move database into chart

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [redis-replication](https://github.com/OT-CONTAINER-KIT/redis-operator) | minor | `0.4.0` -> `0.5.0` |

---

### Release Notes

<details>
<summary>OT-CONTAINER-KIT/redis-operator (redis-replication)</summary>

### [`v0.5.0`](https://github.com/OT-CONTAINER-KIT/redis-operator/blob/HEAD/CHANGELOG.md#v050)

[Compare Source](https://github.com/OT-CONTAINER-KIT/redis-operator/compare/v0.4.0...v0.5.0)

##### May 1, 2021

##### 🎉 Features

- Added support for recovering redis nodes from failover
- Added toleration support for redis statefuls
- Added capability to use existing secret created inside K8s

##### 🪲 Bug Fixes

- Fixed logic for service and statefulset comparison in K8s

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi4zOS4xIiwidXBkYXRlZEluVmVyIjoiNDIuMzkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW1hZ2UiXX0=-->

Reviewed-on: #2563
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

.gitea/workflows/lint-test-helm.yaml

@@ -124,7 +124,13 @@ jobs:
             helm dependency list --max-col-width 120 clusters/${CLUSTER}/helm/$dir 2> /dev/null \
               | tail +2 | head -n -1 \
               | awk '{ print "helm repo add " $1 " " $3 }' \
-              | while read cmd; do echo "$cmd" | sh; done || true
+              | while read cmd; do
+                if [[ "$cmd" == "*oci://*" ]]; then
+                  echo ">> Ignoring OCI repo"
+                else
+                  echo "$cmd" | sh;
+                fi
+              done || true
           done
 
           if helm repo list | tail +2 | read -r; then

.gitea/workflows/render-manifests-automerge.yaml

@@ -106,7 +106,13 @@ jobs:
             helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
               | tail +2 | head -n -1 \
               | awk '{ print "helm repo add " $1 " " $3 }' \
-              | while read cmd; do echo "$cmd" | sh; done || true
+              | while read cmd; do
+                if [[ "$cmd" == "*oci://*" ]]; then
+                  echo ">> Ignoring OCI repo"
+                else
+                  echo "$cmd" | sh;
+                fi
+              done || true
           done
 
           if helm repo list | tail +2 | read -r; then

.gitea/workflows/render-manifests-dispatch.yaml

@@ -91,7 +91,13 @@ jobs:
             helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
               | tail +2 | head -n -1 \
               | awk '{ print "helm repo add " $1 " " $3 }' \
-              | while read cmd; do echo "$cmd" | sh; done || true
+              | while read cmd; do
+                if [[ "$cmd" == "*oci://*" ]]; then
+                  echo ">> Ignoring OCI repo"
+                else
+                  echo "$cmd" | sh;
+                fi
+              done || true
           done
 
           if helm repo list | tail +2 | read -r; then

.gitea/workflows/render-manifests-merge.yaml

@@ -111,7 +111,13 @@ jobs:
             helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
               | tail +2 | head -n -1 \
               | awk '{ print "helm repo add " $1 " " $3 }' \
-              | while read cmd; do echo "$cmd" | sh; done || true
+              | while read cmd; do
+                if [[ "$cmd" == "*oci://*" ]]; then
+                  echo ">> Ignoring OCI repo"
+                else
+                  echo "$cmd" | sh;
+                fi
+              done || true
           done
 
           if helm repo list | tail +2 | read -r; then

.gitea/workflows/render-manifests-push.yaml

@@ -109,7 +109,13 @@ jobs:
             helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
               | tail +2 | head -n -1 \
               | awk '{ print "helm repo add " $1 " " $3 }' \
-              | while read cmd; do echo "$cmd" | sh; done || true
+              | while read cmd; do
+                if [[ "$cmd" == "*oci://*" ]]; then
+                  echo ">> Ignoring OCI repo"
+                else
+                  echo "$cmd" | sh;
+                fi
+              done || true
           done
 
           if helm repo list | tail +2 | read -r; then

clusters/cl01tl/helm/argo-workflows/Chart.lock

@@ -7,6 +7,6 @@ dependencies:
   version: 2.4.19
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 6.16.1
-digest: sha256:40a93dfcabbc5746682bac631e9a620588cf0cb6fdf79a42446a823e93a531c8
-generated: "2025-12-11T15:49:57.970719-06:00"
+  version: 7.1.1
+digest: sha256:796a0f9ae054268c9a4e2752f29004b6547e5ee41e623b8506b531f6836b7313
+generated: "2025-12-15T14:27:02.068848-06:00"

clusters/cl01tl/helm/argo-workflows/Chart.yaml

@@ -25,7 +25,7 @@ dependencies:
     repository: https://argoproj.github.io/argo-helm
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 6.16.1
+    version: 7.1.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 appVersion: v3.7.6

clusters/cl01tl/helm/argo-workflows/values.yaml

@@ -78,17 +78,10 @@ argo-events:
 postgres-18-cluster:
   mode: recovery
   cluster:
-    image:
-      repository: ghcr.io/cloudnative-pg/postgresql
-      tag: 18.1-standard-trixie
     storage:
       storageClass: local-path
     walStorage:
       storageClass: local-path
-    monitoring:
-      enabled: true
-      prometheusRule:
-        enabled: true
   recovery:
     method: objectStore
     objectStore:
@@ -98,11 +91,6 @@ postgres-18-cluster:
       endpointCredentials: argo-workflows-postgresql-18-cluster-backup-secret-garage
   backup:
     objectStore:
-      - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
-        index: 1
-        retentionPolicy: "30d"
-        isWALArchiver: false
       - name: garage-local
         destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
         index: 1
@@ -111,6 +99,11 @@ postgres-18-cluster:
         endpointCredentialsIncludeRegion: true
         retentionPolicy: "3d"
         isWALArchiver: true
+      # - name: external
+      #   destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
+      #   index: 1
+      #   retentionPolicy: "30d"
+      #   isWALArchiver: false
       # - name: garage-remote
       #   destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
       #   index: 1
@@ -121,16 +114,16 @@ postgres-18-cluster:
       #   data:
       #     compression: bzip2
     scheduledBackups:
-      - name: daily-backup
-        suspend: false
-        immediate: true
-        schedule: "0 0 0 * * *"
-        backupName: external
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 0 0 * * *"
         backupName: garage-local
+      # - name: daily-backup
+      #   suspend: false
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
       # - name: weekly-backup
       #   suspend: true
       #   immediate: true

clusters/cl01tl/helm/audiobookshelf/values.yaml

@@ -21,7 +21,7 @@ audiobookshelf:
         apprise-api:
           image:
             repository: caronc/apprise
-            tag: 1.2.6
+            tag: 1.3.0
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/authentik/Chart.lock

@@ -7,6 +7,9 @@ dependencies:
   version: 1.23.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 6.16.1
-digest: sha256:fdd5cc597cf958ca0f6f43dd403915c89c45718eff80920c2d322264dc8b09e1
-generated: "2025-12-11T16:14:14.729827-06:00"
+  version: 7.1.1
+- name: redis-replication
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:e593d25ebf07b1274768045f028e1ceeccbcdc1c8e35414d6bbd9a8d09086991
+generated: "2025-12-15T14:36:33.783343-06:00"

clusters/cl01tl/helm/authentik/Chart.yaml

@@ -29,7 +29,10 @@ dependencies:
     version: 1.23.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 6.16.1
+    version: 7.1.1
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: redis-replication
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/authentik.png
 appVersion: 2025.10.2

clusters/cl01tl/helm/authentik/templates/redis-replication.yaml

@@ -1,32 +0,0 @@
-apiVersion: redis.redis.opstreelabs.in/v1beta2
-kind: RedisReplication
-metadata:
-  name: redis-replication-authentik
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-replication-authentik
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  clusterSize: 3
-  podSecurityContext:
-    runAsUser: 1000
-    fsGroup: 1000
-  kubernetesConfig:
-    image: quay.io/opstree/redis:v8.4.0
-    imagePullPolicy: IfNotPresent
-    resources:
-      requests:
-        cpu: 50m
-        memory: 128Mi
-  storage:
-    volumeClaimTemplate:
-      spec:
-        storageClassName: ceph-block
-        accessModes: ["ReadWriteOnce"]
-        resources:
-          requests:
-            storage: 1Gi
-  redisExporter:
-    enabled: true
-    image: quay.io/opstree/redis-exporter:v1.80.1

clusters/cl01tl/helm/authentik/templates/service-monitor.yaml

@@ -1,19 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: redis-replication-authentik
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-replication-authentik
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-    redis-operator: "true"
-    env: production
-spec:
-  selector:
-    matchLabels:
-      redis_setup_type: replication
-  endpoints:
-    - port: redis-exporter
-      interval: 30s
-      scrapeTimeout: 10s

clusters/cl01tl/helm/authentik/values.yaml

@@ -53,17 +53,10 @@ cloudflared:
 postgres-18-cluster:
   mode: recovery
   cluster:
-    image:
-      repository: ghcr.io/cloudnative-pg/postgresql
-      tag: 18.1-standard-trixie
     storage:
       storageClass: local-path
     walStorage:
       storageClass: local-path
-    monitoring:
-      enabled: true
-      prometheusRule:
-        enabled: true
   recovery:
     method: objectStore
     objectStore:
@@ -73,11 +66,6 @@ postgres-18-cluster:
       endpointCredentials: authentik-postgresql-18-cluster-backup-secret-garage
   backup:
     objectStore:
-      - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/authentik/authentik-postgresql-18-cluster
-        index: 1
-        retentionPolicy: "30d"
-        isWALArchiver: false
       - name: garage-local
         destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-18-cluster
         index: 1
@@ -86,6 +74,11 @@ postgres-18-cluster:
         endpointCredentialsIncludeRegion: true
         retentionPolicy: "3d"
         isWALArchiver: true
+      # - name: external
+      #   destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/authentik/authentik-postgresql-18-cluster
+      #   index: 1
+      #   retentionPolicy: "30d"
+      #   isWALArchiver: false
       # - name: garage-remote
       #   destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-18-cluster
       #   index: 1
@@ -96,18 +89,26 @@ postgres-18-cluster:
       #     compression: bzip2
       #     jobs: 2
     scheduledBackups:
-      - name: daily-backup
-        suspend: false
-        immediate: true
-        schedule: "0 0 0 * * *"
-        backupName: external
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 0 0 * * *"
         backupName: garage-local
+      # - name: daily-backup
+      #   suspend: false
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
       # - name: weekly-backup
       #   suspend: false
       #   immediate: true
       #   schedule: "0 0 4 * * SAT"
       #   backupName: garage-remote
+redis-replication:
+  existingSecret:
+    enabled: false
+  redisReplication:
+    clusterSize: 3
+  redisSentinel:
+    enabled: true
+    clusterSize: 3

