Update vaultwarden/server Docker tag to v1.35.0

2025-12-28 21:56:52 +00:00
100 changed files with 498 additions and 413 deletions
--- a/.gitea/workflows/render-manifests-dispatch.yaml
+++ b/.gitea/workflows/render-manifests-dispatch.yaml
@@ -1,9 +1,6 @@
 name: render-manifests-dispatch

 on:
-  schedule:
-    - cron: '0 3 * * *'
-
  workflow_dispatch:

 env:
--- a/clusters/cl01tl/helm/actual/values.yaml
+++ b/clusters/cl01tl/helm/actual/values.yaml
@@ -78,7 +78,7 @@ actual:
 volsync-target-data:
  pvcTarget: actual-data
  local:
-    enabled: true
+    enabled: false
    schedule: 0 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/argocd/Chart.lock
+++ b/clusters/cl01tl/helm/argocd/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
  repository: https://argoproj.github.io/argo-helm
-  version: 9.2.3
-digest: sha256:b23d6a5b7b9fee9d1807259bfa2dd53d1f4dfbbeba7ec747c41a6ba991dadbba
-generated: "2025-12-28T21:53:37.447568505Z"
+  version: 9.2.2
+digest: sha256:f2ac58995d33d7240087fe7d7618bfbc24b424b1d65ce0e85b297de0223fcdd1
+generated: "2025-12-27T19:43:02.217321931Z"
--- a/clusters/cl01tl/helm/argocd/Chart.yaml
+++ b/clusters/cl01tl/helm/argocd/Chart.yaml
@@ -15,7 +15,7 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: argo-cd
-    version: 9.2.3
+    version: 9.2.2
    repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: github=argoproj/argo-cd
--- a/clusters/cl01tl/helm/audiobookshelf/values.yaml
+++ b/clusters/cl01tl/helm/audiobookshelf/values.yaml
@@ -124,7 +124,7 @@ audiobookshelf:
 volsync-target-config:
  pvcTarget: audiobookshelf-config
  local:
-    enabled: true
+    enabled: false
    schedule: 2 8 * * *
  remote:
    enabled: false
@@ -134,7 +134,7 @@ volsync-target-config:
 volsync-target-metadata:
  pvcTarget: audiobookshelf-metadata
  local:
-    enabled: true
+    enabled: false
    schedule: 4 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/authentik/values.yaml
+++ b/clusters/cl01tl/helm/authentik/values.yaml
@@ -109,7 +109,7 @@ redis-replication:
  existingSecret:
    enabled: false
  redisReplication:
-    clusterSize: 3
+    clusterSize: 1
  redisSentinel:
-    enabled: true
+    enabled: false
    clusterSize: 3
--- a/clusters/cl01tl/helm/backrest/values.yaml
+++ b/clusters/cl01tl/helm/backrest/values.yaml
@@ -108,7 +108,7 @@ backrest:
 volsync-target-data:
  pvcTarget: backrest-data
  local:
-    enabled: true
+    enabled: false
    schedule: 6 8 * * *
  remote:
    enabled: false
@@ -118,7 +118,7 @@ volsync-target-data:
 volsync-target-config:
  pvcTarget: backrest-config
  local:
-    enabled: true
+    enabled: false
    schedule: 8 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/bazarr/values.yaml
+++ b/clusters/cl01tl/helm/bazarr/values.yaml
@@ -84,7 +84,7 @@ volsync-target-config:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  local:
-    enabled: true
+    enabled: false
    schedule: 10 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/blocky/values.yaml
+++ b/clusters/cl01tl/helm/blocky/values.yaml
@@ -159,6 +159,7 @@ blocky:
              sonarr                          IN      CNAME   traefik-cl01tl
              sonarr-4k                       IN      CNAME   traefik-cl01tl
              sonarr-anime                    IN      CNAME   traefik-cl01tl
+              soulsync                        IN      CNAME   traefik-cl01tl
              stalwart                        IN      CNAME   traefik-cl01tl
              tautulli                        IN      CNAME   traefik-cl01tl
              tdarr                           IN      CNAME   traefik-cl01tl
--- a/clusters/cl01tl/helm/booklore/values.yaml
+++ b/clusters/cl01tl/helm/booklore/values.yaml
@@ -9,7 +9,7 @@ booklore:
        main:
          image:
            repository: ghcr.io/booklore-app/booklore
-            tag: v1.16.2
+            tag: v1.15.0
            pullPolicy: IfNotPresent
          env:
            - name: TZ
@@ -218,7 +218,7 @@ mariadb-cluster:
 volsync-target-config:
  pvcTarget: booklore-config
  local:
-    enabled: true
+    enabled: false
    schedule: 12 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/cilium/templates/cilium-l2-announcement-policy.yaml
+++ b/clusters/cl01tl/helm/cilium/templates/cilium-l2-announcement-policy.yaml
@@ -1,19 +1,19 @@
-# apiVersion: "cilium.io/v2alpha1"
-# kind: CiliumL2AnnouncementPolicy
-# metadata:
-#   name: general-l2-policy
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: general-l2-policy
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   nodeSelector:
-#     matchExpressions:
-#       - key: kubernetes.io/hostname
-#         operator: Exists
-#   interfaces:
-#     - end0
-#     - enp6s0
-#   externalIPs: true
-#   loadBalancerIPs: true
+apiVersion: "cilium.io/v2alpha1"
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: general-l2-policy
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: general-l2-policy
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  nodeSelector:
+    matchExpressions:
+      - key: kubernetes.io/hostname
+        operator: Exists
+  interfaces:
+    - end0
+    - enp6s0
+  externalIPs: true
+  loadBalancerIPs: true
--- a/clusters/cl01tl/helm/cilium/values.yaml
+++ b/clusters/cl01tl/helm/cilium/values.yaml
@@ -26,7 +26,7 @@ cilium:
        - SYS_ADMIN
        - SYS_RESOURCE
  l2announcements:
-    enabled: false
+    enabled: true
  bgpControlPlane:
    enabled: false
    secretsNamespace:
--- a/clusters/cl01tl/helm/cloudnative-pg/Chart.lock
+++ b/clusters/cl01tl/helm/cloudnative-pg/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 0.27.0
 - name: plugin-barman-cloud
  repository: https://cloudnative-pg.io/charts/
-  version: 0.4.0
-digest: sha256:5e2a32fa5ed8b180ae5e556d65c67eeb3dcf38e2974b0d668eff4ee3c83258ce
-generated: "2025-12-30T21:01:48.755246408Z"
+  version: 0.3.1
+digest: sha256:14aa30b7bf75571b03bda19af68cd50c1e7908b883351b196a260609a5b85551
+generated: "2025-12-10T19:25:17.952954019Z"
--- a/clusters/cl01tl/helm/cloudnative-pg/Chart.yaml
+++ b/clusters/cl01tl/helm/cloudnative-pg/Chart.yaml
@@ -19,7 +19,7 @@ dependencies:
    version: 0.27.0
    repository: https://cloudnative-pg.io/charts/
  - name: plugin-barman-cloud
-    version: 0.4.0
+    version: 0.3.1
    repository: https://cloudnative-pg.io/charts/
 icon: https://avatars.githubusercontent.com/u/100373852?s=200&v=4
 # renovate: github=cloudnative-pg/cloudnative-pg
--- a/clusters/cl01tl/helm/cloudnative-pg/values.yaml
+++ b/clusters/cl01tl/helm/cloudnative-pg/values.yaml
@@ -7,10 +7,10 @@ plugin-barman-cloud:
  image:
    registry: ghcr.io
    repository: cloudnative-pg/plugin-barman-cloud
-    tag: v0.10.0
+    tag: v0.9.0
  sidecarImage:
    registry: ghcr.io
    repository: cloudnative-pg/plugin-barman-cloud-sidecar
-    tag: v0.10.0
+    tag: v0.9.0
  crds:
