chore(deps): update helm release traefik-crds to v1.15.0

.gitea/workflows/lint-test-docker.yaml

@@ -21,14 +21,14 @@ jobs:
     runs-on: ubuntu-js
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Check Branch Exists
         id: check-branch-exists
         if: github.event_name == 'pull_request'
-        uses: GuillaumeFalourd/branch-exists@009290475dc3d75b5d7ec680c0c5b614b0d9855d # v1.1
+        uses: GuillaumeFalourd/branch-exists@v1.1
         with:
           branch: "${{ github.base_ref }}"
 
@@ -51,7 +51,7 @@ jobs:
 
       - name: Set Up Node.js
         if: steps.branch-exists.outputs.exists == 'true'
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        uses: actions/setup-node@v6
         with:
           node-version: '24'
 
@@ -120,7 +120,7 @@ jobs:
           echo "----"
 
       - name: ntfy Failed
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
         if: failure()
         with:
           url: '${{ secrets.NTFY_URL }}'

.gitea/workflows/lint-test-helm.yaml

@@ -28,14 +28,14 @@ jobs:
       changes-detected: ${{ steps.check-dir-changes.outputs.changes-detected }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Check Branch Exists
         id: check-branch-exists
         if: github.event_name == 'pull_request'
-        uses: GuillaumeFalourd/branch-exists@009290475dc3d75b5d7ec680c0c5b614b0d9855d # v1.1
+        uses: GuillaumeFalourd/branch-exists@v1.1
         with:
           branch: ${{ github.base_ref }}
 
@@ -58,7 +58,7 @@ jobs:
 
       - name: Set Up Helm
         if: steps.branch-exists.outputs.exists == 'true'
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
+        uses: azure/setup-helm@v4
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           # renovate: datasource=github-releases depName=helm/helm
@@ -67,7 +67,7 @@ jobs:
 
       - name: Cache Helm Dependencies
         if: steps.branch-exists.outputs.exists == 'true'
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cache/helm
@@ -209,7 +209,7 @@ jobs:
           exit $EXIT_CODE
 
       - name: ntfy Failed
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
         if: failure()
         with:
           url: '${{ secrets.NTFY_URL }}'
@@ -232,7 +232,7 @@ jobs:
       github.event_name == 'pull_request'
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -257,7 +257,7 @@ jobs:
           echo "----"
 
       - name: Set Up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
+        uses: azure/setup-helm@v4
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           # renovate: datasource=github-releases depName=helm/helm
@@ -265,7 +265,7 @@ jobs:
           cache: true
 
       - name: Cache Helm Dependencies
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cache/helm
@@ -352,7 +352,7 @@ jobs:
           exit $EXIT_CODE
 
       - name: ntfy Failed
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
         if: failure()
         with:
           url: '${{ secrets.NTFY_URL }}'

.gitea/workflows/render-manifests.yaml

@@ -31,32 +31,32 @@ jobs:
       (github.event_name == 'pull_request' && github.event.pull_request.merged == true)
     steps:
       - name: Checkout Main
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v6
         with:
           path: infrastructure
           fetch-depth: 0
 
       - name: Checkout Manifests
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v6
         with:
           ref: manifests
           path: infrastructure-manifests
 
       - name: Set Up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
+        uses: azure/setup-helm@v4
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           version: v3.17.2 # Pending https://github.com/helm/helm/pull/30743
           cache: true
 
       - name: Configure Kubeconfig
-        uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4
+        uses: azure/k8s-set-context@v4
         with:
           method: kubeconfig
           kubeconfig: ${{ secrets.KUBECONFIG }}
 
       - name: Cache Helm Dependencies
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cache/helm
@@ -568,7 +568,7 @@ jobs:
           echo "----"
 
       - name: ntfy Created
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
         if: steps.create-pull-request.outputs.pull-request-operation == 'created' && steps.mode.outputs.is-automerge == 'false'
         with:
           url: "${{ secrets.NTFY_URL }}"
@@ -582,7 +582,7 @@ jobs:
           actions: '[{"action": "view", "label": "View PR", "url": "${{ vars.USER_URL }}/${{ github.repository }}/pulls/${{ steps.create-pull-request.outputs.pull-request-number }}", "clear": true}]'
 
       - name: ntfy Updated
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
         if: steps.commit-push.outputs.push == 'true' && steps.check-for-pull-request.outputs.pull-request-exists != 'false' && steps.mode.outputs.is-automerge == 'false'
         with:
           url: "${{ secrets.NTFY_URL }}"
@@ -596,7 +596,7 @@ jobs:
           actions: '[{"action": "view", "label": "View PR", "url": "${{ vars.USER_URL }}/${{ github.repository }}/pulls/${{ steps.create-pull-request.outputs.pull-request-number }}", "clear": true}]'
 
       - name: ntfy Merged
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
         if: steps.merge-changes.outputs.pull-request-operation == 'merged'
         with:
           url: "${{ secrets.NTFY_URL }}"
@@ -610,7 +610,7 @@ jobs:
           actions: '[{"action": "view", "label": "View PR", "url": "${{ vars.USER_URL }}/${{ github.repository }}/pulls/${{ steps.create-pull-request.outputs.pull-request-number }}", "clear": true}]'
 
       - name: ntfy Failed
-        uses: niniyas/ntfy-action@96acac57fdc91d4c4f50b78486c1ed6f03f9f61c # master
+        uses: niniyas/ntfy-action@master
         if: failure()
         with:
           url: "${{ secrets.NTFY_URL }}"

.gitea/workflows/renovate.yaml

@@ -13,10 +13,10 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.84.2@sha256:92285747b3aac062a4f567762c272a12dce037843a20177a02c95b7c420e20cb
+    container: ghcr.io/renovatebot/renovate:43
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v6
 
       - name: Renovate
         run: renovate
@@ -25,7 +25,7 @@ jobs:
           RENOVATE_ENDPOINT: ${{ vars.INSTANCE_URL }}
           RENOVATE_REPOSITORIES: alexlebens/infrastructure
           RENOVATE_GIT_AUTHOR: Renovate Bot <renovate-bot@alexlebens.net>
-          LOG_LEVEL: debug
+          LOG_LEVEL: info
           RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
           RENOVATE_GIT_PRIVATE_KEY: ${{ secrets.RENOVATE_GIT_PRIVATE_KEY }}
           RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}

clusters/cl01tl/helm/actual/Chart.yaml

@@ -5,12 +5,11 @@ description: Actual
 keywords:
   - actual
   - budget
-home: https://docs.alexlebens.dev/applications/actual/
+home: https://wiki.alexlebens.dev/s/86192f45-94b7-45de-872c-6ef3fec7df5e
 sources:
   - https://github.com/actualbudget/actual
   - https://github.com/actualbudget/actual/pkgs/container/actual
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/actual/values.yaml

@@ -4,18 +4,20 @@ actual:
       type: deployment
       replicas: 1
       strategy: Recreate
+      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: ghcr.io/actualbudget/actual
-            tag: 26.3.0@sha256:eb8bc26f53025e07e464594c12d77c52c4b95840c8dadd9b95c4f0c4660f8ad2
+            tag: 26.3.0
+            pullPolicy: IfNotPresent
           env:
-            - name: ACTUAL_PORT
-              value: 5006
+            - name: TZ
+              value: US/Central
           resources:
             requests:
-              cpu: 25m
-              memory: 64Mi
+              cpu: 10m
+              memory: 128Mi
           probes:
             liveness:
               enabled: true
@@ -52,8 +54,11 @@ actual:
         - actual.alexlebens.net
       rules:
         - backendRefs:
-            - name: actual
+            - group: ''
+              kind: Service
+              name: actual
               port: 80
+              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -64,6 +69,7 @@ actual:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 2Gi
+      retain: true
       advancedMounts:
         main:
           main:

clusters/cl01tl/helm/argo-workflows/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: argo-workflows
   repository: https://argoproj.github.io/argo-helm
-  version: 1.0.5
+  version: 1.0.2
 - name: argo-events
   repository: https://argoproj.github.io/argo-helm
-  version: 2.4.21
+  version: 2.4.20
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.10.0
-digest: sha256:d0d7ebf1c0013d001aa2f17d04a6d3f3d7a1fa7d5c62792eef856b87c24eb26e
-generated: "2026-03-20T20:48:30.830922259Z"
+digest: sha256:8d1c2dd011a360d930ed5ff186462f163407077d36ae633898ec5d6ba30a4e8d
+generated: "2026-03-15T20:04:18.080966008Z"

clusters/cl01tl/helm/argo-workflows/Chart.yaml

@@ -7,21 +7,21 @@ keywords:
   - argo-events
   - workflows
   - events
-home: https://docs.alexlebens.dev/applications/argo-workflows/
+home: https://wiki.alexlebens.dev/s/a268508f-d81d-4b4b-8bd5-9058edaea635
 sources:
   - https://github.com/argoproj/argo-workflows
   - https://github.com/argoproj/argo-events
-  - https://github.com/argoproj/argo-helm/tree/main/charts/argo-workflows
-  - https://github.com/argoproj/argo-helm/tree/main/charts/argo-events
+  - https://github.com/cloudnative-pg/cloudnative-pg
+  - https://github.com/argoproj/argo-helm/tree/main/charts
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-workflows
-    version: 1.0.5
+    version: 1.0.2
     repository: https://argoproj.github.io/argo-helm
   - name: argo-events
-    version: 2.4.21
+    version: 2.4.20
     repository: https://argoproj.github.io/argo-helm
   - name: postgres-cluster
     alias: postgres-18-cluster
@@ -29,4 +29,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-workflows
-appVersion: v4.0.3
+appVersion: v4.0.2

clusters/cl01tl/helm/argo-workflows/templates/external-secret.yaml

@@ -14,9 +14,15 @@ spec:
   data:
     - secretKey: secret
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /authentik/oidc/argo-workflows
+        metadataPolicy: None
         property: secret
     - secretKey: client
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /authentik/oidc/argo-workflows
+        metadataPolicy: None
         property: client

clusters/cl01tl/helm/argo-workflows/templates/http-route.yaml

@@ -0,0 +1,28 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: argo-workflows
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: argo-workflows
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+  hostnames:
+    - argo-workflows.alexlebens.net
+  rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: /
+      backendRefs:
+        - group: ''
+          kind: Service
+          name: argo-workflows-server
+          port: 2746
+          weight: 100

clusters/cl01tl/helm/argo-workflows/values.yaml

@@ -2,15 +2,22 @@ argo-workflows:
   crds:
     install: true
     keep: true
+    # -- Use full CRDs with complete OpenAPI schemas. When false, uses minified CRDs with x-kubernetes-preserve-unknown-fields.
+    # Full CRDs are very large and are installed via a pre-install/pre-upgrade hook Job that uses server-side apply.
     full: true
     upgradeJob:
       image:
         repository: registry.k8s.io/kubectl
-        tag: v1.35.3
+        tag: v1.35.2
   controller:
     metricsConfig:
       enabled: true
     persistence:
+      connectionPool:
+        maxIdleConns: 100
+        maxOpenConns: 0
+      nodeStatusOffLoad: true
+      archive: true
       postgresql:
         host: argo-workflows-postgresql-18-cluster-rw
         port: 5432
@@ -25,34 +32,24 @@ argo-workflows:
         ssl: false
         sslMode: disable
     workflowWorkers: 2
-    workflowTTLWorkers: 2
-    podCleanupWorkers: 2
-    cronWorkflowWorkers: 2
+    workflowTTLWorkers: 1
+    podCleanupWorkers: 1
+    cronWorkflowWorkers: 1
     resources:
       requests:
         cpu: 10m
-        memory: 32Mi
+        memory: 128Mi
     serviceMonitor:
       enabled: true
+    name: workflow-controller
     workflowNamespaces:
+      - argocd
       - argo-workflows
   server:
     authModes:
       - sso
-    httproute:
-      enabled: true
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: traefik-gateway
-          namespace: traefik
-      hostnames:
-        - argo-workflows.alexlebens.net
-      rules:
-        - matches:
-            - path:
-                type: PathPrefix
-                value: /
+    ingress:
+      enabled: false
     sso:
       enabled: true
       issuer: https://authentik.alexlebens.net/application/o/argo-workflows/
@@ -69,15 +66,15 @@ argo-workflows:
         - openid
         - email
         - profile
+  useStaticCredentials: true
+  artifactRepository:
+    archiveLogs: false
 argo-events:
-  crds:
-    install: true
-    keep: true
   controller:
     resources:
       requests:
         cpu: 10m
-        memory: 32Mi
+        memory: 128Mi
     metrics:
       enabled: true
       serviceMonitor:
@@ -87,7 +84,7 @@ argo-events:
     resources:
       requests:
         cpu: 10m
-        memory: 32Mi
+        memory: 128Mi
 postgres-18-cluster:
   mode: recovery
   recovery:
@@ -101,9 +98,32 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
+      # - name: garage-remote
+      #   index: 1
+      #   destinationBucket: postgres-backups
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   retentionPolicy: "90d"
+      #   data:
+      #     compression: bzip2
+      # - name: external
+      #   index: 1
+      #   endpointURL: https://nyc3.digitaloceanspaces.com
+      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 0 14 * * *"
         backupName: garage-local
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 4 * * SAT"
+      #   backupName: garage-remote
+      # - name: daily-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external

clusters/cl01tl/helm/argocd/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 9.4.15
-digest: sha256:a0eed2e174bb6b13d04653c755a359025b050d479a92180039a1990dd8ee7caa
-generated: "2026-03-20T01:09:07.547016465Z"
+  version: 9.4.10
+digest: sha256:795aad956acef3f5efb8160390caf9b9792b7b4150d3a7984f1c5edbad92dfaa
+generated: "2026-03-10T18:58:35.720448421Z"

clusters/cl01tl/helm/argocd/Chart.yaml

@@ -4,8 +4,10 @@ version: 1.0.0
 description: Argo CD
 keywords:
   - argo-cd
+  - delivery
   - deployment
-home: https://docs.alexlebens.dev/applications/argo-cd/
+  - gitops
+home: https://wiki.alexlebens.dev/s/8a75cf26-b9df-437e-9cc5-2ef47e871a5f
 sources:
   - https://github.com/argoproj/argo-cd
   - https://github.com/argoproj/argo-helm/tree/main/charts/argo-cd
@@ -13,8 +15,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 9.4.15
+    version: 9.4.10
     repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-cd
-appVersion: v3.3.4
+appVersion: v3.3.3

clusters/cl01tl/helm/argocd/templates/external-secret.yaml

@@ -14,11 +14,17 @@ spec:
   data:
     - secretKey: secret
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /authentik/oidc/argocd
+        metadataPolicy: None
         property: secret
     - secretKey: client
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /authentik/oidc/argocd
+        metadataPolicy: None
         property: client
 
 ---
@@ -38,7 +44,10 @@ spec:
   data:
     - secretKey: ntfy-token
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /ntfy/user/cl01tl
+        metadataPolicy: None
         property: token
 
 ---
@@ -58,13 +67,22 @@ spec:
   data:
     - secretKey: type
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/argocd/credentials/repo/infrastructure
+        metadataPolicy: None
         property: type
     - secretKey: url
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/argocd/credentials/repo/infrastructure
+        metadataPolicy: None
         property: url
     - secretKey: sshPrivateKey
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/argocd/credentials/repo/infrastructure
+        metadataPolicy: None
         property: sshPrivateKey

clusters/cl01tl/helm/argocd/values.yaml

@@ -1,11 +1,12 @@
 argo-cd:
   crds:
     install: true
-    keep: true
   configs:
     cm:
       admin.enabled: true
       accounts.homepage: apiKey
+      timeout.reconciliation: 100s
+      timeout.reconciliation.jitter: 60s
       url: https://argocd.alexlebens.net
       statusbadge.url: https://argocd.alexlebens.net/
       statusbadge.enabled: true
@@ -32,53 +33,12 @@ argo-cd:
         g, homepage, role:readonly
   controller:
     replicas: 1
-    resources:
-      requests:
-        cpu: 15m
-        memory: 1Gi
-    readinessProbe:
-      failureThreshold: 3
-      initialDelaySeconds: 60
-      periodSeconds: 30
-      successThreshold: 1
-      timeoutSeconds: 5
     metrics:
       enabled: true
       serviceMonitor:
         enabled: true
-      rules:
-        enabled: true
-      spec:
-        - alert: ArgoAppMissing
-          expr: |
-            absent(argocd_app_info) == 1
-          for: 15m
-          labels:
-            severity: critical
-          annotations:
-            summary: "[Argo CD] No reported applications"
-            description: >
-              Argo CD has not reported any applications data for the past 15 minutes which
-              means that it must be down or not functioning properly.  This needs to be
-              resolved for this cloud to continue to maintain state.
-        - alert: ArgoAppNotSynced
-          expr: |
-            argocd_app_info{sync_status!="Synced"} == 1
-          for: 12h
-          labels:
-            severity: warning
-          annotations:
-            summary: "[{{`{{$labels.name}}`}}] Application not synchronized"
-            description: >
-              The application [{{`{{$labels.name}}`}} has not been synchronized for over
-              12 hours which means that the state of this cloud has drifted away from the
-              state inside Git.
   dex:
     enabled: true
-    resources:
-      requests:
-        cpu: 10m
-        memory: 64Mi
     metrics:
       enabled: true
       serviceMonitor:
@@ -89,57 +49,20 @@ argo-cd:
       enabled: true
   redis-ha:
     enabled: true
-    image:
-      repository: redis
-      tag: 8.6.1-alpine@sha256:315270d166080f537bbdf1b489b603aaaa213cb55a544acfa51feb7481abb1c0
-    persistentVolume:
-      enabled: true
-    redis:
-      resources:
-        requests:
-          cpu: 1000m
-          memory: 64Mi
-    haproxy:
-      enabled: true
-      image:
-        repository: haproxy
-        tag: 3.3.6-alpine@sha256:744be2dca649a44d490a4c565d36968d19482dd387f1bdd44c168f4322bc6b1e
-      resources:
-        requests:
-          cpu: 10m
-          memory: 128Mi
-      metrics:
-        enabled: true
-        serviceMonitor:
-          enabled: true
-    exporter:
-      enabled: true
-      image: ghcr.io/oliver006/redis_exporter
-      tag: v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
-      serviceMonitor:
-        enabled: true
-    prometheusRule:
-      enabled: true
-      interval: 30s
-      rules:
-        - alert: RedisPodDown
-          expr: |
-            redis_up{job="{{ include "redis-ha.fullname" . }}"} == 0
-          for: 5m
-          labels:
-            severity: critical
-          annotations:
-            description: Redis pod {{ "{{ $labels.pod }}" }} is down
-            summary: Redis pod {{ "{{ $labels.pod }}" }} is down
     auth: false
   redisSecretInit:
     enabled: false
   server:
     replicas: 2
-    resources:
-     requests:
-       cpu: 10m
-       memory: 64Mi
+    extensions:
+      enabled: true
+      extensionList:
+        - name: extension-trivy
+          env:
+            - name: EXTENSION_URL
+              value: https://github.com/mziyabo/argocd-trivy-extension/releases/download/v0.2.0/extension-trivy.tar
+            - name: EXTENSION_CHECKSUM_URL
+              value: https://github.com/mziyabo/argocd-trivy-extension/releases/download/v0.2.0/extension-trivy_checksums.txt
     metrics:
       enabled: true
       serviceMonitor:
@@ -153,56 +76,31 @@ argo-cd:
           namespace: traefik
       hostnames:
         - argocd.alexlebens.net
+      rules:
+        - matches:
+            - path:
+                type: PathPrefix
+                value: /
   repoServer:
     replicas: 2
-    resources:
-      requests:
-        cpu: 10m
-        memory: 64Mi
-    readinessProbe:
-      enabled: true
-      failureThreshold: 3
-      initialDelaySeconds: 60
-      periodSeconds: 30
-      successThreshold: 1
-      timeoutSeconds: 5
-    livenessProbe:
-      enabled: true
-      failureThreshold: 3
-      initialDelaySeconds: 60
-      periodSeconds: 30
-      successThreshold: 1
-      timeoutSeconds: 5
     metrics:
       enabled: true
       serviceMonitor:
         enabled: true
   applicationSet:
     replicas: 2
-    resources:
-      requests:
-        cpu: 10m
-        memory: 64Mi
     metrics:
       enabled: true
       serviceMonitor:
         enabled: true
-    readinessProbe:
-      enabled: true
-      failureThreshold: 3
-      initialDelaySeconds: 60
-      periodSeconds: 30
-      successThreshold: 1
-      timeoutSeconds: 5
     livenessProbe:
       enabled: true
-      failureThreshold: 3
-      initialDelaySeconds: 60
-      periodSeconds: 30
-      successThreshold: 1
-      timeoutSeconds: 5
+    readinessProbe:
+      enabled: true
   notifications:
-    argocdUrl: https://argocd.alexlebens.net
+    enabled: true
+    context:
+      argocdUrl: https://argocd.alexlebens.net
     secret:
       create: false
       name: argocd-notifications-secret
@@ -216,10 +114,6 @@ argo-cd:
         headers:
           - name: Authorization
             value: Bearer $ntfy-token
-    resources:
-      requests:
-        cpu: 10m
-        memory: 64Mi
     livenessProbe:
       enabled: true
     readinessProbe:

clusters/cl01tl/helm/audiobookshelf/Chart.yaml

@@ -7,14 +7,11 @@ keywords:
   - books
   - podcasts
   - audiobooks
-home: https://docs.alexlebens.dev/applications/audiobookshelf/
+home: https://wiki.alexlebens.dev/s/d4d6719f-cd1c-4b6e-b78e-2d2d7a5097d7
 sources:
   - https://github.com/advplyr/audiobookshelf
-  - https://github.com/caronc/apprise
   - https://github.com/advplyr/audiobookshelf/pkgs/container/audiobookshelf
-  - https://github.com/caronc/apprise-api/pkgs/container/apprise
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:
@@ -32,4 +29,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/audiobookshelf.png
 # renovate: datasource=github-releases depName=advplyr/audiobookshelf
-appVersion: 2.33.1
+appVersion: 2.33.0

clusters/cl01tl/helm/audiobookshelf/templates/external-secret.yaml

@@ -14,5 +14,8 @@ spec:
   data:
     - secretKey: ntfy-url
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/audiobookshelf/apprise
+        metadataPolicy: None
         property: ntfy-url

clusters/cl01tl/helm/audiobookshelf/values.yaml

@@ -4,25 +4,28 @@ audiobookshelf:
       type: deployment
       replicas: 1
       strategy: Recreate
+      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: ghcr.io/advplyr/audiobookshelf
-            tag: 2.33.1@sha256:a4a5841bba093d81e5f4ad1eaedb4da3fda6dbb2528c552349da50ad1f7ae708
+            tag: 2.33.0
+            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: America/Chicago
+              value: US/Central
           resources:
             requests:
               cpu: 10m
-              memory: 200Mi
+              memory: 128Mi
         apprise-api:
           image:
-            repository: ghcr.io/caronc/apprise
-            tag: v1.3.2@sha256:1aafc2118b6eae5d70d17831d9a8a52adee7104fd6f2bb018e6421664699c903
+            repository: caronc/apprise
+            tag: v1.3.2
+            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: America/Chicago
+              value: US/Central
             - name: PGID
               value: "1000"
             - name: PUID
@@ -38,6 +41,10 @@ audiobookshelf:
                 secretKeyRef:
                   name: audiobookshelf-apprise-config
                   key: ntfy-url
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
   service:
     main:
       controller: main
@@ -75,8 +82,11 @@ audiobookshelf:
         - audiobookshelf.alexlebens.net
       rules:
         - backendRefs:
-            - name: audiobookshelf
+            - group: ''
+              kind: Service
+              name: audiobookshelf
               port: 80
+              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -87,6 +97,7 @@ audiobookshelf:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 2Gi
+      retain: true
       advancedMounts:
         main:
           main:
@@ -97,6 +108,7 @@ audiobookshelf:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 10Gi
+      retain: true
       advancedMounts:
         main:
           main:

clusters/cl01tl/helm/authentik/Chart.yaml

@@ -6,14 +6,17 @@ keywords:
   - authentik
   - sso
   - oidc
+  - ldap
+  - idp
   - authentication
-home: https://docs.alexlebens.dev/applications/authentik/
+home: https://wiki.alexlebens.dev/s/45ca5171-581f-41d2-b6fb-2b0915029a2d
 sources:
   - https://github.com/goauthentik/authentik
+  - https://github.com/cloudflare/cloudflared
+  - https://github.com/cloudnative-pg/cloudnative-pg
   - https://github.com/goauthentik/helm
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/authentik/templates/external-secret.yaml

@@ -14,5 +14,8 @@ spec:
   data:
     - secretKey: key
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/authentik/key
+        metadataPolicy: None
         property: key

clusters/cl01tl/helm/authentik/values.yaml

@@ -30,23 +30,8 @@ authentik:
     redis:
       host: authentik-valkey
   server:
-    replicas: 2
-    resources:
-      requests:
-        cpu: 100m
-        memory: 700Mi
-    livenessProbe:
-      failureThreshold: 3
-      initialDelaySeconds: 15
-      periodSeconds: 10
-      successThreshold: 1
-      timeoutSeconds: 5
-    readinessProbe:
-      failureThreshold: 3
-      initialDelaySeconds: 15
-      periodSeconds: 10
-      successThreshold: 1
-      timeoutSeconds: 5
+    name: server
+    replicas: 1
     metrics:
       enabled: true
       serviceMonitor:
@@ -54,6 +39,8 @@ authentik:
     route:
       main:
         enabled: true
+        apiVersion: gateway.networking.k8s.io/v1
+        kind: HTTPRoute
         hostnames:
           - authentik.alexlebens.net
         parentRefs:
@@ -61,20 +48,21 @@ authentik:
             kind: Gateway
             name: traefik-gateway
             namespace: traefik
+        httpsRedirect: false
+        matches:
+          - path:
+              type: PathPrefix
+              value: /
   worker:
     name: worker
-    replicas: 2
-    resources:
-      requests:
-        cpu: 100m
-        memory: 512Mi
-    metrics:
-      enabled: true
-      serviceMonitor:
-        enabled: true
+    replicas: 1
   prometheus:
     rules:
       enabled: true
+  postgresql:
+    enabled: false
+  redis:
+    enabled: false
 postgres-18-cluster:
   mode: recovery
   recovery:
@@ -88,9 +76,32 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
+      # - name: garage-remote
+      #   index: 1
+      #   destinationBucket: postgres-backups
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   retentionPolicy: "90d"
+      #   data:
+      #     compression: bzip2
+      # - name: external
+      #   index: 1
+      #   endpointURL: https://nyc3.digitaloceanspaces.com
+      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 5 14 * * *"
         backupName: garage-local
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 4 * * SAT"
+      #   backupName: garage-remote
+      # - name: daily-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external

clusters/cl01tl/helm/backrest/Chart.yaml

@@ -5,12 +5,11 @@ description: backrest
 keywords:
   - backrest
   - backup
-home: https://docs.alexlebens.dev/applications/backrest/
+home: https://wiki.alexlebens.dev/
 sources:
   - https://github.com/garethgeorge/backrest
-  - https://github.com/garethgeorge/backrest/pkgs/container/backrest
+  - https://hub.docker.com/r/garethgeorge/backrest
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/backrest/values.yaml

@@ -7,8 +7,9 @@ backrest:
       containers:
         main:
           image:
-            repository: ghcr.io/garethgeorge/backrest
-            tag: v1.12.1@sha256:f4d34bd6fa985d13bdb6c01c5d8727e07708899afa9567d800808357d77b9fb0
+            repository: garethgeorge/backrest
+            tag: v1.12.1
+            pullPolicy: IfNotPresent
           env:
             - name: TZ
               value: America/Chicago
@@ -23,7 +24,7 @@ backrest:
           resources:
             requests:
               cpu: 10m
-              memory: 80Mi
+              memory: 256Mi
   service:
     main:
       controller: main
@@ -32,19 +33,6 @@ backrest:
           port: 80
           targetPort: 9898
           protocol: TCP
-  serviceMonitor:
-    main:
-      selector:
-        matchLabels:
-          app.kubernetes.io/name: backrest
-          app.kubernetes.io/instance: backrest
-      serviceName: '{{ include "bjw-s.common.lib.chart.names.fullname" $ }}'
-      endpoints:
-        - port: http
-          scheme: http
-          path: /metrics
-          interval: 300s
-          scrapeTimeout: 15s
   route:
     main:
       kind: HTTPRoute
@@ -57,8 +45,11 @@ backrest:
         - backrest.alexlebens.net
       rules:
         - backendRefs:
-            - name: backrest
+            - group: ''
+              kind: Service
+              name: backrest
               port: 80
+              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -69,6 +60,7 @@ backrest:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 10Gi
+      retain: true
       advancedMounts:
         main:
           main:
@@ -79,6 +71,7 @@ backrest:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 1Gi
+      retain: true
       advancedMounts:
         main:
           main:

clusters/cl01tl/helm/bazarr/Chart.yaml

@@ -4,14 +4,14 @@ version: 1.0.0
 description: Bazarr
 keywords:
   - bazarr
+  - servarr
   - subtitles
-home: https://docs.alexlebens.dev/applications/bazarr/
+home: https://wiki.alexlebens.dev/s/
 sources:
   - https://github.com/morpheus65535/bazarr
   - https://github.com/linuxserver/docker-bazarr
   - https://github.com/linuxserver/docker-bazarr/pkgs/container/bazarr
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/bazarr/values.yaml

