chore(deps): update loki docker tag to v17

.gitea/workflows/renovate.yaml

@@ -13,7 +13,7 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.195.0@sha256:47421f2f3f82048e969b5195dd808d5ac2c5f69d43d192191c4a3dca390afe06
+    container: ghcr.io/renovatebot/renovate:43.194.0@sha256:8b0529e2502c61e5af507ed4a12fd042b68ae5441c9861694238206f06516228
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

clusters/cl01tl/helm/authentik/Chart.lock

@@ -1,7 +1,7 @@
 dependencies:
 - name: authentik
   repository: https://charts.goauthentik.io/
-  version: 2026.5.0
+  version: 2026.2.3
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 3.3.1
@@ -11,5 +11,5 @@ dependencies:
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.9.0
-digest: sha256:8688b819ca57468c53821b0bda7e1ae21cf7fd3570724c2bf2bce52e88c20171
+digest: sha256:4aa66600bce643181cbf413fcba8d26563db238833f27392da16919df75246a3
-generated: "2026-05-22T19:44:38.634358324Z"
+generated: "2026-05-21T20:05:03.197812688Z"

clusters/cl01tl/helm/authentik/Chart.yaml

@@ -18,7 +18,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: authentik
-    version: 2026.5.0
+    version: 2026.2.3
     repository: https://charts.goauthentik.io/
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/helm/blocky/values.yaml

@@ -164,6 +164,7 @@ blocky:
               sparkyfitness                   IN      CNAME   traefik-cl01tl
               tdarr                           IN      CNAME   traefik-cl01tl
               tubearchivist                   IN      CNAME   traefik-cl01tl
+              vault                           IN      CNAME   traefik-cl01tl
               whodb                           IN      CNAME   traefik-cl01tl
               yamtrack                        IN      CNAME   traefik-cl01tl
               yubal                           IN      CNAME   traefik-cl01tl

clusters/cl01tl/helm/gatus/values.yaml

@@ -258,6 +258,9 @@ gatus:
       - name: whodb
         url: https://whodb.alexlebens.net
         <<: *defaults
+      - name: vault
+        url: https://vault.alexlebens.net
+        <<: *defaults
       - name: openbao
         url: https://bao.alexlebens.net
         <<: *defaults

clusters/cl01tl/helm/gitea/values.yaml

@@ -193,8 +193,8 @@ gitea-actions:
     runner:
       registry: docker.io
       repository: gitea/runner
-      # renovate: datasource=docker depName=gitea/runner
+      # renovate: datasource=docker depName=gitea/act_runner
-      tag: 1.0.6@sha256:ab581a3e1a260efa0521886ad8051f0e8c4ff1f1d52aa8ef0a2e3ad7465f8b74
+      tag: 1.0.5@sha256:1fe8fd56be1fe2a88dfe9c58ba602bc1ad758846dcecdc3ebdc28db63be09e73
       extraVolumeMounts:
         - name: workspace-vol
           mountPath: /workspace
@@ -212,7 +212,7 @@ gitea-actions:
       registry: docker.io
       repository: docker
       # renovate: datasource=docker depName=docker
-      tag: 29.5.2-dind@sha256:6b9cd914eb9c6b342c040a49a27a5eb3804453bae6ecc90f7ff96133595a95e8
+      tag: 29.5.2-dind@sha256:eb37f58646a901dc7727cf448cae36daaefaba79de33b5058dab79aa4c04aefb
       extraVolumeMounts:
         - name: docker-vol
           mountPath: /var/lib/docker

clusters/cl01tl/helm/grafana-operator/templates/grafana-dashboard.yaml

@@ -591,6 +591,24 @@ spec:
   resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/rclone.json
 