    create: true
--- a/clusters/cl01tl/helm/code-server/values.yaml
+++ b/clusters/cl01tl/helm/code-server/values.yaml
@@ -76,7 +76,7 @@ volsync-target-config:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  local:
-    enabled: true
+    enabled: false
    schedule: 16 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/directus/values.yaml
+++ b/clusters/cl01tl/helm/directus/values.yaml
@@ -216,7 +216,7 @@ redis-replication:
    name: directus-redis-config
    key: password
  redisReplication:
-    clusterSize: 3
+    clusterSize: 1
  redisSentinel:
-    enabled: true
+    enabled: false
    clusterSize: 3
--- a/clusters/cl01tl/helm/ephemera/values.yaml
+++ b/clusters/cl01tl/helm/ephemera/values.yaml
@@ -9,7 +9,7 @@ ephemera:
        main:
          image:
            repository: ghcr.io/orwellianepilogue/ephemera
-            tag: 1.4.2
+            tag: 1.4.1
            pullPolicy: IfNotPresent
          env:
            - name: AA_BASE_URL
@@ -130,7 +130,7 @@ ephemera:
 volsync-target-config:
  pvcTarget: ephemera
  local:
-    enabled: true
+    enabled: false
    schedule: 16 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/external-dns/Chart.lock
+++ b/clusters/cl01tl/helm/external-dns/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: external-dns
  repository: https://kubernetes-sigs.github.io/external-dns/
-  version: 1.20.0
-digest: sha256:0da4dec408239ea48de1d95fa8ad7701c4fdc0efe67baa8743507c75e62e2a47
-generated: "2026-01-02T16:02:10.536737681Z"
+  version: 1.19.0
+digest: sha256:2216b442cc820ebe561d611fbcca3955d5c94e227a0b3288e5db9f8da7d6ac00
+generated: "2025-12-01T20:25:38.288305-06:00"
--- a/clusters/cl01tl/helm/external-dns/Chart.yaml
+++ b/clusters/cl01tl/helm/external-dns/Chart.yaml
@@ -16,7 +16,7 @@ maintainers:
 dependencies:
  - name: external-dns
    alias: external-dns-unifi
-    version: 1.20.0
+    version: 1.19.0
    repository: https://kubernetes-sigs.github.io/external-dns/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 # renovate: github=kubernetes-sigs/external-dns
--- a/clusters/cl01tl/helm/external-dns/values.yaml
+++ b/clusters/cl01tl/helm/external-dns/values.yaml
@@ -19,7 +19,7 @@ external-dns-unifi:
    webhook:
      image:
        repository: ghcr.io/kashalls/external-dns-unifi-webhook
-        tag: v0.8.0
+        tag: v0.7.0
      env:
        - name: UNIFI_HOST
          value: https://192.168.1.1
--- a/clusters/cl01tl/helm/freshrss/values.yaml
+++ b/clusters/cl01tl/helm/freshrss/values.yaml
@@ -247,7 +247,7 @@ volsync-target-data:
      - 109
      - 65539
  local:
-    enabled: true
+    enabled: false
    schedule: 18 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/garage/values.yaml
+++ b/clusters/cl01tl/helm/garage/values.yaml
@@ -403,20 +403,20 @@ garage:
              readOnly: true
              mountPropagation: None
              subPath: garage-1.toml
-    db-1:
-      forceRename: garage-db-1
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 50Gi
-      retain: true
-      advancedMounts:
-        server-1:
-          main:
-            - path: /var/lib/garage/meta
-              readOnly: false
-          debug:
-            - path: /var/lib/garage/meta
-              readOnly: false
+    # db-1:
+    #   forceRename: garage-db-1
+    #   storageClass: ceph-block
+    #   accessMode: ReadWriteOnce
+    #   size: 50Gi
+    #   retain: true
+    #   advancedMounts:
+    #     server-1:
+    #       main:
+    #         - path: /var/lib/garage/meta
+    #           readOnly: false
+    #       debug:
+    #         - path: /var/lib/garage/meta
+    #           readOnly: false
    db-2:
      forceRename: garage-db-2
      storageClass: ceph-block
--- a/clusters/cl01tl/helm/gatus/values.yaml
+++ b/clusters/cl01tl/helm/gatus/values.yaml
@@ -316,6 +316,9 @@ gatus:
      - name: rayflume
        url: https://rayflume.alexlebens.net
        <<: *defaults
+      - name: soulsync
+        url: https://soulsync.alexlebens.net
+        <<: *defaults
      - name: slskd
        url: https://slskd.alexlebens.net
        <<: *defaults
@@ -421,7 +424,7 @@ postgres-18-cluster:
 volsync-target-data:
  pvcTarget: gatus
  local:
-    enabled: true
+    enabled: false
    schedule: 22 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/generic-device-plugin/Chart.lock
+++ b/clusters/cl01tl/helm/generic-device-plugin/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: generic-device-plugin
  repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-  version: 0.20.11
-digest: sha256:638754658519c268ac93bef8dec82332cded8e99b734ef61db45ee63e4b7c6ce
-generated: "2025-12-30T22:23:45.633280279Z"
+  version: 0.20.10
+digest: sha256:bb4fe0fe2e95889b3fbf028e1eff923fcc71d8bd1bc7887eee08010cfb28f4db
+generated: "2025-12-27T23:08:24.592060217Z"
--- a/clusters/cl01tl/helm/generic-device-plugin/Chart.yaml
+++ b/clusters/cl01tl/helm/generic-device-plugin/Chart.yaml
@@ -15,6 +15,6 @@ maintainers:
 dependencies:
  - name: generic-device-plugin
    repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-    version: 0.20.11
+    version: 0.20.10
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: 1.0.0
--- a/clusters/cl01tl/helm/gitea/Chart.lock
+++ b/clusters/cl01tl/helm/gitea/Chart.lock
@@ -7,7 +7,7 @@ dependencies:
  version: 0.2.1
 - name: meilisearch
  repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.20.0
+  version: 0.19.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 2.1.4
@@ -23,5 +23,5 @@ dependencies:
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.7.0
-digest: sha256:6636f6ead8089c19ad702fb58170d942e11150fdda9470f1b97f4f8fa533d00e
-generated: "2025-12-30T16:03:12.004386065Z"
+digest: sha256:c0ea42d1a2fc3712ac0481e0a40330704f0f2d1d290b7d30c36a536f0d0ee384
+generated: "2025-12-27T19:45:48.293310777Z"
--- a/clusters/cl01tl/helm/gitea/Chart.yaml
+++ b/clusters/cl01tl/helm/gitea/Chart.yaml
@@ -32,7 +32,7 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
    version: 0.2.1
  - name: meilisearch
-    version: 0.20.0
+    version: 0.19.0
    repository: https://meilisearch.github.io/meilisearch-kubernetes
  - name: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
--- a/clusters/cl01tl/helm/gitea/values.yaml
+++ b/clusters/cl01tl/helm/gitea/values.yaml
@@ -1,7 +1,7 @@
 gitea:
  global:
    imageRegistry: registry.hub.docker.com
-  replicaCount: 1
+  replicaCount: 2
  image:
    repository: gitea/gitea
    tag: 1.25.3
--- a/clusters/cl01tl/helm/grafana-operator/values.yaml
+++ b/clusters/cl01tl/helm/grafana-operator/values.yaml
@@ -17,11 +17,11 @@ postgres-18-cluster:
  recovery:
    method: objectStore
    objectStore:
-      index: 2
+      index: 1
  backup:
    objectStore:
      - name: garage-local
-        index: 2
+        index: 1
        destinationBucket: postgres-backups
