chore(deps): update secrets-store-csi-driver to v1.6.0

2026-05-01 23:16:14 +00:00
107 changed files with 945 additions and 179 deletions
--- a/.gitea/workflows/renovate.yaml
+++ b/.gitea/workflows/renovate.yaml
@@ -13,7 +13,7 @@ on:
 jobs:
  renovate:
    runs-on: ubuntu-js
-    container: ghcr.io/renovatebot/renovate:43.160.6@sha256:ef4afabbfdbddce68c26c843d73f98f65e19e8aabd6c22bee7aa7af5f914a43c
+    container: ghcr.io/renovatebot/renovate:43.160.0@sha256:28d6d66ffe2f4fd86bb29c9e9b5cae7215ada90b17605a45e35fa8d4a73159ac
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
--- a/clusters/cl01tl/helm/argocd/Chart.lock
+++ b/clusters/cl01tl/helm/argocd/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
  repository: https://argoproj.github.io/argo-helm
-  version: 9.5.11
-digest: sha256:78e2094dde7b3d0326da14640dbc012ce6e6e899f23270dc4d9a13b168c1ef89
-generated: "2026-05-02T00:45:16.287556363Z"
+  version: 9.5.7
+digest: sha256:dbcf095f232a6cf0220da84ad443e06bf7d97f02bdea6b2676fb4370f6795e45
+generated: "2026-05-01T22:03:46.988114493Z"
--- a/clusters/cl01tl/helm/argocd/Chart.yaml
+++ b/clusters/cl01tl/helm/argocd/Chart.yaml
@@ -13,8 +13,8 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: argo-cd
-    version: 9.5.11
+    version: 9.5.7
    repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-cd
-appVersion: v3.3.9
+appVersion: v3.3.8
--- a/clusters/cl01tl/helm/argocd/values.yaml
+++ b/clusters/cl01tl/helm/argocd/values.yaml
@@ -103,7 +103,7 @@ argo-cd:
      enabled: true
      image:
        repository: haproxy
-        tag: 3.3.8-alpine@sha256:10690acb357180d5214c6fce59e2cefded6cc72b0f7e3febb323fea95b27e349
+        tag: 3.3.7-alpine@sha256:2afa53c856e4e9fcc7dfb35b807fcb189896d7e62b38d363f9bedea92bce7f9a
      resources:
        requests:
          cpu: 5m
--- a/clusters/cl01tl/helm/audiobookshelf/values.yaml
+++ b/clusters/cl01tl/helm/audiobookshelf/values.yaml
@@ -23,7 +23,7 @@ audiobookshelf:
        apprise-api:
          image:
            repository: ghcr.io/caronc/apprise
-            tag: v1.4.1@sha256:25e0577915c2f06233ae1dce077f05c0fc9ba4f0ea89de5aee18a32b2ee9a75c
+            tag: v1.4.0@sha256:9d97a6b9b42cf6afdf3b5466dbed2a59cd42a4bb777ec6aa57b5f2ee623569eb
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/authentik/Chart.lock
+++ b/clusters/cl01tl/helm/authentik/Chart.lock
@@ -10,6 +10,6 @@ dependencies:
  version: 7.12.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
-digest: sha256:808a2347fadb6a48800c0f7355c422c9ed2ce9f7d1ca3b7d64d62574be98e1f8
-generated: "2026-05-02T01:46:08.112423002Z"
+  version: 0.6.1
+digest: sha256:d1dbca83e5b63a58a9bf9f2903d1b45bbadca3e8599541367bc61ef2ce938cdb
+generated: "2026-04-24T21:50:21.398658595Z"
--- a/clusters/cl01tl/helm/authentik/Chart.yaml
+++ b/clusters/cl01tl/helm/authentik/Chart.yaml
@@ -29,7 +29,7 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey
-    version: 0.7.0
+    version: 0.6.1
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/authentik.png
 # renovate: datasource=github-releases depName=goauthentik/authentik
--- a/clusters/cl01tl/helm/blocky/Chart.lock
+++ b/clusters/cl01tl/helm/blocky/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 4.6.2
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
-digest: sha256:855928ecd442b96a98bbeb9f957951cb70a8ab07e3c45ffd2ab33dcd5bf85a18
-generated: "2026-05-02T01:46:25.970760734Z"
+  version: 0.6.1
+digest: sha256:6ed3a7587906fbda581d0091ff2c29a1816b8b0b8ae40add9885e6a68b2b82ae
+generated: "2026-04-13T20:32:34.844998902Z"
--- a/clusters/cl01tl/helm/blocky/Chart.yaml
+++ b/clusters/cl01tl/helm/blocky/Chart.yaml
@@ -20,7 +20,7 @@ dependencies:
    version: 4.6.2
  - name: valkey
    alias: valkey
-    version: 0.7.0
+    version: 0.6.1
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/blocky.png
 # renovate: datasource=github-releases depName=0xerr0r/blocky
--- a/clusters/cl01tl/helm/blocky/values.yaml
+++ b/clusters/cl01tl/helm/blocky/values.yaml
@@ -134,7 +134,7 @@ blocky:
              komodo                          IN      CNAME   traefik-cl01tl
              languagetool                    IN      CNAME   traefik-cl01tl
              lidarr                          IN      CNAME   traefik-cl01tl
-              loki                            IN      CNAME   traefik-cl01tl
+              mail                            IN      CNAME   traefik-cl01tl
              medialyze                       IN      CNAME   traefik-cl01tl
              music-grabber                   IN      CNAME   traefik-cl01tl
              navidrome                       IN      CNAME   traefik-cl01tl
@@ -162,6 +162,7 @@ blocky:
              sonarr-4k                       IN      CNAME   traefik-cl01tl
              sonarr-anime                    IN      CNAME   traefik-cl01tl
              sparkyfitness                   IN      CNAME   traefik-cl01tl
+              stalwart                        IN      CNAME   traefik-cl01tl
              tdarr                           IN      CNAME   traefik-cl01tl
              tubearchivist                   IN      CNAME   traefik-cl01tl
              vault                           IN      CNAME   traefik-cl01tl
--- a/clusters/cl01tl/helm/cloudnative-pg/Chart.lock
+++ b/clusters/cl01tl/helm/cloudnative-pg/Chart.lock
@@ -7,9 +7,9 @@ dependencies:
  version: 0.6.0
 - name: rclone-bucket
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
+  version: 0.4.3
 - name: rclone-bucket
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-digest: sha256:5db4d27087f8a712e7825dc2aac1dc26b6b4e0f9eb11373805be67212bb38e12
-generated: "2026-05-02T01:21:57.977371366Z"
+  version: 0.4.3
+digest: sha256:75d7078b7009082521a1bb8b49141e20b442343dabe7f76f5e7a16a352cfe205
+generated: "2026-04-26T15:36:31.678086-05:00"
--- a/clusters/cl01tl/helm/cloudnative-pg/Chart.yaml
+++ b/clusters/cl01tl/helm/cloudnative-pg/Chart.yaml
@@ -26,11 +26,11 @@ dependencies:
  - name: rclone-bucket
    alias: rclone-postgres-backups-remote
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.5.0
+    version: 0.4.3
  - name: rclone-bucket
    alias: rclone-postgres-backups-external
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.5.0
+    version: 0.4.3
 icon: https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg.github.io/refs/heads/main/assets/images/hero_image.png
 # renovate: datasource=github-releases depName=cloudnative-pg/cloudnative-pg
 appVersion: 1.29.0
--- a/clusters/cl01tl/helm/coredns/values.yaml
+++ b/clusters/cl01tl/helm/coredns/values.yaml
@@ -1,7 +1,7 @@
 coredns:
  image:
-    repository: coredns/coredns
-    tag: v1.14.3@sha256:b21d26b915e10acb5bc78715c1e8b6047ab2675389b2bcc18b3a6499d90e74c0
+    repository: registry.k8s.io/coredns/coredns
+    tag: v1.14.2@sha256:e7e6440cfd1e919280958f5b5a6ab2b184d385bba774c12ad2a9e1e4183f90d9
  replicaCount: 3
  resources:
    limits:
--- a/clusters/cl01tl/helm/dawarich/Chart.lock
+++ b/clusters/cl01tl/helm/dawarich/Chart.lock
@@ -7,7 +7,7 @@ dependencies:
  version: 7.12.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
+  version: 0.6.1
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 1.1.1
@@ -17,5 +17,5 @@ dependencies:
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 1.1.1
-digest: sha256:3cd2af21091719533fb337241480c613ab14b3cb5820af6e386936ddf4243c14
-generated: "2026-05-02T01:46:38.13080627Z"
+digest: sha256:b18a6f20fd00a3477ef296e9a72256f2d6d50fc7710f577f89c06c18f990b6ef
+generated: "2026-04-28T23:31:26.580250793Z"
--- a/clusters/cl01tl/helm/dawarich/Chart.yaml
+++ b/clusters/cl01tl/helm/dawarich/Chart.yaml
@@ -26,7 +26,7 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey
-    version: 0.7.0
+    version: 0.6.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-storage
@@ -42,4 +42,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/dawarich.png
 # renovate: datasource=github-releases depName=Freika/dawarich
-appVersion: 1.7.3
+appVersion: 1.7.1
--- a/clusters/cl01tl/helm/dawarich/values.yaml
+++ b/clusters/cl01tl/helm/dawarich/values.yaml
@@ -8,7 +8,7 @@ dawarich:
        main:
          image:
            repository: freikin/dawarich
-            tag: 1.7.3@sha256:519ea4152381a3f58ae42859f530f5a433073e3f48f196fac3533432642b72b2
+            tag: 1.7.1@sha256:20e2fc135c3724de2a8b447ffc2b062c2ad2b3c631f909efdf132108bb6c14e4
          command:
            - "web-entrypoint.sh"
          args:
@@ -126,7 +126,7 @@ dawarich:
        sidekiq:
          image:
            repository: freikin/dawarich
-            tag: 1.7.3@sha256:519ea4152381a3f58ae42859f530f5a433073e3f48f196fac3533432642b72b2
