chore(deps): update external-secrets to v2.3.0

2026-04-10 15:06:03 +00:00
24 changed files with 42 additions and 350 deletions
--- a/.gitea/workflows/lint-test-helm.yaml
+++ b/.gitea/workflows/lint-test-helm.yaml
@@ -16,8 +16,8 @@ on:
 env:
  CLUSTER: cl01tl
  BASE_BRANCH: "origin/${{ github.base_ref }}"
+  # renovate: datasource=github-releases depName=yannh/kubeconform
  KUBECONFORM_VERSION: "v0.6.7"
-  ARGOCD_VERSION: "v3.3.6"

 jobs:
  lint-helm:
@@ -102,7 +102,7 @@ jobs:
            echo ""
            echo "${CHANGED_CHARTS}"

-            CHANGED_CHARTS_CSV=$(echo "${CHANGED_CHARTS}" | paste -sd ',' -)
+            CHANGED_CHARTS_CSV=$(echo "$CHANGED_CHARTS" | paste -sd ',' -)

            echo ""
            echo "----"
@@ -236,17 +236,7 @@ jobs:
        with:
          fetch-depth: 0

-      - name: Cache Kubeconform
-        id: cache-kubeconform
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
-        with:
-          path: /usr/local/bin/kubeconform
-          key: ${{ runner.os }}-kubeconform-${{ env.KUBECONFORM_VERSION }}
-          restore-keys: |
-            ${{ runner.os }}-kubeconform-
-
      - name: Install Kubeconform
-        if: steps.cache-kubeconform.outputs.cache-hit != 'true'
        run: |
          echo ">> Downloading Kubeconform ${{ env.KUBECONFORM_VERSION }} ..."
          wget -q https://github.com/yannh/kubeconform/releases/download/${{ env.KUBECONFORM_VERSION }}/kubeconform-linux-amd64.tar.gz
@@ -259,8 +249,6 @@ jobs:
          echo ">> Installing Kubeconform ..."
          sudo mv kubeconform /usr/local/bin/

-      - name: Verify installation
-        run: |
          echo ""
          echo ">> Verifying installation ..."
          kubeconform -v
@@ -336,7 +324,7 @@ jobs:

            helm dependency build "${CHART_PATH}" --skip-refresh

-            if ! helm template "${DIR}" "${CHART_PATH}" --include-crds --namespace default --api-versions "gateway.networking.k8s.io/v1/HTTPRoute,monitoring.coreos.com/v1,monitoring.coreos.com/v1/ServiceMonitor" | \
+            if ! helm template "${DIR}" "${CHART_PATH}" --include-crds --namespace default --api-versions "gateway.networking.k8s.io/v1/HTTPRoute" | \
              kubeconform \
                ${SCHEMA_LOCATIONS} \
                -ignore-missing-schemas \
@@ -377,250 +365,3 @@ jobs:
          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
          actions: '[{"action": "view", "label": "View Run", "url": "${{ vars.USER_URL }}/${{ github.repository }}/actions/runs/${{ github.run_id }}", "clear": true}]'
          image: true
-
-  argo-diff:
-    needs: lint-helm
-    runs-on: ubuntu-js
-    if: |
-      needs.lint-helm.result == 'success' &&
-      needs.lint-helm.outputs.changes-detected == 'true' &&
-      github.event_name == 'pull_request'
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          fetch-depth: 0
-
-      - name: Cache ArgoCD CLI
-        id: cache-argocd
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
-        with:
-          path: /usr/local/bin/argocd
-          key: ${{ runner.os }}-argocd-${{ env.ARGOCD_VERSION }}
-          restore-keys: |
-            ${{ runner.os }}-argocd-
-
-      - name: Install ArgoCD CLI
-        if: steps.cache-argocd.outputs.cache-hit != 'true'
-        run: |
-          echo ">> Downloading ArgoCD CLI, version: ${{ env.ARGOCD_VERSION }} ..."
-          curl -sSL -o argocd-linux-amd64 https://github.com/argoproj/argo-cd/releases/download/${{ env.ARGOCD_VERSION }}/argocd-linux-amd64
-
-          echo ""
-          echo ">> Installing ArgoCD CLI ..."
