chore(deps): update dependency tailscale/tailscale to v1.96.4

.gitea/workflows/renovate.yaml

@@ -13,7 +13,7 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.99.0@sha256:aae697086b93427dcde46eb92e08e334b018946ce19339bf044ce971ca1626e2
+    container: ghcr.io/renovatebot/renovate:43.96.0@sha256:41af2f21008f8f5785833277ac951b4f44e936b61394dc7edccdc0fe09e59132
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

clusters/cl01tl/helm/argocd/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 9.4.17
-digest: sha256:17752dbf03861cf70ee31c9a17373a5175656a2edd00ba5fcd3988a195147da8
-generated: "2026-03-28T01:51:34.832601868Z"
+  version: 9.4.16
+digest: sha256:f9ecc47369d4401df61c17f55cc59c9b2d4543f57cf122653abb1a27a4f7bf35
+generated: "2026-03-26T21:01:52.678525211Z"

clusters/cl01tl/helm/argocd/Chart.yaml

@@ -13,8 +13,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 9.4.17
+    version: 9.4.16
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-cd
-appVersion: v3.3.6
+appVersion: v3.3.5

clusters/cl01tl/helm/cert-manager/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: cert-manager
   repository: https://charts.jetstack.io
-  version: v1.20.1
-digest: sha256:1bf36eba44cf096b40355a697b8cffb302f07f9135374222aabdf686f017b7a9
-generated: "2026-03-28T01:35:24.542754563Z"
+  version: v1.20.0
+digest: sha256:1543bd17649cb32982de3cce017fcbed1b44c41d50b76c6471b266f33e261c29
+generated: "2026-03-10T16:06:49.332999536Z"

clusters/cl01tl/helm/cert-manager/Chart.yaml

@@ -13,8 +13,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: cert-manager
-    version: v1.20.1
+    version: v1.20.0
     repository: https://charts.jetstack.io
 icon: https://raw.githubusercontent.com/cert-manager/cert-manager/refs/heads/master/logo/logo.png
 # renovate: datasource=github-releases depName=cert-manager/cert-manager
-appVersion: v1.20.1
+appVersion: v1.20.0

clusters/cl01tl/helm/foldergram/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
 # renovate: datasource=github-releases depName=foldergram/foldergram
-appVersion: v1.0.9
+appVersion: v1.0.8

clusters/cl01tl/helm/grafana-operator/Chart.yaml

@@ -5,13 +5,14 @@ description: Grafana Operator
 keywords:
   - grafana-operator
   - dashboard
-home: https://docs.alexlebens.dev/applications/grafana-operator/
+  - metrics
+  - logs
+home: https://wiki.alexlebens.dev/s/3e5723e1-2ab7-45ab-b496-b8854907fa39
 sources:
   - https://github.com/grafana/grafana-operator
-  - https://github.com/grafana/grafana/pkgs/container/grafana%2Fgrafana
+  - https://github.com/cloudnative-pg/cloudnative-pg
   - https://github.com/grafana/grafana-operator/tree/master/deploy/helm/grafana-operator
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/grafana-operator/templates/external-secret.yaml

@@ -14,11 +14,17 @@ spec:
   data:
     - secretKey: admin-user
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/grafana/auth
+        metadataPolicy: None
         property: admin-user
     - secretKey: admin-password
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/grafana/auth
+        metadataPolicy: None
         property: admin-password
 
 ---
@@ -38,11 +44,17 @@ spec:
   data:
     - secretKey: AUTH_CLIENT_ID
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /authentik/oidc/grafana
+        metadataPolicy: None
         property: client
     - secretKey: AUTH_CLIENT_SECRET
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /authentik/oidc/grafana
+        metadataPolicy: None
         property: secret
 
 ---
@@ -62,11 +74,17 @@ spec:
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /digital-ocean/home-infra/postgres-backups
+        metadataPolicy: None
         property: access
     - secretKey: ACCESS_SECRET_KEY
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /digital-ocean/home-infra/postgres-backups
+        metadataPolicy: None
         property: secret
 
 ---
@@ -86,13 +104,22 @@ spec:
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /garage/home-infra/postgres-backups
+        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: ACCESS_SECRET_KEY
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /garage/home-infra/postgres-backups
+        metadataPolicy: None
         property: ACCESS_SECRET_KEY
     - secretKey: ACCESS_REGION
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /garage/home-infra/postgres-backups
+        metadataPolicy: None
         property: ACCESS_REGION

clusters/cl01tl/helm/grafana-operator/templates/grafana-dashboard.yaml

@@ -11,9 +11,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-system
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/ceph.json
 