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: grafana-dashboard-vault
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: grafana-dashboard-vault
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  instanceSelector:
+    matchLabels:
+      app: grafana-main
+  contentCacheDuration: 6h
+  folderUID: grafana-folder-platform
+  resyncPeriod: 6h
+  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/vault.json
+
 ---
 apiVersion: grafana.integreatly.org/v1beta1
 kind: GrafanaDashboard

clusters/cl01tl/helm/harbor/values.yaml

@@ -18,7 +18,7 @@ harbor:
       registry:
         storageClass: ceph-block
         accessMode: ReadWriteOnce
-        size: 200Gi
+        size: 100Gi
   existingSecretAdminPassword: harbor-secret
   existingSecretAdminPasswordKey: HARBOR_ADMIN_PASSWORD
   ipFamily:

clusters/cl01tl/helm/home-assistant/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/home-assistant.png
 # renovate: datasource=github-releases depName=home-assistant/core
-appVersion: 2026.5.4
+appVersion: 2026.5.3

clusters/cl01tl/helm/homepage/values.yaml

@@ -601,6 +601,18 @@ homepage:
                   href: https://whodb.alexlebens.net
                   siteMonitor: http://whodb.whodb:80
                   statusStyle: dot
+              - Secrets:
+                  icon: sh-hashicorp-vault.webp
+                  description: Vault
+                  href: https://vault.alexlebens.net
+                  siteMonitor: http://vault.vault:8200
+                  statusStyle: dot
+                  namespace: vault
+                  app: vault
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          vault
+                      )
               - Secrets:
                   icon: sh-openbao.webp
                   description: OpenBao

clusters/cl01tl/helm/jellyfin/values.yaml

@@ -97,7 +97,7 @@ jellyfin:
       forceRename: jellyfin-config
       storageClass: ceph-block
       accessMode: ReadWriteOnce
-      size: 200Gi
+      size: 100Gi
       advancedMounts:
         main:
           main:

clusters/cl01tl/helm/loki/Chart.lock

@@ -6,4 +6,4 @@ dependencies:
   repository: https://grafana.github.io/helm-charts
   version: 1.8.1
 digest: sha256:d8d28f5f194afb6200255175add00858b150366e128f80b9d94f6e7e3dce9d4d
-generated: "2026-05-22T19:45:18.821213515Z"
+generated: "2026-05-22T18:33:03.536359859Z"

clusters/cl01tl/helm/music-grabber/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/music-grabber.png
 # renovate: datasource=docker depName=g33kphr33k/musicgrabber
-appVersion: 2.8.13
+appVersion: 2.8.12

clusters/cl01tl/helm/music-grabber/values.yaml

@@ -12,7 +12,7 @@ music-grabber:
         main:
           image:
             repository: g33kphr33k/musicgrabber
-            tag: 2.8.13@sha256:9895b8d50a732248a3ceec611c8db15d08d46438b5a3cc7932c5fa7fe2f8a6d2
+            tag: 2.8.12@sha256:eff4ab1009cccea2b070ac1db3c9ec4c3d359a9156c2dab7c5be247ccf7fc350
           env:
             - name: MUSIC_DIR
               value: /mnt/store/Music Grabber/

clusters/cl01tl/helm/plex/values.yaml

@@ -66,7 +66,7 @@ plex:
       forceRename: plex-config
       storageClass: ceph-block
       accessMode: ReadWriteOnce
-      size: 200Gi
+      size: 100Gi
       advancedMounts:
         main:
           main:

clusters/cl01tl/helm/postiz/values.yaml

@@ -8,7 +8,7 @@ postiz:
         main:
           image:
             repository: ghcr.io/gitroomhq/postiz-app
-            tag: v2.21.8@sha256:3ec7bc8ecf61f08c22e0954291702b097f944def515dc259cb3a441aba4046c0
+            tag: v2.21.7@sha256:29a40ab11ef597c340f7f25764e7f040429c6b72c3eda33d15a429ddb66d0933
           env:
             - name: JWT_SECRET
               valueFrom:

clusters/cl01tl/helm/searxng/values.yaml

@@ -10,7 +10,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:4f0db332041c372dfe238ec0540f53ac055ad15cff2e179235e7fe07f1a5271f
+            tag: latest@sha256:18ac52ae2235032bb4ce8efaba40548411d93f52644a5cec27fded14e026cb18
           env:
             - name: SEARXNG_BASE_URL
               value: http://searxng-api.searxng:8080
@@ -38,7 +38,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:4f0db332041c372dfe238ec0540f53ac055ad15cff2e179235e7fe07f1a5271f
+            tag: latest@sha256:18ac52ae2235032bb4ce8efaba40548411d93f52644a5cec27fded14e026cb18
           env:
             - name: SEARXNG_BASE_URL
               value: https://searxng.alexlebens.net/

clusters/cl01tl/helm/site-documentation/values.yaml

@@ -10,7 +10,7 @@ site-documentation:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-documentation
-            tag: 0.35.0@sha256:736a44315817f8b787dbc628537090120c5a4012eebec3b98f7b961495ebf3e5
+            tag: 0.34.0@sha256:e2805132fec427006ad0e9ea87ec3d660b1a03673399415e7dad32ee79cc769d
           resources:
             requests:
               cpu: 10m

clusters/cl01tl/helm/site-profile/values.yaml

@@ -10,7 +10,7 @@ site-profile:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-profile
-            tag: 3.22.0@sha256:09b0b8635385eb4a18457e0b5fc6e2396d456bf964e54dd073d3524fa29afbf0
+            tag: 3.21.0@sha256:dae8734a45bb9fbd9a6190b6b5284563403bfd10962023d448685afc003b209c
           resources:
             requests:
               cpu: 10m

clusters/cl01tl/helm/site-saralebens/values.yaml

@@ -10,7 +10,7 @@ site-saralebens:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-saralebens
-            tag: 1.3.0@sha256:44fc185d638ad693a2d5d5b81ea2dbbb2d31a1a1389d18220ec26c05971322cb
+            tag: 1.2.0@sha256:645930bfb6f51d56525d4175379ff774d383da62cb893a1313e91ee5c81079b0
           resources:
             requests:
               cpu: 10m

clusters/cl01tl/helm/tailscale-operator/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: tailscale-operator
   repository: https://pkgs.tailscale.com/helmcharts
-  version: 1.98.3
+  version: 1.96.5
-digest: sha256:b35ef32920a6099e11aadb3e6f492b2853085c1b1d57d0e421de54922bfeae05
+digest: sha256:d7352b6781e248f6fc6bbb06e994c76eed77f06b3beaac6a5707e77df72ccc7d
-generated: "2026-05-22T19:06:26.889427133Z"
+generated: "2026-04-07T22:47:27.933877961Z"

clusters/cl01tl/helm/tailscale-operator/Chart.yaml

@@ -17,7 +17,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: tailscale-operator
-    version: 1.98.3
+    version: 1.96.5
     repository: https://pkgs.tailscale.com/helmcharts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tailscale-light.png
 # renovate: datasource=docker depName=tailscale/tailscale

clusters/cl01tl/helm/tailscale-operator/templates/dns-config.yaml

@@ -11,4 +11,4 @@ spec:
     image:
       repo: tailscale/k8s-nameserver
       # renovate: datasource=docker depName=tailscale/k8s-nameserver
-      tag: v1.98.3
+      tag: v1.96.5

clusters/cl01tl/helm/tailscale-operator/values.yaml

@@ -5,7 +5,7 @@ tailscale-operator:
       - "tag:k8s-operator"
     image:
       repository: tailscale/k8s-operator
-      tag: v1.98.3
+      tag: v1.96.5
       digest: sha256:7956bd50dca9dc804b98720df94d112b54af85449ed0bf8cc7fad0346b225067
     hostname: tailscale-operator-cl01tl
   ingressClass:

clusters/cl01tl/helm/vault/Chart.lock

@@ -0,0 +1,12 @@
+dependencies:
+- name: vault
+  repository: https://helm.releases.hashicorp.com
+  version: 0.32.0
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 5.0.1
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 5.0.1
+digest: sha256:c555a9afad1b13f96d7a94c98182312fae388ab55b26cf177b15a0a4192e879f
+generated: "2026-05-15T00:42:01.447358515Z"