        externalSecretCredentialPath: /garage/home-infra/postgres-backups
        isWALArchiver: true
--- a/clusters/cl01tl/helm/harbor/values.yaml
+++ b/clusters/cl01tl/helm/harbor/values.yaml
@@ -142,7 +142,7 @@ redis-replication:
  existingSecret:
    enabled: false
  redisReplication:
-    clusterSize: 3
+    clusterSize: 1
  redisSentinel:
-    enabled: true
+    enabled: false
    clusterSize: 3
--- a/clusters/cl01tl/helm/home-assistant/values.yaml
+++ b/clusters/cl01tl/helm/home-assistant/values.yaml
@@ -9,7 +9,7 @@ home-assistant:
        main:
          image:
            repository: ghcr.io/home-assistant/home-assistant
-            tag: 2025.12.5
+            tag: 2025.12.4
            pullPolicy: IfNotPresent
          env:
            - name: TZ
@@ -133,7 +133,7 @@ volsync-target-config:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  local:
-    enabled: true
+    enabled: false
    schedule: 24 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/homepage/values.yaml
+++ b/clusters/cl01tl/helm/homepage/values.yaml
@@ -667,6 +667,12 @@ homepage:
                  href: https://lidatube.alexlebens.net
                  siteMonitor: http://lidatube.lidatube:80
                  statusStyle: dot
+              - SoulSync:
+                  icon: sh-soulsync.webp
+                  description: Playlist Sync
+                  href: https://soulsync.alexlebens.net
+                  siteMonitor: http://soulsync.soulsync:80
+                  statusStyle: dot
              - slskd:
                  icon: sh-slskd.webp
                  description: slskd
--- a/clusters/cl01tl/helm/huntarr/values.yaml
+++ b/clusters/cl01tl/helm/huntarr/values.yaml
@@ -61,7 +61,7 @@ huntarr:
 volsync-target-config:
  pvcTarget: huntarr-config
  local:
-    enabled: true
+    enabled: false
    schedule: 26 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/immich/values.yaml
+++ b/clusters/cl01tl/helm/immich/values.yaml
@@ -226,9 +226,9 @@ redis-replication:
  existingSecret:
    enabled: false
  redisReplication:
-    clusterSize: 3
+    clusterSize: 1
  redisSentinel:
-    enabled: true
+    enabled: false
    clusterSize: 3
 volsync-target-data:
  pvcTarget: immich
--- a/clusters/cl01tl/helm/jellyfin/Chart.lock
+++ b/clusters/cl01tl/helm/jellyfin/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 4.5.0
 - name: meilisearch
  repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.20.0
+  version: 0.19.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.7.0
-digest: sha256:20665aefeaea3e853d5c977cdce05089a87c6d83e43aa946a088f43bcc7eebf9
-generated: "2025-12-30T16:03:25.803286869Z"
+digest: sha256:dc914dfc86c2b638fae6f580418dafebcddb09a25e6f534f89983fb592196245
+generated: "2025-12-27T13:30:57.814394-06:00"
--- a/clusters/cl01tl/helm/jellyfin/Chart.yaml
+++ b/clusters/cl01tl/helm/jellyfin/Chart.yaml
@@ -25,7 +25,7 @@ dependencies:
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.5.0
  - name: meilisearch
-    version: 0.20.0
+    version: 0.19.0
    repository: https://meilisearch.github.io/meilisearch-kubernetes
  - name: volsync-target
    alias: volsync-target-config
--- a/clusters/cl01tl/helm/jellyfin/values.yaml
+++ b/clusters/cl01tl/helm/jellyfin/values.yaml
@@ -142,7 +142,7 @@ meilisearch:
 volsync-target-config:
  pvcTarget: jellyfin-config
  local:
-    enabled: true
+    enabled: false
    schedule: 30 8 * * *
    restic:
      cacheCapacity: 10Gi
--- a/clusters/cl01tl/helm/jellystat/values.yaml
+++ b/clusters/cl01tl/helm/jellystat/values.yaml
@@ -144,7 +144,7 @@ postgres-18-cluster:
 volsync-target-data:
  pvcTarget: jellystat-data
  local:
-    enabled: true
+    enabled: false
    schedule: 32 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/karakeep/Chart.lock
+++ b/clusters/cl01tl/helm/karakeep/Chart.lock
@@ -4,12 +4,12 @@ dependencies:
  version: 4.5.0
 - name: meilisearch
  repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.20.0
+  version: 0.19.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 2.1.4
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.7.0
-digest: sha256:d65ca3de6fd1095c4dfe2515ed84c4705495c0725773ec95ea49331a38721785
-generated: "2025-12-30T16:03:37.441539588Z"
+digest: sha256:e750d8cab228de94d920f80137981e24e795d97040e92dd4cf0d80e463b2bd19
+generated: "2025-12-27T13:31:02.732529-06:00"
--- a/clusters/cl01tl/helm/karakeep/Chart.yaml
+++ b/clusters/cl01tl/helm/karakeep/Chart.yaml
@@ -22,7 +22,7 @@ dependencies:
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.5.0
  - name: meilisearch
-    version: 0.20.0
+    version: 0.19.0
    repository: https://meilisearch.github.io/meilisearch-kubernetes
  - name: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
--- a/clusters/cl01tl/helm/karakeep/values.yaml
+++ b/clusters/cl01tl/helm/karakeep/values.yaml
@@ -9,7 +9,7 @@ karakeep:
        main:
          image:
            repository: ghcr.io/karakeep-app/karakeep
-            tag: 0.30.0
+            tag: 0.29.3
            pullPolicy: IfNotPresent
          env:
            - name: DATA_DIR
@@ -171,7 +171,7 @@ meilisearch:
 volsync-target-data:
  pvcTarget: karakeep
  local:
-    enabled: true
+    enabled: false
    schedule: 34 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock
@@ -1,12 +1,12 @@
 dependencies:
 - name: kube-prometheus-stack
  repository: oci://ghcr.io/prometheus-community/charts
-  version: 80.9.1
+  version: 80.6.0
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.5.0
 - name: redis-replication
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.5.0
-digest: sha256:91fcf8234e006b8e412e15ddd159ef3450a51bfdb6866a1ea2759741f78b70cd
-generated: "2025-12-30T22:24:25.338726593Z"
+digest: sha256:6f046a936f1d732a44113eb0b7e54330a4261042179f37f4c94fccc9f20ee511
+generated: "2025-12-20T01:04:57.413744271Z"
--- a/clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml
@@ -20,7 +20,7 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: kube-prometheus-stack
-    version: 80.9.1
+    version: 80.6.0
    repository: oci://ghcr.io/prometheus-community/charts
  - name: app-template
    alias: ntfy-alertmanager
--- a/clusters/cl01tl/helm/kube-prometheus-stack/values.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/values.yaml
@@ -174,12 +174,12 @@ redis-replication:
  existingSecret:
    enabled: false
  redisReplication:
-    clusterSize: 3
+    clusterSize: 1
    volumeClaimTemplate:
      spec:
        resources:
          requests:
            storage: 10Gi
  redisSentinel:
-    enabled: true
+    enabled: false
    clusterSize: 3
--- a/clusters/cl01tl/helm/libation/values.yaml
+++ b/clusters/cl01tl/helm/libation/values.yaml
@@ -60,21 +60,10 @@ libation:
          main:
            - path: /config
              readOnly: false
-    audiobooks:
