Merge branch 'tmp/secrets-5' of https://gitea.alexlebens.net/alexlebens/infrastructure into tmp/secrets-5

.gitea/workflows/lint-test-helm.yaml

@@ -169,10 +169,9 @@ jobs:
 
           echo ">> Running linting on changed charts ..."
 
-          lint_chart() {
-            local DIR="$1"
-            local CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
-            local CHART_NAME=$(basename "${CHART_PATH}")
+          for DIR in ${CHANGED_CHARTS}; do
+            CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
+            CHART_NAME=$(basename "${CHART_PATH}")
 
             if [ -f "${CHART_PATH}/Chart.yaml" ]; then
               echo ""
@@ -183,8 +182,15 @@ jobs:
               echo ">> Linting helm chart ${CHART_NAME} ..."
 
               if ! helm lint "${CHART_PATH}" --namespace "default"; then
-                echo "${DIR}" > ".failed_chart_${CHART_NAME}"
-                return 1
+                EXIT_CODE=1
+
+                if [ -z "${FAILED_CHARTS}" ]; then
+                  FAILED_CHARTS="${DIR}"
+
+                else
+                  FAILED_CHARTS="${FAILED_CHARTS}, ${DIR}"
+
+                fi
               fi
 
             else
@@ -192,20 +198,8 @@ jobs:
               echo ">> Directory ${CHART_PATH} does not contain a Chart.yaml. Skipping ..."
 
             fi
-          }
 
-          export -f lint_chart
-          export CLUSTER
-
-          for DIR in ${CHANGED_CHARTS}; do
-            echo "${DIR}"
-          done | xargs -P 4 -I {} bash -c 'OUT=$(lint_chart "$@" 2>&1); printf "%s\n" "$OUT"' _ {}
-
-          if ls .failed_chart_* 1> /dev/null 2>&1; then
-            EXIT_CODE=1
-            FAILED_CHARTS=$(cat .failed_chart_* | paste -sd ',' - | sed 's/,/, /g')
-            rm -f .failed_chart_*
-          fi
+          done
 
           echo ""
           echo "----"
@@ -335,9 +329,8 @@ jobs:
           EXIT_CODE=0
           FAILED_CHARTS=""
 
-          validate_chart() {
-            local DIR="$1"
-            local CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
+          for DIR in ${CHANGED_CHARTS}; do
+            CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
             echo ""
             echo ">> Validating: ${DIR}"
 
@@ -350,23 +343,18 @@ jobs:
                 -strict \
                 -summary; then
 
-              echo "${DIR}" > ".failed_chart_${DIR}"
-              return 1
+              EXIT_CODE=1
+
+              if [ -z "${FAILED_CHARTS}" ]; then
+                FAILED_CHARTS="${DIR}"
+
+              else
+                FAILED_CHARTS="${FAILED_CHARTS}, ${DIR}"
+
+              fi
             fi
-          }
 
-          export -f validate_chart
-          export CLUSTER SCHEMA_LOCATIONS
-
-          for DIR in ${CHANGED_CHARTS}; do
-            echo "${DIR}"
-          done | xargs -P 4 -I {} bash -c 'OUT=$(validate_chart "$@" 2>&1); printf "%s\n" "$OUT"' _ {}
-
-          if ls .failed_chart_* 1> /dev/null 2>&1; then
-            EXIT_CODE=1
-            FAILED_CHARTS=$(cat .failed_chart_* | paste -sd ',' - | sed 's/,/, /g')
-            rm -f .failed_chart_*
-          fi
+          done
 
           echo ""
           echo "----"

.gitea/workflows/renovate.yaml

@@ -12,8 +12,8 @@ on:
 
 jobs:
   renovate:
-    runs-on: ubuntu-js
-    container: ghcr.io/renovatebot/renovate:43.170.3@sha256:df5d352e536fd69b4fbc96ccef05884ff35adf3cf01becda396b5f17d8f54272
+    runs-on: ubuntu-latest
+    container: ghcr.io/renovatebot/renovate:43.139.6@sha256:2ed9f867ea7a7d2448847ce704f78af09e9b881c63f843a1aa0f590691737c42
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

clusters/cl01tl/helm/actual/Chart.lock

@@ -1,9 +1,6 @@
 dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.0
-- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.0.0
-digest: sha256:9468b3406ab0d91bf44a1a940eca8648782f3519d0c683d21b33e16c258c9175
-generated: "2026-05-08T13:03:04.397940703Z"
+  version: 4.6.2
+digest: sha256:1c04c187e6cf768117f7f91f3a3b082937ad5854c1cf6a681ad7c02687cd543d
+generated: "2026-04-18T20:15:22.778699-05:00"

clusters/cl01tl/helm/actual/Chart.yaml

@@ -17,11 +17,11 @@ dependencies:
   - name: app-template
     alias: actual
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.0
-  - name: volsync-target
-    alias: volsync-target-data
-    version: 2.0.0
-    repository: oci://harbor.alexlebens.net/helm-charts
+    version: 4.6.2
+  # - name: volsync-target
+  #   alias: volsync-target-data
+  #   version: 0.8.0
+  #   repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/actual-budget.png
 # renovate: datasource=github-releases depName=actualbudget/actual
-appVersion: 26.5.0
+appVersion: 26.4.0

clusters/cl01tl/helm/actual/values.yaml

@@ -8,7 +8,7 @@ actual:
         main:
           image:
             repository: ghcr.io/actualbudget/actual
-            tag: 26.5.0@sha256:b733ae30c70a66dc4d03577526e53575a0c04eab4f3ab6ace30934776251058c
+            tag: 26.4.0@sha256:b0e732e2c41b3dc468a71548e88ef76d3f0c157fc43d15fa05d14ec1c5747e1e
           env:
             - name: ACTUAL_PORT
               value: 5006

clusters/cl01tl/helm/argocd/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 9.5.11
-digest: sha256:78e2094dde7b3d0326da14640dbc012ce6e6e899f23270dc4d9a13b168c1ef89
-generated: "2026-05-02T00:45:16.287556363Z"
+  version: 9.5.2
+digest: sha256:5d9e6405ee944bf94df6af247164ebb9b8899144853b9a7eafabe8606affe84e
+generated: "2026-04-19T19:53:40.43789-05:00"

clusters/cl01tl/helm/argocd/Chart.yaml

@@ -13,8 +13,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 9.5.12
+    version: 9.5.2
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-cd
-appVersion: v3.4.1
+appVersion: v3.3.7

clusters/cl01tl/helm/argocd/templates/prometheus-rule.yaml

@@ -1,108 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: haproxy
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: haproxy
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  groups:
-    - name: EmbeddedExporter
-      rules:
-        - alert: HAProxyHighHTTP4xxErrorRateBackend
-          expr: ((sum by (proxy) (rate(haproxy_server_http_responses_total{code="4xx"}[1m])) / sum by (proxy) (rate(haproxy_server_http_responses_total[1m]))) * 100) > 5 and sum by (proxy) (rate(haproxy_server_http_responses_total[1m])) > 0
-          for: 1m
-          labels:
-            severity: critical
-          annotations:
-            summary: HAProxy high HTTP 4xx error rate backend (instance {{ `{{ $labels.instance }}` }})
-            description: "Too many HTTP requests with status 4xx (> 5%) on backend {{ `{{ $labels.proxy }}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyHighHTTP5xxErrorRateBackend
-          expr: ((sum by (proxy) (rate(haproxy_server_http_responses_total{code="5xx"}[1m])) / sum by (proxy) (rate(haproxy_server_http_responses_total[1m]))) * 100) > 5 and sum by (proxy) (rate(haproxy_server_http_responses_total[1m])) > 0
-          for: 1m
-          labels:
-            severity: critical
-          annotations:
-            summary: HAProxy high HTTP 5xx error rate backend (instance {{ `{{ $labels.instance }}` }})
-            description: "Too many HTTP requests with status 5xx (> 5%) on backend {{ `{{ $labels.proxy }}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyHighHTTP4xxErrorRateServer
-          expr: ((sum by (server) (rate(haproxy_server_http_responses_total{code="4xx"}[1m])) / sum by (server) (rate(haproxy_server_http_responses_total[1m]))) * 100) > 5 and sum by (server) (rate(haproxy_server_http_responses_total[1m])) > 0
-          for: 1m
-          labels:
-            severity: critical
-          annotations:
-            summary: HAProxy high HTTP 4xx error rate server (instance {{ `{{ $labels.instance }}` }})
-            description: "Too many HTTP requests with status 4xx (> 5%) on server {{ `{{ $labels.server }}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyHighHTTP5xxErrorRateServer
-          expr: ((sum by (server) (rate(haproxy_server_http_responses_total{code="5xx"}[1m])) / sum by (server) (rate(haproxy_server_http_responses_total[1m]))) * 100) > 5 and sum by (server) (rate(haproxy_server_http_responses_total[1m])) > 0
-          for: 1m
-          labels:
-            severity: critical
-          annotations:
-            summary: HAProxy high HTTP 5xx error rate server (instance {{ `{{ $labels.instance }}` }})
-            description: "Too many HTTP requests with status 5xx (> 5%) on server {{ `{{ $labels.server }}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyServerResponseErrors
-          expr: (sum by (server) (rate(haproxy_server_response_errors_total[1m])) / sum by (server) (rate(haproxy_server_http_responses_total[1m]))) * 100 > 5 and sum by (server) (rate(haproxy_server_http_responses_total[1m])) > 0
-          for: 1m
-          labels:
-            severity: critical
-          annotations:
-            summary: HAProxy server response errors (instance {{ `{{ $labels.instance }}` }})
-            description: "Too many response errors to {{ `{{ $labels.server }}` }} server (> 5%).\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyBackendConnectionErrors
-          expr: (sum by (proxy) (rate(haproxy_backend_connection_errors_total[1m]))) > 100
-          for: 1m
-          labels:
-            severity: critical
-          annotations:
-            summary: HAProxy backend connection errors (instance {{ `{{ $labels.instance }}` }})
-            description: "Too many connection errors to {{ `{{ $labels.proxy }}` }} backend (> 100 req/s). Request throughput may be too high.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyServerConnectionErrors
-          expr: (sum by (proxy) (rate(haproxy_server_connection_errors_total[1m]))) > 100
-          for: 0m
-          labels:
-            severity: critical
-          annotations:
-            summary: HAProxy server connection errors (instance {{ `{{ $labels.instance }}` }})
-            description: "Too many connection errors to {{ `{{ $labels.proxy }}` }} (> 100 req/s). Request throughput may be too high.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyBackendMaxActiveSession>80%
-          expr: (haproxy_backend_current_sessions / haproxy_backend_limit_sessions * 100) > 80 and haproxy_backend_limit_sessions > 0
-          for: 2m
-          labels:
-            severity: warning
-          annotations:
-            summary: HAProxy backend max active session > 80% (instance {{ `{{ $labels.instance }}` }})
-            description: "Session limit from backend {{ `{{ $labels.proxy }}` }} reached 80% of limit - {{ `{{ $value | printf \"%.2f\"}}` }}%\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyPendingRequests
-          expr: sum by (proxy) (haproxy_backend_current_queue) > 0
-          for: 2m
-          labels:
-            severity: warning
-          annotations:
-            summary: HAProxy pending requests (instance {{ `{{ $labels.instance }}` }})
-            description: "Some HAProxy requests are pending on {{ `{{ $labels.proxy }}` }} - {{ `{{ $value | printf \"%.2f\"}}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyRetryHigh
-          expr: sum by (proxy) (rate(haproxy_backend_retry_warnings_total[1m])) > 10
-          for: 2m
-          labels:
-            severity: warning
-          annotations:
-            summary: HAProxy retry high (instance {{ `{{ $labels.instance }}` }})
-            description: "High rate of retry on {{ `{{ $labels.proxy }}` }} - {{ `{{ $value | printf \"%.2f\"}}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyFrontendSecurityBlockedRequests
-          expr: sum by (proxy) (rate(haproxy_frontend_denied_connections_total[2m])) > 10
-          for: 2m
-          labels:
-            severity: warning
-          annotations:
-            summary: HAProxy frontend security blocked requests (instance {{ `{{ $labels.instance }}` }})
-            description: "HAProxy is blocking requests for security reason\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyServerHealthcheckFailure
-          expr: increase(haproxy_server_check_failures_total[1m]) > 2
-          for: 0m
-          labels:
-            severity: warning
-          annotations:
-            summary: HAProxy server healthcheck failure (instance {{ `{{ $labels.instance }}` }})
-            description: "Some server healthcheck are failing on {{ `{{ $labels.server }}` }} ({{ `{{ $value }}` }} in the last 1m)\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"

clusters/cl01tl/helm/argocd/values.yaml

@@ -91,7 +91,7 @@ argo-cd:
     enabled: true
     image:
       repository: redis
-      tag: 8.6.3-alpine@sha256:69f2c586c8a7e9cce4ae1ee9bbaf60bc4bb5f4bb3880e4ed022b1fd758a7cab9
+      tag: 8.6.2-alpine@sha256:81b6f81d6a6c5b9019231a2e8eb10085e3a139a34f833dcc965a8a959b040b72
     persistentVolume:
       enabled: true
     redis:
@@ -103,7 +103,7 @@ argo-cd:
       enabled: true
       image:
         repository: haproxy
-        tag: 3.3.8-alpine@sha256:10690acb357180d5214c6fce59e2cefded6cc72b0f7e3febb323fea95b27e349
+        tag: 3.3.6-alpine@sha256:744be2dca649a44d490a4c565d36968d19482dd387f1bdd44c168f4322bc6b1e
       resources:
         requests:
           cpu: 5m

clusters/cl01tl/helm/audiobookshelf/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.0
+  version: 4.6.2
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.0.0
+  version: 0.8.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.0.0
-digest: sha256:57c3cc8da25c1dfc8684c5f20f804ce4642abee25cb317097ce6bd17f8bb0504
-generated: "2026-05-08T13:03:16.679363016Z"
+  version: 0.8.0
+digest: sha256:7ee4cfdf7f908401c39b3cda0cf8783b25dcb9cf93e7c911609bab9e303ec5bf
+generated: "2026-03-06T01:05:03.534042627Z"

clusters/cl01tl/helm/audiobookshelf/Chart.yaml

@@ -21,15 +21,15 @@ dependencies:
   - name: app-template
     alias: audiobookshelf
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.0
+    version: 4.6.2
   - name: volsync-target
     alias: volsync-target-config
-    version: 2.0.0
+    version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-metadata
-    version: 2.0.0
+    version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/audiobookshelf.png
 # renovate: datasource=github-releases depName=advplyr/audiobookshelf
-appVersion: 2.34.0
+appVersion: 2.33.2

clusters/cl01tl/helm/audiobookshelf/values.yaml

@@ -12,7 +12,7 @@ audiobookshelf:
         main:
           image:
             repository: ghcr.io/advplyr/audiobookshelf
-            tag: 2.34.0@sha256:4143292c530f6ac6700afd13360c04f477e4f1a81c1c97c4224b1c7e4330c5c4
+            tag: 2.33.2@sha256:a44ed89b3e845faa1f7d353f2cc89b2fcd8011737dd14075fa963cf9468da3a5
           env:
             - name: TZ
               value: America/Chicago
@@ -23,7 +23,7 @@ audiobookshelf:
         apprise-api:
           image:
             repository: ghcr.io/caronc/apprise
-            tag: v1.4.1@sha256:25e0577915c2f06233ae1dce077f05c0fc9ba4f0ea89de5aee18a32b2ee9a75c
+            tag: v1.3.3@sha256:4bfeac268ba87b8e08e308c9aa0182fe99e9501ec464027afc333d1634e65977
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/authentik/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 2026.2.2
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.2.1
+  version: 2.5.0
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-digest: sha256:72dd08c02d68bc46f396042fff5bcaa7d6ec1ebe4a93af7e5e3d073634f7b99c
-generated: "2026-05-08T05:50:16.362024891Z"
+  version: 0.6.1
+digest: sha256:22fe4d9ec592aa74cbff5596e8d900f607bd68ea14c7df70a94b4ef76727614d
+generated: "2026-04-13T20:32:12.748342469Z"

clusters/cl01tl/helm/authentik/Chart.yaml

@@ -22,14 +22,14 @@ dependencies:
     repository: https://charts.goauthentik.io/
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 3.2.1
+    version: 2.5.0
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.8.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/authentik.png
 # renovate: datasource=github-releases depName=goauthentik/authentik

clusters/cl01tl/helm/backrest/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.0
+  version: 4.6.2
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.0.0
+  version: 0.8.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.0.0
-digest: sha256:440dd48f7cb11c3f84c4543fd51dedeea511b29a96571cefdf3d42ddb988554f
-generated: "2026-05-08T13:03:29.414996636Z"
+  version: 0.8.0
+digest: sha256:f203538010828e77336f3cf39451a1072c90aeb8ece7c173a3476c49883b46d1
+generated: "2026-03-06T01:05:24.935421139Z"

clusters/cl01tl/helm/backrest/Chart.yaml

@@ -17,15 +17,15 @@ dependencies:
   - name: app-template
     alias: backrest
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.0
+    version: 4.6.2
   - name: volsync-target
     alias: volsync-target-config
-    version: 2.0.0
+    version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-data
-    version: 2.0.0
+    version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/backrest.png
 # renovate: datasource=github-releases depName=garethgeorge/backrest
-appVersion: v1.13.0
+appVersion: v1.12.1

clusters/cl01tl/helm/backrest/values.yaml

@@ -8,7 +8,7 @@ backrest:
         main:
           image:
             repository: ghcr.io/garethgeorge/backrest
-            tag: v1.13.0@sha256:9c9966b5c285ec791a6b06cb4545fa0247424d05442e12f9558b4322d9f8a15f
+            tag: v1.12.1@sha256:f4d34bd6fa985d13bdb6c01c5d8727e07708899afa9567d800808357d77b9fb0
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/bazarr/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.0
+  version: 4.6.2
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.0.0
-digest: sha256:a792d16034f5d4f2a94833480ba8700366c9b64d50443934e15033c349a28e81
-generated: "2026-05-08T13:03:41.85021952Z"
+  version: 0.8.0
+digest: sha256:ce88e4cd451613c9dbc25d285700970789ff678452ef277f3c8465dbf6157f1f
+generated: "2026-03-06T01:05:44.405374459Z"

clusters/cl01tl/helm/bazarr/Chart.yaml

@@ -21,10 +21,10 @@ dependencies:
   - name: app-template
     alias: bazarr
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.0
+    version: 4.6.2
   - name: volsync-target
     alias: volsync-target-config
-    version: 2.0.0
+    version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/bazarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-bazarr

clusters/cl01tl/helm/blocky/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.0
+  version: 4.6.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-digest: sha256:c1b8be978ecda2e495eb0a65c62f1794edd1de5c47e288abb8b53b65be4353ac
-generated: "2026-05-08T02:30:25.905416473Z"
+  version: 0.6.1
+digest: sha256:6ed3a7587906fbda581d0091ff2c29a1816b8b0b8ae40add9885e6a68b2b82ae
+generated: "2026-04-13T20:32:34.844998902Z"

clusters/cl01tl/helm/blocky/Chart.yaml

@@ -17,10 +17,10 @@ dependencies:
   - name: app-template
     alias: blocky
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.0
+    version: 4.6.2
   - name: valkey
     alias: valkey
-    version: 0.8.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/blocky.png
 # renovate: datasource=github-releases depName=0xerr0r/blocky

clusters/cl01tl/helm/blocky/values.yaml

@@ -134,7 +134,7 @@ blocky:
               komodo                          IN      CNAME   traefik-cl01tl
               languagetool                    IN      CNAME   traefik-cl01tl
               lidarr                          IN      CNAME   traefik-cl01tl
-              loki                            IN      CNAME   traefik-cl01tl
+              mail                            IN      CNAME   traefik-cl01tl
               medialyze                       IN      CNAME   traefik-cl01tl
               music-grabber                   IN      CNAME   traefik-cl01tl
               navidrome                       IN      CNAME   traefik-cl01tl
@@ -162,6 +162,7 @@ blocky:
               sonarr-4k                       IN      CNAME   traefik-cl01tl
               sonarr-anime                    IN      CNAME   traefik-cl01tl
               sparkyfitness                   IN      CNAME   traefik-cl01tl
+              stalwart                        IN      CNAME   traefik-cl01tl
               tdarr                           IN      CNAME   traefik-cl01tl
               tubearchivist                   IN      CNAME   traefik-cl01tl
               vault                           IN      CNAME   traefik-cl01tl

clusters/cl01tl/helm/cert-manager/templates/prometheus-rule.yaml

@@ -1,44 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: cert-manager
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: cert-manager
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  groups:
-    - name: EmbeddedExporter
-      rules:
-        - alert: Cert-ManagerAbsent
-          expr: absent(up{job="cert-manager"})
-          for: 10m
-          labels:
-            severity: critical
-          annotations:
-            summary: Cert-Manager absent (instance {{ `{{ $labels.instance }}` }})
-            description: "Cert-Manager has disappeared from Prometheus service discovery. New certificates will not be able to be minted, and existing ones can't be renewed until cert-manager is back.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: Cert-ManagerCertificateExpiringSoon
-          expr: avg by (exported_namespace, namespace, name) (certmanager_certificate_expiration_timestamp_seconds - time()) < (21 * 24 * 3600)
-          for: 1h
-          labels:
-            severity: warning
-          annotations:
-            summary: Cert-Manager certificate expiring soon (instance {{ `{{ $labels.instance }}` }})
-            description: "The certificate {{ `{{ $labels.name }}` }} is expiring in less than 21 days.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: Cert-ManagerCertificateNotReady
-          expr: max by (name, exported_namespace, namespace, condition) (certmanager_certificate_ready_status{condition!="True"} == 1)
-          for: 10m
-          labels:
-            severity: critical
-          annotations:
-            summary: Cert-Manager certificate not ready (instance {{ `{{ $labels.instance }}` }})
-            description: "The certificate {{ `{{ $labels.name }}` }} in namespace {{ `{{ $labels.exported_namespace }}` }} is not ready to serve traffic.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: Cert-ManagerHittingACMERateLimits
-          expr: sum by (host) (rate(certmanager_acme_client_request_count{status="429"}[5m])) > 0
-          for: 5m
-          labels:
-            severity: critical
-          annotations:
-            summary: Cert-Manager hitting ACME rate limits (instance {{ `{{ $labels.instance }}` }})
-            description: "Cert-Manager is being rate-limited by the ACME provider. Certificate issuance and renewal may be blocked for up to a week.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"

clusters/cl01tl/helm/cloudnative-pg/Chart.lock

@@ -5,11 +5,5 @@ dependencies:
 - name: plugin-barman-cloud
   repository: https://cloudnative-pg.io/charts/
   version: 0.6.0
-- name: rclone-bucket
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.1
-- name: rclone-bucket
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.1
-digest: sha256:1fcab80d6a3ba35f5d879df05aed598430e73ee5a1348a53ea3b065170175196
-generated: "2026-05-08T06:01:52.628668573Z"
+digest: sha256:48241acb753e635a01b306b90cfbce13ed3c0105a33ec7d36f159e3a7fe607f3
+generated: "2026-04-14T09:03:10.332065288Z"

clusters/cl01tl/helm/cloudnative-pg/Chart.yaml

@@ -13,7 +13,6 @@ sources:
   - https://github.com/cloudnative-pg/postgres-containers/pkgs/container/postgresql
   - https://github.com/cloudnative-pg/charts/tree/main/charts/cloudnative-pg
   - https://github.com/cloudnative-pg/charts/tree/main/charts/plugin-barman-cloud
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/rclone-bucket
 maintainers:
   - name: alexlebens
 dependencies:
@@ -23,14 +22,6 @@ dependencies:
   - name: plugin-barman-cloud
     version: 0.6.0
     repository: https://cloudnative-pg.io/charts/
-  - name: rclone-bucket
-    alias: rclone-postgres-backups-remote
-    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.8.1
-  - name: rclone-bucket
-    alias: rclone-postgres-backups-external
-    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.8.1
 icon: https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg.github.io/refs/heads/main/assets/images/hero_image.png
 # renovate: datasource=github-releases depName=cloudnative-pg/cloudnative-pg
 appVersion: 1.29.0

clusters/cl01tl/helm/cloudnative-pg/values.yaml

@@ -14,61 +14,3 @@ plugin-barman-cloud:
     requests:
       cpu: 1m
       memory: 20Mi
-rclone-postgres-backups-remote:
-  nameOverride: postgres-backups-remote-rclone
-  cronJob:
-    suspend: false
-    schedule: 30 6 * * 1
-  rclone:
-    source:
-      bucketName: postgres-backups
-    destination:
-      bucketName: postgres-backups
-  prune:
-    enabled: true
-    ageToPrune: 45d
-    include: "/cl01tl/*/*/*/base/**"
-    exclude: "**/walls/**"
-  secret:
-    externalSecret:
-      source:
-        credentials:
-          path: /garage/home-infra/postgres-backups
-        config:
-          path: /garage/config
-      destination:
-        credentials:
-          path: /garage/home-infra/postgres-backups
-        config:
-          path: /garage/config
-rclone-postgres-backups-external:
-  nameOverride: postgres-backups-external-rclone
-  cronJob:
-    suspend: false
-    schedule: 0 6 * * 1
-  rclone:
-    source:
-      bucketName: postgres-backups
-    destination:
-      bucketName: postgres-backups-775957147abfbc73
-  prune:
-    enabled: true
-    ageToPrune: 45d
-    include: "/cl01tl/*/*/*/base/**"
-    exclude: "**/walls/**"
-  secret:
-    externalSecret:
-      source:
-        credentials:
-          path: /garage/home-infra/postgres-backups
-        config:
-          path: /garage/config
-      destination:
-        credentials:
-          path: /backblaze/home-infra/postgres-backups
-          keyIdProperty: AWS_ACCESS_KEY_ID
-          secretKeyProperty: AWS_SECRET_ACCESS_KEY
-          regionProperty: AWS_REGION
-        config:
-          path: /backblaze/config
-          endpointProperty: ENDPOINT

clusters/cl01tl/helm/coredns/Chart.yaml

@@ -8,7 +8,6 @@ keywords:
 home: https://docs.alexlebens.dev/applications/coredns/
 sources:
   - https://github.com/coredns/coredns
-  - https://explore.ggcr.dev/?repo=registry.k8s.io%2Fcoredns%2Fcoredns
   - https://github.com/coredns/helm
 maintainers:
   - name: alexlebens
@@ -18,4 +17,4 @@ dependencies:
     repository: https://coredns.github.io/helm
 icon: https://raw.githubusercontent.com/coredns/coredns.io/refs/heads/master/static/images/favicon.png
 # renovate: datasource=github-releases depName=coredns/coredns
-appVersion: v1.14.3
+appVersion: v1.14.2

clusters/cl01tl/helm/coredns/values.yaml

@@ -1,7 +1,7 @@
 coredns:
   image:
-    repository: coredns/coredns
-    tag: 1.14.3@sha256:b21d26b915e10acb5bc78715c1e8b6047ab2675389b2bcc18b3a6499d90e74c0
+    repository: registry.k8s.io/coredns/coredns
+    tag: v1.14.2@sha256:e7e6440cfd1e919280958f5b5a6ab2b184d385bba774c12ad2a9e1e4183f90d9
   replicaCount: 3
   resources:
     limits:

clusters/cl01tl/helm/dawarich/Chart.lock

@@ -1,21 +1,21 @@
 dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.0
+  version: 4.6.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: valkey
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.6.1
+- name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.0.0
+  version: 0.8.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.0.0
-- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.0.0
-digest: sha256:0d0edd3f24d5ae14aa81d31cea6ea065527e4220644235d479b7b079ac5484d8
-generated: "2026-05-08T13:03:53.533776244Z"
+  version: 0.8.0
+digest: sha256:6ece439d5549b7d7ccd75053846bb9b2e8f9798a2e2163eac6f62bf5cf222587
+generated: "2026-04-13T20:32:54.380897459Z"

clusters/cl01tl/helm/dawarich/Chart.yaml

@@ -19,27 +19,27 @@ dependencies:
   - name: app-template
     alias: dawarich
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.0
+    version: 4.6.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.8.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-storage
-    version: 2.0.0
+    version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-public
-    version: 2.0.0
+    version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-watched
-    version: 2.0.0
+    version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/dawarich.png
 # renovate: datasource=github-releases depName=Freika/dawarich
-appVersion: 1.7.5
+appVersion: 1.6.1

clusters/cl01tl/helm/dawarich/templates/external-secret.yaml

@@ -15,18 +15,6 @@ spec:
       remoteRef:
         key: /cl01tl/dawarich/key
         property: key
-    - secretKey: otp-primary-key
-      remoteRef:
-        key: /cl01tl/dawarich/key
-        property: otp-primary-key
-    - secretKey: otp-deterministic-key
-      remoteRef:
-        key: /cl01tl/dawarich/key
-        property: otp-deterministic-key
-    - secretKey: otp-derivation-salt
-      remoteRef:
-        key: /cl01tl/dawarich/key
-        property: otp-derivation-salt
 
 ---
 apiVersion: external-secrets.io/v1

clusters/cl01tl/helm/dawarich/values.yaml

@@ -8,7 +8,7 @@ dawarich:
         main:
           image:
             repository: freikin/dawarich
-            tag: 1.7.5@sha256:dceef4bf7bd5e6a842d61cdd2a82440a0db34f70dc766e02b0b3b212e13b4ba6
+            tag: 1.6.1@sha256:a884f69f19ce0f66992f3872d24544d1e587e133b8a003e072711aafc1e02429
           command:
             - "web-entrypoint.sh"
           args:
@@ -83,21 +83,6 @@ dawarich:
                 secretKeyRef:
                   name: dawarich-key
                   key: key
-            - name: OTP_ENCRYPTION_PRIMARY_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: dawarich-key
-                  key: otp-primary-key
-            - name: OTP_ENCRYPTION_DETERMINISTIC_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: dawarich-key
-                  key: otp-deterministic-key
-            - name: OTP_ENCRYPTION_KEY_DERIVATION_SALT
-              valueFrom:
-                secretKeyRef:
-                  name: dawarich-key
-                  key: otp-derivation-salt
             - name: RAILS_LOG_TO_STDOUT
               value: true
             - name: SELF_HOSTED
@@ -126,7 +111,7 @@ dawarich:
         sidekiq:
           image:
             repository: freikin/dawarich
-            tag: 1.7.5@sha256:dceef4bf7bd5e6a842d61cdd2a82440a0db34f70dc766e02b0b3b212e13b4ba6
+            tag: 1.6.1@sha256:a884f69f19ce0f66992f3872d24544d1e587e133b8a003e072711aafc1e02429
           command:
             - "sidekiq-entrypoint.sh"
           args:
@@ -176,12 +161,12 @@ dawarich:
             - name: OIDC_CLIENT_ID
               valueFrom:
                 secretKeyRef:
-                  name: dawarich-oidc-authentik
+                  name: dawarich-oidc-secret
                   key: client
             - name: OIDC_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: dawarich-oidc-authentik
+                  name: dawarich-oidc-secret
                   key: secret
             - name: OIDC_PROVIDER_NAME
               value: Authentik
@@ -196,23 +181,8 @@ dawarich:
             - name: SECRET_KEY_BASE
               valueFrom:
                 secretKeyRef:
-                  name: dawarich-key
+                  name: dawarich-key-secret
                   key: key
-            - name: OTP_ENCRYPTION_PRIMARY_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: dawarich-key
-                  key: otp-primary-key
-            - name: OTP_ENCRYPTION_DETERMINISTIC_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: dawarich-key
-                  key: otp-deterministic-key
-            - name: OTP_ENCRYPTION_KEY_DERIVATION_SALT
-              valueFrom:
-                secretKeyRef:
-                  name: dawarich-key
-                  key: otp-derivation-salt
             - name: RAILS_LOG_TO_STDOUT
               value: true
             - name: SELF_HOSTED

clusters/cl01tl/helm/democratic-csi-synology-iscsi/values.yaml

@@ -47,8 +47,6 @@ democratic-csi:
         fsType: ext4
   node:
     hostPID: true
-    rbac:
-      enabled: true
     driver:
       extraEnv:
         - name: ISCSIADM_HOST_STRATEGY

clusters/cl01tl/helm/descheduler/values.yaml

@@ -10,7 +10,7 @@ descheduler:
     requests:
       cpu: 10m
       memory: 50Mi
-  deschedulingInterval: 2m
+  deschedulingInterval: 5m
   replicas: 3
   leaderElection:
     enabled: true
@@ -51,13 +51,13 @@ descheduler:
           - name: LowNodeUtilization
             args:
               thresholds:
-                cpu: 30
-                memory: 30
-                pods: 30
+                cpu: 20
+                memory: 20
+                pods: 20
               targetThresholds:
-                cpu: 45
-                memory: 45
-                pods: 45
+                cpu: 50
+                memory: 50
+                pods: 60
         plugins:
           balance:
             enabled:

clusters/cl01tl/helm/directus/Chart.lock

@@ -1,18 +1,12 @@
 dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.0
+  version: 4.6.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-- name: rclone-bucket
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.1
-- name: rclone-bucket
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.1
-digest: sha256:22cacf8a7f40332abb9da4d424f5af12530047c3c982b14e1bd7378eb00ed4a3
-generated: "2026-05-08T06:02:07.541778817Z"
+  version: 0.6.1
+digest: sha256:78f5065d1125792c88e4d24f5ac1ee3d6310b4997f552020c44d0615335ea329
+generated: "2026-04-13T20:33:13.909018545Z"

clusters/cl01tl/helm/directus/Chart.yaml

@@ -12,30 +12,21 @@ sources:
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/rclone-bucket
 maintainers:
   - name: alexlebens
 dependencies:
   - name: app-template
     alias: directus
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.0
+    version: 4.6.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.8.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
-  - name: rclone-bucket
-    alias: rclone-directus-assets-remote
-    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.8.1
-  - name: rclone-bucket
-    alias: rclone-directus-assets-external
-    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.8.1
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/directus.png
 # renovate: datasource=github-releases depName=directus/directus
-appVersion: 11.17.4
+appVersion: 11.17.3

clusters/cl01tl/helm/directus/values.yaml

@@ -8,7 +8,7 @@ directus:
         main:
           image:
             repository: ghcr.io/directus/directus
-            tag: 11.17.4@sha256:eb326f679ae847c0a776f93b972761dc2ebe84980e0b9d274a6bc31cd62809f7
+            tag: 11.17.3@sha256:ae6ab737fd04077d295bbefa545cc4aefccc206e3d0120c83812f9b482a8c9a5
           env:
             - name: PUBLIC_URL
               value: https://directus.alexlebens.net
@@ -210,48 +210,7 @@ valkey:
       aclUsers:
         default:
           permissions: "~* &* +@all"
-rclone-directus-assets-remote:
-  nameOverride: directus-assets-remote-rclone
-  cronJob:
-    suspend: false
-    schedule: 30 6 * * 2
-  rclone:
-    source:
-      bucketName: directus-assets
-    destination:
-      bucketName: directus-assets
-  secret:
-    externalSecret:
-      source:
-        credentials:
-          path: /garage/home-infra/directus-assets
-        config:
-          path: /garage/config
-      destination:
-        credentials:
-          path: /garage/home-infra/directus-assets
-        config:
-          path: /garage/config
-rclone-directus-assets-external:
-  nameOverride: directus-assets-external-rclone
-  cronJob:
-    suspend: false
-    schedule: 0 6 * * 2
-  rclone:
-    source:
-      bucketName: directus-assets
-    destination:
-      bucketName: directus-assets-37363a16b71dc59b
-  secret:
-    externalSecret:
-      source:
-        credentials:
-          path: /garage/home-infra/directus-assets
-        config:
-          path: /garage/config
-      destination:
-        credentials:
-          path: /backblaze/home-infra/directus-assets
-        config:
-          path: /backblaze/config
-          endpointProperty: ENDPOINT
+    # No option to configure metrics when auth is enabled
+    # https://github.com/valkey-io/valkey-helm/issues/135
+    metrics:
+      enabled: false

clusters/cl01tl/helm/elastic-operator/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: eck-operator
   repository: https://helm.elastic.co
-  version: 3.4.0
-digest: sha256:b4787630154471f65ceeb12f65fa24616eab9470e61e089b8e656e42f05f74f1
-generated: "2026-05-06T19:10:32.416627028Z"
+  version: 3.3.2
+digest: sha256:ac7a849a6d8244ef56c11f18438c4c76133f92d245228c5a1c8369d42562c177
+generated: "2026-04-01T21:30:02.975920565Z"

clusters/cl01tl/helm/elastic-operator/Chart.yaml

@@ -14,8 +14,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: eck-operator
-    version: 3.4.0
+    version: 3.3.2
     repository: https://helm.elastic.co
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/elastic.png
 # renovate: datasource=github-releases depName=elastic/cloud-on-k8s
-appVersion: v3.4.0
+appVersion: v3.3.2

clusters/cl01tl/helm/elastic-operator/values.yaml

@@ -1,5 +1,6 @@
 eck-operator:
   managedNamespaces:
+    - stalwart
     - tubearchivist
   installCRDs: true
   replicaCount: 2

clusters/cl01tl/helm/element-web/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: element-web
   repository: https://ananace.gitlab.io/charts
-  version: 1.4.36
+  version: 1.4.34
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.2.1
-digest: sha256:c9e815d9819353f97ff0efc24154db08097c390a772a6d99b9b41c6e1f97feba
-generated: "2026-05-08T05:50:32.655514333Z"
+  version: 2.5.0
+digest: sha256:8640b8a250bdcd9e7561e3d28538ccf4644a7159a035ee0a5fdbcf71dc5b2bbe
+generated: "2026-04-10T01:17:19.932208699Z"

clusters/cl01tl/helm/element-web/Chart.yaml

@@ -15,11 +15,11 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: element-web
-    version: 1.4.36
+    version: 1.4.34
     repository: https://ananace.gitlab.io/charts
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 3.2.1
+    version: 2.5.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/element.png
 # renovate: datasource=github-releases depName=element-hq/element-web
-appVersion: v1.12.17
+appVersion: v1.12.15

clusters/cl01tl/helm/element-web/values.yaml

@@ -2,7 +2,7 @@ element-web:
   replicaCount: 1
   image:
     repository: ghcr.io/element-hq/element-web
-    tag: v1.12.17@sha256:f4a81a24d49a9c5b97e02e77a3013ec799873e500e69041078a28be98e4f1280
+    tag: v1.12.15@sha256:c7fa40b5ba3891f8af3ce63da0818f457c1802a9ee4d2f5e46a9df36a2388eed
   defaultServer:
     url: https://matrix.alexlebens.dev
     name: alexlebens.dev

clusters/cl01tl/helm/eraser/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 1.4.1
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.0
-digest: sha256:b510fa700aade3c4ff5d8cacd8099c6f52d958aff97d436d4fe63abde2200439
-generated: "2026-05-07T20:44:14.408868308Z"
+  version: 4.6.2
+digest: sha256:8414813d3d9d195b16ef7ebf814f7095a16413f4b0e579fcb37738000624f68c
+generated: "2026-04-08T21:39:05.689756-05:00"

clusters/cl01tl/helm/eraser/Chart.yaml

@@ -21,7 +21,7 @@ dependencies:
   - name: app-template
     alias: eraser-metrics
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.0
+    version: 4.6.2
 icon: https://raw.githubusercontent.com/eraser-dev/eraser/refs/heads/main/images/eraser-logo-color-1c.png
 # renovate: datasource=github-releases depName=eraser-dev/eraser
 appVersion: v1.4.1

clusters/cl01tl/helm/eraser/values.yaml

@@ -44,13 +44,11 @@ eraser-metrics:
       type: deployment
       replicas: 1
       strategy: Recreate
-      serviceAccount:
-        name: eraser-metrics
       containers:
         main:
           image:
             repository: ghcr.io/open-telemetry/opentelemetry-collector-releases/opentelemetry-collector
-            tag: 0.151.0@sha256:49a12827519134ed72881a64247ea43fbf4bdac50cfa41ceb495fc1c684451e2
+            tag: 0.150.1@sha256:618f7867e49fdb173d9b46d535b01f82254b0b14beac6ab1f6f2eb8cf62c5d42
           command:
             - /otelcol
             - --config=/conf/otel-collector-config.yaml
@@ -85,9 +83,6 @@ eraser-metrics:
                   - otlp
                 exporters:
                   - prometheus
-  serviceAccount:
-    eraser:
-      enabled: true
   service:
     main:
       controller: main

clusters/cl01tl/helm/excalidraw/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.0
-digest: sha256:297d4f45c64ccbaac66c103774e97bacde3f249cab40afef06c0c1106b62ab79
-generated: "2026-05-07T20:44:26.213030206Z"
+  version: 4.6.2
+digest: sha256:e05d84dd266b8b456a8bc7f9a2bb3ab01f4ac926efd1a58cf405b0cdab343d3f
+generated: "2026-01-17T18:27:08.062835-06:00"

clusters/cl01tl/helm/excalidraw/Chart.yaml

@@ -16,7 +16,7 @@ dependencies:
   - name: app-template
     alias: excalidraw
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.0
+    version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/excalidraw.png
 # renovate: datasource=github-releases depName=excalidraw/excalidraw
-appVersion: v0.18.1
+appVersion: v0.18.0

clusters/cl01tl/helm/excalidraw/values.yaml

@@ -8,7 +8,7 @@ excalidraw:
         main:
           image:
             repository: excalidraw/excalidraw
-            tag: latest@sha256:f7ee194addd607bf831d2af0f0a34463dd4225e426cf35199ef0b12a803398e9
+            tag: latest@sha256:20ffa04668e19616bb0c1b3632849e5cd96e0bc7a1336b73d9d072667f2c2854
           env:
             - name: NODE_ENV
               value: production

clusters/cl01tl/helm/external-dns/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: external-dns
   repository: https://kubernetes-sigs.github.io/external-dns/
-  version: 1.21.1
-digest: sha256:c0fc34e2a1fd5a100043c2e22130a3a7910019b655c5e69a50424562f4322f5d
-generated: "2026-05-01T02:29:38.018973854Z"
+  version: 1.20.0
+digest: sha256:0da4dec408239ea48de1d95fa8ad7701c4fdc0efe67baa8743507c75e62e2a47
+generated: "2026-01-03T23:04:25.142170083Z"

clusters/cl01tl/helm/external-dns/Chart.yaml

@@ -16,7 +16,7 @@ maintainers:
 dependencies:
   - name: external-dns
     alias: external-dns-unifi
-    version: 1.21.1
+    version: 1.20.0
     repository: https://kubernetes-sigs.github.io/external-dns/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 # renovate: datasource=github-releases depName=kubernetes-sigs/external-dns

clusters/cl01tl/helm/external-dns/templates/external-secret.yaml

@@ -13,5 +13,5 @@ spec:
   data:
     - secretKey: api-key
       remoteRef:
-        key: /unifi/users/cl01tl
+        key: /unifi/auth/cl01tl
         property: api-key

clusters/cl01tl/helm/external-secrets/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: external-secrets
   repository: https://charts.external-secrets.io
-  version: 2.4.1
-digest: sha256:f862e1236cdbd9ddea5692ae63f7a05a4dc1f3d60bcae33015237cc0a630c224
-generated: "2026-04-28T18:30:17.998349684Z"
+  version: 2.3.0
+digest: sha256:fedb79c937be24d4bb72f665122b468b445de95f3f02de419903e3136186e42f
+generated: "2026-04-10T15:10:52.488487421Z"

clusters/cl01tl/helm/external-secrets/Chart.yaml

@@ -14,8 +14,8 @@ sources:
 dependencies:
   - name: external-secrets
     alias: external-secrets
-    version: 2.4.1
+    version: 2.3.0
     repository: https://charts.external-secrets.io
 icon: https://raw.githubusercontent.com/external-secrets/external-secrets/refs/heads/main/assets/eso-logo-large.png
 # renovate: datasource=github-releases depName=external-secrets/external-secrets
-appVersion: v2.4.1
+appVersion: v2.3.0

clusters/cl01tl/helm/external-secrets/templates/cluster-secret-store.yaml

@@ -1,5 +1,25 @@
 apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
+metadata:
+  name: vault
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider:
+    vault:
+      server: http://vault-internal.vault:8200
+      path: secret
+      auth:
+        tokenSecretRef:
+          namespace: vault
+          name: vault-token
+          key: token
+
+---
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
 metadata:
   name: openbao
   namespace: {{ .Release.Namespace }}

clusters/cl01tl/helm/external-secrets/values.yaml

@@ -2,7 +2,7 @@ external-secrets:
   replicaCount: 3
   image:
     repository: ghcr.io/external-secrets/external-secrets
-    tag: v2.4.1@sha256:9440a40b394791a5e93f3f7e1b33399ecbdc0e38273de1d69ed83fe12936fc09
+    tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
   installCRDs: true
   crds:
     createClusterExternalSecret: true
@@ -29,7 +29,7 @@ external-secrets:
   webhook:
     image:
       repository: ghcr.io/external-secrets/external-secrets
-      tag: v2.4.1@sha256:9440a40b394791a5e93f3f7e1b33399ecbdc0e38273de1d69ed83fe12936fc09
+      tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
     resources:
       requests:
         cpu: 1m
@@ -37,7 +37,7 @@ external-secrets:
   certController:
     image:
       repository: ghcr.io/external-secrets/external-secrets
-      tag: v2.4.1@sha256:9440a40b394791a5e93f3f7e1b33399ecbdc0e38273de1d69ed83fe12936fc09
+      tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
     resources:
       requests:
         cpu: 1m

clusters/cl01tl/helm/foldergram/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.0
+  version: 4.6.2
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.2.1
+  version: 2.5.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.0.0
-digest: sha256:3ff74f507dc5fb63d6e40b77ade6d52c7a1b453e40e4c294e561126bd487c84d
-generated: "2026-05-08T13:04:05.873239168Z"
+  version: 0.8.0
+digest: sha256:06e321d19ffe0df94b3cd6bcc306804729710f74ca2f9962652628377836c33e
+generated: "2026-04-11T15:26:16.743784-05:00"

clusters/cl01tl/helm/foldergram/Chart.yaml

@@ -18,13 +18,13 @@ dependencies:
   - name: app-template
     alias: foldergram
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.0
+    version: 4.6.2
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 3.2.1
+    version: 2.5.0
   - name: volsync-target
     alias: volsync-target-db
-    version: 2.0.0
+    version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
 # renovate: datasource=github-releases depName=foldergram/foldergram

clusters/cl01tl/helm/foldergram/templates/_helpers.tpl

@@ -16,6 +16,6 @@ app.kubernetes.io/part-of: {{ .Release.Name }}
 {{/*
 NFS names
 */}}
-{{- define "custom.storageMiaNfsName" -}}
-foldergram-pictures-collection-mia-nfs-storage
+{{- define "custom.storageNfsName" -}}
+foldergram-pictures-collections-nfs-storage
 {{- end -}}

clusters/cl01tl/helm/foldergram/templates/persistent-volume-claim.yaml

@@ -1,13 +1,13 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ include "custom.storageMiaNfsName" . }}
+  name: {{ include "custom.storageNfsName" . }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.storageMiaNfsName" . }}
+    app.kubernetes.io/name: {{ include "custom.storageNfsName" . }}
     {{- include "custom.labels" . | nindent 4 }}
 spec:
-  volumeName: {{ include "custom.storageMiaNfsName" . }}
+  volumeName: {{ include "custom.storageNfsName" . }}
   storageClassName: nfs-client
   accessModes:
     - ReadWriteMany

clusters/cl01tl/helm/foldergram/templates/persistent-volume.yaml

@@ -1,10 +1,10 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: {{ include "custom.storageMiaNfsName" . }}
+  name: {{ include "custom.storageNfsName" . }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.storageMiaNfsName" . }}
+    app.kubernetes.io/name: {{ include "custom.storageNfsName" . }}
     {{- include "custom.labels" . | nindent 4 }}
 spec:
   persistentVolumeReclaimPolicy: Retain
@@ -14,7 +14,7 @@ spec:
   accessModes:
     - ReadWriteMany
   nfs:
-    path: '/volume2/Storage/Pictures/Collections/Minneapolis Institute of Art'
+    path: /volume2/Storage/Pictures/Collections
     server: synologybond.alexlebens.net
   mountOptions:
     - vers=4

clusters/cl01tl/helm/foldergram/values.yaml

@@ -17,7 +17,7 @@ foldergram:
             - name: IMAGE_DETAIL_SOURCE
               value: original
             - name: DERIVATIVE_MODE
-              value: lazy
+              value: eager
             - name: DATA_ROOT
               value: ./data
             - name: GALLERY_ROOT
@@ -70,18 +70,18 @@ foldergram:
       forceRename: foldergram-data
       storageClass: synology-iscsi-delete
       accessMode: ReadWriteOnce
-      size: 500Gi
+      size: 250Gi
       advancedMounts:
         main:
           main:
             - path: /app/data
               readOnly: false
-    pictures-mia:
-      existingClaim: foldergram-pictures-collection-mia-nfs-storage
+    pictures:
+      existingClaim: foldergram-pictures-collections-nfs-storage
       advancedMounts:
         main:
           main:
-            - path: '/gallery/Minneapolis Institute of Art'
+            - path: /gallery
               readOnly: true
 volsync-target-db:
   pvcTarget: foldergram-db

clusters/cl01tl/helm/freshrss/Chart.lock

@@ -1,15 +1,15 @@
 dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.0
+  version: 4.6.2
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.2.1
+  version: 2.5.0
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.0.0
-digest: sha256:6f2ee852d75b9abfd124e1d6610a03b245b479a3b81dd8f0083b3e15ecaf0f68
-generated: "2026-05-08T13:04:17.868159983Z"
+  version: 0.8.0
+digest: sha256:2a13aac2d207555bf33ee01db493d210e860e660433cd6f5b9b67fadf91f8f74
+generated: "2026-04-10T01:17:32.585138713Z"

clusters/cl01tl/helm/freshrss/Chart.yaml

@@ -19,17 +19,17 @@ dependencies:
   - name: app-template
     alias: freshrss
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.0
+    version: 4.6.2
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 3.2.1
+    version: 2.5.0
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-data
-    version: 2.0.0
+    version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/freshrss.png
 # renovate: datasource=github-releases depName=FreshRSS/FreshRSS

clusters/cl01tl/helm/garage/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.0
-digest: sha256:925129100b32d9daf71142dc3fc42914cc26d40581a523c574c81ec79e2a0fc6
-generated: "2026-05-07T20:44:57.951189479Z"
+  version: 4.6.2
+digest: sha256:86536c14fa61870a64540b77f65afae8f4308e41a66eefae7fe85b83bf0df30e
+generated: "2026-01-16T18:46:33.321938614Z"

clusters/cl01tl/helm/garage/Chart.yaml

@@ -18,7 +18,7 @@ dependencies:
   - name: app-template
     alias: garage
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.0
+    version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/garage.png
 # renovate: datasource=docker depName=dxflrs/garage
 appVersion: v2.3.0

clusters/cl01tl/helm/gatus/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 1.5.0
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.0.0
-digest: sha256:25d95b64934fb0fe59914f82b752de38979929342c0a8dad1be77e4a1b2ed93f
-generated: "2026-05-08T13:04:29.806261523Z"
+  version: 0.8.0
+digest: sha256:b2a7ef962a91dff4313f66c1d04356f1b2aeefc752d672a9a27ea227db4b8c7d
+generated: "2026-04-04T21:02:09.187828-05:00"

clusters/cl01tl/helm/gatus/Chart.yaml

@@ -20,11 +20,11 @@ dependencies:
     version: 1.5.0
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-data
-    version: 2.0.0
+    version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/gatus.png
 # renovate: datasource=github-releases depName=TwiN/gatus

clusters/cl01tl/helm/gatus/values.yaml

@@ -212,6 +212,12 @@ gatus:
       - name: authentik
         url: https://authentik.alexlebens.net
         <<: *defaults
+      - name: roundcube
+        url: https://mail.alexlebens.net
+        <<: *defaults
+      - name: stalwart
+        url: https://stalwart.alexlebens.net
+        <<: *defaults
       - name: ntfy
         url: https://ntfy.alexlebens.net
         <<: *defaults

clusters/cl01tl/helm/generic-device-plugin/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: generic-device-plugin
   repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-  version: 0.21.1
-digest: sha256:0e131d7c64273f1306e27c66588c8ef43531500e9ceb36884d2556b8c7c89f62
-generated: "2026-05-08T05:58:05.654632277Z"
+  version: 0.20.31
+digest: sha256:2e073f735a5ff699844eb67715ab20d403261b3e9c035ebdc4292cee9666b4f4
+generated: "2026-04-15T01:16:30.361061773Z"

clusters/cl01tl/helm/generic-device-plugin/Chart.yaml

@@ -14,6 +14,6 @@ maintainers:
 dependencies:
   - name: generic-device-plugin
     repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-    version: 0.21.1
+    version: 0.20.31
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: 1.0.0

clusters/cl01tl/helm/gitea/Chart.lock

@@ -10,18 +10,18 @@ dependencies:
   version: 0.32.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 3.2.1
+  version: 2.5.0
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
+  version: 0.6.1
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
+  version: 0.6.1
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.0.0
-digest: sha256:ae246461eab9ffe40e4bedfac334a5ef6e96fa6bed5fb5b4d0e1f485cbb32114
-generated: "2026-05-08T13:04:45.171434694Z"
+  version: 0.8.0
+digest: sha256:2144d55ea34ba25bd81c1e479ee5cd27097fafb5676b96e63aa0e32ad2868925
+generated: "2026-04-16T20:09:26.031592859Z"

clusters/cl01tl/helm/gitea/Chart.yaml

@@ -37,22 +37,22 @@ dependencies:
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
-    version: 3.2.1
+    version: 2.5.0
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-gitea
-    version: 0.8.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-renovate
-    version: 0.8.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-storage
-    version: 2.0.0
+    version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/gitea.png
 # renovate: datasource=github-releases depName=go-gitea/gitea

clusters/cl01tl/helm/gitea/templates/prometheus-rule.yaml

@@ -1,28 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: meilisearch
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: meilisearch
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  groups:
-    - name: EmbeddedExporter
-      rules:
-        - alert: MeilisearchIndexIsEmpty
-          expr: meilisearch_index_docs_count == 0
-          for: 0m
-          labels:
-            severity: warning
-          annotations:
-            summary: Meilisearch index is empty (instance {{ `{{ $labels.instance }}` }})
-            description: "Meilisearch index {{ `{{ $labels.index }}` }} has zero documents\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: MeilisearchHttpResponseTime
-          expr: meilisearch_http_response_time_seconds > 0.5
-          for: 0m
-          labels:
-            severity: warning
-          annotations:
-            summary: Meilisearch http response time (instance {{ `{{ $labels.instance }}` }})
-            description: "Meilisearch http response time is too high\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"

clusters/cl01tl/helm/gitea/values.yaml

@@ -194,7 +194,7 @@ gitea-actions:
       registry: docker.io
       repository: gitea/act_runner
       # renovate: datasource=docker depName=gitea/act_runner
-      tag: 0.6.1@sha256:b5c35d6bdbb9bb25e531230bfc7cc663cb751406cbec90a2a891b85fea54de86
+      tag: 0.4.1@sha256:696a59b51ad3d149521e3beb0229d5fb88f87295e1616f940199793274415b56
       extraVolumeMounts:
         - name: workspace-vol
           mountPath: /workspace
@@ -206,13 +206,14 @@ gitea-actions:
         runner:
           labels:
             - "ubuntu-latest:docker://harbor.alexlebens.net/proxy-hub.docker/gitea/runner-images:ubuntu-24.04"
-            - "ubuntu-latest-slim:docker://harbor.alexlebens.net/proxy-hub.docker/gitea/runner-images:ubuntu-24.04-slim"
             - "ubuntu-js:docker://harbor.alexlebens.net/proxy-ghcr.io/catthehacker/ubuntu:js-24.04"
+            - "ubuntu-24.04:docker://harbor.alexlebens.net/proxy-hub.docker/gitea/runner-images:ubuntu-24.04"
+            - "ubuntu-22.04:docker://harbor.alexlebens.net/proxy-hub.docker/gitea/runner-images:ubuntu-22.04"
     dind:
       registry: docker.io
       repository: docker
       # renovate: datasource=docker depName=docker
-      tag: 29.4.1-dind@sha256:c77e5d7912f9b137cc67051fdc2991d8f5ae22c55ddf532bb836dcb693a04940
+      tag: 29.4.0-dind@sha256:f80c26212befc1c1988b529495532c6b9180d9b1dab1611f4a1efbe9da8ec821
       extraVolumeMounts:
         - name: docker-vol
           mountPath: /var/lib/docker
@@ -280,10 +281,10 @@ valkey-gitea:
         cpu: 20m
         memory: 1Gi
     dataStorage:
-      requestedSize: 20Gi
+      requestedSize: 10Gi
     replica:
       persistence:
-        size: 20Gi
+        size: 10Gi
 valkey-renovate:
   valkey:
     nameOverride: valkey-renovate

clusters/cl01tl/helm/grafana-operator/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 5.22.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
+  version: 0.6.1
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-digest: sha256:a8553690c0fa8cbb9b6707388c3bcc11f2f38314d6512b1b9b2467f862cca4d9
-generated: "2026-05-08T02:31:18.145858152Z"
+  version: 0.6.1
+digest: sha256:6c086da896f573fdb1b81abab43b90181f2af7bf57a62333c4426f3f30496ffa
+generated: "2026-04-13T20:33:58.123069628Z"

clusters/cl01tl/helm/grafana-operator/Chart.yaml

@@ -20,15 +20,15 @@ dependencies:
     repository: https://grafana.github.io/helm-charts
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-unified-alerting
-    version: 0.8.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-remote-cache
-    version: 0.8.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grafana.png
 # renovate: datasource=github-releases depName=grafana/grafana-operator

clusters/cl01tl/helm/grafana-operator/templates/grafana-dashboard.yaml

@@ -411,6 +411,24 @@ spec:
   resyncPeriod: 6h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/unpoller.json
 
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: grafana-dashboard-version-checker-internal
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: grafana-dashboard-version-checker-internal
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  instanceSelector:
+    matchLabels:
+      app: grafana-main
+  contentCacheDuration: 6h
+  folderUID: grafana-folder-service
+  resyncPeriod: 6h
+  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/version-checker-internal.json
+
 ---
 apiVersion: grafana.integreatly.org/v1beta1
 kind: GrafanaDashboard

clusters/cl01tl/helm/grimmory/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.0
+  version: 4.6.2
 - name: mariadb-cluster
   repository: https://helm.mariadb.com/mariadb-operator
   version: 26.3.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.0.0
-digest: sha256:27ac7e85baa400d8bf3ae2d7fa84bef1cb4f240043b34b6b6316d8fe4bf88851
-generated: "2026-05-08T13:05:03.692216401Z"
+  version: 0.8.0
+digest: sha256:6ee403da03c1bcc0289a9abdef0508344072d51173da996eda69b8305d5feefa
+generated: "2026-03-23T20:35:19.743257-05:00"

clusters/cl01tl/helm/grimmory/Chart.yaml

@@ -18,14 +18,14 @@ dependencies:
   - name: app-template
     alias: grimmory
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.0
+    version: 4.6.2
   - name: mariadb-cluster
     version: 26.3.0
     repository: https://helm.mariadb.com/mariadb-operator
   - name: volsync-target
     alias: volsync-target-config
-    version: 2.0.0
+    version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grimmory.png
 # renovate: datasource=github-releases depName=grimmory-tools/grimmory
-appVersion: v3.0.3
+appVersion: v2.3.0

clusters/cl01tl/helm/grimmory/templates/external-secret.yaml

@@ -1,10 +1,10 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: grimmory-database-secret
+  name: grimmory-database-config
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: grimmory-database-secret
+    app.kubernetes.io/name: grimmory-database-config
     {{- include "custom.labels" . | nindent 4 }}
 spec:
   secretStoreRef:
@@ -32,12 +32,12 @@ spec:
   data:
     - secretKey: access
       remoteRef:
-        key: /backblaze/home-infra/mariadb-backups
-        property: ACCESS_KEY_ID
+        key: /digital-ocean/home-infra/mariadb-backups
+        property: access
     - secretKey: secret
       remoteRef:
-        key: /backblaze/home-infra/mariadb-backups
-        property: ACCESS_SECRET_KEY
+        key: /digital-ocean/home-infra/mariadb-backups
+        property: secret
 
 ---
 apiVersion: external-secrets.io/v1

clusters/cl01tl/helm/grimmory/values.yaml

@@ -12,7 +12,7 @@ grimmory:
         main:
           image:
             repository: ghcr.io/grimmory-tools/grimmory
-            tag: v3.0.3@sha256:a903a2b44c308bd1738b6f7cdb5a2e5a2a1ae23a092f30eb68581e2be1af50cd
+            tag: v2.3.0@sha256:9014247f591074529894f81115ca40f899db697e89f72c2fe91ec530e3f19597
           env:
             - name: TZ
               value: America/Chicago
@@ -27,7 +27,7 @@ grimmory:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: grimmory-database-secret
+                  name: grimmory-database-config
                   key: password
             - name: GRIMMORY_PORT
               value: 6060
@@ -98,7 +98,7 @@ mariadb-cluster:
   mariadb:
     rootPasswordSecretKeyRef:
       generate: false
-      name: grimmory-database-secret
+      name: grimmory-database-config
       key: password
     storage:
       size: 5Gi
@@ -151,7 +151,7 @@ mariadb-cluster:
   physicalBackups:
     - name: backup-external
       schedule:
-        cron: "0 0 * * 6"
+        cron: "0 0 * * 0"
         suspend: false
         immediate: true
       compression: gzip
@@ -159,10 +159,10 @@ mariadb-cluster:
       successfulJobsHistoryLimit: 1
       storage:
         s3:
-          bucket: mariadb-backups-6e3b78870f7af040
+          bucket: mariadb-backups-b230a2f5aecf080a4b372c08
           prefix: cl01tl/grimmory
-          endpoint: s3.us-east-005.backblazeb2.com
-          region: us-east-005
+          endpoint: nyc3.digitaloceanspaces.com
+          region: us-east-1
           accessKeyIdSecretKeyRef:
             name: grimmory-mariadb-cluster-backup-secret-external
             key: access

clusters/cl01tl/helm/harbor/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: harbor
   repository: https://helm.goharbor.io
-  version: 1.19.0
+  version: 1.18.3
 - name: postgres-cluster
   repository: https://gitea.alexlebens.net/api/packages/alexlebens/helm
-  version: 7.12.1
+  version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-digest: sha256:4ef3c0544281466cf714f5c6410309d4e090463d7f9a5750cd954c520abb0a40
-generated: "2026-05-08T02:31:31.873945824Z"
+  version: 0.6.1
+digest: sha256:fc508a58ea7dffe1b92049a89c3fe2f0034d05ecdad38807bb6e02c68a1cb957
+generated: "2026-04-13T20:34:25.515547207Z"

clusters/cl01tl/helm/harbor/Chart.yaml

@@ -16,15 +16,15 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: harbor
-    version: 1.19.0
+    version: 1.18.3
     repository: https://helm.goharbor.io
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
     repository: https://gitea.alexlebens.net/api/packages/alexlebens/helm
   - name: valkey
     alias: valkey
-    version: 0.8.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/harbor.png
 # renovate: datasource=github-releases depName=goharbor/harbor

clusters/cl01tl/helm/harbor/values.yaml

@@ -37,12 +37,12 @@ harbor:
   portal:
     image:
       repository: ghcr.io/goharbor/harbor-portal
-      tag: v2.15.1@sha256:ac55161c57a8351807adf8f8def264bdd52667c371d0436beefebdac4341c9e2
+      tag: v2.15.0@sha256:541d5fa95bf77240d46a438f86245cdfd6afa6dd7fdd0cf4dd4c905af6a980b1
     replicas: 2
   core:
     image:
       repository: ghcr.io/goharbor/harbor-core
-      tag: v2.15.1@sha256:887a85b8ea98b76bfc9f715f1a0785bb99f9a1034241513902dd6e95be922a83
+      tag: v2.15.0@sha256:32a13f6693a278261e9c9cb7eb606c5e2aa021308ae44fdc73225755048500a8
     replicas: 2
     existingSecret: harbor-secret
     secretName: harbor-secret
@@ -50,7 +50,7 @@ harbor:
   jobservice:
     image:
       repository: ghcr.io/goharbor/harbor-jobservice
-      tag: v2.15.1@sha256:0de4fd2ce3a02d3e6591b439e4674ea085885ddf43652b44004cc67eb19dba12
+      tag: v2.15.0@sha256:a22c7cccba4673b26ffb96f5c37971d85d879dd837bc82448e01c0170b68cf28
     replicas: 2
     jobLoggers:
       - stdout
@@ -59,11 +59,11 @@ harbor:
     registry:
       image:
         repository: goharbor/registry-photon
-        tag: v2.15.1@sha256:ebf0325c2661729dbb317cbf839608eb8b15cfa158911a94976f2c21563c466e
+        tag: v2.15.0@sha256:beb49fd16cf0906c04a2bf51a22f7210289e7cc2ae43a733e2a0364380aceae6
     controller:
       image:
         repository: ghcr.io/goharbor/harbor-registryctl
-        tag: v2.15.1@sha256:554147a956989175f63f8d41573d716c6ddf6052acd1749c88c0f99ce6ee2bff
+        tag: v2.15.0@sha256:463172f71d3a1e8d4f9e3b4e687a447f41fbc3126316d8c150dba04a903bbc47
     existingSecret: harbor-secret
     relativeurls: true
     credentials:
@@ -74,7 +74,7 @@ harbor:
     enabled: true
     image:
       repository: ghcr.io/goharbor/trivy-adapter-photon
-      tag: v2.15.1@sha256:f0c52bed36c083ec4fded26cefab01e4cd58c9354c261cb3156c69f57bb50131
+      tag: v2.15.0@sha256:6fd6de9cfbbb04cb1d94722cfa01cf71b8994d3f9e7891d3b03a89a7536480ba
   database:
     type: external
     external:
@@ -90,7 +90,7 @@ harbor:
   exporter:
     image:
       repository: ghcr.io/goharbor/harbor-exporter
-      tag: v2.15.1@sha256:372275b6b6abeb571fa7bd5de458e3d75f1a1636503b3c0abe02938f2b285d75
+      tag: v2.15.0@sha256:ad065e4e1a0ee900a0bb1a03d57028ed4b51dc04933f5c1cb5c4aee301a72ddb
     replicas: 2
 postgres-18-cluster:
   mode: recovery

clusters/cl01tl/helm/headlamp/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: headlamp
   repository: https://kubernetes-sigs.github.io/headlamp/
-  version: 0.42.0
-digest: sha256:09efb4cfe9ef92337074c8ae52a564bf902be41f9fcd742dde34b3fe4b4331fa
-generated: "2026-05-07T20:38:18.198513024Z"
+  version: 0.41.0
+digest: sha256:b1cbc64b393c6c9e1c460510adab528cee8336735659040b9c517976e5c6f15d
+generated: "2026-03-26T15:07:50.703213905Z"

clusters/cl01tl/helm/headlamp/Chart.yaml

@@ -13,8 +13,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: headlamp
-    version: 0.42.0
+    version: 0.41.0
     repository: https://kubernetes-sigs.github.io/headlamp/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/headlamp.png
 # renovate: datasource=github-releases depName=headlamp-k8s/headlamp
-appVersion: vv0.42.0
+appVersion: v0.41.0

clusters/cl01tl/helm/headlamp/values.yaml

@@ -3,7 +3,7 @@ headlamp:
   image:
     registry: ghcr.io
     repository: headlamp-k8s/headlamp
-    tag: v0.42.0@sha256:c9754bae1d799220da0547e51ceee234f6e66ebadc138518ca73e33ecd331e59
+    tag: v0.41.0@sha256:89c6c65810bfde61796483c93c70d659104355593792bf55cab680d685da8eeb
   config:
     oidc:
       secret:

clusters/cl01tl/helm/home-assistant/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.0
+  version: 4.6.2
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.0.0
-digest: sha256:89add90994b0d2fe2f54bd69d273fd3091f72171876f0e8c9d5921424a75eeb9
-generated: "2026-05-08T13:05:17.575831327Z"
+  version: 0.8.0
+digest: sha256:dc33c006806b1ac93403a6e77c12e013cac6cf64586bc1d26c54841e6ddf7d2c
+generated: "2026-03-06T01:08:23.774548766Z"

clusters/cl01tl/helm/home-assistant/Chart.yaml

@@ -17,11 +17,11 @@ dependencies:
   - name: app-template
     alias: home-assistant
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.0
+    version: 4.6.2
   - name: volsync-target
     alias: volsync-target-config
-    version: 2.0.0
+    version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/home-assistant.png
 # renovate: datasource=github-releases depName=home-assistant/core
-appVersion: 2026.5.0
+appVersion: 2026.4.3

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -12,7 +12,7 @@ home-assistant:
         main:
           image:
             repository: ghcr.io/home-assistant/home-assistant
-            tag: 2026.5.0@sha256:8edcb16cff8158e87a3a2b48b3bcca05c30dcea0212eb6a2fe940b6d52ed216a
+            tag: 2026.4.3@sha256:ae0800c81fea16bc1241ce03bddb9c6260566e90f58b09d3e5a629e4f68bdc0b
           env:
             - name: TZ
               value: America/Chicago
@@ -23,7 +23,7 @@ home-assistant:
         code-server:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.118.0-ls336@sha256:6e542034343228a692e0b24f12cbcc8ade3650ec1e2c9e195bc291f2bf024e3c
+            tag: 4.116.0-ls333@sha256:4620adace18935dd6ca79d77e3bc1c379e21875392192f970cf5d6b0fb4aefcd
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/homepage/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.0
-digest: sha256:81785552a943df54d09164776a170a007573e38ab96b00872bb22030079076e9
-generated: "2026-05-07T20:45:33.699577658Z"
+  version: 4.6.2
+digest: sha256:1f6cc724b7c88b5209d893b4b3c914e4064a5450e9bb6ca89ef5642199020f2b
+generated: "2026-01-16T18:47:06.186790637Z"

clusters/cl01tl/helm/homepage/Chart.yaml

@@ -16,7 +16,7 @@ dependencies:
   - name: app-template
     alias: homepage
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.0
+    version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/homepage.png
 # renovate: datasource=github-releases depName=gethomepage/homepage
 appVersion: v1.12.3

clusters/cl01tl/helm/homepage/values.yaml

@@ -8,6 +8,8 @@ homepage:
       strategy: Recreate
       annotations:
         reloader.stakater.com/auto: "true"
+      serviceAccount:
+        name: homepage
       pod:
         automountServiceAccountToken: true
       containers:
@@ -25,6 +27,10 @@ homepage:
             requests:
               cpu: 1m
               memory: 128Mi
+  serviceAccount:
+    homepage:
+      enabled: true
+      staticToken: true
   configMaps:
     config:
       enabled: true
@@ -481,6 +487,24 @@ homepage:
                   href: https://authentik.alexlebens.net
                   siteMonitor: http://authentik-server.authentik:80
                   statusStyle: dot
+              - Email Client:
+                  icon: sh-roundcube.webp
+                  description: Roundcube
+                  href: https://mail.alexlebens.net
+                  siteMonitor: http://roundcube.roundcube:80
+                  statusStyle: dot
+              - Email Server:
+                  icon: sh-stalwart.webp
+                  description: Stalwart
+                  href: https://stalwart.alexlebens.net
+                  siteMonitor: http://stalwart.stalwart:80
+                  statusStyle: dot
+                  namespace: stalwart
+                  app: stalwart
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          stalwart
+                      )
               - Notifications:
                   icon: sh-ntfy.webp
                   description: ntfy
@@ -879,9 +903,9 @@ homepage:
               - Github:
                   - abbr: GH
                     href: https://github.com/alexlebens
-              - Backblaze:
-                  - abbr: BB
-                    href: https://secure.backblaze.com
+              - Digital Ocean:
+                  - abbr: DO
+                    href: https://www.digitalocean.com/
               - Cloudflare:
                   - abbr: CF
                     href: https://dash.cloudflare.com/b76e303258b84076ee01fd0f515c0768
@@ -891,6 +915,9 @@ homepage:
               - ProtonVPN:
                   - abbr: PV
                     href: https://account.protonvpn.com/
+              - AirVPN:
+                  - abbr: AV
+                    href: https://airvpn.org/
               - Unifi:
                   - abbr: UF
                     href: https://unifi.ui.com/

clusters/cl01tl/helm/houndarr/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.0
+  version: 4.6.2
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.0.0
-digest: sha256:9041fccd2b6c8370f137ee36fc304054966b82a675fea5dd78b0c58d8e36d739
-generated: "2026-05-08T13:05:33.414994389Z"
+  version: 0.8.0
+digest: sha256:375d6c2eb2f097717c44c5a28cb162da24f4ff154a971e5a68ccd0e0b77e936f
+generated: "2026-03-21T22:31:01.142752-05:00"

clusters/cl01tl/helm/houndarr/Chart.yaml

@@ -18,11 +18,11 @@ dependencies:
   - name: app-template
     alias: houndarr
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.0
+    version: 4.6.2
   - name: volsync-target
     alias: volsync-target-data
-    version: 2.0.0
+    version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/houndarr.png
 # renovate: datasource=github-releases depName=av1155/houndarr
-appVersion: v1.11.0
+appVersion: v1.9.0

clusters/cl01tl/helm/houndarr/values.yaml

@@ -8,7 +8,7 @@ houndarr:
         main:
           image:
             repository: ghcr.io/av1155/houndarr
-            tag: v1.11.0@sha256:9ca1b3206fac52db23da8e58e1dc973743e0626846fc7600530d5ef413453c19
+            tag: v1.9.0@sha256:2a9c9e0de43412f683f00cce6f5d0f3e059b27e50350434ae4029ade720e85a0
           env:
             - name: TZ
               value: America/Chicago

clusters/cl01tl/helm/immich/Chart.lock

@@ -1,15 +1,15 @@
 dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 5.0.0
+  version: 4.6.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
+  version: 0.6.1
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.0.0
-digest: sha256:84d4796c8b111f9888e31181cc560604500ea4b9fd8749c9ad5bcf05e23c8ae8
-generated: "2026-05-08T13:05:46.031208162Z"
+  version: 0.8.0
+digest: sha256:73ee46c366adf205ca50a7382a404ccd0e548a2ebeb39fa5f5afbadf6e0d539f
+generated: "2026-04-13T20:34:57.11369553Z"

clusters/cl01tl/helm/immich/Chart.yaml

@@ -18,18 +18,18 @@ dependencies:
   - name: app-template
     alias: immich
     repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 5.0.0
+    version: 4.6.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.8.0
+    version: 0.6.1
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-data
-    version: 2.0.0
+    version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/immich.png
 # renovate: datasource=github-releases depName=immich-app/immich

clusters/cl01tl/helm/immich/values.yaml

@@ -4,8 +4,8 @@ immich:
       type: deployment
       replicas: 1
       strategy: Recreate
-      pod:
-        automountServiceAccountToken: true
+      serviceAccount:
+        name: immich
       containers:
         main:
           image:
@@ -88,6 +88,10 @@ immich:
               gpu.intel.com/i915: 1
               cpu: 10m
               memory: 500Mi
+  serviceAccount:
+    immich:
+      enabled: true
+      staticToken: true
   service:
     main:
       controller: main