clusters/cl01tl/helm/vault/Chart.yaml

@@ -0,0 +1,34 @@
+apiVersion: v2
+name: vault
+version: 1.0.0
+description: Vault
+keywords:
+  - vault
+  - secrets
+home: https://docs.alexlebens.dev/applications/vault/
+sources:
+  - https://github.com/hashicorp/vault
+  - https://github.com/Angatar/s3cmd
+  - https://github.com/lrstanley/vault-unseal
+  - https://hub.docker.com/r/hashicorp/vault
+  - https://hub.docker.com/r/d3fk/s3cmd/
+  - https://github.com/lrstanley/vault-unseal/pkgs/container/vault-unseal
+  - https://github.com/hashicorp/vault-helm
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: vault
+    version: 0.32.0
+    repository: https://helm.releases.hashicorp.com
+  - name: app-template
+    alias: snapshot
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 5.0.1
+  - name: app-template
+    alias: unseal
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 5.0.1
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/hashicorp-vault.png
+# renovate: datasource=github-releases depName=hashicorp/vault
+appVersion: 2.0.1

clusters/cl01tl/helm/vault/templates/_helpers.tpl

@@ -0,0 +1,21 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+ServiceAccount names
+*/}}
+{{- define "custom.serviceAccountName" -}}
+vault
+{{- end -}}

clusters/cl01tl/helm/vault/templates/config-map.yaml

@@ -0,0 +1,49 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vault-snapshot-script
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-snapshot-script
+    {{- include "custom.labels" . | nindent 4 }}
+data:
+  snapshot.sh: |
+    DATE=$(date +"%Y%m%d-%H-%M")
+
+    echo " "
+    echo ">> Running Vault Snapshot Script ..."
+
+    echo " "
+    echo ">> Fetching Vault token ..."
+    export VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id=$VAULT_APPROLE_ROLE_ID secret_id=$VAULT_APPROLE_SECRET_ID)
+
+    if [ -z "$VAULT_TOKEN" ]; then
+        echo ">> ERROR: Failed to fetch Vault token! Exiting..."
+        exit 1
+    fi
+
+    echo " "
+    echo ">> Taking Vault snapshot ..."
+    vault operator raft snapshot save /opt/backup/vault-snapshot-$DATE.snap
+
+    echo " "
+    echo ">> Setting ownership of Vault snapshot ..."
+    chown 100:1000 /opt/backup/vault-snapshot-$DATE.snap
+
+    echo " "
+    echo ">> Completed Vault snapshot"
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vault-backup-script
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-backup-script
+    {{- include "custom.labels" . | nindent 4 }}
+data:
+  backup.sh: |
+    echo " ";
+    echo ">> Running S3 backup for Vault snapshot";
+    OUTPUT=$(s3cmd sync --no-check-certificate -v /opt/backup/* "${BUCKET}/cl01tl/cl01tl-vault-snapshots/" 2>&1)

clusters/cl01tl/helm/vault/templates/external-secret.yaml

@@ -0,0 +1,215 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: vault-token
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-token
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: token
+      remoteRef:
+        key: /cl01tl/vault/token
+        property: root
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: vault-snapshot-agent-role
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-snapshot-agent-role
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: VAULT_APPROLE_ROLE_ID
+      remoteRef:
+        key: /cl01tl/vault/role/snapshot
+        property: role-id
+    - secretKey: VAULT_APPROLE_SECRET_ID
+      remoteRef:
+        key: /cl01tl/vault/role/snapshot
+        property: secret-id
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: vault-backup-local-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-backup-local-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/vault-backups
+        property: BUCKET_PATH
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: vault-backup-remote-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-backup-remote-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/vault-backups
+        property: BUCKET_PATH
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: vault-unseal-config-1
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-unseal-config-1
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: ENVIRONMENT
+      remoteRef:
+        key: /cl01tl/vault/unseal
+        property: environment
+    - secretKey: NODES
+      remoteRef:
+        key: /cl01tl/vault/unseal
+        property: nodes
+    - secretKey: TOKENS
+      remoteRef:
+        key: /cl01tl/vault/unseal
+        property: tokens-1
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: vault-unseal-config-2
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-unseal-config-2
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: ENVIRONMENT
+      remoteRef:
+        key: /cl01tl/vault/unseal
+        property: environment
+    - secretKey: NODES
+      remoteRef:
+        key: /cl01tl/vault/unseal
+        property: nodes
+    - secretKey: TOKENS
+      remoteRef:
+        key: /cl01tl/vault/unseal
+        property: tokens-2
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: vault-unseal-config-3
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-unseal-config-3
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: ENVIRONMENT
+      remoteRef:
+        key: /cl01tl/vault/unseal
+        property: environment
+    - secretKey: NODES
+      remoteRef:
+        key: /cl01tl/vault/unseal
+        property: nodes
+    - secretKey: TOKENS
+      remoteRef:
+        key: /cl01tl/vault/unseal
+        property: tokens-3
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: vault-ntfy-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-ntfy-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: NTFY_TOKEN
+      remoteRef:
+        key: /cl01tl/ntfy/users/cl01tl
+        property: token
+    - secretKey: NTFY_ENDPOINT
+      remoteRef:
+        key: /cl01tl/ntfy/config
+        property: internal-endpoint
+    - secretKey: NTFY_TOPIC
+      remoteRef:
+        key: /cl01tl/ntfy/topics
+        property: vault
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: vault-ntfy-unseal-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-ntfy-unseal-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    template:
+      mergePolicy: Merge
+      engineVersion: v2
+      data:
+        NOTIFY_QUEUE_URLS: "{{ `{{ .endpoint }}` }}/{{ `{{ .topic }}` }}/?priority=4&tags=vault,unseal&title=Vault+Unsealed"
+  data:
+    - secretKey: endpoint
+      remoteRef:
+        key: /cl01tl/ntfy/users/cl01tl
+        property: internal-endpoint-credential
+    - secretKey: topic
+      remoteRef:
+        key: /cl01tl/ntfy/topics
+        property: vault

clusters/cl01tl/helm/vault/templates/http-route.yaml

@@ -0,0 +1,26 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vault
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+  hostnames:
+    - vault.alexlebens.net
+  rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: /
+      backendRefs:
+        - group: ''
+          kind: Service
+          name: vault-active
+          port: 8200

clusters/cl01tl/helm/vault/templates/ingress.yaml

@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vault-tailscale
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-tailscale
+    {{- include "custom.labels" . | nindent 4 }}
+    tailscale.com/proxy-class: no-metrics
+  annotations:
+    tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"
+spec:
+  ingressClassName: tailscale
+  tls:
+    - hosts:
+        - vault-cl01tl
+      secretName: vault-cl01tl
+  rules:
+    - host: vault-cl01tl
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: vault-active
+                port:
+                  number: 8200

clusters/cl01tl/helm/vault/templates/persistent-volume-claim.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: vault-storage-backup
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-storage-backup
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  volumeMode: Filesystem
+  storageClassName: ceph-filesystem
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi

clusters/cl01tl/helm/vault/templates/secret-provider-class.yaml

@@ -0,0 +1,38 @@
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: vault-backup-local-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-backup-local-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: vault
+    objects: |
+      - objectName: .s3cfg
+        fileName: .s3cfg
+        secretPath: secret/data/garage/home-infra/vault-backups
+        secretKey: s3cfg-local
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: vault-backup-remote-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-backup-remote-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: vault
+    objects: |
+      - objectName: .s3cfg
+        fileName: .s3cfg
+        secretPath: secret/data/garage/home-infra/vault-backups
+        secretKey: s3cfg-remote

clusters/cl01tl/helm/vault/templates/service-account.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "custom.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
+    {{- include "custom.labels" . | nindent 4 }}

clusters/cl01tl/helm/vault/values.yaml

@@ -0,0 +1,314 @@
+vault:
+  global:
+    serverTelemetry:
+      prometheusOperator: true
+  injector:
+    enabled: false
+  server:
+    enabled: true
+    image:
+      repository: hashicorp/vault
+      tag: 2.0.1@sha256:7553550027156b8f04e81f61a98c3f53a7bce57104f2a400e2012c851f66ac19
+    updateStrategyType: RollingUpdate
+    logLevel: debug
+    logFormat: standard
+    resources:
+      requests:
+        cpu: 50m
+        memory: 512Mi
+    authDelegator:
+      enabled: false
+    livenessProbe:
+      enabled: false
+    volumes:
+      - name: vault-storage-backup
+        persistentVolumeClaim:
+          claimName: vault-storage-backup
+    volumeMounts:
+      - mountPath: /opt/backups/
+        name: vault-storage-backup
+        readOnly: false
+    dataStorage:
+      size: 1Gi
+      storageClass: ceph-block
+    auditStorage:
+      enabled: false
+      size: 5Gi
+      storageClass: ceph-block
+    standalone:
+      enabled: false
+    ha:
+      enabled: true
+      raft:
+        enabled: true
+        config: |
+          ui = true
+
+          listener "tcp" {
+            tls_disable = 1
+            address = "[::]:8200"
+            cluster_address = "[::]:8201"
+            telemetry {
+              unauthenticated_metrics_access = "true"
+            }
+          }
+
+          storage "raft" {
+            path = "/vault/data"
+            retry_join {
+              leader_api_addr = "http://vault-0.vault-internal:8200"
+            }
+            retry_join {
+              leader_api_addr = "http://vault-1.vault-internal:8200"
+            }
+            retry_join {
+              leader_api_addr = "http://vault-2.vault-internal:8200"
+            }
+          }
+
+          service_registration "kubernetes" {}
+
+          telemetry {
+            prometheus_retention_time = "30s"
+            disable_hostname = true
+          }
+      disruptionBudget:
+        enabled: true
+        maxUnavailable: 1
+  serverTelemetry:
+    serviceMonitor:
+      enabled: true
+    prometheusRules:
+      enabled: true
+      rules:
+        - alert: vault-HighResponseTime
+          annotations:
+            message: The response time of Vault is over 500ms on average over the last 5 minutes.
+          expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 500
+          for: 5m
+          labels:
+            severity: warning
+        - alert: vault-HighResponseTime
+          annotations:
+            message: The response time of Vault is over 1s on average over the last 5 minutes.
+          expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 1000
+          for: 5m
+          labels:
+            severity: critical
+snapshot:
+  global:
+    fullnameOverride: vault-snapshot
+  controllers:
+    snapshot:
+      type: cronjob
+      pod:
+        automountServiceAccountToken: true
+      cronjob:
+        suspend: false
+        timeZone: America/Chicago
+        schedule: 0 4 * * *
+        backoffLimit: 3
+        parallelism: 1
+      initContainers:
+        snapshot:
+          image:
+            repository: hashicorp/vault
+            tag: 2.0.1@sha256:7553550027156b8f04e81f61a98c3f53a7bce57104f2a400e2012c851f66ac19
+          command:
+            - /bin/ash
+          args:
+            - -ec
+            - /scripts/snapshot.sh
+          envFrom:
+            - secretRef:
+                name: vault-snapshot-agent-role
+          env:
+            - name: VAULT_ADDR
+              value: http://vault-active.vault.svc.cluster.local:8200
+      containers:
+        s3-backup-local:
+          image:
+            repository: d3fk/s3cmd
+            tag: latest@sha256:d66cc5677b30b31a7981f9fde0af064a9072e8b8a57d5e9b4cc02f44f02acbf2
+          command:
+            - /bin/sh
+          args:
+            - -ec
+            - /scripts/backup.sh
+          envFrom:
+            - secretRef:
+                name: vault-ntfy-config
+          env:
+            - name: BUCKET
+              valueFrom:
+                secretKeyRef:
+                  name: vault-backup-local-config
+                  key: BUCKET
+            - name: TARGET
+              value: Local
+        s3-backup-remote:
+          image:
+            repository: d3fk/s3cmd
+            tag: latest@sha256:d66cc5677b30b31a7981f9fde0af064a9072e8b8a57d5e9b4cc02f44f02acbf2
