Update ghcr.io/siderolabs/talosctl Docker tag to v1.12.0

clusters/cl01tl/helm/actual/values.yaml

@@ -9,7 +9,7 @@ actual:
         main:
           image:
             repository: ghcr.io/actualbudget/actual
-            tag: 26.1.0
+            tag: 25.12.0
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -78,7 +78,7 @@ actual:
 volsync-target-data:
   pvcTarget: actual-data
   local:
-    enabled: true
+    enabled: false
     schedule: 0 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/argocd/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 9.2.4
+  version: 9.2.3
-digest: sha256:ad9fc8f132ba717e9da4564ca1c90eab88c1d1ec251d015542b938f2bd5af7bd
+digest: sha256:b23d6a5b7b9fee9d1807259bfa2dd53d1f4dfbbeba7ec747c41a6ba991dadbba
-generated: "2026-01-03T23:01:53.96861459Z"
+generated: "2025-12-28T21:53:37.447568505Z"

clusters/cl01tl/helm/argocd/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 9.2.4
+    version: 9.2.3
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: github=argoproj/argo-cd

clusters/cl01tl/helm/audiobookshelf/values.yaml

@@ -124,7 +124,7 @@ audiobookshelf:
 volsync-target-config:
   pvcTarget: audiobookshelf-config
   local:
-    enabled: true
+    enabled: false
     schedule: 2 8 * * *
   remote:
     enabled: false
@@ -134,7 +134,7 @@ volsync-target-config:
 volsync-target-metadata:
   pvcTarget: audiobookshelf-metadata
   local:
-    enabled: true
+    enabled: false
     schedule: 4 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/authentik/values.yaml

@@ -109,7 +109,7 @@ redis-replication:
   existingSecret:
     enabled: false
   redisReplication:
-    clusterSize: 3
+    clusterSize: 1
   redisSentinel:
-    enabled: true
+    enabled: false
     clusterSize: 3

clusters/cl01tl/helm/backrest/values.yaml

@@ -108,7 +108,7 @@ backrest:
 volsync-target-data:
   pvcTarget: backrest-data
   local:
-    enabled: true
+    enabled: false
     schedule: 6 8 * * *
   remote:
     enabled: false
@@ -118,7 +118,7 @@ volsync-target-data:
 volsync-target-config:
   pvcTarget: backrest-config
   local:
-    enabled: true
+    enabled: false
     schedule: 8 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/bazarr/values.yaml

@@ -15,7 +15,7 @@ bazarr:
         main:
           image:
             repository: ghcr.io/linuxserver/bazarr
-            tag: 1.5.4@sha256:f00df1c88545a23d3d22ca10f5ae5b7ee9359db1d28756b7f8a43cec624042fd
+            tag: 1.5.3@sha256:001875e61839c8a50743f0bc0fa4da2a55ed8a038b9b5ed0dd2c663dd3d0bfc7
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -84,7 +84,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: true
+    enabled: false
     schedule: 10 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/blocky/values.yaml

@@ -152,12 +152,14 @@ blocky:
               radarr-4k                       IN      CNAME   traefik-cl01tl
               radarr-anime                    IN      CNAME   traefik-cl01tl
               radarr-standup                  IN      CNAME   traefik-cl01tl
+              rayflume                        IN      CNAME   traefik-cl01tl
               searxng                         IN      CNAME   traefik-cl01tl
               seerr                           IN      CNAME   traefik-cl01tl
               slskd                           IN      CNAME   traefik-cl01tl
               sonarr                          IN      CNAME   traefik-cl01tl
               sonarr-4k                       IN      CNAME   traefik-cl01tl
               sonarr-anime                    IN      CNAME   traefik-cl01tl
+              soulsync                        IN      CNAME   traefik-cl01tl
               stalwart                        IN      CNAME   traefik-cl01tl
               tautulli                        IN      CNAME   traefik-cl01tl
               tdarr                           IN      CNAME   traefik-cl01tl
@@ -165,7 +167,6 @@ blocky:
               vault                           IN      CNAME   traefik-cl01tl
               whodb                           IN      CNAME   traefik-cl01tl
               yamtrack                        IN      CNAME   traefik-cl01tl
-              yubal-playlist                  IN      CNAME   traefik-cl01tl
 
           blocking:
             denylists:

clusters/cl01tl/helm/booklore/values.yaml

@@ -9,7 +9,7 @@ booklore:
         main:
           image:
             repository: ghcr.io/booklore-app/booklore
-            tag: v1.16.4
+            tag: v1.16.2
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -218,7 +218,7 @@ mariadb-cluster:
 volsync-target-config:
   pvcTarget: booklore-config
   local:
-    enabled: true
+    enabled: false
     schedule: 12 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/cilium/templates/cilium-l2-announcement-policy.yaml

@@ -1,19 +1,19 @@
-# apiVersion: "cilium.io/v2alpha1"
+apiVersion: "cilium.io/v2alpha1"
-# kind: CiliumL2AnnouncementPolicy
+kind: CiliumL2AnnouncementPolicy
-# metadata:
+metadata:
-#   name: general-l2-policy
+  name: general-l2-policy
-#   namespace: {{ .Release.Namespace }}
+  namespace: {{ .Release.Namespace }}
-#   labels:
+  labels:
-#     app.kubernetes.io/name: general-l2-policy
+    app.kubernetes.io/name: general-l2-policy
-#     app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
+spec:
-#   nodeSelector:
+  nodeSelector:
-#     matchExpressions:
+    matchExpressions:
-#       - key: kubernetes.io/hostname
+      - key: kubernetes.io/hostname
-#         operator: Exists
+        operator: Exists
-#   interfaces:
+  interfaces:
-#     - end0
+    - end0
-#     - enp6s0
+    - enp6s0
-#   externalIPs: true
+  externalIPs: true
-#   loadBalancerIPs: true
+  loadBalancerIPs: true

clusters/cl01tl/helm/cilium/values.yaml

@@ -26,7 +26,7 @@ cilium:
         - SYS_ADMIN
         - SYS_RESOURCE
   l2announcements:
-    enabled: false
+    enabled: true
   bgpControlPlane:
     enabled: false
     secretsNamespace:

clusters/cl01tl/helm/code-server/values.yaml

@@ -76,7 +76,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: true
+    enabled: false
     schedule: 16 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/directus/values.yaml