+            tag: 1.7.1@sha256:20e2fc135c3724de2a8b447ffc2b062c2ad2b3c631f909efdf132108bb6c14e4
          command:
            - "sidekiq-entrypoint.sh"
          args:
--- a/clusters/cl01tl/helm/directus/Chart.lock
+++ b/clusters/cl01tl/helm/directus/Chart.lock
@@ -7,9 +7,9 @@ dependencies:
  version: 7.12.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
+  version: 0.6.1
 - name: rclone-bucket
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-digest: sha256:0545b7862144935e861641090f24e1cfb43ba73da7bcbca5013fae6e002e2daa
-generated: "2026-05-02T01:46:52.095684422Z"
+  version: 0.4.3
+digest: sha256:df3b79c6b8868d749d98d232741fef4a26b73894bce3bf4588581340c15fc3da
+generated: "2026-04-26T21:06:27.85398357Z"
--- a/clusters/cl01tl/helm/directus/Chart.yaml
+++ b/clusters/cl01tl/helm/directus/Chart.yaml
@@ -26,12 +26,12 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey
-    version: 0.7.0
+    version: 0.6.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: rclone-bucket
    alias: rclone-directus-assets-remote
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.5.0
+    version: 0.4.3
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/directus.png
 # renovate: datasource=github-releases depName=directus/directus
 appVersion: 11.17.4
--- a/clusters/cl01tl/helm/directus/values.yaml
+++ b/clusters/cl01tl/helm/directus/values.yaml
@@ -210,6 +210,10 @@ valkey:
      aclUsers:
        default:
          permissions: "~* &* +@all"
+    # No option to configure metrics when auth is enabled
+    # https://github.com/valkey-io/valkey-helm/issues/135
+    metrics:
+      enabled: false
 rclone-directus-assets-remote:
  cronJob:
    suspend: false
--- a/clusters/cl01tl/helm/elastic-operator/values.yaml
+++ b/clusters/cl01tl/helm/elastic-operator/values.yaml
@@ -1,5 +1,6 @@
 eck-operator:
  managedNamespaces:
+    - stalwart
    - tubearchivist
  installCRDs: true
  replicaCount: 2
--- a/clusters/cl01tl/helm/element-web/Chart.lock
+++ b/clusters/cl01tl/helm/element-web/Chart.lock
@@ -1,9 +1,9 @@
 dependencies:
 - name: element-web
  repository: https://ananace.gitlab.io/charts
-  version: 1.4.36
+  version: 1.4.34
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 2.6.0
-digest: sha256:36b3f340ee46f20961fdaac41724528c6c3d4b34bf26d97779da7e33087250a1
-generated: "2026-05-03T00:56:23.054212477Z"
+digest: sha256:e988be9f997351a8f658bf5151ec4fb04ae7d877389c9bf01b7331e1a58005ef
+generated: "2026-04-24T21:06:15.882448748Z"
--- a/clusters/cl01tl/helm/element-web/Chart.yaml
+++ b/clusters/cl01tl/helm/element-web/Chart.yaml
@@ -15,11 +15,11 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: element-web
-    version: 1.4.36
+    version: 1.4.34
    repository: https://ananace.gitlab.io/charts
  - name: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
    version: 2.6.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/element.png
 # renovate: datasource=github-releases depName=element-hq/element-web
-appVersion: v1.12.17
+appVersion: v1.12.16
--- a/clusters/cl01tl/helm/element-web/values.yaml
+++ b/clusters/cl01tl/helm/element-web/values.yaml
@@ -2,7 +2,7 @@ element-web:
  replicaCount: 1
  image:
    repository: ghcr.io/element-hq/element-web
-    tag: v1.12.17@sha256:f4a81a24d49a9c5b97e02e77a3013ec799873e500e69041078a28be98e4f1280
+    tag: v1.12.16@sha256:8399a9e03c8891d60edc40e3e2dde1ad7a9c90010076324cbe21d2b581ddffb1
  defaultServer:
    url: https://matrix.alexlebens.dev
    name: alexlebens.dev
--- a/clusters/cl01tl/helm/gatus/values.yaml
+++ b/clusters/cl01tl/helm/gatus/values.yaml
@@ -212,6 +212,12 @@ gatus:
      - name: authentik
        url: https://authentik.alexlebens.net
        <<: *defaults
+      - name: roundcube
+        url: https://mail.alexlebens.net
+        <<: *defaults
+      - name: stalwart
+        url: https://stalwart.alexlebens.net
+        <<: *defaults
      - name: ntfy
        url: https://ntfy.alexlebens.net
        <<: *defaults
--- a/clusters/cl01tl/helm/gitea/Chart.lock
+++ b/clusters/cl01tl/helm/gitea/Chart.lock
@@ -16,12 +16,12 @@ dependencies:
  version: 7.12.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
+  version: 0.6.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
+  version: 0.6.1
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 1.1.1
-digest: sha256:511ffcd0b9ab17ff7c9dff6fc72a2ef802a51a14a4f03e416acee40fa0d1f12a
-generated: "2026-05-02T01:47:05.386747243Z"
+digest: sha256:2450851c5a627a962ab7f42c4034c383d9d4c004bfba5b9f585f282340702a73
+generated: "2026-04-28T23:32:08.412656934Z"
--- a/clusters/cl01tl/helm/gitea/Chart.yaml
+++ b/clusters/cl01tl/helm/gitea/Chart.yaml
@@ -44,11 +44,11 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey-gitea
-    version: 0.7.0
+    version: 0.6.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey-renovate
-    version: 0.7.0
+    version: 0.6.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-storage
--- a/clusters/cl01tl/helm/grafana-operator/Chart.lock
+++ b/clusters/cl01tl/helm/grafana-operator/Chart.lock
@@ -7,9 +7,9 @@ dependencies:
  version: 7.12.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
+  version: 0.6.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
-digest: sha256:1abbac7c3dd999e08b60bc86d45bf4d5740c02a078d4ee7145c5379c274e93d3
-generated: "2026-05-02T01:47:25.480915936Z"
+  version: 0.6.1
+digest: sha256:fffa0806096edeb2b6a6ceead50427544ef3880a3d135afb4a9c7570d05b2042
+generated: "2026-04-24T21:52:27.743114014Z"
--- a/clusters/cl01tl/helm/grafana-operator/Chart.yaml
+++ b/clusters/cl01tl/helm/grafana-operator/Chart.yaml
@@ -24,11 +24,11 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey-unified-alerting
-    version: 0.7.0
+    version: 0.6.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey-remote-cache
-    version: 0.7.0
+    version: 0.6.1
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grafana.png
 # renovate: datasource=github-releases depName=grafana/grafana-operator
--- a/clusters/cl01tl/helm/grimmory/Chart.yaml
+++ b/clusters/cl01tl/helm/grimmory/Chart.yaml
@@ -28,4 +28,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grimmory.png
 # renovate: datasource=github-releases depName=grimmory-tools/grimmory
-appVersion: v3.0.3
+appVersion: v3.0.2
--- a/clusters/cl01tl/helm/grimmory/values.yaml
+++ b/clusters/cl01tl/helm/grimmory/values.yaml
@@ -12,7 +12,7 @@ grimmory:
        main:
          image:
            repository: ghcr.io/grimmory-tools/grimmory
-            tag: v3.0.3@sha256:a903a2b44c308bd1738b6f7cdb5a2e5a2a1ae23a092f30eb68581e2be1af50cd
+            tag: v3.0.2@sha256:4557a78321add7d70bef7c0b89c2617c8c023246ae39698bc2cbe636f8c97f9b
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/harbor/Chart.lock
+++ b/clusters/cl01tl/helm/harbor/Chart.lock
@@ -7,6 +7,6 @@ dependencies:
  version: 7.12.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
-digest: sha256:8ce1125e688aa0f2da0f9f11157b8bab9bbc11aa82d16ed8e7c5141dccb508fd
-generated: "2026-05-02T01:47:39.632625858Z"
+  version: 0.6.1
+digest: sha256:b1f69102ef2b48dc219b41a6f92ab26d3fda803877948b3288a3c5ebc8e69d86
+generated: "2026-04-24T21:52:56.225496919Z"
--- a/clusters/cl01tl/helm/harbor/Chart.yaml
+++ b/clusters/cl01tl/helm/harbor/Chart.yaml
@@ -24,7 +24,7 @@ dependencies:
    repository: https://gitea.alexlebens.net/api/packages/alexlebens/helm
  - name: valkey
    alias: valkey
-    version: 0.7.0
+    version: 0.6.1
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/harbor.png
 # renovate: datasource=github-releases depName=goharbor/harbor
--- a/clusters/cl01tl/helm/homepage/values.yaml
+++ b/clusters/cl01tl/helm/homepage/values.yaml
@@ -487,6 +487,24 @@ homepage:
                  href: https://authentik.alexlebens.net
                  siteMonitor: http://authentik-server.authentik:80
                  statusStyle: dot
+              - Email Client:
+                  icon: sh-roundcube.webp
+                  description: Roundcube
+                  href: https://mail.alexlebens.net
+                  siteMonitor: http://roundcube.roundcube:80
+                  statusStyle: dot
+              - Email Server:
+                  icon: sh-stalwart.webp
+                  description: Stalwart
+                  href: https://stalwart.alexlebens.net
+                  siteMonitor: http://stalwart.stalwart:80
+                  statusStyle: dot
+                  namespace: stalwart
+                  app: stalwart
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          stalwart
+                      )
