8cc7c5`](77d8cc7c58) chore: push `latest` tag only on main
- [`59d9b1c75`](59d9b1c75d) feat: update dependencies
- [`bf6ad5171`](bf6ad51710) feat: add back install script
- [`da451c5ba`](da451c5ba4) chore: drop documentation except for fresh reference
- [`2f23fedeb`](2f23fedeb7) fix: file leak in reading cgroups
- [`b412ffdbc`](b412ffdbc2) docs: update README.md for docs link
- [`8dc51bae7`](8dc51bae79) feat: add drm\_gpuvm and drm\_gpusvm\_helper modules
- [`4ca58aeb8`](4ca58aeb81) fix: make Akamai platform usable
- [`061f8e76f`](061f8e76fd) feat: bump pkgs
- [`a9fa852da`](a9fa852dad) feat: update uefi image to talos linux logo
- [`04753ba69`](04753ba698) feat: update go to 1.25.2
- [`9a42b05bd`](9a42b05bda) feat: implement link aliasing
- [`d732bd0be`](d732bd0be7) chore(ci): run only nvidia tests for NVIDIA workflows
- [`8d1468209`](8d1468209a) fix: stop populating apiserver cert SANs
- [`02473244c`](02473244c1) fix: wait for mount status to be proper mode
- [`825622d90`](825622d90a) fix: resource proto definitions
- [`2c6003e79`](2c6003e790) docs: add Project Calico installation in two mode
- [`4fb4c8678`](4fb4c86780) feat: add disk.EnableUUID to generated ova
- [`33fb48f8f`](33fb48f8f9) fix: add dashboard spinner
- [`053fd0bd4`](053fd0bd4d) feat: update Linux to 6.17
- [`34e107e1b`](34e107e1bd) docs: fix broken link
- [`dfbece56b`](dfbece56bd) docs: update the kubespan docs
- [`8b041a72c`](8b041a72ca) docs: update scaleway.md
- [`435dcbf82`](435dcbf820) fix: provide nocloud metadata with missing network config
- [`ec3bd878f`](ec3bd878f9) refactor: remove the go-blockdevice v1 completely
- [`33544bde9`](33544bde9c) fix: minor improvements to fs
- [`fd2eebf7f`](fd2eebf7fa) feat: create merge patch from diff of two machine configs
- [`eadbdda94`](eadbdda947) fix: uefi boot order setting
- [`cd9fb2743`](cd9fb27434) fix: support secure HTTP proxy with gRPC dial
- [`adf87b4b9`](adf87b4b93) feat: update Flannel to v0.27.4
- [`5dfb7e1fe`](5dfb7e1fe7) feat: serve etcd image from registry.k8s.io
- [`5ca841804`](5ca8418049) fix: nftables flaky test
- [`a940e45a7`](a940e45a7f) feat: generate list of images required to build talos
- [`3472d6e79`](3472d6e79c) fix: revert "chore: use new mount/v3 package in efivarfs"
- [`42c0bdbf3`](42c0bdbf32) feat: add provisioner flag to images default command
- [`6bc0b1bcf`](6bc0b1bcf7) feat: drop and lock deprecated features
- [`362a8e63b`](362a8e63b7) fix: change the compression format
- [`6e58f58aa`](6e58f58aae) fix: mkdir artifacts path

</p>
</details>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi4zOS4xIiwidXBkYXRlZEluVmVyIjoiNDIuNjYuMTMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImltYWdlIl19-->

Reviewed-on: #2825
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

.gitea/workflows/render-manifests-dispatch.yaml

@@ -1,6 +1,9 @@
 name: render-manifests-dispatch
 
 on:
+  schedule:
+    - cron: '0 3 * * *'
+
   workflow_dispatch:
 
 env:

clusters/cl01tl/helm/blocky/values.yaml

@@ -159,7 +159,6 @@ blocky:
               sonarr                          IN      CNAME   traefik-cl01tl
               sonarr-4k                       IN      CNAME   traefik-cl01tl
               sonarr-anime                    IN      CNAME   traefik-cl01tl
-              soulsync                        IN      CNAME   traefik-cl01tl
               stalwart                        IN      CNAME   traefik-cl01tl
               tautulli                        IN      CNAME   traefik-cl01tl
               tdarr                           IN      CNAME   traefik-cl01tl

clusters/cl01tl/helm/booklore/values.yaml

@@ -9,7 +9,7 @@ booklore:
         main:
           image:
             repository: ghcr.io/booklore-app/booklore
-            tag: v1.16.1
+            tag: v1.16.2
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/cilium/templates/cilium-l2-announcement-policy.yaml

@@ -1,19 +1,19 @@
-apiVersion: "cilium.io/v2alpha1"
+# apiVersion: "cilium.io/v2alpha1"
-kind: CiliumL2AnnouncementPolicy
+# kind: CiliumL2AnnouncementPolicy
-metadata:
+# metadata:
-  name: general-l2-policy
+#   name: general-l2-policy
-  namespace: {{ .Release.Namespace }}
+#   namespace: {{ .Release.Namespace }}
-  labels:
+#   labels:
-    app.kubernetes.io/name: general-l2-policy
+#     app.kubernetes.io/name: general-l2-policy
-    app.kubernetes.io/instance: {{ .Release.Name }}
+#     app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+#     app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
+# spec:
-  nodeSelector:
+#   nodeSelector:
-    matchExpressions:
+#     matchExpressions:
-      - key: kubernetes.io/hostname
+#       - key: kubernetes.io/hostname
-        operator: Exists
+#         operator: Exists
-  interfaces:
+#   interfaces:
-    - end0
+#     - end0
-    - enp6s0
+#     - enp6s0
-  externalIPs: true
+#   externalIPs: true
-  loadBalancerIPs: true
+#   loadBalancerIPs: true

clusters/cl01tl/helm/cilium/values.yaml

@@ -26,7 +26,7 @@ cilium:
         - SYS_ADMIN
         - SYS_RESOURCE
   l2announcements:
-    enabled: true
+    enabled: false
   bgpControlPlane:
     enabled: false
     secretsNamespace:

clusters/cl01tl/helm/cloudnative-pg/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 0.27.0
 - name: plugin-barman-cloud
   repository: https://cloudnative-pg.io/charts/
-  version: 0.3.1
+  version: 0.4.0
-digest: sha256:14aa30b7bf75571b03bda19af68cd50c1e7908b883351b196a260609a5b85551
+digest: sha256:5e2a32fa5ed8b180ae5e556d65c67eeb3dcf38e2974b0d668eff4ee3c83258ce
-generated: "2025-12-10T19:25:17.952954019Z"
+generated: "2025-12-30T21:01:48.755246408Z"

clusters/cl01tl/helm/cloudnative-pg/Chart.yaml

@@ -19,7 +19,7 @@ dependencies:
     version: 0.27.0
     repository: https://cloudnative-pg.io/charts/
   - name: plugin-barman-cloud
-    version: 0.3.1
+    version: 0.4.0
     repository: https://cloudnative-pg.io/charts/
 icon: https://avatars.githubusercontent.com/u/100373852?s=200&v=4
 # renovate: github=cloudnative-pg/cloudnative-pg

clusters/cl01tl/helm/cloudnative-pg/values.yaml

@@ -7,10 +7,10 @@ plugin-barman-cloud:
   image:
     registry: ghcr.io
     repository: cloudnative-pg/plugin-barman-cloud
-    tag: v0.9.0
+    tag: v0.10.0
   sidecarImage:
     registry: ghcr.io
     repository: cloudnative-pg/plugin-barman-cloud-sidecar
-    tag: v0.9.0
+    tag: v0.10.0
   crds:
     create: true

clusters/cl01tl/helm/gatus/values.yaml

@@ -316,9 +316,6 @@ gatus:
       - name: rayflume
         url: https://rayflume.alexlebens.net
         <<: *defaults
-      - name: soulsync
-        url: https://soulsync.alexlebens.net
-        <<: *defaults
       - name: slskd
         url: https://slskd.alexlebens.net
         <<: *defaults

clusters/cl01tl/helm/generic-device-plugin/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: generic-device-plugin
   repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-  version: 0.20.10
+  version: 0.20.11
-digest: sha256:bb4fe0fe2e95889b3fbf028e1eff923fcc71d8bd1bc7887eee08010cfb28f4db
+digest: sha256:638754658519c268ac93bef8dec82332cded8e99b734ef61db45ee63e4b7c6ce
-generated: "2025-12-27T23:08:24.592060217Z"
+generated: "2025-12-30T22:23:45.633280279Z"

clusters/cl01tl/helm/generic-device-plugin/Chart.yaml

@@ -15,6 +15,6 @@ maintainers:
 dependencies:
   - name: generic-device-plugin
     repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-    version: 0.20.10
+    version: 0.20.11
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: 1.0.0

clusters/cl01tl/helm/gitea/Chart.lock

@@ -7,7 +7,7 @@ dependencies:
   version: 0.2.1
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.19.0
+  version: 0.20.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.1.4
@@ -23,5 +23,5 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
-digest: sha256:c0ea42d1a2fc3712ac0481e0a40330704f0f2d1d290b7d30c36a536f0d0ee384
+digest: sha256:6636f6ead8089c19ad702fb58170d942e11150fdda9470f1b97f4f8fa533d00e
-generated: "2025-12-27T19:45:48.293310777Z"
+generated: "2025-12-30T16:03:12.004386065Z"

clusters/cl01tl/helm/gitea/Chart.yaml

@@ -32,7 +32,7 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
     version: 0.2.1
   - name: meilisearch
-    version: 0.19.0
+    version: 0.20.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -9,7 +9,7 @@ home-assistant:
         main:
           image:
             repository: ghcr.io/home-assistant/home-assistant
-            tag: 2025.12.4
+            tag: 2025.12.5
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/homepage/values.yaml

@@ -667,12 +667,6 @@ homepage:
                   href: https://lidatube.alexlebens.net
                   siteMonitor: http://lidatube.lidatube:80
                   statusStyle: dot
-              - SoulSync:
-                  icon: sh-soulsync.webp
-                  description: Playlist Sync
-                  href: https://soulsync.alexlebens.net
-                  siteMonitor: http://soulsync.soulsync:80
-                  statusStyle: dot
               - slskd:
                   icon: sh-slskd.webp
                   description: slskd

clusters/cl01tl/helm/jellyfin/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.5.0
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.19.0
+  version: 0.20.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
-digest: sha256:dc914dfc86c2b638fae6f580418dafebcddb09a25e6f534f89983fb592196245
+digest: sha256:20665aefeaea3e853d5c977cdce05089a87c6d83e43aa946a088f43bcc7eebf9
-generated: "2025-12-27T13:30:57.814394-06:00"
+generated: "2025-12-30T16:03:25.803286869Z"

clusters/cl01tl/helm/jellyfin/Chart.yaml

@@ -25,7 +25,7 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
   - name: meilisearch
-    version: 0.19.0
+    version: 0.20.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: volsync-target
     alias: volsync-target-config

clusters/cl01tl/helm/karakeep/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 4.5.0
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.19.0
+  version: 0.20.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.1.4
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
-digest: sha256:e750d8cab228de94d920f80137981e24e795d97040e92dd4cf0d80e463b2bd19
+digest: sha256:d65ca3de6fd1095c4dfe2515ed84c4705495c0725773ec95ea49331a38721785
-generated: "2025-12-27T13:31:02.732529-06:00"
+generated: "2025-12-30T16:03:37.441539588Z"

clusters/cl01tl/helm/karakeep/Chart.yaml

@@ -22,7 +22,7 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
   - name: meilisearch
-    version: 0.19.0
+    version: 0.20.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 80.8.0
+  version: 80.9.1
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.5.0
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.5.0
-digest: sha256:8e4076f0ba94134eb91dc12364fde4f50bffc6dc3c4cc32a5ea6b9ede777a3b6
+digest: sha256:91fcf8234e006b8e412e15ddd159ef3450a51bfdb6866a1ea2759741f78b70cd
-generated: "2025-12-28T21:56:15.664575212Z"
+generated: "2025-12-30T22:24:25.338726593Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 80.8.0
+    version: 80.9.1
     repository: oci://ghcr.io/prometheus-community/charts
   - name: app-template
     alias: ntfy-alertmanager

clusters/cl01tl/helm/local-path-provisioner/values.yaml

@@ -13,6 +13,9 @@ local-path-provisioner:
     reclaimPolicy: Delete
     volumeBindingMode: WaitForFirstConsumer
   nodePathMap:
+    - node: DEFAULT_PATH_FOR_NON_LISTED_NODES
+      paths:
+        - /var/mnt/local-storage
     - node: talos-2di-ktg
       paths:
         - /var/local-path-provisioner
@@ -33,6 +36,9 @@ local-path-provisioner:
                 - talos-2di-ktg
                 - talos-9vs-6hh
                 - talos-aoq-hpv
+          - matchExpressions:
+              - key: node-role.kubernetes.io/local-storage-node
+                operator: Exists
   configmap:
     name: local-path-config
     setup: |-

clusters/cl01tl/helm/postiz/values.yaml

@@ -9,7 +9,7 @@ postiz:
         main:
           image:
             repository: ghcr.io/gitroomhq/postiz-app
-            tag: v2.11.2
+            tag: v2.11.3
             pullPolicy: IfNotPresent
           env:
             - name: MAIN_URL

clusters/cl01tl/helm/rayflume/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     alias: volsync-target-data
     version: 0.7.0
     repository: oci://harbor.alexlebens.net/helm-charts
-appVersion: 0.0.3
+appVersion: 0.0.9

clusters/cl01tl/helm/rayflume/values.yaml

@@ -9,7 +9,7 @@ rayflume:
         main:
           image:
             repository: harbor.alexlebens.net/images/rayflume
-            tag: 0.0.7
+            tag: 0.0.9
             pullPolicy: IfNotPresent
           env:
             - name: DEBUG

clusters/cl01tl/helm/rook-ceph/values.yaml

@@ -85,7 +85,8 @@ rook-ceph-cluster:
           cpu: 100m
           memory: 128Mi
     storage:
-      deviceFilter: sda
+      useAllDevices: false
+      devicePathFilter: "/dev/disk/by-partlabel/r-csi-disk|/dev/sda"
       config:
         osdsPerDevice: "1"
     csi:

clusters/cl01tl/helm/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:6f3a875c64bd804d1ccf2fe3c8df35e985b75ffbf0322f216544e79912fabab2
+            tag: latest@sha256:1ad4159e74903f8870e3464df701b800a75bd2854f5d11b44ce09ee297f3c158
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -39,7 +39,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:6f3a875c64bd804d1ccf2fe3c8df35e985b75ffbf0322f216544e79912fabab2
+            tag: latest@sha256:1ad4159e74903f8870e3464df701b800a75bd2854f5d11b44ce09ee297f3c158
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL

clusters/cl01tl/helm/site-documentation/values.yaml

@@ -11,7 +11,7 @@ site-documentation:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-documentation
-            tag: 0.0.5
+            tag: 0.0.7
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/site-profile/values.yaml

@@ -11,7 +11,7 @@ site-profile:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-profile
-            tag: 2.1.2
+            tag: 2.1.4
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/soulsync/Chart.lock

@@ -1,12 +0,0 @@
-dependencies:
-- name: app-template
-  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.5.0
-- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
-- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
-digest: sha256:3f2befd8dc0c7cc73090a5e1648d200a757dbc3e58f7735940fc11b172ada4f9
-generated: "2025-12-27T13:32:51.138317-06:00"

clusters/cl01tl/helm/soulsync/Chart.yaml

@@ -1,29 +0,0 @@
-apiVersion: v2
-name: soulsync
-version: 1.0.0
-description: SoulSync
-keywords:
-  - soulsync
-  - music
-home: https://wiki.alexlebens.dev/s/
-sources:
-  - https://github.com/Nezreka/SoulSync
-  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: soulsync
-    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.5.0
-  - name: volsync-target
-    alias: volsync-target-config
-    version: 0.7.0
-    repository: oci://harbor.alexlebens.net/helm-charts
-  - name: volsync-target
-    alias: volsync-target-database
-    version: 0.7.0
-    repository: oci://harbor.alexlebens.net/helm-charts
-icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/soulsync.png
-# renovate: github=Nezreka/SoulSync
-appVersion: 1.42.2

clusters/cl01tl/helm/soulsync/templates/external-secret.yaml

@@ -1,21 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: soulsync-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: soulsync-config-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.json
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/soulsync/config
-        metadataPolicy: None
-        property: config.json

clusters/cl01tl/helm/soulsync/templates/persistent-volume-claim.yaml

@@ -1,36 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: soulsync-music-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: soulsync-music-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: soulsync-music-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: soulsync-slskd-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: soulsync-slskd-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: soulsync-slskd-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/helm/soulsync/templates/persistent-volume.yaml

@@ -1,48 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: soulsync-music-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: soulsync-music-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage/Music
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac
-
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: soulsync-slskd-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: soulsync-slskd-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage/slskd/Downloads
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/helm/soulsync/values.yaml

@@ -1,170 +0,0 @@
-soulsync:
-  controllers:
-    main:
-      type: deployment
-      replicas: 0
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      initContainers:
-        init-copy-config:
-          image:
-            repository: busybox
-            tag: 1.37.0
-            pullPolicy: IfNotPresent
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-          command:
-            - /bin/sh
-            - -ec
-            - |
-              echo ">> Coping files ..."
-              ls /tmp
-              cp -fv /tmp/config.json /app/config/config.json
-              echo ">> Files in config:"
-              ls /app/config
-      containers:
-        main:
-          image:
-            repository: boulderbadgedad/soulsync
-            tag: latest
-            pullPolicy: IfNotPresent
-          env:
-            - name: TZ
-              value: US/Central
-            - name: PUID
-              value: 1000
-            - name: PGID
-              value: 1000
-            - name: FLASK_ENV
-              value: production
-            - name: PYTHONPATH
-              value: /app
-            - name: SOULSYNC_CONFIG_PATH
-              value: /app/config/config.json
-          probes:
-            liveness:
-              enabled: true
-              custom: true
-              spec:
-                exec:
-                  command:
-                  - CMD
-                  - curl
-                  - -f
-                  - http://localhost:8888/
-                failureThreshold: 5
-                initialDelaySeconds: 60
-                periodSeconds: 30
-                successThreshold: 1
-                timeoutSeconds: 10
-          resources:
-            requests:
-              cpu: 100m
-              memory: 512Mi
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 8008
-          protocol: HTTP
-  route:
-    main:
-      kind: HTTPRoute
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: traefik-gateway
-          namespace: traefik
-      hostnames:
-        - soulsync.alexlebens.net
-      rules:
-        - backendRefs:
-            - group: ''
-              kind: Service
-              name: soulsync
-              port: 80
-              weight: 100
-          matches:
-            - path:
-                type: PathPrefix
-                value: /
-  persistence:
-    secret:
-      enabled: true
-      type: secret
-      name: soulsync-config-secret
-      advancedMounts:
-        main:
-          init-copy-config:
-            - path: /tmp/config.json
-              readOnly: true
-              mountPropagation: None
-              subPath: config.json
-    config:
-      forceRename: soulsync-config
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 10Gi
-      advancedMounts:
-        main:
-          main:
-            - path: /app/config
-              readOnly: false
-          init-copy-config:
-            - path: /app/config
-              readOnly: false
-    database:
-      forceRename: soulsync-database
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 10Gi
-      advancedMounts:
-        main:
-          main:
-            - path: /app/database
-              readOnly: false
-    downloads:
-      existingClaim: soulsync-slskd-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /app/downloads
-              readOnly: false
-    transfer:
-      type: emptyDir
-      advancedMounts:
-        main:
-          main:
-            - path: /app/Transfer
-              readOnly: false
-    music:
-      existingClaim: soulsync-music-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /music
-              readOnly: true
-volsync-target-config:
-  pvcTarget: soulsync-config
-  local:
-    enabled: false
-    schedule: 28 11 * * *
-  remote:
-    enabled: false
-  external:
-    enabled: true
-    schedule: 28 12 * * *
-volsync-target-database:
-  pvcTarget: soulsync-database
-  local:
-    enabled: false
-    schedule: 30 11 * * *
-  remote:
-    enabled: false
-  external:
-    enabled: true
-    schedule: 30 12 * * *

clusters/cl01tl/helm/stalwart/values.yaml

@@ -9,7 +9,7 @@ stalwart:
         main:
           image:
             repository: stalwartlabs/stalwart
-            tag: v0.15.2
+            tag: v0.15.3
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/talos/values.yaml

@@ -69,7 +69,7 @@ etcd-backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:64a23903ee1b156ae7d795efc756b68ad802bce695f5608343edadba3dea1dc1
+            tag: latest@sha256:8aeb104edaba11f086506024b22d543a0771e0b01cd50243043002e2d61c2f71
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -155,7 +155,7 @@ etcd-backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:64a23903ee1b156ae7d795efc756b68ad802bce695f5608343edadba3dea1dc1
+            tag: latest@sha256:8aeb104edaba11f086506024b22d543a0771e0b01cd50243043002e2d61c2f71
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -241,7 +241,7 @@ etcd-backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:64a23903ee1b156ae7d795efc756b68ad802bce695f5608343edadba3dea1dc1
+            tag: latest@sha256:8aeb104edaba11f086506024b22d543a0771e0b01cd50243043002e2d61c2f71
             pullPolicy: IfNotPresent
           command:
             - /bin/sh

clusters/cl01tl/helm/vault/values.yaml

@@ -187,7 +187,7 @@ snapshot:
         s3-backup-local:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:64a23903ee1b156ae7d795efc756b68ad802bce695f5608343edadba3dea1dc1
+            tag: latest@sha256:8aeb104edaba11f086506024b22d543a0771e0b01cd50243043002e2d61c2f71
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -208,7 +208,7 @@ snapshot:
         s3-backup-remote:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:64a23903ee1b156ae7d795efc756b68ad802bce695f5608343edadba3dea1dc1
+            tag: latest@sha256:8aeb104edaba11f086506024b22d543a0771e0b01cd50243043002e2d61c2f71
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -229,7 +229,7 @@ snapshot:
         s3-backup-external:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:64a23903ee1b156ae7d795efc756b68ad802bce695f5608343edadba3dea1dc1
+            tag: latest@sha256:8aeb104edaba11f086506024b22d543a0771e0b01cd50243043002e2d61c2f71
             pullPolicy: IfNotPresent
           command:
             - /bin/sh

clusters/cl01tl/helm/vaultwarden/values.yaml

@@ -9,7 +9,7 @@ vaultwarden:
         main:
           image:
             repository: vaultwarden/server
-            tag: 1.35.0
+            tag: 1.35.1
             pullPolicy: IfNotPresent
           env:
             - name: DOMAIN

clusters/cl01tl/helm/whodb/values.yaml

@@ -8,7 +8,7 @@ whodb:
         main:
           image:
             repository: clidey/whodb
-            tag: 0.86.0
+            tag: 0.87.0
             pullPolicy: IfNotPresent
           env:
             - name: WHODB_OLLAMA_HOST

clusters/cl01tl/helm/ytdl-sub/values.yaml

@@ -6,7 +6,7 @@ ytdl-sub:
         suspend: false
         concurrencyPolicy: Forbid
         timeZone: US/Central
-        schedule: 0 0 1 1 *
+        schedule: 12 0 * * *
         startingDeadlineSeconds: 90
         successfulJobsHistory: 1
         failedJobsHistory: 1
@@ -16,7 +16,7 @@ ytdl-sub:
         main:
           image:
             repository: ghcr.io/jmbannon/ytdl-sub
-            tag: 2025.12.26
+            tag: 2025.12.30
             pullPolicy: IfNotPresent
           command:
             - ytdl-sub
@@ -38,14 +38,14 @@ ytdl-sub:
       data:
         config.yaml: |
           configuration:
-            working_directory: /config
+            working_directory: /cache
         subscriptions.yaml: |
           __preset__:
             embed_thumbnail: True
             square_thumbnail: True
             overrides:
               music_directory: /music
-          YouTube Releases:
+          YouTube Releases | Max MP3 Quality:
             = YouTube:
               "Music Saved": "https://www.youtube.com/playlist?list=PLtiOoYqxYXtKK3fMya_xhqK0Wit0i10Gy&si=8wNBH-kGT9Nx0XBK"
 

hosts/ps08rp/blocky/config.yml

@@ -135,7 +135,6 @@ customDNS:
     sonarr                          IN      CNAME   traefik-cl01tl
     sonarr-4k                       IN      CNAME   traefik-cl01tl
     sonarr-anime                    IN      CNAME   traefik-cl01tl
-    soulsync                        IN      CNAME   traefik-cl01tl
     stalwart                        IN      CNAME   traefik-cl01tl
     tautulli                        IN      CNAME   traefik-cl01tl
     tdarr                           IN      CNAME   traefik-cl01tl

hosts/ps08rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.5
+        image: ghcr.io/traefik/traefik:v3.6.6
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

hosts/ps09rp/blocky/config.yml

@@ -135,7 +135,6 @@ customDNS:
     sonarr                          IN      CNAME   traefik-cl01tl
     sonarr-4k                       IN      CNAME   traefik-cl01tl
     sonarr-anime                    IN      CNAME   traefik-cl01tl
-    soulsync                        IN      CNAME   traefik-cl01tl
     stalwart                        IN      CNAME   traefik-cl01tl
     tautulli                        IN      CNAME   traefik-cl01tl
     tdarr                           IN      CNAME   traefik-cl01tl

hosts/ps09rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.5
+        image: ghcr.io/traefik/traefik:v3.6.6
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

hosts/ps10rp/traefik/compose.yaml

@@ -20,7 +20,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.5
+        image: ghcr.io/traefik/traefik:v3.6.6
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"