clusters/cl01tl/helm/blocky/Chart.lock

@@ -2,5 +2,8 @@ dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.5.0
-digest: sha256:b8516161886b87344848ad2b3bdafbd66da61ca8ffc5e9a5ebed462f205c9912
-generated: "2025-12-05T17:02:59.562863413Z"
+- name: redis-replication
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:a7840240d52d7c66aa2e542132e32907dd0c48d3051eb15190a209215cbd4dce
+generated: "2025-12-15T20:06:31.995318697Z"

clusters/cl01tl/helm/blocky/Chart.yaml

@@ -17,5 +17,8 @@ dependencies:
     alias: blocky
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
+  - name: redis-replication
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/blocky.png
 appVersion: v0.28.2

clusters/cl01tl/helm/blocky/templates/redis-replication.yaml

@@ -1,32 +0,0 @@
-apiVersion: redis.redis.opstreelabs.in/v1beta2
-kind: RedisReplication
-metadata:
-  name: redis-replication-blocky
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-replication-blocky
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  clusterSize: 3
-  podSecurityContext:
-    runAsUser: 1000
-    fsGroup: 1000
-  kubernetesConfig:
-    image: quay.io/opstree/redis:v8.4.0
-    imagePullPolicy: IfNotPresent
-    resources:
-      requests:
-        cpu: 50m
-        memory: 128Mi
-  storage:
-    volumeClaimTemplate:
-      spec:
-        storageClassName: ceph-block
-        accessModes: ["ReadWriteOnce"]
-        resources:
-          requests:
-            storage: 1Gi
-  redisExporter:
-    enabled: true
-    image: quay.io/opstree/redis-exporter:v1.80.1

clusters/cl01tl/helm/blocky/templates/service-monitor.yaml

@@ -17,24 +17,3 @@ spec:
       interval: 30s
       scrapeTimeout: 10s
       path: /metrics
-
----
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: redis-replication-blocky
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-replication-blocky
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-    redis-operator: "true"
-    env: production
-spec:
-  selector:
-    matchLabels:
-      redis_setup_type: replication
-  endpoints:
-    - port: redis-exporter
-      interval: 30s
-      scrapeTimeout: 10s

clusters/cl01tl/helm/blocky/values.yaml

@@ -132,7 +132,6 @@ blocky:
               jellystat                       IN      CNAME   traefik-cl01tl
               kiwix                           IN      CNAME   traefik-cl01tl
               komodo                          IN      CNAME   traefik-cl01tl
-              kronic                          IN      CNAME   traefik-cl01tl
               lidarr                          IN      CNAME   traefik-cl01tl
               lidatube                        IN      CNAME   traefik-cl01tl
               listenarr                       IN      CNAME   traefik-cl01tl
@@ -143,7 +142,6 @@ blocky:
               ollama                          IN      CNAME   traefik-cl01tl
               omni-tools                      IN      CNAME   traefik-cl01tl
               overseerr                       IN      CNAME   traefik-cl01tl
-              pgadmin                         IN      CNAME   traefik-cl01tl
               photoview                       IN      CNAME   traefik-cl01tl
               plex                            IN      CNAME   traefik-cl01tl
               postiz                          IN      CNAME   traefik-cl01tl
@@ -302,3 +300,10 @@ blocky:
               readOnly: true
               mountPropagation: None
               subPath: config.yml
+redis-replication:
+  existingSecret:
+    enabled: false
+  redisReplication:
+    clusterSize: 3
+  redisSentinel:
+    enabled: false

clusters/cl01tl/helm/code-server/values.yaml

@@ -9,7 +9,7 @@ code-server:
         main:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.106.3@sha256:aab9520fe923b2d93dccc2c806f3dc60649c2f4a2847fcd40c942227d0f1ae8f
+            tag: 4.106.3@sha256:83793e4460090d6c46f4842ff6ab8aa26ad8a567885112bbe754b45c61935055
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/directus/Chart.lock

@@ -7,6 +7,9 @@ dependencies:
   version: 1.23.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 6.16.1
-digest: sha256:636b200b79efdd6ea36afdf29a5e85f3741b362dfcbf2af47c7aff9e55f02812
-generated: "2025-12-11T16:47:16.317535-06:00"
+  version: 7.1.1
+- name: redis-replication
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:1035fe225f5439c73fdc8b498c2164bad362e0198bc2ad40eab6b5d0bae9f86d
+generated: "2025-12-15T14:37:45.474556-06:00"

clusters/cl01tl/helm/directus/Chart.yaml

@@ -27,7 +27,10 @@ dependencies:
     version: 1.23.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 6.16.1
+    version: 7.1.1
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: redis-replication
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/directus.png
 appVersion: 11.14.0

clusters/cl01tl/helm/directus/templates/redis-replication.yaml

@@ -1,35 +0,0 @@
-apiVersion: redis.redis.opstreelabs.in/v1beta2
-kind: RedisReplication
-metadata:
-  name: redis-replication-directus
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-replication-directus
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  clusterSize: 3
-  podSecurityContext:
-    runAsUser: 1000
-    fsGroup: 1000
-  kubernetesConfig:
-    image: quay.io/opstree/redis:v8.4.0
-    imagePullPolicy: IfNotPresent
-    redisSecret:
-      name: directus-redis-config
-      key: password
-    resources:
-      requests:
-        cpu: 50m
-        memory: 128Mi
-  storage:
-    volumeClaimTemplate:
-      spec:
-        storageClassName: ceph-block
-        accessModes: ["ReadWriteOnce"]
-        resources:
-          requests:
-            storage: 1Gi
-  redisExporter:
-    enabled: true
-    image: quay.io/opstree/redis-exporter:v1.80.1

clusters/cl01tl/helm/directus/templates/redis-sentinel.yaml

@@ -1,30 +0,0 @@
-apiVersion: redis.redis.opstreelabs.in/v1beta2
-kind: RedisSentinel
-metadata:
-  name: redis-sentinel-directus
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-sentinel-directus
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  clusterSize: 3
-  podSecurityContext:
-    runAsUser: 1000
-    fsGroup: 1000
-  redisSentinelConfig:
-    redisReplicationName: redis-replication-directus
-    redisReplicationPassword:
-      secretKeyRef:
-        name: directus-redis-config
-        key: password
-  kubernetesConfig:
-    image: quay.io/opstree/redis-sentinel:v8.4.0
-    imagePullPolicy: IfNotPresent
-    redisSecret:
-      name: directus-redis-config
-      key: password
-    resources:
-      requests:
-        cpu: 10m
-        memory: 128Mi

clusters/cl01tl/helm/directus/templates/service-monitor.yaml

@@ -20,24 +20,3 @@ spec:
       bearerTokenSecret:
         name: directus-metric-token
         key: metric-token
-
----
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: redis-replication-directus
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-replication-directus
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-    redis-operator: "true"
-    env: production
-spec:
-  selector:
-    matchLabels:
-      redis_setup_type: replication
-  endpoints:
-    - port: redis-exporter
-      interval: 30s
-      scrapeTimeout: 10s

clusters/cl01tl/helm/directus/values.yaml

@@ -159,17 +159,10 @@ cloudflared-directus:
 postgres-18-cluster:
   mode: recovery
   cluster:
-    image:
-      repository: ghcr.io/cloudnative-pg/postgresql
-      tag: 18.1-standard-trixie
     storage:
       storageClass: local-path
     walStorage:
       storageClass: local-path
-    monitoring:
-      enabled: true
-      prometheusRule:
-        enabled: true
   recovery:
     method: objectStore
     objectStore:
@@ -179,11 +172,6 @@ postgres-18-cluster:
       endpointCredentials: directus-postgresql-18-cluster-backup-secret-garage
   backup:
     objectStore:
-      - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/directus/directus-postgresql-18-cluster
-        index: 1
-        retentionPolicy: "30d"
-        isWALArchiver: false
       - name: garage-local
         destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-18-cluster
         index: 1
@@ -192,6 +180,11 @@ postgres-18-cluster:
         endpointCredentialsIncludeRegion: true
         retentionPolicy: "3d"
         isWALArchiver: true
+      # - name: external
+      #   destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/directus/directus-postgresql-18-cluster
+      #   index: 1
+      #   retentionPolicy: "30d"
+      #   isWALArchiver: false
       # - name: garage-remote
       #   destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-18-cluster
       #   index: 1
@@ -202,18 +195,28 @@ postgres-18-cluster:
       #     compression: bzip2
       #     jobs: 2
     scheduledBackups:
-      - name: daily-backup
-        suspend: false
-        immediate: true
-        schedule: "0 0 0 * * *"
-        backupName: external
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 0 0 * * *"
         backupName: garage-local
+      # - name: daily-backup
+      #   suspend: false
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
       # - name: weekly-backup
       #   suspend: false
       #   immediate: true
       #   schedule: "0 0 4 * * SAT"
       #   backupName: garage-remote
+redis-replication:
+  existingSecret:
+    enabled: true
+    name: directus-redis-config
+    key: password
+  redisReplication:
+    clusterSize: 3
+  redisSentinel:
+    enabled: true
+    clusterSize: 3

clusters/cl01tl/helm/ephemera/values.yaml

@@ -52,7 +52,7 @@ ephemera:
         apprise-api:
           image:
             repository: caronc/apprise
-            tag: 1.2.6
+            tag: 1.3.0
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/freshrss/Chart.lock