-      existingClaim: libation-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /data
-              readOnly: false
-        debug:
-          main:
-            - path: /data
-              readOnly: false
 volsync-target-config:
  pvcTarget: libation
  local:
-    enabled: true
+    enabled: false
    schedule: 36 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/lidarr/values.yaml
+++ b/clusters/cl01tl/helm/lidarr/values.yaml
@@ -171,7 +171,7 @@ volsync-target-config:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  local:
-    enabled: true
+    enabled: false
    schedule: 38 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/lidatube/values.yaml
+++ b/clusters/cl01tl/helm/lidatube/values.yaml
@@ -93,7 +93,7 @@ volsync-target-config:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  local:
-    enabled: true
+    enabled: false
    schedule: 40 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/listenarr/values.yaml
+++ b/clusters/cl01tl/helm/listenarr/values.yaml
@@ -74,7 +74,7 @@ volsync-target-config:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  local:
-    enabled: true
+    enabled: false
    schedule: 42 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/local-path-provisioner/values.yaml
+++ b/clusters/cl01tl/helm/local-path-provisioner/values.yaml
@@ -13,16 +13,26 @@ local-path-provisioner:
    reclaimPolicy: Delete
    volumeBindingMode: WaitForFirstConsumer
  nodePathMap:
-    - node: DEFAULT_PATH_FOR_NON_LISTED_NODES
+    - node: talos-2di-ktg
      paths:
-        - /var/mnt/local-storage
+        - /var/local-path-provisioner
+    - node: talos-9vs-6hh
+      paths:
+        - /var/local-path-provisioner
+    - node: talos-aoq-hpv
+      paths:
+        - /var/local-path-provisioner
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
          - matchExpressions:
-              - key: node-role.kubernetes.io/local-storage-node
-                operator: Exists
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - talos-2di-ktg
+                - talos-9vs-6hh
+                - talos-aoq-hpv
  configmap:
    name: local-path-config
    setup: |-
--- a/clusters/cl01tl/helm/matrix-synapse/values.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/values.yaml
@@ -478,7 +478,7 @@ redis-replication-hookshot:
 volsync-target-synapse:
  pvcTarget: matrix-synapse
  local:
-    enabled: true
+    enabled: false
    schedule: 44 8 * * *
  remote:
    enabled: false
@@ -488,7 +488,7 @@ volsync-target-synapse:
 volsync-target-hookshot:
  pvcTarget: matrix-hookshot
  local:
-    enabled: true
+    enabled: false
    schedule: 46 8 * * *
  remote:
    enabled: false
@@ -501,7 +501,7 @@ volsync-target-discord:
    runAsUser: 1337
    runAsGroup: 1337
  local:
-    enabled: true
+    enabled: false
    schedule: 48 8 * * *
  remote:
    enabled: false
@@ -514,7 +514,7 @@ volsync-target-whatsapp:
    runAsUser: 1337
    runAsGroup: 1337
  local:
-    enabled: true
+    enabled: false
    schedule: 50 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/navidrome/templates/persistent-volume-claim.yaml
+++ b/clusters/cl01tl/helm/navidrome/templates/persistent-volume-claim.yaml
@@ -15,22 +15,3 @@ spec:
  resources:
    requests:
      storage: 1Gi
-
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: navidrome-music-youtube-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: navidrome-music-youtube-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: navidrome-music-youtube-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
--- a/clusters/cl01tl/helm/navidrome/templates/persistent-volume.yaml
+++ b/clusters/cl01tl/helm/navidrome/templates/persistent-volume.yaml
@@ -21,28 +21,3 @@ spec:
    - vers=4
    - minorversion=1
    - noac
-
---
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: navidrome-music-youtube-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: navidrome-music-youtube-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage/Music Youtube/
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac
--- a/clusters/cl01tl/helm/navidrome/values.yaml
+++ b/clusters/cl01tl/helm/navidrome/values.yaml
@@ -146,13 +146,6 @@ navidrome:
          main:
            - path: /music
              readOnly: true
-    music-youtube:
-      existingClaim: navidrome-music-youtube-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /music-youtube
-              readOnly: true
 volsync-target-data:
  pvcTarget: navidrome-data
  moverSecurityContext:
@@ -161,7 +154,7 @@ volsync-target-data:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  local:
-    enabled: true
+    enabled: false
    schedule: 52 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/ollama/values.yaml
+++ b/clusters/cl01tl/helm/ollama/values.yaml
@@ -307,7 +307,7 @@ volsync-target-data:
    runAsUser: 1337
    runAsGroup: 1337
  local:
-    enabled: true
+    enabled: false
    schedule: 54 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/outline/values.yaml
+++ b/clusters/cl01tl/helm/outline/values.yaml
@@ -188,7 +188,7 @@ redis-replication:
  existingSecret:
    enabled: false
  redisReplication:
-    clusterSize: 3
+    clusterSize: 1
  redisSentinel:
-    enabled: true
+    enabled: false
    clusterSize: 3
--- a/clusters/cl01tl/helm/postiz/values.yaml
+++ b/clusters/cl01tl/helm/postiz/values.yaml
@@ -9,7 +9,7 @@ postiz:
        main:
          image:
            repository: ghcr.io/gitroomhq/postiz-app
-            tag: v2.11.3
+            tag: v2.10.1
            pullPolicy: IfNotPresent
          env:
            - name: MAIN_URL
@@ -173,14 +173,14 @@ redis-replication:
    name: postiz-redis-config
    key: password
  redisReplication:
-    clusterSize: 3
+    clusterSize: 1
  redisSentinel:
-    enabled: true
+    enabled: false
    clusterSize: 3
 volsync-target-config:
  pvcTarget: postiz-config
  local:
-    enabled: true
+    enabled: false
    schedule: 56 8 * * *
  remote:
    enabled: false
@@ -190,7 +190,7 @@ volsync-target-config:
 volsync-target-upload:
  pvcTarget: postiz-uploads
  local:
-    enabled: true
+    enabled: false
    schedule: 58 8 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/prowlarr/values.yaml
+++ b/clusters/cl01tl/helm/prowlarr/values.yaml
@@ -83,7 +83,7 @@ volsync-target-config:
      - 109
      - 65539
  local:
-    enabled: true
+    enabled: false
    schedule: 0 11 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/qbittorrent/values.yaml
+++ b/clusters/cl01tl/helm/qbittorrent/values.yaml
@@ -437,7 +437,7 @@ volsync-target-config:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  local:
-    enabled: true
+    enabled: false
    schedule: 2 11 * * *
    restic:
      copyMethod: Snapshot
@@ -458,7 +458,7 @@ volsync-target-config:
 volsync-target-qbit-manage-config:
  pvcTarget: qbittorrent-qbit-manage-config-data