 ---
@@ -30,9 +30,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-system
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/coredns.json
 
 ---
@@ -49,9 +49,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-system
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/etcd.json
 
 ---
@@ -68,9 +68,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-system
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/garage.json
 
 ---
@@ -87,9 +87,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-system
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/loki.json
 
 ---
@@ -106,9 +106,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-system
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/node-full.json
 
 ---
@@ -125,9 +125,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-system
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/node-short.json
 
 ---
@@ -144,9 +144,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-system
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/system/pods.json
 
 ---
@@ -163,9 +163,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-service
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/argocd.json
 
 ---
@@ -182,9 +182,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-service
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/blocky.json
 
 ---
@@ -201,9 +201,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-service
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/cert-manager.json
 
 ---
@@ -220,9 +220,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-service
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/cloudnative-pg.json
 
 ---
@@ -239,9 +239,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-service
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/descheduler.json
 
 ---
@@ -258,9 +258,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-service
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/gatus.json
 
 ---
@@ -277,9 +277,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-service
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/grafana-operator.json
 
 ---
@@ -296,9 +296,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-service
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/harbor.json
 
 ---
@@ -315,9 +315,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-service
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/speedtest-exporter.json
 
 ---
@@ -334,9 +334,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-service
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/spegel.json
 
 ---
@@ -353,9 +353,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-service
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/traefik.json
 
 ---
@@ -372,9 +372,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-service
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/tdarr.json
 
 ---
@@ -391,9 +391,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-service
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/unpoller.json
 
 ---
@@ -410,9 +410,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-service
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/volsync.json
 
 ---
@@ -429,9 +429,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-platform
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/s3.json
 
 ---
@@ -448,9 +448,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-platform
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/authentik.json
 
 ---
@@ -467,9 +467,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-platform
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/gitea.json
 
 ---
@@ -486,9 +486,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-platform
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/ntfy.json
 
 ---
@@ -505,9 +505,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-platform
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/qbittorrent.json
 
 ---
@@ -524,9 +524,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-platform
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/vault.json
 
 ---
@@ -543,9 +543,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-iot
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/iot/airgradient.json
 
 ---
@@ -562,9 +562,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-iot
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/iot/server-power-consumption.json
 
 ---
@@ -581,9 +581,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-application
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/immich.json
 
 ---
@@ -600,9 +600,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-application
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/jellyfin.json
 
 ---
@@ -619,9 +619,9 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-application
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/radarr.json
 
 ---
@@ -638,7 +638,7 @@ spec:
   instanceSelector:
     matchLabels:
       app: grafana-main
-  contentCacheDuration: 6h
+  contentCacheDuration: 1h
   folderUID: grafana-folder-application
-  resyncPeriod: 6h
+  resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/application/sonarr.json

clusters/cl01tl/helm/grafana-operator/templates/grafana.yaml

@@ -56,12 +56,11 @@ spec:
         spec:
           containers:
             - name: grafana
-              # renovate: datasource=docker depName=grafana/grafana
-              image: grafana/grafana:12.4.2@sha256:83749231c3835e390a3144e5e940203e42b9589761f20ef3169c716e734ad505
+              image: grafana/grafana:12.0.0
               resources:
                 requests:
-                  cpu: 20m
-                  memory: 120Mi
+                  cpu: 100m
+                  memory: 128Mi
               env:
                 - name: AUTH_CLIENT_ID
                   valueFrom:
@@ -108,12 +107,3 @@ spec:
                     secretKeyRef:
                       name: grafana-operator-postgresql-18-cluster-app
                       key: password
-  httpRoute:
-    spec:
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: traefik-gateway
-          namespace: traefik
-      hostnames:
-        - grafana.alexlebens.net

clusters/cl01tl/helm/grafana-operator/templates/http-route.yaml

@@ -0,0 +1,28 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: grafana
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: grafana
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+  hostnames:
+    - grafana.alexlebens.net
+  rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: /
+      backendRefs:
+        - group: ''
+          kind: Service
+          name: grafana-main-service
+          port: 3000
+          weight: 100

