Update ghcr.io/orwellianepilogue/ephemera Docker tag to v2

clusters/cl01tl/helm/argo-workflows/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: argo-workflows
   repository: https://argoproj.github.io/argo-helm
-  version: 0.46.4
+  version: 0.46.3
 - name: argo-events
   repository: https://argoproj.github.io/argo-helm
   version: 2.4.19
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.4.5
-digest: sha256:025ab1620b24c23d2e90e65ef7f919297c6d2fd2ee324a43afc5b0bd5ab79fbf
+digest: sha256:a173eb2acc1e305074b6f81161229a27e00fa7a2e7ea14f17bbc3fca444e65a4
-generated: "2026-01-10T11:01:50.673732071Z"
+generated: "2026-01-07T01:51:33.628737915Z"

clusters/cl01tl/helm/argo-workflows/Chart.yaml

@@ -18,7 +18,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-workflows
-    version: 0.46.4
+    version: 0.46.3
     repository: https://argoproj.github.io/argo-helm
   - name: argo-events
     version: 2.4.19

clusters/cl01tl/helm/authentik/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 2025.10.3
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.1.6
+  version: 2.1.4
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.4.5
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.1
+  version: 0.5.0
-digest: sha256:b9fe766e223b1f65430c64c02f94c1f97ad7149a5a9acc7bab8339615706293f
+digest: sha256:d357b0a8f4351068d9ce7223ffd01a0921202cb2b41669421b8429bc3f7778eb
-generated: "2026-01-08T23:01:41.173354097Z"
+generated: "2025-12-27T19:45:06.478084011Z"

clusters/cl01tl/helm/authentik/Chart.yaml

@@ -25,13 +25,13 @@ dependencies:
     repository: https://charts.goauthentik.io/
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.1.6
+    version: 2.1.4
   - name: postgres-cluster
     alias: postgres-18-cluster
     version: 7.4.5
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: redis-replication
-    version: 1.0.1
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/authentik.png
 # renovate: github=goauthentik/authentik

clusters/cl01tl/helm/authentik/values.yaml

@@ -110,5 +110,6 @@ redis-replication:
     enabled: false
   redisReplication:
     clusterSize: 3
-    sentinel:
+  redisSentinel:
-      enabled: true
+    enabled: true
+    clusterSize: 3

clusters/cl01tl/helm/blocky/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 4.6.0
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.1
+  version: 0.5.0
-digest: sha256:e9dde2592347a72ab8b7154efcd12654fb0865c4e791c5bbea27f56b390a6b50
+digest: sha256:defdf9a6c3b44f07e2232ed954e7c9986a2ffefce18b06a38a33456cef9578dd
-generated: "2026-01-08T15:47:39.239057-06:00"
+generated: "2026-01-07T16:03:45.057060212Z"

clusters/cl01tl/helm/blocky/Chart.yaml

@@ -18,7 +18,7 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.0
   - name: redis-replication
-    version: 1.0.1
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/blocky.png
 # renovate: github=0xerr0r/blocky

clusters/cl01tl/helm/blocky/values.yaml

@@ -182,47 +182,35 @@ blocky:
                 - https://v.firebog.net/hosts/Prigent-Ads.txt
               mal:
                 - https://v.firebog.net/hosts/Prigent-Crypto.txt
+                - https://osint.digitalside.it/Threat-Intel/lists/latestdomains.txt
               pro:
                 - https://raw.githubusercontent.com/hagezi/dns-blocklists/main/wildcard/pro.plus.txt
-              oisd:
-                - https://big.oisd.nl/domainswild
             allowlists:
               sus:
                 - |
                   *.alexlebens.net
                   *.alexlebens.dev
                   *.boreal-beaufort.ts.net
-                  *.discord.com
               ads:
                 - |
                   *.alexlebens.net
                   *.alexlebens.dev
                   *.boreal-beaufort.ts.net
-                  *.discord.com
               priv:
                 - |
                   *.alexlebens.net
                   *.alexlebens.dev
                   *.boreal-beaufort.ts.net
-                  *.discord.com
               mal:
                 - |
                   *.alexlebens.net
                   *.alexlebens.dev
                   *.boreal-beaufort.ts.net
-                  *.discord.com
               pro:
                 - |
                   *.alexlebens.net
                   *.alexlebens.dev
                   *.boreal-beaufort.ts.net
-                  *.discord.com
-              oisd:
-                - |
-                  *.alexlebens.net
-                  *.alexlebens.dev
-                  *.boreal-beaufort.ts.net
-                  *.discord.com
             clientGroupsBlock:
               default:
                 - sus
@@ -230,7 +218,6 @@ blocky:
                 - priv
                 - mal
                 - pro
-                - oisd
             blockType: zeroIp
             blockTTL: 1m
             loading:
@@ -328,5 +315,9 @@ blocky:
               mountPropagation: None
               subPath: config.yml
 redis-replication:
+  existingSecret:
+    enabled: false
   redisReplication:
     clusterSize: 1
+  redisSentinel:
+    enabled: false

clusters/cl01tl/helm/booklore/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 4.6.0
 - name: mariadb-cluster
   repository: https://helm.mariadb.com/mariadb-operator
-  version: 25.10.4
+  version: 25.10.3
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
-digest: sha256:bce787056cbe11ac5291393a0e51f64e8e20bf665885580b8f6be79fd2be3e12
+digest: sha256:4c5fe2972b77d33dd85deeb589ab00cdbf85b08728fbd67acf5320b4d82706e2
-generated: "2026-01-08T21:50:26.303731301Z"
+generated: "2026-01-07T16:04:06.614915286Z"

clusters/cl01tl/helm/booklore/Chart.yaml

@@ -18,7 +18,7 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.0
   - name: mariadb-cluster
-    version: 25.10.4
+    version: 25.10.3
     repository: https://helm.mariadb.com/mariadb-operator
   - name: volsync-target
     alias: volsync-target-config

clusters/cl01tl/helm/booklore/values.yaml

@@ -9,7 +9,7 @@ booklore:
         main:
           image:
             repository: ghcr.io/booklore-app/booklore
-            tag: v1.17.0
+            tag: v1.16.5
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/code-server/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.6.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.1.6
+  version: 2.1.4
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
-digest: sha256:62df4e053f3b887bae03f79ef3cb158b7e7147f8b0fba0bca019d4ca16c12ade
+digest: sha256:544f9590c8d5e2afe93e37623cba5e7479df70678b28ff59b433864895e323d2
-generated: "2026-01-08T23:01:55.996749204Z"
+generated: "2026-01-07T16:04:30.495665285Z"

clusters/cl01tl/helm/code-server/Chart.yaml

@@ -22,7 +22,7 @@ dependencies:
     version: 4.6.0
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.1.6
+    version: 2.1.4
   - name: volsync-target
     alias: volsync-target-config
     version: 0.7.0

clusters/cl01tl/helm/code-server/values.yaml

@@ -9,7 +9,7 @@ code-server:
         main:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.107.1@sha256:2c085dd3efc1dfe394a802c4b53a821be607e579e718886f7a337b8ece0b92ee
+            tag: 4.107.0@sha256:e2ebedc28ab9e2ebe08093cf7e78515f97822956ff7cbac3d86fb0bd9e4b6bca
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/democratic-csi-synology-iscsi/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: democratic-csi
   repository: https://democratic-csi.github.io/charts/
-  version: 0.15.1
+  version: 0.15.0
-digest: sha256:e07d76a67023fb523e7d49730330995d0028faba9a4c7c3a6b87c5828921b3c3
+digest: sha256:6fe3d8ad7b990b07ed80a31c75a0a49db8da497c46a956c632615a2093d29d58
-generated: "2026-01-08T20:33:17.610556446Z"
+generated: "2025-12-01T20:25:24.972076-06:00"

clusters/cl01tl/helm/democratic-csi-synology-iscsi/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
 dependencies:
   - name: democratic-csi
     repository: https://democratic-csi.github.io/charts/
-    version: 0.15.1
+    version: 0.15.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 # renovate: github=democratic-csi/democratic-csi
 appVersion: v1.9.4

clusters/cl01tl/helm/directus/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 4.6.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.1.6
+  version: 2.1.4
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.4.5
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.1
+  version: 0.5.0
-digest: sha256:4a666a87c07396ff40393f5d78658ee543ac442270868b65f350e6ad30bbcb5f
+digest: sha256:7b30608ed2a7641688e5fcfea2aa3b7e4f390f106b19c949f766418137ca1db4
-generated: "2026-01-08T23:02:12.156604855Z"
+generated: "2026-01-07T16:04:55.257356422Z"

clusters/cl01tl/helm/directus/Chart.yaml

@@ -23,13 +23,13 @@ dependencies:
     version: 4.6.0
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.1.6
+    version: 2.1.4
   - name: postgres-cluster
     alias: postgres-18-cluster
     version: 7.4.5
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: redis-replication
-    version: 1.0.1
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/directus.png
 # renovate: github=directus/directus

clusters/cl01tl/helm/directus/values.yaml

@@ -217,5 +217,6 @@ redis-replication:
     key: password
   redisReplication:
     clusterSize: 3
-    sentinel:
+  redisSentinel:
-      enabled: true
+    enabled: true
+    clusterSize: 3

clusters/cl01tl/helm/element-web/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: element-web
   repository: https://ananace.gitlab.io/charts
-  version: 1.4.27
+  version: 1.4.26
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.1.6
+  version: 2.1.4
-digest: sha256:b8b4e36fb88254e7575bd3aff60721fbf44a13af33eff949b6bc011facfcec62
+digest: sha256:640ff55a95ff9fd12716bc76106d13189867832f905eaa393b5f67553bd8c961
-generated: "2026-01-08T23:02:24.62763032Z"
+generated: "2025-12-17T19:05:53.062353-06:00"

clusters/cl01tl/helm/element-web/Chart.yaml

@@ -17,11 +17,11 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: element-web
-    version: 1.4.27
+    version: 1.4.26
     repository: https://ananace.gitlab.io/charts
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.1.6
+    version: 2.1.4
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/element.png
 # renovate: github=element-hq/element-web
 appVersion: v1.12.6

clusters/cl01tl/helm/ephemera/values.yaml

@@ -12,10 +12,6 @@ ephemera:
             tag: 2.0.0
             pullPolicy: IfNotPresent
           env:
-            - name: ALLOWED_ORIGINS
-              value: https://ephemera.alexlebens.net
-            - name: BASE_URL
-              value: https://ephemera.alexlebens.net
             - name: AA_BASE_URL
               value: https://annas-archive.org
             # - name: AA_API_KEY

clusters/cl01tl/helm/freshrss/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 4.6.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.1.6
+  version: 2.1.4
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.4.5
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
-digest: sha256:7e108ab93ab55445a290dcc83bad550f37e718168d52f98be76962a138bc2a05
+digest: sha256:79b74aab75bc2bbe71e3c598484d9fe6a115903106e09bd8b41355c004fd5795
-generated: "2026-01-08T23:02:37.83037073Z"
+generated: "2026-01-07T16:05:38.90976743Z"

clusters/cl01tl/helm/freshrss/Chart.yaml

@@ -23,7 +23,7 @@ dependencies:
     version: 4.6.0
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.1.6
+    version: 2.1.4
   - name: postgres-cluster
     alias: postgres-18-cluster
     version: 7.4.5

clusters/cl01tl/helm/generic-device-plugin/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: generic-device-plugin
   repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-  version: 0.20.12
+  version: 0.20.11
-digest: sha256:5106fdc0ebe367913b62c27b6aefb27c1a47c0d6cae5ad6652da33bfb04e3661
+digest: sha256:638754658519c268ac93bef8dec82332cded8e99b734ef61db45ee63e4b7c6ce
-generated: "2026-01-08T23:05:57.531250555Z"
+generated: "2025-12-30T22:23:45.633280279Z"

clusters/cl01tl/helm/generic-device-plugin/Chart.yaml

@@ -15,6 +15,6 @@ maintainers:
 dependencies:
   - name: generic-device-plugin
     repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-    version: 0.20.12
+    version: 0.20.11
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: 1.0.0

clusters/cl01tl/helm/gitea/Chart.lock

@@ -10,18 +10,18 @@ dependencies:
   version: 0.20.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.1.6
+  version: 2.1.4
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.4.5
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.1
+  version: 0.5.0
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.1
+  version: 0.5.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
-digest: sha256:36c3e2511a1163b6055af6ceeef65862df3de0426da8029145eb9274d34748ad
+digest: sha256:6636f6ead8089c19ad702fb58170d942e11150fdda9470f1b97f4f8fa533d00e
-generated: "2026-01-08T23:02:52.334136773Z"
+generated: "2025-12-30T16:03:12.004386065Z"

clusters/cl01tl/helm/gitea/Chart.yaml

@@ -36,18 +36,18 @@ dependencies:
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.1.6
+    version: 2.1.4
   - name: postgres-cluster
     alias: postgres-18-cluster
     version: 7.4.5
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: redis-replication
     alias: redis-replication-gitea
-    version: 1.0.1
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: redis-replication
     alias: redis-replication-renovate
-    version: 1.0.1
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-storage

clusters/cl01tl/helm/gitea/values.yaml

@@ -234,6 +234,9 @@ postgres-18-cluster:
       #   backupName: external
 redis-replication-gitea:
   replicationNameOverride: redis-replication-gitea
+  sentinelNameOverride: redis-sentinel-gitea
+  existingSecret:
+    enabled: false
   redisReplication:
     clusterSize: 3
     resources:
@@ -245,12 +248,17 @@ redis-replication-gitea:
         resources:
           requests:
             storage: 10Gi
-    sentinel:
+  redisSentinel:
-      enabled: true
+    enabled: true
+    clusterSize: 3
 redis-replication-renovate:
   replicationNameOverride: redis-replication-renovate
+  existingSecret:
+    enabled: false
   redisReplication:
     clusterSize: 1
+  redisSentinel:
+    enabled: false
 volsync-target-storage:
   pvcTarget: gitea-shared-storage
   moverSecurityContext:

clusters/cl01tl/helm/grafana-operator/Chart.lock

@@ -7,9 +7,9 @@ dependencies:
   version: 7.4.5
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.1
+  version: 0.5.0
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.1
+  version: 0.5.0
-digest: sha256:62c2a79644690c55ae04eb2706f73cf091c1948583a0e608b72987c0ae5efc2e
+digest: sha256:1336c44a8a073fcde12d78cffd0bfc0c76367681f3aabc255f5b83e449d87a85
-generated: "2026-01-08T16:05:24.786103-06:00"
+generated: "2026-01-06T22:02:21.192222965Z"

clusters/cl01tl/helm/grafana-operator/Chart.yaml

@@ -25,11 +25,11 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: redis-replication
     alias: redis-replication-unified-alerting
-    version: 1.0.1
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: redis-replication
     alias: redis-replication-remote-cache
-    version: 1.0.1
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grafana.png
 # renovate: github=grafana/grafana-operator

clusters/cl01tl/helm/grafana-operator/values.yaml

@@ -56,11 +56,19 @@ postgres-18-cluster:
       #   backupName: external
 redis-replication-unified-alerting:
   replicationNameOverride: redis-replication-unified-alerting
+  sentinelNameOverride: redis-sentinel-unified-alerting
+  existingSecret:
+    enabled: false
   redisReplication:
     clusterSize: 3
-    sentinel:
+  redisSentinel:
-      enabled: true
+    enabled: true
+    clusterSize: 3
 redis-replication-remote-cache:
   replicationNameOverride: redis-replication-remote-cache
+  existingSecret:
+    enabled: false
   redisReplication:
     clusterSize: 1
+  redisSentinel:
+    enabled: false

clusters/cl01tl/helm/harbor/Chart.lock

@@ -7,6 +7,6 @@ dependencies:
   version: 7.4.5
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.1
+  version: 0.5.0
-digest: sha256:195fb663aa2e08bf0b3929a22c79f7e69426301a120594088f1ecbda9969bdc6
+digest: sha256:1292d7c6233b48f285cedb81e59299837d4ff6a6845d2bfb08b5753f2c8e3644
-generated: "2026-01-08T16:05:28.408647-06:00"
+generated: "2025-12-27T19:46:14.927696731Z"

clusters/cl01tl/helm/harbor/Chart.yaml

@@ -24,7 +24,7 @@ dependencies:
     version: 7.4.5
     repository: https://gitea.alexlebens.net/api/packages/alexlebens/helm
   - name: redis-replication
-    version: 1.0.1
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/harbor.png
 # renovate: github=goharbor/harbor

clusters/cl01tl/helm/harbor/values.yaml

@@ -139,7 +139,10 @@ postgres-18-cluster:
       #   schedule: "0 0 0 * * *"
       #   backupName: external
 redis-replication:
+  existingSecret:
+    enabled: false
   redisReplication:
     clusterSize: 3
-    sentinel:
+  redisSentinel:
-      enabled: true
+    enabled: true
+    clusterSize: 3

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -21,7 +21,7 @@ home-assistant:
         code-server:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.107.1@sha256:2c085dd3efc1dfe394a802c4b53a821be607e579e718886f7a337b8ece0b92ee
+            tag: 4.107.0@sha256:e2ebedc28ab9e2ebe08093cf7e78515f97822956ff7cbac3d86fb0bd9e4b6bca
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/homepage-dev/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 4.6.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.1.6
+  version: 2.1.4
-digest: sha256:407c44f708da679b81f9c12db03dd4152456aef87d8161a60652156d0e61a88d
+digest: sha256:4757805271f5c031f763b564b4a3af8a47819260fa29b3d4cca575cb95b42a9a
-generated: "2026-01-08T23:03:12.666369272Z"
+generated: "2026-01-07T16:06:47.60716981Z"

clusters/cl01tl/helm/homepage-dev/Chart.yaml

@@ -21,7 +21,7 @@ dependencies:
     version: 4.6.0
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.1.6
+    version: 2.1.4
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/homepage.png
 # renovate: github=gethomepage/homepage
 appVersion: v1.8.0

clusters/cl01tl/helm/homepage/values.yaml

@@ -147,9 +147,9 @@ homepage:
                   href: https://yamtrack.alexlebens.net
                   siteMonitor: http://yamtrack.yamtrack:80
                   statusStyle: dot
-              - Movies and TV (Alt):
+              - Movies and TV:
                   icon: sh-fladder.webp
-                  description: Fladder, Jellyfin UI
+                  description: Fladder (Alt Jellyfin UI)
                   href: https://fladder.alexlebens.net
                   siteMonitor: http://fladder.jellyfin:80
                   statusStyle: dot

clusters/cl01tl/helm/huntarr/values.yaml

@@ -9,7 +9,7 @@ huntarr:
         main:
           image:
             repository: ghcr.io/plexguide/huntarr
-            tag: 8.2.11
+            tag: 8.2.10
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/immich/Chart.lock

@@ -7,9 +7,9 @@ dependencies:
   version: 7.4.5
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.1
+  version: 0.5.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
-digest: sha256:5635eb2aff4f8a1a4152c14822995cebec4907eb58c5fe3eb7c7dbeea089f2c1
+digest: sha256:6f960b8d9602ff621caee41fdf3d185b848c17dde882aa299cd8db76e45ea38a
-generated: "2026-01-08T16:05:42.767481-06:00"
+generated: "2026-01-07T16:07:44.317069622Z"

clusters/cl01tl/helm/immich/Chart.yaml

@@ -23,7 +23,7 @@ dependencies:
     version: 7.4.5
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: redis-replication
-    version: 1.0.1
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-data

clusters/cl01tl/helm/immich/values.yaml

@@ -223,10 +223,13 @@ postgres-18-cluster:
       #   backupName: external
 
 redis-replication:
+  existingSecret:
+    enabled: false
   redisReplication:
     clusterSize: 3
-    sentinel:
+  redisSentinel:
-      enabled: true
+    enabled: true
+    clusterSize: 3
 volsync-target-data:
   pvcTarget: immich
   local:

clusters/cl01tl/helm/karakeep/Chart.lock

@@ -7,9 +7,9 @@ dependencies:
   version: 0.20.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.1.6
+  version: 2.1.4
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
-digest: sha256:d8b5b42608537e20f34d109bc624c68e27879488f8ef78df2681a70808bfba87
+digest: sha256:6f39f9c04161444d4ca88e8d69e6b809523ad51a2bbe3d19c4aef3d6c8f23f3d
-generated: "2026-01-08T23:03:25.51925384Z"
+generated: "2026-01-07T16:08:39.695436116Z"

clusters/cl01tl/helm/karakeep/Chart.yaml

@@ -26,7 +26,7 @@ dependencies:
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.1.6
+    version: 2.1.4
   - name: volsync-target
     alias: volsync-target-data
     version: 0.7.0

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 80.13.3
+  version: 80.13.0
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.6.0
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.1
+  version: 0.5.0
-digest: sha256:43ec4f7e90e31f70ee36651b795f8e982abe07279068213ddfae54eefe2a3994
+digest: sha256:2cfdc65daf935996789b455aae2de6b4878c0a991f7b9354006aaa42adc5317e
-generated: "2026-01-11T00:04:17.413709338Z"
+generated: "2026-01-07T16:09:30.390264104Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,14 +20,14 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 80.13.3
+    version: 80.13.0
     repository: oci://ghcr.io/prometheus-community/charts
   - name: app-template
     alias: ntfy-alertmanager
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.0
   - name: redis-replication
-    version: 1.0.1
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prometheus.png
 # renovate: github=prometheus-operator/prometheus-operator

clusters/cl01tl/helm/kube-prometheus-stack/values.yaml

@@ -171,16 +171,15 @@ ntfy-alertmanager:
               mountPropagation: None
               subPath: config
 redis-replication:
+  existingSecret:
+    enabled: false
   redisReplication:
     clusterSize: 3
-    resources:
-      requests:
-        cpu: 20m
-        memory: 32Mi
     volumeClaimTemplate:
       spec:
         resources:
           requests:
             storage: 10Gi
-    sentinel:
+  redisSentinel:
-      enabled: true
+    enabled: true
+    clusterSize: 3

clusters/cl01tl/helm/local-path-provisioner/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: local-path-provisioner
   repository: https://charts.containeroo.ch
-  version: 0.0.35
+  version: 0.0.34
-digest: sha256:c59cc5a81e797a9e2ab0f8e6bf03cb3e4dfc740555631aa1d41b7def1d2c60c8
+digest: sha256:f4f946897660d5d65eb2a56144d907c0b48c9a72e20d10a73684eaeb0d50cfd3
-generated: "2026-01-10T19:01:45.394965495Z"
+generated: "2025-12-26T21:55:29.099967751Z"

clusters/cl01tl/helm/local-path-provisioner/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: local-path-provisioner
-    version: 0.0.35
+    version: 0.0.34
     repository: https://charts.containeroo.ch
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 # renovate: github=rancher/local-path-provisioner

clusters/cl01tl/helm/mariadb-operator/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: mariadb-operator
   repository: https://helm.mariadb.com/mariadb-operator
-  version: 25.10.4
+  version: 25.10.3
 - name: mariadb-operator-crds
   repository: https://helm.mariadb.com/mariadb-operator
-  version: 25.10.4
+  version: 25.10.3
-digest: sha256:fcb4433060885746dd43a5fb4d8b32163d50d97dc4614fbf4c82f966a1723304
+digest: sha256:d32a1fb47160eccd389a71467a954f2eea59cad595db38a74243581af1c9c426
-generated: "2026-01-08T21:21:13.446114122Z"
+generated: "2025-12-24T19:28:09.775077014Z"

clusters/cl01tl/helm/mariadb-operator/Chart.yaml

@@ -15,10 +15,10 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: mariadb-operator
-    version: 25.10.4
+    version: 25.10.3
     repository: https://helm.mariadb.com/mariadb-operator
   - name: mariadb-operator-crds
-    version: 25.10.4
+    version: 25.10.3
     repository: https://helm.mariadb.com/mariadb-operator
 icon: https://mariadb-operator.github.io/mariadb-operator/assets/mariadb_profile.svg
 # renovate: github=mariadb-operator/mariadb-operator

clusters/cl01tl/helm/matrix-synapse/Chart.lock

@@ -13,19 +13,19 @@ dependencies:
   version: 4.6.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.1.6
+  version: 2.1.4
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.1.6
+  version: 2.1.4
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.4.5
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.1
+  version: 0.5.0
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.1
+  version: 0.5.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
@@ -38,5 +38,5 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
-digest: sha256:96d373b5c7b5a648c7b5af8770ee62d286a81cd3b79751ef20f2abc072a655bc
+digest: sha256:82d057168152cffe5324f198078aa005953c484c7bd04b3658b3f2593cda909b
-generated: "2026-01-08T23:03:42.203560963Z"
+generated: "2026-01-07T16:11:53.249207417Z"

clusters/cl01tl/helm/matrix-synapse/Chart.yaml

@@ -45,11 +45,11 @@ dependencies:
     version: 4.6.0
   - name: cloudflared
     alias: cloudflared-synapse
-    version: 2.1.6
+    version: 2.1.4
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: cloudflared
     alias: cloudflared-hookshot
-    version: 2.1.6
+    version: 2.1.4
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: postgres-cluster
     alias: postgres-18-cluster
@@ -57,11 +57,11 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: redis-replication
     alias: redis-replication-matrix-synapse
-    version: 1.0.1
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: redis-replication
     alias: redis-replication-hookshot
-    version: 1.0.1
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-synapse

clusters/cl01tl/helm/matrix-synapse/values.yaml

@@ -455,20 +455,26 @@ postgres-18-cluster:
       owner: app
 redis-replication-matrix-synapse:
   replicationNameOverride: redis-replication-matrix-synapse
+  sentinelNameOverride: redis-sentinel-matrix-synapse
   existingSecret:
     enabled: true
     name: matrix-synapse-redis-secret
     key: password
   redisReplication:
     clusterSize: 3
-    sentinel:
+  redisSentinel:
-      enabled: true
+    enabled: true
+    clusterSize: 3
 redis-replication-hookshot:
   replicationNameOverride: redis-replication-hookshot
+  sentinelNameOverride: redis-sentinel-hookshot
+  existingSecret:
+    enabled: false
   redisReplication:
     clusterSize: 3
-    sentinel:
+  redisSentinel:
-      enabled: true
+    enabled: true
+    clusterSize: 3
 volsync-target-synapse:
   pvcTarget: matrix-synapse
   local:

clusters/cl01tl/helm/ollama/values.yaml

@@ -117,7 +117,7 @@ ollama:
         main:
           image:
             repository: ghcr.io/open-webui/open-webui
-            tag: 0.7.2
+            tag: 0.6.43
             pullPolicy: IfNotPresent
           env:
             - name: ENV

clusters/cl01tl/helm/outline/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 4.6.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.1.6
+  version: 2.1.4
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.4.5
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.1
+  version: 0.5.0
-digest: sha256:d792717a0bc3e338d2ae22575677c0042456e7fd86202be2401cce78b5704e8c
+digest: sha256:b824da42e2183694c448e9b2a4d94c3b2c1c156f44bdade953c0de0866936c18
-generated: "2026-01-08T23:03:56.590541379Z"
+generated: "2026-01-07T16:13:31.932487877Z"

clusters/cl01tl/helm/outline/Chart.yaml

@@ -24,13 +24,13 @@ dependencies:
     version: 4.6.0
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.1.6
+    version: 2.1.4
   - name: postgres-cluster
     alias: postgres-18-cluster
     version: 7.4.5
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: redis-replication
-    version: 1.0.1
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/outline.png
 # renovate: github=outline/outline

clusters/cl01tl/helm/outline/values.yaml

@@ -185,7 +185,10 @@ postgres-18-cluster:
       #   schedule: "0 0 0 * * *"
       #   backupName: external
 redis-replication:
+  existingSecret:
+    enabled: false
   redisReplication:
     clusterSize: 3
-    sentinel:
+  redisSentinel:
-      enabled: true
+    enabled: true
+    clusterSize: 3

clusters/cl01tl/helm/postiz/Chart.lock

@@ -4,18 +4,18 @@ dependencies:
   version: 4.6.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.1.6
+  version: 2.1.4
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.4.5
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.1
+  version: 0.5.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
-digest: sha256:af55c44dbbd166a4aa55abef4ed1f880a615dde137a01e09fc63b183e8d6ba39
+digest: sha256:2ab6021cdb2e91e39937432769417bec025543cda98c045bc97d86c98b64c956
-generated: "2026-01-08T23:04:09.854858899Z"
+generated: "2026-01-07T16:14:20.965773103Z"

clusters/cl01tl/helm/postiz/Chart.yaml

@@ -23,13 +23,13 @@ dependencies:
     version: 4.6.0
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.1.6
+    version: 2.1.4
   - name: postgres-cluster
     alias: postgres-18-cluster
     version: 7.4.5
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: redis-replication
-    version: 1.0.1
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-config

clusters/cl01tl/helm/postiz/values.yaml

@@ -174,8 +174,9 @@ redis-replication:
     key: password
   redisReplication:
     clusterSize: 3
-    sentinel:
+  redisSentinel:
-      enabled: true
+    enabled: true
+    clusterSize: 3
 volsync-target-config:
   pvcTarget: postiz-config
   local:

clusters/cl01tl/helm/prometheus-operator-crds/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: prometheus-operator-crds
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 26.0.0
+  version: 25.0.1
-digest: sha256:fb73bc68bbf8ab128ff7fc641413ce3f004677d351038517ed68f5b39eeafb08
+digest: sha256:33e08873d2d1558d7e3784d7f995c8134347ca590f54109b783ae5f6ad5e2ae5
-generated: "2026-01-09T20:11:58.398634666Z"
+generated: "2025-12-11T18:13:48.868551-06:00"

clusters/cl01tl/helm/prometheus-operator-crds/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: prometheus-operator-crds
-    version: 26.0.0
+    version: 25.0.1
     repository: oci://ghcr.io/prometheus-community/charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prometheus.png
 # renovate: github=prometheus-operator/prometheus-operator

clusters/cl01tl/helm/qbittorrent/values.yaml

@@ -28,7 +28,7 @@ qbittorrent:
         qbittorrent:
           image:
             repository: ghcr.io/linuxserver/qbittorrent
-            tag: 5.1.4@sha256:95114034a7f74672b76f795f6938921b0ca795f85b59b48691035dc66714f34c
+            tag: 5.1.4@sha256:e0cedcadd62f809efdeddfd32e4d1192f9a74e6e64ed6753bfc6e2c3ed4a714a
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/redis-operator/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: redis-operator
   repository: https://ot-container-kit.github.io/helm-charts/
-  version: 0.23.0
+  version: 0.22.2
-digest: sha256:5527788e7c70fca410b8d007412f56bf7d8f714bed1d4f96e85468272011406b
+digest: sha256:e9b60cefa8eb7b7fa82acac76a83dde2cbe08fa764a9e5b67e477a31c61d6180
-generated: "2026-01-08T16:07:20.420231-06:00"
+generated: "2025-12-01T20:27:10.143235-06:00"

clusters/cl01tl/helm/redis-operator/Chart.yaml

@@ -15,8 +15,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: redis-operator
-    version: 0.23.0
+    version: 0.22.2
     repository: https://ot-container-kit.github.io/helm-charts/
 icon: https://github.com/OT-CONTAINER-KIT/redis-operator/raw/main/static/redis-operator-logo.svg
 # renovate: github=OT-CONTAINER-KIT/redis-operator
-appVersion: v0.23.0
+appVersion: v0.21.0

clusters/cl01tl/helm/redis-operator/values.yaml

@@ -1,12 +1,7 @@
 redis-operator:
   redisOperator:
     imageName: ghcr.io/ot-container-kit/redis-operator/redis-operator
-    imageTag: v0.23.0
+    imageTag: v0.21.0
-    strategy:
-      type: RollingUpdate
-      rollingUpdate:
-        maxSurge: 50%
-        maxUnavailable: 50%
     metrics:
       enabled: true
   resources:

clusters/cl01tl/helm/rook-ceph/Chart.lock

@@ -7,6 +7,6 @@ dependencies:
   version: v1.18.8
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.1.6
+  version: 2.1.4
-digest: sha256:b664c76e08c3ac8319b627fd627885cff0a7448fe5bad2d78b3cd84c56c55c49
+digest: sha256:a3dd852a1a1d14caf9684d9dfaeae11014eaa36ac1fe4673d50d840b52e8e4b8
-generated: "2026-01-08T23:04:22.143200731Z"
+generated: "2025-12-17T19:07:53.607178-06:00"

clusters/cl01tl/helm/rook-ceph/Chart.yaml

@@ -24,7 +24,7 @@ dependencies:
   - name: cloudflared
     alias: cloudflared-rgw
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.1.6
+    version: 2.1.4
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ceph.png
 # renovate: github=rook/rook
 appVersion: v1.18.8

clusters/cl01tl/helm/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:35e3520e53621e22566330d876d2a36e4a556628b6567bf2706ceb211c6d9c07
+            tag: latest@sha256:472dd0c84b8e2a05bca773b4a430b9fc9e4e92cd4fa0afaa223efab925ab752a
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -39,7 +39,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:35e3520e53621e22566330d876d2a36e4a556628b6567bf2706ceb211c6d9c07
+            tag: latest@sha256:472dd0c84b8e2a05bca773b4a430b9fc9e4e92cd4fa0afaa223efab925ab752a
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL

clusters/cl01tl/helm/site-documentation/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 4.6.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.1.6
+  version: 2.1.4
-digest: sha256:c33f2006ef86895f366d735590870f49811c604558ea89f43aa13ec91cceb667
+digest: sha256:27e7dada3aa2cf324da2c2993aa383183acde6e13482eaa7c94137179877349a
-generated: "2026-01-08T23:04:40.944615738Z"
+generated: "2026-01-07T16:17:45.268630128Z"

clusters/cl01tl/helm/site-documentation/Chart.yaml

@@ -22,6 +22,6 @@ dependencies:
     version: 4.6.0
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.1.6
+    version: 2.1.4
 icon: https://d21zlbwtcn424f.cloudfront.net/logo-new-round.png
 appVersion: 0.0.5

clusters/cl01tl/helm/site-profile/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 4.6.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.1.6
+  version: 2.1.4
-digest: sha256:e9e1225ce510a06926f62cd10911671e0ef84408354e634883e2ca1375a5665e
+digest: sha256:b29bb39a8adde6f287aa96fe55064895f9fcf2882b402a9e8eea6501dfecd01e
-generated: "2026-01-08T23:04:57.975273516Z"
+generated: "2026-01-07T16:17:59.543874451Z"

clusters/cl01tl/helm/site-profile/Chart.yaml

@@ -22,6 +22,6 @@ dependencies:
     version: 4.6.0
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.1.6
+    version: 2.1.4
 icon: https://d21zlbwtcn424f.cloudfront.net/logo-new-round.png
 appVersion: 2.1.2

clusters/cl01tl/helm/slskd/values.yaml

@@ -122,7 +122,7 @@ slskd:
         main:
           image:
             repository: mrusse08/soularr
-            tag: latest@sha256:c1cfc6425c1cc141f5f99744611eeb1af32c85258df5e2a4974d7dbf6db76840
+            tag: latest@sha256:b41d4f8ec74e9eded55e0096ddb40ba155ff3288f87b50639d57e5ba4c980159
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/stalwart/Chart.lock

@@ -7,9 +7,9 @@ dependencies:
   version: 7.4.5
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.1
+  version: 0.5.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
-digest: sha256:6175d8c7a007ae0230ce2f04296bc838e1a7e16992368d69fd48b6080db12509
+digest: sha256:fb7be3af608214b79e4ef1aa1608a1dc34da1bcd3aa15fd4b774d5fddd146a6b
-generated: "2026-01-08T16:07:59.768593-06:00"
+generated: "2026-01-07T16:19:09.333638723Z"

clusters/cl01tl/helm/stalwart/Chart.yaml

@@ -26,7 +26,7 @@ dependencies:
     version: 7.4.5
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: redis-replication
-    version: 1.0.1
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-config

clusters/cl01tl/helm/stalwart/values.yaml

@@ -115,10 +115,13 @@ postgres-18-cluster:
       #   schedule: "0 0 0 * * *"
       #   backupName: external
 redis-replication:
+  existingSecret:
+    enabled: false
   redisReplication:
     clusterSize: 3
-    sentinel:
+  redisSentinel:
-      enabled: true
+    enabled: true
+    clusterSize: 3
 volsync-target-config:
   pvcTarget: stalwart-config
   local:

clusters/cl01tl/helm/traefik/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: traefik
   repository: https://traefik.github.io/charts
-  version: 38.0.2
+  version: 38.0.1
 - name: traefik-crds
   repository: https://traefik.github.io/charts
-  version: 1.13.1
+  version: 1.13.0
-digest: sha256:c9c71fcb47409087113762dae304201b7211a01c011730f97d00622dec18d61e
+digest: sha256:0caf1c25f7bca77f070a3ba490f0d0370f7583370dfeeb2a726023ff567c208e
-generated: "2026-01-08T21:23:37.257658681Z"
+generated: "2025-12-19T18:45:42.696331-06:00"

clusters/cl01tl/helm/traefik/Chart.yaml

@@ -15,10 +15,10 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: traefik
-    version: 38.0.2
+    version: 38.0.1
     repository: https://traefik.github.io/charts
   - name: traefik-crds
-    version: 1.13.1
+    version: 1.13.0
     repository: https://traefik.github.io/charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/webp/traefik.webp
 # renovate: github=traefik/traefik

clusters/cl01tl/helm/tubearchivist/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 4.6.0
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.1
+  version: 0.5.0
-digest: sha256:bda501e989015ea6f2ceee648db3901e4b8714f7d9a3d2c3cdcbb05d9fd12504
+digest: sha256:ab12f52cdf3fee5996182e624946473fde91190da854026c5b47d3a15b7a7a04
-generated: "2026-01-08T16:08:17.930024-06:00"
+generated: "2026-01-07T16:20:08.428831245Z"

clusters/cl01tl/helm/tubearchivist/Chart.yaml

@@ -21,7 +21,7 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.0
   - name: redis-replication
-    version: 1.0.1
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tube-archivist.png
 # renovate: github=argoproj/argo-workflows

clusters/cl01tl/helm/tubearchivist/values.yaml

@@ -66,6 +66,10 @@ tubearchivist:
                 secretKeyRef:
                   name: tubearchivist-wireguard-conf
                   key: proton-password
+            - name: VPN_PORT_FORWARDING
+              value: "on"
+            - name: PORT_FORWARD_ONLY
+              value: "on"
             - name: FIREWALL_OUTBOUND_SUBNETS
               value: 10.0.0.0/8
             - name: FIREWALL_INPUT_PORTS
@@ -147,6 +151,8 @@ tubearchivist:
             - path: /youtube
               readOnly: false
 redis-replication:
+  existingSecret:
+    enabled: false
   redisReplication:
     clusterSize: 3
     resources:
@@ -158,5 +164,6 @@ redis-replication:
         resources:
           requests:
             storage: 10Gi
-    sentinel:
+  redisSentinel:
-      enabled: true
+    enabled: true
+    clusterSize: 3

clusters/cl01tl/helm/vault/values.yaml

@@ -12,7 +12,7 @@ vault:
     enabled: true
     image:
       repository: hashicorp/vault
-      tag: 1.21.2
+      tag: 1.21.1
     updateStrategyType: "RollingUpdate"
     logLevel: debug
     logFormat: standard
@@ -170,7 +170,7 @@ snapshot:
         snapshot:
           image:
             repository: hashicorp/vault
-            tag: 1.21.2
+            tag: 1.21.1
             pullPolicy: IfNotPresent
           command:
             - /bin/ash

clusters/cl01tl/helm/vaultwarden/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 4.6.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.1.6
+  version: 2.1.4
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.4.5
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.7.0
-digest: sha256:e7b45249e9d1d828b8d5799e230eaf6ce1eeacf0abd04afd2795fb986a08f6cb
+digest: sha256:1b46f28ec62f346549c4443f56244b04e9c32cd894cecd5b61467a2f2cabd4c9
-generated: "2026-01-08T23:05:14.373781117Z"
+generated: "2026-01-07T16:21:21.356775158Z"

clusters/cl01tl/helm/vaultwarden/Chart.yaml

@@ -24,7 +24,7 @@ dependencies:
     version: 4.6.0
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.1.6
+    version: 2.1.4
   - name: postgres-cluster
     alias: postgres-18-cluster
     version: 7.4.5

clusters/cl01tl/helm/vaultwarden/values.yaml

@@ -9,7 +9,7 @@ vaultwarden:
         main:
           image:
             repository: vaultwarden/server
-            tag: 1.35.2
+            tag: 1.35.1
             pullPolicy: IfNotPresent
           env:
             - name: DOMAIN

clusters/cl01tl/helm/yamtrack/Chart.lock

@@ -7,6 +7,6 @@ dependencies:
   version: 7.4.5
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.1
+  version: 0.5.0
-digest: sha256:4dc2b8988b173f052f7b06c3b58c35bc50d3ef5981695aeb0759082f24b7e5ed
+digest: sha256:c241e1e5ddb28b25ef86e78648a2092154dc6371950c3a7b45ddade99ec7bf34
-generated: "2026-01-08T16:08:32.850996-06:00"
+generated: "2026-01-07T16:21:48.923671038Z"

clusters/cl01tl/helm/yamtrack/Chart.yaml

@@ -25,7 +25,7 @@ dependencies:
     version: 7.4.5
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: redis-replication
-    version: 1.0.1
+    version: 0.5.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/yamtrack.png
 # renovate: github=FuzzyGrim/Yamtrack

clusters/cl01tl/helm/yamtrack/values.yaml

@@ -133,7 +133,10 @@ postgres-18-cluster:
       #   schedule: "0 0 0 * * *"
       #   backupName: external
 redis-replication:
+  existingSecret:
+    enabled: false
   redisReplication:
     clusterSize: 3
-    sentinel:
+  redisSentinel:
-      enabled: true
+    enabled: true
+    clusterSize: 3

clusters/cl01tl/helm/yubal-playlist/Chart.lock

@@ -1,6 +0,0 @@
-dependencies:
-- name: app-template
-  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.0
-digest: sha256:a2801f0ce30401f024ef9be3e1a957efdfd6bda78ac786c0e73f24e9c6e0a8a3
-generated: "2026-01-08T16:08:34.99394-06:00"

clusters/cl01tl/helm/yubal-playlist/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.0
 # renovate: github=alexlebens/yubal-playlist
-appVersion: 0.0.7
+appVersion: 0.0.5

clusters/cl01tl/helm/yubal-playlist/templates/external-secret.yaml

@@ -19,40 +19,3 @@ spec:
         key: /cl01tl/lidarr2/key
         metadataPolicy: None
         property: key
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: yubal-playlist-wireguard-conf
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: yubal-playlist-wireguard-conf
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: private-key
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
-        metadataPolicy: None
-        property: private-key
-    - secretKey: proton-email
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
-        metadataPolicy: None
-        property: email
-    - secretKey: proton-password
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
-        metadataPolicy: None
-        property: password

clusters/cl01tl/helm/yubal-playlist/templates/namespace.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: yubal-playlist
-  labels:
-    app.kubernetes.io/name: yubal-playlist
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-    pod-security.kubernetes.io/audit: privileged
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/warn: privileged

clusters/cl01tl/helm/yubal-playlist/values.yaml

@@ -9,15 +9,13 @@ yubal-playlist:
         main:
           image:
             repository: harbor.alexlebens.net/images/yubal-playlist
-            tag: 0.0.7
+            tag: 0.0.5
             pullPolicy: IfNotPresent
           env:
             - name: YUBAL_TZ
               value: America/Chicago
-            - name: YUBAL_HOST
-              value: 0.0.0.0
             - name: YUBAL_PORT
-              value: 8080
+              value: 8000
             - name: YUBAL_DEBUG
               value: true
             - name: YUBAL_MB_USER_AGENT
@@ -33,75 +31,13 @@ yubal-playlist:
             requests:
               cpu: 10m
               memory: 128Mi
-        gluetun:
-          image:
-            repository: ghcr.io/qdm12/gluetun
-            tag: v3.41.0@sha256:6b54856716d0de56e5bb00a77029b0adea57284cf5a466f23aad5979257d3045
-            pullPolicy: IfNotPresent
-          lifecycle:
-            postStart:
-              exec:
-                command: ["/bin/sh", "-c", "(ip rule del table 51820; ip -6 rule del table 51820) || true"]
-          env:
-            - name: VPN_SERVICE_PROVIDER
-              value: protonvpn
-            - name: VPN_TYPE
-              value: wireguard
-            - name: WIREGUARD_PRIVATE_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: yubal-playlist-wireguard-conf
-                  key: private-key
-            - name: UPDATER_PROTONVPN_EMAIL
-              valueFrom:
-                secretKeyRef:
-                  name: yubal-playlist-wireguard-conf
-                  key: proton-email
-            - name: UPDATER_PROTONVPN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: yubal-playlist-wireguard-conf
-                  key: proton-password
-            - name: FIREWALL_OUTBOUND_SUBNETS
-              value: 10.0.0.0/8
-            - name: FIREWALL_INPUT_PORTS
-              value: 8080
-            - name: DNS_UPSTREAM_RESOLVER_TYPE
-              value: dot
-          securityContext:
-            privileged: True
-            capabilities:
-              add:
-                - NET_ADMIN
-                - SYS_MODULE
-          probes:
-            liveness:
-              enabled: true
-              custom: true
-              spec:
-                exec:
-                  command:
-                    - /gluetun-entrypoint
-                    - healthcheck
-                failureThreshold: 5
-                initialDelaySeconds: 30
-                periodSeconds: 30
-                successThreshold: 1
-                timeoutSeconds: 15
-          resources:
-            limits:
-              devic.es/tun: "1"
-            requests:
-              devic.es/tun: "1"
-              cpu: 10m
-              memory: 128Mi
   service:
     main:
       controller: main
       ports:
         http:
           port: 80
-          targetPort: 8080
+          targetPort: 8000
           protocol: HTTP
   route:
     main:

hosts/pd05wd/ollama/compose.yaml

@@ -12,6 +12,8 @@ services:
             - TS_HOSTNAME=ollama-pd05wd
         env_file:
             - .ts-env
+        labels:
+            - "com.centurylinklabs.watchtower.scope=ollama"
         network_mode: service:ollama
         restart: always
         volumes:
@@ -19,11 +21,30 @@ services:
         devices:
             - /dev/net/tun:/dev/net/tun
 
+    watchtower:
+        image: ghcr.io/containrrr/watchtower:latest
+        container_name: ollama-watchtower
+        command: --scope ollama
+        environment:
+            - TZ=America/Chicago
+            - WATCHTOWER_HTTP_API_METRICS=true
+            - WATCHTOWER_HTTP_API_TOKEN=token
+            - WATCHTOWER_CLEANUP=true
+            - WATCHTOWER_POLL_INTERVAL=3600
+        labels:
+            - "com.centurylinklabs.watchtower.scope=ollama"
+        network_mode: service:ollama
+        restart: always
+        volumes:
+            - /var/run/docker.sock:/var/run/docker.sock
+
     ollama:
         image: ollama/ollama:latest
         container_name: ollama
         environment:
             - OLLAMA_KEEP_ALIVE=24h
+        labels:
+            - "com.centurylinklabs.watchtower.scope=ollama"
         restart: always
         deploy:
             resources:

hosts/pd05wd/stable-diffusion/compose.yaml

@@ -13,6 +13,8 @@ services:
             - TS_SERVE_CONFIG=/config/serve.json
         env_file:
             - .ts-env
+        labels:
+            - "com.centurylinklabs.watchtower.scope=stable-diffusion"
         network_mode: service:stable-diffusion
         restart: always
         volumes:
@@ -21,6 +23,23 @@ services:
         devices:
             - /dev/net/tun:/dev/net/tun
 
+    watchtower:
+        image: ghcr.io/containrrr/watchtower:latest
+        container_name: stable-diffusion-watchtower
+        command: --scope stable-diffusion
+        environment:
+            - TZ=America/Chicago
+            - WATCHTOWER_HTTP_API_METRICS=true
+            - WATCHTOWER_HTTP_API_TOKEN=token
+            - WATCHTOWER_CLEANUP=true
+            - WATCHTOWER_POLL_INTERVAL=3600
+        labels:
+            - "com.centurylinklabs.watchtower.scope=stable-diffusion"
+        network_mode: service:stable-diffusion
+        restart: always
+        volumes:
+            - /var/run/docker.sock:/var/run/docker.sock
+
     stable-diffusion:
         image: ghcr.io/ai-dock/stable-diffusion-webui:latest-cuda
         container_name: stable-diffusion
@@ -30,6 +49,8 @@ services:
             - WEB_ENABLE_AUTH=false
             - PORT="17860"
             - SUPERVISOR_NO_AUTOSTART=jupyter,syncthing
+        labels:
+            - "com.centurylinklabs.watchtower.scope=stable-diffusion"
         restart: always
         deploy:
             resources:
@@ -39,7 +60,7 @@ services:
                           capabilities: ["gpu"]
                           count: all
         volumes:
-            - workspace:/workspace
+            - workspace:/workspace:rshared
             - ./models:/opt/stable-diffusion-webui/models/Stable-diffusion
 
 volumes:

hosts/ps08rp/blocky/config.yml

@@ -157,6 +157,7 @@ blocking:
       - https://v.firebog.net/hosts/Prigent-Ads.txt
     mal:
       - https://v.firebog.net/hosts/Prigent-Crypto.txt
+      - https://osint.digitalside.it/Threat-Intel/lists/latestdomains.txt
     pro:
       - https://raw.githubusercontent.com/hagezi/dns-blocklists/main/wildcard/pro.plus.txt
   allowlists:
@@ -165,31 +166,26 @@ blocking:
         *.alexlebens.net
         *.alexlebens.dev
         *.boreal-beaufort.ts.net
-        *.discord.com
     ads:
       - |
         *.alexlebens.net
         *.alexlebens.dev
         *.boreal-beaufort.ts.net
-        *.discord.com
     priv:
       - |
         *.alexlebens.net
         *.alexlebens.dev
         *.boreal-beaufort.ts.net
-        *.discord.com
     mal:
       - |
         *.alexlebens.net
         *.alexlebens.dev
         *.boreal-beaufort.ts.net
-        *.discord.com
     pro:
       - |
         *.alexlebens.net
         *.alexlebens.dev
         *.boreal-beaufort.ts.net
-        *.discord.com
   clientGroupsBlock:
     default:
       - sus

hosts/ps09rp/blocky/config.yml

@@ -178,6 +178,7 @@ blocking:
       - https://v.firebog.net/hosts/Prigent-Ads.txt
     mal:
       - https://v.firebog.net/hosts/Prigent-Crypto.txt
+      - https://osint.digitalside.it/Threat-Intel/lists/latestdomains.txt
     pro:
       - https://raw.githubusercontent.com/hagezi/dns-blocklists/main/wildcard/pro.plus.txt
   allowlists:
@@ -186,31 +187,26 @@ blocking:
         *.alexlebens.net
         *.alexlebens.dev
         *.boreal-beaufort.ts.net
-        *.discord.com
     ads:
       - |
         *.alexlebens.net
         *.alexlebens.dev
         *.boreal-beaufort.ts.net
-        *.discord.com
     priv:
       - |
         *.alexlebens.net
         *.alexlebens.dev
         *.boreal-beaufort.ts.net
-        *.discord.com
     mal:
       - |
         *.alexlebens.net
         *.alexlebens.dev
         *.boreal-beaufort.ts.net
-        *.discord.com
     pro:
       - |
         *.alexlebens.net
         *.alexlebens.dev
         *.boreal-beaufort.ts.net
-        *.discord.com
   clientGroupsBlock:
     default:
       - sus