  local:
-    enabled: true
+    enabled: false
    schedule: 4 11 * * *
  remote:
    enabled: false
@@ -468,7 +468,7 @@ volsync-target-qbit-manage-config:
 volsync-target-qui-config:
  pvcTarget: qbittorrent-qui-config-data
  local:
-    enabled: true
+    enabled: false
    schedule: 6 11 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/radarr-4k/values.yaml
+++ b/clusters/cl01tl/helm/radarr-4k/values.yaml
@@ -171,7 +171,7 @@ volsync-target-config:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  local:
-    enabled: true
+    enabled: false
    schedule: 10 11 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/radarr-anime/values.yaml
+++ b/clusters/cl01tl/helm/radarr-anime/values.yaml
@@ -169,7 +169,7 @@ volsync-target-config:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  local:
-    enabled: true
+    enabled: false
    schedule: 12 11 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/radarr-standup/values.yaml
+++ b/clusters/cl01tl/helm/radarr-standup/values.yaml
@@ -169,7 +169,7 @@ volsync-target-config:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  local:
-    enabled: true
+    enabled: false
    schedule: 14 11 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/radarr/values.yaml
+++ b/clusters/cl01tl/helm/radarr/values.yaml
@@ -171,7 +171,7 @@ volsync-target-config:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  local:
-    enabled: true
+    enabled: false
    schedule: 8 11 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/rayflume/Chart.yaml
+++ b/clusters/cl01tl/helm/rayflume/Chart.yaml
@@ -24,4 +24,4 @@ dependencies:
    alias: volsync-target-data
    version: 0.7.0
    repository: oci://harbor.alexlebens.net/helm-charts
-appVersion: 0.0.9
+appVersion: 0.0.3
--- a/clusters/cl01tl/helm/rayflume/values.yaml
+++ b/clusters/cl01tl/helm/rayflume/values.yaml
@@ -9,7 +9,7 @@ rayflume:
        main:
          image:
            repository: harbor.alexlebens.net/images/rayflume
-            tag: 0.0.9
+            tag: 0.0.7
            pullPolicy: IfNotPresent
          env:
            - name: DEBUG
@@ -95,7 +95,7 @@ redis-replication:
 volsync-target-data:
  pvcTarget: rayflume-data
  local:
-    enabled: true
+    enabled: false
    schedule: 16 11 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/rook-ceph/values.yaml
+++ b/clusters/cl01tl/helm/rook-ceph/values.yaml
@@ -85,8 +85,7 @@ rook-ceph-cluster:
          cpu: 100m
          memory: 128Mi
    storage:
-      useAllDevices: false
-      devicePathFilter: "/dev/disk/by-partlabel/r-csi-disk"
+      deviceFilter: sda
      config:
        osdsPerDevice: "1"
    csi:
--- a/clusters/cl01tl/helm/roundcube/values.yaml
+++ b/clusters/cl01tl/helm/roundcube/values.yaml
@@ -271,7 +271,7 @@ postgres-18-cluster:
 volsync-target-data:
  pvcTarget: roundcube-data
  local:
-    enabled: true
+    enabled: false
    schedule: 16 11 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/searxng/values.yaml
+++ b/clusters/cl01tl/helm/searxng/values.yaml
@@ -9,7 +9,7 @@ searxng:
        main:
          image:
            repository: searxng/searxng
-            tag: latest@sha256:472dd0c84b8e2a05bca773b4a430b9fc9e4e92cd4fa0afaa223efab925ab752a
+            tag: latest@sha256:8d98d5c1b678714c3b20dacfab5ea5e3b67f79e50df6d5dbc92ed4f0a964ccbd
            pullPolicy: IfNotPresent
          env:
            - name: SEARXNG_BASE_URL
@@ -39,7 +39,7 @@ searxng:
        main:
          image:
            repository: searxng/searxng
-            tag: latest@sha256:472dd0c84b8e2a05bca773b4a430b9fc9e4e92cd4fa0afaa223efab925ab752a
+            tag: latest@sha256:8d98d5c1b678714c3b20dacfab5ea5e3b67f79e50df6d5dbc92ed4f0a964ccbd
            pullPolicy: IfNotPresent
          env:
            - name: SEARXNG_BASE_URL
@@ -220,7 +220,7 @@ searxng:
 volsync-target-data:
  pvcTarget: searxng-browser-data
  local:
-    enabled: true
+    enabled: false
    schedule: 18 11 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/seerr/values.yaml
+++ b/clusters/cl01tl/helm/seerr/values.yaml
@@ -32,7 +32,7 @@ seerr-chart:
 volsync-target-config:
  pvcTarget: seerr-seerr-chart-config
  local:
-    enabled: true
+    enabled: false
    schedule: 20 11 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/site-documentation/values.yaml
+++ b/clusters/cl01tl/helm/site-documentation/values.yaml
@@ -11,7 +11,7 @@ site-documentation:
        main:
          image:
            repository: harbor.alexlebens.net/images/site-documentation
-            tag: 0.0.7
+            tag: 0.0.5
            pullPolicy: IfNotPresent
          resources:
            requests:
--- a/clusters/cl01tl/helm/site-profile/values.yaml
+++ b/clusters/cl01tl/helm/site-profile/values.yaml
@@ -11,7 +11,7 @@ site-profile:
        main:
          image:
            repository: harbor.alexlebens.net/images/site-profile
-            tag: 2.1.4
+            tag: 2.1.2
            pullPolicy: IfNotPresent
          resources:
            requests:
--- a/clusters/cl01tl/helm/sonarr-4k/values.yaml
+++ b/clusters/cl01tl/helm/sonarr-4k/values.yaml
@@ -169,7 +169,7 @@ volsync-target-config:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  local:
-    enabled: true
+    enabled: false
    schedule: 24 11 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/sonarr-anime/values.yaml
+++ b/clusters/cl01tl/helm/sonarr-anime/values.yaml
@@ -169,7 +169,7 @@ volsync-target-config:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  local:
-    enabled: true
+    enabled: false
    schedule: 26 11 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/sonarr/values.yaml
+++ b/clusters/cl01tl/helm/sonarr/values.yaml
@@ -169,7 +169,7 @@ volsync-target-config:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  local:
-    enabled: true
+    enabled: false
    schedule: 22 11 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/soulsync/Chart.lock
+++ b/clusters/cl01tl/helm/soulsync/Chart.lock
@@ -0,0 +1,12 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.5.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.7.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.7.0
+digest: sha256:3f2befd8dc0c7cc73090a5e1648d200a757dbc3e58f7735940fc11b172ada4f9
+generated: "2025-12-27T13:32:51.138317-06:00"
--- a/clusters/cl01tl/helm/soulsync/Chart.yaml
+++ b/clusters/cl01tl/helm/soulsync/Chart.yaml
@@ -0,0 +1,29 @@
+apiVersion: v2
+name: soulsync
+version: 1.0.0
+description: SoulSync
+keywords:
+  - soulsync
+  - music
+home: https://wiki.alexlebens.dev/s/
+sources:
+  - https://github.com/Nezreka/SoulSync
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: soulsync
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.5.0
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.7.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-database
+    version: 0.7.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/soulsync.png
+# renovate: github=Nezreka/SoulSync
+appVersion: 1.42.2
--- a/clusters/cl01tl/helm/vaultwarden/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/vaultwarden/templates/external-secret.yaml
@@ -1,10 +1,10 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: vaultwarden-oidc-secret
+  name: soulsync-config-secret
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: vaultwarden-oidc-secret
+    app.kubernetes.io/name: soulsync-config-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
@@ -12,17 +12,10 @@ spec:
    kind: ClusterSecretStore
    name: vault
  data:
-    - secretKey: client
+    - secretKey: config.json
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
-        key: /authentik/oidc/vaultwarden
+        key: /cl01tl/soulsync/config
        metadataPolicy: None
-        property: client
-    - secretKey: secret
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /authentik/oidc/vaultwarden
-        metadataPolicy: None
-        property: secret
+        property: config.json
--- a/clusters/cl01tl/helm/soulsync/templates/persistent-volume-claim.yaml
+++ b/clusters/cl01tl/helm/soulsync/templates/persistent-volume-claim.yaml
@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: soulsync-music-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: soulsync-music-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  volumeName: soulsync-music-nfs-storage
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: soulsync-slskd-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: soulsync-slskd-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  volumeName: soulsync-slskd-nfs-storage
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
--- a/clusters/cl01tl/helm/soulsync/templates/persistent-volume.yaml
+++ b/clusters/cl01tl/helm/soulsync/templates/persistent-volume.yaml
@@ -0,0 +1,48 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: soulsync-music-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: soulsync-music-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: nfs-client
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    path: /volume2/Storage/Music
+    server: synologybond.alexlebens.net
+  mountOptions:
+    - vers=4
+    - minorversion=1
+    - noac
+
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: soulsync-slskd-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: soulsync-slskd-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: nfs-client
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    path: /volume2/Storage/slskd/Downloads
+    server: synologybond.alexlebens.net
+  mountOptions:
+    - vers=4
+    - minorversion=1
+    - noac
--- a/clusters/cl01tl/helm/soulsync/values.yaml
+++ b/clusters/cl01tl/helm/soulsync/values.yaml
@@ -0,0 +1,170 @@
+soulsync:
+  controllers:
+    main:
+      type: deployment
+      replicas: 0
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      initContainers:
+        init-copy-config:
+          image:
+            repository: busybox
+            tag: 1.37.0
+            pullPolicy: IfNotPresent
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+          command:
+            - /bin/sh
+            - -ec
+            - |
+              echo ">> Coping files ..."
+              ls /tmp
+              cp -fv /tmp/config.json /app/config/config.json
+              echo ">> Files in config:"
+              ls /app/config
+      containers:
+        main:
+          image:
+            repository: boulderbadgedad/soulsync
+            tag: latest
+            pullPolicy: IfNotPresent
+          env:
+            - name: TZ
+              value: US/Central
+            - name: PUID
+              value: 1000
+            - name: PGID
+              value: 1000
+            - name: FLASK_ENV
+              value: production
+            - name: PYTHONPATH
+              value: /app
+            - name: SOULSYNC_CONFIG_PATH
+              value: /app/config/config.json
+          probes:
+            liveness:
+              enabled: true
+              custom: true
+              spec:
+                exec:
+                  command:
+                  - CMD
+                  - curl
+                  - -f
+                  - http://localhost:8888/
+                failureThreshold: 5
+                initialDelaySeconds: 60
+                periodSeconds: 30
+                successThreshold: 1
+                timeoutSeconds: 10
+          resources:
+            requests:
+              cpu: 100m
+              memory: 512Mi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 8008
+          protocol: HTTP
+  route:
+    main:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - soulsync.alexlebens.net
+      rules:
+        - backendRefs:
+            - group: ''
+              kind: Service
+              name: soulsync
+              port: 80
+              weight: 100
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+  persistence:
+    secret:
+      enabled: true
+      type: secret
+      name: soulsync-config-secret
+      advancedMounts:
+        main:
+          init-copy-config:
+            - path: /tmp/config.json
+              readOnly: true
+              mountPropagation: None
+              subPath: config.json
+    config:
+      forceRename: soulsync-config
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      advancedMounts:
+        main:
+          main:
+            - path: /app/config
+              readOnly: false
+          init-copy-config:
+            - path: /app/config
+              readOnly: false
+    database:
+      forceRename: soulsync-database
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      advancedMounts:
+        main:
+          main:
+            - path: /app/database
+              readOnly: false
+    downloads:
+      existingClaim: soulsync-slskd-nfs-storage
+      advancedMounts:
+        main:
+          main:
+            - path: /app/downloads
+              readOnly: false
+    transfer:
+      type: emptyDir
+      advancedMounts:
+        main:
+          main:
+            - path: /app/Transfer
+              readOnly: false
+    music:
+      existingClaim: soulsync-music-nfs-storage
+      advancedMounts:
+        main:
+          main:
+            - path: /music
+              readOnly: true
+volsync-target-config:
+  pvcTarget: soulsync-config
+  local:
+    enabled: false
+    schedule: 28 11 * * *
+  remote:
+    enabled: false
+  external:
+    enabled: true
+    schedule: 28 12 * * *
+volsync-target-database:
+  pvcTarget: soulsync-database
+  local:
+    enabled: false
+    schedule: 30 11 * * *
+  remote:
+    enabled: false
+  external:
+    enabled: true
+    schedule: 30 12 * * *
--- a/clusters/cl01tl/helm/stalwart/values.yaml
+++ b/clusters/cl01tl/helm/stalwart/values.yaml
@@ -9,7 +9,7 @@ stalwart:
        main:
          image:
            repository: stalwartlabs/stalwart
-            tag: v0.15.3
+            tag: v0.15.2
            pullPolicy: IfNotPresent
          resources:
            requests:
@@ -118,14 +118,14 @@ redis-replication:
  existingSecret:
    enabled: false
  redisReplication:
-    clusterSize: 3
+    clusterSize: 1
  redisSentinel:
-    enabled: true
+    enabled: false
    clusterSize: 3
 volsync-target-config:
  pvcTarget: stalwart-config
  local:
-    enabled: true
+    enabled: false
    schedule: 32 11 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/talos/values.yaml
+++ b/clusters/cl01tl/helm/talos/values.yaml
@@ -69,7 +69,7 @@ etcd-backup:
        s3-prune:
          image:
            repository: d3fk/s3cmd
-            tag: latest@sha256:8aeb104edaba11f086506024b22d543a0771e0b01cd50243043002e2d61c2f71
+            tag: latest@sha256:64a23903ee1b156ae7d795efc756b68ad802bce695f5608343edadba3dea1dc1
            pullPolicy: IfNotPresent
          command:
            - /bin/sh
@@ -155,7 +155,7 @@ etcd-backup:
        s3-prune:
          image:
            repository: d3fk/s3cmd
-            tag: latest@sha256:8aeb104edaba11f086506024b22d543a0771e0b01cd50243043002e2d61c2f71
+            tag: latest@sha256:64a23903ee1b156ae7d795efc756b68ad802bce695f5608343edadba3dea1dc1
            pullPolicy: IfNotPresent
          command:
            - /bin/sh
@@ -241,7 +241,7 @@ etcd-backup:
        s3-prune:
          image:
            repository: d3fk/s3cmd
-            tag: latest@sha256:8aeb104edaba11f086506024b22d543a0771e0b01cd50243043002e2d61c2f71
+            tag: latest@sha256:64a23903ee1b156ae7d795efc756b68ad802bce695f5608343edadba3dea1dc1
            pullPolicy: IfNotPresent
          command:
            - /bin/sh
@@ -405,7 +405,7 @@ etcd-defrag:
        main:
          image:
            repository: ghcr.io/siderolabs/talosctl
-            tag: v1.12.0
+            tag: v1.11.6
            pullPolicy: IfNotPresent
          args:
            - etcd
@@ -438,7 +438,7 @@ etcd-defrag:
        main:
          image:
            repository: ghcr.io/siderolabs/talosctl
-            tag: v1.12.0
+            tag: v1.11.6
            pullPolicy: IfNotPresent
          args:
            - etcd
@@ -471,7 +471,7 @@ etcd-defrag:
        main:
          image:
            repository: ghcr.io/siderolabs/talosctl
-            tag: v1.12.0
+            tag: v1.11.6
            pullPolicy: IfNotPresent
          args:
            - etcd
--- a/clusters/cl01tl/helm/tautulli/values.yaml
+++ b/clusters/cl01tl/helm/tautulli/values.yaml
@@ -170,7 +170,7 @@ tautulli:
 volsync-target-config:
  pvcTarget: tautulli-config
  local:
-    enabled: true
+    enabled: false
    schedule: 34 11 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/tdarr/values.yaml
+++ b/clusters/cl01tl/helm/tdarr/values.yaml
@@ -180,7 +180,7 @@ tdarr-exporter:
 volsync-target-config:
  pvcTarget: tdarr-config
  local:
-    enabled: true
+    enabled: false
    schedule: 36 11 * * *
  remote:
    enabled: false
@@ -190,7 +190,7 @@ volsync-target-config:
 volsync-target-server:
  pvcTarget: tdarr-server
  local:
-    enabled: true
+    enabled: false
    schedule: 38 11 * * *
  remote:
    enabled: false
--- a/clusters/cl01tl/helm/tubearchivist/values.yaml
+++ b/clusters/cl01tl/helm/tubearchivist/values.yaml
@@ -148,7 +148,7 @@ redis-replication:
  existingSecret:
    enabled: false
  redisReplication:
-    clusterSize: 3
+    clusterSize: 1
    resources:
      requests:
        cpu: 200m
@@ -159,5 +159,5 @@ redis-replication:
          requests:
            storage: 10Gi
  redisSentinel:
-    enabled: true
+    enabled: false
    clusterSize: 3
--- a/clusters/cl01tl/helm/unpoller/values.yaml
+++ b/clusters/cl01tl/helm/unpoller/values.yaml
@@ -9,7 +9,7 @@ unpoller:
        main:
          image:
            repository: ghcr.io/unpoller/unpoller
-            tag: v2.21.0
+            tag: v2.20.1
            pullPolicy: IfNotPresent
          env:
            - name: UP_UNIFI_CONTROLLER_0_SAVE_ALARMS
--- a/clusters/cl01tl/helm/vault/values.yaml
+++ b/clusters/cl01tl/helm/vault/values.yaml
@@ -187,7 +187,7 @@ snapshot:
        s3-backup-local:
          image:
            repository: d3fk/s3cmd
-            tag: latest@sha256:8aeb104edaba11f086506024b22d543a0771e0b01cd50243043002e2d61c2f71
+            tag: latest@sha256:64a23903ee1b156ae7d795efc756b68ad802bce695f5608343edadba3dea1dc1
            pullPolicy: IfNotPresent
          command:
            - /bin/sh
@@ -208,7 +208,7 @@ snapshot:
        s3-backup-remote:
          image:
            repository: d3fk/s3cmd
-            tag: latest@sha256:8aeb104edaba11f086506024b22d543a0771e0b01cd50243043002e2d61c2f71
+            tag: latest@sha256:64a23903ee1b156ae7d795efc756b68ad802bce695f5608343edadba3dea1dc1
            pullPolicy: IfNotPresent
          command:
            - /bin/sh
@@ -229,7 +229,7 @@ snapshot:
        s3-backup-external:
          image:
            repository: d3fk/s3cmd
-            tag: latest@sha256:8aeb104edaba11f086506024b22d543a0771e0b01cd50243043002e2d61c2f71
+            tag: latest@sha256:64a23903ee1b156ae7d795efc756b68ad802bce695f5608343edadba3dea1dc1
            pullPolicy: IfNotPresent
          command:
            - /bin/sh
--- a/clusters/cl01tl/helm/vaultwarden/values.yaml
+++ b/clusters/cl01tl/helm/vaultwarden/values.yaml
@@ -9,7 +9,7 @@ vaultwarden:
        main:
          image:
            repository: vaultwarden/server
-            tag: 1.35.1
+            tag: 1.35.0
            pullPolicy: IfNotPresent
          env:
            - name: DOMAIN
@@ -23,24 +23,6 @@ vaultwarden:
                secretKeyRef:
                  name: vaultwarden-postgresql-18-cluster-app
                  key: uri
-            - name: SSO_ENABLED
-              value: true
-            - name: SSO_SIGNUPS_MATCH_EMAIL
-              value: true
-            - name: SSO_AUTHORITY
-              value: https://auth.alexlebens.dev/application/o/vaultwarden/
-            - name: SSO_SCOPES
-              value: "email profile offline_access"
-            - name: SSO_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: vaultwarden-oidc-secret
-                  key: client
-            - name: SSO_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: vaultwarden-oidc-secret
-                  key: secret
          resources:
            requests:
              cpu: 10m
--- a/clusters/cl01tl/helm/whodb/values.yaml
+++ b/clusters/cl01tl/helm/whodb/values.yaml
@@ -8,7 +8,7 @@ whodb:
        main:
          image:
            repository: clidey/whodb
-            tag: 0.87.0
+            tag: 0.86.0
            pullPolicy: IfNotPresent
          env:
            - name: WHODB_OLLAMA_HOST
--- a/clusters/cl01tl/helm/yamtrack/values.yaml
+++ b/clusters/cl01tl/helm/yamtrack/values.yaml
@@ -9,7 +9,7 @@ yamtrack:
        main:
          image:
            repository: ghcr.io/fuzzygrim/yamtrack
-            tag: 0.24.11
+            tag: 0.24.9
            pullPolicy: IfNotPresent
          env:
            - name: TZ
@@ -136,7 +136,7 @@ redis-replication:
  existingSecret:
    enabled: false
  redisReplication:
-    clusterSize: 3
+    clusterSize: 1
  redisSentinel:
-    enabled: true
+    enabled: false
    clusterSize: 3
--- a/clusters/cl01tl/helm/ytdl-sub/Chart.yaml
+++ b/clusters/cl01tl/helm/ytdl-sub/Chart.yaml
@@ -1,22 +0,0 @@
-apiVersion: v2
-name: ytdl-sub
-version: 1.0.0
-description: ytdl-sub
-keywords:
-  - ytdl-sub
-  - music
-  - youtube
-home: https://wiki.alexlebens.dev/s/
-sources:
-  - https://github.com/jmbannon/ytdl-sub
-  - https://github.com/jmbannon/ytdl-sub/pkgs/container/ytdl-sub
-  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: ytdl-sub
-    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.5.0
-# renovate: github=jmbannon/ytdl-sub
-appVersion: 2025.12.26
--- a/clusters/cl01tl/helm/ytdl-sub/templates/persistent-volume-claim.yaml
+++ b/clusters/cl01tl/helm/ytdl-sub/templates/persistent-volume-claim.yaml
@@ -1,17 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: ytdl-sub-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ytdl-sub-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: ytdl-sub-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
--- a/clusters/cl01tl/helm/ytdl-sub/templates/persistent-volume.yaml
+++ b/clusters/cl01tl/helm/ytdl-sub/templates/persistent-volume.yaml
@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: ytdl-sub-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ytdl-sub-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage/Music Youtube/
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac
--- a/clusters/cl01tl/helm/ytdl-sub/values.yaml
+++ b/clusters/cl01tl/helm/ytdl-sub/values.yaml
@@ -1,81 +0,0 @@
-ytdl-sub:
-  controllers:
-    main:
-      type: cronjob
-      cronjob:
-        suspend: false
-        concurrencyPolicy: Forbid
-        timeZone: US/Central
-        schedule: 12 0 * * *
-        startingDeadlineSeconds: 90
-        successfulJobsHistory: 1
-        failedJobsHistory: 1
-        backoffLimit: 3
-        parallelism: 1
-      containers:
-        main:
-          image:
-            repository: ghcr.io/jmbannon/ytdl-sub
-            tag: 2025.12.30
-            pullPolicy: IfNotPresent
-          command:
-            - ytdl-sub
-            - -c
-            - /config/config.yaml
-            - sub
-          env:
-            - name: TZ
-              value: America/Chicago
-            - name: CRON_RUN_ON_START
-              value: false
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  configMaps:
-    config:
-      enabled: true
-      data:
-        config.yaml: |
-          configuration:
-            working_directory: /cache
-        subscriptions.yaml: |
-          __preset__:
-            embed_thumbnail: True
-            square_thumbnail: True
-            overrides:
-              music_directory: /music
-          YouTube Releases | Max MP3 Quality:
-            = YouTube:
-              "Music Saved": "https://www.youtube.com/playlist?list=PLtiOoYqxYXtKK3fMya_xhqK0Wit0i10Gy&si=8wNBH-kGT9Nx0XBK"
-
-  persistence:
-    config:
-      enabled: true
-      type: configMap
-      name: ytdl-sub
-      advancedMounts:
-        main:
-          main:
-            - path: /config/config.yaml
-              readOnly: true
-              mountPropagation: None
-              subPath: config.yaml
-            - path: /config/subscriptions.yaml
-              readOnly: true
-              mountPropagation: None
-              subPath: subscriptions.yaml
-    cache:
-      type: emptyDir
-      advancedMounts:
-        main:
-          main:
-            - path: /cache
-              readOnly: false
-    music:
-      existingClaim: ytdl-sub-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /music
-              readOnly: false
--- a/hosts/ps08rp/blocky/config.yml
+++ b/hosts/ps08rp/blocky/config.yml
@@ -135,6 +135,7 @@ customDNS:
    sonarr                          IN      CNAME   traefik-cl01tl
    sonarr-4k                       IN      CNAME   traefik-cl01tl
    sonarr-anime                    IN      CNAME   traefik-cl01tl
+    soulsync                        IN      CNAME   traefik-cl01tl
    stalwart                        IN      CNAME   traefik-cl01tl
    tautulli                        IN      CNAME   traefik-cl01tl
    tdarr                           IN      CNAME   traefik-cl01tl
--- a/hosts/ps08rp/traefik/compose.yaml
+++ b/hosts/ps08rp/traefik/compose.yaml
@@ -1,7 +1,7 @@
 ---
 services:
    traefik:
-        image: ghcr.io/traefik/traefik:v3.6.6
+        image: ghcr.io/traefik/traefik:v3.6.5
        container_name: traefik
        command:
            - "--global.checkNewVersion=false"
--- a/hosts/ps09rp/blocky/config.yml
+++ b/hosts/ps09rp/blocky/config.yml
@@ -135,6 +135,7 @@ customDNS:
    sonarr                          IN      CNAME   traefik-cl01tl
    sonarr-4k                       IN      CNAME   traefik-cl01tl
    sonarr-anime                    IN      CNAME   traefik-cl01tl
+    soulsync                        IN      CNAME   traefik-cl01tl
    stalwart                        IN      CNAME   traefik-cl01tl
    tautulli                        IN      CNAME   traefik-cl01tl
    tdarr                           IN      CNAME   traefik-cl01tl
--- a/hosts/ps09rp/traefik/compose.yaml
+++ b/hosts/ps09rp/traefik/compose.yaml
@@ -1,7 +1,7 @@
 ---
 services:
    traefik:
-        image: ghcr.io/traefik/traefik:v3.6.6
+        image: ghcr.io/traefik/traefik:v3.6.5
        container_name: traefik
        command:
            - "--global.checkNewVersion=false"
--- a/hosts/ps10rp/traefik/compose.yaml
+++ b/hosts/ps10rp/traefik/compose.yaml
@@ -20,7 +20,7 @@ services:
            - /dev/net/tun:/dev/net/tun

    traefik:
-        image: ghcr.io/traefik/traefik:v3.6.6
+        image: ghcr.io/traefik/traefik:v3.6.5
        container_name: traefik
        command:
            - "--global.checkNewVersion=false"
--- a/renovate.json
+++ b/renovate.json
@@ -18,7 +18,8 @@
      "addLabels": [
        "chart"
      ],
-      "automerge": false
+      "automerge": false,
+      "minimumReleaseAge": "1 days"
    },
    {
      "description": "Automerge chart patches",
@@ -58,7 +59,8 @@
      "addLabels": [
        "image"
      ],
-      "automerge": false
+      "automerge": false,
+      "minimumReleaseAge": "1 days"
    },
    {
      "description": "Automerge image patches",