chore(deps): pin dependencies

2026-03-22 03:04:19 +00:00
44 changed files with 252 additions and 505 deletions
--- a/.gitea/workflows/lint-test-docker.yaml
+++ b/.gitea/workflows/lint-test-docker.yaml
@@ -120,7 +120,7 @@ jobs:
          echo "----"

      - name: ntfy Failed
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: '${{ secrets.NTFY_URL }}'
--- a/.gitea/workflows/lint-test-helm.yaml
+++ b/.gitea/workflows/lint-test-helm.yaml
@@ -209,7 +209,7 @@ jobs:
          exit $EXIT_CODE

      - name: ntfy Failed
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: '${{ secrets.NTFY_URL }}'
@@ -352,7 +352,7 @@ jobs:
          exit $EXIT_CODE

      - name: ntfy Failed
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: '${{ secrets.NTFY_URL }}'
--- a/.gitea/workflows/render-manifests.yaml
+++ b/.gitea/workflows/render-manifests.yaml
@@ -568,7 +568,7 @@ jobs:
          echo "----"

      - name: ntfy Created
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
        if: steps.create-pull-request.outputs.pull-request-operation == 'created' && steps.mode.outputs.is-automerge == 'false'
        with:
          url: "${{ secrets.NTFY_URL }}"
@@ -582,7 +582,7 @@ jobs:
          actions: '[{"action": "view", "label": "View PR", "url": "${{ vars.USER_URL }}/${{ github.repository }}/pulls/${{ steps.create-pull-request.outputs.pull-request-number }}", "clear": true}]'

      - name: ntfy Updated
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
        if: steps.commit-push.outputs.push == 'true' && steps.check-for-pull-request.outputs.pull-request-exists != 'false' && steps.mode.outputs.is-automerge == 'false'
        with:
          url: "${{ secrets.NTFY_URL }}"
@@ -596,7 +596,7 @@ jobs:
          actions: '[{"action": "view", "label": "View PR", "url": "${{ vars.USER_URL }}/${{ github.repository }}/pulls/${{ steps.create-pull-request.outputs.pull-request-number }}", "clear": true}]'

      - name: ntfy Merged
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
        if: steps.merge-changes.outputs.pull-request-operation == 'merged'
        with:
          url: "${{ secrets.NTFY_URL }}"
@@ -610,7 +610,7 @@ jobs:
          actions: '[{"action": "view", "label": "View PR", "url": "${{ vars.USER_URL }}/${{ github.repository }}/pulls/${{ steps.create-pull-request.outputs.pull-request-number }}", "clear": true}]'

