chore(deps): update helm release alloy to v1.7.0

2026-04-02 19:05:57 +00:00
65 changed files with 479 additions and 254 deletions
--- a/.gitea/workflows/renovate.yaml
+++ b/.gitea/workflows/renovate.yaml
@@ -13,7 +13,7 @@ on:
 jobs:
  renovate:
    runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.104.3@sha256:8248aad190150ce3f1016f9e93b45185679f075c428bca093e724a59f1fd426e
+    container: ghcr.io/renovatebot/renovate:43.104.0@sha256:20543dec1eaca2d5e10f9225f3112a1a4d8bcbd3af73acb6a552cf6569692cbb
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
--- a/clusters/cl01tl/helm/argo-workflows/Chart.lock
+++ b/clusters/cl01tl/helm/argo-workflows/Chart.lock
@@ -1,12 +1,12 @@
 dependencies:
 - name: argo-workflows
  repository: https://argoproj.github.io/argo-helm
-  version: 1.0.7
+  version: 1.0.6
 - name: argo-events
  repository: https://argoproj.github.io/argo-helm
  version: 2.4.21
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 7.11.1
-digest: sha256:bcf7ba94885125ce6dac62ee376299f9868bf6ad391597deab0b08ae697a0c5b
-generated: "2026-04-03T23:47:41.400540573Z"
+digest: sha256:a249bd8faad886fa267cb42e843fd6465b3c4147961d182b73dd64ef9e6ca06e
+generated: "2026-03-31T18:36:18.025982-05:00"
--- a/clusters/cl01tl/helm/argo-workflows/Chart.yaml
+++ b/clusters/cl01tl/helm/argo-workflows/Chart.yaml
@@ -18,7 +18,7 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: argo-workflows
-    version: 1.0.7
+    version: 1.0.6
    repository: https://argoproj.github.io/argo-helm
  - name: argo-events
    version: 2.4.21
@@ -29,4 +29,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-workflows
-appVersion: v4.0.4
+appVersion: v4.0.3
--- a/clusters/cl01tl/helm/bazarr/Chart.yaml
+++ b/clusters/cl01tl/helm/bazarr/Chart.yaml
@@ -5,7 +5,6 @@ description: Bazarr
 keywords:
  - bazarr
  - subtitles
-  - servarr
 home: https://docs.alexlebens.dev/applications/bazarr/
 sources:
  - https://github.com/morpheus65535/bazarr
@@ -25,5 +24,5 @@ dependencies:
    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/bazarr.png
-# renovate: datasource=github-releases depName=linuxserver/docker-bazarr
+# renovate: datasource=github-releases depName=morpheus65535/bazarr
 appVersion: 1.5.6
--- a/clusters/cl01tl/helm/code-server/Chart.yaml
+++ b/clusters/cl01tl/helm/code-server/Chart.yaml
@@ -28,5 +28,5 @@ dependencies:
    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/visual-studio-code.png
-# renovate: datasource=github-releases depName=linuxserver/docker-code-server
-appVersion: 4.113.1-ls327
+# renovate: datasource=github-releases depName=coder/code-server
+appVersion: 4.112.0
--- a/clusters/cl01tl/helm/code-server/values.yaml
+++ b/clusters/cl01tl/helm/code-server/values.yaml
@@ -12,7 +12,7 @@ code-server:
        main:
          image:
            repository: ghcr.io/linuxserver/code-server
-            tag: 4.114.0-ls328@sha256:928e63f0b775d76cda606f181bae9d81c6d3fbd2d1daeef9438e3ba5579f391d
+            tag: 4.112.0-ls325@sha256:a17ee95f4e1b43284fe5dfea99e82c8a26f096534215ff36817fa80161eec220
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/directus/values.yaml
+++ b/clusters/cl01tl/helm/directus/values.yaml
@@ -9,6 +9,7 @@ directus:
          image:
            repository: ghcr.io/directus/directus
            tag: 11.17.1@sha256:1dd2080a50a9f6df2b6f49df15a7734424bbd1a5902983c4b6e447f22027b80b
+            pullPolicy: IfNotPresent
          env:
            - name: PUBLIC_URL
              value: https://directus.alexlebens.net
--- a/clusters/cl01tl/helm/elastic-operator/Chart.yaml
+++ b/clusters/cl01tl/helm/elastic-operator/Chart.yaml
@@ -18,4 +18,4 @@ dependencies:
    repository: https://helm.elastic.co
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/elastic.png
 # renovate: datasource=github-releases depName=elastic/cloud-on-k8s
-appVersion: v3.3.2
+appVersion: v3.3.1
--- a/clusters/cl01tl/helm/foldergram/Chart.yaml
+++ b/clusters/cl01tl/helm/foldergram/Chart.yaml
@@ -24,4 +24,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
 # renovate: datasource=github-releases depName=foldergram/foldergram
-appVersion: v1.1.0
+appVersion: v1.0.9
--- a/clusters/cl01tl/helm/foldergram/values.yaml
+++ b/clusters/cl01tl/helm/foldergram/values.yaml
@@ -12,7 +12,8 @@ foldergram:
        main:
          image:
            repository: ghcr.io/foldergram/foldergram
-            tag: 1.1.0@sha256:b08c7f30a15a3d3e4cf0877a5271cb76be6a36ab83751f040c115ccdb76b736a
+            tag: 1.0.9@sha256:aa6707e7456386f2d74b8f2769d0281f4127d1276349583b8531dbaa8f844883
+            pullPolicy: IfNotPresent
          env:
            - name: IMAGE_DETAIL_SOURCE
              value: original
--- a/clusters/cl01tl/helm/gitea/values.yaml
+++ b/clusters/cl01tl/helm/gitea/values.yaml
@@ -145,52 +145,11 @@ gitea-actions:
  statefulset:
    replicas: 6
    timezone: America/Chicago
-    resources:
-      limits:
-        ephemeral-storage: 15Gi
-      requests:
-        ephemeral-storage: 2Gi
-    affinity:
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 100
-            podAffinityTerm:
-              labelSelector:
-                matchExpressions:
-                  - key: app.kubernetes.io/name
-                    operator: In
-                    values:
-                    - gitea-actions-act-runner
-              topologyKey: "kubernetes.io/hostname"
-    extraVolumes:
-      - name: workspace-vol
-        ephemeral:
-          volumeClaimTemplate:
-            spec:
-              accessModes:
-                - ReadWriteOnce
-              storageClassName: ceph-block
-              resources:
-                requests:
-                  storage: 20Gi
-      - name: docker-vol
-        ephemeral:
-          volumeClaimTemplate:
-            spec:
-              accessModes:
-                - ReadWriteOnce
-              storageClassName: ceph-block
-              resources:
-                requests:
-                  storage: 50Gi
    actRunner:
      registry: docker.io
      repository: gitea/act_runner
      # renovate: datasource=docker depName=gitea/act_runner
      tag: 0.3.1@sha256:c2a169c5e99864c25e32527cef3d82203225e09558773022bf3dc164a2e6d762
-      extraVolumeMounts:
-        - name: workspace-vol
-          mountPath: /workspace
      config: |
        log:
          level: debug
@@ -207,9 +166,6 @@ gitea-actions:
      repository: docker
      # renovate: datasource=docker depName=docker
      tag: 29.3.1-dind@sha256:4d90f1f6c400315c2dba96d3ec93c01e64198395cbba04f79d12adce4f737029
-      extraVolumeMounts:
-        - name: docker-vol
-          mountPath: /var/lib/docker
    persistence:
      storageClass: ceph-block
      size: 10Gi
--- a/clusters/cl01tl/helm/home-assistant/Chart.yaml
+++ b/clusters/cl01tl/helm/home-assistant/Chart.yaml
@@ -24,4 +24,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/home-assistant.png
 # renovate: datasource=github-releases depName=home-assistant/core
-appVersion: 2026.4.1
+appVersion: 2026.4.0
--- a/clusters/cl01tl/helm/home-assistant/values.yaml
+++ b/clusters/cl01tl/helm/home-assistant/values.yaml
@@ -12,7 +12,7 @@ home-assistant:
        main:
          image:
            repository: ghcr.io/home-assistant/home-assistant
-            tag: 2026.4.1@sha256:8848691147f01a6eee7753de2ade21b04d6168fcd2e2a7089f6f84e3b7b86960
+            tag: 2026.4.0@sha256:7fbf6a5e006e889d7799476ad7646bd18e9dc73e8a4ccd9326b41798de6bb3bf
          env:
            - name: TZ
              value: America/Chicago
@@ -23,7 +23,7 @@ home-assistant:
        code-server:
          image:
            repository: ghcr.io/linuxserver/code-server
-            tag: 4.114.0-ls328@sha256:928e63f0b775d76cda606f181bae9d81c6d3fbd2d1daeef9438e3ba5579f391d
+            tag: 4.112.0-ls325@sha256:a17ee95f4e1b43284fe5dfea99e82c8a26f096534215ff36817fa80161eec220
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/houndarr/Chart.yaml
+++ b/clusters/cl01tl/helm/houndarr/Chart.yaml
@@ -4,7 +4,6 @@ version: 1.0.0
 description: Houndarr
 keywords:
  - houndarr
-  - rescan
  - servarr
 home: https://docs.alexlebens.dev/applications/houndarr/
 sources:
@@ -25,4 +24,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/houndarr.png
 # renovate: datasource=github-releases depName=av1155/houndarr
-appVersion: v1.7.0
+appVersion: v1.6.5
--- a/clusters/cl01tl/helm/houndarr/values.yaml
+++ b/clusters/cl01tl/helm/houndarr/values.yaml
@@ -8,7 +8,7 @@ houndarr:
        main:
          image:
            repository: ghcr.io/av1155/houndarr
-            tag: v1.7.0@sha256:8ae2a8b86497cbc54d11591c12220f3be3319039c2bdd0c8b041b2b7c2fd7943
+            tag: v1.6.6@sha256:6ecf6c92759a82068a3fbef3eae9065c88e1d8706b538832d07dc4854bc94ec0
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/jellyfin/values.yaml
+++ b/clusters/cl01tl/helm/jellyfin/values.yaml
@@ -5,9 +5,6 @@ jellyfin:
      replicas: 1
      strategy: Recreate
      pod:
-        securityContext:
-          fsGroup: 1000
-          fsGroupChangePolicy: OnRootMismatch
        affinity:
          podAntiAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
--- a/clusters/cl01tl/helm/jellystat/Chart.yaml
+++ b/clusters/cl01tl/helm/jellystat/Chart.yaml
@@ -29,4 +29,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/jellystat.png
 # renovate: datasource=github-releases depName=CyferShepard/Jellystat
-appVersion: 1.1.9
+appVersion: 1.1.7
--- a/clusters/cl01tl/helm/jellystat/values.yaml
+++ b/clusters/cl01tl/helm/jellystat/values.yaml
@@ -8,7 +8,7 @@ jellystat:
        main:
          image:
            repository: ghcr.io/cyfershepard/jellystat
-            tag: 1.1.9@sha256:f7f56aabad139faa996b8bb21a36dd3e65f7c87e10408921815b95a28a4efbaf
+            tag: 1.1.8@sha256:c8c451704ba7985340142cd047e2364cabaf41b613669b6c5340688ed217f82a
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/kiwix/Chart.yaml
+++ b/clusters/cl01tl/helm/kiwix/Chart.yaml
@@ -5,7 +5,7 @@ description: Kiwix
 keywords:
  - kiwix
  - wikipedia
-home: https://docs.alexlebens.dev/applications/kiwix/
+home: https://wiki.alexlebens.dev/s/16eaaf92-3607-421f-bc66-cb3c39eeaea0
 sources:
  - https://github.com/kiwix
  - https://github.com/kiwix/kiwix-tools/pkgs/container/kiwix-serve
--- a/clusters/cl01tl/helm/kiwix/values.yaml
+++ b/clusters/cl01tl/helm/kiwix/values.yaml
@@ -4,11 +4,13 @@ kiwix:
      type: deployment
      replicas: 1
      strategy: Recreate
+      revisionHistoryLimit: 3
      containers:
        main:
          image:
            repository: ghcr.io/kiwix/kiwix-serve
-            tag: 3.8.2@sha256:acdab28186a66b51bfd4202210c6732931ea95cf41c711148a0c9770b9fcc9e1
+            tag: 3.8.2
+            pullPolicy: IfNotPresent
          args:
            - '*.zim'
          env:
@@ -16,8 +18,8 @@ kiwix:
              value: 8080
          resources:
            requests:
-              cpu: 1m
-              memory: 10Mi
+              cpu: 50m
+              memory: 512Mi
  service:
    main:
      controller: main
@@ -25,6 +27,7 @@ kiwix:
        http:
          port: 80
          targetPort: 8080
+          protocol: HTTP
  route:
    main:
      kind: HTTPRoute
@@ -37,8 +40,11 @@ kiwix:
        - kiwix.alexlebens.net
      rules:
        - backendRefs:
-            - name: kiwix
+            - group: ''
+              kind: Service
+              name: kiwix
              port: 80
+              weight: 100
          matches:
            - path:
                type: PathPrefix
--- a/clusters/cl01tl/helm/komodo/Chart.lock
+++ b/clusters/cl01tl/helm/komodo/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 4.6.2
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.11.1
+  version: 7.10.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.8.0
-digest: sha256:9af0fa5ab5e1895e94d64ea5983b5ee58c8b4dd9c5c8ef8021c8c7f950fd54c4
-generated: "2026-04-02T20:28:17.818342-05:00"
+digest: sha256:c1bbed66c94b64ba44ef1caadf74d46d9bce551e37b62b1cd0a3af9b81046251
+generated: "2026-03-24T14:00:56.813765-05:00"
--- a/clusters/cl01tl/helm/komodo/Chart.yaml
+++ b/clusters/cl01tl/helm/komodo/Chart.yaml
@@ -4,16 +4,16 @@ version: 1.0.0
 description: Komodo
 keywords:
  - komodo
-  - docker-deployment
-home: https://docs.alexlebens.dev/applications/komodo/
+  - deployment
+  - dashboard
+  - docker-compose
+home: https://wiki.alexlebens.dev/s/bb7eb683-b5c7-4f50-9f2c-e8e57dc67c81
 sources:
  - https://github.com/moghtech/komodo
-  - https://github.com/FerretDB/FerretDB
+  - https://github.com/cloudnative-pg/cloudnative-pg
  - https://github.com/moghtech/komodo/pkgs/container/komodo-core
-  - https://github.com/ferretdb/FerretDB/pkgs/container/ferretdb
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
  - name: alexlebens
 dependencies:
@@ -23,7 +23,7 @@ dependencies:
    version: 4.6.2
  - name: postgres-cluster
    alias: postgresql-17-fdb-cluster
-    version: 7.11.1
+    version: 7.10.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-keys
@@ -31,4 +31,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/komodo.png
 # renovate: datasource=github-releases depName=moghtech/komodo
-appVersion: v2.1.1
+appVersion: v2.1.0
--- a/clusters/cl01tl/helm/komodo/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/komodo/templates/external-secret.yaml
@@ -14,23 +14,38 @@ spec:
  data:
    - secretKey: passkey
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/komodo/config
+        metadataPolicy: None
        property: passkey
    - secretKey: jwt
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/komodo/config
+        metadataPolicy: None
        property: jwt
    - secretKey: webhook
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/komodo/config
+        metadataPolicy: None
        property: webhook
    - secretKey: oidc-client-id
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /authentik/oidc/komodo
+        metadataPolicy: None
        property: client
    - secretKey: oidc-client-secret
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /authentik/oidc/komodo
+        metadataPolicy: None
        property: secret

 ---
@@ -50,9 +65,15 @@ spec:
  data:
    - secretKey: uri
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/komodo/ferret
+        metadataPolicy: None
        property: uri
    - secretKey: password
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/komodo/ferret
+        metadataPolicy: None
        property: password
--- a/clusters/cl01tl/helm/komodo/values.yaml
+++ b/clusters/cl01tl/helm/komodo/values.yaml
@@ -4,11 +4,13 @@ komodo:
      type: deployment
      replicas: 1
      strategy: Recreate
+      revisionHistoryLimit: 3
      containers:
        main:
          image:
            repository: ghcr.io/moghtech/komodo-core
-            tag: 2.1.1@sha256:2bbbb1efd3534211dac35091e0818f10398d9bdd98fdbf0ddef09e9e0b5ec4ba
+            tag: 2.1.0@sha256:4915d91b5c6e9de4e8fd59391eed5cad090ec84dcf6a1a9233d97edfdbbb88e7
+            pullPolicy: IfNotPresent
          env:
            - name: COMPOSE_LOGGING_DRIVER
              value: local
@@ -43,7 +45,7 @@ komodo:
            - name: KOMODO_LOCAL_AUTH
              value: true
            - name: KOMODO_ENABLE_NEW_USERS
-              value: false
+              value: true
            - name: KOMODO_DISABLE_NON_ADMIN_CREATE
              value: true
            - name: KOMODO_TRANSPARENT_MODE
@@ -80,16 +82,18 @@ komodo:
          resources:
            requests:
              cpu: 10m
-              memory: 80Mi
+              memory: 128Mi
    ferretdb-2:
      type: deployment
      replicas: 1
      strategy: Recreate
+      revisionHistoryLimit: 3
      containers:
        main:
          image:
            repository: ghcr.io/ferretdb/ferretdb
-            tag: 2.7.0@sha256:5706414241eb84f0515512c37b46db0f1b1eac9e5ceb7e4c2523211c184b1985
+            tag: 2.7.0
+            pullPolicy: IfNotPresent
          env:
            - name: DB_USERNAME
              value: ferret
@@ -102,8 +106,8 @@ komodo:
              value: postgresql://$(DB_USERNAME):$(DB_PASSWORD)@komodo-postgresql-17-fdb-cluster-rw.komodo.svc.cluster.local:5432/ferretDB
          resources:
            requests:
-              cpu: 1m
-              memory: 20Mi
+              cpu: 10m
+              memory: 128Mi
  service:
    main:
      controller: main