@@ -216,7 +216,7 @@ redis-replication:
     name: directus-redis-config
     key: password
   redisReplication:
-    clusterSize: 3
+    clusterSize: 1
   redisSentinel:
-    enabled: true
+    enabled: false
     clusterSize: 3

clusters/cl01tl/helm/ephemera/values.yaml

@@ -130,7 +130,7 @@ ephemera:
 volsync-target-config:
   pvcTarget: ephemera
   local:
-    enabled: true
+    enabled: false
     schedule: 16 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/external-dns/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: external-dns
   repository: https://kubernetes-sigs.github.io/external-dns/
-  version: 1.20.0
+  version: 1.19.0
-digest: sha256:0da4dec408239ea48de1d95fa8ad7701c4fdc0efe67baa8743507c75e62e2a47
+digest: sha256:2216b442cc820ebe561d611fbcca3955d5c94e227a0b3288e5db9f8da7d6ac00
-generated: "2026-01-03T23:04:25.142170083Z"
+generated: "2025-12-01T20:25:38.288305-06:00"

clusters/cl01tl/helm/external-dns/Chart.yaml

@@ -16,7 +16,7 @@ maintainers:
 dependencies:
   - name: external-dns
     alias: external-dns-unifi
-    version: 1.20.0
+    version: 1.19.0
     repository: https://kubernetes-sigs.github.io/external-dns/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 # renovate: github=kubernetes-sigs/external-dns

clusters/cl01tl/helm/external-secrets/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: external-secrets
   repository: https://charts.external-secrets.io
-  version: 1.2.1
+  version: 1.2.0
-digest: sha256:20d4fe97e96c6bd5ba958b23121d807d8154c39d58b01511b80025166713a141
+digest: sha256:6e713c4b50c14d9daf1758d9f169d10a8c7274d2c42490846817b6fb1a3ce558
-generated: "2026-01-03T23:02:15.181743082Z"
+generated: "2025-12-20T01:04:35.136580598Z"

clusters/cl01tl/helm/external-secrets/Chart.yaml

@@ -12,7 +12,7 @@ sources:
   - https://github.com/external-secrets/external-secrets/tree/main/deploy/charts/external-secrets
 dependencies:
   - name: external-secrets
-    version: 1.2.1
+    version: 1.2.0
     repository: https://charts.external-secrets.io
 icon: https://avatars.githubusercontent.com/u/68335991?s=48&v=4
 # renovate: github=external-secrets/external-secrets

clusters/cl01tl/helm/freshrss/values.yaml

@@ -247,7 +247,7 @@ volsync-target-data:
       - 109
       - 65539
   local:
-    enabled: true
+    enabled: false
     schedule: 18 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/garage/values.yaml

@@ -403,20 +403,20 @@ garage:
               readOnly: true
               mountPropagation: None
               subPath: garage-1.toml
-    db-1:
+    # db-1:
-      forceRename: garage-db-1
+    #   forceRename: garage-db-1
-      storageClass: ceph-block
+    #   storageClass: ceph-block
-      accessMode: ReadWriteOnce
+    #   accessMode: ReadWriteOnce
-      size: 50Gi
+    #   size: 50Gi
-      retain: true
+    #   retain: true
-      advancedMounts:
+    #   advancedMounts:
-        server-1:
+    #     server-1:
-          main:
+    #       main:
-            - path: /var/lib/garage/meta
+    #         - path: /var/lib/garage/meta
-              readOnly: false
+    #           readOnly: false
-          debug:
+    #       debug:
-            - path: /var/lib/garage/meta
+    #         - path: /var/lib/garage/meta
-              readOnly: false
+    #           readOnly: false
     db-2:
       forceRename: garage-db-2
       storageClass: ceph-block

clusters/cl01tl/helm/gatus/values.yaml

@@ -7,7 +7,7 @@ gatus:
     enabled: true
   image:
     repository: ghcr.io/twin/gatus
-    tag: v5.34.0
+    tag: v5.33.1
   annotations:
     reloader.stakater.com/auto: "true"
   service:
@@ -313,8 +313,11 @@ gatus:
       - name: lidatube
         url: https://lidatube.alexlebens.net
         <<: *defaults
-      - name: yubal-playlist
+      - name: rayflume
-        url: https://yubal-playlist.alexlebens.net
+        url: https://rayflume.alexlebens.net
+        <<: *defaults
+      - name: soulsync
+        url: https://soulsync.alexlebens.net
         <<: *defaults
       - name: slskd
         url: https://slskd.alexlebens.net
@@ -421,7 +424,7 @@ postgres-18-cluster:
 volsync-target-data:
   pvcTarget: gatus
   local:
-    enabled: true
+    enabled: false
     schedule: 22 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/harbor/values.yaml

@@ -142,7 +142,7 @@ redis-replication:
   existingSecret:
     enabled: false
   redisReplication:
-    clusterSize: 3
+    clusterSize: 1
   redisSentinel:
-    enabled: true
+    enabled: false
     clusterSize: 3

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -133,7 +133,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: true
+    enabled: false
     schedule: 24 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/homepage/values.yaml

@@ -655,11 +655,11 @@ homepage:
                     url: http://lidarr.lidarr:80
                     key: {{ "{{HOMEPAGE_VAR_LIDARR_KEY}}" }}
                     fields: ["wanted", "queued", "artists"]
-              - Yubal Playlist:
+              - RayFlume:
-                  icon: sh-yubal.webp
+                  icon: sh-youtubarr.webp
-                  description: Replicate Youtube playlist
+                  description: Playlist to Lidarr Import
-                  href: https://yubal-playlist.alexlebens.net
+                  href: https://rayflume.alexlebens.net
-                  siteMonitor: http://yubal-playlist.yubal-playlist:80
+                  siteMonitor: http://rayflume.rayflume:80
                   statusStyle: dot
               - LidaTube:
                   icon: sh-lidatube.webp
@@ -667,6 +667,12 @@ homepage:
                   href: https://lidatube.alexlebens.net
                   siteMonitor: http://lidatube.lidatube:80
                   statusStyle: dot
+              - SoulSync:
+                  icon: sh-soulsync.webp
+                  description: Playlist Sync
+                  href: https://soulsync.alexlebens.net
+                  siteMonitor: http://soulsync.soulsync:80
+                  statusStyle: dot
               - slskd:
                   icon: sh-slskd.webp
                   description: slskd

clusters/cl01tl/helm/huntarr/values.yaml

@@ -61,7 +61,7 @@ huntarr:
 volsync-target-config:
   pvcTarget: huntarr-config
   local:
-    enabled: true
+    enabled: false
     schedule: 26 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/immich/values.yaml

