chore(deps): pin dependencies

.gitea/workflows/lint-test-docker.yaml

@@ -120,7 +120,7 @@ jobs:
           echo "----"
 
       - name: ntfy Failed
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
         if: failure()
         with:
           url: '${{ secrets.NTFY_URL }}'

.gitea/workflows/lint-test-helm.yaml

@@ -58,7 +58,7 @@ jobs:
 
       - name: Set Up Helm
         if: steps.branch-exists.outputs.exists == 'true'
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           # renovate: datasource=github-releases depName=helm/helm
@@ -209,7 +209,7 @@ jobs:
           exit $EXIT_CODE
 
       - name: ntfy Failed
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
         if: failure()
         with:
           url: '${{ secrets.NTFY_URL }}'
@@ -257,7 +257,7 @@ jobs:
           echo "----"
 
       - name: Set Up Helm
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           # renovate: datasource=github-releases depName=helm/helm
@@ -352,7 +352,7 @@ jobs:
           exit $EXIT_CODE
 
       - name: ntfy Failed
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
         if: failure()
         with:
           url: '${{ secrets.NTFY_URL }}'

.gitea/workflows/render-manifests.yaml

@@ -43,7 +43,7 @@ jobs:
           path: infrastructure-manifests
 
       - name: Set Up Helm
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           version: v3.17.2 # Pending https://github.com/helm/helm/pull/30743
@@ -568,7 +568,7 @@ jobs:
           echo "----"
 
       - name: ntfy Created
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
         if: steps.create-pull-request.outputs.pull-request-operation == 'created' && steps.mode.outputs.is-automerge == 'false'
         with:
           url: "${{ secrets.NTFY_URL }}"
@@ -582,7 +582,7 @@ jobs:
           actions: '[{"action": "view", "label": "View PR", "url": "${{ vars.USER_URL }}/${{ github.repository }}/pulls/${{ steps.create-pull-request.outputs.pull-request-number }}", "clear": true}]'
 
       - name: ntfy Updated
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
         if: steps.commit-push.outputs.push == 'true' && steps.check-for-pull-request.outputs.pull-request-exists != 'false' && steps.mode.outputs.is-automerge == 'false'
         with:
           url: "${{ secrets.NTFY_URL }}"
@@ -596,7 +596,7 @@ jobs:
           actions: '[{"action": "view", "label": "View PR", "url": "${{ vars.USER_URL }}/${{ github.repository }}/pulls/${{ steps.create-pull-request.outputs.pull-request-number }}", "clear": true}]'
 
       - name: ntfy Merged
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
         if: steps.merge-changes.outputs.pull-request-operation == 'merged'
         with:
           url: "${{ secrets.NTFY_URL }}"
@@ -610,7 +610,7 @@ jobs:
           actions: '[{"action": "view", "label": "View PR", "url": "${{ vars.USER_URL }}/${{ github.repository }}/pulls/${{ steps.create-pull-request.outputs.pull-request-number }}", "clear": true}]'
 
       - name: ntfy Failed
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
         if: failure()
         with:
           url: "${{ secrets.NTFY_URL }}"

.gitea/workflows/renovate.yaml

@@ -13,7 +13,7 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.84.2@sha256:92285747b3aac062a4f567762c272a12dce037843a20177a02c95b7c420e20cb
+    container: ghcr.io/renovatebot/renovate:43@sha256:92285747b3aac062a4f567762c272a12dce037843a20177a02c95b7c420e20cb
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -25,7 +25,7 @@ jobs:
           RENOVATE_ENDPOINT: ${{ vars.INSTANCE_URL }}
           RENOVATE_REPOSITORIES: alexlebens/infrastructure
           RENOVATE_GIT_AUTHOR: Renovate Bot <renovate-bot@alexlebens.net>
-          LOG_LEVEL: debug
+          LOG_LEVEL: info
           RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
           RENOVATE_GIT_PRIVATE_KEY: ${{ secrets.RENOVATE_GIT_PRIVATE_KEY }}
           RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}

clusters/cl01tl/helm/actual/Chart.yaml

@@ -5,12 +5,11 @@ description: Actual
 keywords:
   - actual
   - budget
-home: https://docs.alexlebens.dev/applications/actual/
+home: https://wiki.alexlebens.dev/s/86192f45-94b7-45de-872c-6ef3fec7df5e
 sources:
   - https://github.com/actualbudget/actual
   - https://github.com/actualbudget/actual/pkgs/container/actual
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/actual/values.yaml

@@ -4,18 +4,20 @@ actual:
       type: deployment
       replicas: 1
       strategy: Recreate
+      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: ghcr.io/actualbudget/actual
-            tag: 26.3.0@sha256:eb8bc26f53025e07e464594c12d77c52c4b95840c8dadd9b95c4f0c4660f8ad2
+            tag: 26.3.0
+            pullPolicy: IfNotPresent
           env:
-            - name: ACTUAL_PORT
+            - name: TZ
-              value: 5006
+              value: US/Central
           resources:
             requests:
-              cpu: 25m
+              cpu: 10m
-              memory: 64Mi
+              memory: 128Mi
           probes:
             liveness:
               enabled: true
@@ -52,8 +54,11 @@ actual:
         - actual.alexlebens.net
       rules:
         - backendRefs:
-            - name: actual
+            - group: ''
+              kind: Service
+              name: actual
               port: 80
+              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -64,6 +69,7 @@ actual:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 2Gi
+      retain: true
       advancedMounts:
         main:
           main:

clusters/cl01tl/helm/argo-workflows/Chart.yaml

@@ -7,12 +7,12 @@ keywords:
   - argo-events
   - workflows
   - events
-home: https://docs.alexlebens.dev/applications/argo-workflows/
+home: https://wiki.alexlebens.dev/s/a268508f-d81d-4b4b-8bd5-9058edaea635
 sources:
   - https://github.com/argoproj/argo-workflows
   - https://github.com/argoproj/argo-events
-  - https://github.com/argoproj/argo-helm/tree/main/charts/argo-workflows
+  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://github.com/argoproj/argo-helm/tree/main/charts/argo-events
+  - https://github.com/argoproj/argo-helm/tree/main/charts
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
   - name: alexlebens

clusters/cl01tl/helm/argo-workflows/templates/external-secret.yaml

@@ -14,9 +14,15 @@ spec:
   data:
     - secretKey: secret
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /authentik/oidc/argo-workflows
+        metadataPolicy: None
         property: secret
     - secretKey: client
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /authentik/oidc/argo-workflows
+        metadataPolicy: None
         property: client

clusters/cl01tl/helm/argo-workflows/templates/http-route.yaml

@@ -0,0 +1,28 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: argo-workflows
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: argo-workflows
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+  hostnames:
+    - argo-workflows.alexlebens.net
+  rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: /
+      backendRefs:
+        - group: ''
+          kind: Service
+          name: argo-workflows-server
+          port: 2746
+          weight: 100