clusters/cl01tl/helm/grafana-operator/values.yaml

@@ -1,11 +1,17 @@
 grafana-operator:
   replicas: 2
+  serviceAccount:
+    create: true
+  rbac:
+    create: true
   resources:
     requests:
-      cpu: 1m
-      memory: 50Mi
+      cpu: 10m
+      memory: 64Mi
   serviceMonitor:
     enabled: true
+  dashboard:
+    enabled: false
 postgres-18-cluster:
   mode: recovery
   recovery:
@@ -19,12 +25,35 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
+      # - name: garage-remote
+      #   index: 1
+      #   destinationBucket: postgres-backups
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   retentionPolicy: "90d"
+      #   data:
+      #     compression: bzip2
+      # - name: external
+      #   index: 1
+      #   endpointURL: https://nyc3.digitaloceanspaces.com
+      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 30 14 * * *"
         backupName: garage-local
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 4 * * SAT"
+      #   backupName: garage-remote
+      # - name: daily-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
 valkey-unified-alerting:
   valkey:
     nameOverride: valkey-unified-alerting

clusters/cl01tl/helm/houndarr/values.yaml

@@ -9,7 +9,7 @@ houndarr:
         main:
           image:
             repository: ghcr.io/av1155/houndarr
-            tag: v1.6.3
+            tag: v1.6.2
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/immich/values.yaml

@@ -9,7 +9,7 @@ immich:
         main:
           image:
             repository: ghcr.io/immich-app/immich-server
-            tag: v2.6.3
+            tag: v2.6.2
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 82.15.1
+  version: 82.15.0
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.6.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
-digest: sha256:7be2f0d61a12e674af175046960df7ba06a7248dc92db0b2d9c9b63a77a5bc17
-generated: "2026-03-28T01:54:34.406941487Z"
+digest: sha256:524759b57f9500d5742b962bcdb114ec556d80ec4418921c93a722e00df57647
+generated: "2026-03-26T23:02:03.558664114Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 82.15.1
+    version: 82.15.0
     repository: oci://ghcr.io/prometheus-community/charts
   - name: app-template
     alias: ntfy-alertmanager

clusters/cl01tl/helm/loki/Chart.yaml

@@ -23,4 +23,4 @@ dependencies:
     repository: https://grafana.github.io/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/loki.png
 # renovate: datasource=github-releases depName=grafana/loki
-appVersion: 3.7.1
+appVersion: 3.7.0

clusters/cl01tl/helm/movie-roulette/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     version: 4.6.2
 icon: https://raw.githubusercontent.com/sahara101/Movie-Roulette/refs/heads/main/static/icons/icon.png
 # renovate: datasource=github-releases depName=sahara101/Movie-Roulette
-appVersion: v5.4.0
+appVersion: v5.3.0

clusters/cl01tl/helm/movie-roulette/values.yaml

@@ -9,7 +9,7 @@ movie-roulette:
         main:
           image:
             repository: ghcr.io/sahara101/movie-roulette
-            tag: v5.4.0
+            tag: v5.3.0
             pullPolicy: IfNotPresent
           env:
             - name: FLASK_SECRET_KEY

clusters/cl01tl/helm/ntfy/Chart.yaml

@@ -20,4 +20,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ntfy.png
 # renovate: datasource=github-releases depName=binwiederhier/ntfy
-appVersion: 2.20.1
+appVersion: 2.20.0

clusters/cl01tl/helm/ntfy/values.yaml

@@ -9,7 +9,7 @@ ntfy:
         main:
           image:
             repository: binwiederhier/ntfy
-            tag: v2.20.1
+            tag: v2.20.0
             pullPolicy: IfNotPresent
           args: ["serve"]
           env:

clusters/cl01tl/helm/ollama/values.yaml

@@ -117,7 +117,7 @@ ollama:
         main:
           image:
             repository: ghcr.io/open-webui/open-webui
-            tag: v0.8.12
+            tag: v0.8.10
             pullPolicy: IfNotPresent
           env:
             - name: ENV

clusters/cl01tl/helm/postiz/values.yaml

@@ -9,7 +9,7 @@ postiz:
         main:
           image:
             repository: ghcr.io/gitroomhq/postiz-app
-            tag: v2.21.2
+            tag: v2.21.0
             pullPolicy: IfNotPresent
           env:
             - name: MAIN_URL

clusters/cl01tl/helm/rybbit/values.yaml

@@ -122,7 +122,7 @@ rybbit:
         main:
           image:
             repository: clickhouse/clickhouse-server
-            tag: 26.3.2
+            tag: 26.2.5
             pullPolicy: IfNotPresent
           env:
             - name: CLICKHOUSE_DB

clusters/cl01tl/helm/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:c026ed4cb1a29b21878fed2c13f4c31fa811b8b03d931aa8764e8528177e2862
+            tag: latest@sha256:032eec8dcd3799007059d0753e9d04837fc8dba8d8b749a08469118a8039b703
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -39,7 +39,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:c026ed4cb1a29b21878fed2c13f4c31fa811b8b03d931aa8764e8528177e2862
+            tag: latest@sha256:032eec8dcd3799007059d0753e9d04837fc8dba8d8b749a08469118a8039b703
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL

clusters/cl01tl/helm/whodb/Chart.yaml

@@ -20,4 +20,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/whodb.png
 # renovate: datasource=github-releases depName=clidey/whodb
-appVersion: 0.103.0
+appVersion: 0.101.0

clusters/cl01tl/helm/whodb/values.yaml

@@ -8,7 +8,7 @@ whodb:
         main:
           image:
             repository: clidey/whodb
-            tag: 0.103.0
+            tag: 0.101.0
             pullPolicy: IfNotPresent
           env:
             - name: WHODB_OLLAMA_HOST

hosts/ps08rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.12@sha256:171c9c3565b29f6c133f1c1b43c5d4e5853415198e9e1078c001f8702ff66aec
+        image: ghcr.io/traefik/traefik:v3.6.11@sha256:acfc80650104f0194a15f73dc1648f517561bc1645391a15705332a064cfc33c
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

hosts/ps09rp/traefik/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.12@sha256:171c9c3565b29f6c133f1c1b43c5d4e5853415198e9e1078c001f8702ff66aec
+        image: ghcr.io/traefik/traefik:v3.6.11@sha256:acfc80650104f0194a15f73dc1648f517561bc1645391a15705332a064cfc33c
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

hosts/ps10rp/homepage/compose.yaml

@@ -32,7 +32,7 @@ services:
             - /var/run/docker.sock:/var/run/docker.sock:ro
 
     homepage:
-        image: ghcr.io/gethomepage/homepage:v1.12.0@sha256:5bb66eac5d48f021fd60414add03aa123d1feb85770550ddb1d99a5b8851c6c2
+        image: ghcr.io/gethomepage/homepage:v1.11.0@sha256:b129cb0f674bd6d204e215bde2c2fc3f11d6ad0e82f6d20007cf80f74e1acbb1
         container_name: homepage
         labels:
             traefik.enable: true

hosts/ps10rp/traefik/compose.yaml

@@ -20,7 +20,7 @@ services:
             - /dev/net/tun:/dev/net/tun
 
     traefik:
-        image: ghcr.io/traefik/traefik:v3.6.12@sha256:171c9c3565b29f6c133f1c1b43c5d4e5853415198e9e1078c001f8702ff66aec
+        image: ghcr.io/traefik/traefik:v3.6.11@sha256:acfc80650104f0194a15f73dc1648f517561bc1645391a15705332a064cfc33c
         container_name: traefik
         command:
             - "--global.checkNewVersion=false"

renovate.json

@@ -16,16 +16,6 @@
   "baseBranchPatterns": [
     "main"
   ],
-  "regexManagers": [
-    {
-      "fileMatch": ["(^|/)values\\.yaml$", "(^|/)values-.*\\.yaml$"],
-      "matchStrings": [
-        "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+tag:\\s+(?<currentValue>.*)"
-      ],
-      "datasourceTemplate": "{{{datasource}}}",
-      "depNameTemplate": "{{{depName}}}"
-    }
-  ],
   "customManagers": [
     {
       "description": "Update appVersion in Chart.yaml",
@@ -38,18 +28,6 @@
       ],
       "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver-coerced{{/if}}"
     },
-    {
-      "description": "Update specific images in values",
-      "customType": "regex",
-      "managerFilePatterns": [
-        "(^|/)values\\.yaml$"
-      ],
-      "matchStrings": [
-        "#\\s*renovate:\\s*datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)\\s*\\n\\s+tag:\\s*[\"']?(?<currentValue>[^\"'\\s]+)[\"']?"
-      ],
-      "depNameTemplate": "{{{depName}}}",
-      "datasourceTemplate": "{{{datasource}}}"
-    },
     {
       "description": "Update images in templates",
       "customType": "regex",