+          command:
+            - /bin/sh
+          args:
+            - -ec
+            - /scripts/backup.sh
+          envFrom:
+            - secretRef:
+                name: vault-ntfy-config
+          env:
+            - name: BUCKET
+              valueFrom:
+                secretKeyRef:
+                  name: vault-backup-remote-config
+                  key: BUCKET
+            - name: TARGET
+              value: Remote
+  persistence:
+    snapshot-script:
+      enabled: true
+      type: configMap
+      name: vault-snapshot-script
+      defaultMode: 0755
+      advancedMounts:
+        snapshot:
+          snapshot:
+            - path: /scripts/snapshot.sh
+              subPath: snapshot.sh
+    backup-script:
+      enabled: true
+      type: configMap
+      name: vault-backup-script
+      defaultMode: 0755
+      advancedMounts:
+        snapshot:
+          s3-backup-local:
+            - path: /scripts/backup.sh
+              subPath: backup.sh
+          s3-backup-remote:
+            - path: /scripts/backup.sh
+              subPath: backup.sh
+          s3-backup-external:
+            - path: /scripts/backup.sh
+              subPath: backup.sh
+    backup-local-config:
+      type: custom
+      volumeSpec:
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: vault-backup-local-config
+      advancedMounts:
+        snapshot:
+          s3-backup-local:
+            - path: /root/.s3cfg
+              readOnly: true
+              mountPropagation: None
+              subPath: .s3cfg
+    backup-remote-config:
+      type: custom
+      volumeSpec:
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: vault-backup-remote-config
+      advancedMounts:
+        snapshot:
+          s3-backup-remote:
+            - path: /root/.s3cfg
+              readOnly: true
+              mountPropagation: None
+              subPath: .s3cfg
+    backup-external-config:
+      type: custom
+      volumeSpec:
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: vault-backup-external-config
+      advancedMounts:
+        snapshot:
+          s3-backup-external:
+            - path: /root/.s3cfg
+              readOnly: true
+              mountPropagation: None
+              subPath: .s3cfg
+    backup:
+      existingClaim: vault-storage-backup
+      advancedMounts:
+        snapshot:
+          snapshot:
+            - path: /opt/backup
+              readOnly: false
+          s3-backup-local:
+            - path: /opt/backup
+              readOnly: false
+          s3-backup-remote:
+            - path: /opt/backup
+              readOnly: false
+          s3-backup-external:
+            - path: /opt/backup
+              readOnly: false
+unseal:
+  global:
+    fullnameOverride: vault-unseal
+  controllers:
+    unseal-1:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      containers:
+        main:
+          image:
+            repository: ghcr.io/lrstanley/vault-unseal
+            tag: 1.0.0@sha256:9b936fadc8dea2a473972806bffc218a4dd2fbc3b373566138a60e058cc544aa
+          envFrom:
+            - secretRef:
+                name: vault-unseal-config-1
+            - secretRef:
+                name: vault-ntfy-unseal-config
+          resources:
+            requests:
+              cpu: 1m
+              memory: 10Mi
+    unseal-2:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      containers:
+        main:
+          image:
+            repository: ghcr.io/lrstanley/vault-unseal
+            tag: 1.0.0@sha256:9b936fadc8dea2a473972806bffc218a4dd2fbc3b373566138a60e058cc544aa
+          envFrom:
+            - secretRef:
+                name: vault-unseal-config-2
+            - secretRef:
+                name: vault-ntfy-unseal-config
+          resources:
+            requests:
+              cpu: 1m
+              memory: 10Mi
+    unseal-3:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      containers:
+        main:
+          image:
+            repository: ghcr.io/lrstanley/vault-unseal
+            tag: 1.0.0@sha256:9b936fadc8dea2a473972806bffc218a4dd2fbc3b373566138a60e058cc544aa
+          envFrom:
+            - secretRef:
+                name: vault-unseal-config-3
+            - secretRef:
+                name: vault-ntfy-unseal-config
+          resources:
+            requests:
+              cpu: 1m
+              memory: 10Mi

hosts/pd05wd/invoke-ai/compose.yaml

@@ -1,6 +1,6 @@
 services:
     tailscale-invoke-ai:
-        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
+        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
         container_name: tailscale-invoke-ai
         cap_add:
             - net_admin

hosts/pd05wd/ollama/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-ollama:
-        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
+        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
         container_name: tailscale-ollama
         cap_add:
             - net_admin

hosts/pd05wd/stable-diffusion/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-stable-diffusion:
-        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
+        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
         container_name: tailscale-stable-diffusion
         cap_add:
             - net_admin

hosts/ps08rp/blocky/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-blocky:
-        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
+        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
         container_name: tailscale-blocky
         cap_add:
             - net_admin

hosts/ps08rp/blocky/config.yml

@@ -142,6 +142,7 @@ customDNS:
     sparkyfitness                   IN      CNAME   traefik-cl01tl
     tdarr                           IN      CNAME   traefik-cl01tl
     tubearchivist                   IN      CNAME   traefik-cl01tl
+    vault                           IN      CNAME   traefik-cl01tl
     whodb                           IN      CNAME   traefik-cl01tl
     yamtrack                        IN      CNAME   traefik-cl01tl
     yubal                           IN      CNAME   traefik-cl01tl

hosts/ps09rp/blocky/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-blocky:
-        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
+        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
         container_name: tailscale-blocky
         cap_add:
             - net_admin

hosts/ps09rp/blocky/config.yml

@@ -163,6 +163,7 @@ customDNS:
     sparkyfitness                   IN      CNAME   traefik-cl01tl
     tdarr                           IN      CNAME   traefik-cl01tl
     tubearchivist                   IN      CNAME   traefik-cl01tl
+    vault                           IN      CNAME   traefik-cl01tl
     whodb                           IN      CNAME   traefik-cl01tl
     yamtrack                        IN      CNAME   traefik-cl01tl
     yubal                           IN      CNAME   traefik-cl01tl

hosts/ps10rp/blocky/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-blocky:
-        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
+        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
         container_name: tailscale-blocky
         cap_add:
             - net_admin

hosts/ps10rp/garage/compose.yaml

@@ -1,6 +1,6 @@
 services:
     tailscale-garage:
-        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
+        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
         container_name: tailscale-garage
         cap_add:
             - net_admin
@@ -20,7 +20,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     tailscale-garage-ui:
-        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
+        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
         container_name: tailscale-garage-ui
         cap_add:
             - net_admin

hosts/ps10rp/gitea/compose.yaml

@@ -1,6 +1,6 @@
 services:
     tailscale-gitea:
-        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
+        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
         container_name: tailscale-gitea
         cap_add:
             - net_admin

hosts/ps10rp/homepage/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-homepage:
-        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
+        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
         container_name: tailscale-homepage
         cap_add:
             - net_admin

hosts/ps10rp/komodo-periphery/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-komodo-periphery:
-        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
+        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
         container_name: tailscale-komodo-periphery
         cap_add:
             - net_admin

hosts/ps10rp/node-exporter/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-node-exporter:
-        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
+        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
         container_name: tailscale-node-exporter
         cap_add:
             - net_admin

hosts/ps10rp/tailscale-subnet/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale:
-        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
+        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
         container_name: tailscale-subnet
         cap_add:
             - net_admin

hosts/ps10rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     tailscale-traefik:
-        image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
+        image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
         container_name: tailscale-traefik
         cap_add:
             - net_admin