@@ -4,6 +4,7 @@ bazarr:
       type: deployment
       replicas: 1
       strategy: Recreate
+      revisionHistoryLimit: 3
       pod:
         securityContext:
           runAsUser: 1000
@@ -15,9 +16,10 @@ bazarr:
           image:
             repository: ghcr.io/linuxserver/bazarr
             tag: 1.5.6@sha256:05f9d5b24884f37120453dc1a008a47be244eebec32099ae1bd29032e75b67aa
+            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: America/Chicago
+              value: US/Central
             - name: PUID
               value: 1000
             - name: PGID
@@ -46,8 +48,11 @@ bazarr:
         - bazarr.alexlebens.net
       rules:
         - backendRefs:
-            - name: bazarr
+            - group: ''
+              kind: Service
+              name: bazarr
               port: 80
+              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -58,6 +63,7 @@ bazarr:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 5Gi
+      retain: true
       advancedMounts:
         main:
           main:

clusters/cl01tl/helm/blocky/Chart.yaml

@@ -5,12 +5,11 @@ description: Blocky
 keywords:
   - blocky
   - dns
-home: https://docs.alexlebens.dev/applications/blocky/
+home: https://wiki.alexlebens.dev/s/cf70113d-20bc-48ad-afb8-1e22ed3fd62a
 sources:
   - https://github.com/0xERR0R/blocky
-  - https://github.com/0xERR0R/blocky/pkgs/container/blocky
+  - https://hub.docker.com/r/spx01/blocky
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
 maintainers:
   - name: alexlebens
 dependencies:

clusters/cl01tl/helm/blocky/values.yaml

@@ -4,18 +4,20 @@ blocky:
       type: deployment
       replicas: 3
       strategy: RollingUpdate
+      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: ghcr.io/0xerr0r/blocky
             tag: v0.29.0@sha256:a6d99f323d3036a99a3767a52ad612f4d8f3f31167492bfc14d4ea57b24cdfd0
+            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: America/Chicago
+              value: US/Central
           resources:
             requests:
               cpu: 10m
-              memory: 90Mi
+              memory: 128Mi
   configMaps:
     config:
       enabled: true
@@ -96,7 +98,7 @@ blocky:
 
               traefik-cl01tl                  IN      A       10.232.1.21
               blocky                          IN      A       10.232.1.22
-              plex-lb                         IN      A       10.232.1.23
+              cilium-cl01tl                   IN      A       10.232.1.23
 
 
               ;; Application Names
@@ -115,7 +117,6 @@ blocky:
               directus                        IN      CNAME   traefik-cl01tl
               excalidraw                      IN      CNAME   traefik-cl01tl
               feishin                         IN      CNAME   traefik-cl01tl
-              foldergram                      IN      CNAME   traefik-cl01tl
               garage-s3                       IN      CNAME   traefik-cl01tl
               garage-webui                    IN      CNAME   traefik-cl01tl
               gatus                           IN      CNAME   traefik-cl01tl
@@ -126,17 +127,14 @@ blocky:
               home                            IN      CNAME   traefik-cl01tl
               home-assistant                  IN      CNAME   traefik-cl01tl
               home-assistant-code-server      IN      CNAME   traefik-cl01tl
-              houndarr                        IN      CNAME   traefik-cl01tl
               hubble                          IN      CNAME   traefik-cl01tl
               immich                          IN      CNAME   traefik-cl01tl
               jellyfin                        IN      CNAME   traefik-cl01tl
               jellystat                       IN      CNAME   traefik-cl01tl
               kiwix                           IN      CNAME   traefik-cl01tl
               komodo                          IN      CNAME   traefik-cl01tl
-              languagetool                    IN      CNAME   traefik-cl01tl
               lidarr                          IN      CNAME   traefik-cl01tl
               mail                            IN      CNAME   traefik-cl01tl
-              medialyze                       IN      CNAME   traefik-cl01tl
               movie-roulette                  IN      CNAME   traefik-cl01tl
               music-grabber                   IN      CNAME   traefik-cl01tl
               navidrome                       IN      CNAME   traefik-cl01tl

clusters/cl01tl/helm/booklore/Chart.yaml

@@ -4,14 +4,11 @@ version: 1.0.0
 description: booklore
 keywords:
   - booklore
-  - grimmory
   - books
 home: https://wiki.alexlebens.dev/
 sources:
   - https://github.com/booklore-app/BookLore
-  - https://github.com/grimmory-tools/grimmory
   - https://github.com/booklore-app/booklore/pkgs/container/booklore
-  - https://github.com/grimmory-tools/grimmory/pkgs/container/grimmory
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
 maintainers:
   - name: alexlebens
@@ -32,5 +29,5 @@ dependencies:
     version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/booklore.png
-# renovate: datasource=github-releases depName=grimmory-tools/grimmory
-appVersion: v2.3.0
+# renovate: datasource=github-releases depName=booklore-app/BookLore
+appVersion: v2.2.1

clusters/cl01tl/helm/booklore/values.yaml

@@ -8,8 +8,8 @@ booklore:
       containers:
         main:
           image:
-            repository: ghcr.io/grimmory-tools/grimmory
-            tag: v2.3.0
+            repository: ghcr.io/booklore-app/booklore
+            tag: v2.2.1
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/code-server/values.yaml

@@ -9,7 +9,7 @@ code-server:
         main:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.112.0@sha256:4bb5b8ad22268001687c047f0f04933799fb03df1eb0e1e266ba15ed2d9f4e8b
+            tag: 4.111.0@sha256:12c04b41f601604795562ece2ac64cade7cfca632415f4bfb1742477e3226272
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/dawarich/Chart.yaml

@@ -26,4 +26,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/dawarich.png
 # renovate: datasource=github-releases depName=Freika/dawarich
-appVersion: 1.4.0
+appVersion: 1.3.4

clusters/cl01tl/helm/dawarich/values.yaml

@@ -9,7 +9,7 @@ dawarich:
         main:
           image:
             repository: freikin/dawarich
-            tag: 1.4.0
+            tag: 1.3.4
             pullPolicy: IfNotPresent
           command: ["web-entrypoint.sh"]
           args: ["bin/rails", "server", "-p", "3000", "-b", "::"]
@@ -106,7 +106,7 @@ dawarich:
         sidekiq:
           image:
             repository: freikin/dawarich
-            tag: 1.4.0
+            tag: 1.3.4
             pullPolicy: IfNotPresent
           command: ["sidekiq-entrypoint.sh"]
           args: ["sidekiq"]

clusters/cl01tl/helm/decluttarr/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.6.2
+digest: sha256:548ae1f8699100a2f6bac11a4a3137402b3eea340c7a3db4d9f1813ad6a11dca
+generated: "2026-02-23T22:08:42.516245-06:00"

clusters/cl01tl/helm/decluttarr/Chart.yaml

@@ -0,0 +1,20 @@
+apiVersion: v2
+name: decluttarr
+version: 1.0.0
+description: decluttarr
+keywords:
+  - decluttarr
+  - servarr
+home: https://wiki.alexlebens.dev/s/
+sources:
+  - https://github.com/ManiMatter/decluttarr
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: decluttarr
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.6.2
+# renovate: datasource=github-releases depName=ManiMatter/decluttarr
+appVersion: v2.0.0

clusters/cl01tl/helm/decluttarr/templates/external-secret.yaml

@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: decluttarr-config-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: decluttarr-config-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: config.yaml
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/decluttarr/config
+        metadataPolicy: None
+        property: config.yaml

clusters/cl01tl/helm/decluttarr/values.yaml

@@ -0,0 +1,32 @@
+decluttarr:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: ghcr.io/manimatter/decluttarr
+            tag: v2.0.0
+            pullPolicy: IfNotPresent
+          env:
+            - name: TZ
+              value: America/Chicago
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+  persistence:
+    config:
+      enabled: true
+      type: secret
+      name: decluttarr-config-secret
+      advancedMounts:
+        main:
+          main:
+            - path: /app/config/config.yaml
+              readOnly: true
+              mountPropagation: None
+              subPath: config.yaml

clusters/cl01tl/helm/eraser/values.yaml

@@ -34,7 +34,27 @@ eraser:
         request:
           cpu: 100m
           memory: 128Mi
-        config: ""
+        config: "" # |
+          # cacheDir: /var/lib/trivy
+          # dbRepo: ghcr.io/aquasecurity/trivy-db
+          # deleteFailedImages: true
+          # deleteEOLImages: true
+          # vulnerabilities:
+          #   ignoreUnfixed: true
+          #   types:
+          #     - os
+          #     - library
+          #   securityChecks:
+          #     - vuln
+          #   severities:
+          #     - CRITICAL
+          #     - HIGH
+          #     - MEDIUM
+          #     - LOW
+          #   ignoredStatuses:
+          # timeout:
+          #   total: 23h
+          #   perImage: 1h
       remover:
         request:
           cpu: 10m

clusters/cl01tl/helm/external-secrets/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: external-secrets
   repository: https://charts.external-secrets.io
-  version: 2.2.0
-digest: sha256:832fc3f8d3728bdea2b696a6044e4c18967cd9ab9c5cc74adbf40aaa270a84b4
-generated: "2026-03-20T20:53:08.407747649Z"
+  version: 2.1.0
+digest: sha256:b19563d51f1922403185979c6c442531a7bb13d302e8438b5a18d450259b7245
+generated: "2026-03-07T18:02:23.908145348Z"

clusters/cl01tl/helm/external-secrets/Chart.yaml

@@ -12,8 +12,8 @@ sources:
   - https://github.com/external-secrets/external-secrets/tree/main/deploy/charts/external-secrets
 dependencies:
   - name: external-secrets
-    version: 2.2.0
+    version: 2.1.0
     repository: https://charts.external-secrets.io
 icon: https://avatars.githubusercontent.com/u/68335991?s=48&v=4
 # renovate: datasource=github-releases depName=external-secrets/external-secrets
-appVersion: v2.2.0
+appVersion: v2.1.0

clusters/cl01tl/helm/foldergram/Chart.lock

@@ -1,9 +0,0 @@
-dependencies:
-- name: app-template
-  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
-- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-digest: sha256:59100c6fbfb829f9d703b9ee1cf869c4fd77b6ff53c63b0c644a757223027e58
-generated: "2026-03-22T12:42:43.150705-05:00"

clusters/cl01tl/helm/foldergram/Chart.yaml

@@ -1,25 +0,0 @@
-apiVersion: v2
-name: foldergram
-version: 1.0.0
-description: Foldergram
-keywords:
-  - foldergram
-  - pictures
-home: https://wiki.alexlebens.dev/
-sources:
-  - https://github.com/foldergram/foldergram
-  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: foldergram
-    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.6.2
-  - name: volsync-target
-    alias: volsync-target-data
-    version: 0.8.0
-    repository: oci://harbor.alexlebens.net/helm-charts
-icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
-# renovate: datasource=github-releases depName=foldergram/foldergram
-appVersion: v1.0.5

clusters/cl01tl/helm/foldergram/templates/persistent-volume-claim.yaml

@@ -1,17 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: foldergram-pictures-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: foldergram-pictures-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: foldergram-pictures-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/helm/foldergram/templates/persistent-volume.yaml