              - Notifications:
                  icon: sh-ntfy.webp
                  description: ntfy
--- a/clusters/cl01tl/helm/immich/Chart.lock
+++ b/clusters/cl01tl/helm/immich/Chart.lock
@@ -7,9 +7,9 @@ dependencies:
  version: 7.12.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
+  version: 0.6.1
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 1.1.1
-digest: sha256:a0fdf72de4f4e2a475035e6ece26fe570e548895db02374a08fd4f3481c55dc0
-generated: "2026-05-02T01:47:54.093954603Z"
+digest: sha256:1c0a8a4209c11fbdc520b8a08d4a73f77116bc3daa42981f2a95a5336679247f
+generated: "2026-04-28T23:32:54.822466546Z"
--- a/clusters/cl01tl/helm/immich/Chart.yaml
+++ b/clusters/cl01tl/helm/immich/Chart.yaml
@@ -25,7 +25,7 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey
-    version: 0.7.0
+    version: 0.6.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-data
--- a/clusters/cl01tl/helm/karakeep/Chart.lock
+++ b/clusters/cl01tl/helm/karakeep/Chart.lock
@@ -13,6 +13,6 @@ dependencies:
  version: 1.1.1
 - name: rclone-bucket
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-digest: sha256:399d686a6186e665a804f98a3dca1132d028f6cb9fc458866ec94b09920dbb6f
-generated: "2026-05-02T01:23:08.040832303Z"
+  version: 0.4.3
+digest: sha256:85450973a07f19c63e3d91b72534de8504b6768b6514cedb625129c9366c2b3e
+generated: "2026-04-28T23:33:29.533736389Z"
--- a/clusters/cl01tl/helm/karakeep/Chart.yaml
+++ b/clusters/cl01tl/helm/karakeep/Chart.yaml
@@ -36,7 +36,7 @@ dependencies:
  - name: rclone-bucket
    alias: rclone-karakeep-assets-remote
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.5.0
+    version: 0.4.3
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/karakeep.png
 # renovate: datasource=github-releases depName=karakeep-app/karakeep
 appVersion: 0.31.0
--- a/clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock
@@ -10,6 +10,6 @@ dependencies:
  version: 4.6.2
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
-digest: sha256:902e19ae8e5818d1ac4c30f804e616e8428b927358e4823ef6e373fdf655cba1
-generated: "2026-05-02T01:48:08.598425992Z"
+  version: 0.6.1
+digest: sha256:14075e91f57dd8827bb615a6531c52f419c4f25f6c1ed9ed1c19d113ac7e34e7
+generated: "2026-05-01T18:04:06.66754682Z"
--- a/clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml
@@ -31,7 +31,7 @@ dependencies:
    version: 4.6.2
  - name: valkey
    alias: valkey
-    version: 0.7.0
+    version: 0.6.1
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prometheus.png
 # renovate: datasource=github-releases depName=prometheus-operator/prometheus-operator
--- a/clusters/cl01tl/helm/libation/Chart.yaml
+++ b/clusters/cl01tl/helm/libation/Chart.yaml
@@ -26,4 +26,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/libation.png
 # renovate: datasource=github-releases depName=rmcrackan/Libation
-appVersion: 13.3.6
+appVersion: 13.3.5
--- a/clusters/cl01tl/helm/libation/values.yaml
+++ b/clusters/cl01tl/helm/libation/values.yaml
@@ -12,7 +12,7 @@ libation:
        main:
          image:
            repository: rmcrackan/libation
-            tag: 13.3.6@sha256:54695675b9e838b7448c99f7fa03f5c34e0e35c7d7c82c44663959888be9c1b6
+            tag: 13.3.5@sha256:fcfeaa406a3567e3de89d85bf761d17868029c6e8a127922672770cb812b9be8
          env:
            - name: SLEEP_TIME
              value: "-1"
--- a/clusters/cl01tl/helm/loki/Chart.lock
+++ b/clusters/cl01tl/helm/loki/Chart.lock
@@ -1,9 +1,9 @@
 dependencies:
 - name: loki
-  repository: oci://ghcr.io/grafana-community/helm-charts
-  version: 13.5.0
+  repository: https://grafana.github.io/helm-charts
+  version: 6.55.0
 - name: alloy
  repository: https://grafana.github.io/helm-charts
  version: 1.8.0
-digest: sha256:bef475f5b6770e4b582b4499e38417789b2bb59ce0ee93c0390daef780e5728d
-generated: "2026-05-02T19:36:44.416322-05:00"
+digest: sha256:e3c7508c21ed7737f692387ca79a0c001c3393edbedff7b05c60325469a4fb2b
+generated: "2026-04-24T17:01:55.023153925Z"
--- a/clusters/cl01tl/helm/loki/Chart.yaml
+++ b/clusters/cl01tl/helm/loki/Chart.yaml
@@ -9,14 +9,14 @@ home: https://docs.alexlebens.dev/applications/loki/
 sources:
  - https://github.com/grafana/loki
  - https://github.com/grafana/alloy
-  - https://github.com/grafana-community/helm-charts/tree/main/charts/loki
+  - https://github.com/grafana/loki/tree/main/production/helm/loki
  - https://github.com/grafana/alloy/tree/main/operations/helm/charts/alloy
 maintainers:
  - name: alexlebens
 dependencies:
  - name: loki
-    version: 13.5.0
-    repository: oci://ghcr.io/grafana-community/helm-charts
+    version: 6.55.0
+    repository: https://grafana.github.io/helm-charts
  - name: alloy
    version: 1.8.0
    repository: https://grafana.github.io/helm-charts
--- a/clusters/cl01tl/helm/loki/values.yaml
+++ b/clusters/cl01tl/helm/loki/values.yaml
@@ -1,5 +1,5 @@
 loki:
-  deploymentMode: Monolithic
+  deploymentMode: SingleBinary
  loki:
    auth_enabled: false
    limits_config:
@@ -31,6 +31,8 @@ loki:
      pool_config:
        remote_timeout: 10s
      remote_timeout: 10s
+  enterprise:
+    enabled: false
  gateway:
    enabled: true
    resources:
@@ -39,18 +41,6 @@ loki:
        memory: 20Mi
    basicAuth:
      enabled: false
-    route:
-      main:
-        enabled: true
-        apiVersion: gateway.networking.k8s.io/v1
-        kind: HTTPRoute
-        hostnames:
-          - loki.alexlebens.net
-        parentRefs:
-          - group: gateway.networking.k8s.io
-            kind: Gateway
-            name: traefik-gateway
-            namespace: traefik
  singleBinary:
    replicas: 1
    resources:
@@ -58,16 +48,14 @@ loki:
        cpu: 100m
        memory: 800Mi
    persistence:
+      enabled: true
      size: 150Gi
      storageClass: synology-iscsi-delete
  write:
-    enabled: false
    replicas: 0
  read:
-    enabled: false
    replicas: 0
  backend:
-    enabled: false
    replicas: 0
 alloy:
  crds:
--- a/clusters/cl01tl/helm/mariadb-operator/values.yaml
+++ b/clusters/cl01tl/helm/mariadb-operator/values.yaml
@@ -2,8 +2,7 @@ mariadb-operator:
  crds:
    enabled: false
  ha:
-    enabled: false
-    replicas: 1
+    enabled: true
  metrics:
    enabled: true
  pdb:
--- a/clusters/cl01tl/helm/matrix-synapse/Chart.lock
+++ b/clusters/cl01tl/helm/matrix-synapse/Chart.lock
@@ -1,7 +1,7 @@
 dependencies:
 - name: matrix-synapse
  repository: https://ananace.gitlab.io/charts
-  version: 3.12.26
+  version: 3.12.25
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.6.2
@@ -22,10 +22,10 @@ dependencies:
  version: 7.12.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
+  version: 0.6.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
+  version: 0.6.1
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 1.1.1
@@ -38,5 +38,5 @@ dependencies:
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 1.1.1
-digest: sha256:4377d9ff96042ba996b879caf6108260d2eb9d20bccdb26ae7042d96d2772012
-generated: "2026-05-03T01:00:09.899197368Z"
+digest: sha256:4ab0a2e6d69be08294675d43bce29b9222864f42fa9686bdabec40e74fa9ca2c
+generated: "2026-04-28T23:34:25.05408586Z"
--- a/clusters/cl01tl/helm/matrix-synapse/Chart.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/Chart.yaml
@@ -26,7 +26,7 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: matrix-synapse
-    version: 3.12.26
+    version: 3.12.25
    repository: https://ananace.gitlab.io/charts
  - name: app-template
    alias: matrix-hookshot
@@ -54,11 +54,11 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey-matrix-synapse
-    version: 0.7.0
+    version: 0.6.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey-hookshot
-    version: 0.7.0
+    version: 0.6.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-synapse
--- a/clusters/cl01tl/helm/matrix-synapse/values.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/values.yaml
@@ -445,6 +445,10 @@ valkey-matrix-synapse:
      aclUsers:
        default:
          permissions: "~* &* +@all"
+    # No option to configure metrics when auth is enabled
+    # https://github.com/valkey-io/valkey-helm/issues/135
+    metrics:
+      enabled: false
 valkey-hookshot:
  valkey:
    nameOverride: valkey-hookshot
--- a/clusters/cl01tl/helm/music-grabber/Chart.yaml
+++ b/clusters/cl01tl/helm/music-grabber/Chart.yaml
@@ -24,4 +24,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/music-grabber.png
 # renovate: datasource=docker depName=g33kphr33k/musicgrabber
-appVersion: 2.8.1
+appVersion: 2.8.0
--- a/clusters/cl01tl/helm/music-grabber/values.yaml
+++ b/clusters/cl01tl/helm/music-grabber/values.yaml
@@ -12,7 +12,7 @@ music-grabber:
        main:
          image:
            repository: g33kphr33k/musicgrabber
-            tag: 2.8.1@sha256:b0946724ca54944c239bceddd445bc78f91cfc0d439379c4f063d3819e7b47d3
+            tag: 2.8.0@sha256:39f9a9b783320bfb11805e62ec4990dac038b221a2730f06e81f9fff38875f26
          env:
            - name: MUSIC_DIR
              value: /mnt/store/Music Grabber/
--- a/clusters/cl01tl/helm/ntfy/Chart.lock
+++ b/clusters/cl01tl/helm/ntfy/Chart.lock
@@ -7,6 +7,6 @@ dependencies:
  version: 7.12.1
 - name: rclone-bucket
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-digest: sha256:7defcecc03024b82d4f1e19b39f0fbe1725b1077e72e1664326ffa0e40e4f27f
-generated: "2026-05-02T01:23:52.599948616Z"
+  version: 0.4.3
+digest: sha256:97ce7f765707305cb7ccf7020c3a0945a19cda7d7d54cb75ff341acdbf000a23
+generated: "2026-04-26T21:07:46.221034664Z"
--- a/clusters/cl01tl/helm/ntfy/Chart.yaml
+++ b/clusters/cl01tl/helm/ntfy/Chart.yaml
@@ -25,7 +25,7 @@ dependencies:
  - name: rclone-bucket
    alias: rclone-ntfy-attachments-remote
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.5.0
+    version: 0.4.3
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ntfy.png
 # renovate: datasource=github-releases depName=binwiederhier/ntfy
 appVersion: 2.22.0
--- a/clusters/cl01tl/helm/ollama/values.yaml
+++ b/clusters/cl01tl/helm/ollama/values.yaml
@@ -21,7 +21,7 @@ ollama:
        main:
          image:
            repository: ollama/ollama
-            tag: 0.23.0@sha256:5600a652d1081050f398152127c584222546354491f27fe47ccbc6351bc870bd
+            tag: 0.22.0@sha256:05ab093b257a54318fba39293f1640d53b507d1edec8fa6ca2d3e1817c02e53b
          env:
            - name: OLLAMA_KEEP_ALIVE
              value: 24h
@@ -55,7 +55,7 @@ ollama:
        main:
          image:
            repository: ollama/ollama
-            tag: 0.23.0@sha256:5600a652d1081050f398152127c584222546354491f27fe47ccbc6351bc870bd
+            tag: 0.22.0@sha256:05ab093b257a54318fba39293f1640d53b507d1edec8fa6ca2d3e1817c02e53b
          env:
            - name: OLLAMA_KEEP_ALIVE
              value: 24h
@@ -89,7 +89,7 @@ ollama:
        main:
          image:
            repository: ollama/ollama
-            tag: 0.23.0@sha256:5600a652d1081050f398152127c584222546354491f27fe47ccbc6351bc870bd
+            tag: 0.22.0@sha256:05ab093b257a54318fba39293f1640d53b507d1edec8fa6ca2d3e1817c02e53b
          env:
            - name: OLLAMA_KEEP_ALIVE
              value: 24h
--- a/clusters/cl01tl/helm/openbao/Chart.lock
+++ b/clusters/cl01tl/helm/openbao/Chart.lock
@@ -7,9 +7,9 @@ dependencies:
  version: 4.6.2
 - name: rclone-bucket
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
+  version: 0.4.3
 - name: rclone-bucket
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-digest: sha256:ba842213ae2aad9eb8311f9316f21597f8b595a86d0fb3f579d61dd400782a0d
-generated: "2026-05-02T01:24:36.047963846Z"
+  version: 0.4.3
+digest: sha256:cbb61cd27ce6f613cd0fb07a3b9d380008732ed9e933eed45eda2d7e379fe279
+generated: "2026-04-26T21:08:16.543052937Z"
--- a/clusters/cl01tl/helm/openbao/Chart.yaml
+++ b/clusters/cl01tl/helm/openbao/Chart.yaml
@@ -29,11 +29,11 @@ dependencies:
  - name: rclone-bucket
    alias: rclone-openbao-backups-remote
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.5.0
+    version: 0.4.3
  - name: rclone-bucket
    alias: rclone-openbao-backups-external
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.5.0
+    version: 0.4.3
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/openbao.png
 # renovate: datasource=github-releases depName=openbao/openbao
 appVersion: v2.5.3
--- a/clusters/cl01tl/helm/outline/Chart.lock
+++ b/clusters/cl01tl/helm/outline/Chart.lock
@@ -10,9 +10,9 @@ dependencies:
  version: 7.12.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
+  version: 0.6.1
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 1.1.1
-digest: sha256:19b61d32c5880ff75ea8a448e457478f265aad30b1429e1ef98f7ce81061c33a
-generated: "2026-05-02T01:48:38.163770954Z"
+digest: sha256:10eedaddab28265089eb9e3ac4696a035f315f2bff4180677064e9bdc1e6a509
+generated: "2026-04-28T23:35:18.266951842Z"
--- a/clusters/cl01tl/helm/outline/Chart.yaml
+++ b/clusters/cl01tl/helm/outline/Chart.yaml
@@ -30,7 +30,7 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey
-    version: 0.7.0
+    version: 0.6.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-data
--- a/clusters/cl01tl/helm/paperless-ngx/Chart.lock
+++ b/clusters/cl01tl/helm/paperless-ngx/Chart.lock
@@ -7,7 +7,7 @@ dependencies:
  version: 7.12.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
+  version: 0.6.1
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 1.1.1
@@ -20,5 +20,5 @@ dependencies:
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 1.1.1
-digest: sha256:3f1a8d707092db66baa608a9b8bde91b0972e25e34d42d268919576acce9e79f
-generated: "2026-05-02T01:48:51.56053895Z"
+digest: sha256:0aa4c48e3d5bf86dbde8a8797f39b4443e2774791f9990514a234a0ef6eb8d90
+generated: "2026-04-28T23:35:29.066158571Z"
--- a/clusters/cl01tl/helm/paperless-ngx/Chart.yaml
+++ b/clusters/cl01tl/helm/paperless-ngx/Chart.yaml
@@ -28,7 +28,7 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey
-    version: 0.7.0
+    version: 0.6.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-data
--- a/clusters/cl01tl/helm/postiz/Chart.lock
+++ b/clusters/cl01tl/helm/postiz/Chart.lock
@@ -13,12 +13,12 @@ dependencies:
  version: 7.12.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
+  version: 0.6.1
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 1.1.1
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 1.1.1
-digest: sha256:44a89d0e616240e5d57be216bb9a8d92f5c0498cc3a9660cf25b8634d0269a62
-generated: "2026-05-02T01:49:06.238514311Z"
+digest: sha256:c7075d5427d865320269e04b7a88ae4ac589c8e9c86d2f482719bf85e03c4848
+generated: "2026-05-01T01:41:33.938608277Z"
--- a/clusters/cl01tl/helm/postiz/Chart.yaml
+++ b/clusters/cl01tl/helm/postiz/Chart.yaml
@@ -39,7 +39,7 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey
-    version: 0.7.0
+    version: 0.6.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-config
--- a/clusters/cl01tl/helm/postiz/values.yaml
+++ b/clusters/cl01tl/helm/postiz/values.yaml
@@ -273,6 +273,10 @@ valkey:
      aclUsers:
        default:
          permissions: "~* &* +@all"
+    # No option to configure metrics when auth is enabled
+    # https://github.com/valkey-io/valkey-helm/issues/135
+    metrics:
+      enabled: false
 volsync-target-config:
  pvcTarget: postiz-config
  local:
--- a/clusters/cl01tl/helm/prowlarr/Chart.yaml
+++ b/clusters/cl01tl/helm/prowlarr/Chart.yaml
@@ -28,4 +28,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prowlarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-prowlarr
-appVersion: 2.3.5.5327-ls144
+appVersion: 2.3.5.5327-ls143
--- a/clusters/cl01tl/helm/prowlarr/values.yaml
+++ b/clusters/cl01tl/helm/prowlarr/values.yaml
@@ -12,7 +12,7 @@ prowlarr:
        main:
          image:
            repository: ghcr.io/linuxserver/prowlarr
-            tag: 2.3.5.5327-ls144@sha256:b4204e18666179472225935b443a99cf6c66dcb7bbc2d35034427a3851f13135
+            tag: 2.3.5.5327-ls143@sha256:c5de2a8758a05594319263e7691c1dce56899442ed1720d6eca216c0958f4caf
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/qbittorrent/values.yaml
+++ b/clusters/cl01tl/helm/qbittorrent/values.yaml
@@ -168,7 +168,7 @@ qbittorrent:
        apprise-api:
          image:
            repository: ghcr.io/caronc/apprise
-            tag: v1.4.1@sha256:25e0577915c2f06233ae1dce077f05c0fc9ba4f0ea89de5aee18a32b2ee9a75c
+            tag: v1.4.0@sha256:9d97a6b9b42cf6afdf3b5466dbed2a59cd42a4bb777ec6aa57b5f2ee623569eb
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/rclone/Chart.lock
+++ b/clusters/cl01tl/helm/rclone/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: rclone-bucket
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-digest: sha256:3b046c434d4913304077d8b5f72552f604ea0c0704c1f267981798508a5ef497
-generated: "2026-05-02T01:25:18.948375366Z"
+  version: 0.4.3
+digest: sha256:7203c46d1617837cfaad5fc500277ff1ed8d5e310b3af65500f3fbbd3166abd6
+generated: "2026-04-26T21:08:47.555855644Z"
--- a/clusters/cl01tl/helm/rclone/Chart.yaml
+++ b/clusters/cl01tl/helm/rclone/Chart.yaml
@@ -16,7 +16,7 @@ dependencies:
  - name: rclone-bucket
    alias: rclone-web-assets-remote
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.5.0
+    version: 0.4.3
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/rclone.png
 # renovate: datasource=github-releases depName=rclone/rclone
-appVersion: v1.74.0
+appVersion: v1.73.5
--- a/clusters/cl01tl/helm/rclone/values.yaml
+++ b/clusters/cl01tl/helm/rclone/values.yaml
@@ -12,7 +12,7 @@ rclone:
        sync:
          image:
            repository: rclone/rclone
-            tag: 1.74.0@sha256:d2e0e88359d0b2e67cfcd2c43d5405185eb8adfc207079df27c42da82c5207bc
+            tag: 1.73.5@sha256:1619a625f845e169c34b952cf40c483c0392965b821c5155cde8cbfd35254a96
          args:
            - sync
            - src:postgres-backups
@@ -87,7 +87,7 @@ rclone:
        prune:
          image:
            repository: rclone/rclone
-            tag: 1.74.0@sha256:d2e0e88359d0b2e67cfcd2c43d5405185eb8adfc207079df27c42da82c5207bc
+            tag: 1.73.5@sha256:1619a625f845e169c34b952cf40c483c0392965b821c5155cde8cbfd35254a96
          args:
            - delete
            - dest:postgres-backups
--- a/clusters/cl01tl/helm/roundcube/Chart.lock
+++ b/clusters/cl01tl/helm/roundcube/Chart.lock
@@ -0,0 +1,12 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.6.2
+- name: postgres-cluster
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 7.12.1
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 1.1.1
+digest: sha256:6ea0ffea8d47e3c62657f35ce0dda5d5f67aa13c99107dee396787a6e0c3633c
+generated: "2026-04-28T23:36:57.236521514Z"
--- a/clusters/cl01tl/helm/roundcube/Chart.yaml
+++ b/clusters/cl01tl/helm/roundcube/Chart.yaml
@@ -0,0 +1,32 @@
+apiVersion: v2
+name: roundcube
+version: 1.0.0
+description: Roundcube
+keywords:
+  - roundcube
+  - email-client
+home: https://docs.alexlebens.dev/applications/rclone/
+sources:
+  - https://github.com/roundcube/roundcubemail
+  - https://hub.docker.com/r/roundcube/roundcubemail
+  - https://hub.docker.com/_/nginx
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: roundcube
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.6.2
+  - name: postgres-cluster
+    alias: postgres-18-cluster
+    version: 7.12.1
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-data
+    version: 1.1.1
+    repository: oci://harbor.alexlebens.net/helm-charts
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/roundcube.png
+# renovate: datasource=github-releases depName=roundcube/roundcubemail
+appVersion: 1.6.15
--- a/clusters/cl01tl/helm/roundcube/templates/_helpers.tpl
+++ b/clusters/cl01tl/helm/roundcube/templates/_helpers.tpl
@@ -0,0 +1,14 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
--- a/clusters/cl01tl/helm/roundcube/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/roundcube/templates/external-secret.yaml
@@ -0,0 +1,17 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: roundcube-key
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: roundcube-key
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: DES_KEY
+      remoteRef:
+        key: /cl01tl/roundcube/key
+        property: des-key
--- a/clusters/cl01tl/helm/roundcube/values.yaml
+++ b/clusters/cl01tl/helm/roundcube/values.yaml
@@ -0,0 +1,236 @@
+roundcube:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      containers:
+        main:
+          image:
+            repository: roundcube/roundcubemail
+            tag: 1.6.15-fpm-alpine@sha256:0e07c1c66d5a1392f0c47cc79e85e0c60095108f715037d7d0aa3fd8cbe2e780
+          env:
+            - name: ROUNDCUBEMAIL_DB_TYPE
+              value: pgsql
+            - name: ROUNDCUBEMAIL_DB_HOST
+              valueFrom:
+                secretKeyRef:
+                  name: roundcube-postgresql-18-cluster-app
+                  key: host
+            - name: ROUNDCUBEMAIL_DB_NAME
+              valueFrom:
+                secretKeyRef:
+                  name: roundcube-postgresql-18-cluster-app
+                  key: dbname
+            - name: ROUNDCUBEMAIL_DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: roundcube-postgresql-18-cluster-app
+                  key: user
+            - name: ROUNDCUBEMAIL_DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: roundcube-postgresql-18-cluster-app
+                  key: password
+            - name: ROUNDCUBEMAIL_DES_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: roundcube-key
+                  key: DES_KEY
+            - name: ROUNDCUBEMAIL_DEFAULT_HOST
+              value: stalwart.stalwart
+            - name: ROUNDCUBEMAIL_DEFAULT_PORT
+              value: 143
+            - name: ROUNDCUBEMAIL_SMTP_SERVER
+              value: stalwart.stalwart
+            - name: ROUNDCUBEMAIL_SMTP_PORT
+              value: 25
+            - name: ROUNDCUBEMAIL_SKIN
+              value: elastic
+            - name: ROUNDCUBEMAIL_PLUGINS
+              value: archive,zipdownload,newmail_notifier
+          resources:
+            requests:
+              cpu: 1m
+              memory: 40Mi
+        nginx:
+          image:
+            repository: nginx
+            tag: 1.30.0-alpine-slim@sha256:830b40ff1beb5e018e56aef2ed1f9fe87a7797e35a555b75fea5c9568e316b04
+          env:
+            - name: NGINX_HOST
+              value: mail.alexlebens.net
+            - name: NGINX_PHP_CGI
+              value: roundcube.roundcube:9000
+    cleandb:
+      type: cronjob
+      cronjob:
+        suspend: false
+        timeZone: America/Chicago
+        schedule: 30 4 * * *
+        backoffLimit: 3
+        parallelism: 1
+      containers:
+        backup:
+          image:
+            repository: roundcube/roundcubemail
+            tag: 1.6.15-fpm-alpine@sha256:0e07c1c66d5a1392f0c47cc79e85e0c60095108f715037d7d0aa3fd8cbe2e780
+          args:
+            - bin/cleandb.sh
+          env:
+            - name: ROUNDCUBEMAIL_DB_TYPE
+              value: pgsql
+            - name: ROUNDCUBEMAIL_DB_HOST
+              valueFrom:
+                secretKeyRef:
+                  name: roundcube-postgresql-18-cluster-app
+                  key: host
+            - name: ROUNDCUBEMAIL_DB_NAME
+              valueFrom:
+                secretKeyRef:
+                  name: roundcube-postgresql-18-cluster-app
+                  key: dbname
+            - name: ROUNDCUBEMAIL_DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: roundcube-postgresql-18-cluster-app
+                  key: user
+            - name: ROUNDCUBEMAIL_DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: roundcube-postgresql-18-cluster-app
+                  key: password
+            - name: ROUNDCUBEMAIL_DES_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: roundcube-key
+                  key: DES_KEY
+            - name: ROUNDCUBEMAIL_DEFAULT_HOST
+              value: tls://stalwart.stalwart
+            - name: ROUNDCUBEMAIL_SMTP_SERVER
+              value: tls://stalwart.stalwart
+            - name: ROUNDCUBEMAIL_SKIN
+              value: elastic
+            - name: ROUNDCUBEMAIL_PLUGINS
+              value: archive,zipdownload,newmail_notifier
+  configMaps:
+    config:
+      enabled: true
+      data:
+        default.conf: |
+          server {
+              listen 80 default_server;
+              server_name _;
+              root /var/www/html;
+
+              location / {
+                  try_files $uri /index.php$is_args$args;
+              }
+
+              location ~ \.php(/|$) {
+                  try_files $uri =404;
+                  fastcgi_pass roundcube:9000;
+                  fastcgi_read_timeout 300;
+                  proxy_read_timeout 300;
+                  fastcgi_split_path_info ^(.+\.php)(/.*)$;
+                  include fastcgi_params;
+                  fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
+                  fastcgi_param DOCUMENT_ROOT $realpath_root;
+                  internal;
+              }
+
+              client_max_body_size 6m;
+
+              error_log  /var/log/nginx/error.log;
+              access_log /var/log/nginx/access.log;
+          }
+  service:
+    main:
+      controller: main
+      ports:
+        mail:
+          port: 9000
+          targetPort: 9000
+        web:
+          port: 80
+          targetPort: 80
+  route:
+    main:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - mail.alexlebens.net
+      rules:
+        - backendRefs:
+            - name: roundcube
+              port: 80
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+  persistence:
+    config:
+      enabled: true
+      type: configMap
+      name: roundcube-config
+      advancedMounts:
+        main:
+          nginx:
+            - path: /etc/nginx/conf.d/default.conf
+              readOnly: true
+              mountPropagation: None
+              subPath: default.conf
+    data:
+      forceRename: roundcube-data
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 5Gi
+      advancedMounts:
+        main:
+          main:
+            - path: /var/www/html
+              readOnly: false
+          nginx:
+            - path: /var/www/html
+              readOnly: false
+    temp:
+      type: emptyDir
+      advancedMounts:
+        main:
+          main:
+            - path: /tmp/roundcube-temp
+              readOnly: false
+postgres-18-cluster:
+  mode: recovery
+  recovery:
+    method: objectStore
+    objectStore:
+      index: 1
+  backup:
+    objectStore:
+      - name: garage-local
+        index: 1
+        destinationBucket: postgres-backups
+        externalSecretCredentialPath: /garage/home-infra/postgres-backups
+        isWALArchiver: true
+    scheduledBackups:
+      - name: live-backup
+        suspend: false
+        immediate: true
+        schedule: "0 40 15 * * *"
+        backupName: garage-local
+volsync-target-data:
+  pvcTarget: roundcube-data
+  local:
+    enabled: true
+    schedule: 12 11 * * *
+  remote:
+    enabled: true
+    schedule: 12 12 * * *
+  external:
+    enabled: true
+    schedule: 12 13 * * *
--- a/clusters/cl01tl/helm/searxng/values.yaml
+++ b/clusters/cl01tl/helm/searxng/values.yaml
@@ -10,7 +10,7 @@ searxng:
        main:
          image:
            repository: searxng/searxng
-            tag: latest@sha256:b2211b2ad11fc9822ed8d94502a609a862d6587e13f052e18847559586c76b71
+            tag: latest@sha256:90ea6250fe543ccad61fddeb389032073c8362ce7e1a863d9ea6e2d36dc8e1da
          env:
            - name: SEARXNG_BASE_URL
              value: http://searxng-api.searxng:8080
@@ -38,7 +38,7 @@ searxng:
        main:
          image:
            repository: searxng/searxng
-            tag: latest@sha256:b2211b2ad11fc9822ed8d94502a609a862d6587e13f052e18847559586c76b71
+            tag: latest@sha256:90ea6250fe543ccad61fddeb389032073c8362ce7e1a863d9ea6e2d36dc8e1da
          env:
            - name: SEARXNG_BASE_URL
              value: https://searxng.alexlebens.net/
--- a/clusters/cl01tl/helm/secrets-store-csi-driver/Chart.lock
+++ b/clusters/cl01tl/helm/secrets-store-csi-driver/Chart.lock
@@ -3,4 +3,4 @@ dependencies:
  repository: https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
  version: 1.6.0
 digest: sha256:cafa172d57768baf373cfa9595998422472ecce44e2fdfaab429d7f3fcc7a59e
-generated: "2026-05-01T23:24:12.084808884Z"
+generated: "2026-05-01T23:16:09.682873359Z"
--- a/clusters/cl01tl/helm/shelfmark/Chart.yaml
+++ b/clusters/cl01tl/helm/shelfmark/Chart.yaml
@@ -24,4 +24,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/shelfmark.png
 # renovate: datasource=github-releases depName=calibrain/shelfmark
-appVersion: v1.2.3
+appVersion: v1.2.1
--- a/clusters/cl01tl/helm/shelfmark/values.yaml
+++ b/clusters/cl01tl/helm/shelfmark/values.yaml
@@ -12,7 +12,7 @@ shelfmark:
        main:
          image:
            repository: ghcr.io/calibrain/shelfmark
-            tag: v1.2.3@sha256:bd6cb4bfa14a917e76945c22ed2c376d64cf7fdb74632435db713d42ca597b20
+            tag: v1.2.1@sha256:5e00d47cccaa3b67234855d950d016c50691b78197a68adf15a624f6c08acee2
          env:
            - name: FLASK_PORT
              value: 8084
--- a/clusters/cl01tl/helm/sonarr-4k/Chart.yaml
+++ b/clusters/cl01tl/helm/sonarr-4k/Chart.yaml
@@ -33,4 +33,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/sonarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-sonarr
-appVersion: 4.0.17.2952-ls310
+appVersion: 4.0.17.2952-ls309
--- a/clusters/cl01tl/helm/sonarr-4k/values.yaml
+++ b/clusters/cl01tl/helm/sonarr-4k/values.yaml
@@ -13,7 +13,7 @@ sonarr-4k:
        main:
          image:
            repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.17.2952-ls310@sha256:bed3afb5d46fde809290997760f2e19d41e57d1eb34f507c485d5a8979c7cd8d
+            tag: 4.0.17.2952-ls309@sha256:3580aec3802c915f0f819a88d5099abce61734b925732b8393d176b5dc561020
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/sonarr-anime/Chart.yaml
+++ b/clusters/cl01tl/helm/sonarr-anime/Chart.yaml
@@ -33,4 +33,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/sonarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-sonarr
-appVersion: 4.0.17.2952-ls310
+appVersion: 4.0.17.2952-ls309
--- a/clusters/cl01tl/helm/sonarr-anime/values.yaml
+++ b/clusters/cl01tl/helm/sonarr-anime/values.yaml
@@ -13,7 +13,7 @@ sonarr-anime:
        main:
          image:
            repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.17.2952-ls310@sha256:bed3afb5d46fde809290997760f2e19d41e57d1eb34f507c485d5a8979c7cd8d
+            tag: 4.0.17.2952-ls309@sha256:3580aec3802c915f0f819a88d5099abce61734b925732b8393d176b5dc561020
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/sonarr/Chart.yaml
+++ b/clusters/cl01tl/helm/sonarr/Chart.yaml
@@ -33,4 +33,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/sonarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-sonarr
-appVersion: 4.0.17.2952-ls310
+appVersion: 4.0.17.2952-ls309
--- a/clusters/cl01tl/helm/sonarr/values.yaml
+++ b/clusters/cl01tl/helm/sonarr/values.yaml
@@ -12,7 +12,7 @@ sonarr:
        main:
          image:
            repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.17.2952-ls310@sha256:bed3afb5d46fde809290997760f2e19d41e57d1eb34f507c485d5a8979c7cd8d
+            tag: 4.0.17.2952-ls309@sha256:3580aec3802c915f0f819a88d5099abce61734b925732b8393d176b5dc561020
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/sparkyfitness/values.yaml
+++ b/clusters/cl01tl/helm/sparkyfitness/values.yaml
@@ -20,7 +20,7 @@ sparkyfitness:
  server:
    image:
      repository: ghcr.io/codewithcj/sparkyfitness-server
-      tag: v0.16.6.0@sha256:fda636e5adce8da495fe649df4aa230f37c47edbd134798163ac8461479ca725
+      tag: v0.16.5.8@sha256:55e5444a74dde388fa7e54121185c41b2130ffd9d12ad38e9e31765019a5c44b
    resources:
      requests:
        cpu: 100m
@@ -45,7 +45,7 @@ sparkyfitness:
  frontend:
    image:
      repository: ghcr.io/codewithcj/sparkyfitness-frontend
-      tag: v0.16.6.0@sha256:8680cbcd2f2cb5d582600c508c9328cd0c20c13d14e0402a5261cdf51eb925c8
+      tag: v0.16.5.8@sha256:aaf810547097007f6d0b3c90af65f8ce89d9b899a6e3035299caffef830736dc
    resources:
      requests:
        cpu: 10m
--- a/clusters/cl01tl/helm/stalwart/Chart.lock
+++ b/clusters/cl01tl/helm/stalwart/Chart.lock
@@ -0,0 +1,15 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.6.2
+- name: postgres-cluster
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 7.12.1
+- name: valkey
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.6.1
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 1.1.1
+digest: sha256:e90757bb2b260226e23e52d4b48f4280e8abbafb51bdc9268515a91ed694ddf3
+generated: "2026-04-28T23:38:27.664914125Z"
--- a/clusters/cl01tl/helm/stalwart/Chart.yaml
+++ b/clusters/cl01tl/helm/stalwart/Chart.yaml
@@ -0,0 +1,37 @@
+apiVersion: v2
+name: stalwart
+version: 1.0.0
+description: Stalwart
+keywords:
+  - stalwart
+  - email
+home: https://docs.alexlebens.dev/applications/stalwart/
+sources:
+  - https://github.com/stalwartlabs/mail-server
+  - https://github.com/stalwartlabs/stalwart/pkgs/container/stalwart
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: stalwart
+    version: 4.6.2
+    repository: https://bjw-s-labs.github.io/helm-charts/
+  - name: postgres-cluster
+    alias: postgres-18-cluster
+    version: 7.12.1
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: valkey
+    alias: valkey
+    version: 0.6.1
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 1.1.1
+    repository: oci://harbor.alexlebens.net/helm-charts
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/stalwart.png
+# renovate: datasource=github-releases depName=stalwartlabs/mail-server
+appVersion: v0.15.5
--- a/clusters/cl01tl/helm/stalwart/templates/_helpers.tpl
+++ b/clusters/cl01tl/helm/stalwart/templates/_helpers.tpl
@@ -0,0 +1,14 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
--- a/clusters/cl01tl/helm/stalwart/templates/elasticsearch.yaml
+++ b/clusters/cl01tl/helm/stalwart/templates/elasticsearch.yaml
@@ -0,0 +1,29 @@
+apiVersion: elasticsearch.k8s.elastic.co/v1
+kind: Elasticsearch
+metadata:
+  name: elasticsearch-stalwart
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: elasticsearch-stalwart
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  # renovate: datasource=docker depName=elasticsearch
+  version: 9.3.3
+  auth:
+    fileRealm:
+      - secretName: stalwart-elasticsearch-config
+  nodeSets:
+    - name: default
+      count: 2
+      config:
+        node.store.allow_mmap: false
+      volumeClaimTemplates:
+        - metadata:
+            name: elasticsearch-data
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 5Gi
+            storageClassName: ceph-block
--- a/clusters/cl01tl/helm/stalwart/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/stalwart/templates/external-secret.yaml
@@ -0,0 +1,25 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: stalwart-elasticsearch-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: stalwart-elasticsearch-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: username
+      remoteRef:
+        key: /cl01tl/stalwart/elasticsearch
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: /cl01tl/stalwart/elasticsearch
+        property: password
+    - secretKey: roles
+      remoteRef:
+        key: /cl01tl/stalwart/elasticsearch
+        property: roles
--- a/clusters/cl01tl/helm/stalwart/templates/namespace.yaml
+++ b/clusters/cl01tl/helm/stalwart/templates/namespace.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Namespace }}
+    {{- include "custom.labels" . | nindent 4 }}
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: privileged
--- a/clusters/cl01tl/helm/stalwart/templates/prometheus-rule.yaml
+++ b/clusters/cl01tl/helm/stalwart/templates/prometheus-rule.yaml
@@ -0,0 +1,169 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: elasticsearch
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: elasticsearch
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  groups:
+    - name: ElasticsearchExporter
+      rules:
+        - alert: ElasticsearchHeapUsageTooHigh
+          expr: (elasticsearch_jvm_memory_used_bytes{area="heap"} / elasticsearch_jvm_memory_max_bytes{area="heap"}) * 100 > 90 and elasticsearch_jvm_memory_max_bytes{area="heap"} > 0
+          for: 2m
+          labels:
+            severity: critical
+          annotations:
+            summary: Elasticsearch Heap Usage Too High (instance {{ `{{ $labels.instance }}` }})
+            description: "The heap usage is over 90%\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: ElasticsearchHeapUsageWarning
+          expr: (elasticsearch_jvm_memory_used_bytes{area="heap"} / elasticsearch_jvm_memory_max_bytes{area="heap"}) * 100 > 80 and elasticsearch_jvm_memory_max_bytes{area="heap"} > 0
+          for: 2m
+          labels:
+            severity: warning
+          annotations:
+            summary: Elasticsearch Heap Usage warning (instance {{ `{{ $labels.instance }}` }})
+            description: "The heap usage is over 80%\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: ElasticsearchDiskOutOfSpace
+          expr: elasticsearch_filesystem_data_available_bytes / elasticsearch_filesystem_data_size_bytes * 100 < 10 and elasticsearch_filesystem_data_size_bytes > 0
+          for: 0m
+          labels:
+            severity: critical
+          annotations:
+            summary: Elasticsearch disk out of space (instance {{ `{{ $labels.instance }}` }})
+            description: "The disk usage is over 90%\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: ElasticsearchDiskSpaceLow
+          expr: elasticsearch_filesystem_data_available_bytes / elasticsearch_filesystem_data_size_bytes * 100 < 20 and elasticsearch_filesystem_data_size_bytes > 0
+          for: 2m
+          labels:
+            severity: warning
+          annotations:
+            summary: Elasticsearch disk space low (instance {{ `{{ $labels.instance }}` }})
+            description: "The disk usage is over 80%\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: ElasticsearchClusterRed
+          expr: elasticsearch_cluster_health_status{color="red"} == 1
+          for: 0m
+          labels:
+            severity: critical
+          annotations:
+            summary: Elasticsearch Cluster Red (instance {{ `{{ $labels.instance }}` }})
+            description: "Elastic Cluster Red status\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: ElasticsearchClusterYellow
+          expr: elasticsearch_cluster_health_status{color="yellow"} == 1
+          for: 0m
+          labels:
+            severity: warning
+          annotations:
+            summary: Elasticsearch Cluster Yellow (instance {{ `{{ $labels.instance }}` }})
+            description: "Elastic Cluster Yellow status\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+          # 1m delay allows a restart without triggering an alert.
+        - alert: ElasticsearchHealthyNodes
+          expr: elasticsearch_cluster_health_number_of_nodes < 3
+          for: 1m
+          labels:
+            severity: critical
+          annotations:
+            summary: Elasticsearch Healthy Nodes (instance {{ `{{ $labels.instance }}` }})
+            description: "Missing node in Elasticsearch cluster\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+          # 1m delay allows a restart without triggering an alert.
+        - alert: ElasticsearchHealthyDataNodes
+          expr: elasticsearch_cluster_health_number_of_data_nodes < 3
+          for: 1m
+          labels:
+            severity: critical
+          annotations:
+            summary: Elasticsearch Healthy Data Nodes (instance {{ `{{ $labels.instance }}` }})
+            description: "Missing data node in Elasticsearch cluster\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: ElasticsearchRelocatingShards
+          expr: elasticsearch_cluster_health_relocating_shards > 0
+          for: 0m
+          labels:
+            severity: info
+          annotations:
+            summary: Elasticsearch relocating shards (instance {{ `{{ $labels.instance }}` }})
+            description: "Elasticsearch is relocating shards\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: ElasticsearchRelocatingShardsTooLong
+          expr: elasticsearch_cluster_health_relocating_shards > 0
+          for: 15m
+          labels:
+            severity: warning
+          annotations:
+            summary: Elasticsearch relocating shards too long (instance {{ `{{ $labels.instance }}` }})
+            description: "Elasticsearch has been relocating shards for 15min\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: ElasticsearchInitializingShards
+          expr: elasticsearch_cluster_health_initializing_shards > 0
+          for: 0m
+          labels:
+            severity: info
+          annotations:
+            summary: Elasticsearch initializing shards (instance {{ `{{ $labels.instance }}` }})
+            description: "Elasticsearch is initializing shards\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: ElasticsearchInitializingShardsTooLong
+          expr: elasticsearch_cluster_health_initializing_shards > 0
+          for: 15m
+          labels:
+            severity: warning
+          annotations:
+            summary: Elasticsearch initializing shards too long (instance {{ `{{ $labels.instance }}` }})
+            description: "Elasticsearch has been initializing shards for 15 min\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: ElasticsearchUnassignedShards
+          expr: elasticsearch_cluster_health_unassigned_shards > 0
+          for: 2m
+          labels:
+            severity: critical
+          annotations:
+            summary: Elasticsearch unassigned shards (instance {{ `{{ $labels.instance }}` }})
+            description: "Elasticsearch has unassigned shards\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: ElasticsearchPendingTasks
+          expr: elasticsearch_cluster_health_number_of_pending_tasks > 0
+          for: 15m
+          labels:
+            severity: warning
+          annotations:
+            summary: Elasticsearch pending tasks (instance {{ `{{ $labels.instance }}` }})
+            description: "Elasticsearch has pending tasks. Cluster works slowly.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: ElasticsearchNoNewDocuments
+          expr: increase(elasticsearch_indices_indexing_index_total{es_data_node="true"}[10m]) < 1
+          for: 0m
+          labels:
+            severity: warning
+          annotations:
+            summary: Elasticsearch no new documents (instance {{ `{{ $labels.instance }}` }})
+            description: "No new documents for 10 min!\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+          # Threshold of 10ms (0.01s) per indexing operation is a rough default. Adjust based on your document size and cluster performance.
+        - alert: ElasticsearchHighIndexingLatency
+          expr: rate(elasticsearch_indices_indexing_index_time_seconds_total[5m]) / rate(elasticsearch_indices_indexing_index_total[5m]) > 0.01 and rate(elasticsearch_indices_indexing_index_total[5m]) > 0
+          for: 10m
+          labels:
+            severity: warning
+          annotations:
+            summary: Elasticsearch High Indexing Latency (instance {{ `{{ $labels.instance }}` }})
+            description: "The indexing latency on Elasticsearch cluster is higher than the threshold (current value: {{ `{{ $value }}` }}s).\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+          # Threshold of 10000 ops/s is a rough default. Adjust based on your cluster capacity and expected workload.
+        - alert: ElasticsearchHighIndexingRate
+          expr: sum(rate(elasticsearch_indices_indexing_index_total[1m]))> 10000
+          for: 5m
+          labels:
+            severity: warning
+          annotations:
+            summary: Elasticsearch High Indexing Rate (instance {{ `{{ $labels.instance }}` }})
+            description: "The indexing rate on Elasticsearch cluster is higher than the threshold.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+          # Threshold of 100 queries/s is very low for most production clusters. Adjust based on your expected query volume.
+        - alert: ElasticsearchHighQueryRate
+          expr: sum(rate(elasticsearch_indices_search_query_total[1m])) > 100
+          for: 5m
+          labels:
+            severity: warning
+          annotations:
+            summary: Elasticsearch High Query Rate (instance {{ `{{ $labels.instance }}` }})
+            description: "The query rate on Elasticsearch cluster is higher than the threshold.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
+        - alert: ElasticsearchHighQueryLatency
+          expr: rate(elasticsearch_indices_search_query_time_seconds[1m]) / rate(elasticsearch_indices_search_query_total[1m]) > 1 and rate(elasticsearch_indices_search_query_total[1m]) > 0
+          for: 5m
+          labels:
+            severity: warning
+          annotations:
+            summary: Elasticsearch High Query Latency (instance {{ `{{ $labels.instance }}` }})
+            description: "The query latency on Elasticsearch cluster is higher than the threshold (current value: {{ `{{ $value }}` }}s).\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
--- a/clusters/cl01tl/helm/stalwart/values.yaml
+++ b/clusters/cl01tl/helm/stalwart/values.yaml
@@ -0,0 +1,129 @@
+stalwart:
+  controllers:
+    main:
+      forceRename: stalwart
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      containers:
+        main:
+          image:
+            repository: ghcr.io/stalwartlabs/stalwart
+            tag: v0.15.5@sha256:dcf575db2d53d9ef86d6ced8abe4ba491984659a0f8862cc6079ee7b41c3c568
+          resources:
+            requests:
+              cpu: 10m
+              memory: 100Mi
+    metrics:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      containers:
+        main:
+          image:
+            repository: quay.io/prometheuscommunity/elasticsearch-exporter
+            tag: v1.10.0@sha256:a6a4d4403f670faf6a94b8c7f9adbca3ead91f26dd64e5ccf95fa69025dc6e58
+          args:
+            - '--es.uri=https://elasticsearch-stalwart-es-http.tubearchivist:9200'
+            - '--es.ssl-skip-verify'
+          resources:
+            requests:
+              cpu: 1m
+              memory: 10Mi
+  service:
+    main:
+      controller: main
+      forceRename: stalwart
+      ports:
+        http:
+          port: 80
+          targetPort: 8080
+        smtp:
+          port: 25
+          targetPort: 25
+        smtps:
+          port: 465
+          targetPort: 465
+        imap:
+          port: 143
+          targetPort: 143
+        imaps:
+          port: 993
+          targetPort: 993
+    metrics:
+      controller: metrics
+      ports:
+        metrics:
+          port: 9114
+          targetPort: 9114
+  serviceMonitor:
+    main:
+      selector:
+        matchLabels:
+          app.kubernetes.io/name: stalwart-metrics
+          app.kubernetes.io/instance: stalwart-metrics
+      serviceName: '{{ include "bjw-s.common.lib.chart.names.fullname" $ }}'
+      endpoints:
+        - port: metrics
+          interval: 30s
+          scrapeTimeout: 10s
+          path: /metrics
+  route:
+    main:
+      kind: HTTPRoute
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: traefik-gateway
+          namespace: traefik
+      hostnames:
+        - stalwart.alexlebens.net
+      rules:
+        - backendRefs:
+            - name: stalwart
+              port: 80
+          matches:
+            - path:
+                type: PathPrefix
+                value: /
+  persistence:
+    config:
+      forceRename: stalwart-config
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      advancedMounts:
+        main:
+          main:
+            - path: /opt/stalwart
+              readOnly: false
+postgres-18-cluster:
+  mode: recovery
+  recovery:
+    method: objectStore
+    objectStore:
+      index: 1
+  backup:
+    objectStore:
+      - name: garage-local
+        index: 1
+        destinationBucket: postgres-backups
+        externalSecretCredentialPath: /garage/home-infra/postgres-backups
+        isWALArchiver: true
+    scheduledBackups:
+      - name: live-backup
+        suspend: false
+        immediate: true
+        schedule: "0 5 16 * * *"
+        backupName: garage-local
+volsync-target-config:
+  pvcTarget: stalwart-config
+  local:
+    enabled: true
+    schedule: 28 11 * * *
+  remote:
+    enabled: true
+    schedule: 28 12 * * *
+  external:
+    enabled: true
+    schedule: 28 13 * * *
--- a/clusters/cl01tl/helm/traefik/Chart.yaml
+++ b/clusters/cl01tl/helm/traefik/Chart.yaml
@@ -21,4 +21,4 @@ dependencies:
    repository: https://traefik.github.io/charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/traefik.png
 # renovate: datasource=github-releases depName=traefik/traefik
-appVersion: v3.6.15
+appVersion: v3.6.14
--- a/clusters/cl01tl/helm/traefik/values.yaml
+++ b/clusters/cl01tl/helm/traefik/values.yaml
@@ -2,7 +2,7 @@ traefik:
  image:
    registry: docker.io
    repository: traefik
-    tag: v3.6.15@sha256:8cb20d16e01a53d8d7f7696ac2f1af7d200d5c9984d226ce2299731d9eab6d6c
+    tag: v3.6.14@sha256:1c1be62608b6a484c585a917203b01a8226cff13df6a2a78705eeb66b52e667e
  deployment:
    kind: DaemonSet
  ingressClass:
--- a/clusters/cl01tl/helm/tubearchivist/Chart.lock
+++ b/clusters/cl01tl/helm/tubearchivist/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 4.6.2
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
-digest: sha256:640684e6fe2d124b3821a96156d1306d176ae777821eb1ad026217d93db7f00c
-generated: "2026-05-02T01:49:34.768360181Z"
+  version: 0.6.1
+digest: sha256:30856a39a1cd1670a9ab26be30c64d82c19e1283e998b9eeab2df058ea28d284
+generated: "2026-04-13T20:37:24.431820385Z"
--- a/clusters/cl01tl/helm/tubearchivist/Chart.yaml
+++ b/clusters/cl01tl/helm/tubearchivist/Chart.yaml
@@ -24,7 +24,7 @@ dependencies:
    version: 4.6.2
  - name: valkey
    alias: valkey
-    version: 0.7.0
+    version: 0.6.1
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tube-archivist.png
 # renovate: datasource=github-releases depName=tubearchivist/tubearchivist
--- a/clusters/cl01tl/helm/tubearchivist/templates/elasticsearch.yaml
+++ b/clusters/cl01tl/helm/tubearchivist/templates/elasticsearch.yaml
@@ -8,7 +8,7 @@ metadata:
    {{- include "custom.labels" . | nindent 4 }}
 spec:
  # renovate: datasource=docker depName=elasticsearch
-  version: 9.3.4
+  version: 9.3.3
  auth:
    fileRealm:
      - secretName: tubearchivist-elasticsearch-config
--- a/clusters/cl01tl/helm/whodb/Chart.yaml
+++ b/clusters/cl01tl/helm/whodb/Chart.yaml
@@ -19,4 +19,4 @@ dependencies:
    version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/whodb.png
 # renovate: datasource=github-releases depName=clidey/whodb
-appVersion: 0.107.0
+appVersion: 0.106.0
--- a/clusters/cl01tl/helm/whodb/values.yaml
+++ b/clusters/cl01tl/helm/whodb/values.yaml
@@ -7,7 +7,7 @@ whodb:
        main:
          image:
            repository: clidey/whodb
-            tag: 0.107.0@sha256:20fb865bd0972bf56600c9e16715a3b5f30fef77defc19d74efcf72218d5f567
+            tag: 0.106.0@sha256:f872bfcdf2f1cd6d9e97fa4c5d8dd521636bea1bfc0efe0a27ab6c9c11137010
          env:
            - name: WHODB_OLLAMA_HOST
              value: ollama-server-2.ollama
--- a/clusters/cl01tl/helm/yamtrack/Chart.lock
+++ b/clusters/cl01tl/helm/yamtrack/Chart.lock
@@ -7,6 +7,6 @@ dependencies:
  version: 7.12.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.7.0
-digest: sha256:4de822800dcb7ce72c0602d72b8191d5f888ee61a7a11812918239429e2b4837
-generated: "2026-05-02T01:49:48.932539841Z"
+  version: 0.6.1
+digest: sha256:ee9dcbfb4371395a98b8d0c988a022cb8fe1a0d61a21deb6e6acf8e6485717e8
+generated: "2026-04-24T22:02:33.764787706Z"
--- a/Show More
+++ b/Show More