@@ -226,9 +226,9 @@ redis-replication:
   existingSecret:
     enabled: false
   redisReplication:
-    clusterSize: 3
+    clusterSize: 1
   redisSentinel:
-    enabled: true
+    enabled: false
     clusterSize: 3
 volsync-target-data:
   pvcTarget: immich

clusters/cl01tl/helm/jellyfin/values.yaml

@@ -142,7 +142,7 @@ meilisearch:
 volsync-target-config:
   pvcTarget: jellyfin-config
   local:
-    enabled: true
+    enabled: false
     schedule: 30 8 * * *
     restic:
       cacheCapacity: 10Gi

clusters/cl01tl/helm/jellystat/values.yaml

@@ -144,7 +144,7 @@ postgres-18-cluster:
 volsync-target-data:
   pvcTarget: jellystat-data
   local:
-    enabled: true
+    enabled: false
     schedule: 32 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/karakeep/values.yaml

@@ -9,7 +9,7 @@ karakeep:
         main:
           image:
             repository: ghcr.io/karakeep-app/karakeep
-            tag: 0.30.0
+            tag: 0.29.3
             pullPolicy: IfNotPresent
           env:
             - name: DATA_DIR
@@ -171,7 +171,7 @@ meilisearch:
 volsync-target-data:
   pvcTarget: karakeep
   local:
-    enabled: true
+    enabled: false
     schedule: 34 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/kube-prometheus-stack/values.yaml

@@ -174,12 +174,12 @@ redis-replication:
   existingSecret:
     enabled: false
   redisReplication:
-    clusterSize: 3
+    clusterSize: 1
     volumeClaimTemplate:
       spec:
         resources:
           requests:
             storage: 10Gi
   redisSentinel:
-    enabled: true
+    enabled: false
     clusterSize: 3

clusters/cl01tl/helm/libation/values.yaml

@@ -16,7 +16,7 @@ libation:
         main:
           image:
             repository: rmcrackan/libation
-            tag: 13.1.0
+            tag: 13.0.0
             pullPolicy: IfNotPresent
           env:
             - name: SLEEP_TIME
@@ -74,7 +74,7 @@ libation:
 volsync-target-config:
   pvcTarget: libation
   local:
-    enabled: true
+    enabled: false
     schedule: 36 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/lidarr/values.yaml

@@ -171,7 +171,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: true
+    enabled: false
     schedule: 38 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/lidatube/values.yaml

@@ -93,7 +93,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: true
+    enabled: false
     schedule: 40 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/listenarr/values.yaml

@@ -74,7 +74,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: true
+    enabled: false
     schedule: 42 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/local-path-provisioner/values.yaml

@@ -13,16 +13,26 @@ local-path-provisioner:
     reclaimPolicy: Delete
     volumeBindingMode: WaitForFirstConsumer
   nodePathMap:
-    - node: DEFAULT_PATH_FOR_NON_LISTED_NODES
+    - node: talos-2di-ktg
       paths:
-        - /var/mnt/local-storage
+        - /var/local-path-provisioner
+    - node: talos-9vs-6hh
+      paths:
+        - /var/local-path-provisioner
+    - node: talos-aoq-hpv
+      paths:
+        - /var/local-path-provisioner
   affinity:
     nodeAffinity:
       requiredDuringSchedulingIgnoredDuringExecution:
         nodeSelectorTerms:
           - matchExpressions:
-              - key: node-role.kubernetes.io/local-storage-node
+            - key: kubernetes.io/hostname
-                operator: Exists
+              operator: In
+              values:
+                - talos-2di-ktg
+                - talos-9vs-6hh
+                - talos-aoq-hpv
   configmap:
     name: local-path-config
     setup: |-

clusters/cl01tl/helm/matrix-synapse/values.yaml

@@ -478,7 +478,7 @@ redis-replication-hookshot:
 volsync-target-synapse:
   pvcTarget: matrix-synapse
   local:
-    enabled: true
+    enabled: false
     schedule: 44 8 * * *
   remote:
     enabled: false
@@ -488,7 +488,7 @@ volsync-target-synapse:
 volsync-target-hookshot:
   pvcTarget: matrix-hookshot
   local:
-    enabled: true
+    enabled: false
     schedule: 46 8 * * *
   remote:
     enabled: false
@@ -501,7 +501,7 @@ volsync-target-discord:
     runAsUser: 1337
     runAsGroup: 1337
   local:
-    enabled: true
+    enabled: false
     schedule: 48 8 * * *
   remote:
     enabled: false
@@ -514,7 +514,7 @@ volsync-target-whatsapp:
     runAsUser: 1337
     runAsGroup: 1337
   local:
-    enabled: true
+    enabled: false
     schedule: 50 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/navidrome/values.yaml

@@ -161,7 +161,7 @@ volsync-target-data:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: true
+    enabled: false
     schedule: 52 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/ollama/values.yaml

@@ -307,7 +307,7 @@ volsync-target-data:
     runAsUser: 1337
     runAsGroup: 1337
   local:
-    enabled: true
+    enabled: false
     schedule: 54 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/outline/values.yaml

@@ -188,7 +188,7 @@ redis-replication:
   existingSecret:
     enabled: false
   redisReplication:
-    clusterSize: 3
+    clusterSize: 1
   redisSentinel:
-    enabled: true
+    enabled: false
     clusterSize: 3

clusters/cl01tl/helm/postiz/values.yaml

@@ -173,14 +173,14 @@ redis-replication:
     name: postiz-redis-config
     key: password
   redisReplication:
-    clusterSize: 3
+    clusterSize: 1
   redisSentinel:
-    enabled: true
+    enabled: false
     clusterSize: 3
 volsync-target-config:
   pvcTarget: postiz-config
   local:
-    enabled: true
+    enabled: false
     schedule: 56 8 * * *
   remote:
     enabled: false
@@ -190,7 +190,7 @@ volsync-target-config:
 volsync-target-upload:
   pvcTarget: postiz-uploads
   local:
-    enabled: true
+    enabled: false
     schedule: 58 8 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/prowlarr/values.yaml

@@ -83,7 +83,7 @@ volsync-target-config:
       - 109
       - 65539
   local:
-    enabled: true
+    enabled: false
     schedule: 0 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/qbittorrent/templates/external-secret.yaml

@@ -19,20 +19,6 @@ spec:
         key: /protonvpn/conf/cl01tl
         metadataPolicy: None
         property: private-key
-    - secretKey: proton-email
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
-        metadataPolicy: None
-        property: email
-    - secretKey: proton-password
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
-        metadataPolicy: None
-        property: password
 