@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: foldergram-pictures-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: foldergram-pictures-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage/Pictures
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/helm/foldergram/values.yaml

@@ -1,87 +0,0 @@
-foldergram:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: ghcr.io/foldergram/foldergram
-            tag: 1.0.5
-            pullPolicy: IfNotPresent
-          env:
-            - name: IMAGE_DETAIL_SOURCE
-              value: original
-            - name: DERIVATIVE_MODE
-              value: lazy
-            - name: DATA_ROOT
-              value: ./data
-            - name: GALLERY_ROOT
-              value: /gallery
-            - name: CSRF_TRUSTED_ORIGINS
-              value: https://foldergram.alexlebens.net
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 4141
-          protocol: HTTP
-  route:
-    main:
-      kind: HTTPRoute
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: traefik-gateway
-          namespace: traefik
-      hostnames:
-        - foldergram.alexlebens.net
-      rules:
-        - backendRefs:
-            - group: ''
-              kind: Service
-              name: foldergram
-              port: 80
-              weight: 100
-          matches:
-            - path:
-                type: PathPrefix
-                value: /
-  persistence:
-    cache:
-      forceRename: foldergram-data
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 10Gi
-      retain: false
-      advancedMounts:
-        main:
-          main:
-            - path: /app/data
-              readOnly: false
-    pictures:
-      existingClaim: foldergram-pictures-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /gallery/pictures
-              readOnly: true
-volsync-target-data:
-  pvcTarget: foldergram-data
-  local:
-    enabled: true
-    schedule: 46 11 * * *
-  remote:
-    enabled: true
-    schedule: 46 12 * * *
-  external:
-    enabled: true
-    schedule: 46 13 * * *

clusters/cl01tl/helm/garage/values.yaml

@@ -34,7 +34,7 @@ garage:
         debug:
           image:
             repository: ubuntu
-            tag: resolute-20260312
+            tag: resolute-20260108
             pullPolicy: IfNotPresent
           command:
             - "sleep"

clusters/cl01tl/helm/gatus/values.yaml

@@ -161,9 +161,6 @@ gatus:
       - name: photoview
         url: https://photoview.alexlebens.net
         <<: *defaults
-      - name: foldergram
-        url: https://foldergram.alexlebens.net
-        <<: *defaults
       - name: booklore
         url: https://booklore.alexlebens.net
         <<: *defaults
@@ -194,9 +191,6 @@ gatus:
       - name: excalidraw
         url: https://excalidraw.alexlebens.net
         <<: *defaults
-      - name: languagetool
-        url: https://languagetool.alexlebens.net
-        <<: *defaults
       - name: gitea
         url: https://gitea.alexlebens.net
         <<: *defaults
@@ -233,9 +227,6 @@ gatus:
       - name: jellystat
         url: https://jellystat.alexlebens.net
         <<: *defaults
-      - name: medialyze
-        url: https://medialyze.alexlebens.net
-        <<: *defaults
       - name: authentik
         url: https://authentik.alexlebens.net
         <<: *defaults
@@ -310,9 +301,6 @@ gatus:
       - name: tdarr
         url: https://tdarr.alexlebens.net
         <<: *defaults
-      - name: houndarr
-        url: https://houndarr.alexlebens.net
-        <<: *defaults
       - name: sonarr
         url: http://sonarr.sonarr:80
         <<: *defaults

clusters/cl01tl/helm/generic-device-plugin/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: generic-device-plugin
   repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-  version: 0.20.24
-digest: sha256:36bf651c24198d299458046aaf449e9fb50942e1143389092a746357d402b731
-generated: "2026-03-20T01:18:36.687250976Z"
+  version: 0.20.22
+digest: sha256:14e5aa3f02ce6a1271dadc3f76997c739fc9434e669b05655c079d0b873c56ca
+generated: "2026-03-15T20:35:40.676997293Z"

clusters/cl01tl/helm/generic-device-plugin/Chart.yaml

@@ -15,6 +15,6 @@ maintainers:
 dependencies:
   - name: generic-device-plugin
     repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-    version: 0.20.24
+    version: 0.20.22
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: 1.0.0

clusters/cl01tl/helm/gitea/Chart.lock

@@ -7,7 +7,7 @@ dependencies:
   version: 0.0.3
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.28.0
+  version: 0.27.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.4.0
@@ -23,5 +23,5 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:238b7653c9d12c4886a56350b6d66217dbe7ecbb76078a846c7cc2c8cb450eb3
-generated: "2026-03-16T15:56:55.197735783Z"
+digest: sha256:095caf06888cd4663eb5d389399ebad167861007b604016fc4907308474558ab
+generated: "2026-03-15T20:05:41.388335307Z"

clusters/cl01tl/helm/gitea/Chart.yaml

@@ -33,7 +33,7 @@ dependencies:
     repository: https://dl.gitea.com/charts/
     version: 0.0.3
   - name: meilisearch
-    version: 0.28.0
+    version: 0.27.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/helm/grafana-operator/Chart.lock

@@ -1,7 +1,7 @@
 dependencies:
 - name: grafana-operator
   repository: https://grafana.github.io/helm-charts
-  version: 5.22.2
+  version: 5.22.1
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 7.10.0
@@ -11,5 +11,5 @@ dependencies:
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
-digest: sha256:a3bf183bcecb4d4b5354fe91a549075997dccb41c193da9daec9ccbe4d659fe2
-generated: "2026-03-18T10:04:15.165729555Z"
+digest: sha256:9cbba52d093e40b20917af87263e1fb0e478912440f660543f3527e70452edc7
+generated: "2026-03-15T20:05:59.855514102Z"

clusters/cl01tl/helm/grafana-operator/Chart.yaml

@@ -17,7 +17,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: grafana-operator
-    version: 5.22.2
+    version: 5.22.1
     repository: https://grafana.github.io/helm-charts
   - name: postgres-cluster
     alias: postgres-18-cluster
@@ -33,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grafana.png
 # renovate: datasource=github-releases depName=grafana/grafana-operator
-appVersion: v5.22.2
+appVersion: v5.22.1

clusters/cl01tl/helm/grafana-operator/templates/grafana-dashboard.yaml

@@ -377,6 +377,25 @@ spec:
   resyncPeriod: 1h
   url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/tdarr.json
 
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: grafana-dashboard-trivy
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: grafana-dashboard-trivy
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  instanceSelector:
+    matchLabels:
+      app: grafana-main
+  contentCacheDuration: 1h
+  folderUID: grafana-folder-service
+  resyncPeriod: 1h
+  url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/service/trivy.json
+
 ---
 apiVersion: grafana.integreatly.org/v1beta1
 kind: GrafanaDashboard

clusters/cl01tl/helm/harbor/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: harbor
   repository: https://helm.goharbor.io
-  version: 1.18.3
+  version: 1.18.2
 - name: postgres-cluster
   repository: https://gitea.alexlebens.net/api/packages/alexlebens/helm
   version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
-digest: sha256:e7a5cee56dddb4abc07ff18677cb6ddf55571b38da2eeb7e654e8ad8f7709bfa
-generated: "2026-03-19T04:16:54.362332682Z"
+digest: sha256:14c2b7d09631dbb573e9c9d4613ebe52e330146662da0da15f74c31ec519ed15
+generated: "2026-03-15T20:06:13.615175051Z"

clusters/cl01tl/helm/harbor/Chart.yaml

@@ -17,7 +17,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: harbor
-    version: 1.18.3
+    version: 1.18.2
     repository: https://helm.goharbor.io
   - name: postgres-cluster
     alias: postgres-18-cluster
@@ -29,4 +29,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/harbor.png
 # renovate: datasource=github-releases depName=goharbor/harbor
-appVersion: v2.15.0
+appVersion: v2.14.3

clusters/cl01tl/helm/harbor/values.yaml

@@ -41,12 +41,12 @@ harbor:
   portal:
     image:
       repository: goharbor/harbor-portal
-      tag: v2.15.0
+      tag: v2.14.3
     replicas: 2
   core:
     image:
       repository: goharbor/harbor-core
-      tag: v2.15.0
+      tag: v2.14.3
     replicas: 2
     existingSecret: harbor-secret
     secretName: harbor-secret
@@ -54,7 +54,7 @@ harbor:
   jobservice:
     image:
       repository: goharbor/harbor-jobservice
-      tag: v2.15.0
+      tag: v2.14.3
     replicas: 2
     jobLoggers:
       - stdout
@@ -63,11 +63,11 @@ harbor:
     registry:
       image:
         repository: goharbor/registry-photon
-        tag: v2.15.0
+        tag: v2.14.3
     controller:
       image:
         repository: goharbor/harbor-registryctl
-        tag: v2.15.0
+        tag: v2.14.3
     existingSecret: harbor-secret
     relativeurls: true
     credentials:
@@ -94,7 +94,7 @@ harbor:
   exporter:
     image:
       repository: goharbor/harbor-exporter
-      tag: v2.15.0
+      tag: v2.14.3
     replicas: 2
 postgres-18-cluster:
   mode: recovery

clusters/cl01tl/helm/headlamp/values.yaml

@@ -25,6 +25,9 @@ headlamp:
         - name: cert-manager
           source: https://artifacthub.io/packages/headlamp/headlamp-plugins/headlamp_cert-manager
           version: 0.1.0
+        - name: trivy
+          source: https://artifacthub.io/packages/headlamp/headlamp-trivy/headlamp_trivy
+          version: 0.3.1
         - name: external-secrets-operator
           source: https://artifacthub.io/packages/headlamp/external-secrets-operator-headlamp-plugin/external-secrets-operator
           version: 0.1.0-beta7

clusters/cl01tl/helm/home-assistant/Chart.yaml

@@ -25,4 +25,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/home-assistant.png
 # renovate: datasource=github-releases depName=home-assistant/core
-appVersion: 2026.3.3
+appVersion: 2026.3.1

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -9,7 +9,7 @@ home-assistant:
         main:
           image:
             repository: ghcr.io/home-assistant/home-assistant
-            tag: 2026.3.3
+            tag: 2026.3.1
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -21,7 +21,7 @@ home-assistant:
         code-server:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.112.0@sha256:4bb5b8ad22268001687c047f0f04933799fb03df1eb0e1e266ba15ed2d9f4e8b
+            tag: 4.111.0@sha256:12c04b41f601604795562ece2ac64cade7cfca632415f4bfb1742477e3226272
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/homepage/values.yaml

@@ -202,15 +202,9 @@ homepage:
                   href: https://photoview.alexlebens.net
                   siteMonitor: http://photoview.photoview:80
                   statusStyle: dot
-              - Pictures:
-                  icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
-                  description: Foldergram
-                  href: https://foldergram.alexlebens.net
-                  siteMonitor: http://foldergram.foldergram:80
-                  statusStyle: dot
               - Books:
                   icon: sh-booklore.webp
-                  description: Grimmory
+                  description: Booklore
                   href: https://booklore.alexlebens.net
                   siteMonitor: http://booklore.booklore:80
                   statusStyle: dot
@@ -483,12 +477,6 @@ homepage:
                   href: https://jellystat.alexlebens.net
                   siteMonitor: http://jellystat.jellystat:80
                   statusStyle: dot
-              - MediaLyze:
-                  icon: https://raw.githubusercontent.com/frederikemmer/MediaLyze/d8f69c0628bac7c047b90f91a66341648029c273/frontend/public/favicon.svg
-                  description: Jellyfin Media Monitoring
-                  href: https://medialyze.alexlebens.net
-                  siteMonitor: http://medialyze.medialyze:80
-                  statusStyle: dot
           - Services:
               - Auth (Public):
                   icon: sh-authentik.webp
@@ -639,12 +627,6 @@ homepage:
                   href: https://bazarr.alexlebens.net
                   siteMonitor: http://bazarr.bazarr:80
                   statusStyle: dot
-              - Houndarr:
-                  icon: https://raw.githubusercontent.com/av1155/houndarr/main/src/houndarr/static/img/houndarr-logo-dark.png
-                  description: Media Searches
-                  href: https://houndarr.alexlebens.net
-                  siteMonitor: http://houndarr.houndarr:80
-                  statusStyle: dot
               - Tdarr:
                   icon: sh-tdarr.webp
                   description: Media transcoding and health checks
@@ -792,6 +774,9 @@ homepage:
               - Digital Ocean:
                   - abbr: DO
                     href: https://www.digitalocean.com/
+              - AWS:
+                  - abbr: AW
+                    href: https://aws.amazon.com/console/
               - Cloudflare:
                   - abbr: CF
                     href: https://dash.cloudflare.com/b76e303258b84076ee01fd0f515c0768
@@ -801,12 +786,12 @@ homepage:
               - ProtonVPN:
                   - abbr: PV
                     href: https://account.protonvpn.com/
-              - AirVPN:
-                  - abbr: AV
-                    href: https://airvpn.org/
               - Unifi:
                   - abbr: UF
                     href: https://unifi.ui.com/
+              - Pushover:
+                  - abbr: PO
+                    href: https://pushover.net
               - ReCaptcha:
                   - abbr: RC
                     href: https://www.google.com/recaptcha/admin/site/698983587

clusters/cl01tl/helm/houndarr/Chart.lock

@@ -1,9 +0,0 @@
-dependencies:
-- name: app-template
-  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
-- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-digest: sha256:375d6c2eb2f097717c44c5a28cb162da24f4ff154a971e5a68ccd0e0b77e936f
-generated: "2026-03-21T22:31:01.142752-05:00"

clusters/cl01tl/helm/houndarr/Chart.yaml

@@ -1,25 +0,0 @@
-apiVersion: v2
-name: houndarr
-version: 1.0.0
-description: Houndarr
-keywords:
-  - houndarr
-  - servarr
-home: https://wiki.alexlebens.dev/s/
-sources:
-  - https://github.com/av1155/houndarr
-  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: houndarr
-    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.6.2
-  - name: volsync-target
-    alias: volsync-target-data
-    version: 0.8.0
-    repository: oci://harbor.alexlebens.net/helm-charts
-icon: https://raw.githubusercontent.com/av1155/houndarr/main/src/houndarr/static/img/houndarr-logo-dark.png
-# renovate: datasource=github-releases depName=av1155/houndarr
-appVersion: v1.6.1

clusters/cl01tl/helm/houndarr/values.yaml

@@ -1,84 +0,0 @@
-houndarr:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: ghcr.io/av1155/houndarr
-            tag: v1.6.0
-            pullPolicy: IfNotPresent
-          env:
-            - name: TZ
-              value: America/Chicago
-            - name: PUID
-              value: 1000
-            - name: PGID
-              value: 1000
-            - name: HOUNDARR_SECURE_COOKIES
-              value: true
-            - name: HOUNDARR_TRUSTED_PROXIES
-              value: 10.96.0.0/12
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 8877
-          protocol: HTTP
-  route:
-    main:
-      kind: HTTPRoute
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: traefik-gateway
-          namespace: traefik
-      hostnames:
-        - houndarr.alexlebens.net
-      rules:
-        - backendRefs:
-            - group: ''
-              kind: Service
-              name: houndarr
-              port: 80
-              weight: 100
-          matches:
-            - path:
-                type: PathPrefix
-                value: /
-  persistence:
-    data:
-      forceRename: houndarr-data
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 1Gi
-      advancedMounts:
-        main:
-          main:
-            - path: /data
-              readOnly: false
-volsync-target-data:
-  pvcTarget: houndarr-data
-  moverSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: OnRootMismatch
-  local:
-    enabled: true
-    schedule: 40 11 * * *
-  remote:
-    enabled: true
-    schedule: 40 12 * * *
-  external:
-    enabled: true
-    schedule: 40 14 * * *

clusters/cl01tl/helm/immich/Chart.yaml

@@ -32,4 +32,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/immich.png
 # renovate: datasource=github-releases depName=immich-app/immich
-appVersion: v2.6.1
+appVersion: v2.5.6

clusters/cl01tl/helm/immich/values.yaml

@@ -9,7 +9,7 @@ immich:
         main:
           image:
             repository: ghcr.io/immich-app/immich-server
-            tag: v2.6.1
+            tag: v2.5.6
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/jellyfin/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.6.2
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.28.0
+  version: 0.27.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:57b007c6e19dda1300f5025332d9e8104bfb9a50cd7124260bfa68ce2432628b
-generated: "2026-03-16T15:57:13.466372254Z"
+digest: sha256:ca384647a640ae717ac874a2627f00ac9a1e5c97ff5eeb8f326ebdd471ab1623
+generated: "2026-03-09T15:04:08.648165537Z"

clusters/cl01tl/helm/jellyfin/Chart.yaml

@@ -25,7 +25,7 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
   - name: meilisearch
-    version: 0.28.0
+    version: 0.27.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: volsync-target
     alias: volsync-target-config

clusters/cl01tl/helm/karakeep/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 4.6.2
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.28.0
+  version: 0.27.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.4.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:49e37e17dc859927048c6474ce27cb063a020f291d6d2d24876d0427eddc3656
-generated: "2026-03-16T15:57:28.156797159Z"
+digest: sha256:75f92316d4b6229d00e3dfa39ed5026ad39a28f833321cd3887a2048cdac34c7
+generated: "2026-03-09T22:04:48.630821646Z"

clusters/cl01tl/helm/karakeep/Chart.yaml

@@ -22,7 +22,7 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
   - name: meilisearch
-    version: 0.28.0
+    version: 0.27.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 82.13.0
+  version: 82.10.4
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.6.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
-digest: sha256:1d90bebd9c0afd20f8ff780edd15da18b20f89cf35fd85832d6d8d44b2e0544b
-generated: "2026-03-20T18:02:38.368086545Z"
+digest: sha256:d6bbbfdd1a781b5eb82c2dc8571836a43d23bf8526eac1bcd40f38030be642db
+generated: "2026-03-15T20:38:11.961621853Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 82.13.0
+    version: 82.10.4
     repository: oci://ghcr.io/prometheus-community/charts
   - name: app-template
     alias: ntfy-alertmanager
@@ -32,4 +32,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prometheus.png
 # renovate: datasource=github-releases depName=prometheus-operator/prometheus-operator
-appVersion: v0.90.0
+appVersion: v0.89.0

clusters/cl01tl/helm/languagetool/Chart.lock

@@ -1,9 +0,0 @@
-dependencies:
-- name: app-template
-  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
-- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-digest: sha256:cb14506ada77add5ffcb93d38763e2a5c962312e5754618265d15c4361fea783
-generated: "2026-03-20T17:49:46.393059-05:00"

clusters/cl01tl/helm/languagetool/Chart.yaml

@@ -1,27 +0,0 @@
-apiVersion: v2
-name: languagetool
-version: 1.0.0
-description: LanguageTool
-keywords:
-  - languagetool
-  - spellchecking
-home: https://wiki.alexlebens.dev/
-sources:
-  - https://github.com/languagetool-org/languagetool
-  - https://github.com/Erikvl87/docker-languagetool
-  - https://hub.docker.com/r/erikvl87/languagetool
-  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: languagetool
-    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.6.2
-  - name: volsync-target
-    alias: volsync-target-data
-    version: 0.8.0
-    repository: oci://harbor.alexlebens.net/helm-charts
-icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/languagetool.webp
-# renovate: datasource=github-releases depName=Erikvl87/docker-languagetool
-appVersion: "6.7"

clusters/cl01tl/helm/languagetool/values.yaml

@@ -1,76 +0,0 @@
-languagetool:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: erikvl87/languagetool
-            tag: 6.7
-            pullPolicy: IfNotPresent
-          env:
-            - name: langtool_languageModel
-              value: /ngrams
-            - name: Java_Xms
-              value: 512m
-            - name: Java_Xmx
-              value: 1g
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 8010
-          protocol: HTTP
-  route:
-    main:
-      kind: HTTPRoute
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: traefik-gateway
-          namespace: traefik
-      hostnames:
-        - languagetool.alexlebens.net
-      rules:
-        - backendRefs:
-            - group: ''
-              kind: Service
-              name: languagetool
-              port: 80
-              weight: 100
-          matches:
-            - path:
-                type: PathPrefix
-                value: /
-  persistence:
-    data:
-      forceRename: languagetool-data
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 1Gi
-      retain: true
-      advancedMounts:
-        main:
-          main:
-            - path: /ngrams
-              readOnly: false
-volsync-target-data:
-  pvcTarget: languagetool-data
-  local:
-    enabled: true
-    schedule: 38 11 * * *
-  remote:
-    enabled: true
-    schedule: 38 12 * * *
-  external:
-    enabled: true
-    schedule: 38 14 * * *

clusters/cl01tl/helm/libation/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/libation.png
 # renovate: datasource=github-releases depName=rmcrackan/Libation
-appVersion: 13.3.2
+appVersion: 13.3.0

clusters/cl01tl/helm/libation/values.yaml

@@ -16,7 +16,7 @@ libation:
         main:
           image:
             repository: rmcrackan/libation
-            tag: 13.3.2
+            tag: 13.3.0
             pullPolicy: IfNotPresent
           env:
             - name: SLEEP_TIME
@@ -35,7 +35,7 @@ libation:
         main:
           image:
             repository: ubuntu
-            tag: resolute-20260312
+            tag: resolute-20260108
             pullPolicy: IfNotPresent
           command:
             - "sleep"

clusters/cl01tl/helm/lidarr/values.yaml

@@ -15,7 +15,7 @@ lidarr:
         main:
           image:
             repository: ghcr.io/linuxserver/lidarr
-            tag: 3.1.2-nightly@sha256:034055feee43b11eb2f7a8438a9af1c99ab564dd2b43e5df2fe5b3c9b3b8b1ac
+            tag: 3.1.2-nightly@sha256:2b1b64f07214c6cf05bcfed999aa74ee23825e4bc2ef2c48aba1cd5d5bf968fe
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/medialyze/Chart.lock

@@ -1,6 +0,0 @@
-dependencies:
-- name: app-template
-  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
-digest: sha256:17ac9bc0cc2eac395c630c22ab095e3e34e5d75a34523c3f39629ca1c56ecbc8
-generated: "2026-03-17T17:46:15.885193-05:00"

clusters/cl01tl/helm/medialyze/Chart.yaml

@@ -1,22 +0,0 @@
-apiVersion: v2
-name: medialyze
-version: 1.0.0
-description: MediaLyze
-keywords:
-  - medialyze
-  - jellyfin
-home: https://wiki.alexlebens.dev/
-sources:
-  - https://github.com/frederikemmer/MediaLyze
-  - https://github.com/frederikemmer/MediaLyze/pkgs/container/medialyze
-  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: medialyze
-    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.6.2
-icon: https://raw.githubusercontent.com/frederikemmer/MediaLyze/d8f69c0628bac7c047b90f91a66341648029c273/frontend/public/favicon.svg
-# renovate: datasource=github-releases depName=frederikemmer/MediaLyze
-appVersion: 0.2.3

clusters/cl01tl/helm/medialyze/templates/persistent-volume-claim.yaml

@@ -1,17 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: medialyze-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: medialyze-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: medialyze-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/helm/medialyze/templates/persistent-volume.yaml

@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: medialyze-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: medialyze-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/helm/medialyze/values.yaml

@@ -1,85 +0,0 @@
-medialyze:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: ghcr.io/frederikemmer/medialyze
-            tag: 0.2.3
-            pullPolicy: IfNotPresent
-          env:
-            - name: HOST_PORT
-              value: 8080
-            - name: SCAN_RUNTIME_WORKER_COUNT
-              value: 2
-            - name: TZ
-              value: America/Chicago
-            - name: MEDIA_HOST_DIR
-              value: /media
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 8080
-          protocol: HTTP
-  route:
-    main:
-      kind: HTTPRoute
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: traefik-gateway
-          namespace: traefik
-      hostnames:
-        - medialyze.alexlebens.net
-      rules:
-        - backendRefs:
-            - group: ''
-              kind: Service
-              name: medialyze
-              port: 80
-              weight: 100
-          matches:
-            - path:
-                type: PathPrefix
-                value: /
-  persistence:
-    data:
-      forceRename: medialyze-data
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 1Gi
-      retain: true
-      advancedMounts:
-        main:
-          main:
-            - path: /config
-              readOnly: false
-    media:
-      existingClaim: medialyze-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /media
-              readOnly: true
-volsync-target-data:
-  pvcTarget: medialyze-data
-  local:
-    enabled: true
-    schedule: 36 11 * * *
-  remote:
-    enabled: true
-    schedule: 36 12 * * *
-  external:
-    enabled: true
-    schedule: 36 14 * * *

clusters/cl01tl/helm/music-grabber/templates/external-secret.yaml

@@ -60,27 +60,20 @@ spec:
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /airvpn/conf/cl01tl
+        key: /protonvpn/conf/cl01tl
         metadataPolicy: None
         property: private-key
-    - secretKey: preshared-key
+    - secretKey: proton-email
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /airvpn/conf/cl01tl
+        key: /protonvpn/conf/cl01tl
         metadataPolicy: None
-        property: preshared-key
-    - secretKey: addresses
+        property: email
+    - secretKey: proton-password
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /airvpn/conf/cl01tl
+        key: /protonvpn/conf/cl01tl
         metadataPolicy: None
-        property: addresses
-    - secretKey: input-ports
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /airvpn/conf/cl01tl
-        metadataPolicy: None
-        property: input-ports
+        property: password

clusters/cl01tl/helm/music-grabber/values.yaml

@@ -9,7 +9,7 @@ music-grabber:
         main:
           image:
             repository: g33kphr33k/musicgrabber
-            tag: 2.5.0
+            tag: 2.4.3
             pullPolicy: IfNotPresent
           env:
             - name: MUSIC_DIR
@@ -50,72 +50,72 @@ music-grabber:
             requests:
               cpu: 10m
               memory: 512Mi
-        # gluetun:
-        #   image:
-        #     repository: ghcr.io/qdm12/gluetun
-        #     tag: v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab
-        #     pullPolicy: IfNotPresent
-        #   lifecycle:
-        #     postStart:
-        #       exec:
-        #         command: ["/bin/sh", "-c", "(ip rule del table 51820; ip -6 rule del table 51820) || true"]
-        #   env:
-        #     - name: VPN_SERVICE_PROVIDER
-        #       value: airvpn
-        #     - name: VPN_TYPE
-        #       value: wireguard
-        #     - name: WIREGUARD_PRIVATE_KEY
-        #       valueFrom:
-        #         secretKeyRef:
-        #           name: music-grabber-wireguard-conf
-        #           key: private-key
-        #     - name: WIREGUARD_PRESHARED_KEY
-        #       valueFrom:
-        #         secretKeyRef:
-        #           name: music-grabber-wireguard-conf
-        #           key: preshared-key
-        #     - name: WIREGUARD_ADDRESSES
-        #       valueFrom:
-        #         secretKeyRef:
-        #           name: music-grabber-wireguard-conf
-        #           key: addresses
-        #     - name: FIREWALL_OUTBOUND_SUBNETS
-        #       value: 10.0.0.0/8
-        #     - name: FIREWALL_INPUT_PORTS
-        #       value: 8080
-        #     - name: DNS_UPSTREAM_RESOLVER_TYPE
-        #       value: dot
-        #     - name: HTTPPROXY
-        #       value: "off"
-        #     - name: SHADOWSOCKS
-        #       value: "off"
-        #   securityContext:
-        #     privileged: True
-        #     capabilities:
-        #       add:
-        #         - NET_ADMIN
-        #         - SYS_MODULE
-        #   probes:
-        #     liveness:
-        #       enabled: true
-        #       custom: true
-        #       spec:
-        #         exec:
-        #           command:
-        #             - /gluetun-entrypoint
-        #             - healthcheck
-        #         failureThreshold: 5
-        #         initialDelaySeconds: 30
-        #         periodSeconds: 30
-        #         successThreshold: 1
-        #         timeoutSeconds: 15
-        #   resources:
-        #     limits:
-        #       devic.es/tun: "1"
-        #     requests:
-        #       devic.es/tun: "1"
-        #       cpu: 10m
-        #       memory: 128Mi
+        gluetun:
+          image:
+            repository: ghcr.io/qdm12/gluetun
+            tag: v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab
+            pullPolicy: IfNotPresent
+          lifecycle:
+            postStart:
+              exec:
+                command: ["/bin/sh", "-c", "(ip rule del table 51820; ip -6 rule del table 51820) || true"]
+          env:
+            - name: VPN_SERVICE_PROVIDER
+              value: protonvpn
+            - name: VPN_TYPE
+              value: wireguard
+            - name: WIREGUARD_PRIVATE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: music-grabber-wireguard-conf
+                  key: private-key
+            - name: UPDATER_PROTONVPN_EMAIL
+              valueFrom:
+                secretKeyRef:
+                  name: music-grabber-wireguard-conf
+                  key: proton-email
+            - name: UPDATER_PROTONVPN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: music-grabber-wireguard-conf
+                  key: proton-password
+            - name: FIREWALL_OUTBOUND_SUBNETS
+              value: 10.0.0.0/8
+            - name: FIREWALL_INPUT_PORTS
+              value: 8080
+            - name: DNS_UPSTREAM_RESOLVER_TYPE
+              value: dot
+            - name: HTTPPROXY
+              value: "off"
+            - name: SHADOWSOCKS
+              value: "off"
+          securityContext:
+            privileged: True
+            capabilities:
+              add:
+                - NET_ADMIN
+                - SYS_MODULE
+          probes:
+            liveness:
+              enabled: true
+              custom: true
+              spec:
+                exec:
+                  command:
+                    - /gluetun-entrypoint
+                    - healthcheck
+                failureThreshold: 5
+                initialDelaySeconds: 30
+                periodSeconds: 30
+                successThreshold: 1
+                timeoutSeconds: 15
+          resources:
+            limits:
+              devic.es/tun: "1"
+            requests:
+              devic.es/tun: "1"
+              cpu: 10m
+              memory: 128Mi
   service:
     main:
       controller: main

clusters/cl01tl/helm/ntfy/Chart.yaml

@@ -20,4 +20,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ntfy.png
 # renovate: datasource=github-releases depName=binwiederhier/ntfy
-appVersion: 2.19.2
+appVersion: 2.19.0

clusters/cl01tl/helm/ntfy/values.yaml

@@ -9,7 +9,7 @@ ntfy:
         main:
           image:
             repository: binwiederhier/ntfy
-            tag: v2.19.2
+            tag: v2.19.0
             pullPolicy: IfNotPresent
           args: ["serve"]
           env:

clusters/cl01tl/helm/ollama/Chart.yaml

@@ -31,4 +31,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ollama.png
 # renovate: datasource=github-releases depName=ollama/ollama
-appVersion: 0.18.2
+appVersion: 0.18.0

clusters/cl01tl/helm/ollama/values.yaml

@@ -22,7 +22,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.18.2
+            tag: 0.18.0
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE
@@ -58,7 +58,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.18.2
+            tag: 0.18.0
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE
@@ -94,7 +94,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.18.2
+            tag: 0.18.0
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE

clusters/cl01tl/helm/outline/Chart.yaml

@@ -39,4 +39,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/outline.png
 # renovate: datasource=github-releases depName=outline/outline
-appVersion: 1.6.1
+appVersion: 1.6.0

clusters/cl01tl/helm/outline/values.yaml

@@ -12,7 +12,7 @@ outline:
         main:
           image:
             repository: outlinewiki/outline
-            tag: 1.6.1
+            tag: 1.6.0
             pullPolicy: IfNotPresent
           env:
             - name: NODE_ENV

clusters/cl01tl/helm/plex/values.yaml

@@ -9,7 +9,7 @@ plex:
         main:
           image:
             repository: ghcr.io/linuxserver/plex
-            tag: 1.43.0@sha256:a27f1ce1e1d14cd3627ed217f042bf8de0f796ed274fb27b2dc971ae22a64b95
+            tag: 1.43.0@sha256:84f8646e799f6636876ab4f283d9fc8f6c51d56098ea74cba82bfb85074b68df
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -26,7 +26,6 @@ plex:
   service:
     main:
       controller: main
-      type: LoadBalancer
       ports:
         http:
           port: 32400

clusters/cl01tl/helm/postiz/Chart.yaml

@@ -42,4 +42,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/postiz.png
 # renovate: datasource=github-releases depName=gitroomhq/postiz-app
-appVersion: v2.21.0
+appVersion: v2.20.2

clusters/cl01tl/helm/postiz/values.yaml

@@ -9,7 +9,7 @@ postiz:
         main:
           image:
             repository: ghcr.io/gitroomhq/postiz-app
-            tag: v2.21.0
+            tag: v2.20.2
             pullPolicy: IfNotPresent
           env:
             - name: MAIN_URL

clusters/cl01tl/helm/prometheus-operator-crds/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: prometheus-operator-crds
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 28.0.0
-digest: sha256:82e19c59373b1dd1a854a4e5699c7b864cfbb96e58a065f53ad76e64d7109cff
-generated: "2026-03-19T22:02:57.659253727Z"
+  version: 27.0.0
+digest: sha256:ab76a45fb53268d4afdad507277c244af11c50344e50a24799182bbd9757258d
+generated: "2026-02-06T14:05:22.069162277Z"

clusters/cl01tl/helm/prometheus-operator-crds/Chart.yaml

@@ -15,8 +15,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: prometheus-operator-crds
-    version: 28.0.0
+    version: 27.0.0
     repository: oci://ghcr.io/prometheus-community/charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prometheus.png
 # renovate: datasource=github-releases depName=prometheus-operator/prometheus-operator
-appVersion: v0.90.0
+appVersion: v0.89.0

clusters/cl01tl/helm/qbittorrent/templates/external-secret.yaml

@@ -16,30 +16,23 @@ spec:
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /airvpn/conf/cl01tl
+        key: /protonvpn/conf/cl01tl
         metadataPolicy: None
         property: private-key
-    - secretKey: preshared-key
+    - secretKey: proton-email
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /airvpn/conf/cl01tl
+        key: /protonvpn/conf/cl01tl
         metadataPolicy: None
-        property: preshared-key
-    - secretKey: addresses
+        property: email
+    - secretKey: proton-password
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /airvpn/conf/cl01tl
+        key: /protonvpn/conf/cl01tl
         metadataPolicy: None
-        property: addresses
-    - secretKey: input-ports
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /airvpn/conf/cl01tl
-        metadataPolicy: None
-        property: input-ports
+        property: password
 
 ---
 apiVersion: external-secrets.io/v1

clusters/cl01tl/helm/qbittorrent/values.yaml

@@ -56,7 +56,7 @@ qbittorrent:
                 command: ["/bin/sh", "-c", "(ip rule del table 51820; ip -6 rule del table 51820) || true"]
           env:
             - name: VPN_SERVICE_PROVIDER
-              value: airvpn
+              value: protonvpn
             - name: VPN_TYPE
               value: wireguard
             - name: WIREGUARD_PRIVATE_KEY
@@ -64,29 +64,28 @@ qbittorrent:
                 secretKeyRef:
                   name: qbittorrent-wireguard-conf
                   key: private-key
-            - name: WIREGUARD_PRESHARED_KEY
+            - name: UPDATER_PROTONVPN_EMAIL
               valueFrom:
                 secretKeyRef:
                   name: qbittorrent-wireguard-conf
-                  key: preshared-key
-            - name: WIREGUARD_ADDRESSES
+                  key: proton-email
+            - name: UPDATER_PROTONVPN_PASSWORD
               valueFrom:
                 secretKeyRef:
                   name: qbittorrent-wireguard-conf
-                  key: addresses
-            - name: FIREWALL_VPN_INPUT_PORTS
-              valueFrom:
-                secretKeyRef:
-                  name: qbittorrent-wireguard-conf
-                  key: input-ports
+                  key: proton-password
+            - name: VPN_PORT_FORWARDING
+              value: "on"
+            - name: VPN_PORT_FORWARDING_UP_COMMAND
+              value: '/bin/sh -c "/gluetun/update.sh {{ printf "{{PORTS}}" }}"'
+            - name: PORT_FORWARD_ONLY
+              value: "on"
             - name: FIREWALL_OUTBOUND_SUBNETS
               value: 192.168.1.0/24,10.244.0.0/16
             - name: FIREWALL_INPUT_PORTS
               value: 8080,9022
             - name: DNS_UPSTREAM_RESOLVER_TYPE
               value: dot
-            - name: BLOCK_MALICIOUS
-              value: "off"
             - name: HTTPPROXY
               value: "off"
             - name: SHADOWSOCKS
@@ -217,7 +216,7 @@ qbittorrent:
         qui:
           image:
             repository: ghcr.io/autobrr/qui
-            tag: v1.15.0
+            tag: v1.14.1
             pullPolicy: IfNotPresent
           env:
             - name: QUI__METRICS_ENABLED

clusters/cl01tl/helm/roundcube/Chart.yaml

@@ -29,4 +29,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/roundcube.png
 # renovate: datasource=github-releases depName=roundcube/roundcubemail
-appVersion: 1.6.14
+appVersion: 1.6.13

clusters/cl01tl/helm/roundcube/values.yaml

@@ -9,7 +9,7 @@ roundcube:
         main:
           image:
             repository: roundcube/roundcubemail
-            tag: 1.6.14-fpm-alpine
+            tag: 1.6.13-fpm-alpine
             pullPolicy: IfNotPresent
           env:
             - name: ROUNDCUBEMAIL_DB_TYPE
@@ -85,7 +85,7 @@ roundcube:
         backup:
           image:
             repository: roundcube/roundcubemail
-            tag: 1.6.14-fpm-alpine
+            tag: 1.6.13-fpm-alpine
             pullPolicy: IfNotPresent
           env:
             - name: ROUNDCUBEMAIL_DB_TYPE

clusters/cl01tl/helm/rybbit/values.yaml

@@ -71,7 +71,7 @@ rybbit:
                   key: mapbox-token
           probes:
             liveness:
-              enabled: false
+              enabled: true
               custom: true
               spec:
                 exec:
@@ -122,7 +122,7 @@ rybbit:
         main:
           image:
             repository: clickhouse/clickhouse-server
-            tag: 26.2.5
+            tag: 26.2.4
             pullPolicy: IfNotPresent
           env:
             - name: CLICKHOUSE_DB