-          sudo install -m 555 argocd-linux-amd64 /usr/local/bin/argocd
-
-          echo ""
-          echo "----"
-
-      - name: Verify installation
-        run: |
-          echo ""
-          echo ">> Verifying installation ..."
-          argocd version --client
-
-          echo ""
-          echo "----"
-
-      - name: Set Up Helm
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5
-        with:
-          token: ${{ secrets.GITEA_TOKEN }}
-          # renovate: datasource=github-releases depName=helm/helm
-          version: v4.1.3
-          cache: true
-
-      - name: Cache Helm Dependencies
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
-        with:
-          path: |
-            ~/.cache/helm
-            ~/.config/helm
-          key: helm-cache-${{ runner.os }}-${{ hashFiles('infrastructure/clusters/cl01tl/helm/**/Chart.yaml', 'infrastructure/clusters/cl01tl/helm/**/Chart.lock') }}
-          restore-keys: |
-            helm-cache-${{ runner.os }}-
-
-      - name: Add Repositories
-        env:
-          CHANGED_CHARTS: ${{ needs.lint-helm.outputs.chart-dir }}
-        run: |
-          echo ">> Adding repositories for chart dependencies ..."
-          echo ""
-
-          for DIR in ${CHANGED_CHARTS}; do
-            helm dependency list --max-col-width 120 clusters/${CLUSTER}/helm/${DIR} 2> /dev/null \
-              | tail -n +2 \
-              | awk 'NF > 0 { print $1, $3 }' \
-              | while read -r REPO_NAME REPO_URL; do
-                if [[ "${REPO_URL}" == oci://* ]]; then
-                  echo ">> Ignoring OCI repo: ${REPO_URL}"
-
-                elif [[ -n "${REPO_NAME}" && -n "${REPO_URL}" ]]; then
-                  helm repo add "${REPO_NAME}" "${REPO_URL}"
-
-                fi
-
-              done || true
-          done
-
-          if helm repo list > /dev/null 2>&1; then
-            echo ""
-            echo ">> Update repository cache ..."
-            helm repo update
-
-          fi
-
-          echo ""
-          echo "----"
-
-      - name: Render Templates
-        id: render
-        env:
-          CHANGED_CHARTS: ${{ needs.lint-helm.outputs.chart-dir }}
-        run: |
-          for APP_NAME in ${CHANGED_CHARTS}; do
-            echo ">> Render templates for ${APP_NAME} ..."
-            CHART_PATH="clusters/${CLUSTER}/helm/${APP_NAME}"
-            OUTPUT_FOLDER="clusters/${CLUSTER}/manifests/${APP_NAME}/"
-
-            helm dependency build "${CHART_PATH}" --skip-refresh
-
-            NAMESPACE="${APP_NAME}"
-            case "${APP_NAME}" in
-              "stack")
-                NAMESPACE="argocd"
-                echo ">> Special Rendering into 'argocd' namespace ..."
-                ;;
-              "cilium" | "coredns" | "metrics-server")
-                NAMESPACE="kube-system"
-                echo ">> Special Rendering for ${APP_NAME} into 'kube-system' namespace ..."
-                ;;
-              *)
-                echo ">> Standard Rendering ..."
-            esac
-
-            TEMPLATE=$(helm template "${APP_NAME}" "${CHART_PATH}" --include-crds --namespace "${NAMESPACE}" --include-crds --api-versions "gateway.networking.k8s.io/v1/HTTPRoute,monitoring.coreos.com/v1,monitoring.coreos.com/v1/ServiceMonitor")
-
-            # Format and split rendered template
-            echo "${TEMPLATE}" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"${OUTPUT_FOLDER}"'" + .kind + "-" + .metadata.name + ".yaml"'
-
-            # Strip comments again to ensure formatting correctness
-            for file in "$OUTPUT_FOLDER"/*; do
-              yq -i '... comments=""' $file
-
-            done
-
-            echo ""
-            echo ">> Templates in outpute folder: ${OUTPUT_FOLDER}"
-            ls ${OUTPUT_FOLDER}
-          done
-
-          echo "----"
-
-      - name: Run App Diff
-        id: diff
-        env:
-          ARGOCD_SERVER: ${{ secrets.ARGOCD_SERVER }}
-          ARGOCD_AUTH_TOKEN: ${{ secrets.ARGOCD_AUTH_TOKEN }}
-          CHANGED_CHARTS: ${{ needs.lint-helm.outputs.chart-dir }}
-        run: |
-          # argo diff outputs 1 on any diff, but this is expected, only error on output 2+
-          set +e
-          OVERALL_EXIT_CODE=0
-          FAILED_CHARTS=""
-          DIFF_FOUND="false"
-
-          for APP_NAME in ${CHANGED_CHARTS}; do
-            echo ">> Running argocd app diff for ${APP_NAME} ..."
-
-            argocd app diff "${APP_NAME}" \
-              --server "${ARGOCD_SERVER}" \
-              --revision ${{ gitea.sha }} \
-              --grpc-web > diff_output_${APP_NAME}.txt
-
-            EXIT_CODE=$?
-
-            if [ -s "diff_output_${APP_NAME}.txt" ]; then
-              echo ">> Argo diff:"
-              echo ""
-              cat diff_output_${APP_NAME}.txt
-              echo ""
-
-              DIFF_FOUND="true"
-
-            else
-              echo ">> No Argo diff found for ${APP_NAME}"
-              rm "diff_output_${APP_NAME}.txt"
-
-            fi
-
-            if [ $EXIT_CODE -eq 2 ]; then
-              echo ">> ArgoCD diff failed for ${APP_NAME} due to a manifest error"
-
-              OVERALL_EXIT_CODE=1
-
-              if [ -z "${FAILED_CHARTS}" ]; then
-                FAILED_CHARTS="${APP_NAME}"
-
-              else
-                FAILED_CHARTS="${FAILED_CHARTS}, ${APP_NAME}"
-
-              fi
-            fi
-          done
-
-          echo "----"
-          echo "diff-detected=${DIFF_FOUND}" >> "$GITHUB_OUTPUT"
-          echo "failed-charts=${FAILED_CHARTS}" >> "$GITHUB_OUTPUT"
-
-          exit $OVERALL_EXIT_CODE
-
-      - name: Post Diff
-        if: |
-          always() &&
-          steps.diff.outputs.diff-detected == 'true' &&
-          gitea.event.pull_request.number != null
-        env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-        run: |
-          COMMENT_BODY="### ArgoCD Diff Results
-          "
-
-          for f in diff_output_*.txt; do
-            APP_NAME=$(echo $f | sed 's/diff_output_//;s/.txt//')
-            DIFF_CONTENT=$(cat "$f")
-
-            COMMENT_BODY="${COMMENT_BODY}
-          #### App: ${APP_NAME}
-          "
-
-            if [ -z "$DIFF_CONTENT" ]; then
-              COMMENT_BODY="${COMMENT_BODY} No changes detected."
-            else
-              COMMENT_BODY="${COMMENT_BODY}
-          \`\`\`diff
-          ${DIFF_CONTENT}
-          \`\`\`"
-            fi
-          done
-
-          curl -X 'POST' \
-            "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/issues/${{ gitea.event.pull_request.number }}/comments" \
-            -H "Authorization: token ${GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "$(jq -n --arg body "$COMMENT_BODY" '{body: $body}')"
-
-      - name: ntfy Failed
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
-        if: failure()
-        with:
-          url: '${{ secrets.NTFY_URL }}'
-          topic: '${{ secrets.NTFY_TOPIC }}'
-          title: 'ArgoCD Diff Failure'
-          priority: 3
-          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
-          tags: action,failed
-          details: "ArgoCD diff for cluster '${{ env.CLUSTER }}' failed on charts: ${{ steps.diff.outputs.failed-charts }}"
-          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
-          actions: '[{"action": "view", "label": "View Run", "url": "${{ vars.USER_URL }}/${{ github.repository }}/actions/runs/${{ github.run_id }}", "clear": true}]'
-          image: true
--- a/.gitea/workflows/renovate.yaml
+++ b/.gitea/workflows/renovate.yaml
@@ -13,7 +13,7 @@ on:
 jobs:
  renovate:
    runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.110.14@sha256:f3ba59186f17171bf2eaacc35014192d4862bf1b2af3116fb694ba9c17f04f70
+    container: ghcr.io/renovatebot/renovate:43.110.4@sha256:7ad99abc53b30d3f6e34df88b3e2b2b75436bba9b290e90d367356526034496f
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
--- a/clusters/cl01tl/helm/bazarr/values.yaml
+++ b/clusters/cl01tl/helm/bazarr/values.yaml
@@ -23,8 +23,10 @@ bazarr:
            - name: PGID
              value: 1000
          resources:
+            limits:
+              cpu: 100m
            requests:
-              cpu: 10m
+              cpu: 1m
              memory: 250Mi
        metrics:
          image:
--- a/clusters/cl01tl/helm/external-secrets/Chart.lock
+++ b/clusters/cl01tl/helm/external-secrets/Chart.lock
@@ -3,4 +3,4 @@ dependencies:
  repository: https://charts.external-secrets.io
  version: 2.3.0
 digest: sha256:fedb79c937be24d4bb72f665122b468b445de95f3f02de419903e3136186e42f
-generated: "2026-04-10T15:10:52.488487421Z"
+generated: "2026-04-10T15:05:57.474486384Z"
--- a/clusters/cl01tl/helm/foldergram/Chart.lock
+++ b/clusters/cl01tl/helm/foldergram/Chart.lock
@@ -2,11 +2,8 @@ dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.6.2
- name: cloudflared
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.5.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.8.0
-digest: sha256:06e321d19ffe0df94b3cd6bcc306804729710f74ca2f9962652628377836c33e
-generated: "2026-04-11T15:26:16.743784-05:00"
+digest: sha256:59100c6fbfb829f9d703b9ee1cf869c4fd77b6ff53c63b0c644a757223027e58
+generated: "2026-03-22T12:42:43.150705-05:00"
--- a/clusters/cl01tl/helm/foldergram/Chart.yaml
+++ b/clusters/cl01tl/helm/foldergram/Chart.yaml
@@ -10,7 +10,6 @@ sources:
  - https://github.com/foldergram/foldergram
  - https://github.com/foldergram/foldergram/pkgs/container/foldergram
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
  - name: alexlebens
@@ -19,11 +18,8 @@ dependencies:
    alias: foldergram
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.6.2
-  - name: cloudflared
-    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.5.0
  - name: volsync-target
-    alias: volsync-target-db
+    alias: volsync-target-data
    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
--- a/clusters/cl01tl/helm/foldergram/values.yaml
+++ b/clusters/cl01tl/helm/foldergram/values.yaml
@@ -23,13 +23,11 @@ foldergram:
            - name: GALLERY_ROOT
              value: /gallery
            - name: CSRF_TRUSTED_ORIGINS
-              value: https://foldergram.alexlebens.net, https://art.alexlebens.dev
-            # - name: PUBLIC_DEMO_MODE
-            #   value: 1
+              value: https://foldergram.alexlebens.net
          resources:
            requests:
-              cpu: 10m
-              memory: 1Gi
+              cpu: 1m
+              memory: 230Mi
  service:
    main:
      controller: main
@@ -56,21 +54,11 @@ foldergram:
                type: PathPrefix
                value: /
  persistence:
-    db:
-      forceRename: foldergram-db
+    cache:
+      forceRename: foldergram-data
      storageClass: ceph-block
      accessMode: ReadWriteOnce
-      size: 10Gi
-      advancedMounts:
-        main:
-          main:
-            - path: /app/data/db
-              readOnly: false
-    data:
-      forceRename: foldergram-data
-      storageClass: synology-iscsi-delete
-      accessMode: ReadWriteOnce
-      size: 100Gi
+      size: 40Gi
      advancedMounts:
        main:
          main:
@@ -81,10 +69,10 @@ foldergram:
      advancedMounts:
        main:
          main:
-            - path: /gallery
+            - path: /gallery/pictures/collections
              readOnly: true
-volsync-target-db:
-  pvcTarget: foldergram-db
+volsync-target-data:
+  pvcTarget: foldergram-data
  local:
    enabled: true
    schedule: 46 11 * * *
--- a/clusters/cl01tl/helm/generic-device-plugin/Chart.lock
+++ b/clusters/cl01tl/helm/generic-device-plugin/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: generic-device-plugin
  repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-  version: 0.20.29
-digest: sha256:927c4aaf7484f3522ecd92d456f184555f4c742adc1c63b32a149cbb847e9eee
-generated: "2026-04-10T17:19:10.852938614Z"
+  version: 0.20.28
+digest: sha256:16e4470b394110a11721fe38a57ad1cfa7c994bca440bfbbc5b3b7a46a79f165
+generated: "2026-04-05T02:12:22.980217268Z"
--- a/clusters/cl01tl/helm/generic-device-plugin/Chart.yaml
+++ b/clusters/cl01tl/helm/generic-device-plugin/Chart.yaml
@@ -14,6 +14,6 @@ maintainers:
 dependencies:
  - name: generic-device-plugin
    repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-    version: 0.20.29
+    version: 0.20.28
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: 1.0.0
--- a/clusters/cl01tl/helm/gitea/templates/config-map.yaml
+++ b/clusters/cl01tl/helm/gitea/templates/config-map.yaml
@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: gitea-custom-templates
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-custom-templates
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-data:
-  header.tmpl: |
-    <script defer src="https://rybbit.alexlebens.dev/api/script.js" data-site-id="b515c34a6dcc"></script>
--- a/clusters/cl01tl/helm/gitea/values.yaml
+++ b/clusters/cl01tl/helm/gitea/values.yaml
@@ -32,9 +32,6 @@ gitea:
    - name: gitea-themes-storage
      persistentVolumeClaim:
        claimName: gitea-themes-storage
-    - name: gitea-custom-templates
-      configMap:
-        name: gitea-custom-templates
  extraInitVolumeMounts:
    - name: gitea-themes-storage
      readOnly: false
@@ -43,10 +40,6 @@ gitea:
    - name: gitea-themes-storage
      readOnly: true
      mountPath: /data/gitea/public/assets/css
-    - name: gitea-custom-templates
-      mountPath: /data/gitea/templates/custom/header.tmpl
-      subPath: header.tmpl
-      readOnly: true
  initPreScript: |
    wget https://github.com/catppuccin/gitea/releases/latest/download/catppuccin-gitea.tar.gz;
    tar -xvzf catppuccin-gitea.tar.gz -C /data/gitea/public/assets/css;
--- a/clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock
@@ -1,7 +1,7 @@
 dependencies:
 - name: kube-prometheus-stack
  repository: oci://ghcr.io/prometheus-community/charts
-  version: 83.4.0
+  version: 83.2.0
 - name: prometheus-operator-crds
  repository: oci://ghcr.io/prometheus-community/charts
  version: 28.0.1
@@ -11,5 +11,5 @@ dependencies:
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.6.0
-digest: sha256:94ed4d62bfc30d84c74fab1eb3439be43243952686245de16bb5b0ba15b50965
-generated: "2026-04-10T17:23:18.478974013Z"
+digest: sha256:53540696af31c47db50fcbfef6b74fe08912acb2591f8b911bb292567af29772
+generated: "2026-04-10T01:36:25.114003661Z"
--- a/clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml
@@ -20,7 +20,7 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: kube-prometheus-stack
-    version: 83.4.0
+    version: 83.2.0
    repository: oci://ghcr.io/prometheus-community/charts
  - name: prometheus-operator-crds
    version: 28.0.1
--- a/clusters/cl01tl/helm/medialyze/Chart.yaml
+++ b/clusters/cl01tl/helm/medialyze/Chart.yaml
@@ -24,4 +24,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/frederikemmer/MediaLyze/d8f69c0628bac7c047b90f91a66341648029c273/frontend/public/favicon.svg
 # renovate: datasource=github-releases depName=frederikemmer/MediaLyze
-appVersion: 0.5.0
+appVersion: 0.4.1
--- a/clusters/cl01tl/helm/medialyze/values.yaml
+++ b/clusters/cl01tl/helm/medialyze/values.yaml
@@ -12,7 +12,7 @@ medialyze:
        main:
          image:
            repository: ghcr.io/frederikemmer/medialyze
-            tag: 0.5.0@sha256:41dc308bb303fcc7a17a2dac35fc1b3ef6a2d345c3e121f677eaf3c2be7564d6
+            tag: 0.4.1@sha256:d4f2e04d3759f308bea605c9b7242ab6da98813adc0b276dc3cbe9c283071eb8
          env:
            - name: HOST_PORT
              value: 8080
--- a/clusters/cl01tl/helm/postiz/Chart.yaml
+++ b/clusters/cl01tl/helm/postiz/Chart.yaml
@@ -51,4 +51,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/postiz.png
 # renovate: datasource=github-releases depName=gitroomhq/postiz-app
-appVersion: v2.21.5
+appVersion: v2.21.4
--- a/clusters/cl01tl/helm/rybbit/values.yaml
+++ b/clusters/cl01tl/helm/rybbit/values.yaml
@@ -112,7 +112,7 @@ rybbit:
        main:
          image:
            repository: clickhouse/clickhouse-server
-            tag: 26.3.5@sha256:0115c4aa8d29ef873a533bcebaf5a65ec12815cf3b08b4fe6a20c30d460e8133
+            tag: 26.3.4@sha256:e9de4678349386db2bd6282aa71e93ef465912ae9fa419ead2e83eb1cbce7a4a
          env:
            - name: CLICKHOUSE_DB
              value: analytics
--- a/clusters/cl01tl/helm/searxng/values.yaml
+++ b/clusters/cl01tl/helm/searxng/values.yaml
@@ -8,7 +8,7 @@ searxng:
        main:
          image:
            repository: searxng/searxng
-            tag: latest@sha256:e86a5bd7537b6eb01176a8bfd53f9b535fe14bcf193d04648b6c0892d7b59d2f
+            tag: latest@sha256:e314fcbbfb221777f5599ce20c0c48c5d78a876a278bad4a50adc9aa5b661d3a
          env:
            - name: SEARXNG_BASE_URL
              value: http://searxng-api.searxng:8080
@@ -36,7 +36,7 @@ searxng:
        main:
          image:
            repository: searxng/searxng
-            tag: latest@sha256:e86a5bd7537b6eb01176a8bfd53f9b535fe14bcf193d04648b6c0892d7b59d2f
+            tag: latest@sha256:e314fcbbfb221777f5599ce20c0c48c5d78a876a278bad4a50adc9aa5b661d3a
          env:
            - name: SEARXNG_BASE_URL
              value: https://searxng.alexlebens.net/
--- a/clusters/cl01tl/helm/shelly-plug/values.yaml
+++ b/clusters/cl01tl/helm/shelly-plug/values.yaml
@@ -30,7 +30,7 @@ shelly-plug:
        main:
          image:
            repository: php
-            tag: 8.5.5-apache@sha256:103a8cd59a029b387470deace9736a7bc5aeb167a746774c68da82bb469c578c
+            tag: 8.5.4-apache@sha256:e55a9f8e4caa09c6a31ec752b307675d847bb8546d975f379128cb2a99842b96
          env:
            - name: SHELLY_HOSTNAME
              value: it05sp.alexlebens.net
--- a/clusters/cl01tl/helm/site-documentation/values.yaml
+++ b/clusters/cl01tl/helm/site-documentation/values.yaml
@@ -10,7 +10,7 @@ site-documentation:
        main:
          image:
            repository: harbor.alexlebens.net/images/site-documentation
-            tag: 0.24.0@sha256:4de96b40683bdb4998219b38b728a46e821de7ccd28b2ff6cc69ff26a712e7af
+            tag: 0.23.0@sha256:d185fc8513362aab1663016deb2ce43ed6b4e6077685848f500c28d2d2cfd290
          resources:
            requests:
              cpu: 10m
--- a/clusters/cl01tl/helm/speedtest-exporter/values.yaml
+++ b/clusters/cl01tl/helm/speedtest-exporter/values.yaml
@@ -10,8 +10,8 @@ speedtest-exporter:
    runAsNonRoot: true
    runAsUser: 1000
  resources:
-    requests:
-      cpu: 10m
+    limits:
+      cpu: 1m
      memory: 30Mi
  serviceMonitor:
    interval: 180m
--- a/clusters/cl01tl/helm/whodb/Chart.yaml
+++ b/clusters/cl01tl/helm/whodb/Chart.yaml
@@ -19,4 +19,4 @@ dependencies:
    version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/whodb.png
 # renovate: datasource=github-releases depName=clidey/whodb
-appVersion: 0.105.0
+appVersion: 0.104.0
--- a/clusters/cl01tl/helm/whodb/values.yaml
+++ b/clusters/cl01tl/helm/whodb/values.yaml
@@ -7,7 +7,7 @@ whodb:
        main:
          image:
            repository: clidey/whodb
-            tag: 0.105.0@sha256:f4c7139554ef65e162b88792b9d28f793d1b3e50c3838f3d35f37c05a1b51413
+            tag: 0.104.0@sha256:ab485c021b862aac50bb88658f3342ca01d3eba33e933353692bc9989b2912c4
          env:
            - name: WHODB_OLLAMA_HOST
              value: ollama-server-2.ollama
--- a/renovate.json
+++ b/renovate.json
@@ -62,19 +62,6 @@
      "depNameTemplate": "yannh/kubeconform",
      "datasourceTemplate": "github-releases",
      "versioningTemplate": "semver"
-    },
-    {
-      "description": "Update ArgoCD version in GitHub Actions env",
-      "customType": "regex",
-      "managerFilePatterns": [
-        "/^\\.github/workflows/.*\\.ya?ml$/"
-      ],
-      "matchStrings": [
-        "ARGOCD_VERSION: \"(?<currentValue>v?\\d+\\.\\d+\\.\\d+)\""
-      ],
-      "depNameTemplate": "argoproj/argo-cd",
-      "datasourceTemplate": "github-releases",
-      "versioningTemplate": "semver"
    }
  ],
  "packageRules": [
@@ -89,10 +76,10 @@
    {
      "description": "Specific app grouping overrides",
      "matchPackageNames": [
-        "/(^|/|-)(argo-cd|bazarr|cilium|dawarich|element-web|home-assistant|immich|komodo|plex|postiz|rook-ceph|roundcube|rybbit|sonarr|tdarr|traefik)/",
+        "/(^|/|-)(argo-cd|bazarr|cilium|dawarich|element-web|home-assistant|immich|komodo|plex|postiz|rook-ceph|roundcube|rybbit|tdarr|traefik)/",
        "/^rook(-ceph|/rook|/ceph)/"
      ],
-      "groupName": "{{#if packageName}}{{{replace '^.*(argo-cd|bazarr|cilium|dawarich|element-web|home-assistant|immich|komodo|plex|postiz|rook-ceph|roundcube|rybbit|sonarr|tdarr|traefik).*$' '$1' packageName}}}{{else}}{{{replace '^.*(argo-cd|bazarr|cilium|dawarich|element-web|home-assistant|immich|komodo|plex|postiz|rook-ceph|roundcube|rybbit|sonarr|tdarr|traefik).*$' '$1' depName}}}{{/if}}",
+      "groupName": "{{#if packageName}}{{{replace '^.*(argo-cd|bazarr|cilium|dawarich|element-web|home-assistant|immich|komodo|plex|postiz|rook-ceph|roundcube|rybbit|tdarr|traefik).*$' '$1' packageName}}}{{else}}{{{replace '^.*(argo-cd|bazarr|cilium|dawarich|element-web|home-assistant|immich|komodo|plex|postiz|rook-ceph|roundcube|rybbit|tdarr|traefik).*$' '$1' depName}}}{{/if}}",
      "groupSlug": "unified-{{{groupName}}}"
    },
    {