      - name: ntfy Failed
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: "${{ secrets.NTFY_URL }}"
--- a/.gitea/workflows/renovate.yaml
+++ b/.gitea/workflows/renovate.yaml
@@ -13,7 +13,7 @@ on:
 jobs:
  renovate:
    runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.84.2@sha256:92285747b3aac062a4f567762c272a12dce037843a20177a02c95b7c420e20cb
+    container: ghcr.io/renovatebot/renovate:43@sha256:92285747b3aac062a4f567762c272a12dce037843a20177a02c95b7c420e20cb
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -25,7 +25,7 @@ jobs:
          RENOVATE_ENDPOINT: ${{ vars.INSTANCE_URL }}
          RENOVATE_REPOSITORIES: alexlebens/infrastructure
          RENOVATE_GIT_AUTHOR: Renovate Bot <renovate-bot@alexlebens.net>
-          LOG_LEVEL: debug
+          LOG_LEVEL: info
          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
          RENOVATE_GIT_PRIVATE_KEY: ${{ secrets.RENOVATE_GIT_PRIVATE_KEY }}
          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}
--- a/clusters/cl01tl/helm/actual/Chart.yaml
+++ b/clusters/cl01tl/helm/actual/Chart.yaml
@@ -5,12 +5,11 @@ description: Actual
 keywords:
  - actual
  - budget
-home: https://docs.alexlebens.dev/applications/actual/
+home: https://wiki.alexlebens.dev/s/86192f45-94b7-45de-872c-6ef3fec7df5e
 sources:
  - https://github.com/actualbudget/actual
  - https://github.com/actualbudget/actual/pkgs/container/actual
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
  - name: alexlebens
 dependencies:
--- a/clusters/cl01tl/helm/actual/values.yaml
+++ b/clusters/cl01tl/helm/actual/values.yaml
@@ -4,18 +4,20 @@ actual:
      type: deployment
      replicas: 1
      strategy: Recreate
+      revisionHistoryLimit: 3
      containers:
        main:
          image:
            repository: ghcr.io/actualbudget/actual
-            tag: 26.3.0@sha256:eb8bc26f53025e07e464594c12d77c52c4b95840c8dadd9b95c4f0c4660f8ad2
+            tag: 26.3.0
+            pullPolicy: IfNotPresent
          env:
-            - name: ACTUAL_PORT
-              value: 5006
+            - name: TZ
+              value: US/Central
          resources:
            requests:
-              cpu: 25m
-              memory: 64Mi
+              cpu: 10m
+              memory: 128Mi
          probes:
            liveness:
              enabled: true
@@ -52,8 +54,11 @@ actual:
        - actual.alexlebens.net
      rules:
        - backendRefs:
-            - name: actual
+            - group: ''
+              kind: Service
+              name: actual
              port: 80
+              weight: 100
          matches:
            - path:
                type: PathPrefix
@@ -64,6 +69,7 @@ actual:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 2Gi
+      retain: true
      advancedMounts:
        main:
          main:
--- a/clusters/cl01tl/helm/argo-workflows/Chart.yaml
+++ b/clusters/cl01tl/helm/argo-workflows/Chart.yaml
@@ -7,12 +7,12 @@ keywords:
  - argo-events
  - workflows
  - events
-home: https://docs.alexlebens.dev/applications/argo-workflows/
+home: https://wiki.alexlebens.dev/s/a268508f-d81d-4b4b-8bd5-9058edaea635
 sources:
  - https://github.com/argoproj/argo-workflows
  - https://github.com/argoproj/argo-events
-  - https://github.com/argoproj/argo-helm/tree/main/charts/argo-workflows
-  - https://github.com/argoproj/argo-helm/tree/main/charts/argo-events
+  - https://github.com/cloudnative-pg/cloudnative-pg
+  - https://github.com/argoproj/argo-helm/tree/main/charts
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
  - name: alexlebens
--- a/clusters/cl01tl/helm/argo-workflows/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/argo-workflows/templates/external-secret.yaml
@@ -14,9 +14,15 @@ spec:
  data:
    - secretKey: secret
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /authentik/oidc/argo-workflows
+        metadataPolicy: None
        property: secret
    - secretKey: client
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /authentik/oidc/argo-workflows
+        metadataPolicy: None
        property: client
--- a/clusters/cl01tl/helm/argo-workflows/templates/http-route.yaml
+++ b/clusters/cl01tl/helm/argo-workflows/templates/http-route.yaml
@@ -0,0 +1,28 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: argo-workflows
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: argo-workflows
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+  hostnames:
+    - argo-workflows.alexlebens.net
+  rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: /
+      backendRefs:
+        - group: ''
+          kind: Service
+          name: argo-workflows-server
+          port: 2746
+          weight: 100
--- a/clusters/cl01tl/helm/argo-workflows/values.yaml
+++ b/clusters/cl01tl/helm/argo-workflows/values.yaml
@@ -2,6 +2,8 @@ argo-workflows:
  crds:
    install: true
    keep: true
+    # -- Use full CRDs with complete OpenAPI schemas. When false, uses minified CRDs with x-kubernetes-preserve-unknown-fields.
+    # Full CRDs are very large and are installed via a pre-install/pre-upgrade hook Job that uses server-side apply.
    full: true
    upgradeJob:
      image:
@@ -11,6 +13,11 @@ argo-workflows:
    metricsConfig:
      enabled: true
    persistence:
+      connectionPool:
+        maxIdleConns: 100
+        maxOpenConns: 0
+      nodeStatusOffLoad: true
+      archive: true
      postgresql:
        host: argo-workflows-postgresql-18-cluster-rw
        port: 5432
@@ -25,34 +32,24 @@ argo-workflows:
        ssl: false
        sslMode: disable
    workflowWorkers: 2
-    workflowTTLWorkers: 2
-    podCleanupWorkers: 2
-    cronWorkflowWorkers: 2
+    workflowTTLWorkers: 1
+    podCleanupWorkers: 1
+    cronWorkflowWorkers: 1
    resources:
      requests:
        cpu: 10m
-        memory: 32Mi
+        memory: 128Mi
    serviceMonitor:
      enabled: true
+    name: workflow-controller
    workflowNamespaces:
+      - argocd
      - argo-workflows
  server:
    authModes:
      - sso
-    httproute:
-      enabled: true
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: traefik-gateway
-          namespace: traefik
-      hostnames:
-        - argo-workflows.alexlebens.net
-      rules:
-        - matches:
-            - path:
-                type: PathPrefix
-                value: /
+    ingress:
+      enabled: false
    sso:
      enabled: true
      issuer: https://authentik.alexlebens.net/application/o/argo-workflows/
@@ -69,15 +66,15 @@ argo-workflows:
        - openid
        - email
        - profile
+  useStaticCredentials: true
+  artifactRepository:
+    archiveLogs: false
 argo-events:
-  crds:
-    install: true
-    keep: true
  controller:
    resources:
      requests:
        cpu: 10m
-        memory: 32Mi
+        memory: 128Mi
    metrics:
      enabled: true
      serviceMonitor:
@@ -87,7 +84,7 @@ argo-events:
    resources:
      requests:
        cpu: 10m
-        memory: 32Mi
+        memory: 128Mi
 postgres-18-cluster:
  mode: recovery
  recovery:
@@ -101,9 +98,32 @@ postgres-18-cluster:
        destinationBucket: postgres-backups
        externalSecretCredentialPath: /garage/home-infra/postgres-backups
        isWALArchiver: true
+      # - name: garage-remote
+      #   index: 1
+      #   destinationBucket: postgres-backups
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   retentionPolicy: "90d"
+      #   data:
+      #     compression: bzip2
+      # - name: external
+      #   index: 1
+      #   endpointURL: https://nyc3.digitaloceanspaces.com
+      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   isWALArchiver: false
    scheduledBackups:
      - name: live-backup
        suspend: false
        immediate: true
        schedule: "0 0 14 * * *"
        backupName: garage-local
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 4 * * SAT"
+      #   backupName: garage-remote
+      # - name: daily-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
--- a/clusters/cl01tl/helm/argocd/Chart.yaml
+++ b/clusters/cl01tl/helm/argocd/Chart.yaml
@@ -4,8 +4,10 @@ version: 1.0.0
 description: Argo CD
 keywords:
  - argo-cd
+  - delivery
  - deployment
-home: https://docs.alexlebens.dev/applications/argo-cd/
+  - gitops
+home: https://wiki.alexlebens.dev/s/8a75cf26-b9df-437e-9cc5-2ef47e871a5f
 sources:
  - https://github.com/argoproj/argo-cd
  - https://github.com/argoproj/argo-helm/tree/main/charts/argo-cd
--- a/clusters/cl01tl/helm/argocd/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/argocd/templates/external-secret.yaml
@@ -14,11 +14,17 @@ spec:
  data:
    - secretKey: secret
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /authentik/oidc/argocd
+        metadataPolicy: None
        property: secret
    - secretKey: client
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /authentik/oidc/argocd
+        metadataPolicy: None
        property: client

 ---
@@ -38,7 +44,10 @@ spec:
  data:
    - secretKey: ntfy-token
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /ntfy/user/cl01tl
+        metadataPolicy: None
        property: token

 ---
@@ -58,13 +67,22 @@ spec:
  data:
    - secretKey: type
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/argocd/credentials/repo/infrastructure
+        metadataPolicy: None
        property: type
    - secretKey: url
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/argocd/credentials/repo/infrastructure
+        metadataPolicy: None
        property: url
    - secretKey: sshPrivateKey
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/argocd/credentials/repo/infrastructure
+        metadataPolicy: None
        property: sshPrivateKey
--- a/clusters/cl01tl/helm/argocd/values.yaml
+++ b/clusters/cl01tl/helm/argocd/values.yaml
@@ -1,11 +1,12 @@
 argo-cd:
  crds:
    install: true
-    keep: true
  configs:
    cm:
      admin.enabled: true
      accounts.homepage: apiKey
+      timeout.reconciliation: 100s
+      timeout.reconciliation.jitter: 60s
      url: https://argocd.alexlebens.net
      statusbadge.url: https://argocd.alexlebens.net/
      statusbadge.enabled: true
@@ -32,53 +33,12 @@ argo-cd:
        g, homepage, role:readonly
  controller:
    replicas: 1
-    resources:
-      requests:
-        cpu: 15m
-        memory: 1Gi
-    readinessProbe:
-      failureThreshold: 3
-      initialDelaySeconds: 60
-      periodSeconds: 30
-      successThreshold: 1
-      timeoutSeconds: 5
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
-      rules:
-        enabled: true
-      spec:
-        - alert: ArgoAppMissing
-          expr: |
-            absent(argocd_app_info) == 1
-          for: 15m
-          labels:
-            severity: critical
-          annotations:
-            summary: "[Argo CD] No reported applications"
-            description: >
-              Argo CD has not reported any applications data for the past 15 minutes which
-              means that it must be down or not functioning properly.  This needs to be
-              resolved for this cloud to continue to maintain state.
-        - alert: ArgoAppNotSynced
-          expr: |
-            argocd_app_info{sync_status!="Synced"} == 1
-          for: 12h
-          labels:
-            severity: warning
-          annotations:
-            summary: "[{{`{{$labels.name}}`}}] Application not synchronized"
-            description: >
-              The application [{{`{{$labels.name}}`}} has not been synchronized for over
-              12 hours which means that the state of this cloud has drifted away from the
-              state inside Git.
  dex:
    enabled: true
-    resources:
-      requests:
-        cpu: 10m
-        memory: 64Mi
    metrics:
      enabled: true
      serviceMonitor:
@@ -89,57 +49,13 @@ argo-cd:
      enabled: true
  redis-ha:
    enabled: true
-    image:
-      repository: redis
-      tag: 8.6.1-alpine@sha256:315270d166080f537bbdf1b489b603aaaa213cb55a544acfa51feb7481abb1c0
-    persistentVolume:
-      enabled: true
-    redis:
-      resources:
-        requests:
-          cpu: 1000m
-          memory: 64Mi
-    haproxy:
-      enabled: true
-      image:
-        repository: haproxy
-        tag: 3.3.6-alpine@sha256:744be2dca649a44d490a4c565d36968d19482dd387f1bdd44c168f4322bc6b1e
-      resources:
-        requests:
-          cpu: 10m
-          memory: 128Mi
-      metrics:
-        enabled: true
-        serviceMonitor:
-          enabled: true
-    exporter:
-      enabled: true
-      image: ghcr.io/oliver006/redis_exporter
-      tag: v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
-      serviceMonitor:
-        enabled: true
-    prometheusRule:
-      enabled: true
-      interval: 30s
-      rules:
-        - alert: RedisPodDown
-          expr: |
-            redis_up{job="{{ include "redis-ha.fullname" . }}"} == 0
-          for: 5m
-          labels:
-            severity: critical
-          annotations:
-            description: Redis pod {{ "{{ $labels.pod }}" }} is down
-            summary: Redis pod {{ "{{ $labels.pod }}" }} is down
    auth: false
  redisSecretInit:
    enabled: false
  server:
    replicas: 2
-    resources:
-     requests:
-       cpu: 10m
-       memory: 64Mi
+    extensions:
+      enabled: false
    metrics:
      enabled: true
      serviceMonitor:
@@ -153,56 +69,31 @@ argo-cd:
          namespace: traefik
      hostnames:
        - argocd.alexlebens.net
+      rules:
+        - matches:
+            - path:
+                type: PathPrefix
+                value: /
  repoServer:
    replicas: 2
-    resources:
-      requests:
-        cpu: 10m
-        memory: 64Mi
-    readinessProbe:
-      enabled: true
-      failureThreshold: 3
-      initialDelaySeconds: 60
-      periodSeconds: 30
-      successThreshold: 1
-      timeoutSeconds: 5
-    livenessProbe:
-      enabled: true
-      failureThreshold: 3
-      initialDelaySeconds: 60
-      periodSeconds: 30
-      successThreshold: 1
-      timeoutSeconds: 5
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
  applicationSet:
    replicas: 2
-    resources:
-      requests:
-        cpu: 10m
-        memory: 64Mi
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
-    readinessProbe:
-      enabled: true
-      failureThreshold: 3
-      initialDelaySeconds: 60
-      periodSeconds: 30
-      successThreshold: 1
-      timeoutSeconds: 5
    livenessProbe:
      enabled: true
-      failureThreshold: 3
-      initialDelaySeconds: 60
-      periodSeconds: 30
-      successThreshold: 1
-      timeoutSeconds: 5
+    readinessProbe:
+      enabled: true
  notifications:
-    argocdUrl: https://argocd.alexlebens.net
+    enabled: true
+    context:
+      argocdUrl: https://argocd.alexlebens.net
    secret:
      create: false
      name: argocd-notifications-secret
@@ -216,10 +107,6 @@ argo-cd:
        headers:
          - name: Authorization
            value: Bearer $ntfy-token
-    resources:
-      requests:
-        cpu: 10m
-        memory: 64Mi
    livenessProbe:
      enabled: true
    readinessProbe:
--- a/clusters/cl01tl/helm/audiobookshelf/Chart.yaml
+++ b/clusters/cl01tl/helm/audiobookshelf/Chart.yaml
@@ -7,14 +7,11 @@ keywords:
  - books
  - podcasts
  - audiobooks
-home: https://docs.alexlebens.dev/applications/audiobookshelf/
+home: https://wiki.alexlebens.dev/s/d4d6719f-cd1c-4b6e-b78e-2d2d7a5097d7
 sources:
  - https://github.com/advplyr/audiobookshelf
-  - https://github.com/caronc/apprise
  - https://github.com/advplyr/audiobookshelf/pkgs/container/audiobookshelf
-  - https://github.com/caronc/apprise-api/pkgs/container/apprise
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
  - name: alexlebens
 dependencies:
--- a/clusters/cl01tl/helm/audiobookshelf/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/audiobookshelf/templates/external-secret.yaml
@@ -14,5 +14,8 @@ spec:
  data:
    - secretKey: ntfy-url
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/audiobookshelf/apprise
+        metadataPolicy: None
        property: ntfy-url
--- a/clusters/cl01tl/helm/audiobookshelf/values.yaml
+++ b/clusters/cl01tl/helm/audiobookshelf/values.yaml
@@ -4,25 +4,28 @@ audiobookshelf:
      type: deployment
      replicas: 1
      strategy: Recreate
+      revisionHistoryLimit: 3
      containers:
        main:
          image:
            repository: ghcr.io/advplyr/audiobookshelf
-            tag: 2.33.1@sha256:a4a5841bba093d81e5f4ad1eaedb4da3fda6dbb2528c552349da50ad1f7ae708
+            tag: 2.33.1
+            pullPolicy: IfNotPresent
          env:
            - name: TZ
-              value: America/Chicago
+              value: US/Central
          resources:
            requests:
              cpu: 10m
-              memory: 200Mi
+              memory: 128Mi
        apprise-api:
          image:
-            repository: ghcr.io/caronc/apprise
-            tag: v1.3.2@sha256:1aafc2118b6eae5d70d17831d9a8a52adee7104fd6f2bb018e6421664699c903
+            repository: caronc/apprise
+            tag: v1.3.2
+            pullPolicy: IfNotPresent
          env:
            - name: TZ
-              value: America/Chicago
+              value: US/Central
            - name: PGID
              value: "1000"
            - name: PUID
@@ -38,6 +41,10 @@ audiobookshelf:
                secretKeyRef:
                  name: audiobookshelf-apprise-config
                  key: ntfy-url
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
  service:
    main:
      controller: main
@@ -75,8 +82,11 @@ audiobookshelf:
        - audiobookshelf.alexlebens.net
      rules:
        - backendRefs:
-            - name: audiobookshelf
+            - group: ''
+              kind: Service
+              name: audiobookshelf
              port: 80
+              weight: 100
          matches:
            - path:
                type: PathPrefix
@@ -87,6 +97,7 @@ audiobookshelf:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 2Gi
+      retain: true
      advancedMounts:
        main:
          main:
@@ -97,6 +108,7 @@ audiobookshelf:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 10Gi
+      retain: true
      advancedMounts:
        main:
          main:
--- a/clusters/cl01tl/helm/authentik/Chart.yaml
+++ b/clusters/cl01tl/helm/authentik/Chart.yaml
@@ -6,14 +6,17 @@ keywords:
  - authentik
  - sso
  - oidc
+  - ldap
+  - idp
  - authentication
-home: https://docs.alexlebens.dev/applications/authentik/
+home: https://wiki.alexlebens.dev/s/45ca5171-581f-41d2-b6fb-2b0915029a2d
 sources:
  - https://github.com/goauthentik/authentik
+  - https://github.com/cloudflare/cloudflared
+  - https://github.com/cloudnative-pg/cloudnative-pg
  - https://github.com/goauthentik/helm
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
 maintainers:
  - name: alexlebens
 dependencies:
--- a/clusters/cl01tl/helm/authentik/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/authentik/templates/external-secret.yaml
@@ -14,5 +14,8 @@ spec:
  data:
    - secretKey: key
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
        key: /cl01tl/authentik/key
+        metadataPolicy: None
        property: key
--- a/clusters/cl01tl/helm/authentik/values.yaml
+++ b/clusters/cl01tl/helm/authentik/values.yaml
@@ -30,23 +30,8 @@ authentik:
    redis:
      host: authentik-valkey
  server:
-    replicas: 2
-    resources:
-      requests:
-        cpu: 100m
-        memory: 700Mi
-    livenessProbe:
-      failureThreshold: 3
-      initialDelaySeconds: 15
-      periodSeconds: 10
-      successThreshold: 1
-      timeoutSeconds: 5
-    readinessProbe:
-      failureThreshold: 3
-      initialDelaySeconds: 15
-      periodSeconds: 10
-      successThreshold: 1
-      timeoutSeconds: 5
+    name: server
+    replicas: 1
    metrics:
      enabled: true
      serviceMonitor:
@@ -54,6 +39,8 @@ authentik:
    route:
      main:
        enabled: true
+        apiVersion: gateway.networking.k8s.io/v1
+        kind: HTTPRoute
        hostnames:
          - authentik.alexlebens.net
        parentRefs:
@@ -61,20 +48,21 @@ authentik:
            kind: Gateway
            name: traefik-gateway
            namespace: traefik
+        httpsRedirect: false
+        matches:
+          - path:
+              type: PathPrefix
+              value: /
  worker:
    name: worker
-    replicas: 2
-    resources:
-      requests:
-        cpu: 100m
-        memory: 512Mi
-    metrics:
-      enabled: true
-      serviceMonitor:
-        enabled: true
+    replicas: 1
  prometheus:
    rules:
      enabled: true
+  postgresql:
+    enabled: false
+  redis:
+    enabled: false
 postgres-18-cluster:
  mode: recovery
  recovery:
@@ -88,9 +76,32 @@ postgres-18-cluster:
        destinationBucket: postgres-backups
        externalSecretCredentialPath: /garage/home-infra/postgres-backups
        isWALArchiver: true
+      # - name: garage-remote
+      #   index: 1
+      #   destinationBucket: postgres-backups
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   retentionPolicy: "90d"
+      #   data:
+      #     compression: bzip2
+      # - name: external
+      #   index: 1
+      #   endpointURL: https://nyc3.digitaloceanspaces.com
+      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   isWALArchiver: false
    scheduledBackups:
      - name: live-backup
        suspend: false
        immediate: true
        schedule: "0 5 14 * * *"
        backupName: garage-local
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 4 * * SAT"
+      #   backupName: garage-remote
+      # - name: daily-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
--- a/clusters/cl01tl/helm/backrest/Chart.yaml
+++ b/clusters/cl01tl/helm/backrest/Chart.yaml
@@ -5,12 +5,11 @@ description: backrest
 keywords:
  - backrest
  - backup
-home: https://docs.alexlebens.dev/applications/backrest/
+home: https://wiki.alexlebens.dev/
 sources:
  - https://github.com/garethgeorge/backrest
-  - https://github.com/garethgeorge/backrest/pkgs/container/backrest
+  - https://hub.docker.com/r/garethgeorge/backrest
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
  - name: alexlebens
 dependencies:
--- a/clusters/cl01tl/helm/backrest/values.yaml
+++ b/clusters/cl01tl/helm/backrest/values.yaml
@@ -7,8 +7,9 @@ backrest:
      containers:
        main:
          image:
-            repository: ghcr.io/garethgeorge/backrest
-            tag: v1.12.1@sha256:f4d34bd6fa985d13bdb6c01c5d8727e07708899afa9567d800808357d77b9fb0
+            repository: garethgeorge/backrest
+            tag: v1.12.1
+            pullPolicy: IfNotPresent
          env:
            - name: TZ
              value: America/Chicago
@@ -23,7 +24,7 @@ backrest:
          resources:
            requests:
              cpu: 10m
-              memory: 80Mi
+              memory: 256Mi
  service:
    main:
      controller: main
@@ -32,19 +33,6 @@ backrest:
          port: 80
          targetPort: 9898
          protocol: TCP
-  serviceMonitor:
-    main:
-      selector:
-        matchLabels:
-          app.kubernetes.io/name: backrest
-          app.kubernetes.io/instance: backrest
-      serviceName: '{{ include "bjw-s.common.lib.chart.names.fullname" $ }}'
-      endpoints:
-        - port: http
-          scheme: http
-          path: /metrics
-          interval: 300s
-          scrapeTimeout: 15s
  route:
    main:
      kind: HTTPRoute
@@ -57,8 +45,11 @@ backrest:
        - backrest.alexlebens.net
      rules:
        - backendRefs:
-            - name: backrest
+            - group: ''
+              kind: Service
+              name: backrest
              port: 80
+              weight: 100
          matches:
            - path:
                type: PathPrefix
@@ -69,6 +60,7 @@ backrest:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 10Gi
+      retain: true
      advancedMounts:
        main:
          main:
@@ -79,6 +71,7 @@ backrest:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 1Gi
+      retain: true
      advancedMounts:
        main:
          main:
--- a/clusters/cl01tl/helm/bazarr/Chart.yaml
+++ b/clusters/cl01tl/helm/bazarr/Chart.yaml
@@ -4,14 +4,14 @@ version: 1.0.0
 description: Bazarr
 keywords:
  - bazarr
+  - servarr
  - subtitles
-home: https://docs.alexlebens.dev/applications/bazarr/
+home: https://wiki.alexlebens.dev/s/
 sources:
  - https://github.com/morpheus65535/bazarr
  - https://github.com/linuxserver/docker-bazarr
  - https://github.com/linuxserver/docker-bazarr/pkgs/container/bazarr
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
  - name: alexlebens
 dependencies:
--- a/clusters/cl01tl/helm/bazarr/values.yaml
+++ b/clusters/cl01tl/helm/bazarr/values.yaml
@@ -4,6 +4,7 @@ bazarr:
      type: deployment
      replicas: 1
      strategy: Recreate
+      revisionHistoryLimit: 3
      pod:
        securityContext:
          runAsUser: 1000
@@ -15,9 +16,10 @@ bazarr:
          image:
            repository: ghcr.io/linuxserver/bazarr
            tag: 1.5.6@sha256:05f9d5b24884f37120453dc1a008a47be244eebec32099ae1bd29032e75b67aa
+            pullPolicy: IfNotPresent
          env:
            - name: TZ
-              value: America/Chicago
+              value: US/Central
            - name: PUID
              value: 1000
            - name: PGID
@@ -46,8 +48,11 @@ bazarr:
        - bazarr.alexlebens.net
      rules:
        - backendRefs:
-            - name: bazarr
+            - group: ''
+              kind: Service
+              name: bazarr
              port: 80
+              weight: 100
          matches:
            - path:
                type: PathPrefix
@@ -58,6 +63,7 @@ bazarr:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 5Gi
+      retain: true
      advancedMounts:
        main:
          main:
--- a/clusters/cl01tl/helm/blocky/Chart.yaml
+++ b/clusters/cl01tl/helm/blocky/Chart.yaml
@@ -5,12 +5,11 @@ description: Blocky
 keywords:
  - blocky
  - dns
-home: https://docs.alexlebens.dev/applications/blocky/
+home: https://wiki.alexlebens.dev/s/cf70113d-20bc-48ad-afb8-1e22ed3fd62a
 sources:
  - https://github.com/0xERR0R/blocky
-  - https://github.com/0xERR0R/blocky/pkgs/container/blocky
+  - https://hub.docker.com/r/spx01/blocky
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
 maintainers:
  - name: alexlebens
 dependencies:
--- a/clusters/cl01tl/helm/blocky/values.yaml
+++ b/clusters/cl01tl/helm/blocky/values.yaml
@@ -4,18 +4,20 @@ blocky:
      type: deployment
      replicas: 3
      strategy: RollingUpdate
+      revisionHistoryLimit: 3
      containers:
        main:
          image:
            repository: ghcr.io/0xerr0r/blocky
            tag: v0.29.0@sha256:a6d99f323d3036a99a3767a52ad612f4d8f3f31167492bfc14d4ea57b24cdfd0
+            pullPolicy: IfNotPresent
          env:
            - name: TZ
-              value: America/Chicago
+              value: US/Central
          resources:
            requests:
              cpu: 10m
-              memory: 90Mi
+              memory: 128Mi
  configMaps:
    config:
      enabled: true
@@ -96,7 +98,7 @@ blocky:

              traefik-cl01tl                  IN      A       10.232.1.21
              blocky                          IN      A       10.232.1.22
-              plex-lb                         IN      A       10.232.1.23
+              cilium-cl01tl                   IN      A       10.232.1.23


              ;; Application Names
@@ -115,7 +117,6 @@ blocky:
              directus                        IN      CNAME   traefik-cl01tl
              excalidraw                      IN      CNAME   traefik-cl01tl
              feishin                         IN      CNAME   traefik-cl01tl
-              foldergram                      IN      CNAME   traefik-cl01tl
              garage-s3                       IN      CNAME   traefik-cl01tl
              garage-webui                    IN      CNAME   traefik-cl01tl
              gatus                           IN      CNAME   traefik-cl01tl
--- a/clusters/cl01tl/helm/dawarich/Chart.yaml
+++ b/clusters/cl01tl/helm/dawarich/Chart.yaml
@@ -26,4 +26,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/dawarich.png
 # renovate: datasource=github-releases depName=Freika/dawarich
-appVersion: 1.4.0
+appVersion: 1.3.4
--- a/clusters/cl01tl/helm/dawarich/values.yaml
+++ b/clusters/cl01tl/helm/dawarich/values.yaml
@@ -9,7 +9,7 @@ dawarich:
        main:
          image:
            repository: freikin/dawarich
-            tag: 1.4.0
+            tag: 1.3.4
            pullPolicy: IfNotPresent
          command: ["web-entrypoint.sh"]
          args: ["bin/rails", "server", "-p", "3000", "-b", "::"]
@@ -106,7 +106,7 @@ dawarich:
        sidekiq:
          image:
            repository: freikin/dawarich
-            tag: 1.4.0
+            tag: 1.3.4
            pullPolicy: IfNotPresent
          command: ["sidekiq-entrypoint.sh"]
          args: ["sidekiq"]
--- a/clusters/cl01tl/helm/foldergram/Chart.lock
+++ b/clusters/cl01tl/helm/foldergram/Chart.lock
@@ -1,9 +0,0 @@
-dependencies:
- name: app-template
-  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-digest: sha256:59100c6fbfb829f9d703b9ee1cf869c4fd77b6ff53c63b0c644a757223027e58
-generated: "2026-03-22T12:42:43.150705-05:00"
--- a/clusters/cl01tl/helm/foldergram/Chart.yaml
+++ b/clusters/cl01tl/helm/foldergram/Chart.yaml
@@ -1,25 +0,0 @@
-apiVersion: v2
-name: foldergram
-version: 1.0.0
-description: Foldergram
-keywords:
-  - foldergram
-  - pictures
-home: https://wiki.alexlebens.dev/
-sources:
-  - https://github.com/foldergram/foldergram
-  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: foldergram
-    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.6.2
-  - name: volsync-target
-    alias: volsync-target-data
-    version: 0.8.0
-    repository: oci://harbor.alexlebens.net/helm-charts
-icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
-# renovate: datasource=github-releases depName=foldergram/foldergram
-appVersion: v1.0.5
--- a/clusters/cl01tl/helm/foldergram/templates/persistent-volume-claim.yaml
+++ b/clusters/cl01tl/helm/foldergram/templates/persistent-volume-claim.yaml
@@ -1,17 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: foldergram-pictures-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: foldergram-pictures-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: foldergram-pictures-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
--- a/clusters/cl01tl/helm/foldergram/templates/persistent-volume.yaml
+++ b/clusters/cl01tl/helm/foldergram/templates/persistent-volume.yaml
@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: foldergram-pictures-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: foldergram-pictures-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage/Pictures
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac
--- a/clusters/cl01tl/helm/foldergram/values.yaml
+++ b/clusters/cl01tl/helm/foldergram/values.yaml
@@ -1,87 +0,0 @@
-foldergram:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: ghcr.io/foldergram/foldergram
-            tag: 1.0.5
-            pullPolicy: IfNotPresent
-          env:
-            - name: IMAGE_DETAIL_SOURCE
-              value: original
-            - name: DERIVATIVE_MODE
-              value: lazy
-            - name: DATA_ROOT
-              value: ./data
-            - name: GALLERY_ROOT
-              value: /gallery
-            - name: CSRF_TRUSTED_ORIGINS
-              value: https://foldergram.alexlebens.net
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 4141
-          protocol: HTTP
-  route:
-    main:
-      kind: HTTPRoute
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: traefik-gateway
-          namespace: traefik
-      hostnames:
-        - foldergram.alexlebens.net
-      rules:
-        - backendRefs:
-            - group: ''
-              kind: Service
-              name: foldergram
-              port: 80
-              weight: 100
-          matches:
-            - path:
-                type: PathPrefix
-                value: /
-  persistence:
-    cache:
-      forceRename: foldergram-data
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 10Gi
-      retain: false
-      advancedMounts:
-        main:
-          main:
-            - path: /app/data
-              readOnly: false
-    pictures:
-      existingClaim: foldergram-pictures-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /gallery/pictures
-              readOnly: true
-volsync-target-data:
-  pvcTarget: foldergram-data
-  local:
-    enabled: true
-    schedule: 46 11 * * *
-  remote:
-    enabled: true
-    schedule: 46 12 * * *
-  external:
-    enabled: true
-    schedule: 46 13 * * *
--- a/clusters/cl01tl/helm/gatus/values.yaml
+++ b/clusters/cl01tl/helm/gatus/values.yaml
@@ -161,9 +161,6 @@ gatus:
      - name: photoview
        url: https://photoview.alexlebens.net
        <<: *defaults
-      - name: foldergram
-        url: https://foldergram.alexlebens.net
-        <<: *defaults
      - name: booklore
        url: https://booklore.alexlebens.net
        <<: *defaults
--- a/clusters/cl01tl/helm/homepage/values.yaml
+++ b/clusters/cl01tl/helm/homepage/values.yaml
@@ -202,12 +202,6 @@ homepage:
                  href: https://photoview.alexlebens.net
                  siteMonitor: http://photoview.photoview:80
                  statusStyle: dot
-              - Pictures:
-                  icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
-                  description: Foldergram
-                  href: https://foldergram.alexlebens.net
-                  siteMonitor: http://foldergram.foldergram:80
-                  statusStyle: dot
              - Books:
                  icon: sh-booklore.webp
                  description: Grimmory
--- a/clusters/cl01tl/helm/houndarr/Chart.lock
+++ b/clusters/cl01tl/helm/houndarr/Chart.lock
@@ -1,9 +0,0 @@
-dependencies:
- name: app-template
-  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-digest: sha256:375d6c2eb2f097717c44c5a28cb162da24f4ff154a971e5a68ccd0e0b77e936f
-generated: "2026-03-21T22:31:01.142752-05:00"
--- a/clusters/cl01tl/helm/houndarr/Chart.yaml
+++ b/clusters/cl01tl/helm/houndarr/Chart.yaml
@@ -22,4 +22,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/av1155/houndarr/main/src/houndarr/static/img/houndarr-logo-dark.png
 # renovate: datasource=github-releases depName=av1155/houndarr
-appVersion: v1.6.1
+appVersion: v1.6.0
--- a/clusters/cl01tl/helm/houndarr/values.yaml
+++ b/clusters/cl01tl/helm/houndarr/values.yaml
@@ -14,10 +14,6 @@ houndarr:
          env:
            - name: TZ
              value: America/Chicago
-            - name: PUID
-              value: 1000
-            - name: PGID
-              value: 1000
            - name: HOUNDARR_SECURE_COOKIES
              value: true
            - name: HOUNDARR_TRUSTED_PROXIES
@@ -68,11 +64,6 @@ houndarr:
              readOnly: false
 volsync-target-data:
  pvcTarget: houndarr-data
-  moverSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: OnRootMismatch
  local:
    enabled: true
    schedule: 40 11 * * *
--- a/clusters/cl01tl/helm/plex/values.yaml
+++ b/clusters/cl01tl/helm/plex/values.yaml
@@ -26,7 +26,6 @@ plex:
  service:
    main:
      controller: main
-      type: LoadBalancer
      ports:
        http:
          port: 32400
--- a/clusters/cl01tl/helm/site-documentation/values.yaml
+++ b/clusters/cl01tl/helm/site-documentation/values.yaml
@@ -11,7 +11,7 @@ site-documentation:
        main:
          image:
            repository: harbor.alexlebens.net/images/site-documentation
-            tag: 0.6.0
+            tag: 0.3.0
            pullPolicy: IfNotPresent
          resources:
            requests:
--- a/clusters/cl01tl/helm/unpoller/Chart.yaml
+++ b/clusters/cl01tl/helm/unpoller/Chart.yaml
@@ -21,4 +21,4 @@ dependencies:
    version: 4.6.2
 icon: https://camo.githubusercontent.com/c5d07a5b3acfeac8e1c25bf56f440ffe032b86e4e7f15de82357f022a43fc927/68747470733a2f2f756e706f6c6c65722e636f6d2f696d672f6c6f676f2e706e67
 # renovate: datasource=github-releases depName=unpoller/unpoller
-appVersion: v2.35.0
+appVersion: v2.34.0
--- a/clusters/cl01tl/helm/unpoller/values.yaml
+++ b/clusters/cl01tl/helm/unpoller/values.yaml
@@ -9,7 +9,7 @@ unpoller:
        main:
          image:
            repository: ghcr.io/unpoller/unpoller
-            tag: v2.35.0
+            tag: v2.34.0
            pullPolicy: IfNotPresent
          env:
            - name: UP_UNIFI_CONTROLLER_0_SAVE_ALARMS
--- a/hosts/ps08rp/blocky/config.yml
+++ b/hosts/ps08rp/blocky/config.yml
@@ -73,7 +73,7 @@ customDNS:

    traefik-cl01tl                  IN      A       10.232.1.21
    blocky                          IN      A       10.232.1.22
-    plex-lb                         IN      A       10.232.1.23
+    cilium-cl01tl                   IN      A       10.232.1.23


    ;; Application Names
@@ -92,7 +92,6 @@ customDNS:
    directus                        IN      CNAME   traefik-cl01tl
    excalidraw                      IN      CNAME   traefik-cl01tl
    feishin                         IN      CNAME   traefik-cl01tl
-    foldergram                      IN      CNAME   traefik-cl01tl
    garage-s3                       IN      CNAME   traefik-cl01tl
    garage-webui                    IN      CNAME   traefik-cl01tl
    gatus                           IN      CNAME   traefik-cl01tl
--- a/hosts/ps09rp/blocky/config.yml
+++ b/hosts/ps09rp/blocky/config.yml
@@ -94,7 +94,7 @@ customDNS:

    traefik-cl01tl                  IN      A       10.232.1.21
    blocky                          IN      A       10.232.1.22
-    plex-lb                         IN      A       10.232.1.23
+    cilium-cl01tl                   IN      A       10.232.1.23


    ;; Application Names
@@ -113,7 +113,6 @@ customDNS:
    directus                        IN      CNAME   traefik-cl01tl
    excalidraw                      IN      CNAME   traefik-cl01tl
    feishin                         IN      CNAME   traefik-cl01tl
-    foldergram                      IN      CNAME   traefik-cl01tl
    garage-s3                       IN      CNAME   traefik-cl01tl
    garage-webui                    IN      CNAME   traefik-cl01tl
    gatus                           IN      CNAME   traefik-cl01tl
--- a/renovate.json
+++ b/renovate.json
@@ -22,8 +22,7 @@
      ],
      "matchStrings": [
        "#\\s*renovate:\\s*datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+appVersion:\\s*[\"']?(?<currentValue>[^\"'\\s]+)[\"']?"
-      ],
-      "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver-coerced{{/if}}"
+      ]
    },
    {
      "description": "Update images in templates",
@@ -32,7 +31,7 @@
        "/(^|/)templates/.*\\.yaml$/"
      ],
      "matchStrings": [
-        "# renovate: datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)\\s+tag:\\s*[\"']?(?<currentValue>[^@\"'\\s\n]+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?[\"']?"
+        "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+tag: (?<currentValue>.*)"
      ]
    },
    {
@@ -70,22 +69,6 @@
      ],
      "enabled": false
    },
-    {
-      "description": "Automerge digests for actions",
-      "matchManagers": [
-        "github-actions"
-      ],
-      "matchUpdateTypes": [
-        "digest"
-      ],
-      "addLabels": [
-        "actions",
-        "automerge"
-      ],
-      "enabled": true,
-      "automerge": true,
-      "minimumReleaseAge": "1 days"
-    },
    {
      "description": "Label charts",
      "matchDatasources": [
@@ -127,7 +110,7 @@
      "automergeType": "branch"
    },
    {
-      "description": "Label images",
+      "description": "Label images, docker",
      "matchDatasources": [
        "docker"
      ],
@@ -137,10 +120,9 @@
      "automerge": false
    },
    {
-      "description": "Automerge image patches",
+      "description": "Automerge image patches, docker",
      "matchUpdateTypes": [
-        "patch",
-        "pinDigest"
+        "patch"
      ],
      "matchDatasources": [
        "docker"
@@ -153,26 +135,7 @@
      "minimumReleaseAge": "1 days"
    },
    {
-      "description": "Automerge images, specific packages",
-      "matchUpdateTypes": [
-        "patch",
-        "minor"
-      ],
-      "matchDatasources": [
-        "docker"
-      ],
-      "matchPackageNames": [
-        "ghcr.io/renovatebot/renovate"
-      ],
-      "addLabels": [
-        "image",
-        "automerge"
-      ],
-      "automerge": true,
-      "minimumReleaseAge": "1 days"
-    },
-    {
-      "description": "Automerge digest updates, specific packages",
+      "description": "Allow digest updates for specific packages",
      "matchUpdateTypes": [
        "digest"
      ],
@@ -182,16 +145,12 @@
      "matchPackageNames": [
        "searxng/searxng"
      ],
-      "addLabels": [
-        "image",
-        "automerge"
-      ],
      "enabled": true,
      "automerge": true,
      "minimumReleaseAge": "1 days"
    },
    {
-      "description": "Label appVersion and images, merged",
+      "description": "Label charts and docker, merged",
      "matchManagers": [
        "custom.regex",
        "helm-values"
@@ -204,10 +163,9 @@
      "automerge": false
    },
    {
-      "description": "Automerge appVersion and images, merged",
+      "description": "Automerge charts and docker, merged",
      "matchUpdateTypes": [
-        "patch",
-        "pinDigest"
+        "patch"
      ],
      "matchManagers": [
        "custom.regex",
@@ -221,19 +179,6 @@
      ],
      "automerge": true,
      "minimumReleaseAge": "1 days"
-    },
-    {
-      "description": "Group unmatched Dawarich dependencies",
-      "matchPackageNames": [
-        "freikin/dawarich",
-        "freika/dawarich",
-        "ghcr.io/freikin/dawarich",
-        "ghcr.io/freika/dawarich",
-        "docker.io/freikin/dawarich",
-        "docker.io/freika/dawarich"
-      ],
-      "groupName": "dawarich",
-      "groupSlug": "unified-dawarich"
    }
  ]
 }