@@ -111,12 +115,14 @@ komodo:
        http:
          port: 80
          targetPort: 9120
+          protocol: HTTP
    ferretdb-2:
      controller: ferretdb-2
      ports:
        http:
          port: 27017
          targetPort: 27017
+          protocol: HTTP
  route:
    main:
      kind: HTTPRoute
@@ -129,8 +135,11 @@ komodo:
        - komodo.alexlebens.net
      rules:
        - backendRefs:
-            - name: komodo-main
+            - group: ''
+              kind: Service
+              name: komodo-main
              port: 80
+              weight: 100
          matches:
            - path:
                type: PathPrefix
@@ -141,6 +150,7 @@ komodo:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 1Gi
+      retain: true
      advancedMounts:
        main:
          main:
@@ -150,6 +160,7 @@ komodo:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 5Gi
+      retain: true
      advancedMounts:
        main:
          main:
@@ -159,6 +170,7 @@ komodo:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 5Gi
+      retain: true
      advancedMounts:
        main:
          main:
@@ -170,7 +182,7 @@ postgresql-17-fdb-cluster:
  cluster:
    image:
      repository: ghcr.io/ferretdb/postgres-documentdb
-      tag: 17-0.107.0-ferretdb-2.7.0@sha256:2386795ec2aa7ae559304361979f1dc5708d383ee9020ae63dadc2940dfe58f7
+      tag: "17-0.106.0-ferretdb-2.5.0"
    postgresUID: 999
    postgresGID: 999
    postgresql:
@@ -212,12 +224,35 @@ postgresql-17-fdb-cluster:
        destinationBucket: postgres-backups
        externalSecretCredentialPath: /garage/home-infra/postgres-backups
        isWALArchiver: true
+      # - name: garage-remote
+      #   index: 1
+      #   destinationBucket: postgres-backups
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   retentionPolicy: "90d"
+      #   data:
+      #     compression: bzip2
+      # - name: external
+      #   index: 1
+      #   endpointURL: https://nyc3.digitaloceanspaces.com
+      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   isWALArchiver: false
    scheduledBackups:
      - name: live-backup
        suspend: false
        immediate: true
        schedule: "0 50 14 * * *"
        backupName: garage-local
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 4 * * SAT"
+      #   backupName: garage-remote
+      # - name: daily-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
 volsync-target-keys:
  pvcTarget: komodo-keys
  local:
--- a/clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock
@@ -1,12 +1,12 @@
 dependencies:
 - name: kube-prometheus-stack
  repository: oci://ghcr.io/prometheus-community/charts
-  version: 82.17.1
+  version: 82.16.1
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.6.2
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-digest: sha256:8c2a56a7d6bf858a59e6a46a7ff2d3cbfdf022adb985254ec869e348d3ddb68b
-generated: "2026-04-04T12:02:57.648448879Z"
+  version: 0.4.0
+digest: sha256:ece31be37d2fa7c7c59058e2d47e8190bea3baa742b4f04fe793956cd2d52f7f
+generated: "2026-04-02T07:03:55.367235416Z"
--- a/clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml
@@ -5,20 +5,22 @@ description: Kube Prometheus Stack
 keywords:
  - kube-prometheus-stack
  - prometheus
-home: https://docs.alexlebens.dev/applications/kube-prometheus-stack/
+  - alertmanager
+  - metrics
+  - alerts
+  - kubernetes
+home: https://wiki.alexlebens.dev/s/cd9fc3a4-aa88-4285-8886-91a6c5aecf7d
 sources:
  - https://github.com/prometheus/prometheus
  - https://github.com/prometheus-operator/kube-prometheus
-  - https://git.xenrox.net/~xenrox/ntfy-alertmanager/
-  - https://hub.docker.com/r/xenrox/ntfy-alertmanager
+  - https://github.com/alexbakker/alertmanager-ntfy
  - https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack
  - https://github.com/bjw-s/helm-charts/blob/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
 maintainers:
  - name: alexlebens
 dependencies:
  - name: kube-prometheus-stack
-    version: 82.17.1
+    version: 82.16.1
    repository: oci://ghcr.io/prometheus-community/charts
  - name: app-template
    alias: ntfy-alertmanager
@@ -26,7 +28,7 @@ dependencies:
    version: 4.6.2
  - name: valkey
    alias: valkey
-    version: 0.5.0
+    version: 0.4.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prometheus.png
 # renovate: datasource=github-releases depName=prometheus-operator/prometheus-operator
--- a/clusters/cl01tl/helm/kube-prometheus-stack/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/templates/external-secret.yaml
@@ -14,7 +14,10 @@ spec:
  data:
    - secretKey: ntfy_password
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/kube-prometheus-stack/ntfy-alertmanager
+        metadataPolicy: None
        property: ntfy_password

 ---
@@ -34,7 +37,10 @@ spec:
  data:
    - secretKey: token
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /garage/token
+        metadataPolicy: None
        property: metric

 ---
@@ -54,9 +60,15 @@ spec:
  data:
    - secretKey: ntfy_password
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/kube-prometheus-stack/ntfy-alertmanager
+        metadataPolicy: None
        property: ntfy_password
    - secretKey: config
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/kube-prometheus-stack/ntfy-alertmanager
+        metadataPolicy: None
        property: config
--- a/clusters/cl01tl/helm/kube-prometheus-stack/values.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/values.yaml
@@ -9,8 +9,10 @@ kube-prometheus-stack:
      kubeSchedulerRecording: false
  global:
    rbac:
+      create: true
      createAggregateClusterRoles: true
  alertmanager:
+    enabled: true
    config:
      route:
        group_by: ["namespace", "alertname"]
@@ -34,6 +36,8 @@ kube-prometheus-stack:
    route:
      main:
        enabled: true
+        apiVersion: gateway.networking.k8s.io/v1
+        kind: HTTPRoute
        hostnames:
          - alertmanager.alexlebens.net
        parentRefs:
@@ -41,9 +45,14 @@ kube-prometheus-stack:
            kind: Gateway
            name: traefik-gateway
            namespace: traefik
+        matches:
+          - path:
+              type: PathPrefix
+              value: /
    alertmanagerSpec:
      secrets:
        - alertmanager-config-secret
+      replicas: 1
  grafana:
    enabled: false
  kubeApiServer:
@@ -52,13 +61,11 @@ kube-prometheus-stack:
  kubeControllerManager:
    enabled: false
  kubeEtcd:
+    enabled: true
    service:
      selector:
        k8s-app: kube-controller-manager
    serviceMonitor:
-      metricRelabelings:
-        - action: labeldrop
-          regex: pod
      relabelings:
        - sourceLabels: [__meta_kubernetes_pod_node_name]
          separator: ;
@@ -66,12 +73,22 @@ kube-prometheus-stack:
          targetLabel: nodename
          replacement: $1
          action: replace
+      metricRelabelings:
+        - action: labeldrop
+          regex: pod
  kubeScheduler:
    enabled: false
  kubeProxy:
    enabled: false
+  kubeStateMetrics:
+    enabled: true
+  nodeExporter:
+    operatingSystems:
+      darwin:
+        enabled: false
  prometheusOperator:
    admissionWebhooks:
+      enabled: true
      annotations:
        argocd.argoproj.io/hook: PreSync
        argocd.argoproj.io/hook-delete-policy: HookSucceeded
@@ -89,6 +106,8 @@ kube-prometheus-stack:
    route:
      main:
        enabled: true
+        apiVersion: gateway.networking.k8s.io/v1
+        kind: HTTPRoute
        hostnames:
          - prometheus.alexlebens.net
        parentRefs:
@@ -96,10 +115,13 @@ kube-prometheus-stack:
            kind: Gateway
            name: traefik-gateway
            namespace: traefik
+        matches:
+          - path:
+              type: PathPrefix
+              value: /
    prometheusSpec:
      scrapeInterval: 30s
-      retention: 45d
-      retentionSize: 240GiB
+      retention: 30d
      externalUrl: https://prometheus.alexlebens.net
      ruleSelectorNilUsesHelmValues: false
      serviceMonitorSelectorNilUsesHelmValues: false
@@ -120,11 +142,14 @@ ntfy-alertmanager:
    main:
      type: deployment
      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
      containers:
        main:
          image:
            repository: xenrox/ntfy-alertmanager
-            tag: 1.0.0@sha256:81788c7905774b7b0b2ed6833b2bc4826a90a42e4b738706edcedd5f489e7a73
+            tag: 1.0.0
+            pullPolicy: IfNotPresent
  service:
    main:
      controller: main
@@ -132,6 +157,7 @@ ntfy-alertmanager:
        http:
          port: 80
          targetPort: 8080
+          protocol: HTTP
  persistence:
    config:
      enabled: true
--- a/clusters/cl01tl/helm/kubelet-serving-cert-approver/Chart.yaml
+++ b/clusters/cl01tl/helm/kubelet-serving-cert-approver/Chart.yaml
@@ -4,8 +4,9 @@ version: 1.0.0
 description: Kubelet Serving Cert Approver
 keywords:
  - kubelet-serving-cert-approver
+  - kubernetes
  - certificate
-home: https://docs.alexlebens.dev/applications/kubelet-serving-cert-approver/
+home: https://wiki.alexlebens.dev/s/3aa80722-db85-41b4-ba1e-8d4c3d8643b5
 sources:
  - https://github.com/alex1989hu/kubelet-serving-cert-approver
  - https://github.com/alex1989hu/kubelet-serving-cert-approver/pkgs/container/kubelet-serving-cert-approver
--- a/clusters/cl01tl/helm/kubelet-serving-cert-approver/values.yaml
+++ b/clusters/cl01tl/helm/kubelet-serving-cert-approver/values.yaml
@@ -29,6 +29,7 @@ kubelet-serving-cert-approver:
      type: deployment
      replicas: 1
      strategy: Recreate
+      revisionHistoryLimit: 3
      serviceAccount:
        name: kubelet-serving-cert-approver
      pod:
@@ -37,7 +38,8 @@ kubelet-serving-cert-approver:
        main:
          image:
            repository: ghcr.io/alex1989hu/kubelet-serving-cert-approver
-            tag: 0.10.3@sha256:4cdc92140c48341433513dce3201806309d5256cfbac6f830feae1e7e9fb0d7d
+            tag: 0.10.3
+            pullPolicy: Always
          args:
            - serve
          env:
@@ -47,8 +49,8 @@ kubelet-serving-cert-approver:
                  fieldPath: metadata.namespace
          resources:
            requests:
-              cpu: 1m
-              memory: 20Mi
+              cpu: 100m
+              memory: 128Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
@@ -68,6 +70,8 @@ kubelet-serving-cert-approver:
        health:
          port: 8080
          targetPort: 8080
+          protocol: HTTP
        metrics:
          port: 9090
          targetPort: 9090
+          protocol: HTTP
--- a/clusters/cl01tl/helm/kubernetes-cloudflare-ddns/Chart.yaml
+++ b/clusters/cl01tl/helm/kubernetes-cloudflare-ddns/Chart.yaml
@@ -4,8 +4,10 @@ version: 1.0.0
 description: Kubernetes Cloudflare DDNS
 keywords:
  - kubernetes-cloudflare-ddns
+  - cloudflare
  - ddns
-home: https://docs.alexlebens.dev/applications/kubelet-serving-cert-approver/
+  - kubernetes
+home: https://wiki.alexlebens.dev/s/49513b51-cf91-4efd-b2a5-957555bc3ad7
 sources:
  - https://github.com/kubitodev/kubernetes-cloudflare-ddns
  - https://hub.docker.com/r/kubitodev/kubernetes-cloudflare-ddns
--- a/clusters/cl01tl/helm/kubernetes-cloudflare-ddns/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/kubernetes-cloudflare-ddns/templates/external-secret.yaml
@@ -14,17 +14,29 @@ spec:
  data:
    - secretKey: AUTH_KEY
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cloudflare/alexlebens.net/ddns
+        metadataPolicy: None
        property: token
    - secretKey: NAME
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cloudflare/alexlebens.net/ddns
+        metadataPolicy: None
        property: name
    - secretKey: RECORD_ID
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cloudflare/alexlebens.net/ddns
+        metadataPolicy: None
        property: record-id
    - secretKey: ZONE_ID
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cloudflare/alexlebens.net/ddns
+        metadataPolicy: None
        property: zone-id
--- a/clusters/cl01tl/helm/kubernetes-cloudflare-ddns/values.yaml
+++ b/clusters/cl01tl/helm/kubernetes-cloudflare-ddns/values.yaml
@@ -4,19 +4,24 @@ kubernetes-cloudflare-ddns:
      type: cronjob
      cronjob:
        suspend: false
-        timeZone: America/Chicago
+        concurrencyPolicy: Forbid
+        timeZone: US/Central
        schedule: "30 4 * * *"
+        startingDeadlineSeconds: 90
+        successfulJobsHistory: 1
+        failedJobsHistory: 1
        backoffLimit: 3
        parallelism: 1
      containers:
        main:
          image:
            repository: kubitodev/kubernetes-cloudflare-ddns
-            tag: 2.0.0sha256:80979b046e32ecccedfa6c00804676d070ef87c7f77a65e4afa4e91ffdeb7309
+            tag: 2.0.0
+            pullPolicy: IfNotPresent
          envFrom:
            - secretRef:
                name: kubernetes-cloudflare-ddns-secret
          resources:
            requests:
              cpu: 10m
-              memory: 32Mi
+              memory: 128Mi
--- a/clusters/cl01tl/helm/languagetool/Chart.yaml
+++ b/clusters/cl01tl/helm/languagetool/Chart.yaml
@@ -5,13 +5,12 @@ description: LanguageTool
 keywords:
  - languagetool
  - spellchecking
-home: https://docs.alexlebens.dev/applications/languagetool/
+home: https://wiki.alexlebens.dev/
 sources:
  - https://github.com/languagetool-org/languagetool
  - https://github.com/Erikvl87/docker-languagetool
  - https://hub.docker.com/r/erikvl87/languagetool
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
  - name: alexlebens
 dependencies:
--- a/clusters/cl01tl/helm/languagetool/values.yaml
+++ b/clusters/cl01tl/helm/languagetool/values.yaml
@@ -4,11 +4,13 @@ languagetool:
      type: deployment
      replicas: 1
      strategy: Recreate
+      revisionHistoryLimit: 3
      containers:
        main:
          image:
            repository: erikvl87/languagetool
-            tag: 6.7@sha256:454acc9b3d232bdf37a0eddb1c8d0e93513ce41b914a8a374e3c44a884122364
+            tag: 6.7
+            pullPolicy: IfNotPresent
          env:
            - name: langtool_languageModel
              value: /ngrams
@@ -18,8 +20,8 @@ languagetool:
              value: 1g
          resources:
            requests:
-              cpu: 1m
-              memory: 800Mi
+              cpu: 10m
+              memory: 128Mi
  service:
    main:
      controller: main
@@ -27,6 +29,7 @@ languagetool:
        http:
          port: 80
          targetPort: 8010
+          protocol: HTTP
  route:
    main:
      kind: HTTPRoute
@@ -39,8 +42,11 @@ languagetool:
        - languagetool.alexlebens.net
      rules:
        - backendRefs:
-            - name: languagetool
+            - group: ''
+              kind: Service
+              name: languagetool
              port: 80
+              weight: 100
          matches:
            - path:
                type: PathPrefix
@@ -51,6 +57,7 @@ languagetool:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 1Gi
+      retain: true
      advancedMounts:
        main:
          main:
--- a/clusters/cl01tl/helm/libation/Chart.yaml
+++ b/clusters/cl01tl/helm/libation/Chart.yaml
@@ -4,14 +4,13 @@ version: 1.0.0
 description: Libation
 keywords:
  - libation
+  - audiobooks
  - audible
-home: https://docs.alexlebens.dev/applications/languagetool/
+home: https://wiki.alexlebens.dev/s/63beac50-a63f-45fe-b8e5-e1691dd5e9b0
 sources:
  - https://github.com/rmcrackan/Libation
  - https://hub.docker.com/r/rmcrackan/libation
-  - https://hub.docker.com/_/ubuntu/tags
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
  - name: alexlebens
 dependencies:
--- a/clusters/cl01tl/helm/libation/values.yaml
+++ b/clusters/cl01tl/helm/libation/values.yaml
@@ -4,15 +4,20 @@ libation:
      type: cronjob
      cronjob:
        suspend: false
-        timeZone: America/Chicago
+        concurrencyPolicy: Forbid
+        timeZone: US/Central
        schedule: 0 0 1 1 *
+        startingDeadlineSeconds: 90
+        successfulJobsHistory: 1
+        failedJobsHistory: 1
        backoffLimit: 3
        parallelism: 1
      containers:
        main:
          image:
            repository: rmcrackan/libation
-            tag: 13.3.2@sha256:d1c45260f3ba34b0fb1432c2b51763e00c5174864961856c1c31e7f2b0c3a39e
+            tag: 13.3.2
+            pullPolicy: IfNotPresent
          env:
            - name: SLEEP_TIME
              value: "-1"
@@ -21,7 +26,7 @@ libation:
          resources:
            requests:
              cpu: 10m
-              memory: 32Mi
+              memory: 128Mi
    debug:
      type: deployment
      replicas: 0
@@ -30,7 +35,8 @@ libation:
        main:
          image:
            repository: ubuntu
-            tag: resolute-20260401@sha256:a072b64036a738e55bff8f9a9682cbb893bf20c213772effc1de8dee8df1cea9
+            tag: resolute-20260401
+            pullPolicy: IfNotPresent
          command:
            - "sleep"
            - "infinity"
@@ -44,6 +50,7 @@ libation:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 500Mi
+      retain: true
      advancedMounts:
        main:
          main:
--- a/clusters/cl01tl/helm/lidarr/Chart.lock
+++ b/clusters/cl01tl/helm/lidarr/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 4.6.2
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.11.1
+  version: 7.10.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.8.0
-digest: sha256:28d9013864be22eb7085fc88a45c0b8a555a582026c779dd72fca4a2e1728d2a
-generated: "2026-04-03T19:30:51.252965-05:00"
+digest: sha256:0f1a2923a7042b364a817edc64729d5e1c18b0552555c035d974de626f372692
+generated: "2026-03-15T20:07:00.750754951Z"
--- a/clusters/cl01tl/helm/lidarr/Chart.yaml
+++ b/clusters/cl01tl/helm/lidarr/Chart.yaml
@@ -4,18 +4,17 @@ version: 1.0.0
 description: Lidarr
 keywords:
  - lidarr
-  - music
  - servarr
-home: https://docs.alexlebens.dev/applications/lidarr/
+  - music
+  - metrics
+home: https://wiki.alexlebens.dev/s/f7c4e892-aa3b-435f-b220-317dc53137ac
 sources:
  - https://github.com/Lidarr/Lidarr
  - https://github.com/linuxserver/docker-lidarr
-  - https://github.com/onedr0p/exportarr
-  - https://github.com/linuxserver/docker-lidarr/pkgs/container/lidarr
+  - https://github.com/cloudnative-pg/cloudnative-pg
  - https://github.com/onedr0p/exportarr/pkgs/container/exportarr
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
  - name: alexlebens
 dependencies:
@@ -25,12 +24,11 @@ dependencies:
    version: 4.6.2
  - name: postgres-cluster
    alias: postgres-18-cluster
-    version: 7.11.1
+    version: 7.10.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-config
    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/lidarr.png
-# renovate: datasource=github-releases depName=linuxserver/docker-lidarr
 appVersion: 3.1.2-nightly
--- a/clusters/cl01tl/helm/lidarr/values.yaml
+++ b/clusters/cl01tl/helm/lidarr/values.yaml
@@ -4,6 +4,7 @@ lidarr:
      type: deployment
      replicas: 1
      strategy: Recreate
+      revisionHistoryLimit: 3
      pod:
        securityContext:
          runAsUser: 1000
@@ -15,9 +16,10 @@ lidarr:
          image:
            repository: ghcr.io/linuxserver/lidarr
            tag: 3.1.2-nightly@sha256:034055feee43b11eb2f7a8438a9af1c99ab564dd2b43e5df2fe5b3c9b3b8b1ac
+            pullPolicy: IfNotPresent
          env:
            - name: TZ
-              value: America/Chicago
+              value: US/Central
            - name: PUID
              value: 1000
            - name: PGID
@@ -25,11 +27,12 @@ lidarr:
          resources:
            requests:
              cpu: 100m
-              memory: 300Mi
+              memory: 256Mi
        metrics:
          image:
            repository: ghcr.io/onedr0p/exportarr
-            tag: v2.3.0@sha256:af535d94061cf97a52e1661945ffba78c03f9443eae7c0da1a80a5a4be56b520
+            tag: v2.3.0
+            pullPolicy: IfNotPresent
          args: ["lidarr"]
          env:
            - name: URL
@@ -42,6 +45,10 @@ lidarr:
              value: false
            - name: ENABLE_UNKNOWN_QUEUE_ITEMS
              value: false
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
  service:
    main:
      controller: main
@@ -49,9 +56,11 @@ lidarr:
        http:
          port: 80
          targetPort: 8686
+          protocol: HTTP
        metrics:
          port: 9792
          targetPort: 9792
+          protocol: TCP
  serviceMonitor:
    main:
      selector:
@@ -86,8 +95,11 @@ lidarr:
                type: PathPrefix
                value: /outpost.goauthentik.io
        - backendRefs:
-            - name: lidarr
+            - group: ''
+              kind: Service
+              name: lidarr
              port: 80
+              weight: 100
          filters:
            - type: ExtensionRef
              extensionRef:
@@ -104,6 +116,7 @@ lidarr:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 10Gi
+      retain: true
      advancedMounts:
        main:
          main:
@@ -137,12 +150,35 @@ postgres-18-cluster:
        destinationBucket: postgres-backups
        externalSecretCredentialPath: /garage/home-infra/postgres-backups
        isWALArchiver: true
+      # - name: garage-remote
+      #   index: 1
+      #   destinationBucket: postgres-backups
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   retentionPolicy: "90d"
+      #   data:
+      #     compression: bzip2
+      # - name: external
+      #   index: 1
+      #   endpointURL: https://nyc3.digitaloceanspaces.com
+      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   isWALArchiver: false
    scheduledBackups:
      - name: live-backup
        suspend: false
        immediate: true
        schedule: "0 55 14 * * *"
        backupName: garage-local
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 4 * * SAT"
+      #   backupName: garage-remote
+      # - name: daily-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
 volsync-target-config:
  pvcTarget: lidarr-config
  moverSecurityContext:
--- a/clusters/cl01tl/helm/local-path-provisioner/Chart.yaml
+++ b/clusters/cl01tl/helm/local-path-provisioner/Chart.yaml
@@ -5,7 +5,8 @@ description: Local Path Provisioner
 keywords:
  - local-path-provisioner
  - storage
-home: https://docs.alexlebens.dev/applications/local-path-provisioner/
+  - kubernetes
+home: https://wiki.alexlebens.dev/s/fa4d4152-b9dd-4fdc-a6f2-93a2c0df7f4a
 sources:
  - https://github.com/rancher/local-path-provisioner
  - https://hub.docker.com/r/rancher/local-path-provisioner
--- a/clusters/cl01tl/helm/local-path-provisioner/values.yaml
+++ b/clusters/cl01tl/helm/local-path-provisioner/values.yaml
@@ -1,11 +1,10 @@
 local-path-provisioner:
-  replicaCount: 1
  image:
    repository: rancher/local-path-provisioner
-    tag: v0.0.35@sha256:34ff0847cc47ebf69656ba44a3de9324596d0036b66ffd323b21614dd8221530
+    tag: v0.0.35
  helperImage:
    repository: busybox
-    tag: 1.37.0@sha256:1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e
+    tag: 1.37.0
  storageClass:
    create: true
    defaultClass: false
@@ -13,10 +12,6 @@ local-path-provisioner:
    name: local-path
    reclaimPolicy: Delete
    volumeBindingMode: WaitForFirstConsumer
-  resources:
-    limits:
-      cpu: 1m
-      memory: 30Mi
  nodePathMap:
    - node: DEFAULT_PATH_FOR_NON_LISTED_NODES
      paths:
--- a/clusters/cl01tl/helm/loki/Chart.yaml
+++ b/clusters/cl01tl/helm/loki/Chart.yaml
@@ -4,13 +4,14 @@ version: 1.0.0
 description: Loki
 keywords:
  - loki
+  - promtail
  - logs
-home: https://docs.alexlebens.dev/applications/loki/
+  - kubernetes
+home: https://wiki.alexlebens.dev/s/c5a4dc61-5487-46c9-88f1-cac363742d30
 sources:
  - https://github.com/grafana/loki
-  - https://github.com/grafana/alloy
  - https://github.com/grafana/loki/tree/main/production/helm/loki
-  - https://github.com/grafana/alloy/tree/main/operations/helm/charts/alloy
+  - https://github.com/grafana/helm-charts/tree/main/charts/promtail
 maintainers:
  - name: alexlebens
 dependencies:
--- a/clusters/cl01tl/helm/loki/values.yaml
+++ b/clusters/cl01tl/helm/loki/values.yaml
@@ -2,14 +2,25 @@ loki:
  deploymentMode: SingleBinary
  loki:
    auth_enabled: false
+    commonConfig:
+      replication_factor: 1
+    ingester_client:
+      pool_config:
+        remote_timeout: 10s
+      remote_timeout: 10s
    limits_config:
      allow_structured_metadata: false
      max_streams_per_user: 100000
      ingestion_rate_mb: 1024
      ingestion_burst_size_mb: 1024
      retention_period: 7d
-    commonConfig:
-      replication_factor: 1
+    compactor:
+      delete_request_store: filesystem
+      working_directory: /var/loki/compactor
+      compaction_interval: 10m
+      retention_enabled: true
+      retention_delete_delay: 2h
+      retention_delete_worker_count: 150
    storage:
      type: filesystem
    schemaConfig:
@@ -20,34 +31,16 @@ loki:
          schema: v13
          index:
            period: 24h
-    compactor:
-      delete_request_store: filesystem
-      working_directory: /var/loki/compactor
-      compaction_interval: 10m
-      retention_enabled: true
-      retention_delete_delay: 2h
-      retention_delete_worker_count: 150
-    ingester_client:
-      pool_config:
-        remote_timeout: 10s
-      remote_timeout: 10s
  enterprise:
    enabled: false
  gateway:
    enabled: true
-    resources:
-      requests:
-        cpu: 10m
-        memory: 20Mi
    basicAuth:
      enabled: false
  singleBinary:
    replicas: 1
-    resources:
-      requests:
-        cpu: 100m
-        memory: 800Mi
    persistence:
+      enableStatefulSetAutoDeletePVC: true
      enabled: true
      size: 150Gi
      storageClass: synology-iscsi-delete
@@ -128,5 +121,7 @@ alloy:
            url = "http://loki-gateway.loki.svc.cluster.local:80/loki/api/v1/push"
          }
        }
+  controller:
+    type: 'daemonset'
  serviceMonitor:
    enabled: true
--- a/clusters/cl01tl/helm/mariadb-operator/Chart.yaml
+++ b/clusters/cl01tl/helm/mariadb-operator/Chart.yaml
@@ -5,12 +5,12 @@ description: MariaDB Operator
 keywords:
  - mariadb-operator
  - database
-  - operator
-home: https://docs.alexlebens.dev/applications/mariadb-operator/
+  - storage
+  - kubernetes
+home: https://wiki.alexlebens.dev/
 sources:
  - https://github.com/mariadb-operator/mariadb-operator
  - https://github.com/mariadb-operator/mariadb-operator/tree/main/deploy/charts/mariadb-operator
-  - https://github.com/mariadb-operator/mariadb-operator/tree/main/deploy/charts/mariadb-operator-crds
 maintainers:
  - name: alexlebens
 dependencies:
@@ -20,6 +20,6 @@ dependencies:
  - name: mariadb-operator-crds
    version: 26.3.0
    repository: https://helm.mariadb.com/mariadb-operator
-icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/mariadb.png
+icon: https://mariadb-operator.github.io/mariadb-operator/assets/mariadb_profile.svg
 # renovate: datasource=github-releases depName=mariadb-operator/mariadb-operator
 appVersion: 26.3.0
--- a/clusters/cl01tl/helm/mariadb-operator/values.yaml
+++ b/clusters/cl01tl/helm/mariadb-operator/values.yaml
@@ -1,9 +1,11 @@
 mariadb-operator:
-  crds:
-    enabled: false
  ha:
    enabled: true
+    replicas: 3
  metrics:
    enabled: true
+    serviceMonitor:
+      enabled: true
  pdb:
    enabled: true
+    maxUnavailable: 1
--- a/clusters/cl01tl/helm/matrix-synapse/Chart.lock
+++ b/clusters/cl01tl/helm/matrix-synapse/Chart.lock
@@ -19,13 +19,13 @@ dependencies:
  version: 2.4.0
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.11.1
+  version: 7.10.0
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
+  version: 0.4.0
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
+  version: 0.4.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.8.0
@@ -38,5 +38,5 @@ dependencies:
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.8.0
-digest: sha256:70a7f9dc242a1102eafa0b8a5c481954793d3450eea907c7fb5fd86cb81b1bea
-generated: "2026-04-03T21:00:39.545529-05:00"
+digest: sha256:8fb2d00605ade15db97e778f47ecc1ffae3705ce3408a17e0a21f7def65de884
+generated: "2026-03-24T16:59:56.540825394Z"
--- a/clusters/cl01tl/helm/matrix-synapse/Chart.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/Chart.yaml
@@ -4,15 +4,20 @@ version: 1.0.0
 description: Matrix Synapse
 keywords:
  - matrix-synapse
+  - matrix
  - chat
-home: https://docs.alexlebens.dev/applications/matrix-synapse/
+  - bridge
+  - matrix-hookshot
+  - mautrix-discord
+  - mautrix-whatsapp
+home: https://wiki.alexlebens.dev/s/bd7e7f66-136a-41b8-8144-847bacbb3059
 sources:
  - https://github.com/element-hq/synapse
  - https://github.com/matrix-org/matrix-hookshot
  - https://github.com/mautrix/discord
  - https://github.com/mautrix/whatsapp
-  - https://github.com/rtsp/docker-lighttpd/pkgs/container/docker-lighttpd
-  - https://hub.docker.com/_/alpine
+  - https://github.com/cloudflare/cloudflared
+  - https://github.com/cloudnative-pg/cloudnative-pg
  - https://hub.docker.com/r/halfshot/matrix-hookshot
  - https://mau.dev/mautrix/discord/container_registry
  - https://mau.dev/mautrix/whatsapp/container_registry
@@ -20,8 +25,6 @@ sources:
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
  - name: alexlebens
 dependencies:
@@ -50,15 +53,15 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: postgres-cluster
    alias: postgres-18-cluster
-    version: 7.11.1
+    version: 7.10.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey-matrix-synapse
-    version: 0.5.0
+    version: 0.4.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey-hookshot
-    version: 0.5.0
+    version: 0.4.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-synapse
--- a/clusters/cl01tl/helm/matrix-synapse/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/templates/external-secret.yaml
@@ -14,11 +14,17 @@ spec:
  data:
    - secretKey: oidc.yaml
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/matrix-synapse/config
+        metadataPolicy: None
        property: oidc.yaml
    - secretKey: config.yaml
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/matrix-synapse/config
+        metadataPolicy: None
        property: config.yaml

 ---
@@ -38,7 +44,10 @@ spec:
  data:
    - secretKey: signing.key
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/matrix-synapse/config
+        metadataPolicy: None
        property: signing-key

 ---
@@ -58,19 +67,31 @@ spec:
  data:
    - secretKey: config.yml
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/matrix-synapse/hookshot
+        metadataPolicy: None
        property: config
    - secretKey: registration.yml
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/matrix-synapse/hookshot
+        metadataPolicy: None
        property: registration
    - secretKey: hookshot-registration.yaml
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/matrix-synapse/hookshot
+        metadataPolicy: None
        property: registration
    - secretKey: passkey.pem
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/matrix-synapse/hookshot
+        metadataPolicy: None
        property: passkey

 ---
@@ -89,11 +110,17 @@ spec:
  data:
    - secretKey: config.yaml
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/matrix-synapse/mautrix-discord
+        metadataPolicy: None
        property: config
    - secretKey: mautrix-discord-registration.yaml
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/matrix-synapse/mautrix-discord
+        metadataPolicy: None
        property: registration

 ---
@@ -113,11 +140,17 @@ spec:
  data:
    - secretKey: config.yaml
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/matrix-synapse/mautrix-whatsapp
+        metadataPolicy: None
        property: config
    - secretKey: mautrix-whatsapp-registration.yaml
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/matrix-synapse/mautrix-whatsapp
+        metadataPolicy: None
        property: registration

 ---
@@ -137,7 +170,10 @@ spec:
  data:
    - secretKey: double-puppet-registration.yaml
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/matrix-synapse/double-puppet
+        metadataPolicy: None
        property: registration

 ---
@@ -157,9 +193,15 @@ spec:
  data:
    - secretKey: default
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/matrix-synapse/redis
+        metadataPolicy: None
        property: password
    - secretKey: password
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/matrix-synapse/redis
+        metadataPolicy: None
        property: password
--- a/clusters/cl01tl/helm/matrix-synapse/values.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/values.yaml
@@ -1,7 +1,4 @@
 matrix-synapse:
-  image:
-    repository: ghcr.io/element-hq/synapse
-    tag: v1.150.0@sha256:cba0969087ca70a3ec72ebcd1491a6c8391a7da2c0b92738231dd9c7ad55df4d
  serverName: alexlebens.dev
  publicServerName: matrix.alexlebens.dev
  argoCD: true
@@ -80,7 +77,7 @@ matrix-synapse:
    resources:
      requests:
        cpu: 10m
-        memory: 130Mi
+        memory: 128Mi
  workers:
    default:
      replicaCount: 0
@@ -103,9 +100,6 @@ matrix-synapse:
    client:
      m.homeserver:
        base_url: https://matrix.alexlebens.dev
-    image:
-      repository: ghcr.io/rtsp/docker-lighttpd
-      tag: 1.4.76@sha256:b4b58d217a35dbd6cade82927677de404a46fb3d2b1d5fcb42042b6a6f17b2fb
  postgresql:
    enabled: false
  externalPostgresql:
@@ -131,9 +125,6 @@ matrix-synapse:
    enabled: true
    uid: 666
    gid: 666
-    image:
-      repository: alpine
-      tag: 3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
  ingress:
    enabled: false
  gateway:
@@ -147,15 +138,17 @@ matrix-hookshot:
      type: deployment
      replicas: 1
      strategy: Recreate
+      revisionHistoryLimit: 3
      containers:
        main:
          image:
            repository: halfshot/matrix-hookshot
-            tag: 7.3.2@sha256:44283e5131a1a5818bbbf6d9d1e07dccdc29ac5bb6002fcf159af6ac09cf8085
+            tag: 7.3.2
+            pullPolicy: IfNotPresent
          resources:
            requests:
-              cpu: 5m
-              memory: 90Mi
+              cpu: 10m
+              memory: 128Mi
  service:
    main:
      controller: main
@@ -163,15 +156,19 @@ matrix-hookshot:
        webhook:
          port: 9000
          targetPort: 9000
+          protocol: HTTP
        metrics:
          port: 9001
          targetPort: 9001
+          protocol: HTTP
        widgets:
          port: 9002
          targetPort: 9002
+          protocol: HTTP
        appservice:
          port: 9993
          targetPort: 9993
+          protocol: HTTP
  serviceMonitor:
    main:
      selector:
@@ -223,6 +220,7 @@ matrix-hookshot:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 500Mi
+      retain: true
      advancedMounts:
        main:
          main:
@@ -237,11 +235,13 @@ mautrix-discord:
      type: statefulset
      replicas: 1
      strategy: RollingUpdate
+      revisionHistoryLimit: 3
      # initContainers:
      #   init-copy-config:
      #     image:
      #       repository: busybox
      #       tag: 1.37.0
+      #       pullPolicy: IfNotPresent
      #     resources:
      #       requests:
      #         cpu: 10m
@@ -260,11 +260,12 @@ mautrix-discord:
        main:
          image:
            repository: dock.mau.dev/mautrix/discord
-            tag: v0.7.6@sha256:e4946b0df6a2786c88ed490e0d2692e352f1b79b9ff0e821a33764bd8bd1fffd
+            tag: v0.7.6
+            pullPolicy: IfNotPresent
          resources:
            requests:
-              cpu: 1m
-              memory: 40Mi
+              cpu: 10m
+              memory: 128Mi
  service:
    main:
      controller: main
@@ -272,6 +273,7 @@ mautrix-discord:
        http:
          port: 29334
          targetPort: 29334
+          protocol: HTTP
  persistence:
    config:
      enabled: true
@@ -300,6 +302,7 @@ mautrix-discord:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 500Mi
+      retain: true
      advancedMounts:
        main:
          init-copy-config:
@@ -315,13 +318,15 @@ mautrix-whatsapp:
  controllers:
    main:
      type: statefulset
-      replicas: 1
+      replicas: 0
      strategy: RollingUpdate
+      revisionHistoryLimit: 3
      # initContainers:
      #   init-copy-config:
      #     image:
      #       repository: busybox
      #       tag: 1.37.0
+      #       pullPolicy: IfNotPresent
      #     resources:
      #       requests:
      #         cpu: 10m
@@ -340,11 +345,12 @@ mautrix-whatsapp:
        main:
          image:
            repository: dock.mau.dev/mautrix/whatsapp
-            tag: v0.2602.0@sha256:07fca07f8746c09e6d5f486d002e638da014d0a134e053e2ed7af9875053104d
+            tag: v0.2602.0
+            pullPolicy: IfNotPresent
          resources:
            requests:
-              cpu: 1m
-              memory: 40Mi
+              cpu: 10m
+              memory: 64Mi
  service:
    main:
      controller: main
@@ -352,6 +358,7 @@ mautrix-whatsapp:
        http:
          port: 29318
          targetPort: 29318
+          protocol: HTTP
  persistence:
    config:
      enabled: true
@@ -380,6 +387,7 @@ mautrix-whatsapp:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 500Mi
+      retain: true
      advancedMounts:
        main:
          init-copy-config:
@@ -394,6 +402,10 @@ cloudflared-hookshot:
  name: hookshot
 postgres-18-cluster:
  mode: recovery
+  cluster:
+    resources:
+      requests:
+        cpu: 200m
  recovery:
    method: objectStore
    objectStore:
@@ -405,12 +417,35 @@ postgres-18-cluster:
        destinationBucket: postgres-backups
        externalSecretCredentialPath: /garage/home-infra/postgres-backups
        isWALArchiver: true
+      # - name: garage-remote
+      #   index: 1
+      #   destinationBucket: postgres-backups
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   retentionPolicy: "90d"
+      #   data:
+      #     compression: bzip2
+      # - name: external
+      #   index: 1
+      #   endpointURL: https://nyc3.digitaloceanspaces.com
+      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   isWALArchiver: false
    scheduledBackups:
      - name: live-backup
        suspend: false
        immediate: true
        schedule: "0 0 15 * * *"
        backupName: garage-local
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 4 * * SAT"
+      #   backupName: garage-remote
+      # - name: daily-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
  databases:
    - name: mautrix-discord
      ensure: present
@@ -426,8 +461,6 @@ valkey-matrix-synapse:
      aclUsers:
        default:
          permissions: "~* &* +@all"
-    # No option to configure metrics when auth is enabled
-    # https://github.com/valkey-io/valkey-helm/issues/135
    metrics:
      enabled: false
 valkey-hookshot:
--- a/clusters/cl01tl/helm/movie-roulette/Chart.yaml
+++ b/clusters/cl01tl/helm/movie-roulette/Chart.yaml
@@ -19,4 +19,4 @@ dependencies:
    version: 4.6.2
 icon: https://raw.githubusercontent.com/sahara101/Movie-Roulette/refs/heads/main/static/icons/icon.png
 # renovate: datasource=github-releases depName=sahara101/Movie-Roulette
-appVersion: v5.4.2
+appVersion: v5.4.1
--- a/clusters/cl01tl/helm/music-grabber/Chart.yaml
+++ b/clusters/cl01tl/helm/music-grabber/Chart.yaml
@@ -18,4 +18,4 @@ dependencies:
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.6.2
 # renovate: datasource=docker depName=g33kphr33k/musicgrabber
-appVersion: 2.5.5
+appVersion: 2.5.4
--- a/clusters/cl01tl/helm/music-grabber/values.yaml
+++ b/clusters/cl01tl/helm/music-grabber/values.yaml
@@ -9,7 +9,7 @@ music-grabber:
        main:
          image:
            repository: g33kphr33k/musicgrabber
-            tag: 2.5.5
+            tag: 2.5.4
            pullPolicy: IfNotPresent
          env:
            - name: MUSIC_DIR
--- a/clusters/cl01tl/helm/ollama/Chart.yaml
+++ b/clusters/cl01tl/helm/ollama/Chart.yaml
@@ -31,4 +31,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ollama.png
 # renovate: datasource=github-releases depName=ollama/ollama
-appVersion: 0.20.0
+appVersion: 0.19.0
--- a/clusters/cl01tl/helm/ollama/values.yaml
+++ b/clusters/cl01tl/helm/ollama/values.yaml
@@ -22,7 +22,7 @@ ollama:
        main:
          image:
            repository: ollama/ollama
-            tag: 0.20.0
+            tag: 0.19.0
            pullPolicy: IfNotPresent
          env:
            - name: OLLAMA_KEEP_ALIVE
@@ -58,7 +58,7 @@ ollama:
        main:
          image:
            repository: ollama/ollama
-            tag: 0.20.0
+            tag: 0.19.0
            pullPolicy: IfNotPresent
          env:
            - name: OLLAMA_KEEP_ALIVE
@@ -94,7 +94,7 @@ ollama:
        main:
          image:
            repository: ollama/ollama
-            tag: 0.20.0
+            tag: 0.19.0
            pullPolicy: IfNotPresent
          env:
            - name: OLLAMA_KEEP_ALIVE
--- a/clusters/cl01tl/helm/qbittorrent/values.yaml
+++ b/clusters/cl01tl/helm/qbittorrent/values.yaml
@@ -173,7 +173,7 @@ qbittorrent:
        qbit-manage:
          image:
            repository: ghcr.io/stuffanthings/qbit_manage
-            tag: v4.7.0
+            tag: v4.6.6
            pullPolicy: IfNotPresent
          env:
            - name: TZ
@@ -280,8 +280,8 @@ qbittorrent:
      controller: qbit-manage
      ports:
        apprise:
-          port: 80
-          targetPort: 8181
+          port: 8000
+          targetPort: 8000
          protocol: HTTP
    qui:
      controller: qui
--- a/clusters/cl01tl/helm/searxng/values.yaml
+++ b/clusters/cl01tl/helm/searxng/values.yaml
@@ -9,7 +9,7 @@ searxng:
        main:
          image:
            repository: searxng/searxng
-            tag: latest@sha256:1c4ee27483e7e98f718c75592e2ce20210f221ecac4bcb7acf672c8071c7df69
+            tag: latest@sha256:dac0c447bdd3f20a43687c6bed8140547f493252fd7bad3ad8bef1faffe1002d
            pullPolicy: IfNotPresent
          env:
            - name: SEARXNG_BASE_URL
@@ -39,7 +39,7 @@ searxng:
        main:
          image:
            repository: searxng/searxng
-            tag: latest@sha256:1c4ee27483e7e98f718c75592e2ce20210f221ecac4bcb7acf672c8071c7df69
+            tag: latest@sha256:dac0c447bdd3f20a43687c6bed8140547f493252fd7bad3ad8bef1faffe1002d
            pullPolicy: IfNotPresent
          env:
            - name: SEARXNG_BASE_URL
--- a/clusters/cl01tl/helm/site-documentation/values.yaml
+++ b/clusters/cl01tl/helm/site-documentation/values.yaml
@@ -11,7 +11,7 @@ site-documentation:
        main:
          image:
            repository: harbor.alexlebens.net/images/site-documentation
-            tag: 0.16.0
+            tag: 0.15.0
            pullPolicy: IfNotPresent
          resources:
            requests:
--- a/clusters/cl01tl/helm/whodb/Chart.yaml
+++ b/clusters/cl01tl/helm/whodb/Chart.yaml
@@ -20,4 +20,4 @@ dependencies:
    version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/whodb.png
 # renovate: datasource=github-releases depName=clidey/whodb
-appVersion: 0.104.0
+appVersion: 0.103.0
--- a/clusters/cl01tl/helm/whodb/values.yaml
+++ b/clusters/cl01tl/helm/whodb/values.yaml
@@ -8,7 +8,7 @@ whodb:
        main:
          image:
            repository: clidey/whodb
-            tag: 0.104.0
+            tag: 0.103.0
            pullPolicy: IfNotPresent
          env:
            - name: WHODB_OLLAMA_HOST
--- a/hosts/ps08rp/node-exporter/compose.yaml
+++ b/hosts/ps08rp/node-exporter/compose.yaml
@@ -1,7 +1,7 @@
 ---
 services:
    node-exporter:
-        image: quay.io/prometheus/node-exporter:v1.11.0@sha256:2f0cc335ef9ea15d6c96e1c0d693d8b57c0b794d0244b22313a6c162bd1cb1b8
+        image: quay.io/prometheus/node-exporter:v1.10.2@sha256:337ff1d356b68d39cef853e8c6345de11ce7556bb34cda8bd205bcf2ed30b565
        container_name: node-exporter
        command:
            - '--path.rootfs=/rootfs'
--- a/hosts/ps09rp/node-exporter/compose.yaml
+++ b/hosts/ps09rp/node-exporter/compose.yaml
@@ -1,7 +1,7 @@
 ---
 services:
    node-exporter:
-        image: quay.io/prometheus/node-exporter:v1.11.0@sha256:2f0cc335ef9ea15d6c96e1c0d693d8b57c0b794d0244b22313a6c162bd1cb1b8
+        image: quay.io/prometheus/node-exporter:v1.10.2@sha256:337ff1d356b68d39cef853e8c6345de11ce7556bb34cda8bd205bcf2ed30b565
        container_name: node-exporter
        command:
            - '--path.rootfs=/rootfs'
--- a/hosts/ps10rp/komodo-periphery/compose.yaml
+++ b/hosts/ps10rp/komodo-periphery/compose.yaml
@@ -20,7 +20,7 @@ services:
            - /dev/net/tun:/dev/net/tun

    komodo-periphery:
-        image: ghcr.io/moghtech/komodo-periphery:2.1.1@sha256:9324baa15d355796fc8ab7fb4a4de7f2904327238100fa78fc2c814ba9d56022
+        image: ghcr.io/moghtech/komodo-periphery:2.1.0@sha256:f5b272e3d9acd60d4eac69ea4fa0292dcaddfdecfc2be64ba5575e5ae18e72ae
        container_name: komodo-periphery
        init: true
        env_file:
--- a/hosts/ps10rp/node-exporter/compose.yaml
+++ b/hosts/ps10rp/node-exporter/compose.yaml
@@ -20,7 +20,7 @@ services:
            - /dev/net/tun:/dev/net/tun

    node-exporter:
-        image: quay.io/prometheus/node-exporter:v1.11.0@sha256:2f0cc335ef9ea15d6c96e1c0d693d8b57c0b794d0244b22313a6c162bd1cb1b8
+        image: quay.io/prometheus/node-exporter:v1.10.2@sha256:337ff1d356b68d39cef853e8c6345de11ce7556bb34cda8bd205bcf2ed30b565
        container_name: node-exporter
        command:
            - '--path.rootfs=/rootfs'
--- a/renovate.json
+++ b/renovate.json
@@ -67,21 +67,11 @@
  ],
  "packageRules": [
    {
-      "description": "Group app packages",
-      "matchPackageNames": [
-        "*"
+      "description": "Disable updates to digests",
+      "matchUpdateTypes": [
+        "digest"
      ],
-      "groupName": "{{#if packageName}}{{{replace '^.*/([^/]+)$' '$1' packageName}}}{{else}}{{{replace '^.*/([^/]+)$' '$1' depName}}}{{/if}}",
-      "groupSlug": "unified-{{{groupName}}}"
-    },
-    {
-      "description": "Specific app grouping overrides",
-      "matchPackageNames": [
-        "/(^|/)(argo-cd|bazarr|cilium|code-server|dawarich|element-web|home-assistant|immich|komodo|postiz|rook-ceph|roundcube|rybbit|tdarr|traefik)/",
-        "/^rook(-ceph|/rook|/ceph)/"
-      ],
-      "groupName": "{{{replace '^.*(argo-cd|bazarr|cilium|code-server|dawarich|element-web|home-assistant|immich|komodo|postiz|rook-ceph|roundcube|rybbit|tdarr|traefik).*$' '$1' depName}}}",
-      "groupSlug": "unified-{{{groupName}}}"
+      "enabled": false
    },
    {
      "description": "Label Helm updates",
@@ -111,11 +101,46 @@
      ]
    },
    {
-      "description": "Disable updates to digests by default",
+      "description": "Group packages together by stripping all registry/namespace prefixes",
+      "groupName": "{{#if packageName}}{{{replace '^.*/([^/]+)$' '$1' packageName}}}{{else}}{{{replace '^.*/([^/]+)$' '$1' depName}}}{{/if}}",
+      "groupSlug": "unified-{{{groupName}}}",
+      "matchPackageNames": [
+        "*"
+      ]
+    },
+    {
+      "description": "Group for specific apps, these have different package and repo names",
+      "groupName": "{{{replace '^.*(argo-cd|bazarr|cilium|code-server|dawarich|element-web|home-assistant|immich|komodo|postiz|rook-ceph|roundcube|rybbit|tdarr|traefik).*$' '$1' depName}}}",
+      "groupSlug": "unified-{{{groupName}}}",
+      "matchPackageNames": [
+        "/(^|/)(argo-cd|bazarr|cilium|code-server|dawarich|element-web|home-assistant|immich|komodo|postiz|rook-ceph|roundcube|rybbit|tdarr|traefik)/",
+        "/^rook(-ceph|/rook|/ceph)/"
+      ]
+    },
+    {
+      "description": "Automerge helm chart lock files",
+      "matchManagers": [
+        "helm"
+      ],
+      "lockFileMaintenance": {
+        "enabled": true
+      },
+      "addLabels": [
+        "{{{datasource}}}",
+        "automerge"
+      ],
+      "automerge": true,
+      "automergeType": "branch"
+    },
+    {
+      "description": "Open for digest updates, specific packages",
      "matchUpdateTypes": [
        "digest"
      ],
-      "enabled": false
+      "matchPackageNames": [
+        "excalidraw/excalidraw"
+      ],
+      "enabled": true
    },
    {
      "description": "Automerge digest updates, specific packages",
@@ -123,10 +148,10 @@
        "digest"
      ],
      "matchPackageNames": [
-        "excalidraw/excalidraw",
        "searxng/searxng"
      ],
      "addLabels": [
+        "{{{datasource}}}",
        "automerge"
      ],
      "enabled": true,
@@ -135,7 +160,8 @@
    {
      "description": "Automerge patches",
      "matchUpdateTypes": [
-        "patch"
+        "patch",
+        "pinDigest"
      ],
      "addLabels": [
        "{{{datasource}}}",
@@ -147,7 +173,9 @@
    {
      "description": "Automerge images, specific packages",
      "matchUpdateTypes": [
-        "minor"
+        "minor",
+        "patch",
+        "pinDigest"
      ],
      "matchPackageNames": [
        "ghcr.io/renovatebot/renovate",