clusters/cl01tl/helm/argo-workflows/values.yaml

@@ -2,6 +2,8 @@ argo-workflows:
   crds:
     install: true
     keep: true
+    # -- Use full CRDs with complete OpenAPI schemas. When false, uses minified CRDs with x-kubernetes-preserve-unknown-fields.
+    # Full CRDs are very large and are installed via a pre-install/pre-upgrade hook Job that uses server-side apply.
     full: true
     upgradeJob:
       image:
@@ -11,6 +13,11 @@ argo-workflows:
     metricsConfig:
       enabled: true
     persistence:
+      connectionPool:
+        maxIdleConns: 100
+        maxOpenConns: 0
+      nodeStatusOffLoad: true
+      archive: true
       postgresql:
         host: argo-workflows-postgresql-18-cluster-rw
         port: 5432
@@ -25,34 +32,24 @@ argo-workflows:
         ssl: false
         sslMode: disable
     workflowWorkers: 2
-    workflowTTLWorkers: 2
+    workflowTTLWorkers: 1
-    podCleanupWorkers: 2
+    podCleanupWorkers: 1
-    cronWorkflowWorkers: 2
+    cronWorkflowWorkers: 1
     resources:
       requests:
         cpu: 10m
-        memory: 32Mi
+        memory: 128Mi
     serviceMonitor:
       enabled: true
+    name: workflow-controller
     workflowNamespaces:
+      - argocd
       - argo-workflows
   server:
     authModes:
       - sso
-    httproute:
+    ingress:
-      enabled: true
+      enabled: false
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: traefik-gateway
-          namespace: traefik
-      hostnames:
-        - argo-workflows.alexlebens.net
-      rules:
-        - matches:
-            - path:
-                type: PathPrefix
-                value: /
     sso:
       enabled: true
       issuer: https://authentik.alexlebens.net/application/o/argo-workflows/
@@ -69,15 +66,15 @@ argo-workflows:
         - openid
         - email
         - profile
+  useStaticCredentials: true
+  artifactRepository:
+    archiveLogs: false
 argo-events:
-  crds:
-    install: true
-    keep: true
   controller:
     resources:
       requests:
         cpu: 10m
-        memory: 32Mi
+        memory: 128Mi
     metrics:
       enabled: true
       serviceMonitor:
@@ -87,7 +84,7 @@ argo-events:
     resources:
       requests:
         cpu: 10m
-        memory: 32Mi
+        memory: 128Mi
 postgres-18-cluster:
   mode: recovery
   recovery:
@@ -101,9 +98,32 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
+      # - name: garage-remote
+      #   index: 1
+      #   destinationBucket: postgres-backups
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   retentionPolicy: "90d"
+      #   data:
+      #     compression: bzip2
+      # - name: external
+      #   index: 1
+      #   endpointURL: https://nyc3.digitaloceanspaces.com
+      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 0 14 * * *"
         backupName: garage-local
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 4 * * SAT"
+      #   backupName: garage-remote
+      # - name: daily-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external

clusters/cl01tl/helm/argocd/Chart.yaml

@@ -4,8 +4,10 @@ version: 1.0.0
 description: Argo CD
 keywords:
   - argo-cd
+  - delivery
   - deployment
-home: https://docs.alexlebens.dev/applications/argo-cd/
+  - gitops
+home: https://wiki.alexlebens.dev/s/8a75cf26-b9df-437e-9cc5-2ef47e871a5f
 sources:
   - https://github.com/argoproj/argo-cd
   - https://github.com/argoproj/argo-helm/tree/main/charts/argo-cd

clusters/cl01tl/helm/argocd/templates/external-secret.yaml

@@ -14,11 +14,17 @@ spec:
   data:
     - secretKey: secret
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /authentik/oidc/argocd
+        metadataPolicy: None
         property: secret
     - secretKey: client
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /authentik/oidc/argocd
+        metadataPolicy: None
         property: client
 
 ---
@@ -38,7 +44,10 @@ spec:
   data:
     - secretKey: ntfy-token
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /ntfy/user/cl01tl
+        metadataPolicy: None
         property: token
 
 ---
@@ -58,13 +67,22 @@ spec:
   data:
     - secretKey: type
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/argocd/credentials/repo/infrastructure
+        metadataPolicy: None
         property: type
     - secretKey: url
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/argocd/credentials/repo/infrastructure
+        metadataPolicy: None
         property: url
     - secretKey: sshPrivateKey
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/argocd/credentials/repo/infrastructure
+        metadataPolicy: None
         property: sshPrivateKey

clusters/cl01tl/helm/argocd/values.yaml

@@ -1,11 +1,12 @@
 argo-cd:
   crds:
     install: true
-    keep: true
   configs:
     cm:
       admin.enabled: true
       accounts.homepage: apiKey
+      timeout.reconciliation: 100s
+      timeout.reconciliation.jitter: 60s
       url: https://argocd.alexlebens.net
       statusbadge.url: https://argocd.alexlebens.net/
       statusbadge.enabled: true
@@ -32,53 +33,12 @@ argo-cd:
         g, homepage, role:readonly
   controller:
     replicas: 1
-    resources:
-      requests:
-        cpu: 15m
-        memory: 1Gi
-    readinessProbe:
-      failureThreshold: 3
-      initialDelaySeconds: 60
-      periodSeconds: 30
-      successThreshold: 1
-      timeoutSeconds: 5
     metrics:
       enabled: true
       serviceMonitor:
         enabled: true
-      rules:
-        enabled: true
-      spec:
-        - alert: ArgoAppMissing
-          expr: |
-            absent(argocd_app_info) == 1
-          for: 15m
-          labels:
-            severity: critical
-          annotations:
-            summary: "[Argo CD] No reported applications"
-            description: >
-              Argo CD has not reported any applications data for the past 15 minutes which
-              means that it must be down or not functioning properly.  This needs to be
-              resolved for this cloud to continue to maintain state.
-        - alert: ArgoAppNotSynced
-          expr: |
-            argocd_app_info{sync_status!="Synced"} == 1
-          for: 12h
-          labels:
-            severity: warning
-          annotations:
-            summary: "[{{`{{$labels.name}}`}}] Application not synchronized"
-            description: >
-              The application [{{`{{$labels.name}}`}} has not been synchronized for over
-              12 hours which means that the state of this cloud has drifted away from the
-              state inside Git.
   dex:
     enabled: true
-    resources:
-      requests:
-        cpu: 10m
-        memory: 64Mi
     metrics:
       enabled: true
       serviceMonitor:
@@ -89,57 +49,13 @@ argo-cd:
       enabled: true
   redis-ha:
     enabled: true
-    image:
-      repository: redis
-      tag: 8.6.1-alpine@sha256:315270d166080f537bbdf1b489b603aaaa213cb55a544acfa51feb7481abb1c0
-    persistentVolume:
-      enabled: true
-    redis:
-      resources:
-        requests:
-          cpu: 1000m
-          memory: 64Mi
-    haproxy:
-      enabled: true
-      image:
-        repository: haproxy
-        tag: 3.3.6-alpine@sha256:744be2dca649a44d490a4c565d36968d19482dd387f1bdd44c168f4322bc6b1e
-      resources:
-        requests:
-          cpu: 10m
-          memory: 128Mi
-      metrics:
-        enabled: true
-        serviceMonitor:
-          enabled: true
-    exporter:
-      enabled: true
-      image: ghcr.io/oliver006/redis_exporter
-      tag: v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
-      serviceMonitor:
-        enabled: true
-    prometheusRule:
-      enabled: true
-      interval: 30s
-      rules:
-        - alert: RedisPodDown
-          expr: |
-            redis_up{job="{{ include "redis-ha.fullname" . }}"} == 0
-          for: 5m
-          labels:
-            severity: critical
-          annotations:
-            description: Redis pod {{ "{{ $labels.pod }}" }} is down
-            summary: Redis pod {{ "{{ $labels.pod }}" }} is down
     auth: false
   redisSecretInit:
     enabled: false
   server:
     replicas: 2
-    resources:
+    extensions:
-     requests:
+      enabled: false
-       cpu: 10m
-       memory: 64Mi
     metrics:
       enabled: true
       serviceMonitor:
@@ -153,55 +69,30 @@ argo-cd:
           namespace: traefik
       hostnames:
         - argocd.alexlebens.net
+      rules:
+        - matches:
+            - path:
+                type: PathPrefix
+                value: /
   repoServer:
     replicas: 2
-    resources:
-      requests:
-        cpu: 10m
-        memory: 64Mi
-    readinessProbe:
-      enabled: true
-      failureThreshold: 3
-      initialDelaySeconds: 60
-      periodSeconds: 30
-      successThreshold: 1
-      timeoutSeconds: 5
-    livenessProbe:
-      enabled: true
-      failureThreshold: 3
-      initialDelaySeconds: 60
-      periodSeconds: 30
-      successThreshold: 1
-      timeoutSeconds: 5
     metrics:
       enabled: true
       serviceMonitor:
         enabled: true
   applicationSet:
     replicas: 2
-    resources:
-      requests:
-        cpu: 10m
-        memory: 64Mi
     metrics:
       enabled: true
       serviceMonitor:
         enabled: true
-    readinessProbe:
-      enabled: true
-      failureThreshold: 3
-      initialDelaySeconds: 60
-      periodSeconds: 30
-      successThreshold: 1
-      timeoutSeconds: 5
     livenessProbe:
       enabled: true
-      failureThreshold: 3
+    readinessProbe:
-      initialDelaySeconds: 60
+      enabled: true
-      periodSeconds: 30
-      successThreshold: 1
-      timeoutSeconds: 5
   notifications:
+    enabled: true
+    context:
       argocdUrl: https://argocd.alexlebens.net
     secret:
       create: false
@@ -216,10 +107,6 @@ argo-cd:
         headers:
           - name: Authorization
             value: Bearer $ntfy-token
-    resources:
-      requests:
-        cpu: 10m
-        memory: 64Mi
     livenessProbe:
       enabled: true
     readinessProbe:

clusters/cl01tl/helm/audiobookshelf/Chart.yaml

@@ -7,14 +7,11 @@ keywords:
   - books
   - podcasts
   - audiobooks
-home: https://docs.alexlebens.dev/applications/audiobookshelf/
+home: https://wiki.alexlebens.dev/s/d4d6719f-cd1c-4b6e-b78e-2d2d7a5097d7
 sources:
   - https://github.com/advplyr/audiobookshelf
-  - https://github.com/caronc/apprise
   - https://github.com/advplyr/audiobookshelf/pkgs/container/audiobookshelf
-  - https://github.com/caronc/apprise-api/pkgs/container/apprise
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/audiobookshelf/templates/external-secret.yaml

@@ -14,5 +14,8 @@ spec:
   data:
     - secretKey: ntfy-url
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/audiobookshelf/apprise
+        metadataPolicy: None
         property: ntfy-url

clusters/cl01tl/helm/audiobookshelf/values.yaml

@@ -4,29 +4,28 @@ audiobookshelf:
       type: deployment
       replicas: 1
       strategy: Recreate
-      pod:
+      revisionHistoryLimit: 3
-        securityContext:
-          fsGroup: 1000
-          fsGroupChangePolicy: OnRootMismatch
       containers:
         main:
           image:
             repository: ghcr.io/advplyr/audiobookshelf
-            tag: 2.33.1@sha256:a4a5841bba093d81e5f4ad1eaedb4da3fda6dbb2528c552349da50ad1f7ae708
+            tag: 2.33.1
+            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: America/Chicago
+              value: US/Central
           resources:
             requests:
               cpu: 10m
-              memory: 200Mi
+              memory: 128Mi
         apprise-api:
           image:
-            repository: ghcr.io/caronc/apprise
+            repository: caronc/apprise
-            tag: v1.3.2@sha256:1aafc2118b6eae5d70d17831d9a8a52adee7104fd6f2bb018e6421664699c903
+            tag: v1.3.2
+            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: America/Chicago
+              value: US/Central
             - name: PGID
               value: "1000"
             - name: PUID
@@ -42,6 +41,10 @@ audiobookshelf:
                 secretKeyRef:
                   name: audiobookshelf-apprise-config
                   key: ntfy-url
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
   service:
     main:
       controller: main
@@ -79,8 +82,11 @@ audiobookshelf:
         - audiobookshelf.alexlebens.net
       rules:
         - backendRefs:
-            - name: audiobookshelf
+            - group: ''
+              kind: Service
+              name: audiobookshelf
               port: 80
+              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -91,6 +97,7 @@ audiobookshelf:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 2Gi
+      retain: true
       advancedMounts:
         main:
           main:
@@ -101,6 +108,7 @@ audiobookshelf:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 10Gi
+      retain: true
       advancedMounts:
         main:
           main:

clusters/cl01tl/helm/authentik/Chart.yaml

@@ -6,14 +6,17 @@ keywords:
   - authentik
   - sso
   - oidc
+  - ldap
+  - idp
   - authentication
-home: https://docs.alexlebens.dev/applications/authentik/
+home: https://wiki.alexlebens.dev/s/45ca5171-581f-41d2-b6fb-2b0915029a2d
 sources:
   - https://github.com/goauthentik/authentik
+  - https://github.com/cloudflare/cloudflared
+  - https://github.com/cloudnative-pg/cloudnative-pg
   - https://github.com/goauthentik/helm
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/authentik/templates/external-secret.yaml

@@ -14,5 +14,8 @@ spec:
   data:
     - secretKey: key
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/authentik/key
+        metadataPolicy: None
         property: key

clusters/cl01tl/helm/authentik/values.yaml

@@ -30,23 +30,8 @@ authentik:
     redis:
       host: authentik-valkey
   server:
-    replicas: 2
+    name: server
-    resources:
+    replicas: 1
-      requests:
-        cpu: 100m
-        memory: 700Mi
-    livenessProbe:
-      failureThreshold: 3
-      initialDelaySeconds: 15
-      periodSeconds: 10
-      successThreshold: 1
-      timeoutSeconds: 5
-    readinessProbe:
-      failureThreshold: 3
-      initialDelaySeconds: 15
-      periodSeconds: 10
-      successThreshold: 1
-      timeoutSeconds: 5
     metrics:
       enabled: true
       serviceMonitor:
@@ -54,6 +39,8 @@ authentik:
     route:
       main:
         enabled: true
+        apiVersion: gateway.networking.k8s.io/v1
+        kind: HTTPRoute
         hostnames:
           - authentik.alexlebens.net
         parentRefs:
@@ -61,20 +48,21 @@ authentik:
             kind: Gateway
             name: traefik-gateway
             namespace: traefik
+        httpsRedirect: false
+        matches:
+          - path:
+              type: PathPrefix
+              value: /
   worker:
     name: worker
-    replicas: 2
+    replicas: 1
-    resources:
-      requests:
-        cpu: 100m
-        memory: 512Mi
-    metrics:
-      enabled: true
-      serviceMonitor:
-        enabled: true
   prometheus:
     rules:
       enabled: true
+  postgresql:
+    enabled: false
+  redis:
+    enabled: false
 postgres-18-cluster:
   mode: recovery
   recovery:
@@ -88,9 +76,32 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
+      # - name: garage-remote
+      #   index: 1
+      #   destinationBucket: postgres-backups
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   retentionPolicy: "90d"
+      #   data:
+      #     compression: bzip2
+      # - name: external
+      #   index: 1
+      #   endpointURL: https://nyc3.digitaloceanspaces.com
+      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 5 14 * * *"
         backupName: garage-local
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 4 * * SAT"
+      #   backupName: garage-remote
+      # - name: daily-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external

clusters/cl01tl/helm/backrest/Chart.yaml

@@ -5,12 +5,11 @@ description: backrest
 keywords:
   - backrest
   - backup
-home: https://docs.alexlebens.dev/applications/backrest/
+home: https://wiki.alexlebens.dev/
 sources:
   - https://github.com/garethgeorge/backrest
-  - https://github.com/garethgeorge/backrest/pkgs/container/backrest
+  - https://hub.docker.com/r/garethgeorge/backrest
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/backrest/values.yaml

@@ -7,8 +7,9 @@ backrest:
       containers:
         main:
           image:
-            repository: ghcr.io/garethgeorge/backrest
+            repository: garethgeorge/backrest
-            tag: v1.12.1@sha256:f4d34bd6fa985d13bdb6c01c5d8727e07708899afa9567d800808357d77b9fb0
+            tag: v1.12.1
+            pullPolicy: IfNotPresent
           env:
             - name: TZ
               value: America/Chicago
@@ -23,7 +24,7 @@ backrest:
           resources:
             requests:
               cpu: 10m
-              memory: 80Mi
+              memory: 256Mi
   service:
     main:
       controller: main
@@ -32,19 +33,6 @@ backrest:
           port: 80
           targetPort: 9898
           protocol: TCP
-  serviceMonitor:
-    main:
-      selector:
-        matchLabels:
-          app.kubernetes.io/name: backrest
-          app.kubernetes.io/instance: backrest
-      serviceName: '{{ include "bjw-s.common.lib.chart.names.fullname" $ }}'
-      endpoints:
-        - port: http
-          scheme: http
-          path: /metrics
-          interval: 300s
-          scrapeTimeout: 15s
   route:
     main:
       kind: HTTPRoute
@@ -57,8 +45,11 @@ backrest:
         - backrest.alexlebens.net
       rules:
         - backendRefs:
-            - name: backrest
+            - group: ''
+              kind: Service
+              name: backrest
               port: 80
+              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -69,6 +60,7 @@ backrest:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 10Gi
+      retain: true
       advancedMounts:
         main:
           main:
@@ -79,6 +71,7 @@ backrest:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 1Gi
+      retain: true
       advancedMounts:
         main:
           main:

clusters/cl01tl/helm/bazarr/Chart.yaml

@@ -4,14 +4,14 @@ version: 1.0.0
 description: Bazarr
 keywords:
   - bazarr
+  - servarr
   - subtitles
-home: https://docs.alexlebens.dev/applications/bazarr/
+home: https://wiki.alexlebens.dev/s/
 sources:
   - https://github.com/morpheus65535/bazarr
   - https://github.com/linuxserver/docker-bazarr
   - https://github.com/linuxserver/docker-bazarr/pkgs/container/bazarr
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/bazarr/values.yaml

@@ -4,6 +4,7 @@ bazarr:
       type: deployment
       replicas: 1
       strategy: Recreate
+      revisionHistoryLimit: 3
       pod:
         securityContext:
           runAsUser: 1000
@@ -15,9 +16,10 @@ bazarr:
           image:
             repository: ghcr.io/linuxserver/bazarr
             tag: 1.5.6@sha256:05f9d5b24884f37120453dc1a008a47be244eebec32099ae1bd29032e75b67aa
+            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: America/Chicago
+              value: US/Central
             - name: PUID
               value: 1000
             - name: PGID
@@ -46,8 +48,11 @@ bazarr:
         - bazarr.alexlebens.net
       rules:
         - backendRefs:
-            - name: bazarr
+            - group: ''
+              kind: Service
+              name: bazarr
               port: 80
+              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -58,6 +63,7 @@ bazarr:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 5Gi
+      retain: true
       advancedMounts:
         main:
           main:

clusters/cl01tl/helm/blocky/Chart.yaml

@@ -5,12 +5,11 @@ description: Blocky
 keywords:
   - blocky
   - dns
-home: https://docs.alexlebens.dev/applications/blocky/
+home: https://wiki.alexlebens.dev/s/cf70113d-20bc-48ad-afb8-1e22ed3fd62a
 sources:
   - https://github.com/0xERR0R/blocky
-  - https://github.com/0xERR0R/blocky/pkgs/container/blocky
+  - https://hub.docker.com/r/spx01/blocky
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/blocky/values.yaml

@@ -4,18 +4,20 @@ blocky:
       type: deployment
       replicas: 3
       strategy: RollingUpdate
+      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: ghcr.io/0xerr0r/blocky
             tag: v0.29.0@sha256:a6d99f323d3036a99a3767a52ad612f4d8f3f31167492bfc14d4ea57b24cdfd0
+            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: America/Chicago
+              value: US/Central
           resources:
             requests:
               cpu: 10m
-              memory: 90Mi
+              memory: 128Mi
   configMaps:
     config:
       enabled: true
@@ -96,7 +98,7 @@ blocky:
 
               traefik-cl01tl                  IN      A       10.232.1.21
               blocky                          IN      A       10.232.1.22
-              plex-lb                         IN      A       10.232.1.23
+              cilium-cl01tl                   IN      A       10.232.1.23
 
 
               ;; Application Names
@@ -108,19 +110,18 @@ blocky:
               authentik                       IN      CNAME   traefik-cl01tl
               backrest                        IN      CNAME   traefik-cl01tl
               bazarr                          IN      CNAME   traefik-cl01tl
+              booklore                        IN      CNAME   traefik-cl01tl
               ceph                            IN      CNAME   traefik-cl01tl
               code-server                     IN      CNAME   traefik-cl01tl
               dawarich                        IN      CNAME   traefik-cl01tl
               directus                        IN      CNAME   traefik-cl01tl
               excalidraw                      IN      CNAME   traefik-cl01tl
               feishin                         IN      CNAME   traefik-cl01tl
-              foldergram                      IN      CNAME   traefik-cl01tl
               garage-s3                       IN      CNAME   traefik-cl01tl
               garage-webui                    IN      CNAME   traefik-cl01tl
               gatus                           IN      CNAME   traefik-cl01tl
               gitea                           IN      CNAME   traefik-cl01tl
               grafana                         IN      CNAME   traefik-cl01tl
-              grimmory                        IN      CNAME   traefik-cl01tl
               harbor                          IN      CNAME   traefik-cl01tl
               headlamp                        IN      CNAME   traefik-cl01tl
               home                            IN      CNAME   traefik-cl01tl

clusters/cl01tl/helm/booklore/Chart.lock

@@ -8,5 +8,8 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:6ee403da03c1bcc0289a9abdef0508344072d51173da996eda69b8305d5feefa
+- name: volsync-target
-generated: "2026-03-23T20:35:19.743257-05:00"
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.8.0
+digest: sha256:e65fa008c652092da5431e9780eb2a87c944298a12e58e432efad61c9e826da5
+generated: "2026-03-14T23:57:22.721295098Z"

clusters/cl01tl/helm/booklore/Chart.yaml

@@ -1,22 +1,23 @@
 apiVersion: v2
-name: grimmory
+name: booklore
 version: 1.0.0
-description: Grimmory
+description: booklore
 keywords:
+  - booklore
   - grimmory
   - books
-home: https://docs.alexlebens.dev/applications/grimmory/
+home: https://wiki.alexlebens.dev/
 sources:
+  - https://github.com/booklore-app/BookLore
   - https://github.com/grimmory-tools/grimmory
+  - https://github.com/booklore-app/booklore/pkgs/container/booklore
   - https://github.com/grimmory-tools/grimmory/pkgs/container/grimmory
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/mariadb-operator/mariadb-operator/tree/main/deploy/charts/mariadb-cluster
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:
   - name: app-template
-    alias: grimmory
+    alias: booklore
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
   - name: mariadb-cluster
@@ -26,6 +27,10 @@ dependencies:
     alias: volsync-target-config
     version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
-icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grimmory.png
+  - name: volsync-target
+    alias: volsync-target-data
+    version: 0.8.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/booklore.png
 # renovate: datasource=github-releases depName=grimmory-tools/grimmory
 appVersion: v2.3.0

clusters/cl01tl/helm/booklore/templates/external-secret.yaml

@@ -1,10 +1,10 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: grimmory-database-secret
+  name: booklore-database-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: grimmory-database-secret
+    app.kubernetes.io/name: booklore-database-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -14,17 +14,20 @@ spec:
   data:
     - secretKey: password
       remoteRef:
-        key: /cl01tl/grimmory/database
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/booklore/database
+        metadataPolicy: None
         property: password
 
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: grimmory-data-replication-secret
+  name: booklore-data-replication-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: grimmory-data-replication-secret
+    app.kubernetes.io/name: booklore-data-replication-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -34,17 +37,20 @@ spec:
   data:
     - secretKey: psk.txt
       remoteRef:
-        key: /cl01tl/grimmory/replication
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/booklore/replication
+        metadataPolicy: None
         property: psk.txt
 
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: grimmory-mariadb-cluster-backup-secret-external
+  name: booklore-mariadb-cluster-backup-secret-external
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: grimmory-mariadb-cluster-backup-secret-external
+    app.kubernetes.io/name: booklore-mariadb-cluster-backup-secret-external
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -54,21 +60,27 @@ spec:
   data:
     - secretKey: access
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /digital-ocean/home-infra/mariadb-backups
+        metadataPolicy: None
         property: access
     - secretKey: secret
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /digital-ocean/home-infra/mariadb-backups
+        metadataPolicy: None
         property: secret
 
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: grimmory-mariadb-cluster-backup-secret-garage
+  name: booklore-mariadb-cluster-backup-secret-garage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: grimmory-mariadb-cluster-backup-secret-garage
+    app.kubernetes.io/name: booklore-mariadb-cluster-backup-secret-garage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -78,9 +90,15 @@ spec:
   data:
     - secretKey: access
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /garage/home-infra/mariadb-backups
+        metadataPolicy: None
         property: access
     - secretKey: secret
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /garage/home-infra/mariadb-backups
+        metadataPolicy: None
         property: secret

clusters/cl01tl/helm/booklore/templates/namespace.yaml

@@ -1,11 +1,11 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: grimmory
+  name: booklore
   annotations:
     volsync.backube/privileged-movers: "true"
   labels:
-    app.kubernetes.io/name: grimmory
+    app.kubernetes.io/name: booklore
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
     pod-security.kubernetes.io/audit: privileged

clusters/cl01tl/helm/booklore/templates/persistent-volume-claim.yaml

@@ -1,14 +1,14 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: grimmory-books-nfs-storage
+  name: booklore-books-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: grimmory-books-nfs-storage
+    app.kubernetes.io/name: booklore-books-nfs-storage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
-  volumeName: grimmory-books-nfs-storage
+  volumeName: booklore-books-nfs-storage
   storageClassName: nfs-client
   accessModes:
     - ReadWriteMany
@@ -20,14 +20,14 @@ spec:
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: grimmory-books-import-nfs-storage
+  name: booklore-books-import-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: grimmory-books-import-nfs-storage
+    app.kubernetes.io/name: booklore-books-import-nfs-storage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
-  volumeName: grimmory-books-import-nfs-storage
+  volumeName: booklore-books-import-nfs-storage
   storageClassName: nfs-client
   accessModes:
     - ReadWriteMany

clusters/cl01tl/helm/booklore/templates/persistent-volume.yaml

@@ -1,10 +1,10 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: grimmory-books-nfs-storage
+  name: booklore-books-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: grimmory-books-nfs-storage
+    app.kubernetes.io/name: booklore-books-nfs-storage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -26,10 +26,10 @@ spec:
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: grimmory-books-import-nfs-storage
+  name: booklore-books-import-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: grimmory-books-import-nfs-storage
+    app.kubernetes.io/name: booklore-books-import-nfs-storage
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:

clusters/cl01tl/helm/booklore/values.yaml

@@ -1,18 +1,16 @@
-grimmory:
+booklore:
   controllers:
     main:
       type: deployment
       replicas: 1
       strategy: Recreate
-      pod:
+      revisionHistoryLimit: 3
-        securityContext:
-          fsGroup: 1000
-          fsGroupChangePolicy: OnRootMismatch
       containers:
         main:
           image:
             repository: ghcr.io/grimmory-tools/grimmory
-            tag: v2.3.0@sha256:9014247f591074529894f81115ca40f899db697e89f72c2fe91ec530e3f19597
+            tag: v2.3.0
+            pullPolicy: IfNotPresent
           env:
             - name: TZ
               value: America/Chicago
@@ -21,22 +19,22 @@ grimmory:
             - name: GROUP_ID
               value: 1000
             - name: DATABASE_URL
-              value: jdbc:mariadb://grimmory-mariadb-cluster-primary.grimmory:3306/booklore
+              value: jdbc:mariadb://booklore-mariadb-cluster-primary.booklore:3306/booklore
             - name: DATABASE_USERNAME
-              value: grimmory
+              value: booklore
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: grimmory-database-secret
+                  name: booklore-database-secret
                   key: password
-            - name: GRIMMORY_PORT
+            - name: BOOKLORE_PORT
               value: 6060
             - name: SWAGGER_ENABLED
               value: false
           resources:
             requests:
-              cpu: 10m
+              cpu: 50m
-              memory: 1Gi
+              memory: 128Mi
   service:
     main:
       controller: main
@@ -54,26 +52,41 @@ grimmory:
           name: traefik-gateway
           namespace: traefik
       hostnames:
-        - grimmory.alexlebens.net
+        - booklore.alexlebens.net
       rules:
         - backendRefs:
-            - name: grimmory
+            - group: ''
+              kind: Service
+              name: booklore
               port: 80
+              weight: 100
           matches:
             - path:
                 type: PathPrefix
                 value: /
   persistence:
     config:
-      forceRename: grimmory-config
+      forceRename: booklore-config
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 5Gi
+      retain: true
       advancedMounts:
         main:
           main:
             - path: /app/data
               readOnly: false
+    data:
+      forceRename: booklore-data
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      retain: true
+      advancedMounts:
+        main:
+          main:
+            - path: /data
+              readOnly: false
     books-import:
       type: emptyDir
       advancedMounts:
@@ -81,15 +94,8 @@ grimmory:
           main:
             - path: /bookdrop
               readOnly: false
-    data:
-      existingClaim: grimmory-books-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /data
-              readOnly: false
     ingest:
-      existingClaim: grimmory-books-import-nfs-storage
+      existingClaim: booklore-books-import-nfs-storage
       advancedMounts:
         main:
           main:
@@ -99,7 +105,7 @@ mariadb-cluster:
   mariadb:
     rootPasswordSecretKeyRef:
       generate: false
-      name: grimmory-database-secret
+      name: booklore-database-secret
       key: password
     storage:
       size: 5Gi
@@ -109,14 +115,14 @@ mariadb-cluster:
     bootstrapFrom:
       s3:
         bucket: mariadb-backups-b230a2f5aecf080a4b372c08
-        prefix: cl01tl/grimmory
+        prefix: cl01tl/booklore
         endpoint: nyc3.digitaloceanspaces.com
         region: us-east-1
         accessKeyIdSecretKeyRef:
-          name: grimmory-mariadb-cluster-backup-secret-external
+          name: booklore-mariadb-cluster-backup-secret-external
           key: access
         secretAccessKeySecretKeyRef:
-          name: grimmory-mariadb-cluster-backup-secret-external
+          name: booklore-mariadb-cluster-backup-secret-external
           key: secret
         tls:
           enabled: true
@@ -128,22 +134,21 @@ mariadb-cluster:
       cleanupPolicy: Delete
       requeueInterval: 10h
   users:
-    - name: grimmory
+    - name: booklore
       passwordSecretKeyRef:
-        name: grimmory-database-secret
+        name: booklore-database-secret
         key: password
       host: '%'
-      maxUserConnections: 100
       cleanupPolicy: Delete
       requeueInterval: 10h
       retryInterval: 30s
   grants:
-    - name: grimmory
+    - name: booklore
       privileges:
         - "ALL PRIVILEGES"
       database: "booklore"
       table: "*"
-      username: grimmory
+      username: booklore
       grantOption: true
       host: '%'
       cleanupPolicy: Delete
@@ -161,14 +166,14 @@ mariadb-cluster:
       storage:
         s3:
           bucket: mariadb-backups-b230a2f5aecf080a4b372c08
-          prefix: cl01tl/grimmory
+          prefix: cl01tl/booklore
           endpoint: nyc3.digitaloceanspaces.com
           region: us-east-1
           accessKeyIdSecretKeyRef:
-            name: grimmory-mariadb-cluster-backup-secret-external
+            name: booklore-mariadb-cluster-backup-secret-external
             key: access
           secretAccessKeySecretKeyRef:
-            name: grimmory-mariadb-cluster-backup-secret-external
+            name: booklore-mariadb-cluster-backup-secret-external
             key: secret
           tls:
             enabled: true
@@ -183,14 +188,14 @@ mariadb-cluster:
       storage:
         s3:
           bucket: mariadb-backups
-          prefix: cl01tl/grimmory
+          prefix: cl01tl/booklore
           endpoint: garage-ps10rp.boreal-beaufort.ts.net:3900
           region: us-east-1
           accessKeyIdSecretKeyRef:
-            name: grimmory-mariadb-cluster-backup-secret-garage
+            name: booklore-mariadb-cluster-backup-secret-garage
             key: access
           secretAccessKeySecretKeyRef:
-            name: grimmory-mariadb-cluster-backup-secret-garage
+            name: booklore-mariadb-cluster-backup-secret-garage
             key: secret
           tls:
             enabled: true
@@ -205,20 +210,17 @@ mariadb-cluster:
       storage:
         s3:
           bucket: mariadb-backups
-          prefix: cl01tl/grimmory
+          prefix: cl01tl/booklore
           endpoint: garage-main.garage:3900
           region: us-east-1
           accessKeyIdSecretKeyRef:
-            name: grimmory-mariadb-cluster-backup-secret-garage
+            name: booklore-mariadb-cluster-backup-secret-garage
             key: access
           secretAccessKeySecretKeyRef:
-            name: grimmory-mariadb-cluster-backup-secret-garage
+            name: booklore-mariadb-cluster-backup-secret-garage
             key: secret
 volsync-target-config:
-  pvcTarget: grimmory-config
+  pvcTarget: booklore-config
-  moverSecurityContext:
-    fsGroup: 1000
-    fsGroupChangePolicy: OnRootMismatch
   local:
     enabled: true
     schedule: 12 8 * * *
@@ -228,3 +230,20 @@ volsync-target-config:
   external:
     enabled: true
     schedule: 12 10 * * *
+volsync-target-data:
+  pvcTarget: booklore-data
+  local:
+    enabled: true
+    schedule: 14 8 * * *
+    restic:
+      cacheCapacity: 10Gi
+  remote:
+    enabled: true
+    schedule: 14 9 * * *
+    restic:
+      cacheCapacity: 10Gi
+  external:
+    enabled: true
+    schedule: 14 10 * * *
+    restic:
+      cacheCapacity: 10Gi

clusters/cl01tl/helm/cilium/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: cilium
   repository: https://helm.cilium.io/
-  version: 1.19.2
+  version: 1.18.6
-digest: sha256:11f8eef4733b70c2b9a91ce39fe3c1ea1ad3fa3c46750efb015e03ff6ea3655b
+digest: sha256:8ea328ac238524b5b423e6289f5e25d05ef64e6aa19cfd5de238f1d5dd533e9b
-generated: "2026-03-24T03:46:51.217460551Z"
+generated: "2026-02-05T12:00:20.15778-06:00"

clusters/cl01tl/helm/cilium/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: cilium
-    version: 1.19.2
+    version: 1.18.6
     repository: https://helm.cilium.io/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/cilium.png
 # renovate: datasource=github-releases depName=cilium/cilium

clusters/cl01tl/helm/dawarich/Chart.yaml

@@ -26,4 +26,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/dawarich.png
 # renovate: datasource=github-releases depName=Freika/dawarich
-appVersion: 1.4.0
+appVersion: 1.3.4

clusters/cl01tl/helm/dawarich/values.yaml

@@ -9,7 +9,7 @@ dawarich:
         main:
           image:
             repository: freikin/dawarich
-            tag: 1.4.0
+            tag: 1.3.4
             pullPolicy: IfNotPresent
           command: ["web-entrypoint.sh"]
           args: ["bin/rails", "server", "-p", "3000", "-b", "::"]
@@ -106,7 +106,7 @@ dawarich:
         sidekiq:
           image:
             repository: freikin/dawarich
-            tag: 1.4.0
+            tag: 1.3.4
             pullPolicy: IfNotPresent
           command: ["sidekiq-entrypoint.sh"]
           args: ["sidekiq"]

clusters/cl01tl/helm/foldergram/Chart.lock

@@ -1,9 +0,0 @@
-dependencies:
-- name: app-template
-  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
-- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-digest: sha256:59100c6fbfb829f9d703b9ee1cf869c4fd77b6ff53c63b0c644a757223027e58
-generated: "2026-03-22T12:42:43.150705-05:00"

clusters/cl01tl/helm/foldergram/Chart.yaml

@@ -1,25 +0,0 @@
-apiVersion: v2
-name: foldergram
-version: 1.0.0
-description: Foldergram
-keywords:
-  - foldergram
-  - pictures
-home: https://wiki.alexlebens.dev/
-sources:
-  - https://github.com/foldergram/foldergram
-  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: foldergram
-    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.6.2
-  - name: volsync-target
-    alias: volsync-target-data
-    version: 0.8.0
-    repository: oci://harbor.alexlebens.net/helm-charts
-icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
-# renovate: datasource=github-releases depName=foldergram/foldergram
-appVersion: v1.0.5

clusters/cl01tl/helm/foldergram/templates/persistent-volume-claim.yaml

@@ -1,17 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: foldergram-pictures-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: foldergram-pictures-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: foldergram-pictures-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/helm/foldergram/templates/persistent-volume.yaml

@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: foldergram-pictures-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: foldergram-pictures-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage/Pictures
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/helm/foldergram/values.yaml

@@ -1,87 +0,0 @@
-foldergram:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: ghcr.io/foldergram/foldergram
-            tag: 1.0.5
-            pullPolicy: IfNotPresent
-          env:
-            - name: IMAGE_DETAIL_SOURCE
-              value: original
-            - name: DERIVATIVE_MODE
-              value: lazy
-            - name: DATA_ROOT
-              value: ./data
-            - name: GALLERY_ROOT
-              value: /gallery
-            - name: CSRF_TRUSTED_ORIGINS
-              value: https://foldergram.alexlebens.net
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 4141
-          protocol: HTTP
-  route:
-    main:
-      kind: HTTPRoute
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: traefik-gateway
-          namespace: traefik
-      hostnames:
-        - foldergram.alexlebens.net
-      rules:
-        - backendRefs:
-            - group: ''
-              kind: Service
-              name: foldergram
-              port: 80
-              weight: 100
-          matches:
-            - path:
-                type: PathPrefix
-                value: /
-  persistence:
-    cache:
-      forceRename: foldergram-data
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 10Gi
-      retain: false
-      advancedMounts:
-        main:
-          main:
-            - path: /app/data
-              readOnly: false
-    pictures:
-      existingClaim: foldergram-pictures-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /gallery/pictures
-              readOnly: true
-volsync-target-data:
-  pvcTarget: foldergram-data
-  local:
-    enabled: true
-    schedule: 46 11 * * *
-  remote:
-    enabled: true
-    schedule: 46 12 * * *
-  external:
-    enabled: true
-    schedule: 46 13 * * *

clusters/cl01tl/helm/gatus/values.yaml

@@ -161,11 +161,8 @@ gatus:
       - name: photoview
         url: https://photoview.alexlebens.net
         <<: *defaults
-      - name: foldergram
+      - name: booklore
-        url: https://foldergram.alexlebens.net
+        url: https://booklore.alexlebens.net
-        <<: *defaults
-      - name: grimmory
-        url: https://grimmory.alexlebens.net
         <<: *defaults
       - name: directus
         url: https://directus.alexlebens.net

clusters/cl01tl/helm/generic-device-plugin/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: generic-device-plugin
   repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-  version: 0.20.25
+  version: 0.20.24
-digest: sha256:04f987ed54b51b4401ab056b4627cfce7d1fe660bb496a459e975f4dcc8ff466
+digest: sha256:36bf651c24198d299458046aaf449e9fb50942e1143389092a746357d402b731
-generated: "2026-03-24T00:12:00.102697457Z"
+generated: "2026-03-20T01:18:36.687250976Z"

clusters/cl01tl/helm/generic-device-plugin/Chart.yaml

@@ -15,6 +15,6 @@ maintainers:
 dependencies:
   - name: generic-device-plugin
     repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-    version: 0.20.25
+    version: 0.20.24
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: 1.0.0

clusters/cl01tl/helm/headlamp/Chart.yaml

@@ -18,4 +18,4 @@ dependencies:
     repository: https://kubernetes-sigs.github.io/headlamp/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/headlamp.png
 # renovate: datasource=github-releases depName=headlamp-k8s/headlamp
-appVersion: v0.41.0
+appVersion: v0.40.1

clusters/cl01tl/helm/homepage/values.yaml

@@ -202,17 +202,11 @@ homepage:
                   href: https://photoview.alexlebens.net
                   siteMonitor: http://photoview.photoview:80
                   statusStyle: dot
-              - Pictures:
-                  icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
-                  description: Foldergram
-                  href: https://foldergram.alexlebens.net
-                  siteMonitor: http://foldergram.foldergram:80
-                  statusStyle: dot
               - Books:
                   icon: sh-booklore.webp
                   description: Grimmory
-                  href: https://grimmory.alexlebens.net
+                  href: https://booklore.alexlebens.net
-                  siteMonitor: http://grimmory.grimmory:80
+                  siteMonitor: http://booklore.booklore:80
                   statusStyle: dot
           - Public:
               - Site:

clusters/cl01tl/helm/houndarr/Chart.lock

@@ -1,9 +0,0 @@
-dependencies:
-- name: app-template
-  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
-- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-digest: sha256:375d6c2eb2f097717c44c5a28cb162da24f4ff154a971e5a68ccd0e0b77e936f
-generated: "2026-03-21T22:31:01.142752-05:00"

clusters/cl01tl/helm/houndarr/Chart.yaml

@@ -22,4 +22,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/av1155/houndarr/main/src/houndarr/static/img/houndarr-logo-dark.png
 # renovate: datasource=github-releases depName=av1155/houndarr
-appVersion: v1.6.2
+appVersion: v1.6.0

clusters/cl01tl/helm/houndarr/values.yaml

@@ -14,10 +14,6 @@ houndarr:
           env:
             - name: TZ
               value: America/Chicago
-            - name: PUID
-              value: 1000
-            - name: PGID
-              value: 1000
             - name: HOUNDARR_SECURE_COOKIES
               value: true
             - name: HOUNDARR_TRUSTED_PROXIES
@@ -68,11 +64,6 @@ houndarr:
               readOnly: false
 volsync-target-data:
   pvcTarget: houndarr-data
-  moverSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: OnRootMismatch
   local:
     enabled: true
     schedule: 40 11 * * *

clusters/cl01tl/helm/movie-roulette/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     version: 4.6.2
 icon: https://raw.githubusercontent.com/sahara101/Movie-Roulette/refs/heads/main/static/icons/icon.png
 # renovate: datasource=github-releases depName=sahara101/Movie-Roulette
-appVersion: v5.3.0
+appVersion: v5.2.1

clusters/cl01tl/helm/movie-roulette/values.yaml

@@ -9,7 +9,7 @@ movie-roulette:
         main:
           image:
             repository: ghcr.io/sahara101/movie-roulette
-            tag: v5.3.0
+            tag: v5.2.1
             pullPolicy: IfNotPresent
           env:
             - name: FLASK_SECRET_KEY

clusters/cl01tl/helm/music-grabber/values.yaml

@@ -9,7 +9,7 @@ music-grabber:
         main:
           image:
             repository: g33kphr33k/musicgrabber
-            tag: 2.5.1
+            tag: 2.5.0
             pullPolicy: IfNotPresent
           env:
             - name: MUSIC_DIR

clusters/cl01tl/helm/plex/values.yaml

@@ -26,7 +26,6 @@ plex:
   service:
     main:
       controller: main
-      type: LoadBalancer
       ports:
         http:
           port: 32400

clusters/cl01tl/helm/qbittorrent/values.yaml

@@ -184,7 +184,7 @@ qbittorrent:
         apprise-api:
           image:
             repository: caronc/apprise
-            tag: v1.3.3
+            tag: v1.3.2
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/shelfmark/templates/external-secret.yaml

@@ -12,14 +12,14 @@ spec:
     kind: ClusterSecretStore
     name: vault
   data:
-    - secretKey: grimmory-user
+    - secretKey: booklore-user
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
         key: /cl01tl/shelfmark/booklore
         metadataPolicy: None
         property: user
-    - secretKey: grimmory-password
+    - secretKey: booklore-password
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None

clusters/cl01tl/helm/shelfmark/values.yaml

@@ -17,7 +17,7 @@ shelfmark:
             - name: DOCKERMODE
               value: true
             - name: CALIBRE_WEB_URL
-              value: https://grimmory.alexlebens.net
+              value: https://booklore.alexlebens.net
             - name: AUDIOBOOK_LIBRARY_URL
               value: https://audiobookshelf.alexlebens.net
             - name: SEARCH_MODE
@@ -29,17 +29,17 @@ shelfmark:
             - name: BOOKS_OUTPUT_MODE
               value: booklore
             - name: BOOKLORE_HOST
-              value: http://grimmory.grimmory:80
+              value: http://booklore.booklore:80
             - name: BOOKLORE_USERNAME
               valueFrom:
                 secretKeyRef:
                   name: shelfmark-config-secret
-                  key: grimmory-user
+                  key: booklore-user
             - name: BOOKLORE_PASSWORD
               valueFrom:
                 secretKeyRef:
                   name: shelfmark-config-secret
-                  key: grimmory-password
+                  key: booklore-password
             - name: BOOKLORE_DESTINATION
               value: library
             - name: BOOKLORE_LIBRARY_ID

clusters/cl01tl/helm/site-documentation/values.yaml

@@ -11,7 +11,7 @@ site-documentation:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-documentation
-            tag: 0.6.0
+            tag: 0.3.0
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/tdarr/values.yaml

@@ -9,7 +9,7 @@ tdarr:
         main:
           image:
             repository: ghcr.io/haveagitgat/tdarr
-            tag: 2.65.01
+            tag: 2.64.02
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -48,7 +48,7 @@ tdarr:
         main:
           image:
             repository: ghcr.io/haveagitgat/tdarr_node
-            tag: 2.65.01
+            tag: 2.64.02
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/unpoller/Chart.yaml

@@ -21,4 +21,4 @@ dependencies:
     version: 4.6.2
 icon: https://camo.githubusercontent.com/c5d07a5b3acfeac8e1c25bf56f440ffe032b86e4e7f15de82357f022a43fc927/68747470733a2f2f756e706f6c6c65722e636f6d2f696d672f6c6f676f2e706e67
 # renovate: datasource=github-releases depName=unpoller/unpoller
-appVersion: v2.37.0
+appVersion: v2.34.0

clusters/cl01tl/helm/unpoller/values.yaml

@@ -9,7 +9,7 @@ unpoller:
         main:
           image:
             repository: ghcr.io/unpoller/unpoller
-            tag: v2.37.0
+            tag: v2.34.0
             pullPolicy: IfNotPresent
           env:
             - name: UP_UNIFI_CONTROLLER_0_SAVE_ALARMS

clusters/cl01tl/helm/whodb/Chart.yaml

@@ -20,4 +20,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/whodb.png
 # renovate: datasource=github-releases depName=clidey/whodb
-appVersion: 0.101.0
+appVersion: 0.100.0

clusters/cl01tl/helm/whodb/values.yaml

@@ -8,7 +8,7 @@ whodb:
         main:
           image:
             repository: clidey/whodb
-            tag: 0.101.0
+            tag: 0.100.0
             pullPolicy: IfNotPresent
           env:
             - name: WHODB_OLLAMA_HOST

hosts/ps08rp/blocky/config.yml

@@ -73,7 +73,7 @@ customDNS:
 
     traefik-cl01tl                  IN      A       10.232.1.21
     blocky                          IN      A       10.232.1.22
-    plex-lb                         IN      A       10.232.1.23
+    cilium-cl01tl                   IN      A       10.232.1.23
 
 
     ;; Application Names
@@ -85,19 +85,18 @@ customDNS:
     authentik                       IN      CNAME   traefik-cl01tl
     backrest                        IN      CNAME   traefik-cl01tl
     bazarr                          IN      CNAME   traefik-cl01tl
+    booklore                        IN      CNAME   traefik-cl01tl
     ceph                            IN      CNAME   traefik-cl01tl
     code-server                     IN      CNAME   traefik-cl01tl
     dawarich                        IN      CNAME   traefik-cl01tl
     directus                        IN      CNAME   traefik-cl01tl
     excalidraw                      IN      CNAME   traefik-cl01tl
     feishin                         IN      CNAME   traefik-cl01tl
-    foldergram                      IN      CNAME   traefik-cl01tl
     garage-s3                       IN      CNAME   traefik-cl01tl
     garage-webui                    IN      CNAME   traefik-cl01tl
     gatus                           IN      CNAME   traefik-cl01tl
     gitea                           IN      CNAME   traefik-cl01tl
     grafana                         IN      CNAME   traefik-cl01tl
-    grimmory                        IN      CNAME   traefik-cl01tl
     harbor                          IN      CNAME   traefik-cl01tl
     headlamp                        IN      CNAME   traefik-cl01tl
     home                            IN      CNAME   traefik-cl01tl

hosts/ps09rp/blocky/config.yml

@@ -94,7 +94,7 @@ customDNS:
 
     traefik-cl01tl                  IN      A       10.232.1.21
     blocky                          IN      A       10.232.1.22
-    plex-lb                         IN      A       10.232.1.23
+    cilium-cl01tl                   IN      A       10.232.1.23
 
 
     ;; Application Names
@@ -106,19 +106,18 @@ customDNS:
     authentik                       IN      CNAME   traefik-cl01tl
     backrest                        IN      CNAME   traefik-cl01tl
     bazarr                          IN      CNAME   traefik-cl01tl
+    booklore                        IN      CNAME   traefik-cl01tl
     ceph                            IN      CNAME   traefik-cl01tl
     code-server                     IN      CNAME   traefik-cl01tl
     dawarich                        IN      CNAME   traefik-cl01tl
     directus                        IN      CNAME   traefik-cl01tl
     excalidraw                      IN      CNAME   traefik-cl01tl
     feishin                         IN      CNAME   traefik-cl01tl
-    foldergram                      IN      CNAME   traefik-cl01tl
     garage-s3                       IN      CNAME   traefik-cl01tl
     garage-webui                    IN      CNAME   traefik-cl01tl
     gatus                           IN      CNAME   traefik-cl01tl
     gitea                           IN      CNAME   traefik-cl01tl
     grafana                         IN      CNAME   traefik-cl01tl
-    grimmory                        IN      CNAME   traefik-cl01tl
     harbor                          IN      CNAME   traefik-cl01tl
     headlamp                        IN      CNAME   traefik-cl01tl
     home                            IN      CNAME   traefik-cl01tl

renovate.json

@@ -5,7 +5,7 @@
     "mergeConfidence:all-badges",
     ":rebaseStalePrs"
   ],
-  "timezone": "America/Chicago",
+  "timezone": "US/Central",
   "labels": [],
   "prHourlyLimit": 0,
   "prConcurrentLimit": 0,
@@ -22,8 +22,7 @@
       ],
       "matchStrings": [
         "#\\s*renovate:\\s*datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+appVersion:\\s*[\"']?(?<currentValue>[^\"'\\s]+)[\"']?"
-      ],
+      ]
-      "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver-coerced{{/if}}"
     },
     {
       "description": "Update images in templates",
@@ -32,7 +31,7 @@
         "/(^|/)templates/.*\\.yaml$/"
       ],
       "matchStrings": [
-        "# renovate: datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)\\s+tag:\\s*[\"']?(?<currentValue>[^@\"'\\s\n]+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?[\"']?"
+        "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+tag: (?<currentValue>.*)"
       ]
     },
     {
@@ -70,22 +69,6 @@
       ],
       "enabled": false
     },
-    {
-      "description": "Automerge digests for actions",
-      "matchManagers": [
-        "github-actions"
-      ],
-      "matchUpdateTypes": [
-        "digest"
-      ],
-      "addLabels": [
-        "actions",
-        "automerge"
-      ],
-      "enabled": true,
-      "automerge": true,
-      "minimumReleaseAge": "1 days"
-    },
     {
       "description": "Label charts",
       "matchDatasources": [
@@ -127,7 +110,7 @@
       "automergeType": "branch"
     },
     {
-      "description": "Label images",
+      "description": "Label images, docker",
       "matchDatasources": [
         "docker"
       ],
@@ -137,10 +120,9 @@
       "automerge": false
     },
     {
-      "description": "Automerge image patches",
+      "description": "Automerge image patches, docker",
       "matchUpdateTypes": [
-        "patch",
+        "patch"
-        "pinDigest"
       ],
       "matchDatasources": [
         "docker"
@@ -153,26 +135,7 @@
       "minimumReleaseAge": "1 days"
     },
     {
-      "description": "Automerge images, specific packages",
+      "description": "Allow digest updates for specific packages",
-      "matchUpdateTypes": [
-        "patch",
-        "minor"
-      ],
-      "matchDatasources": [
-        "docker"
-      ],
-      "matchPackageNames": [
-        "ghcr.io/renovatebot/renovate"
-      ],
-      "addLabels": [
-        "image",
-        "automerge"
-      ],
-      "automerge": true,
-      "minimumReleaseAge": "1 days"
-    },
-    {
-      "description": "Automerge digest updates, specific packages",
       "matchUpdateTypes": [
         "digest"
       ],
@@ -182,16 +145,12 @@
       "matchPackageNames": [
         "searxng/searxng"
       ],
-      "addLabels": [
-        "image",
-        "automerge"
-      ],
       "enabled": true,
       "automerge": true,
       "minimumReleaseAge": "1 days"
     },
     {
-      "description": "Label appVersion and images, merged",
+      "description": "Label charts and docker, merged",
       "matchManagers": [
         "custom.regex",
         "helm-values"
@@ -204,10 +163,9 @@
       "automerge": false
     },
     {
-      "description": "Automerge appVersion and images, merged",
+      "description": "Automerge charts and docker, merged",
       "matchUpdateTypes": [
-        "patch",
+        "patch"
-        "pinDigest"
       ],
       "matchManagers": [
         "custom.regex",
@@ -221,19 +179,6 @@
       ],
       "automerge": true,
       "minimumReleaseAge": "1 days"
-    },
-    {
-      "description": "Group unmatched Dawarich dependencies",
-      "matchPackageNames": [
-        "freikin/dawarich",
-        "freika/dawarich",
-        "ghcr.io/freikin/dawarich",
-        "ghcr.io/freika/dawarich",
-        "docker.io/freikin/dawarich",
-        "docker.io/freika/dawarich"
-      ],
-      "groupName": "dawarich",
-      "groupSlug": "unified-dawarich"
     }
   ]
 }