@@ -7,6 +7,6 @@ dependencies:
   version: 1.23.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 6.16.1
-digest: sha256:dc8829a1f2cea88033bfda5d412dee8124154e26bfbe9e1bd67b8bb351ad7904
-generated: "2025-12-11T17:07:50.35548-06:00"
+  version: 7.1.1
+digest: sha256:2789c65a08710c82e66f5d23cf29d6ae953afe0cea8509c735ceee5be134e52b
+generated: "2025-12-15T14:51:03.037186-06:00"

clusters/cl01tl/helm/freshrss/Chart.yaml

@@ -27,7 +27,7 @@ dependencies:
     version: 1.23.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 6.16.1
+    version: 7.1.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/freshrss.png
 appVersion: 1.27.1

clusters/cl01tl/helm/freshrss/values.yaml

@@ -196,17 +196,10 @@ cloudflared:
 postgres-18-cluster:
   mode: recovery
   cluster:
-    image:
-      repository: ghcr.io/cloudnative-pg/postgresql
-      tag: 18.1-standard-trixie
     storage:
       storageClass: local-path
     walStorage:
       storageClass: local-path
-    monitoring:
-      enabled: true
-      prometheusRule:
-        enabled: true
   recovery:
     method: objectStore
     objectStore:
@@ -216,11 +209,6 @@ postgres-18-cluster:
       endpointCredentials: freshrss-postgresql-18-cluster-backup-secret-garage
   backup:
     objectStore:
-      - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/freshrss/freshrss-postgresql-18-cluster
-        index: 1
-        retentionPolicy: "30d"
-        isWALArchiver: false
       - name: garage-local
         destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-18-cluster
         index: 1
@@ -229,6 +217,11 @@ postgres-18-cluster:
         endpointCredentialsIncludeRegion: true
         retentionPolicy: "3d"
         isWALArchiver: true
+      # - name: external
+      #   destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/freshrss/freshrss-postgresql-18-cluster
+      #   index: 1
+      #   retentionPolicy: "30d"
+      #   isWALArchiver: false
       # - name: garage-remote
       #   destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-18-cluster
       #   index: 1
@@ -239,18 +232,18 @@ postgres-18-cluster:
       #     compression: bzip2
       #     jobs: 2
     scheduledBackups:
-      - name: daily-backup
-        suspend: false
-        immediate: true
-        schedule: "0 0 0 * * *"
-        backupName: external
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 0 0 * * *"
         backupName: garage-local
-      # - name: weekly-backup
+      # - name: daily-backup
       #   suspend: false
       #   immediate: true
-      #   schedule: "0 2 4 * * SAT"
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 4 * * SAT"
       #   backupName: garage-remote

clusters/cl01tl/helm/garage/values.yaml

@@ -125,7 +125,7 @@ garage:
     db:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
-      size: 10Gi
+      size: 50Gi
       retain: true
       advancedMounts:
         main:

clusters/cl01tl/helm/gatus/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 1.4.4
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 6.16.1
-digest: sha256:11d46f37e9f98a5562239e1b827a4caccc0ca14dc738681465e27ef5c5edd6d0
-generated: "2025-12-11T17:23:01.072262-06:00"
+  version: 7.1.1
+digest: sha256:882677f24d2ebed1584b41dc81118987efda2a246431ea3e7641e957bea0fff8
+generated: "2025-12-15T15:30:43.562864-06:00"

clusters/cl01tl/helm/gatus/Chart.yaml

@@ -22,7 +22,7 @@ dependencies:
     version: 1.4.4
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 6.16.1
+    version: 7.1.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/gatus.png
 appVersion: v5.33.0

clusters/cl01tl/helm/gatus/values.yaml

@@ -182,11 +182,6 @@ gatus:
       - name: n8n
         url: https://n8n.alexlebens.net
         <<: *defaults
-      - name: kronic
-        url: https://kronic.alexlebens.net
-        <<: *defaults
-        conditions:
-          - "[STATUS] == 401"
       - name: omni-tools
         url: https://omni-tools.alexlebens.net
         <<: *defaults
@@ -259,9 +254,6 @@ gatus:
       - name: garage
         url: https://garage-webui.alexlebens.net
         <<: *defaults
-      - name: pgadmin
-        url: https://pgadmin.alexlebens.net
-        <<: *defaults
       - name: whodb
         url: https://whodb.alexlebens.net
         <<: *defaults
@@ -381,17 +373,10 @@ gatus:
 postgres-18-cluster:
   mode: recovery
   cluster:
-    image:
-      repository: ghcr.io/cloudnative-pg/postgresql
-      tag: 18.1-standard-trixie
     storage:
       storageClass: local-path
     walStorage:
       storageClass: local-path
-    monitoring:
-      enabled: true
-      prometheusRule:
-        enabled: true
   recovery:
     method: objectStore
     objectStore:
@@ -401,19 +386,19 @@ postgres-18-cluster:
       endpointCredentials: gatus-postgresql-18-cluster-backup-secret-garage
   backup:
     objectStore:
-      - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/gatus/gatus-postgresql-18-cluster
-        index: 2
-        retentionPolicy: "30d"
-        isWALArchiver: false
       - name: garage-local
         destinationPath: s3://postgres-backups/cl01tl/gatus/gatus-postgresql-18-cluster
         index: 1
         endpointURL: http://garage-main.garage:3900
-        endpointCredentials: gatus-postgresql-17-cluster-backup-secret-garage
+        endpointCredentials: gatus-postgresql-18-cluster-backup-secret-garage
         endpointCredentialsIncludeRegion: true
         retentionPolicy: "3d"
         isWALArchiver: true
+      # - name: external
+      #   destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/gatus/gatus-postgresql-18-cluster
+      #   index: 1
+      #   retentionPolicy: "30d"
+      #   isWALArchiver: false
       # - name: garage-remote
       #   destinationPath: s3://postgres-backups/cl01tl/gatus/gatus-postgresql-18-cluster
       #   index: 1
@@ -424,18 +409,18 @@ postgres-18-cluster:
       #     compression: bzip2
       #     jobs: 2
     scheduledBackups:
-      - name: daily-backup
-        suspend: false
-        immediate: true
-        schedule: "0 0 0 * * *"
-        backupName: external
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 0 0 * * *"
         backupName: garage-local
-      # - name: weekly-backup
+      # - name: daily-backup
       #   suspend: false
       #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
       #   schedule: "0 0 4 * * SAT"
       #   backupName: garage-remote

clusters/cl01tl/helm/generic-device-plugin/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: generic-device-plugin
   repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-  version: 0.20.5
-digest: sha256:329b2d00301ab1467a8654dd92febfd7078db121c00c0960548010c01dee66b6
-generated: "2025-12-08T03:02:06.697075532Z"
+  version: 0.20.6
+digest: sha256:259465f8536594c9edb2d24ffa3bc95fcbe867421d776829143f45644797f325
+generated: "2025-12-13T00:08:10.184445232Z"

clusters/cl01tl/helm/generic-device-plugin/Chart.yaml

@@ -15,6 +15,6 @@ maintainers:
 dependencies:
   - name: generic-device-plugin
     repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-    version: 0.20.5
+    version: 0.20.6
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: 1.0.0

clusters/cl01tl/helm/gitea/Chart.lock

@@ -10,12 +10,18 @@ dependencies:
   version: 4.5.0
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.17.2
+  version: 0.18.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 1.23.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 6.16.1
-digest: sha256:ecb6e0283b564f37b5d60bb64860b71c3b68acc2835364c0488fd7a9e932b941
-generated: "2025-12-11T17:38:49.087683-06:00"
+  version: 7.1.1
+- name: redis-replication
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+- name: redis-replication
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:e19321e491e25ccf17b9efadd4bdf9320efab133eae4bb8110730a4e42861ad7
+generated: "2025-12-15T15:30:49.152984-06:00"

clusters/cl01tl/helm/gitea/Chart.yaml

@@ -36,7 +36,7 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
   - name: meilisearch
-    version: 0.17.2
+    version: 0.18.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     alias: cloudflared
@@ -44,7 +44,15 @@ dependencies:
     version: 1.23.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 6.16.1
+    version: 7.1.1
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: redis-replication
+    alias: redis-replication-gitea
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: redis-replication
+    alias: redis-replication-renovate
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/gitea.png
 appVersion: 1.25.2

clusters/cl01tl/helm/gitea/templates/redis-replication.yaml

@@ -1,66 +0,0 @@
-apiVersion: redis.redis.opstreelabs.in/v1beta2
-kind: RedisReplication
-metadata:
-  name: redis-replication-gitea
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-replication-gitea
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  clusterSize: 3
-  podSecurityContext:
-    runAsUser: 1000
-    fsGroup: 1000
-  kubernetesConfig:
-    image: quay.io/opstree/redis:v8.4.0
-    imagePullPolicy: IfNotPresent
-    resources:
-      requests:
-        cpu: 50m
-        memory: 128Mi
-  storage:
-    volumeClaimTemplate:
-      spec:
-        storageClassName: ceph-block
-        accessModes: ["ReadWriteOnce"]
-        resources:
-          requests:
-            storage: 10Gi
-  redisExporter:
-    enabled: true
-    image: quay.io/opstree/redis-exporter:v1.80.1
-
----
-apiVersion: redis.redis.opstreelabs.in/v1beta2
-kind: RedisReplication
-metadata:
-  name: redis-replication-renovate
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-replication-renovate
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  clusterSize: 3
-  podSecurityContext:
-    runAsUser: 1000
-    fsGroup: 1000
-  kubernetesConfig:
-    image: quay.io/opstree/redis:v8.4.0
-    imagePullPolicy: IfNotPresent
-    resources:
-      requests:
-        cpu: 50m
-        memory: 128Mi
-  storage:
-    volumeClaimTemplate:
-      spec:
-        storageClassName: ceph-block
-        accessModes: ["ReadWriteOnce"]
-        resources:
-          requests:
-            storage: 1Gi
-  redisExporter:
-    enabled: true
-    image: quay.io/opstree/redis-exporter:v1.80.1

clusters/cl01tl/helm/gitea/templates/redis-sentinel.yaml

@@ -1,23 +0,0 @@
-apiVersion: redis.redis.opstreelabs.in/v1beta2
-kind: RedisSentinel
-metadata:
-  name: redis-sentinel-gitea
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-sentinel-gitea
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  clusterSize: 3
-  podSecurityContext:
-    runAsUser: 1000
-    fsGroup: 1000
-  redisSentinelConfig:
-    redisReplicationName: redis-replication-gitea
-  kubernetesConfig:
-    image: quay.io/opstree/redis-sentinel:v8.4.0
-    imagePullPolicy: IfNotPresent
-    resources:
-      requests:
-        cpu: 10m
-        memory: 128Mi

clusters/cl01tl/helm/gitea/templates/service-monitor.yaml

@@ -14,24 +14,3 @@ spec:
       app.kubernetes.io/instance: {{ .Release.Name }}
   endpoints:
     - port: http
-
----
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: redis-replication-gitea
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-replication-gitea
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-    redis-operator: "true"
-    env: production
-spec:
-  selector:
-    matchLabels:
-      redis_setup_type: replication
-  endpoints:
-    - port: redis-exporter
-      interval: 30s
-      scrapeTimeout: 10s

clusters/cl01tl/helm/gitea/values.yaml

@@ -173,10 +173,8 @@ gitea-actions:
   giteaRootURL: http://gitea-http.gitea:3000
 backup:
   global:
+    nameOverride: gitea-backup
     fullnameOverride: gitea-backup
-    labels:
-      app.kubernetes.io/instance: gitea-backup
-      app.kubernetes.io/name: gitea-backup
   controllers:
     backup:
       type: cronjob
@@ -325,17 +323,10 @@ cloudflared:
 postgres-18-cluster:
   mode: recovery
   cluster:
-    image:
-      repository: ghcr.io/cloudnative-pg/postgresql
-      tag: 18.1-standard-trixie
     storage:
       storageClass: local-path
     walStorage:
       storageClass: local-path
-    monitoring:
-      enabled: true
-      prometheusRule:
-        enabled: true
     resources:
       requests:
         memory: 1Gi
@@ -349,11 +340,6 @@ postgres-18-cluster:
       endpointCredentials: gitea-postgresql-18-cluster-backup-secret-garage
   backup:
     objectStore:
-      - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/gitea/gitea-postgresql-18-cluster
-        index: 1
-        retentionPolicy: "30d"
-        isWALArchiver: false
       - name: garage-local
         destinationPath: s3://postgres-backups/cl01tl/gitea/gitea-postgresql-18-cluster
         index: 1
@@ -362,6 +348,11 @@ postgres-18-cluster:
         endpointCredentialsIncludeRegion: true
         retentionPolicy: "3d"
         isWALArchiver: true
+      # - name: external
+      #   destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/gitea/gitea-postgresql-18-cluster
+      #   index: 1
+      #   retentionPolicy: "30d"
+      #   isWALArchiver: false
       # - name: garage-remote
       #   destinationPath: s3://postgres-backups/cl01tl/gitea/gitea-postgresql-18-cluster
       #   index: 1
@@ -372,18 +363,45 @@ postgres-18-cluster:
       #     compression: bzip2
       #     jobs: 2
     scheduledBackups:
-      - name: daily-backup
-        suspend: false
-        immediate: true
-        schedule: "0 0 0 * * *"
-        backupName: external
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 0 0 * * *"
         backupName: garage-local
-      # - name: weekly-backup
+      # - name: daily-backup
       #   suspend: false
       #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
       #   schedule: "0 0 4 * * SAT"
       #   backupName: garage-remote
+redis-replication-gitea:
+  replicationNameOverride: redis-replication-gitea
+  sentinelNameOverride: redis-sentinel-gitea
+  existingSecret:
+    enabled: false
+  redisReplication:
+    clusterSize: 3
+    resources:
+      requests:
+        cpu: 20m
+        memory: 400Mi
+    volumeClaimTemplate:
+      spec:
+        resources:
+          requests:
+            storage: 10Gi
+  redisSentinel:
+    enabled: true
+    clusterSize: 3
+redis-replication-renovate:
+  replicationNameOverride: redis-replication-renovate
+  existingSecret:
+    enabled: false
+  redisReplication:
+    clusterSize: 1
+  redisSentinel:
+    enabled: false

clusters/cl01tl/helm/grafana-operator/Chart.lock

@@ -4,6 +4,12 @@ dependencies:
   version: v5.20.0
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 6.16.1
-digest: sha256:9640766b4a15b50a759edbc8a2aad816f9240be72bf06364acb387464245d51a
-generated: "2025-12-11T19:19:12.375716-06:00"
+  version: 7.1.1
+- name: redis-replication
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+- name: redis-replication
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:7089382a69a87a15afef83277e5b59a59b192a734c402384a61e4c65319f4891
+generated: "2025-12-15T15:30:54.939003-06:00"

clusters/cl01tl/helm/grafana-operator/Chart.yaml

@@ -21,7 +21,15 @@ dependencies:
     repository: https://grafana.github.io/helm-charts
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 6.16.1
+    version: 7.1.1
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: redis-replication
+    alias: redis-replication-unified-alerting
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: redis-replication
+    alias: redis-replication-remote-cache
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grafana.png
 appVersion: v5.20.0

clusters/cl01tl/helm/grafana-operator/templates/redis-replication.yaml

@@ -1,66 +0,0 @@
-apiVersion: redis.redis.opstreelabs.in/v1beta2
-kind: RedisReplication
-metadata:
-  name: redis-replication-unified-alerting
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-replication-unified-alerting
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  clusterSize: 3
-  podSecurityContext:
-    runAsUser: 1000
-    fsGroup: 1000
-  kubernetesConfig:
-    image: quay.io/opstree/redis:v8.4.0
-    imagePullPolicy: IfNotPresent
-    resources:
-      requests:
-        cpu: 50m
-        memory: 128Mi
-  storage:
-    volumeClaimTemplate:
-      spec:
-        storageClassName: ceph-block
-        accessModes: ["ReadWriteOnce"]
-        resources:
-          requests:
-            storage: 1Gi
-  redisExporter:
-    enabled: true
-    image: quay.io/opstree/redis-exporter:v1.80.1
-
----
-apiVersion: redis.redis.opstreelabs.in/v1beta2
-kind: RedisReplication
-metadata:
-  name: redis-replication-remote-cache
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-replication-remote-cache
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  clusterSize: 3
-  podSecurityContext:
-    runAsUser: 1000
-    fsGroup: 1000
-  kubernetesConfig:
-    image: quay.io/opstree/redis:v8.4.0
-    imagePullPolicy: IfNotPresent
-    resources:
-      requests:
-        cpu: 50m
-        memory: 128Mi
-  storage:
-    volumeClaimTemplate:
-      spec:
-        storageClassName: ceph-block
-        accessModes: ["ReadWriteOnce"]
-        resources:
-          requests:
-            storage: 1Gi
-  redisExporter:
-    enabled: true
-    image: quay.io/opstree/redis-exporter:v1.80.1

clusters/cl01tl/helm/grafana-operator/templates/service-monitor.yaml

@@ -1,19 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: redis-replication-grafana-operator
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-replication-grafana-operator
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-    redis-operator: "true"
-    env: production
-spec:
-  selector:
-    matchLabels:
-      redis_setup_type: replication
-  endpoints:
-    - port: redis-exporter
-      interval: 30s
-      scrapeTimeout: 10s

clusters/cl01tl/helm/grafana-operator/values.yaml

@@ -15,17 +15,10 @@ grafana-operator:
 postgres-18-cluster:
   mode: recovery
   cluster:
-    image:
-      repository: ghcr.io/cloudnative-pg/postgresql
-      tag: 18.1-standard-trixie
     storage:
       storageClass: local-path
     walStorage:
       storageClass: local-path
-    monitoring:
-      enabled: true
-      prometheusRule:
-        enabled: true
   recovery:
     method: objectStore
     objectStore:
@@ -35,11 +28,6 @@ postgres-18-cluster:
       endpointCredentials: grafana-operator-postgresql-18-cluster-backup-secret-garage
   backup:
     objectStore:
-      - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/grafana-operator/grafana-operator-postgresql-18-cluster
-        index: 1
-        retentionPolicy: "30d"
-        isWALArchiver: false
       - name: garage-local
         destinationPath: s3://postgres-backups/cl01tl/grafana-operator/grafana-operator-postgresql-18-cluster
         index: 1
@@ -48,6 +36,11 @@ postgres-18-cluster:
         endpointCredentialsIncludeRegion: true
         retentionPolicy: "3d"
         isWALArchiver: true
+      # - name: external
+      #   destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/grafana-operator/grafana-operator-postgresql-18-cluster
+      #   index: 1
+      #   retentionPolicy: "30d"
+      #   isWALArchiver: false
       # - name: garage-remote
       #   destinationPath: s3://postgres-backups/cl01tl/grafana-operator/grafana-operator-postgresql-18-cluster
       #   index: 1
@@ -58,18 +51,36 @@ postgres-18-cluster:
       #     compression: bzip2
       #     jobs: 2
     scheduledBackups:
-      - name: daily-backup
-        suspend: false
-        immediate: true
-        schedule: "0 0 0 * * *"
-        backupName: external
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 0 0 * * *"
         backupName: garage-local
-      # - name: weekly-backup
+      # - name: daily-backup
       #   suspend: false
       #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
       #   schedule: "0 0 4 * * SAT"
       #   backupName: garage-remote
+redis-replication-unified-alerting:
+  replicationNameOverride: redis-replication-unified-alerting
+  sentinelNameOverride: redis-sentinel-unified-alerting
+  existingSecret:
+    enabled: false
+  redisReplication:
+    clusterSize: 3
+  redisSentinel:
+    enabled: true
+    clusterSize: 3
+redis-replication-remote-cache:
+  replicationNameOverride: redis-replication-remote-cache
+  existingSecret:
+    enabled: false
+  redisReplication:
+    clusterSize: 1
+  redisSentinel:
+    enabled: false

clusters/cl01tl/helm/harbor/Chart.lock

@@ -4,6 +4,9 @@ dependencies:
   version: 1.18.1
 - name: postgres-cluster
   repository: https://gitea.alexlebens.net/api/packages/alexlebens/helm
-  version: 6.16.1
-digest: sha256:a8f5d259fb93f933050c498d9271a5b8606594c968a360f8be151f47b3feb49d
-generated: "2025-12-11T20:49:18.650522-06:00"
+  version: 7.1.1
+- name: redis-replication
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:8bd072dc65397b6c1dc8ff319e87f8df1afd50cebcd3f8c46ed753e3dcdba13a
+generated: "2025-12-15T15:36:05.141898-06:00"

clusters/cl01tl/helm/harbor/Chart.yaml

@@ -21,7 +21,10 @@ dependencies:
     repository: https://helm.goharbor.io
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 6.16.1
+    version: 7.1.1
     repository: https://gitea.alexlebens.net/api/packages/alexlebens/helm
+  - name: redis-replication
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/harbor.png
 appVersion: v2.14.1

clusters/cl01tl/helm/harbor/templates/redis-replication.yaml

@@ -1,32 +0,0 @@
-apiVersion: redis.redis.opstreelabs.in/v1beta2
-kind: RedisReplication
-metadata:
-  name: redis-replication-harbor
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-replication-harbor
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  clusterSize: 3
-  podSecurityContext:
-    runAsUser: 1000
-    fsGroup: 1000
-  kubernetesConfig:
-    image: quay.io/opstree/redis:v8.4.0
-    imagePullPolicy: IfNotPresent
-    resources:
-      requests:
-        cpu: 50m
-        memory: 128Mi
-  storage:
-    volumeClaimTemplate:
-      spec:
-        storageClassName: ceph-block
-        accessModes: ["ReadWriteOnce"]
-        resources:
-          requests:
-            storage: 1Gi
-  redisExporter:
-    enabled: true
-    image: quay.io/opstree/redis-exporter:v1.80.1

clusters/cl01tl/helm/harbor/templates/redis-sentinel.yaml

@@ -1,23 +0,0 @@
-apiVersion: redis.redis.opstreelabs.in/v1beta2
-kind: RedisSentinel
-metadata:
-  name: redis-sentinel-harbor
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-sentinel-harbor
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  clusterSize: 3
-  podSecurityContext:
-    runAsUser: 1000
-    fsGroup: 1000
-  redisSentinelConfig:
-    redisReplicationName: redis-replication-harbor
-  kubernetesConfig:
-    image: quay.io/opstree/redis-sentinel:v8.4.0
-    imagePullPolicy: IfNotPresent
-    resources:
-      requests:
-        cpu: 10m
-        memory: 128Mi

clusters/cl01tl/helm/harbor/templates/service-monitor.yaml

@@ -1,19 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: redis-replication-harbor
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-replication-harbor
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-    redis-operator: "true"
-    env: production
-spec:
-  selector:
-    matchLabels:
-      redis_setup_type: replication
-  endpoints:
-    - port: redis-exporter
-      interval: 30s
-      scrapeTimeout: 10s

clusters/cl01tl/helm/harbor/values.yaml

@@ -99,17 +99,10 @@ harbor:
 postgres-18-cluster:
   mode: recovery
   cluster:
-    image:
-      repository: ghcr.io/cloudnative-pg/postgresql
-      tag: 18.1-standard-trixie
     storage:
       storageClass: local-path
     walStorage:
       storageClass: local-path
-    monitoring:
-      enabled: true
-      prometheusRule:
-        enabled: true
   recovery:
     method: objectStore
     objectStore:
@@ -119,11 +112,6 @@ postgres-18-cluster:
       endpointCredentials: harbor-postgresql-18-cluster-backup-secret-garage
   backup:
     objectStore:
-      - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/harbor/harbor-postgresql-18-cluster
-        index: 1
-        retentionPolicy: "30d"
-        isWALArchiver: false
       - name: garage-local
         destinationPath: s3://postgres-backups/cl01tl/harbor/harbor-postgresql-18-cluster
         index: 1
@@ -132,6 +120,11 @@ postgres-18-cluster:
         endpointCredentialsIncludeRegion: true
         retentionPolicy: "3d"
         isWALArchiver: true
+      # - name: external
+      #   destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/harbor/harbor-postgresql-18-cluster
+      #   index: 1
+      #   retentionPolicy: "30d"
+      #   isWALArchiver: false
       # - name: garage-remote
       #   destinationPath: s3://postgres-backups/cl01tl/harbor/harbor-postgresql-18-cluster
       #   index: 1
@@ -142,18 +135,26 @@ postgres-18-cluster:
       #     compression: bzip2
       #     jobs: 2
     scheduledBackups:
-      - name: daily-backup
-        suspend: false
-        immediate: true
-        schedule: "0 0 0 * * *"
-        backupName: external
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 0 0 * * *"
         backupName: garage-local
-      # - name: weekly-backup
+      # - name: daily-backup
       #   suspend: false
       #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
       #   schedule: "0 0 4 * * SAT"
       #   backupName: garage-remote
+redis-replication:
+  existingSecret:
+    enabled: false
+  redisReplication:
+    clusterSize: 3
+  redisSentinel:
+    enabled: true
+    clusterSize: 3

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -21,7 +21,7 @@ home-assistant:
         code-server:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.106.3@sha256:aab9520fe923b2d93dccc2c806f3dc60649c2f4a2847fcd40c942227d0f1ae8f
+            tag: 4.106.3@sha256:83793e4460090d6c46f4842ff6ab8aa26ad8a567885112bbe754b45c61935055
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/homepage/templates/service.yaml

@@ -36,7 +36,7 @@ metadata:
   name: garage-ui-ps10rp
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: garage-ps10rp
+    app.kubernetes.io/name: garage-ui-ps10rp
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
   annotations:

clusters/cl01tl/helm/homepage/values.yaml

@@ -337,12 +337,6 @@ homepage:
                   href: https://n8n.alexlebens.net
                   siteMonitor: http://n8n-main.n8n:80
                   statusStyle: dot
-              - Jobs:
-                  icon: https://raw.githubusercontent.com/mshade/kronic/main/static/android-chrome-192x192.png
-                  description: Kronic
-                  href: https://kronic.alexlebens.net
-                  siteMonitor: http://kronic.kronic:80
-                  statusStyle: dot
               - Uptime:
                   icon: sh-gatus.webp
                   description: Gatus
@@ -513,12 +507,6 @@ homepage:
                   href: https://garage-ui-ps10rp.boreal-beaufort.ts.net
                   siteMonitor: https://garage-ui-ps10rp.boreal-beaufort.ts.net
                   statusStyle: dot
-              - Database:
-                  icon: sh-pgadmin-light.webp
-                  description: PGAdmin
-                  href: https://pgadmin.alexlebens.net
-                  siteMonitor: http://pgadmin.pgadmin:80
-                  statusStyle: dot
               - Database:
                   icon: sh-whodb.webp
                   description: WhoDB

clusters/cl01tl/helm/immich/Chart.lock

@@ -4,6 +4,9 @@ dependencies:
   version: 4.5.0
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 6.16.1
-digest: sha256:0efb7efad85276191f07755520291b6a549472af4bbd6ac32c58b29f36984e60
-generated: "2025-12-11T21:59:26.978234-06:00"
+  version: 7.1.1
+- name: redis-replication
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:f0fb98c302e8749494c4ebe612cd9ea69e9b11d062dc5a16710dffd13802f475
+generated: "2025-12-15T15:31:14.966284-06:00"

clusters/cl01tl/helm/immich/Chart.yaml

@@ -20,7 +20,10 @@ dependencies:
     version: 4.5.0
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 6.16.1
+    version: 7.1.1
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: redis-replication
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/immich.png
 appVersion: v2.3.1

clusters/cl01tl/helm/immich/templates/redis-replication.yaml

@@ -1,32 +0,0 @@
-apiVersion: redis.redis.opstreelabs.in/v1beta2
-kind: RedisReplication
-metadata:
-  name: redis-replication-immich
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-replication-immich
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  clusterSize: 3
-  podSecurityContext:
-    runAsUser: 1000
-    fsGroup: 1000
-  kubernetesConfig:
-    image: quay.io/opstree/redis:v8.4.0
-    imagePullPolicy: IfNotPresent
-    resources:
-      requests:
-        cpu: 50m
-        memory: 128Mi
-  storage:
-    volumeClaimTemplate:
-      spec:
-        storageClassName: ceph-block
-        accessModes: ["ReadWriteOnce"]
-        resources:
-          requests:
-            storage: 1Gi
-  redisExporter:
-    enabled: true
-    image: quay.io/opstree/redis-exporter:v1.80.1

clusters/cl01tl/helm/immich/templates/redis-sentinel.yaml

@@ -1,23 +0,0 @@
-apiVersion: redis.redis.opstreelabs.in/v1beta2
-kind: RedisSentinel
-metadata:
-  name: redis-sentinel-immich
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-sentinel-immich
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  clusterSize: 3
-  podSecurityContext:
-    runAsUser: 1000
-    fsGroup: 1000
-  redisSentinelConfig:
-    redisReplicationName: redis-replication-immich
-  kubernetesConfig:
-    image: quay.io/opstree/redis-sentinel:v8.4.0
-    imagePullPolicy: IfNotPresent
-    resources:
-      requests:
-        cpu: 10m
-        memory: 128Mi

clusters/cl01tl/helm/immich/templates/service-monitor.yaml

@@ -21,24 +21,3 @@ spec:
       interval: 3m
       scrapeTimeout: 1m
       path: /metrics
-
----
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: redis-replication-immich
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-replication-immich
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-    redis-operator: "true"
-    env: production
-spec:
-  selector:
-    matchLabels:
-      redis_setup_type: replication
-  endpoints:
-    - port: redis-exporter
-      interval: 30s
-      scrapeTimeout: 10s

clusters/cl01tl/helm/immich/values.yaml

@@ -136,10 +136,6 @@ postgres-18-cluster:
       storageClass: local-path
     walStorage:
       storageClass: local-path
-    monitoring:
-      enabled: true
-      prometheusRule:
-        enabled: true
     postgresql:
       parameters:
         shared_buffers: 256MB
@@ -160,11 +156,6 @@ postgres-18-cluster:
       endpointCredentials: immich-postgresql-18-cluster-backup-secret-garage
   backup:
     objectStore:
-      - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/immich/immich-postgresql-18-cluster
-        index: 1
-        retentionPolicy: "30d"
-        isWALArchiver: false
       - name: garage-local
         destinationPath: s3://postgres-backups/cl01tl/immich/immich-postgresql-18-cluster
         index: 1
@@ -173,6 +164,11 @@ postgres-18-cluster:
         endpointCredentialsIncludeRegion: true
         retentionPolicy: "3d"
         isWALArchiver: true
+      # - name: external
+      #   destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/immich/immich-postgresql-18-cluster
+      #   index: 1
+      #   retentionPolicy: "30d"
+      #   isWALArchiver: false
       # - name: garage-remote
       #   destinationPath: s3://postgres-backups/cl01tl/immich/immich-postgresql-18-cluster
       #   index: 1
@@ -183,18 +179,26 @@ postgres-18-cluster:
       #     compression: bzip2
       #     jobs: 2
     scheduledBackups:
-      - name: daily-backup
-        suspend: false
-        immediate: true
-        schedule: "0 0 0 * * *"
-        backupName: external
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 0 0 * * *"
         backupName: garage-local
-      # - name: weekly-backup
+      # - name: daily-backup
       #   suspend: false
       #   immediate: true
-      #   schedule: "0 4 4 * * SAT"
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 4 * * SAT"
       #   backupName: garage-remote
+redis-replication:
+  existingSecret:
+    enabled: false
+  redisReplication:
+    clusterSize: 3
+  redisSentinel:
+    enabled: true
+    clusterSize: 3

clusters/cl01tl/helm/intel-device-plugin/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: intel-device-plugins-operator
   repository: https://intel.github.io/helm-charts/
-  version: 0.34.0
+  version: 0.34.1
 - name: intel-device-plugins-gpu
   repository: https://intel.github.io/helm-charts/
   version: 0.34.1
-digest: sha256:dbfe08e0ce5ba59ee56dec4ad49eda24c99d45934602c88f50f2d11336302a25
-generated: "2025-12-12T08:01:53.830078355Z"
+digest: sha256:73b2b6f28ec36be02c7bf3e0ef5608e790344a4cdb3e5f183b6b079723e8b53a
+generated: "2025-12-12T08:03:32.455070212Z"

clusters/cl01tl/helm/intel-device-plugin/Chart.yaml

@@ -16,7 +16,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: intel-device-plugins-operator
-    version: 0.34.0
+    version: 0.34.1
     repository: https://intel.github.io/helm-charts/
   - name: intel-device-plugins-gpu
     version: 0.34.1

clusters/cl01tl/helm/jellyfin/Chart.yaml

@@ -22,4 +22,4 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/jellyfin.png
-appVersion: 10.10.7
+appVersion: 10.11.4

clusters/cl01tl/helm/jellystat/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 4.5.0
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 6.16.1
-digest: sha256:6c8b6a56bcdad0ea3f8e998c28642deaf449a7a37aea8ba9616d88fcc6d2bc14
-generated: "2025-12-05T17:06:11.6747146Z"
+  version: 7.1.1
+digest: sha256:1420b2a4ee76b1e6085fb81f60802bfae1273622c2d91085e7baebcce3e845fd
+generated: "2025-12-15T15:31:26.51811-06:00"

clusters/cl01tl/helm/jellystat/Chart.yaml

@@ -20,8 +20,8 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
   - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 6.16.1
+    alias: postgres-18-cluster
+    version: 7.1.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/jellystat.png
 appVersion: 1.1.6

clusters/cl01tl/helm/jellystat/templates/external-secret.yaml

@@ -95,10 +95,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: jellystat-postgresql-17-cluster-backup-secret
+  name: jellystat-postgresql-18-cluster-backup-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: jellystat-postgresql-17-cluster-backup-secret
+    app.kubernetes.io/name: jellystat-postgresql-18-cluster-backup-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -125,10 +125,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: jellystat-postgresql-17-cluster-backup-secret-garage
+  name: jellystat-postgresql-18-cluster-backup-secret-garage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: jellystat-postgresql-17-cluster-backup-secret-garage
+    app.kubernetes.io/name: jellystat-postgresql-18-cluster-backup-secret-garage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:

clusters/cl01tl/helm/jellystat/values.yaml

@@ -32,27 +32,27 @@ jellystat:
             - name: POSTGRES_USER
               valueFrom:
                 secretKeyRef:
-                  name: jellystat-postgresql-17-cluster-app
+                  name: jellystat-postgresql-18-cluster-app
                   key: username
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: jellystat-postgresql-17-cluster-app
+                  name: jellystat-postgresql-18-cluster-app
                   key: password
             - name: POSTGRES_DB
               valueFrom:
                 secretKeyRef:
-                  name: jellystat-postgresql-17-cluster-app
+                  name: jellystat-postgresql-18-cluster-app
                   key: dbname
             - name: POSTGRES_IP
               valueFrom:
                 secretKeyRef:
-                  name: jellystat-postgresql-17-cluster-app
+                  name: jellystat-postgresql-18-cluster-app
                   key: host
             - name: POSTGRES_PORT
               valueFrom:
                 secretKeyRef:
-                  name: jellystat-postgresql-17-cluster-app
+                  name: jellystat-postgresql-18-cluster-app
                   key: port
           resources:
             requests:
@@ -78,59 +78,57 @@ jellystat:
           main:
             - path: /app/backend/backup-data
               readOnly: false
-postgres-17-cluster:
+postgres-18-cluster:
   mode: recovery
   cluster:
     storage:
       storageClass: local-path
     walStorage:
       storageClass: local-path
-    monitoring:
-      enabled: true
-      prometheusRule:
-        enabled: true
   recovery:
     method: objectStore
     objectStore:
-      destinationPath: s3://postgres-backups/cl01tl/jellystat/jellystat-postgresql-17-cluster
+      destinationPath: s3://postgres-backups/cl01tl/jellystat/jellystat-postgresql-18-cluster
       endpointURL: http://garage-main.garage:3900
       index: 1
-      endpointCredentials: jellystat-postgresql-17-cluster-backup-secret-garage
+      endpointCredentials: jellystat-postgresql-18-cluster-backup-secret-garage
   backup:
     objectStore:
-      - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/jellystat/jellystat-postgresql-17-cluster
-        index: 1
-        retentionPolicy: "30d"
-        isWALArchiver: false
       - name: garage-local
-        destinationPath: s3://postgres-backups/cl01tl/jellystat/jellystat-postgresql-17-cluster
+        destinationPath: s3://postgres-backups/cl01tl/jellystat/jellystat-postgresql-18-cluster
         index: 1
         endpointURL: http://garage-main.garage:3900
-        endpointCredentials: jellystat-postgresql-17-cluster-backup-secret-garage
+        endpointCredentials: jellystat-postgresql-18-cluster-backup-secret-garage
         endpointCredentialsIncludeRegion: true
         retentionPolicy: "3d"
         isWALArchiver: true
+      # - name: external
+      #   destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/jellystat/jellystat-postgresql-18-cluster
+      #   index: 1
+      #   retentionPolicy: "30d"
+      #   isWALArchiver: false
       # - name: garage-remote
-      #   destinationPath: s3://postgres-backups/cl01tl/jellystat/jellystat-postgresql-17-cluster
+      #   destinationPath: s3://postgres-backups/cl01tl/jellystat/jellystat-postgresql-18-cluster
       #   index: 1
       #   endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
-      #   endpointCredentials: jellystat-postgresql-17-cluster-backup-secret-garage
+      #   endpointCredentials: jellystat-postgresql-18-cluster-backup-secret-garage
       #   retentionPolicy: "30d"
       #   data:
       #     compression: bzip2
       #     jobs: 2
     scheduledBackups:
-      - name: daily-backup
-        suspend: false
-        schedule: "0 0 0 * * *"
-        backupName: external
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 0 0 * * *"
         backupName: garage-local
-      # - name: weekly-backup
+      # - name: daily-backup
       #   suspend: false
-      #   schedule: "0 6 4 * * SAT"
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 4 * * SAT"
       #   backupName: garage-remote

clusters/cl01tl/helm/karakeep/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.5.0
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.17.2
+  version: 0.18.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 1.23.2
-digest: sha256:c291962defb9fb8614db91ea3eef795b2bdf82e0364595a27cbd335e7f9a3179
-generated: "2025-12-07T02:55:11.250839916Z"
+digest: sha256:132f367449a238ecba12a35d68e7c3a044ca27ed04eee1e374140971e496d964
+generated: "2025-12-12T21:03:25.448446883Z"

clusters/cl01tl/helm/karakeep/Chart.yaml

@@ -22,11 +22,11 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
   - name: meilisearch
-    version: 0.17.2
+    version: 0.18.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     alias: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
     version: 1.23.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/webp/karakeep.webp
-appVersion: 0.26.0
+appVersion: 0.29.1

clusters/cl01tl/helm/kiwix/Chart.yaml

@@ -18,4 +18,4 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kiwix-dark.png
-appVersion: 3.7.0
+appVersion: 3.8.1

clusters/cl01tl/helm/komodo/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 4.5.0
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 6.16.1
-digest: sha256:39fd05347cf1189a1cafbbbed8531de082dc4fa989ec46f0ecab661c307d89ac
-generated: "2025-12-05T17:06:55.655563589Z"
+  version: 7.1.1
+digest: sha256:af53027913a6984910269dd07fadd06d6c40d260a677244165311fb638d45e88
+generated: "2025-12-15T15:31:35.269554-06:00"

clusters/cl01tl/helm/komodo/Chart.yaml

@@ -23,7 +23,7 @@ dependencies:
     version: 4.5.0
   - name: postgres-cluster
     alias: postgresql-17-fdb-cluster
-    version: 6.16.1
+    version: 7.1.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/komodo.png
-appVersion: v1.17.5
+appVersion: v1.19.5

clusters/cl01tl/helm/komodo/values.yaml

@@ -145,7 +145,7 @@ komodo:
               readOnly: false
 postgresql-17-fdb-cluster:
   nameOverride: komodo-postgresql-17-fdb
-  mode: standalone
+  mode: recovery
   cluster:
     image:
       repository: ghcr.io/ferretdb/postgres-documentdb
@@ -156,11 +156,6 @@ postgresql-17-fdb-cluster:
       storageClass: local-path
     postgresUID: 999
     postgresGID: 999
-    enableSuperuserAccess: true
-    monitoring:
-      enabled: true
-      prometheusRule:
-        enabled: true
     postgresql:
       parameters:
         cron.database_name: 'ferretDB'
@@ -198,11 +193,6 @@ postgresql-17-fdb-cluster:
       endpointCredentials: komodo-postgresql-17-cluster-backup-secret-garage
   backup:
     objectStore:
-      - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/komodo/komodo-postgresql-17-fdb-cluster
-        index: 2
-        retentionPolicy: "30d"
-        isWALArchiver: false
       - name: garage-local
         destinationPath: s3://postgres-backups/cl01tl/komodo/komodo-postgresql-17-cluster
         index: 1
@@ -211,6 +201,11 @@ postgresql-17-fdb-cluster:
         endpointCredentialsIncludeRegion: true
         retentionPolicy: "3d"
         isWALArchiver: true
+      # - name: external
+      #   destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/komodo/komodo-postgresql-17-fdb-cluster
+      #   index: 1
+      #   retentionPolicy: "30d"
+      #   isWALArchiver: false
       # - name: garage-remote
       #   destinationPath: s3://postgres-backups/cl01tl/komodo/komodo-postgresql-17-cluster
       #   index: 1
@@ -221,16 +216,18 @@ postgresql-17-fdb-cluster:
       #     compression: bzip2
       #     jobs: 2
     scheduledBackups:
-      - name: daily-backup
-        suspend: false
-        schedule: "0 0 0 * * *"
-        backupName: external
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 0 0 * * *"
         backupName: garage-local
-      # - name: weekly-backup
+      # - name: daily-backup
       #   suspend: false
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
       #   schedule: "0 0 4 * * SAT"
       #   backupName: garage-remote

clusters/cl01tl/helm/kronic/Chart.lock

@@ -1,6 +0,0 @@
-dependencies:
-- name: kronic
-  repository: https://mshade.github.io/kronic/
-  version: 0.1.7
-digest: sha256:cd9b035491c58c6fff903e2c4e750ef41e2c360555468df6a15c2457c1873fa1
-generated: "2025-12-01T19:55:52.361339-06:00"

clusters/cl01tl/helm/kronic/Chart.yaml

@@ -1,22 +0,0 @@
-apiVersion: v2
-name: kronic
-version: 1.0.0
-description: Kronic
-keywords:
-  - kronic
-  - cron-job
-  - dashboard
-  - kubernetes
-home: https://wiki.alexlebens.dev/s/f1191e27-264a-42bf-a3aa-3dcc35820a62
-sources:
-  - https://github.com/mshade/kronic
-  - https://github.com/mshade/kronic/pkgs/container/kronic
-  - https://github.com/mshade/kronic/tree/main/chart/kronic
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: kronic
-    repository: https://mshade.github.io/kronic/
-    version: 0.1.7
-icon: https://raw.githubusercontent.com/mshade/kronic/main/static/android-chrome-192x192.png
-appVersion:  v0.1.4

clusters/cl01tl/helm/kronic/templates/external-secret.yaml

@@ -1,21 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: kronic-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: kronic-config-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: password
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/kronic/auth
-        metadataPolicy: None
-        property: password

clusters/cl01tl/helm/kronic/templates/http-route.yaml

@@ -1,28 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: https-route-kronic
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: https-route-kronic
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-  hostnames:
-    - kronic.alexlebens.net
-  rules:
-    - matches:
-      - path:
-          type: PathPrefix
-          value: /
-      backendRefs:
-        - group: ''
-          kind: Service
-          name: kronic
-          port: 80
-          weight: 100

clusters/cl01tl/helm/kronic/values.yaml

@@ -1,17 +0,0 @@
-kronic:
-  replicaCount: 1
-  image:
-    repository: ghcr.io/mshade/kronic
-    tag: v0.1.4
-  auth:
-    enabled: true
-    adminUsername: kronic
-    existingSecretName: kronic-config-secret
-  env:
-    KRONIC_ALLOW_NAMESPACES: "gitea,vault,talos,libation,kubernetes-cloudflare-ddns"
-  ingress:
-    enabled: false
-  resources:
-    requests:
-      cpu: 10m
-      memory: 256Mi

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -5,5 +5,8 @@ dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.5.0
-digest: sha256:78e60a6bd6407b1a2d0e1bb9f7717faedd7ad43ded9cb4b6a93e29e85bdf294a
-generated: "2025-12-10T21:05:54.967633057Z"
+- name: redis-replication
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:ab60270fcaf467cda51a683d01978f805df2f08b3aa2ea490ef3374349a549a4
+generated: "2025-12-15T13:01:35.345305-06:00"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -12,6 +12,7 @@ keywords:
 home: https://wiki.alexlebens.dev/s/cd9fc3a4-aa88-4285-8886-91a6c5aecf7d
 sources:
   - https://github.com/prometheus/prometheus
+  - https://github.com/prometheus-operator/kube-prometheus
   - https://github.com/alexbakker/alertmanager-ntfy
   - https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack
   - https://github.com/bjw-s/helm-charts/blob/main/charts/other/app-template
@@ -25,5 +26,9 @@ dependencies:
     alias: ntfy-alertmanager
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
+  - name: redis-replication
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prometheus.png
-appVersion: v0.82.0
+# renovate: github=prometheus-operator/prometheus-operator
+appVersion: v0.87.1

clusters/cl01tl/helm/kube-prometheus-stack/templates/external-secret.yaml

@@ -12,20 +12,6 @@ spec:
     kind: ClusterSecretStore
     name: vault
   data:
-    - secretKey: pushover_token
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /pushover/key
-        metadataPolicy: None
-        property: alertmanager_key
-    - secretKey: pushover_user_key
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /pushover/key
-        metadataPolicy: None
-        property: user_key
     - secretKey: ntfy_password
       remoteRef:
         conversionStrategy: Default

clusters/cl01tl/helm/kube-prometheus-stack/templates/redis-replication.yaml

@@ -1,32 +0,0 @@
-apiVersion: redis.redis.opstreelabs.in/v1beta2
-kind: RedisReplication
-metadata:
-  name: redis-replication-kube-prometheus-stack
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-replication-kube-prometheus-stack
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  clusterSize: 3
-  podSecurityContext:
-    runAsUser: 1000
-    fsGroup: 1000
-  kubernetesConfig:
-    image: quay.io/opstree/redis:v8.0.3
-    imagePullPolicy: IfNotPresent
-    resources:
-      requests:
-        cpu: 50m
-        memory: 128Mi
-  storage:
-    volumeClaimTemplate:
-      spec:
-        storageClassName: ceph-block
-        accessModes: ["ReadWriteOnce"]
-        resources:
-          requests:
-            storage: 1Gi
-  redisExporter:
-    enabled: true
-    image: quay.io/opstree/redis-exporter:v1.48.0

clusters/cl01tl/helm/kube-prometheus-stack/templates/service-monitor.yaml

@@ -1,19 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: redis-replication-kube-prometheus-stack
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: redis-replication-kube-prometheus-stack
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-    redis-operator: "true"
-    env: production
-spec:
-  selector:
-    matchLabels:
-      redis_setup_type: replication
-  endpoints:
-    - port: redis-exporter
-      interval: 30s
-      scrapeTimeout: 10s

clusters/cl01tl/helm/kube-prometheus-stack/values.yaml

@@ -26,11 +26,6 @@ kube-prometheus-stack:
             group_interval: 5m
             repeat_interval: 24h
       receivers:
-        - name: pushover
-          pushover_configs:
-            - send_resolved: true
-              user_key_file: /etc/alertmanager/secrets/alertmanager-config-secret/pushover_user_key
-              token_file: /etc/alertmanager/secrets/alertmanager-config-secret/pushover_token
         - name: ntfy
           webhook_configs:
             - url: http://ntfy-alertmanager.kube-prometheus-stack:80
@@ -145,3 +140,11 @@ ntfy-alertmanager:
               readOnly: true
               mountPropagation: None
               subPath: config
+redis-replication:
+  existingSecret:
+    enabled: false
+  redisReplication:
+    clusterSize: 3
+  redisSentinel:
+    enabled: true
+    clusterSize: 3

clusters/cl01tl/helm/kubelet-serving-cert-approver/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
-appVersion: 0.10.0
+appVersion: 0.10.1

clusters/cl01tl/helm/libation/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/libation.png
-appVersion: 12.4.3
+appVersion: 12.8.2

clusters/cl01tl/helm/libation/values.yaml

@@ -6,7 +6,7 @@ libation:
         suspend: false
         concurrencyPolicy: Forbid
         timeZone: US/Central
-        schedule: "30 4 * * *"
+        schedule: "0 0 * * *"
         startingDeadlineSeconds: 90
         successfulJobsHistory: 3
         failedJobsHistory: 3
@@ -16,7 +16,7 @@ libation:
         main:
           image:
             repository: rmcrackan/libation
-            tag: 12.8.1
+            tag: 12.8.2
             pullPolicy: IfNotPresent
           env:
             - name: SLEEP_TIME

clusters/cl01tl/helm/lidarr/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 4.5.0
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 6.16.1
-digest: sha256:e13dd5117332240d6a3127ebd18ebc478014b87291b7807e48471980c439fd16
-generated: "2025-12-05T17:07:59.963348904Z"
+  version: 7.1.1
+digest: sha256:1f5783eb14154ecf2d4d85c3874bcbee86044a8ecd5386ff1e97f5157bfbb057
+generated: "2025-12-15T15:31:49.133431-06:00"

clusters/cl01tl/helm/lidarr/Chart.yaml

@@ -23,8 +23,8 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
   - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 6.16.1
+    alias: postgres-18-cluster
+    version: 7.1.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/lidarr.png
-appVersion: 2.13.3
+appVersion: 3.1.0

clusters/cl01tl/helm/lidarr/templates/external-secret.yaml

@@ -58,10 +58,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: lidarr-postgresql-17-cluster-backup-secret
+  name: lidarr-postgresql-18-cluster-backup-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: lidarr-postgresql-17-cluster-backup-secret
+    app.kubernetes.io/name: lidarr-postgresql-18-cluster-backup-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -88,10 +88,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: lidarr-postgresql-17-cluster-backup-secret-garage
+  name: lidarr-postgresql-18-cluster-backup-secret-garage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: lidarr-postgresql-17-cluster-backup-secret-garage
+    app.kubernetes.io/name: lidarr-postgresql-18-cluster-backup-secret-garage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:

clusters/cl01tl/helm/lidarr/values.yaml

@@ -15,7 +15,7 @@ lidarr:
         main:
           image:
             repository: ghcr.io/linuxserver/lidarr
-            tag: 2.14.5@sha256:5e1235d00b5d1c1f60ca0d472e554a6611aef41aa7b5b6d88260214bf4809af0
+            tag: 3.1.0@sha256:c1e17cc29421c9da603f0c727b7785d280dc98dfb1f835d0b176485dc8c5deb5
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -83,69 +83,64 @@ lidarr:
           main:
             - path: /mnt/store
               readOnly: false
-postgres-17-cluster:
-  nameOverride: lidarr2-postgresql-17
+postgres-18-cluster:
   mode: recovery
   cluster:
     storage:
       storageClass: local-path
     walStorage:
       storageClass: local-path
-    monitoring:
-      enabled: true
-      prometheusRule:
-        enabled: true
-    resources:
-      requests:
-        memory: 1Gi
-        cpu: 200m
     initdb:
+      database: app
+      owner: app
       postInitSQL:
-        - CREATE DATABASE "lidarr-main" OWNER "app";
-        - CREATE DATABASE "lidarr-log" OWNER "app";
+        - CREATE DATABASE IF NOT EXISTS "lidarr-main" OWNER "app";
+        - CREATE DATABASE IF NOT EXISTS "lidarr-log" OWNER "app";
   recovery:
     method: objectStore
     objectStore:
-      destinationPath: s3://postgres-backups/cl01tl/lidarr/lidarr2-postgresql-17-cluster
+      destinationPath: s3://postgres-backups/cl01tl/lidarr/lidarr-postgresql-18-cluster
       endpointURL: http://garage-main.garage:3900
       index: 1
-      endpointCredentials: lidarr-postgresql-17-cluster-backup-secret
+      endpointCredentials: lidarr-postgresql-18-cluster-backup-secret
   backup:
     objectStore:
-      - name: external
-        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/lidarr2/lidarr2-postgresql-17-cluster
-        index: 1
-        endpointCredentials: lidarr-postgresql-17-cluster-backup-secret
-        retentionPolicy: "30d"
-        isWALArchiver: false
       - name: garage-local
-        destinationPath: s3://postgres-backups/cl01tl/lidarr/lidarr2-postgresql-17-cluster
+        destinationPath: s3://postgres-backups/cl01tl/lidarr/lidarr-postgresql-18-cluster
         index: 1
         endpointURL: http://garage-main.garage:3900
-        endpointCredentials: lidarr-postgresql-17-cluster-backup-secret-garage
+        endpointCredentials: lidarr-postgresql-18-cluster-backup-secret-garage
         endpointCredentialsIncludeRegion: true
         retentionPolicy: "3d"
         isWALArchiver: true
+      # - name: external
+      #   destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/lidarr/lidarr-postgresql-18-cluster
+      #   index: 1
+      #   endpointCredentials: lidarr-postgresql-18-cluster-backup-secret
+      #   retentionPolicy: "30d"
+      #   isWALArchiver: false
       # - name: garage-remote
-      #   destinationPath: s3://postgres-backups/cl01tl/lidarr/lidarr2-postgresql-17-cluster
+      #   destinationPath: s3://postgres-backups/cl01tl/lidarr/lidarr-postgresql-18-cluster
       #   index: 1
       #   endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
-      #   endpointCredentials: lidarr-postgresql-17-cluster-backup-secret-garage
+      #   endpointCredentials: lidarr-postgresql-18-cluster-backup-secret-garage
       #   retentionPolicy: "30d"
       #   data:
       #     compression: bzip2
       #     jobs: 2
     scheduledBackups:
-      - name: daily-backup
-        suspend: false
-        schedule: "0 0 0 * * *"
-        backupName: external
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 0 0 * * *"
         backupName: garage-local
-      # - name: weekly-backup
+      # - name: daily-backup
       #   suspend: false
-      #   schedule: "0 8 4 * * SAT"
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 4 * * SAT"
       #   backupName: garage-remote

clusters/cl01tl/helm/lidatube/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/lidatube.png
-appVersion: 0.2.22
+appVersion: 0.2.42

clusters/cl01tl/helm/local-path-provisioner/Chart.yaml

@@ -18,4 +18,4 @@ dependencies:
     version: 0.0.33
     repository: https://charts.containeroo.ch
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
-appVersion: v0.0.31
+appVersion: v0.0.32

clusters/cl01tl/helm/loki/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: loki
   repository: https://grafana.github.io/helm-charts
-  version: 6.48.0
+  version: 6.49.0
 - name: promtail
   repository: https://grafana.github.io/helm-charts
   version: 6.17.1
-digest: sha256:218f6fdff5df62e43f081f045ab7ccba541a792b42750e3ebb8ac28308072724
-generated: "2025-12-10T18:02:17.566041524Z"
+digest: sha256:56aa7fd5ac7a16617b60e4a3f501aeeec1bdfbb3d67a41b45f33d3a4cbbed07e
+generated: "2025-12-14T20:36:23.645088704Z"

clusters/cl01tl/helm/loki/Chart.yaml

@@ -16,10 +16,10 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: loki
-    version: 6.48.0
+    version: 6.49.0
     repository: https://grafana.github.io/helm-charts
   - name: promtail
     version: 6.17.1
     repository: https://grafana.github.io/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/loki.png
-appVersion: 3.4.2
+appVersion: 3.6.3

clusters/cl01tl/helm/matrix-synapse/Chart.lock

@@ -5,6 +5,12 @@ dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.5.0
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.5.0
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.5.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 1.23.2
@@ -13,6 +19,12 @@ dependencies:
   version: 1.23.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 6.16.1
-digest: sha256:b1df95bd8c258c15178f35b229b2d2aee28fc2fff2b5176ed734a7aaeffaa372
-generated: "2025-12-10T17:01:51.601498219Z"
+  version: 7.1.3
+- name: redis-replication
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+- name: redis-replication
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:c08d2fd5436ca9f0d1b159d6d424ab42d171a967ca97178b2f8dd60de83f9cc9
+generated: "2025-12-15T15:56:54.377467-06:00"

clusters/cl01tl/helm/matrix-synapse/Chart.yaml

@@ -35,14 +35,14 @@ dependencies:
     alias: matrix-hookshot
     version: 4.5.0
     repository: https://bjw-s-labs.github.io/helm-charts/
-  # - name: app-template
-  #   alias: mautrix-discord
-  #   repository: https://bjw-s-labs.github.io/helm-charts/
-  #   version: 4.0.1
-  # - name: app-template
-  #   alias: mautrix-whatsapp
-  #   repository: https://bjw-s-labs.github.io/helm-charts/
-  #   version: 4.0.1
+  - name: app-template
+    alias: mautrix-discord
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.5.0
+  - name: app-template
+    alias: mautrix-whatsapp
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.5.0
   - name: cloudflared
     alias: cloudflared-synapse
     version: 1.23.2
@@ -52,8 +52,16 @@ dependencies:
     version: 1.23.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 6.16.1
+    alias: postgres-18-cluster
+    version: 7.1.3
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: redis-replication
+    alias: redis-replication-matrix-synapse
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: redis-replication
+    alias: redis-replication-hookshot
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/matrix.png
-appVersion: 1.129.0
+appVersion: 1.144.0

clusters/cl01tl/helm/matrix-synapse/templates/external-secret.yaml

@@ -94,63 +94,64 @@ spec:
         metadataPolicy: None
         property: passkey
 
-# ---
-# apiVersion: external-secrets.io/v1
-# kind: ExternalSecret
-# metadata:
-#   name: mautrix-discord-config-secret
-#   namespace: {{ .Release.Namespace }}
-  # labels:
-  #   app.kubernetes.io/name: {{ .Release.Name }}
-  #   app.kubernetes.io/instance: {{ .Release.Name }}
-# spec:
-#   secretStoreRef:
-#     kind: ClusterSecretStore
-#     name: vault
-#   data:
-#     - secretKey: config.yaml
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/matrix-synapse/mautrix-discord
-#         metadataPolicy: None
-#         property: config
-#     - secretKey: mautrix-discord-registration.yaml
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/matrix-synapse/mautrix-discord
-#         metadataPolicy: None
-#         property: registration
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: mautrix-discord-config-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: config.yaml
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/matrix-synapse/mautrix-discord
+        metadataPolicy: None
+        property: config
+    - secretKey: mautrix-discord-registration.yaml
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/matrix-synapse/mautrix-discord
+        metadataPolicy: None
+        property: registration
 
-# ---
-# apiVersion: external-secrets.io/v1
-# kind: ExternalSecret
-# metadata:
-#   name: mautrix-whatsapp-config-secret
-#   namespace: {{ .Release.Namespace }}
-  # labels:
-  #   app.kubernetes.io/name: {{ .Release.Name }}
-  #   app.kubernetes.io/instance: {{ .Release.Name }}
-# spec:
-#   secretStoreRef:
-#     kind: ClusterSecretStore
-#     name: vault
-#   data:
-#     - secretKey: config.yaml
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/matrix-synapse/mautrix-whatsapp
-#         metadataPolicy: None
-#         property: config
-#     - secretKey: mautrix-whatsapp-registration.yaml
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/matrix-synapse/mautrix-whatsapp
-#         metadataPolicy: None
-#         property: registration
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: mautrix-whatsapp-config-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: mautrix-whatsapp-config-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: config.yaml
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/matrix-synapse/mautrix-whatsapp
+        metadataPolicy: None
+        property: config
+    - secretKey: mautrix-whatsapp-registration.yaml
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/matrix-synapse/mautrix-whatsapp
+        metadataPolicy: None
+        property: registration
 
 ---
 apiVersion: external-secrets.io/v1
@@ -301,126 +302,126 @@ spec:
         metadataPolicy: None
         property: secret_key
 
-# ---
-# apiVersion: external-secrets.io/v1
-# kind: ExternalSecret
-# metadata:
-#   name: mautrix-discord-data-backup-secret
-#   namespace: {{ .Release.Namespace }}
-  # labels:
-  #   app.kubernetes.io/name: {{ .Release.Name }}
-  #   app.kubernetes.io/instance: {{ .Release.Name }}
-# spec:
-#   secretStoreRef:
-#     kind: ClusterSecretStore
-#     name: vault
-#   target:
-#     template:
-#       mergePolicy: Merge
-#       engineVersion: v2
-#       data:
-#         RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/matrix-synapse/mautrix-discord-data"
-#   data:
-#     - secretKey: BUCKET_ENDPOINT
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: S3_BUCKET_ENDPOINT
-#     - secretKey: RESTIC_PASSWORD
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: RESTIC_PASSWORD
-#     - secretKey: AWS_DEFAULT_REGION
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: AWS_DEFAULT_REGION
-#     - secretKey: AWS_ACCESS_KEY_ID
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /digital-ocean/home-infra/volsync-backups
-#         metadataPolicy: None
-#         property: access_key
-#     - secretKey: AWS_SECRET_ACCESS_KEY
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /digital-ocean/home-infra/volsync-backups
-#         metadataPolicy: None
-#         property: secret_key
-
-# ---
-# apiVersion: external-secrets.io/v1
-# kind: ExternalSecret
-# metadata:
-#   name: mautrix-whatsapp-data-backup-secret
-#   namespace: {{ .Release.Namespace }}
-  # labels:
-  #   app.kubernetes.io/name: {{ .Release.Name }}
-  #   app.kubernetes.io/instance: {{ .Release.Name }}
-# spec:
-#   secretStoreRef:
-#     kind: ClusterSecretStore
-#     name: vault
-#   target:
-#     template:
-#       mergePolicy: Merge
-#       engineVersion: v2
-#       data:
-#         RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/matrix-synapse/mautrix-whatsapp-data"
-#   data:
-#     - secretKey: BUCKET_ENDPOINT
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: S3_BUCKET_ENDPOINT
-#     - secretKey: RESTIC_PASSWORD
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: RESTIC_PASSWORD
-#     - secretKey: AWS_DEFAULT_REGION
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: AWS_DEFAULT_REGION
-#     - secretKey: AWS_ACCESS_KEY_ID
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /digital-ocean/home-infra/volsync-backups
-#         metadataPolicy: None
-#         property: access_key
-#     - secretKey: AWS_SECRET_ACCESS_KEY
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /digital-ocean/home-infra/volsync-backups
-#         metadataPolicy: None
-#         property: secret_key
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: mautrix-discord-data-backup-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  target:
+    template:
+      mergePolicy: Merge
+      engineVersion: v2
+      data:
+        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/matrix-synapse/mautrix-discord-data"
+  data:
+    - secretKey: BUCKET_ENDPOINT
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/volsync/restic/config
+        metadataPolicy: None
+        property: S3_BUCKET_ENDPOINT
+    - secretKey: RESTIC_PASSWORD
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/volsync/restic/config
+        metadataPolicy: None
+        property: RESTIC_PASSWORD
+    - secretKey: AWS_DEFAULT_REGION
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/volsync/restic/config
+        metadataPolicy: None
+        property: AWS_DEFAULT_REGION
+    - secretKey: AWS_ACCESS_KEY_ID
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /digital-ocean/home-infra/volsync-backups
+        metadataPolicy: None
+        property: access_key
+    - secretKey: AWS_SECRET_ACCESS_KEY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /digital-ocean/home-infra/volsync-backups
+        metadataPolicy: None
+        property: secret_key
 
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: matrix-synapse-postgresql-17-cluster-backup-secret
+  name: mautrix-whatsapp-data-backup-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: matrix-synapse-postgresql-17-cluster-backup-secret
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  target:
+    template:
+      mergePolicy: Merge
+      engineVersion: v2
+      data:
+        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/matrix-synapse/mautrix-whatsapp-data"
+  data:
+    - secretKey: BUCKET_ENDPOINT
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/volsync/restic/config
+        metadataPolicy: None
+        property: S3_BUCKET_ENDPOINT
+    - secretKey: RESTIC_PASSWORD
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/volsync/restic/config
+        metadataPolicy: None
+        property: RESTIC_PASSWORD
+    - secretKey: AWS_DEFAULT_REGION
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/volsync/restic/config
+        metadataPolicy: None
+        property: AWS_DEFAULT_REGION
+    - secretKey: AWS_ACCESS_KEY_ID
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /digital-ocean/home-infra/volsync-backups
+        metadataPolicy: None
+        property: access_key
+    - secretKey: AWS_SECRET_ACCESS_KEY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /digital-ocean/home-infra/volsync-backups
+        metadataPolicy: None
+        property: secret_key
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: matrix-synapse-postgresql-18-cluster-backup-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-synapse-postgresql-18-cluster-backup-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -447,10 +448,10 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: matrix-synapse-postgresql-17-cluster-backup-secret-garage
+  name: matrix-synapse-postgresql-18-cluster-backup-secret-garage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: matrix-synapse-postgresql-17-cluster-backup-secret-garage
+    app.kubernetes.io/name: matrix-synapse-postgresql-18-cluster-backup-secret-garage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec: