chore(deps): update ghcr.io/linuxserver/code-server docker tag to v4.117.0-ls334

clusters/cl01tl/helm/external-secrets/Chart.yaml

@@ -18,4 +18,4 @@ dependencies:
     repository: https://charts.external-secrets.io
 icon: https://raw.githubusercontent.com/external-secrets/external-secrets/refs/heads/main/assets/eso-logo-large.png
 # renovate: datasource=github-releases depName=external-secrets/external-secrets
-appVersion: v2.4.0
+appVersion: v2.3.0

clusters/cl01tl/helm/external-secrets/values.yaml

@@ -2,7 +2,7 @@ external-secrets:
   replicaCount: 3
   image:
     repository: ghcr.io/external-secrets/external-secrets
-    tag: v2.4.0@sha256:d2b74514f63f5b55360d08351f1fe5af3b1db794a81fa10389abe2ff2999c566
+    tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
   installCRDs: true
   crds:
     createClusterExternalSecret: true
@@ -29,7 +29,7 @@ external-secrets:
   webhook:
     image:
       repository: ghcr.io/external-secrets/external-secrets
-      tag: v2.4.0@sha256:d2b74514f63f5b55360d08351f1fe5af3b1db794a81fa10389abe2ff2999c566
+      tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
     resources:
       requests:
         cpu: 1m
@@ -37,7 +37,7 @@ external-secrets:
   certController:
     image:
       repository: ghcr.io/external-secrets/external-secrets
-      tag: v2.4.0@sha256:d2b74514f63f5b55360d08351f1fe5af3b1db794a81fa10389abe2ff2999c566
+      tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
     resources:
       requests:
         cpu: 1m

clusters/cl01tl/helm/grimmory/Chart.yaml

@@ -28,4 +28,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grimmory.png
 # renovate: datasource=github-releases depName=grimmory-tools/grimmory
-appVersion: v3.0.0
+appVersion: v2.3.0

clusters/cl01tl/helm/grimmory/values.yaml

@@ -12,7 +12,7 @@ grimmory:
         main:
           image:
             repository: ghcr.io/grimmory-tools/grimmory
-            tag: v3.0.0@sha256:0130c338d4c1186f2f6b6acdc4a7ee56388dfdab9cb0b9a23ac0fc91b79e7d75
+            tag: v2.3.0@sha256:9014247f591074529894f81115ca40f899db697e89f72c2fe91ec530e3f19597
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,7 +1,7 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 84.0.1
+  version: 83.7.0
 - name: prometheus-operator-crds
   repository: oci://ghcr.io/prometheus-community/charts
   version: 28.0.1
@@ -11,5 +11,5 @@ dependencies:
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.6.1
-digest: sha256:2714de1082a27491925ba1b7adfba884a5ca9e674df22df96e8f6ccf56a54a6e
+digest: sha256:d4435b0e182ec588250d52bee0957b22d7b69abc5be8b60606d4811bfc0ed8d6
-generated: "2026-04-24T17:03:37.423427661Z"
+generated: "2026-04-21T17:08:18.793790591Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 84.0.1
+    version: 83.7.0
     repository: oci://ghcr.io/prometheus-community/charts
   - name: prometheus-operator-crds
     version: 28.0.1

clusters/cl01tl/helm/kube-prometheus-stack/values.yaml

@@ -30,7 +30,7 @@ kube-prometheus-stack:
               http_config:
                 basic_auth:
                   username: ntfy-alertmanager
-                  password_file: /etc/alertmanager/secrets/alertmanager-ntfy-config/ntfy_password
+                  password_file: /etc/alertmanager/secrets/alertmanager-config-secret/ntfy_password
     route:
       main:
         enabled: true

clusters/cl01tl/helm/loki/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 6.55.0
 - name: alloy
   repository: https://grafana.github.io/helm-charts
-  version: 1.8.0
+  version: 1.7.0
-digest: sha256:e3c7508c21ed7737f692387ca79a0c001c3393edbedff7b05c60325469a4fb2b
+digest: sha256:e6a06dc016858215a461d05c543b937f7a87ecc1bb58381cd6fb825ba524fa66
-generated: "2026-04-24T17:01:55.023153925Z"
+generated: "2026-04-02T19:05:47.897397013Z"

clusters/cl01tl/helm/loki/Chart.yaml

@@ -18,7 +18,7 @@ dependencies:
     version: 6.55.0
     repository: https://grafana.github.io/helm-charts
   - name: alloy
-    version: 1.8.0
+    version: 1.7.0
     repository: https://grafana.github.io/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/loki.png
 # renovate: datasource=github-releases depName=grafana/loki

clusters/cl01tl/helm/matrix-synapse/templates/_helpers.tpl

@@ -14,7 +14,7 @@ app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}
 
 {{/*
-ServiceAccount names
+NFS names
 */}}
 {{- define "custom.serviceAccountName" -}}
 matrix-synapse

clusters/cl01tl/helm/matrix-synapse/values.yaml

@@ -37,7 +37,7 @@ matrix-synapse:
     strategy:
       type: Recreate
     extraVolumes:
-      - name: synapse-config
+      - name: config
         csi:
           driver: secrets-store.csi.k8s.io
           readOnly: true
@@ -74,7 +74,7 @@ matrix-synapse:
           volumeAttributes:
             secretProviderClass: matrix-synapse-double-puppet-config
     extraVolumeMounts:
-      - name: synapse-config
+      - name: config
         mountPath: /synapse/config/conf.d/config.yaml
         mountPropagation: None
         readOnly: true
@@ -165,8 +165,6 @@ matrix-synapse:
     enabled: false
   gateway:
     enabled: false
-  serviceAccount:
-    name: matrix-synapse
 matrix-hookshot:
   global:
     nameOverride: matrix-hookshot

clusters/cl01tl/helm/ntfy/Chart.yaml

@@ -23,4 +23,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ntfy.png
 # renovate: datasource=github-releases depName=binwiederhier/ntfy
-appVersion: 2.22.0
+appVersion: 2.21.0

clusters/cl01tl/helm/ntfy/values.yaml

@@ -8,7 +8,7 @@ ntfy:
         main:
           image:
             repository: binwiederhier/ntfy
-            tag: v2.22.0@sha256:d8b3408c75d5ae78e03339af6103e7e6195e56573eea6f1ad34bb4dc4f44f340
+            tag: v2.21.0@sha256:2b9e12d56a538f4402da51328eeca02696c4b207ab7fbe031c27e51a22ca9b86
           args: ["serve"]
           env:
             - name: TZ

clusters/cl01tl/helm/outline/values.yaml

@@ -96,8 +96,12 @@ outline:
                 secretKeyRef:
                   name: outline-oidc-authentik
                   key: secret
-            - name: OIDC_ISSUER_URL
+            - name: OIDC_AUTH_URI
-              value: https://auth.alexlebens.dev/application/o/outline
+              value: https://auth.alexlebens.dev/application/o/authorize/
+            - name: OIDC_TOKEN_URI
+              value: https://auth.alexlebens.dev/application/o/token/
+            - name: OIDC_USERINFO_URI
+              value: https://auth.alexlebens.dev/application/o/userinfo/
             - name: OIDC_USERNAME_CLAIM
               value: email
             - name: OIDC_DISPLAY_NAME

clusters/cl01tl/helm/postiz/values.yaml

@@ -232,7 +232,7 @@ temporal:
   web:
     image:
       repository: temporalio/ui
-      tag: 2.49.1@sha256:a066bdf5c4de689cabaf80cc357871f1db5e6d750a6bcfc42e877b913e31ef24
+      tag: 2.48.4@sha256:b01df917af27067914b716a347eff78d232dfd47cc2c8527c621ce85e5bc15e3
     resources:
       requests:
         cpu: 10m

clusters/cl01tl/helm/qbittorrent/values.yaml

@@ -55,7 +55,7 @@ qbittorrent:
         gluetun:
           image:
             repository: ghcr.io/qdm12/gluetun
-            tag: latest@sha256:725d3e51091dde4ca43e3e3f26e2e6d3d0ccc66821e92d505c3da04958f7d472
+            tag: v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab
           lifecycle:
             postStart:
               exec:

clusters/cl01tl/helm/roundcube/values.yaml

@@ -103,7 +103,7 @@ roundcube:
             - name: ROUNDCUBEMAIL_DES_KEY
               valueFrom:
                 secretKeyRef:
-                  name: roundcube-key
+                  name: roundcube-key-secret
                   key: DES_KEY
             - name: ROUNDCUBEMAIL_DEFAULT_HOST
               value: tls://stalwart.stalwart

clusters/cl01tl/helm/s3-exporter/templates/external-secret.yaml

@@ -13,15 +13,15 @@ spec:
   data:
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        key: /digital-ocean/home-infra/all-access
+        key: /digital-ocean/home-infra/s3-exporter
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        key: /digital-ocean/home-infra/all-access
+        key: /digital-ocean/home-infra/s3-exporter
         property: AWS_SECRET_ACCESS_KEY
     - secretKey: AWS_REGION
       remoteRef:
-        key: /digital-ocean/home-infra/all-access
+        key: /digital-ocean/home-infra/s3-exporter
         property: AWS_REGION
 
 ---

clusters/cl01tl/helm/searxng/values.yaml

@@ -10,7 +10,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:c9100c29c14a77d5289263a671580226c3b8a396a1a0130d2f500f57076a0119
+            tag: latest@sha256:37c616a774b90fb5df9239eb143f1b11866ddf7b830cd1ebcca6ba11b38cc2bf
           env:
             - name: SEARXNG_BASE_URL
               value: http://searxng-api.searxng:8080
@@ -38,7 +38,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:c9100c29c14a77d5289263a671580226c3b8a396a1a0130d2f500f57076a0119
+            tag: latest@sha256:37c616a774b90fb5df9239eb143f1b11866ddf7b830cd1ebcca6ba11b38cc2bf
           env:
             - name: SEARXNG_BASE_URL
               value: https://searxng.alexlebens.net/

clusters/cl01tl/helm/talos/templates/_helpers.tpl

@@ -12,13 +12,3 @@ Selector labels
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}
-
-{{/*
-ServiceAccount names
-*/}}
-{{- define "custom.serviceAccountName" -}}
-talos-backup
-{{- end -}}
-{{- define "custom.serviceAccountSecretsName" -}}
-talos-backup-secrets
-{{- end -}}

clusters/cl01tl/helm/talos/templates/secret-provider-class.yaml

@@ -10,7 +10,7 @@ spec:
   provider: openbao
   parameters:
     baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: {{ include "custom.serviceAccountName" . }}
+    roleName: slskd
     objects: |
       - objectName: .s3cfg
         fileName: .s3cfg
@@ -30,7 +30,7 @@ spec:
   provider: openbao
   parameters:
     baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: {{ include "custom.serviceAccountName" . }}
+    roleName: slskd
     objects: |
       - objectName: .s3cfg
         fileName: .s3cfg
@@ -50,7 +50,7 @@ spec:
   provider: openbao
   parameters:
     baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: {{ include "custom.serviceAccountName" . }}
+    roleName: slskd
     objects: |
       - objectName: .s3cfg
         fileName: .s3cfg
@@ -70,7 +70,7 @@ spec:
   provider: openbao
   parameters:
     baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: {{ include "custom.serviceAccountName" . }}
+    roleName: slskd
     objects: |
       - objectName: config
         fileName: config

clusters/cl01tl/helm/talos/templates/service-account.yaml

@@ -1,20 +1,10 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "custom.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
-    {{- include "custom.labels" . | nindent 4 }}
-
----
 apiVersion: talos.dev/v1alpha1
 kind: ServiceAccount
 metadata:
-  name: {{ include "custom.serviceAccountSecretsName" . }}
+  name: talos-backup-secrets
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.serviceAccountSecretsName" . }}
+    app.kubernetes.io/name: talos-backup-secrets
     {{- include "custom.labels" . | nindent 4 }}
 spec:
   roles:

clusters/cl01tl/helm/talos/values.yaml

@@ -15,8 +15,6 @@ etcd-backup:
         schedule: 0 2 * * *
         backoffLimit: 3
         parallelism: 1
-      serviceAccount:
-        name: talos-backup
       containers:
         backup:
           image:
@@ -97,8 +95,6 @@ etcd-backup:
         schedule: 0 3 * * *
         backoffLimit: 3
         parallelism: 1
-      serviceAccount:
-        name: talos-backup
       containers:
         backup:
           image:
@@ -179,8 +175,6 @@ etcd-backup:
         schedule: 0 4 * * *
         backoffLimit: 3
         parallelism: 1
-      serviceAccount:
-        name: talos-backup
       containers:
         backup:
           image:

clusters/cl01tl/helm/traefik/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 39.0.8
 - name: traefik-crds
   repository: https://traefik.github.io/charts
-  version: 1.17.0
+  version: 1.16.0
-digest: sha256:93a74b11097a301c811ad03080fd1d6a1c1e695b6794b2c6cff7d61ae98ecc4f
+digest: sha256:e63ea5a588f53e421e33372390b0755609974029827762aa17ff5caec3ddd90c
-generated: "2026-04-24T16:35:47.354173673Z"
+generated: "2026-04-17T16:08:27.772737904Z"

clusters/cl01tl/helm/traefik/Chart.yaml

@@ -17,7 +17,7 @@ dependencies:
     version: 39.0.8
     repository: https://traefik.github.io/charts
   - name: traefik-crds
-    version: 1.17.0
+    version: 1.16.0
     repository: https://traefik.github.io/charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/traefik.png
 # renovate: datasource=github-releases depName=traefik/traefik

clusters/cl01tl/helm/vault/templates/_helpers.tpl

@@ -12,10 +12,3 @@ Selector labels
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}
-
-{{/*
-ServiceAccount names
-*/}}
-{{- define "custom.serviceAccountName" -}}
-vault
-{{- end -}}

clusters/cl01tl/helm/vault/templates/secret-provider-class.yaml

@@ -10,7 +10,7 @@ spec:
   provider: openbao
   parameters:
     baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: vault
+    roleName: slskd
     objects: |
       - objectName: .s3cfg
         fileName: .s3cfg
@@ -30,7 +30,7 @@ spec:
   provider: openbao
   parameters:
     baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: vault
+    roleName: slskd
     objects: |
       - objectName: .s3cfg
         fileName: .s3cfg
@@ -50,7 +50,7 @@ spec:
   provider: openbao
   parameters:
     baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: vault
+    roleName: slskd
     objects: |
       - objectName: .s3cfg
         fileName: .s3cfg

clusters/cl01tl/helm/vault/templates/service-account.yaml

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "custom.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
-    {{- include "custom.labels" . | nindent 4 }}

clusters/cl01tl/helm/vault/values.yaml

@@ -107,8 +107,6 @@ snapshot:
         schedule: 0 4 * * *
         backoffLimit: 3
         parallelism: 1
-      serviceAccount:
-        name: vault
       initContainers:
         snapshot:
           image: