Update dpage/pgadmin4 Docker tag to v9.10

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [headlamp](https://headlamp.dev/) ([source](https://github.com/kubernetes-sigs/headlamp)) | minor | `0.37.0` -> `0.38.0` |

---

### Release Notes

<details>
<summary>kubernetes-sigs/headlamp (headlamp)</summary>

### [`v0.38.0`](https://github.com/kubernetes-sigs/headlamp/releases/tag/v0.38.0): 0.38.0

[Compare Source](https://github.com/kubernetes-sigs/headlamp/compare/v0.37.0...v0.38.0)

#### ✨ Enhancements:

- Add custom local port input dialog for port forwarding. Thanks [@&#8203;jaehanbyun](https://github.com/jaehanbyun)
- Add concept of "shipped", "user-installed", and "dev" plugin types
- Add ability to specify priorityClassName in the Headlamp Helm chart. This allows setting the relative priority of Headlamp compared to other Pods when Headlamp is deployed in a cluster. Thanks [@&#8203;mcg1024](https://github.com/mcg1024)

##### Custom Local Port Forwarding Dialog

A custom local port selection dialog for port forwarding was added. Allowing people to specify their preferred local ports (e.g., 8080) instead of only using auto-assigned ports.

<https://github.com/user-attachments/assets/27cab13c-773d-421a-bf9e-1678732aa54c>

##### Enhanced Plugin System to Handle Different Types of Plugins Better

The plugin loading system has been enhanced. It now differentiates plugins by type (shipped with app/user-installed/development) and loads them according to a priority-based system. Development plugins have the highest priority, followed by user-installed, then shipped plugins. When multiple versions of the same plugin exist, only the highest priority enabled version is loaded.

The UI has been enhanced to show the different types of plugins. To also make finding where they are easier.

<img width="935" height="817" alt="New Plugins setting view showing the different types of plugins. It shows if they are loaded, if they are user, dev, or shipped plugins." src="https://github.com/user-attachments/assets/957ae036-fd0b-489a-9786-f9a6a590ac06" />

#### 🐞 Bug fixes

- Fix useAccessToken arg not set when using external secrets in Helm chart. Thanks [@&#8203;rickliujh](https://github.com/rickliujh)
- Fix missing PKCE arg in Helm charts. Thanks [@&#8203;rayshoo](https://github.com/rayshoo)
- Fix Add Local Cluster Provider link on Add Cluster view
- Fix so username is displayed in Top Bar for when Headlamp is behind an Oauth2Proxy
- Remove extra 1px border on top of the Side Bar
- Improve headlamp port clashes for the Headlamp app when it is starting and ports are already used
- Fix reloading of app after plugin install when using Windows app

##### Port Clashes Fixed in Headlamp Desktop App

Before Headlamp tried to listen on port 4466 with the desktop app. If that port was already used then Headlamp would just try to use that existing port. This was problematic of course if there are other apps using that port, or other users on the same machine using that port. Now Headlamp will use another port if that port is already used.

#### 💻 Development

- Remove our homebrew and winget package creation automation, because they are handled by them now
- Add action to push chocolatey package automatically
- Update dependencies for security updates
- Fix storybook theme for plugins, and use correct new logo in storybook for plugins

##### For Plugin Developers: Find Plugin Folder in the UI

To make it easier for plugin developers to find where on the local file system plugins are there is an open plugin folder button. In Plugin Settings select the plugin being developed, and then click the open folder icon to open the plugin path with the Desktop file Finder.

<img width="942" height="434" alt="Shows the UI for finding the plugin folder and the open folder where the plugin is" src="https://github.com/user-attachments/assets/e7fe6c1e-ef30-47e1-b66d-f319fe3e6b47" />

#### 📖 Documentation

- Improve [Projects Learn section](https://headlamp.dev/docs/latest/learn/projects/) in docs
- Add [Local Cluster Learn section](https://headlamp.dev/docs/latest/learn/local-cluster/) to docs
- Fix missing commas in OIDC scopes in some OIDC installation tutorials

<!-- end-release-notes -->

**Full Changelog**: <https://github.com/kubernetes-sigs/headlamp/compare/v0.37.0...v0.38.0>

**Container image:** 🐳  [ghcr.io/headlamp-k8s/headlamp:v0.38.0](https://github.com/orgs/headlamp-k8s/packages/container/package/headlamp)

**Desktop Apps:**

🐧  [Flatpak / Linux (AMD64)](https://flathub.org/apps/details/io.kinvolk.Headlamp)
🐧  Linux AppImage [AMD64](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/Headlamp-0.38.0-linux-x64.AppImage), [ARM64](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/Headlamp-0.38.0-linux-arm64.AppImage),  [ARMv7l](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/Headlamp-0.38.0-linux-armv7l.AppImage)
🐧 Linux Tarball [AMD64](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/Headlamp-0.38.0-linux-x64.tar.gz), [ARM64](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/Headlamp-0.38.0-linux-arm64.tar.gz), [ARMv7l](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/Headlamp-0.38.0-linux-armv7l.tar.gz)
🐧 Debian / Linux [AMD64](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/headlamp_0.38.0-1_amd64.deb)
:green\_apple:  [Mac (AMD64)](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/Headlamp-0.38.0-mac-x64.dmg)
:green\_apple: [Mac (ARM/M1)](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/Headlamp-0.38.0-mac-arm64.dmg)
:blue\_square:  [Windows (AMD64)](https://github.com/kubernetes-sigs/headlamp/releases/download/v0.38.0/Headlamp-0.38.0-win-x64.exe)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi41LjAiLCJ1cGRhdGVkSW5WZXIiOiI0Mi41LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImNoYXJ0Il19-->

Reviewed-on: #2019
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

.gitea/workflows/lint-test-docker-pull.yaml

@@ -1,13 +1,6 @@
 name: lint-test-docker
 
 on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'hosts/**'
-      - ! 'hosts/archive'
-
   pull_request:
     branches:
       - main
@@ -77,3 +70,18 @@ jobs:
             echo ">> Linting $compose ..."
             npx dclint $compose
           done
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Test Failure - Infrastructure'
+          priority: 3
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: 'Docker linting on Pull Request for Infrastructure has failed!'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-docker-pull.yaml", "clear": true}]'
+          image: true

.gitea/workflows/lint-test-docker-push.yaml

@@ -0,0 +1,75 @@
+name: lint-test-docker
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'hosts/**'
+      - ! 'hosts/archive'
+
+jobs:
+  docker-lint:
+    runs-on: ubuntu-js
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+
+      - name: Lint Docker Compose
+        run: |
+          set -e  # Exit immediately if a command exits with a non-zero status.
+
+          TARGET_BRANCH="origin/main"
+          echo ">> Target branch for diff is: $TARGET_BRANCH"
+
+          CHANGED_FILES=$(git diff --name-only "$TARGET_BRANCH" -- 'hosts/**')
+
+          echo ">> Found changed files:"
+          echo "$CHANGED_FILES"
+
+          # For each changed file, find its parent chart directory (the one with compose.yaml).
+          # Then, create a unique list of those directories.
+          CHANGED_COMPOSE=$(echo "$CHANGED_FILES" | while read -r file; do
+            dir=$(dirname "$file")
+            while [[ "$dir" != "." && ! -f "$dir/compose.yaml" ]]; do
+              dir=$(dirname "$dir")
+            done
+            if [[ "$dir" != "." ]]; then
+              echo "$dir"
+            fi
+          done | sort -u)
+
+          if [[ -z "$CHANGED_COMPOSE" ]]; then
+            echo ">> Could not determine changed compose files. This will happen if only files outside a compose file were changed."
+            exit 0
+          fi
+
+          echo ">> Running dclint on changed compose files:"
+          echo "$CHANGED_COMPOSE"
+
+          echo "$CHANGED_COMPOSE" | while read -r compose; do
+            echo ">> Linting $compose ..."
+            npx dclint $compose
+          done
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Test Failure - Infrastructure'
+          priority: 4
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: 'Docker linting on Push for Infrastructure has failed!'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-docker-push.yaml", "clear": true}]'
+          image: true

.gitea/workflows/lint-test-helm-pull.yaml

@@ -1,13 +1,6 @@
 name: lint-test-helm
 
 on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'clusters/**'
-      - ! 'clusters/*/archive'
-
   pull_request:
     branches:
       - main
@@ -80,3 +73,18 @@ jobs:
             echo ">> Linting $chart..."
             helm lint "$chart"
           done
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Test Failure - Infrastructure'
+          priority: 3
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: 'Helm linting on Pull Request for Infrastructure has failed!'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-helm-pull.yaml", "clear": true}]'
+          image: true

.gitea/workflows/lint-test-helm-push.yaml

@@ -0,0 +1,78 @@
+name: lint-test-helm
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'clusters/**'
+      - ! 'clusters/*/archive'
+
+jobs:
+  helm-lint:
+    runs-on: ubuntu-js
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+          version: latest
+
+      - name: Lint Helm Chart
+        run: |
+          set -e  # Exit immediately if a command exits with a non-zero status.
+
+          TARGET_BRANCH="origin/main"
+          echo ">> Target branch for diff is: $TARGET_BRANCH"
+
+          CHANGED_FILES=$(git diff --name-only "$TARGET_BRANCH" -- 'clusters/**')
+
+          echo ">> Found changed files:"
+          echo "$CHANGED_FILES"
+
+          # For each changed file, find its parent chart directory (the one with Chart.yaml).
+          # Then, create a unique list of those directories.
+          CHANGED_CHARTS=$(echo "$CHANGED_FILES" | while read -r file; do
+            dir=$(dirname "$file")
+            while [[ "$dir" != "." && ! -f "$dir/Chart.yaml" ]]; do
+              dir=$(dirname "$dir")
+            done
+            if [[ "$dir" != "." ]]; then
+              echo "$dir"
+            fi
+          done | sort -u)
+
+          if [[ -z "$CHANGED_CHARTS" ]]; then
+            echo ">> Could not determine changed charts. This could happen if only files outside a chart were changed."
+            exit 0
+          fi
+
+          echo ">> Running helm lint on changed charts:"
+          echo "$CHANGED_CHARTS"
+
+          echo "$CHANGED_CHARTS" | while read -r chart; do
+            echo ">> Building dependency for "$chart" ..."
+            helm dependency build "$chart"
+            echo ">> Linting $chart..."
+            helm lint "$chart"
+          done
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Test Failure - Infrastructure'
+          priority: 4
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: 'Helm linting on Push for Infrastructure has failed!'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-helm-push.yaml", "clear": true}]'
+          image: true

clusters/cl01tl/applications/element-web/Chart.yaml

@@ -17,7 +17,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: element-web
-    version: 1.4.22
+    version: 1.4.23
     repository: https://ananace.gitlab.io/charts
   - name: cloudflared
     alias: cloudflared

clusters/cl01tl/applications/homepage/values.yaml

@@ -522,6 +522,12 @@ homepage:
                   href: https://vault.alexlebens.net
                   siteMonitor: http://vault.vault:8200
                   statusStyle: dot
+              - Backups:
+                  icon: sh-backrest-light.webp
+                  description: Backrest
+                  href: https://backrest.alexlebens.net
+                  siteMonitor: http://backrest.backrest:80
+                  statusStyle: dot
           - TV Shows:
               - Sonarr:
                   icon: sh-sonarr.webp

clusters/cl01tl/applications/libation/values.yaml

@@ -16,7 +16,7 @@ libation:
         main:
           image:
             repository: rmcrackan/libation
-            tag: 12.7.0
+            tag: 12.7.1
             pullPolicy: IfNotPresent
           env:
             - name: SLEEP_TIME

clusters/cl01tl/applications/lidatube/values.yaml

@@ -13,7 +13,7 @@ lidatube:
         main:
           image:
             repository: thewicklowwolf/lidatube
-            tag: 0.2.40
+            tag: 0.2.41
             pullPolicy: IfNotPresent
           env:
             - name: PUID

clusters/cl01tl/applications/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:d477c0460cc06afa57541f24c7adcae3846303a125c3ae785b9893c9c2c2186f
+            tag: latest@sha256:7b763e6a95da4c5d320ba48c886fa0cae8745337f7510cdf216e96eabdbe0e65
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -43,7 +43,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:d477c0460cc06afa57541f24c7adcae3846303a125c3ae785b9893c9c2c2186f
+            tag: latest@sha256:7b763e6a95da4c5d320ba48c886fa0cae8745337f7510cdf216e96eabdbe0e65
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL

clusters/cl01tl/deployment/argocd/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 9.1.0
+    version: 9.1.2
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 appVersion: 3.0.0

clusters/cl01tl/management/headlamp/Chart.yaml

@@ -14,7 +14,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: headlamp
-    version: 0.37.0
+    version: 0.38.0
     repository: https://kubernetes-sigs.github.io/headlamp/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/headlamp.png
 appVersion: 0.37.0

clusters/cl01tl/management/komodo/values.yaml

@@ -95,7 +95,7 @@ komodo:
         main:
           image:
             repository: ghcr.io/ferretdb/ferretdb
-            tag: 2.7.0
+            tag: 2.5.0
             pullPolicy: IfNotPresent
           env:
             - name: FERRETDB_POSTGRESQL_URL

clusters/cl01tl/monitoring/kube-prometheus-stack/Chart.yaml

@@ -19,7 +19,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 79.2.1
+    version: 79.4.1
     repository: oci://ghcr.io/prometheus-community/charts
   - name: app-template
     alias: ntfy-alertmanager

clusters/cl01tl/platform/gitea/values.yaml

@@ -212,7 +212,7 @@ backup:
         s3-backup:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:33181474927de824a1d209a7bda39e877e2ce78e1aa34d2e7acdf490ef1b7601
+            tag: latest@sha256:4252b3d04c18dc7fec2117259ab5dc0e51cb46b8719e661762222b44f6559189
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -236,7 +236,7 @@ backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:33181474927de824a1d209a7bda39e877e2ce78e1aa34d2e7acdf490ef1b7601
+            tag: latest@sha256:4252b3d04c18dc7fec2117259ab5dc0e51cb46b8719e661762222b44f6559189
             pullPolicy: IfNotPresent
           command:
             - /bin/sh

clusters/cl01tl/platform/matrix-synapse/Chart.yaml

@@ -29,7 +29,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: matrix-synapse
-    version: 3.12.13
+    version: 3.12.14
     repository: https://ananace.gitlab.io/charts
   - name: app-template
     alias: matrix-hookshot

clusters/cl01tl/platform/vault/values.yaml

@@ -198,7 +198,7 @@ snapshot:
         s3-backup:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:33181474927de824a1d209a7bda39e877e2ce78e1aa34d2e7acdf490ef1b7601
+            tag: latest@sha256:4252b3d04c18dc7fec2117259ab5dc0e51cb46b8719e661762222b44f6559189
             pullPolicy: IfNotPresent
           command:
             - /bin/sh

clusters/cl01tl/services/blocky/values.yaml

@@ -109,6 +109,7 @@ blocky:
               argocd                          IN      CNAME   traefik-cl01tl
               audiobookshelf                  IN      CNAME   traefik-cl01tl
               authentik                       IN      CNAME   traefik-cl01tl
+              backrest                        IN      CNAME   traefik-cl01tl
               bazarr                          IN      CNAME   traefik-cl01tl
               calibre                         IN      CNAME   traefik-cl01tl
               calibre-downloader              IN      CNAME   traefik-cl01tl

clusters/cl01tl/services/generic-device-plugin/Chart.yaml

@@ -15,6 +15,6 @@ maintainers:
 dependencies:
   - name: generic-device-plugin
     repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-    version: 0.18.0
+    version: 0.20.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: 1.0.0

clusters/cl01tl/services/talos/values.yaml

@@ -73,7 +73,7 @@ etcd-backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:33181474927de824a1d209a7bda39e877e2ce78e1aa34d2e7acdf490ef1b7601
+            tag: latest@sha256:4252b3d04c18dc7fec2117259ab5dc0e51cb46b8719e661762222b44f6559189
             pullPolicy: IfNotPresent
           command:
             - /bin/sh

clusters/cl01tl/standalone/cilium/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: cilium
-    version: 1.18.3
+    version: 1.18.4
     repository: https://helm.cilium.io/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/cilium.png
 appVersion: 1.17.3

clusters/cl01tl/storage/backrest/Chart.yaml

@@ -0,0 +1,21 @@
+apiVersion: v2
+name: backrest
+version: 1.0.0
+description: backrest
+keywords:
+  - backrest
+  - backup
+home: https://wiki.alexlebens.dev/
+sources:
+  - https://github.com/garethgeorge/backrest
+  - https://hub.docker.com/r/garethgeorge/backrest
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: backrest
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.4.0
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/backrest.png
+appVersion: v1.10.1

clusters/cl01tl/storage/backrest/templates/http-route.yaml

@@ -0,0 +1,28 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-route-backrest
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: http-route-backrest
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+  hostnames:
+    - backrest.alexlebens.net
+  rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: /
+      backendRefs:
+        - group: ''
+          kind: Service
+          name: backrest
+          port: 80
+          weight: 100

clusters/cl01tl/storage/backrest/templates/persistent-volume-claim.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: backrest-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: backrest-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  volumeName: backrest-nfs-storage
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi

clusters/cl01tl/storage/backrest/templates/persistent-volume.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: backrest-nfs-storage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: backrest-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: nfs-client
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    path: /volume2/Storage
+    server: synologybond.alexlebens.net
+  mountOptions:
+    - vers=4
+    - minorversion=1
+    - noac

clusters/cl01tl/storage/backrest/templates/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: garage-ps10rp
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: garage-ps10rp
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+  annotations:
+    tailscale.com/tailnet-fqdn: garage-ps10rp.boreal-beaufort.ts.net
+spec:
+  externalName: placeholder
+  type: ExternalName

clusters/cl01tl/storage/backrest/values.yaml

@@ -0,0 +1,77 @@
+backrest:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      containers:
+        main:
+          image:
+            repository: garethgeorge/backrest
+            tag: v1.10.1
+            pullPolicy: IfNotPresent
+          env:
+            - name: TZ
+              value: America/Chicago
+            - name: BACKREST_DATA
+              value: /data
+            - name: BACKREST_CONFIG
+              value: /config/config.json
+            - name: XDG_CACHE_HOME
+              value: /cache
+            - name: TMPDIR
+              value: /tmp
+          resources:
+            requests:
+              cpu: 10m
+              memory: 256Mi
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 9898
+          protocol: TCP
+  persistence:
+    data:
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      retain: true
+      advancedMounts:
+        main:
+          main:
+            - path: /data
+              readOnly: false
+    config:
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 1Gi
+      retain: true
+      advancedMounts:
+        main:
+          main:
+            - path: /config
+              readOnly: false
+    cache:
+      type: emptyDir
+      advancedMounts:
+        main:
+          main:
+            - path: /cache
+              readOnly: false
+    tmp:
+      type: emptyDir
+      advancedMounts:
+        main:
+          main:
+            - path: /tmp
+              readOnly: false
+    storage:
+      existingClaim: backrest-nfs-storage
+      advancedMounts:
+        main:
+          main:
+            - path: /userdata
+              readOnly: true

clusters/cl01tl/storage/garage/values.yaml

@@ -52,10 +52,13 @@ garage:
 
           metadata_dir = "/var/lib/garage/meta"
           data_dir = "/var/lib/garage/data"
+          metadata_snapshots_dir = "/var/lib/garage/snapshots"
 
-          db_engine = "sqlite"
+          db_engine = "lmdb"
 
-          compression_level = 1
+          metadata_auto_snapshot_interval = "6h"
+
+          compression_level = 3
 
           rpc_bind_addr = "[::]:3901"
           rpc_public_addr = "127.0.0.1:3901"
@@ -119,6 +122,16 @@ garage:
               readOnly: true
               mountPropagation: None
               subPath: garage.toml
+    db:
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      retain: true
+      advancedMounts:
+        main:
+          main:
+            - path: /var/lib/garage/meta
+              readOnly: false
     data:
       storageClass: synology-iscsi-delete
       accessMode: ReadWriteOnce
@@ -127,5 +140,15 @@ garage:
       advancedMounts:
         main:
           main:
-            - path: /var/lib/garage
+            - path: /var/lib/garage/data
+              readOnly: false
+    snapshots:
+      storageClass: synology-iscsi-delete
+      accessMode: ReadWriteOnce
+      size: 50Gi
+      retain: true
+      advancedMounts:
+        main:
+          main:
+            - path: /var/lib/garage/snapshots
               readOnly: false

clusters/cl01tl/storage/pgadmin/values.yaml

@@ -28,7 +28,7 @@ pgadmin4:
             runAsGroup: 5050
           image:
             repository: dpage/pgadmin4
-            tag: "9.9"
+            tag: "9.10"
             pullPolicy: IfNotPresent
           env:
             - name: PGADMIN_CONFIG_ENHANCED_COOKIE_PROTECTION

clusters/cl01tl/storage/whodb/values.yaml

@@ -8,7 +8,7 @@ whodb:
         main:
           image:
             repository: clidey/whodb
-            tag: 0.71.0
+            tag: 0.72.0
             pullPolicy: IfNotPresent
           env:
             - name: WHODB_OLLAMA_HOST

hosts/ps08rp/blocky/config.yml

@@ -85,6 +85,7 @@ customDNS:
     argocd                          IN      CNAME   traefik-cl01tl
     audiobookshelf                  IN      CNAME   traefik-cl01tl
     authentik                       IN      CNAME   traefik-cl01tl
+    backrest                        IN      CNAME   traefik-cl01tl
     bazarr                          IN      CNAME   traefik-cl01tl
     calibre                         IN      CNAME   traefik-cl01tl
     calibre-downloader              IN      CNAME   traefik-cl01tl

hosts/ps09rp/blocky/config.yml

@@ -85,6 +85,7 @@ customDNS:
     argocd                          IN      CNAME   traefik-cl01tl
     audiobookshelf                  IN      CNAME   traefik-cl01tl
     authentik                       IN      CNAME   traefik-cl01tl
+    backrest                        IN      CNAME   traefik-cl01tl
     bazarr                          IN      CNAME   traefik-cl01tl
     calibre                         IN      CNAME   traefik-cl01tl
     calibre-downloader              IN      CNAME   traefik-cl01tl