 ---
 apiVersion: external-secrets.io/v1

clusters/cl01tl/helm/qbittorrent/values.yaml

@@ -28,7 +28,7 @@ qbittorrent:
         qbittorrent:
           image:
             repository: ghcr.io/linuxserver/qbittorrent
-            tag: 5.1.4@sha256:e0cedcadd62f809efdeddfd32e4d1192f9a74e6e64ed6753bfc6e2c3ed4a714a
+            tag: 5.1.4@sha256:1497b6e047ad47b738f94739219f0e5c5b2ad7a5953b7cf0050f2fedddd8c601
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -48,7 +48,7 @@ qbittorrent:
         gluetun:
           image:
             repository: ghcr.io/qdm12/gluetun
-            tag: v3.41.0@sha256:6b54856716d0de56e5bb00a77029b0adea57284cf5a466f23aad5979257d3045
+            tag: v3.40.4@sha256:e10584de1f82d8999e5e6c3111901d9d56a2eed21151fb96af060f390bbdfba8
             pullPolicy: IfNotPresent
           lifecycle:
             postStart:
@@ -64,16 +64,6 @@ qbittorrent:
                 secretKeyRef:
                   name: qbittorrent-wireguard-conf
                   key: private-key
-            - name: UPDATER_PROTONVPN_EMAIL
-              valueFrom:
-                secretKeyRef:
-                  name: qbittorrent-wireguard-conf
-                  key: proton-email
-            - name: UPDATER_PROTONVPN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: qbittorrent-wireguard-conf
-                  key: proton-password
             - name: VPN_PORT_FORWARDING
               value: "on"
             - name: VPN_PORT_FORWARDING_UP_COMMAND
@@ -84,8 +74,8 @@ qbittorrent:
               value: 192.168.1.0/24,10.244.0.0/16
             - name: FIREWALL_INPUT_PORTS
               value: 8080,9022
-            - name: DNS_UPSTREAM_RESOLVER_TYPE
+            - name: DOT
-              value: dot
+              value: "off"
           securityContext:
             privileged: True
             capabilities:
@@ -212,7 +202,7 @@ qbittorrent:
         qui:
           image:
             repository: ghcr.io/autobrr/qui
-            tag: v1.12.0
+            tag: v1.11.0
             pullPolicy: IfNotPresent
           env:
             - name: QUI__METRICS_ENABLED
@@ -447,7 +437,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: true
+    enabled: false
     schedule: 2 11 * * *
     restic:
       copyMethod: Snapshot
@@ -468,7 +458,7 @@ volsync-target-config:
 volsync-target-qbit-manage-config:
   pvcTarget: qbittorrent-qbit-manage-config-data
   local:
-    enabled: true
+    enabled: false
     schedule: 4 11 * * *
   remote:
     enabled: false
@@ -478,7 +468,7 @@ volsync-target-qbit-manage-config:
 volsync-target-qui-config:
   pvcTarget: qbittorrent-qui-config-data
   local:
-    enabled: true
+    enabled: false
     schedule: 6 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/radarr-4k/values.yaml

@@ -171,7 +171,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: true
+    enabled: false
     schedule: 10 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/radarr-anime/values.yaml

@@ -169,7 +169,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: true
+    enabled: false
     schedule: 12 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/radarr-standup/values.yaml

@@ -169,7 +169,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: true
+    enabled: false
     schedule: 14 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/radarr/values.yaml

@@ -171,7 +171,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: true
+    enabled: false
     schedule: 8 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/rayflume/Chart.lock

@@ -0,0 +1,12 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.5.0
+- name: redis-replication
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.7.0
+digest: sha256:8ffb9b2d1e452cad49196824787d52f55fcc0309722fbb433a1eb2a99e9d19e1
+generated: "2025-12-27T13:32:17.225782-06:00"

clusters/cl01tl/helm/rayflume/Chart.yaml

@@ -0,0 +1,27 @@
+apiVersion: v2
+name: rayflume
+version: 1.0.0
+description: RayFlume
+keywords:
+  - rayflume
+  - music
+  - lidarr
+home: https://wiki.alexlebens.dev/s/
+sources:
+  - https://gitea.alexlebens.dev/alexlebens/RayFlume
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: rayflume
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.5.0
+  - name: redis-replication
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-data
+    version: 0.7.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+appVersion: 0.0.9

clusters/cl01tl/helm/rayflume/templates/external-secret.yaml

@@ -0,0 +1,42 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: rayflume-config-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: rayflume-config-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: SECRET_KEY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/rayflume/config
+        metadataPolicy: None
+        property: SECRET_KEY
+    - secretKey: LIDARR_TOKEN
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/rayflume/config
+        metadataPolicy: None
+        property: LIDARR_TOKEN
+    - secretKey: YOUTUBE_API_KEY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/rayflume/config
+        metadataPolicy: None
+        property: YOUTUBE_API_KEY
+    - secretKey: MB_USER_AGENT
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/rayflume/config
+        metadataPolicy: None
+        property: MB_USER_AGENT

clusters/cl01tl/helm/rayflume/values.yaml

@@ -0,0 +1,104 @@
+rayflume:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: harbor.alexlebens.net/images/rayflume
+            tag: 0.0.9
+            pullPolicy: IfNotPresent
+          env:
+            - name: DEBUG
+              value: True
+            - name: ALLOWED_HOSTS
+              value: rayflume.alexlebens.net,rayflume.rayflume
+            - name: SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: rayflume-config-secret
+                  key: SECRET_KEY
+            - name: LIDARR_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: rayflume-config-secret
+                  key: LIDARR_TOKEN
+            - name: YOUTUBE_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: rayflume-config-secret
+                  key: YOUTUBE_API_KEY
+            - name: MB_USER_AGENT
+              valueFrom:
+                secretKeyRef:
+                  name: rayflume-config-secret
+                  key: MB_USER_AGENT
+            - name: CELERY_BROKER_URL
+              value: redis://redis-replication-rayflume-master.rayflume:6379/0
+            - name: CELERY_RESULT_BACKEND
+              value: redis://redis-replication-rayflume-master.rayflume:6379/0
+          resources:
+            requests:
+              cpu: 10m
+              memory: 64Mi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 80
+          protocol: HTTP
+  route:
+    main:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - rayflume.alexlebens.net
+      rules:
+        - backendRefs:
+            - group: ''
+              kind: Service
+              name: rayflume
+              port: 80
+              weight: 100
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+  persistence:
+    data:
+      forceRename: rayflume-data
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 1Gi
+      advancedMounts:
+        main:
+          main:
+            - path: /data
+              readOnly: false
+redis-replication:
+  existingSecret:
+    enabled: false
+  redisReplication:
+    clusterSize: 1
+  redisSentinel:
+    enabled: false
+    clusterSize: 3
+volsync-target-data:
+  pvcTarget: rayflume-data
+  local:
+    enabled: false
+    schedule: 16 11 * * *
+  remote:
+    enabled: false
+  external:
+    enabled: true
+    schedule: 16 12 * * *

clusters/cl01tl/helm/rook-ceph/values.yaml

@@ -85,8 +85,7 @@ rook-ceph-cluster:
           cpu: 100m
           memory: 128Mi
     storage:
-      useAllDevices: false
+      deviceFilter: sda
-      devicePathFilter: "/dev/disk/by-partlabel/r-csi-disk"
       config:
         osdsPerDevice: "1"
     csi:

clusters/cl01tl/helm/roundcube/values.yaml

@@ -271,7 +271,7 @@ postgres-18-cluster:
 volsync-target-data:
   pvcTarget: roundcube-data
   local:
-    enabled: true
+    enabled: false
     schedule: 16 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/searxng/templates/external-secret.yaml

@@ -1,5 +1,28 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
+metadata:
+  name: searxng-wireguard-conf
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: searxng-wireguard-conf
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: private-key
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /protonvpn/conf/cl01tl
+        metadataPolicy: None
+        property: private-key
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: searxng-browser-metrics-auth
   namespace: {{ .Release.Namespace }}

clusters/cl01tl/helm/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:472dd0c84b8e2a05bca773b4a430b9fc9e4e92cd4fa0afaa223efab925ab752a
+            tag: latest@sha256:1ad4159e74903f8870e3464df701b800a75bd2854f5d11b44ce09ee297f3c158
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -39,7 +39,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:472dd0c84b8e2a05bca773b4a430b9fc9e4e92cd4fa0afaa223efab925ab752a
+            tag: latest@sha256:1ad4159e74903f8870e3464df701b800a75bd2854f5d11b44ce09ee297f3c158
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -67,6 +67,56 @@ searxng:
             requests:
               cpu: 10m
               memory: 128Mi
+        gluetun:
+          image:
+            repository: ghcr.io/qdm12/gluetun
+            tag: v3.40.4@sha256:e10584de1f82d8999e5e6c3111901d9d56a2eed21151fb96af060f390bbdfba8
+            pullPolicy: IfNotPresent
+          lifecycle:
+            postStart:
+              exec:
+                command: ["/bin/sh", "-c", "(ip rule del table 51820; ip -6 rule del table 51820) || true"]
+          env:
+            - name: VPN_SERVICE_PROVIDER
+              value: protonvpn
+            - name: VPN_TYPE
+              value: wireguard
+            - name: WIREGUARD_PRIVATE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: searxng-wireguard-conf
+                  key: private-key
+            - name: FIREWALL_OUTBOUND_SUBNETS
+              value: 192.168.1.0/24,10.244.0.0/16
+            - name: FIREWALL_INPUT_PORTS
+              value: 8080
+          securityContext:
+            privileged: True
+            capabilities:
+              add:
+                - NET_ADMIN
+                - SYS_MODULE
+          probes:
+            liveness:
+              enabled: true
+              custom: true
+              spec:
+                exec:
+                  command:
+                    - /gluetun-entrypoint
+                    - healthcheck
+                failureThreshold: 5
+                initialDelaySeconds: 30
+                periodSeconds: 30
+                successThreshold: 1
+                timeoutSeconds: 15
+          resources:
+            limits:
+              devic.es/tun: "1"
+            requests:
+              devic.es/tun: "1"
+              cpu: 10m
+              memory: 64Mi
   service:
     api:
       controller: api
@@ -170,7 +220,7 @@ searxng:
 volsync-target-data:
   pvcTarget: searxng-browser-data
   local:
-    enabled: true
+    enabled: false
     schedule: 18 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/seerr/values.yaml

@@ -32,7 +32,7 @@ seerr-chart:
 volsync-target-config:
   pvcTarget: seerr-seerr-chart-config
   local:
-    enabled: true
+    enabled: false
     schedule: 20 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/slskd/templates/external-secret.yaml

@@ -65,17 +65,3 @@ spec:
         key: /protonvpn/conf/cl01tl
         metadataPolicy: None
         property: private-key
-    - secretKey: proton-email
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
-        metadataPolicy: None
-        property: email
-    - secretKey: proton-password
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
-        metadataPolicy: None
-        property: password

clusters/cl01tl/helm/slskd/values.yaml

@@ -46,7 +46,7 @@ slskd:
         gluetun:
           image:
             repository: ghcr.io/qdm12/gluetun
-            tag: v3.41.0@sha256:6b54856716d0de56e5bb00a77029b0adea57284cf5a466f23aad5979257d3045
+            tag: v3.40.4@sha256:e10584de1f82d8999e5e6c3111901d9d56a2eed21151fb96af060f390bbdfba8
             pullPolicy: IfNotPresent
           lifecycle:
             postStart:
@@ -62,16 +62,6 @@ slskd:
                 secretKeyRef:
                   name: slskd-wireguard-conf
                   key: private-key
-            - name: UPDATER_PROTONVPN_EMAIL
-              valueFrom:
-                secretKeyRef:
-                  name: slskd-wireguard-conf
-                  key: proton-email
-            - name: UPDATER_PROTONVPN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: slskd-wireguard-conf
-                  key: proton-password
             - name: VPN_PORT_FORWARDING
               value: "on"
             - name: PORT_FORWARD_ONLY
@@ -80,8 +70,8 @@ slskd:
               value: 192.168.1.0/24,10.244.0.0/16
             - name: FIREWALL_INPUT_PORTS
               value: 5030,50300
-            - name: DNS_UPSTREAM_RESOLVER_TYPE
+            - name: DOT
-              value: dot
+              value: "off"
           securityContext:
             privileged: true
             capabilities:

clusters/cl01tl/helm/sonarr-4k/values.yaml

@@ -169,7 +169,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: true
+    enabled: false
     schedule: 24 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/sonarr-anime/values.yaml

@@ -169,7 +169,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: true
+    enabled: false
     schedule: 26 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/sonarr/values.yaml

@@ -169,7 +169,7 @@ volsync-target-config:
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:
-    enabled: true
+    enabled: false
     schedule: 22 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/soulsync/Chart.lock

@@ -0,0 +1,12 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.5.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.7.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.7.0
+digest: sha256:3f2befd8dc0c7cc73090a5e1648d200a757dbc3e58f7735940fc11b172ada4f9
+generated: "2025-12-27T13:32:51.138317-06:00"

clusters/cl01tl/helm/soulsync/Chart.yaml

@@ -0,0 +1,29 @@
+apiVersion: v2
+name: soulsync
+version: 1.0.0
+description: SoulSync
+keywords:
+  - soulsync
+  - music
+home: https://wiki.alexlebens.dev/s/
+sources:
+  - https://github.com/Nezreka/SoulSync
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: soulsync
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.5.0
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.7.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-database
+    version: 0.7.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/soulsync.png
+# renovate: github=Nezreka/SoulSync
+appVersion: 1.42.2

clusters/cl01tl/helm/soulsync/templates/external-secret.yaml

@@ -1,10 +1,10 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: yubal-playlist-config-secret
+  name: soulsync-config-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: yubal-playlist-config-secret
+    app.kubernetes.io/name: soulsync-config-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -12,10 +12,10 @@ spec:
     kind: ClusterSecretStore
     name: vault
   data:
-    - secretKey: lidarr-key
+    - secretKey: config.json
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /cl01tl/lidarr2/key
+        key: /cl01tl/soulsync/config
         metadataPolicy: None
-        property: key
+        property: config.json

clusters/cl01tl/helm/soulsync/templates/persistent-volume-claim.yaml

@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: soulsync-music-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: soulsync-music-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  volumeName: soulsync-music-nfs-storage
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: soulsync-slskd-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: soulsync-slskd-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  volumeName: soulsync-slskd-nfs-storage
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi

clusters/cl01tl/helm/soulsync/templates/persistent-volume.yaml

@@ -0,0 +1,48 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: soulsync-music-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: soulsync-music-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: nfs-client
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    path: /volume2/Storage/Music
+    server: synologybond.alexlebens.net
+  mountOptions:
+    - vers=4
+    - minorversion=1
+    - noac
+
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: soulsync-slskd-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: soulsync-slskd-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: nfs-client
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    path: /volume2/Storage/slskd/Downloads
+    server: synologybond.alexlebens.net
+  mountOptions:
+    - vers=4
+    - minorversion=1
+    - noac

clusters/cl01tl/helm/soulsync/values.yaml

@@ -0,0 +1,170 @@
+soulsync:
+  controllers:
+    main:
+      type: deployment
+      replicas: 0
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      initContainers:
+        init-copy-config:
+          image:
+            repository: busybox
+            tag: 1.37.0
+            pullPolicy: IfNotPresent
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+          command:
+            - /bin/sh
+            - -ec
+            - |
+              echo ">> Coping files ..."
+              ls /tmp
+              cp -fv /tmp/config.json /app/config/config.json
+              echo ">> Files in config:"
+              ls /app/config
+      containers:
+        main:
+          image:
+            repository: boulderbadgedad/soulsync
+            tag: latest
+            pullPolicy: IfNotPresent
+          env:
+            - name: TZ
+              value: US/Central
+            - name: PUID
+              value: 1000
+            - name: PGID
+              value: 1000
+            - name: FLASK_ENV
+              value: production
+            - name: PYTHONPATH
+              value: /app
+            - name: SOULSYNC_CONFIG_PATH
+              value: /app/config/config.json
+          probes:
+            liveness:
+              enabled: true
+              custom: true
+              spec:
+                exec:
+                  command:
+                  - CMD
+                  - curl
+                  - -f
+                  - http://localhost:8888/
+                failureThreshold: 5
+                initialDelaySeconds: 60
+                periodSeconds: 30
+                successThreshold: 1
+                timeoutSeconds: 10
+          resources:
+            requests:
+              cpu: 100m
+              memory: 512Mi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 8008
+          protocol: HTTP
+  route:
+    main:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - soulsync.alexlebens.net
+      rules:
+        - backendRefs:
+            - group: ''
+              kind: Service
+              name: soulsync
+              port: 80
+              weight: 100
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+  persistence:
+    secret:
+      enabled: true
+      type: secret
+      name: soulsync-config-secret
+      advancedMounts:
+        main:
+          init-copy-config:
+            - path: /tmp/config.json
+              readOnly: true
+              mountPropagation: None
+              subPath: config.json
+    config:
+      forceRename: soulsync-config
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      advancedMounts:
+        main:
+          main:
+            - path: /app/config
+              readOnly: false
+          init-copy-config:
+            - path: /app/config
+              readOnly: false
+    database:
+      forceRename: soulsync-database
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      advancedMounts:
+        main:
+          main:
+            - path: /app/database
+              readOnly: false
+    downloads:
+      existingClaim: soulsync-slskd-nfs-storage
+      advancedMounts:
+        main:
+          main:
+            - path: /app/downloads
+              readOnly: false
+    transfer:
+      type: emptyDir
+      advancedMounts:
+        main:
+          main:
+            - path: /app/Transfer
+              readOnly: false
+    music:
+      existingClaim: soulsync-music-nfs-storage
+      advancedMounts:
+        main:
+          main:
+            - path: /music
+              readOnly: true
+volsync-target-config:
+  pvcTarget: soulsync-config
+  local:
+    enabled: false
+    schedule: 28 11 * * *
+  remote:
+    enabled: false
+  external:
+    enabled: true
+    schedule: 28 12 * * *
+volsync-target-database:
+  pvcTarget: soulsync-database
+  local:
+    enabled: false
+    schedule: 30 11 * * *
+  remote:
+    enabled: false
+  external:
+    enabled: true
+    schedule: 30 12 * * *

clusters/cl01tl/helm/stalwart/values.yaml

@@ -118,14 +118,14 @@ redis-replication:
   existingSecret:
     enabled: false
   redisReplication:
-    clusterSize: 3
+    clusterSize: 1
   redisSentinel:
-    enabled: true
+    enabled: false
     clusterSize: 3
 volsync-target-config:
   pvcTarget: stalwart-config
   local:
-    enabled: true
+    enabled: false
     schedule: 32 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/tautulli/values.yaml

@@ -170,7 +170,7 @@ tautulli:
 volsync-target-config:
   pvcTarget: tautulli-config
   local:
-    enabled: true
+    enabled: false
     schedule: 34 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/tdarr/values.yaml

@@ -180,7 +180,7 @@ tdarr-exporter:
 volsync-target-config:
   pvcTarget: tdarr-config
   local:
-    enabled: true
+    enabled: false
     schedule: 36 11 * * *
   remote:
     enabled: false
@@ -190,7 +190,7 @@ volsync-target-config:
 volsync-target-server:
   pvcTarget: tdarr-server
   local:
-    enabled: true
+    enabled: false
     schedule: 38 11 * * *
   remote:
     enabled: false

clusters/cl01tl/helm/tubearchivist/templates/external-secret.yaml

@@ -86,17 +86,3 @@ spec:
         key: /protonvpn/conf/cl01tl
         metadataPolicy: None
         property: private-key
-    - secretKey: proton-email
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
-        metadataPolicy: None
-        property: email
-    - secretKey: proton-password
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
-        metadataPolicy: None
-        property: password

clusters/cl01tl/helm/tubearchivist/values.yaml

@@ -40,7 +40,7 @@ tubearchivist:
         gluetun:
           image:
             repository: ghcr.io/qdm12/gluetun
-            tag: v3.41.0@sha256:6b54856716d0de56e5bb00a77029b0adea57284cf5a466f23aad5979257d3045
+            tag: v3.40.4@sha256:e10584de1f82d8999e5e6c3111901d9d56a2eed21151fb96af060f390bbdfba8
             pullPolicy: IfNotPresent
           lifecycle:
             postStart:
@@ -56,16 +56,6 @@ tubearchivist:
                 secretKeyRef:
                   name: tubearchivist-wireguard-conf
                   key: private-key
-            - name: UPDATER_PROTONVPN_EMAIL
-              valueFrom:
-                secretKeyRef:
-                  name: tubearchivist-wireguard-conf
-                  key: proton-email
-            - name: UPDATER_PROTONVPN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: tubearchivist-wireguard-conf
-                  key: proton-password
             - name: VPN_PORT_FORWARDING
               value: "on"
             - name: PORT_FORWARD_ONLY
@@ -74,8 +64,12 @@ tubearchivist:
               value: 10.0.0.0/8
             - name: FIREWALL_INPUT_PORTS
               value: 80,8000,24000
-            - name: DNS_UPSTREAM_RESOLVER_TYPE
+            - name: DOT
-              value: dot
+              value: off
+            - name: DNS_KEEP_NAMESERVER
+              value: on
+            - name: DNS_PLAINTEXT_ADDRESS
+              value: 10.96.0.10
           securityContext:
             privileged: True
             capabilities:
@@ -154,7 +148,7 @@ redis-replication:
   existingSecret:
     enabled: false
   redisReplication:
-    clusterSize: 3
+    clusterSize: 1
     resources:
       requests:
         cpu: 200m
@@ -165,5 +159,5 @@ redis-replication:
           requests:
             storage: 10Gi
   redisSentinel:
-    enabled: true
+    enabled: false
     clusterSize: 3

clusters/cl01tl/helm/vaultwarden/values.yaml

@@ -9,7 +9,7 @@ vaultwarden:
         main:
           image:
             repository: vaultwarden/server
-            tag: 1.35.1
+            tag: 1.35.0
             pullPolicy: IfNotPresent
           env:
             - name: DOMAIN

clusters/cl01tl/helm/yamtrack/values.yaml

@@ -136,7 +136,7 @@ redis-replication:
   existingSecret:
     enabled: false
   redisReplication:
-    clusterSize: 3
+    clusterSize: 1
   redisSentinel:
-    enabled: true
+    enabled: false
     clusterSize: 3

clusters/cl01tl/helm/ytdl-sub/Chart.yaml

@@ -1,22 +1,22 @@
 apiVersion: v2
-name: yubal-playlist
+name: ytdl-sub
 version: 1.0.0
-description: yubal-playlist
+description: ytdl-sub
 keywords:
-  - yubal-playlist
+  - ytdl-sub
   - music
   - youtube
 home: https://wiki.alexlebens.dev/s/
 sources:
-  - https://gitea.alexlebens.dev/alexlebens/yubal-playlist
+  - https://github.com/jmbannon/ytdl-sub
-  - https://github.com/guillevc/yubal
+  - https://github.com/jmbannon/ytdl-sub/pkgs/container/ytdl-sub
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
 maintainers:
   - name: alexlebens
 dependencies:
   - name: app-template
-    alias: yubal-playlist
+    alias: ytdl-sub
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
-# renovate: github=alexlebens/yubal-playlist
+# renovate: github=jmbannon/ytdl-sub
-appVersion: 0.0.5
+appVersion: 2025.12.26

clusters/cl01tl/helm/ytdl-sub/templates/persistent-volume-claim.yaml

@@ -1,14 +1,14 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: yubal-playlist-nfs-storage
+  name: ytdl-sub-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: yubal-playlist-nfs-storage
+    app.kubernetes.io/name: ytdl-sub-nfs-storage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
-  volumeName: yubal-playlist-nfs-storage
+  volumeName: ytdl-sub-nfs-storage
   storageClassName: nfs-client
   accessModes:
     - ReadWriteMany

clusters/cl01tl/helm/ytdl-sub/templates/persistent-volume.yaml

@@ -1,10 +1,10 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: yubal-playlist-nfs-storage
+  name: ytdl-sub-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: yubal-playlist-nfs-storage
+    app.kubernetes.io/name: ytdl-sub-nfs-storage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:

clusters/cl01tl/helm/ytdl-sub/values.yaml

@@ -0,0 +1,81 @@
+ytdl-sub:
+  controllers:
+    main:
+      type: cronjob
+      cronjob:
+        suspend: false
+        concurrencyPolicy: Forbid
+        timeZone: US/Central
+        schedule: 12 0 * * *
+        startingDeadlineSeconds: 90
+        successfulJobsHistory: 1
+        failedJobsHistory: 1
+        backoffLimit: 3
+        parallelism: 1
+      containers:
+        main:
+          image:
+            repository: ghcr.io/jmbannon/ytdl-sub
+            tag: 2025.12.30
+            pullPolicy: IfNotPresent
+          command:
+            - ytdl-sub
+            - -c
+            - /config/config.yaml
+            - sub
+          env:
+            - name: TZ
+              value: America/Chicago
+            - name: CRON_RUN_ON_START
+              value: false
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+  configMaps:
+    config:
+      enabled: true
+      data:
+        config.yaml: |
+          configuration:
+            working_directory: /cache
+        subscriptions.yaml: |
+          __preset__:
+            embed_thumbnail: True
+            square_thumbnail: True
+            overrides:
+              music_directory: /music
+          YouTube Releases | Max MP3 Quality:
+            = YouTube:
+              "Music Saved": "https://www.youtube.com/playlist?list=PLtiOoYqxYXtKK3fMya_xhqK0Wit0i10Gy&si=8wNBH-kGT9Nx0XBK"
+
+  persistence:
+    config:
+      enabled: true
+      type: configMap
+      name: ytdl-sub
+      advancedMounts:
+        main:
+          main:
+            - path: /config/config.yaml
+              readOnly: true
+              mountPropagation: None
+              subPath: config.yaml
+            - path: /config/subscriptions.yaml
+              readOnly: true
+              mountPropagation: None
+              subPath: subscriptions.yaml
+    cache:
+      type: emptyDir
+      advancedMounts:
+        main:
+          main:
+            - path: /cache
+              readOnly: false
+    music:
+      existingClaim: ytdl-sub-nfs-storage
+      advancedMounts:
+        main:
+          main:
+            - path: /music
+              readOnly: false

clusters/cl01tl/helm/yubal-playlist/values.yaml

@@ -1,77 +0,0 @@
-yubal-playlist:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: harbor.alexlebens.net/images/yubal-playlist
-            tag: 0.0.5
-            pullPolicy: IfNotPresent
-          env:
-            - name: YUBAL_TZ
-              value: America/Chicago
-            - name: YUBAL_PORT
-              value: 8000
-            - name: YUBAL_DEBUG
-              value: true
-            - name: YUBAL_MB_USER_AGENT
-              value: alexanderlebens@gmail.com
-            - name: YUBAL_LIDARR_ENDPOINT
-              value: http://lidarr.lidarr:80
-            - name: YUBAL_LIDARR_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: yubal-playlist-config-secret
-                  key: lidarr-key
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 8000
-          protocol: HTTP
-  route:
-    main:
-      kind: HTTPRoute
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: traefik-gateway
-          namespace: traefik
-      hostnames:
-        - yubal-playlist.alexlebens.net
-      rules:
-        - backendRefs:
-            - group: ''
-              kind: Service
-              name: yubal-playlist
-              port: 80
-              weight: 100
-          matches:
-            - path:
-                type: PathPrefix
-                value: /
-  persistence:
-    cache:
-      type: emptyDir
-      advancedMounts:
-        main:
-          main:
-            - path: /app/ytdlp
-              readOnly: false
-    music:
-      existingClaim: yubal-playlist-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /app/data
-              readOnly: false

hosts/ps08rp/blocky/config.yml

@@ -75,6 +75,7 @@ customDNS:
     blocky                          IN      A       10.232.1.22
     cilium-cl01tl                   IN      A       10.232.1.23
 
+
     ;; Application Names
     actual                          IN      CNAME   traefik-cl01tl
     alertmanager                    IN      CNAME   traefik-cl01tl
@@ -127,12 +128,14 @@ customDNS:
     radarr-4k                       IN      CNAME   traefik-cl01tl
     radarr-anime                    IN      CNAME   traefik-cl01tl
     radarr-standup                  IN      CNAME   traefik-cl01tl
+    rayflume                        IN      CNAME   traefik-cl01tl
     searxng                         IN      CNAME   traefik-cl01tl
     seerr                           IN      CNAME   traefik-cl01tl
     slskd                           IN      CNAME   traefik-cl01tl
     sonarr                          IN      CNAME   traefik-cl01tl
     sonarr-4k                       IN      CNAME   traefik-cl01tl
     sonarr-anime                    IN      CNAME   traefik-cl01tl
+    soulsync                        IN      CNAME   traefik-cl01tl
     stalwart                        IN      CNAME   traefik-cl01tl
     tautulli                        IN      CNAME   traefik-cl01tl
     tdarr                           IN      CNAME   traefik-cl01tl
@@ -140,7 +143,6 @@ customDNS:
     vault                           IN      CNAME   traefik-cl01tl
     whodb                           IN      CNAME   traefik-cl01tl
     yamtrack                        IN      CNAME   traefik-cl01tl
-    yubal-playlist                  IN      CNAME   traefik-cl01tl
 
 blocking:
   denylists:

hosts/ps09rp/blocky/config.yml

@@ -49,27 +49,6 @@ customDNS:
     it05sp                          IN      A       10.230.0.100  ; Shelly Plug
 
 
-    ;; Computer Names
-    nw01un                          IN      A       192.168.1.1   ; Unifi Gateway
-
-    ps08rp                          IN      A       10.232.1.51   ; DNS
-    ps09rp                          IN      A       10.232.1.52   ; DNS
-    ps02sn                          IN      A       10.232.1.61   ; Synology Web
-    ps02sn-bond                     IN      A       10.232.1.64   ; Synology Bond for Storage
-
-    pd05wd                          IN      A       10.230.0.115  ; Desktop
-    pl02mc                          IN      A       10.230.0.105  ; Laptop
-
-    dv01hr                          IN      A       10.232.1.72   ; HD Homerun
-    dv02kv                          IN      A       10.232.1.71   ; Pi KVM
-
-    it01ag                          IN      A       10.232.1.83   ; Airgradient
-    it02ph                          IN      A       10.232.1.85   ; Phillips Hue
-    it03tb                          IN      A       10.232.1.81   ; TubesZB ZigBee
-    it04tb                          IN      A       10.232.1.82   ; TubesZB Z-Wave
-    it05sp                          IN      A       10.230.0.100  ; Shelly Plug
-
-
     ;; Common Names
     synology                        IN      CNAME   ps02sn
     synologybond                    IN      CNAME   ps02sn-bond
@@ -96,6 +75,7 @@ customDNS:
     blocky                          IN      A       10.232.1.22
     cilium-cl01tl                   IN      A       10.232.1.23
 
+
     ;; Application Names
     actual                          IN      CNAME   traefik-cl01tl
     alertmanager                    IN      CNAME   traefik-cl01tl
@@ -148,12 +128,14 @@ customDNS:
     radarr-4k                       IN      CNAME   traefik-cl01tl
     radarr-anime                    IN      CNAME   traefik-cl01tl
     radarr-standup                  IN      CNAME   traefik-cl01tl
+    rayflume                        IN      CNAME   traefik-cl01tl
     searxng                         IN      CNAME   traefik-cl01tl
     seerr                           IN      CNAME   traefik-cl01tl
     slskd                           IN      CNAME   traefik-cl01tl
     sonarr                          IN      CNAME   traefik-cl01tl
     sonarr-4k                       IN      CNAME   traefik-cl01tl
     sonarr-anime                    IN      CNAME   traefik-cl01tl
+    soulsync                        IN      CNAME   traefik-cl01tl
     stalwart                        IN      CNAME   traefik-cl01tl
     tautulli                        IN      CNAME   traefik-cl01tl
     tdarr                           IN      CNAME   traefik-cl01tl
@@ -161,7 +143,6 @@ customDNS:
     vault                           IN      CNAME   traefik-cl01tl
     whodb                           IN      CNAME   traefik-cl01tl
     yamtrack                        IN      CNAME   traefik-cl01tl
-    yubal-playlist                  IN      CNAME   traefik-cl01tl
 
 blocking:
   denylists: