Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 renovate-bot
|
8a89bb3adc
|
@@ -18,7 +18,7 @@ env:
|
||||
|
||||
jobs:
|
||||
lint-docker-compose:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: ubuntu-js
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
|
||||
@@ -21,7 +21,7 @@ env:
|
||||
|
||||
jobs:
|
||||
lint-helm:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: ubuntu-js
|
||||
outputs:
|
||||
chart-dir: ${{ steps.check-dir-changes.outputs.chart-dir }}
|
||||
chart-dir-csv: ${{ steps.check-dir-changes.outputs.chart-dir-csv }}
|
||||
@@ -231,7 +231,7 @@ jobs:
|
||||
|
||||
validate-kubeconform:
|
||||
needs: lint-helm
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: ubuntu-js
|
||||
if: |
|
||||
needs.lint-helm.result == 'success' &&
|
||||
needs.lint-helm.outputs.changes-detected == 'true' &&
|
||||
|
||||
@@ -24,7 +24,7 @@ env:
|
||||
|
||||
jobs:
|
||||
render-manifests:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: ubuntu-js
|
||||
if: >-
|
||||
github.event_name == 'schedule' ||
|
||||
github.event_name == 'workflow_dispatch' ||
|
||||
|
||||
@@ -12,8 +12,8 @@ on:
|
||||
|
||||
jobs:
|
||||
renovate:
|
||||
runs-on: ubuntu-latest
|
||||
container: ghcr.io/renovatebot/renovate:43.195.0@sha256:47421f2f3f82048e969b5195dd808d5ac2c5f69d43d192191c4a3dca390afe06
|
||||
runs-on: ubuntu-js
|
||||
container: ghcr.io/renovatebot/renovate:43.191.2@sha256:539b0ce5f22bcd4b0a42681c0c984afd1c293e2ce5bb12bcb4c01e0f608d60c9
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
dependencies:
|
||||
- name: argo-cd
|
||||
repository: https://argoproj.github.io/argo-helm
|
||||
version: 9.5.15
|
||||
digest: sha256:e9c84de9594f6fb4e05a0f0c1bd87aea8743fcbae08bd8394ea785c167dfcc11
|
||||
generated: "2026-05-22T01:09:44.579860771Z"
|
||||
version: 9.5.14
|
||||
digest: sha256:5cae964bb988089467bc5c46badbe33b67f64abd039f5961e66e412a5c7004a7
|
||||
generated: "2026-05-13T17:58:34.736881783Z"
|
||||
|
||||
@@ -13,7 +13,7 @@ maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: argo-cd
|
||||
version: 9.5.15
|
||||
version: 9.5.14
|
||||
repository: https://argoproj.github.io/argo-helm
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
|
||||
# renovate: datasource=github-releases depName=argoproj/argo-cd
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
dependencies:
|
||||
- name: authentik
|
||||
repository: https://charts.goauthentik.io/
|
||||
version: 2026.5.0
|
||||
version: 2026.2.3
|
||||
- name: cloudflared
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 3.3.1
|
||||
@@ -10,6 +10,6 @@ dependencies:
|
||||
version: 7.15.0
|
||||
- name: valkey
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.9.0
|
||||
digest: sha256:8688b819ca57468c53821b0bda7e1ae21cf7fd3570724c2bf2bce52e88c20171
|
||||
generated: "2026-05-22T19:44:38.634358324Z"
|
||||
version: 0.8.0
|
||||
digest: sha256:df192f903f1bcb7c8882b65b697ab457301c8eced1fdebc56580e4a76039910e
|
||||
generated: "2026-05-18T19:56:17.91252-05:00"
|
||||
|
||||
@@ -18,7 +18,7 @@ maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: authentik
|
||||
version: 2026.5.0
|
||||
version: 2026.2.3
|
||||
repository: https://charts.goauthentik.io/
|
||||
- name: cloudflared
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
@@ -29,7 +29,7 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: valkey
|
||||
alias: valkey
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/authentik.png
|
||||
# renovate: datasource=github-releases depName=goauthentik/authentik
|
||||
|
||||
@@ -4,6 +4,6 @@ dependencies:
|
||||
version: 5.0.1
|
||||
- name: valkey
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.9.0
|
||||
digest: sha256:a78dcd753753806ee7b5e81380676bc289c6f196e4e4b968f1d8f71efa8556b0
|
||||
generated: "2026-05-21T20:05:26.87528061Z"
|
||||
version: 0.8.0
|
||||
digest: sha256:adbf5c062f0be520b579854a9ec75e6932b472508d9b1ec7277bacc3940c20e9
|
||||
generated: "2026-05-15T00:29:14.40707075Z"
|
||||
|
||||
@@ -20,7 +20,7 @@ dependencies:
|
||||
version: 5.0.1
|
||||
- name: valkey
|
||||
alias: valkey
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/blocky.png
|
||||
# renovate: datasource=github-releases depName=0xerr0r/blocky
|
||||
|
||||
@@ -164,6 +164,7 @@ blocky:
|
||||
sparkyfitness IN CNAME traefik-cl01tl
|
||||
tdarr IN CNAME traefik-cl01tl
|
||||
tubearchivist IN CNAME traefik-cl01tl
|
||||
vault IN CNAME traefik-cl01tl
|
||||
whodb IN CNAME traefik-cl01tl
|
||||
yamtrack IN CNAME traefik-cl01tl
|
||||
yubal IN CNAME traefik-cl01tl
|
||||
|
||||
@@ -7,7 +7,7 @@ dependencies:
|
||||
version: 7.15.0
|
||||
- name: valkey
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 2.0.0
|
||||
@@ -17,5 +17,5 @@ dependencies:
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 2.0.0
|
||||
digest: sha256:cd2b6d78d834baba995997c9e2c867012ffe555dc3bea4d59bef416875f71433
|
||||
generated: "2026-05-21T20:05:51.237084324Z"
|
||||
digest: sha256:2463c5c7f9d43539f2f0bda9a59ce391d6c45e328b8a7cbfeae2991128983978
|
||||
generated: "2026-05-18T19:56:49.128641-05:00"
|
||||
|
||||
@@ -26,7 +26,7 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: valkey
|
||||
alias: valkey
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: volsync-target
|
||||
alias: volsync-target-storage
|
||||
@@ -42,4 +42,4 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/dawarich.png
|
||||
# renovate: datasource=github-releases depName=Freika/dawarich
|
||||
appVersion: 1.7.9
|
||||
appVersion: 1.7.8
|
||||
|
||||
@@ -8,7 +8,7 @@ dawarich:
|
||||
main:
|
||||
image:
|
||||
repository: freikin/dawarich
|
||||
tag: 1.7.9@sha256:54329b050caab65f39367308ef7a9f2f3bd1fa3b6ba969d6a33bbf4a0f5e7e84
|
||||
tag: 1.7.8@sha256:dea326d03e728cd3b8d051b72d293cf375d0db6c00e22c55f338daedfdfdb3a4
|
||||
command:
|
||||
- "web-entrypoint.sh"
|
||||
args:
|
||||
@@ -136,7 +136,7 @@ dawarich:
|
||||
sidekiq:
|
||||
image:
|
||||
repository: freikin/dawarich
|
||||
tag: 1.7.9@sha256:54329b050caab65f39367308ef7a9f2f3bd1fa3b6ba969d6a33bbf4a0f5e7e84
|
||||
tag: 1.7.8@sha256:dea326d03e728cd3b8d051b72d293cf375d0db6c00e22c55f338daedfdfdb3a4
|
||||
command:
|
||||
- "sidekiq-entrypoint.sh"
|
||||
args:
|
||||
|
||||
@@ -7,12 +7,12 @@ dependencies:
|
||||
version: 7.15.0
|
||||
- name: valkey
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
- name: rclone-bucket
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.11.4
|
||||
- name: rclone-bucket
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.11.4
|
||||
digest: sha256:6a2d1c3824f01c94572919dc58c3c72267373506979aa7566b138159d4389252
|
||||
generated: "2026-05-21T20:06:21.441505828Z"
|
||||
digest: sha256:984ca917152c95f2e7f0cd9467a952f24adc0c53f5fc521c2f0395174ec9aab7
|
||||
generated: "2026-05-19T16:29:28.911319575Z"
|
||||
|
||||
@@ -26,7 +26,7 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: valkey
|
||||
alias: valkey
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: rclone-bucket
|
||||
alias: rclone-directus-assets-remote
|
||||
|
||||
@@ -33,4 +33,4 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/freshrss.png
|
||||
# renovate: datasource=github-releases depName=FreshRSS/FreshRSS
|
||||
appVersion: 1.29.1
|
||||
appVersion: 1.29.0
|
||||
|
||||
@@ -8,7 +8,7 @@ freshrss:
|
||||
main:
|
||||
image:
|
||||
repository: freshrss/freshrss
|
||||
tag: 1.29.1@sha256:ab6b363102ccdbc39f6a62db926f567c61a5289bf25ba460f1c34423d8cc1a4d
|
||||
tag: 1.29.0@sha256:cca8988d05cd449e1c6c69405971b1e6fc2c2116ceeb45c9fa3fc33837997a75
|
||||
env:
|
||||
- name: PGID
|
||||
value: "568"
|
||||
|
||||
@@ -258,6 +258,9 @@ gatus:
|
||||
- name: whodb
|
||||
url: https://whodb.alexlebens.net
|
||||
<<: *defaults
|
||||
- name: vault
|
||||
url: https://vault.alexlebens.net
|
||||
<<: *defaults
|
||||
- name: openbao
|
||||
url: https://bao.alexlebens.net
|
||||
<<: *defaults
|
||||
|
||||
@@ -4,7 +4,7 @@ dependencies:
|
||||
version: 12.6.0
|
||||
- name: actions
|
||||
repository: https://dl.gitea.com/charts/
|
||||
version: 0.1.1
|
||||
version: 0.1.0
|
||||
- name: meilisearch
|
||||
repository: https://meilisearch.github.io/meilisearch-kubernetes
|
||||
version: 0.32.0
|
||||
@@ -16,12 +16,12 @@ dependencies:
|
||||
version: 7.15.0
|
||||
- name: valkey
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
- name: valkey
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 2.0.0
|
||||
digest: sha256:c6dbbe309deaa50180021a1bd54a16425591f7081c07165db22c971abfd86ee3
|
||||
generated: "2026-05-22T01:09:01.919731791Z"
|
||||
digest: sha256:34bef18e6f56091f1a9822dd243cda4b17ba07783d4c8635165e5ada2dcaa4ad
|
||||
generated: "2026-05-18T19:57:53.546712-05:00"
|
||||
|
||||
@@ -31,7 +31,7 @@ dependencies:
|
||||
- name: actions
|
||||
alias: gitea-actions
|
||||
repository: https://dl.gitea.com/charts/
|
||||
version: 0.1.1
|
||||
version: 0.1.0
|
||||
- name: meilisearch
|
||||
version: 0.32.0
|
||||
repository: https://meilisearch.github.io/meilisearch-kubernetes
|
||||
@@ -44,11 +44,11 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: valkey
|
||||
alias: valkey-gitea
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: valkey
|
||||
alias: valkey-renovate
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: volsync-target
|
||||
alias: volsync-target-storage
|
||||
@@ -56,4 +56,4 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/gitea.png
|
||||
# renovate: datasource=github-releases depName=go-gitea/gitea
|
||||
appVersion: 1.26.2
|
||||
appVersion: 1.26.1
|
||||
|
||||
@@ -9,7 +9,7 @@ gitea:
|
||||
maxUnavailable: 1
|
||||
image:
|
||||
repository: gitea/gitea
|
||||
tag: 1.26.2
|
||||
tag: 1.26.1
|
||||
service:
|
||||
http:
|
||||
type: ClusterIP
|
||||
@@ -190,11 +190,11 @@ gitea-actions:
|
||||
resources:
|
||||
requests:
|
||||
storage: 50Gi
|
||||
runner:
|
||||
actRunner:
|
||||
registry: docker.io
|
||||
repository: gitea/runner
|
||||
# renovate: datasource=docker depName=gitea/runner
|
||||
tag: 1.0.6@sha256:ab581a3e1a260efa0521886ad8051f0e8c4ff1f1d52aa8ef0a2e3ad7465f8b74
|
||||
repository: gitea/act_runner
|
||||
# renovate: datasource=docker depName=gitea/act_runner
|
||||
tag: 0.6.1@sha256:b5c35d6bdbb9bb25e531230bfc7cc663cb751406cbec90a2a891b85fea54de86
|
||||
extraVolumeMounts:
|
||||
- name: workspace-vol
|
||||
mountPath: /workspace
|
||||
@@ -212,7 +212,7 @@ gitea-actions:
|
||||
registry: docker.io
|
||||
repository: docker
|
||||
# renovate: datasource=docker depName=docker
|
||||
tag: 29.5.2-dind@sha256:6b9cd914eb9c6b342c040a49a27a5eb3804453bae6ecc90f7ff96133595a95e8
|
||||
tag: 29.5.0-dind@sha256:8e3fae900cbfbdc14e8abca89a9e44363065cb535f34a09283c59cc0dde2de20
|
||||
extraVolumeMounts:
|
||||
- name: docker-vol
|
||||
mountPath: /var/lib/docker
|
||||
|
||||
@@ -7,9 +7,9 @@ dependencies:
|
||||
version: 7.15.0
|
||||
- name: valkey
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
- name: valkey
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.9.0
|
||||
digest: sha256:8e441f3d69aa8b4186265cd7b265d75f6faae8883fb4ecb8d23db2d61ec2a954
|
||||
generated: "2026-05-22T00:24:27.626131121Z"
|
||||
version: 0.8.0
|
||||
digest: sha256:f8f9607ebb8f64e8b33c976408ab0ee181d8b99c6ca68ba57d674563050427da
|
||||
generated: "2026-05-21T18:20:22.931604942Z"
|
||||
|
||||
@@ -24,11 +24,11 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: valkey
|
||||
alias: valkey-unified-alerting
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: valkey
|
||||
alias: valkey-remote-cache
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grafana.png
|
||||
# renovate: datasource=github-releases depName=grafana/grafana-operator
|
||||
|
||||
@@ -591,6 +591,24 @@ spec:
|
||||
resyncPeriod: 6h
|
||||
url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/rclone.json
|
||||
|
||||
---
|
||||
apiVersion: grafana.integreatly.org/v1beta1
|
||||
kind: GrafanaDashboard
|
||||
metadata:
|
||||
name: grafana-dashboard-vault
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: grafana-dashboard-vault
|
||||
{{- include "custom.labels" . | nindent 4 }}
|
||||
spec:
|
||||
instanceSelector:
|
||||
matchLabels:
|
||||
app: grafana-main
|
||||
contentCacheDuration: 6h
|
||||
folderUID: grafana-folder-platform
|
||||
resyncPeriod: 6h
|
||||
url: http://gitea-http.gitea:3000/alexlebens/grafana-dashboards/raw/branch/main/dashboards/platform/vault.json
|
||||
|
||||
---
|
||||
apiVersion: grafana.integreatly.org/v1beta1
|
||||
kind: GrafanaDashboard
|
||||
|
||||
@@ -7,6 +7,6 @@ dependencies:
|
||||
version: 7.15.0
|
||||
- name: valkey
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.9.0
|
||||
digest: sha256:3f12966ac47aa1912f222875b5dedce047de094768e43082aaa0b85f3c2a366d
|
||||
generated: "2026-05-21T20:07:47.472198246Z"
|
||||
version: 0.8.0
|
||||
digest: sha256:99d2db33da1da7b9f21936809f446bccad5870a9aa0f204f17c3265afdf56699
|
||||
generated: "2026-05-19T16:30:40.946495049Z"
|
||||
|
||||
@@ -24,7 +24,7 @@ dependencies:
|
||||
repository: https://gitea.alexlebens.net/api/packages/alexlebens/helm
|
||||
- name: valkey
|
||||
alias: valkey
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/harbor.png
|
||||
# renovate: datasource=github-releases depName=goharbor/harbor
|
||||
|
||||
@@ -24,4 +24,4 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/home-assistant.png
|
||||
# renovate: datasource=github-releases depName=home-assistant/core
|
||||
appVersion: 2026.5.4
|
||||
appVersion: 2026.5.2
|
||||
|
||||
@@ -12,7 +12,7 @@ home-assistant:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/home-assistant/home-assistant
|
||||
tag: 2026.5.4@sha256:ceb1202133a5a036e8b03e20a10eb113186cc2f871968323c6fc6c3fc4205716
|
||||
tag: 2026.5.3@sha256:ff875078181a0383bf3fca9f061be12d6180896dbd531de04e094e25505b0bb9
|
||||
env:
|
||||
- name: TZ
|
||||
value: America/Chicago
|
||||
|
||||
@@ -601,6 +601,18 @@ homepage:
|
||||
href: https://whodb.alexlebens.net
|
||||
siteMonitor: http://whodb.whodb:80
|
||||
statusStyle: dot
|
||||
- Secrets:
|
||||
icon: sh-hashicorp-vault.webp
|
||||
description: Vault
|
||||
href: https://vault.alexlebens.net
|
||||
siteMonitor: http://vault.vault:8200
|
||||
statusStyle: dot
|
||||
namespace: vault
|
||||
app: vault
|
||||
podSelector: >-
|
||||
app.kubernetes.io/instance in (
|
||||
vault
|
||||
)
|
||||
- Secrets:
|
||||
icon: sh-openbao.webp
|
||||
description: OpenBao
|
||||
|
||||
@@ -7,9 +7,9 @@ dependencies:
|
||||
version: 7.15.0
|
||||
- name: valkey
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 2.0.0
|
||||
digest: sha256:61c7ed165fd02bd41fc1703b3b213c68cdbae746576ffeedbec35725db4c7e76
|
||||
generated: "2026-05-21T20:08:09.249760256Z"
|
||||
digest: sha256:0ebe80fdc1e7b70d1d7714f4f73ddf9ac5ffdb6ecd75cb7304cc55af062328be
|
||||
generated: "2026-05-18T19:58:31.087625-05:00"
|
||||
|
||||
@@ -25,7 +25,7 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: valkey
|
||||
alias: valkey
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: volsync-target
|
||||
alias: volsync-target-data
|
||||
|
||||
@@ -30,4 +30,4 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/jellyfin.png
|
||||
# renovate: datasource=github-releases depName=jellyfin/jellyfin
|
||||
appVersion: 10.11.9
|
||||
appVersion: 10.11.8
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
dependencies:
|
||||
- name: kube-prometheus-stack
|
||||
repository: oci://ghcr.io/prometheus-community/charts
|
||||
version: 85.2.2
|
||||
version: 85.1.3
|
||||
- name: prometheus-operator-crds
|
||||
repository: oci://ghcr.io/prometheus-community/charts
|
||||
version: 29.0.0
|
||||
@@ -10,6 +10,6 @@ dependencies:
|
||||
version: 5.0.1
|
||||
- name: valkey
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.9.0
|
||||
digest: sha256:1778799905ce3862ad26eecd89ab337fcbf5b8c56e878d67c2a3c464c23c8f63
|
||||
generated: "2026-05-22T18:21:37.821260669Z"
|
||||
version: 0.8.0
|
||||
digest: sha256:67a7c994af3e36ed3668123a1c5add5144e5460149dce40e7686e71c79c5123a
|
||||
generated: "2026-05-17T15:05:47.249164073Z"
|
||||
|
||||
@@ -20,7 +20,7 @@ maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: kube-prometheus-stack
|
||||
version: 85.2.2
|
||||
version: 85.2.0
|
||||
repository: oci://ghcr.io/prometheus-community/charts
|
||||
- name: prometheus-operator-crds
|
||||
version: 29.0.0
|
||||
@@ -31,7 +31,7 @@ dependencies:
|
||||
version: 5.0.1
|
||||
- name: valkey
|
||||
alias: valkey
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prometheus.png
|
||||
# renovate: datasource=github-releases depName=prometheus-operator/prometheus-operator
|
||||
|
||||
@@ -19,4 +19,4 @@ dependencies:
|
||||
version: 5.0.1
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
|
||||
# renovate: datasource=github-releases depName=alex1989hu/kubelet-serving-cert-approver
|
||||
appVersion: 0.11.0
|
||||
appVersion: 0.10.3
|
||||
|
||||
@@ -35,7 +35,7 @@ kubelet-serving-cert-approver:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/alex1989hu/kubelet-serving-cert-approver
|
||||
tag: 0.11.0@sha256:f17017b53983fe93f5a07ef85b2e448b9e4be848d45f05c325c8f2c77e1171c4
|
||||
tag: 0.10.3@sha256:4cdc92140c48341433513dce3201806309d5256cfbac6f830feae1e7e9fb0d7d
|
||||
args:
|
||||
- serve
|
||||
env:
|
||||
|
||||
@@ -26,4 +26,4 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/libation.png
|
||||
# renovate: datasource=github-releases depName=rmcrackan/Libation
|
||||
appVersion: 13.4.3
|
||||
appVersion: 13.4.2
|
||||
|
||||
@@ -12,7 +12,7 @@ libation:
|
||||
main:
|
||||
image:
|
||||
repository: rmcrackan/libation
|
||||
tag: 13.4.3@sha256:51ba31d839c60599185684615564618dbb669ace677254f56e8419b1ef19c603
|
||||
tag: 13.4.2@sha256:0544f061512f2c272a153a2d6d4b3cedc276486949808a5e3acd8842dc3cc4c4
|
||||
env:
|
||||
- name: SLEEP_TIME
|
||||
value: "-1"
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
dependencies:
|
||||
- name: loki
|
||||
repository: oci://ghcr.io/grafana-community/helm-charts
|
||||
version: 17.0.1
|
||||
version: 16.0.1
|
||||
- name: alloy
|
||||
repository: https://grafana.github.io/helm-charts
|
||||
version: 1.8.1
|
||||
digest: sha256:d8d28f5f194afb6200255175add00858b150366e128f80b9d94f6e7e3dce9d4d
|
||||
generated: "2026-05-22T19:45:18.821213515Z"
|
||||
digest: sha256:4ba5dd2a028c1c5788496b2a60b89f37b3904b206a53058f2f66f88172ca903d
|
||||
generated: "2026-05-19T22:45:18.915774113Z"
|
||||
|
||||
@@ -15,7 +15,7 @@ maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: loki
|
||||
version: 17.0.1
|
||||
version: 16.1.0
|
||||
repository: oci://ghcr.io/grafana-community/helm-charts
|
||||
- name: alloy
|
||||
version: 1.8.1
|
||||
|
||||
@@ -22,10 +22,10 @@ dependencies:
|
||||
version: 7.15.0
|
||||
- name: valkey
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
- name: valkey
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 2.0.0
|
||||
@@ -38,5 +38,5 @@ dependencies:
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 2.0.0
|
||||
digest: sha256:7f72074216b5af8e4af37c76f91880d97aecedbf7aa557e032c8f66e312238e1
|
||||
generated: "2026-05-21T20:08:53.38814427Z"
|
||||
digest: sha256:6b9386d0dde99ba9774cc1447e76c838bd5103e0ba8d15300a6f10c8595712fa
|
||||
generated: "2026-05-19T17:06:13.901207941Z"
|
||||
|
||||
@@ -54,11 +54,11 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: valkey
|
||||
alias: valkey-matrix-synapse
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: valkey
|
||||
alias: valkey-hookshot
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: volsync-target
|
||||
alias: volsync-target-synapse
|
||||
|
||||
@@ -24,4 +24,4 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/music-grabber.png
|
||||
# renovate: datasource=docker depName=g33kphr33k/musicgrabber
|
||||
appVersion: 2.8.13
|
||||
appVersion: 2.8.12
|
||||
|
||||
@@ -12,7 +12,7 @@ music-grabber:
|
||||
main:
|
||||
image:
|
||||
repository: g33kphr33k/musicgrabber
|
||||
tag: 2.8.13@sha256:9895b8d50a732248a3ceec611c8db15d08d46438b5a3cc7932c5fa7fe2f8a6d2
|
||||
tag: 2.8.12@sha256:eff4ab1009cccea2b070ac1db3c9ec4c3d359a9156c2dab7c5be247ccf7fc350
|
||||
env:
|
||||
- name: MUSIC_DIR
|
||||
value: /mnt/store/Music Grabber/
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
dependencies:
|
||||
- name: openbao
|
||||
repository: https://openbao.github.io/openbao-helm
|
||||
version: 0.28.3
|
||||
version: 0.28.2
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 5.0.1
|
||||
@@ -11,5 +11,5 @@ dependencies:
|
||||
- name: rclone-bucket
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.11.4
|
||||
digest: sha256:5e743ed99053774e3b3bd6afe3c97d85ece29e86f20f81ddfc456e80d10f47a8
|
||||
generated: "2026-05-22T01:11:07.608089959Z"
|
||||
digest: sha256:bd0ab8f854917701e69215e81bc77899d0365908998d658aba02de4afaffd889
|
||||
generated: "2026-05-18T02:15:31.062887311Z"
|
||||
|
||||
@@ -20,7 +20,7 @@ maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: openbao
|
||||
version: 0.28.3
|
||||
version: 0.28.2
|
||||
repository: https://openbao.github.io/openbao-helm
|
||||
- name: app-template
|
||||
alias: unseal
|
||||
@@ -36,4 +36,4 @@ dependencies:
|
||||
version: 0.11.4
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/openbao.png
|
||||
# renovate: datasource=github-releases depName=openbao/openbao
|
||||
appVersion: v2.5.4
|
||||
appVersion: v2.5.3
|
||||
|
||||
@@ -10,9 +10,9 @@ dependencies:
|
||||
version: 7.15.0
|
||||
- name: valkey
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 2.0.0
|
||||
digest: sha256:79c32aa3dde61902c1ce8614aef90164ee649958dc8a4be2afd131e1843256e8
|
||||
generated: "2026-05-21T20:09:17.731275764Z"
|
||||
digest: sha256:38f3c7343b94e64ff91765ce2cb64ff797325f60ba7eb0ffc17d9cc2b132273f
|
||||
generated: "2026-05-19T16:32:08.124145071Z"
|
||||
|
||||
@@ -30,7 +30,7 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: valkey
|
||||
alias: valkey
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: volsync-target
|
||||
alias: volsync-target-data
|
||||
|
||||
@@ -7,7 +7,7 @@ dependencies:
|
||||
version: 7.15.0
|
||||
- name: valkey
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 2.0.0
|
||||
@@ -20,5 +20,5 @@ dependencies:
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 2.0.0
|
||||
digest: sha256:812cebb8d13669a0d9a3ff2663f59cf8ba7ae5186cae098103fa4fe68f7192fe
|
||||
generated: "2026-05-21T20:09:47.142294164Z"
|
||||
digest: sha256:1c42441e106a0c58b4831e1a957ab0ba10c9c3f3ebb99571dd84a330f5103bc2
|
||||
generated: "2026-05-19T16:32:19.671233373Z"
|
||||
|
||||
@@ -28,7 +28,7 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: valkey
|
||||
alias: valkey
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: volsync-target
|
||||
alias: volsync-target-data
|
||||
|
||||
@@ -13,12 +13,12 @@ dependencies:
|
||||
version: 7.15.0
|
||||
- name: valkey
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 2.0.0
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 2.0.0
|
||||
digest: sha256:75f99ea76fd535b49dfd49ec5cde400ce3957585f67507066ce7356640f2d46e
|
||||
generated: "2026-05-21T20:10:12.033103279Z"
|
||||
digest: sha256:8fcff64223e7985eaac2e27f30102314141e8f68b9d30a460d936afcb80e58f8
|
||||
generated: "2026-05-19T16:32:36.686073568Z"
|
||||
|
||||
@@ -39,7 +39,7 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: valkey
|
||||
alias: valkey
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: volsync-target
|
||||
alias: volsync-target-config
|
||||
@@ -51,4 +51,4 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/postiz.png
|
||||
# renovate: datasource=github-releases depName=gitroomhq/postiz-app
|
||||
appVersion: v2.21.8
|
||||
appVersion: v2.21.7
|
||||
|
||||
@@ -8,7 +8,7 @@ postiz:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/gitroomhq/postiz-app
|
||||
tag: v2.21.8@sha256:3ec7bc8ecf61f08c22e0954291702b097f944def515dc259cb3a441aba4046c0
|
||||
tag: v2.21.7@sha256:29a40ab11ef597c340f7f25764e7f040429c6b72c3eda33d15a429ddb66d0933
|
||||
env:
|
||||
- name: JWT_SECRET
|
||||
valueFrom:
|
||||
@@ -232,7 +232,7 @@ temporal:
|
||||
web:
|
||||
image:
|
||||
repository: temporalio/ui
|
||||
tag: 2.50.0@sha256:49a61456f6b770af926d6d7d74f63ebb4b9a3c5abc4fb68ddb146321d49391e4
|
||||
tag: 2.49.1@sha256:a066bdf5c4de689cabaf80cc357871f1db5e6d750a6bcfc42e877b913e31ef24
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
|
||||
@@ -28,4 +28,4 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prowlarr.png
|
||||
# renovate: datasource=github-releases depName=linuxserver/docker-prowlarr
|
||||
appVersion: 2.3.5.5327-ls147
|
||||
appVersion: 2.3.5.5327-ls146
|
||||
|
||||
@@ -196,7 +196,7 @@ qbittorrent:
|
||||
qui:
|
||||
image:
|
||||
repository: ghcr.io/autobrr/qui
|
||||
tag: v1.19.0@sha256:baa07db5326f75f8c2246703603cbe2132476c8ad0ab31c976a960cb4c4731f5
|
||||
tag: v1.18.0@sha256:2e768c8509831afd1f606d27d9aa8e5f3fc722fac4ea88acfdc4fa3b0e9b13ae
|
||||
env:
|
||||
- name: QUI__METRICS_ENABLED
|
||||
value: true
|
||||
|
||||
@@ -112,7 +112,7 @@ rybbit:
|
||||
main:
|
||||
image:
|
||||
repository: clickhouse/clickhouse-server
|
||||
tag: 26.5.1@sha256:07afc18d8a9706eb9d85c5c5d2752e5270f91bbc2894caeaecb73e4d0f603bf5
|
||||
tag: 26.4.2@sha256:6d8f358747b59f7db044749eaf951e828e75cc16f9c487f855b114272c44b82c
|
||||
env:
|
||||
- name: CLICKHOUSE_DB
|
||||
value: analytics
|
||||
|
||||
@@ -10,7 +10,7 @@ searxng:
|
||||
main:
|
||||
image:
|
||||
repository: searxng/searxng
|
||||
tag: latest@sha256:4f0db332041c372dfe238ec0540f53ac055ad15cff2e179235e7fe07f1a5271f
|
||||
tag: latest@sha256:9dc52736c6ba776d387bdc275e8c58d5b57ac7da77021b46311a058f23dd15dc
|
||||
env:
|
||||
- name: SEARXNG_BASE_URL
|
||||
value: http://searxng-api.searxng:8080
|
||||
@@ -38,7 +38,7 @@ searxng:
|
||||
main:
|
||||
image:
|
||||
repository: searxng/searxng
|
||||
tag: latest@sha256:4f0db332041c372dfe238ec0540f53ac055ad15cff2e179235e7fe07f1a5271f
|
||||
tag: latest@sha256:9dc52736c6ba776d387bdc275e8c58d5b57ac7da77021b46311a058f23dd15dc
|
||||
env:
|
||||
- name: SEARXNG_BASE_URL
|
||||
value: https://searxng.alexlebens.net/
|
||||
|
||||
@@ -10,7 +10,7 @@ site-profile:
|
||||
main:
|
||||
image:
|
||||
repository: harbor.alexlebens.net/images/site-profile
|
||||
tag: 3.22.0@sha256:09b0b8635385eb4a18457e0b5fc6e2396d456bf964e54dd073d3524fa29afbf0
|
||||
tag: 3.20.2@sha256:38dc06984b895fa5efe4ab913990c39c7b603a8daa0bcb06b30d96255be98cc3
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
dependencies:
|
||||
- name: tailscale-operator
|
||||
repository: https://pkgs.tailscale.com/helmcharts
|
||||
version: 1.98.3
|
||||
digest: sha256:b35ef32920a6099e11aadb3e6f492b2853085c1b1d57d0e421de54922bfeae05
|
||||
generated: "2026-05-22T19:06:26.889427133Z"
|
||||
version: 1.96.5
|
||||
digest: sha256:d7352b6781e248f6fc6bbb06e994c76eed77f06b3beaac6a5707e77df72ccc7d
|
||||
generated: "2026-04-07T22:47:27.933877961Z"
|
||||
|
||||
@@ -17,8 +17,8 @@ maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: tailscale-operator
|
||||
version: 1.98.3
|
||||
version: 1.96.5
|
||||
repository: https://pkgs.tailscale.com/helmcharts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tailscale-light.png
|
||||
# renovate: datasource=docker depName=tailscale/tailscale
|
||||
appVersion: v1.98.3
|
||||
appVersion: v1.96.5
|
||||
|
||||
@@ -11,4 +11,4 @@ spec:
|
||||
image:
|
||||
repo: tailscale/k8s-nameserver
|
||||
# renovate: datasource=docker depName=tailscale/k8s-nameserver
|
||||
tag: v1.98.3
|
||||
tag: v1.96.5
|
||||
|
||||
@@ -5,7 +5,7 @@ tailscale-operator:
|
||||
- "tag:k8s-operator"
|
||||
image:
|
||||
repository: tailscale/k8s-operator
|
||||
tag: v1.98.3
|
||||
tag: v1.96.5
|
||||
digest: sha256:7956bd50dca9dc804b98720df94d112b54af85449ed0bf8cc7fad0346b225067
|
||||
hostname: tailscale-operator-cl01tl
|
||||
ingressClass:
|
||||
@@ -13,6 +13,6 @@ tailscale-operator:
|
||||
proxyConfig:
|
||||
image:
|
||||
repository: tailscale/tailscale
|
||||
tag: v1.98.3
|
||||
tag: v1.96.5
|
||||
digest: sha256:95e528798bebe75f39b10e74e7051cf51188ee615934f232ba7ad06a3390ffa1
|
||||
defaultProxyClass: no-metrics
|
||||
|
||||
@@ -12,7 +12,7 @@ tdarr:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/haveagitgat/tdarr
|
||||
tag: 2.75.01@sha256:d691b283d6498bb43b48753c24d176fc6a849012c33f3518f16394d93d6b6359
|
||||
tag: 2.74.01@sha256:4dd21e8aa92f10601c35828566ddaadbb6d9d4335d004411ee69f1e02714d1c8
|
||||
env:
|
||||
- name: TZ
|
||||
value: America/Chicago
|
||||
@@ -68,7 +68,7 @@ tdarr:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/haveagitgat/tdarr_node
|
||||
tag: 2.75.01@sha256:db2b52a1a6fb545a9b0a45952d7f1172e1e23979af638845aea2a76ce2e2e7e6
|
||||
tag: 2.74.01@sha256:1dd3efb3fdb3d29a3aa115bfd0d6a29e87168b44b42614f526dfd9c73410cb5e
|
||||
env:
|
||||
- name: TZ
|
||||
value: America/Chicago
|
||||
|
||||
@@ -4,6 +4,6 @@ dependencies:
|
||||
version: 5.0.1
|
||||
- name: valkey
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.9.0
|
||||
digest: sha256:843e0ebb0d76994745d40ce8c4a14b95013837052772b91053edb326d802005d
|
||||
generated: "2026-05-21T20:10:38.443234533Z"
|
||||
version: 0.8.0
|
||||
digest: sha256:bee22e09c8cda4452f27a3880a38ccf350de1293cedc2223b4e5cfaa2bdc1dac
|
||||
generated: "2026-05-15T00:41:20.815897832Z"
|
||||
|
||||
@@ -24,7 +24,7 @@ dependencies:
|
||||
version: 5.0.1
|
||||
- name: valkey
|
||||
alias: valkey
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tube-archivist.png
|
||||
# renovate: datasource=github-releases depName=tubearchivist/tubearchivist
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
dependencies:
|
||||
- name: vault
|
||||
repository: https://helm.releases.hashicorp.com
|
||||
version: 0.32.0
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 5.0.1
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 5.0.1
|
||||
digest: sha256:c555a9afad1b13f96d7a94c98182312fae388ab55b26cf177b15a0a4192e879f
|
||||
generated: "2026-05-15T00:42:01.447358515Z"
|
||||
@@ -0,0 +1,34 @@
|
||||
apiVersion: v2
|
||||
name: vault
|
||||
version: 1.0.0
|
||||
description: Vault
|
||||
keywords:
|
||||
- vault
|
||||
- secrets
|
||||
home: https://docs.alexlebens.dev/applications/vault/
|
||||
sources:
|
||||
- https://github.com/hashicorp/vault
|
||||
- https://github.com/Angatar/s3cmd
|
||||
- https://github.com/lrstanley/vault-unseal
|
||||
- https://hub.docker.com/r/hashicorp/vault
|
||||
- https://hub.docker.com/r/d3fk/s3cmd/
|
||||
- https://github.com/lrstanley/vault-unseal/pkgs/container/vault-unseal
|
||||
- https://github.com/hashicorp/vault-helm
|
||||
- https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
|
||||
maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: vault
|
||||
version: 0.32.0
|
||||
repository: https://helm.releases.hashicorp.com
|
||||
- name: app-template
|
||||
alias: snapshot
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 5.0.1
|
||||
- name: app-template
|
||||
alias: unseal
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 5.0.1
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/hashicorp-vault.png
|
||||
# renovate: datasource=github-releases depName=hashicorp/vault
|
||||
appVersion: 2.0.0
|
||||
@@ -0,0 +1,21 @@
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "custom.labels" -}}
|
||||
{{ include "custom.selectorLabels" $ }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "custom.selectorLabels" -}}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
ServiceAccount names
|
||||
*/}}
|
||||
{{- define "custom.serviceAccountName" -}}
|
||||
vault
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,49 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: vault-snapshot-script
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: vault-snapshot-script
|
||||
{{- include "custom.labels" . | nindent 4 }}
|
||||
data:
|
||||
snapshot.sh: |
|
||||
DATE=$(date +"%Y%m%d-%H-%M")
|
||||
|
||||
echo " "
|
||||
echo ">> Running Vault Snapshot Script ..."
|
||||
|
||||
echo " "
|
||||
echo ">> Fetching Vault token ..."
|
||||
export VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id=$VAULT_APPROLE_ROLE_ID secret_id=$VAULT_APPROLE_SECRET_ID)
|
||||
|
||||
if [ -z "$VAULT_TOKEN" ]; then
|
||||
echo ">> ERROR: Failed to fetch Vault token! Exiting..."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo " "
|
||||
echo ">> Taking Vault snapshot ..."
|
||||
vault operator raft snapshot save /opt/backup/vault-snapshot-$DATE.snap
|
||||
|
||||
echo " "
|
||||
echo ">> Setting ownership of Vault snapshot ..."
|
||||
chown 100:1000 /opt/backup/vault-snapshot-$DATE.snap
|
||||
|
||||
echo " "
|
||||
echo ">> Completed Vault snapshot"
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: vault-backup-script
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: vault-backup-script
|
||||
{{- include "custom.labels" . | nindent 4 }}
|
||||
data:
|
||||
backup.sh: |
|
||||
echo " ";
|
||||
echo ">> Running S3 backup for Vault snapshot";
|
||||
OUTPUT=$(s3cmd sync --no-check-certificate -v /opt/backup/* "${BUCKET}/cl01tl/cl01tl-vault-snapshots/" 2>&1)
|
||||
@@ -0,0 +1,215 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: vault-token
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: vault-token
|
||||
{{- include "custom.labels" . | nindent 4 }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: openbao
|
||||
data:
|
||||
- secretKey: token
|
||||
remoteRef:
|
||||
key: /cl01tl/vault/token
|
||||
property: root
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: vault-snapshot-agent-role
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: vault-snapshot-agent-role
|
||||
{{- include "custom.labels" . | nindent 4 }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: openbao
|
||||
data:
|
||||
- secretKey: VAULT_APPROLE_ROLE_ID
|
||||
remoteRef:
|
||||
key: /cl01tl/vault/role/snapshot
|
||||
property: role-id
|
||||
- secretKey: VAULT_APPROLE_SECRET_ID
|
||||
remoteRef:
|
||||
key: /cl01tl/vault/role/snapshot
|
||||
property: secret-id
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: vault-backup-local-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: vault-backup-local-config
|
||||
{{- include "custom.labels" . | nindent 4 }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: openbao
|
||||
data:
|
||||
- secretKey: BUCKET
|
||||
remoteRef:
|
||||
key: /garage/home-infra/vault-backups
|
||||
property: BUCKET_PATH
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: vault-backup-remote-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: vault-backup-remote-config
|
||||
{{- include "custom.labels" . | nindent 4 }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: openbao
|
||||
data:
|
||||
- secretKey: BUCKET
|
||||
remoteRef:
|
||||
key: /garage/home-infra/vault-backups
|
||||
property: BUCKET_PATH
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: vault-unseal-config-1
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: vault-unseal-config-1
|
||||
{{- include "custom.labels" . | nindent 4 }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: openbao
|
||||
data:
|
||||
- secretKey: ENVIRONMENT
|
||||
remoteRef:
|
||||
key: /cl01tl/vault/unseal
|
||||
property: environment
|
||||
- secretKey: NODES
|
||||
remoteRef:
|
||||
key: /cl01tl/vault/unseal
|
||||
property: nodes
|
||||
- secretKey: TOKENS
|
||||
remoteRef:
|
||||
key: /cl01tl/vault/unseal
|
||||
property: tokens-1
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: vault-unseal-config-2
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: vault-unseal-config-2
|
||||
{{- include "custom.labels" . | nindent 4 }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: openbao
|
||||
data:
|
||||
- secretKey: ENVIRONMENT
|
||||
remoteRef:
|
||||
key: /cl01tl/vault/unseal
|
||||
property: environment
|
||||
- secretKey: NODES
|
||||
remoteRef:
|
||||
key: /cl01tl/vault/unseal
|
||||
property: nodes
|
||||
- secretKey: TOKENS
|
||||
remoteRef:
|
||||
key: /cl01tl/vault/unseal
|
||||
property: tokens-2
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: vault-unseal-config-3
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: vault-unseal-config-3
|
||||
{{- include "custom.labels" . | nindent 4 }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: openbao
|
||||
data:
|
||||
- secretKey: ENVIRONMENT
|
||||
remoteRef:
|
||||
key: /cl01tl/vault/unseal
|
||||
property: environment
|
||||
- secretKey: NODES
|
||||
remoteRef:
|
||||
key: /cl01tl/vault/unseal
|
||||
property: nodes
|
||||
- secretKey: TOKENS
|
||||
remoteRef:
|
||||
key: /cl01tl/vault/unseal
|
||||
property: tokens-3
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: vault-ntfy-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: vault-ntfy-config
|
||||
{{- include "custom.labels" . | nindent 4 }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: openbao
|
||||
data:
|
||||
- secretKey: NTFY_TOKEN
|
||||
remoteRef:
|
||||
key: /cl01tl/ntfy/users/cl01tl
|
||||
property: token
|
||||
- secretKey: NTFY_ENDPOINT
|
||||
remoteRef:
|
||||
key: /cl01tl/ntfy/config
|
||||
property: internal-endpoint
|
||||
- secretKey: NTFY_TOPIC
|
||||
remoteRef:
|
||||
key: /cl01tl/ntfy/topics
|
||||
property: vault
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: vault-ntfy-unseal-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: vault-ntfy-unseal-config
|
||||
{{- include "custom.labels" . | nindent 4 }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: openbao
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
NOTIFY_QUEUE_URLS: "{{ `{{ .endpoint }}` }}/{{ `{{ .topic }}` }}/?priority=4&tags=vault,unseal&title=Vault+Unsealed"
|
||||
data:
|
||||
- secretKey: endpoint
|
||||
remoteRef:
|
||||
key: /cl01tl/ntfy/users/cl01tl
|
||||
property: internal-endpoint-credential
|
||||
- secretKey: topic
|
||||
remoteRef:
|
||||
key: /cl01tl/ntfy/topics
|
||||
property: vault
|
||||
@@ -0,0 +1,26 @@
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: vault
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
{{- include "custom.labels" . | nindent 4 }}
|
||||
spec:
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: traefik-gateway
|
||||
namespace: traefik
|
||||
hostnames:
|
||||
- vault.alexlebens.net
|
||||
rules:
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
backendRefs:
|
||||
- group: ''
|
||||
kind: Service
|
||||
name: vault-active
|
||||
port: 8200
|
||||
@@ -0,0 +1,28 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: vault-tailscale
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: vault-tailscale
|
||||
{{- include "custom.labels" . | nindent 4 }}
|
||||
tailscale.com/proxy-class: no-metrics
|
||||
annotations:
|
||||
tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"
|
||||
spec:
|
||||
ingressClassName: tailscale
|
||||
tls:
|
||||
- hosts:
|
||||
- vault-cl01tl
|
||||
secretName: vault-cl01tl
|
||||
rules:
|
||||
- host: vault-cl01tl
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: vault-active
|
||||
port:
|
||||
number: 8200
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: vault-storage-backup
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: vault-storage-backup
|
||||
{{- include "custom.labels" . | nindent 4 }}
|
||||
spec:
|
||||
volumeMode: Filesystem
|
||||
storageClassName: ceph-filesystem
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
@@ -0,0 +1,38 @@
|
||||
apiVersion: secrets-store.csi.x-k8s.io/v1
|
||||
kind: SecretProviderClass
|
||||
metadata:
|
||||
name: vault-backup-local-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: vault-backup-local-config
|
||||
{{- include "custom.labels" . | nindent 4 }}
|
||||
spec:
|
||||
provider: openbao
|
||||
parameters:
|
||||
baoAddress: "http://openbao-internal.openbao:8200"
|
||||
roleName: vault
|
||||
objects: |
|
||||
- objectName: .s3cfg
|
||||
fileName: .s3cfg
|
||||
secretPath: secret/data/garage/home-infra/vault-backups
|
||||
secretKey: s3cfg-local
|
||||
|
||||
---
|
||||
apiVersion: secrets-store.csi.x-k8s.io/v1
|
||||
kind: SecretProviderClass
|
||||
metadata:
|
||||
name: vault-backup-remote-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: vault-backup-remote-config
|
||||
{{- include "custom.labels" . | nindent 4 }}
|
||||
spec:
|
||||
provider: openbao
|
||||
parameters:
|
||||
baoAddress: "http://openbao-internal.openbao:8200"
|
||||
roleName: vault
|
||||
objects: |
|
||||
- objectName: .s3cfg
|
||||
fileName: .s3cfg
|
||||
secretPath: secret/data/garage/home-infra/vault-backups
|
||||
secretKey: s3cfg-remote
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "custom.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
|
||||
{{- include "custom.labels" . | nindent 4 }}
|
||||
@@ -0,0 +1,314 @@
|
||||
vault:
|
||||
global:
|
||||
serverTelemetry:
|
||||
prometheusOperator: true
|
||||
injector:
|
||||
enabled: false
|
||||
server:
|
||||
enabled: true
|
||||
image:
|
||||
repository: hashicorp/vault
|
||||
tag: 2.0.0@sha256:e40c741ed95bb271425e3e6ca6c222d620cf8682f6f7a1b1e7c9d49d0aba484b
|
||||
updateStrategyType: RollingUpdate
|
||||
logLevel: debug
|
||||
logFormat: standard
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 512Mi
|
||||
authDelegator:
|
||||
enabled: false
|
||||
livenessProbe:
|
||||
enabled: false
|
||||
volumes:
|
||||
- name: vault-storage-backup
|
||||
persistentVolumeClaim:
|
||||
claimName: vault-storage-backup
|
||||
volumeMounts:
|
||||
- mountPath: /opt/backups/
|
||||
name: vault-storage-backup
|
||||
readOnly: false
|
||||
dataStorage:
|
||||
size: 1Gi
|
||||
storageClass: ceph-block
|
||||
auditStorage:
|
||||
enabled: false
|
||||
size: 5Gi
|
||||
storageClass: ceph-block
|
||||
standalone:
|
||||
enabled: false
|
||||
ha:
|
||||
enabled: true
|
||||
raft:
|
||||
enabled: true
|
||||
config: |
|
||||
ui = true
|
||||
|
||||
listener "tcp" {
|
||||
tls_disable = 1
|
||||
address = "[::]:8200"
|
||||
cluster_address = "[::]:8201"
|
||||
telemetry {
|
||||
unauthenticated_metrics_access = "true"
|
||||
}
|
||||
}
|
||||
|
||||
storage "raft" {
|
||||
path = "/vault/data"
|
||||
retry_join {
|
||||
leader_api_addr = "http://vault-0.vault-internal:8200"
|
||||
}
|
||||
retry_join {
|
||||
leader_api_addr = "http://vault-1.vault-internal:8200"
|
||||
}
|
||||
retry_join {
|
||||
leader_api_addr = "http://vault-2.vault-internal:8200"
|
||||
}
|
||||
}
|
||||
|
||||
service_registration "kubernetes" {}
|
||||
|
||||
telemetry {
|
||||
prometheus_retention_time = "30s"
|
||||
disable_hostname = true
|
||||
}
|
||||
disruptionBudget:
|
||||
enabled: true
|
||||
maxUnavailable: 1
|
||||
serverTelemetry:
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
prometheusRules:
|
||||
enabled: true
|
||||
rules:
|
||||
- alert: vault-HighResponseTime
|
||||
annotations:
|
||||
message: The response time of Vault is over 500ms on average over the last 5 minutes.
|
||||
expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 500
|
||||
for: 5m
|
||||
labels:
|
||||
severity: warning
|
||||
- alert: vault-HighResponseTime
|
||||
annotations:
|
||||
message: The response time of Vault is over 1s on average over the last 5 minutes.
|
||||
expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 1000
|
||||
for: 5m
|
||||
labels:
|
||||
severity: critical
|
||||
snapshot:
|
||||
global:
|
||||
fullnameOverride: vault-snapshot
|
||||
controllers:
|
||||
snapshot:
|
||||
type: cronjob
|
||||
pod:
|
||||
automountServiceAccountToken: true
|
||||
cronjob:
|
||||
suspend: false
|
||||
timeZone: America/Chicago
|
||||
schedule: 0 4 * * *
|
||||
backoffLimit: 3
|
||||
parallelism: 1
|
||||
initContainers:
|
||||
snapshot:
|
||||
image:
|
||||
repository: hashicorp/vault
|
||||
tag: 2.0.0@sha256:e40c741ed95bb271425e3e6ca6c222d620cf8682f6f7a1b1e7c9d49d0aba484b
|
||||
command:
|
||||
- /bin/ash
|
||||
args:
|
||||
- -ec
|
||||
- /scripts/snapshot.sh
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: vault-snapshot-agent-role
|
||||
env:
|
||||
- name: VAULT_ADDR
|
||||
value: http://vault-active.vault.svc.cluster.local:8200
|
||||
containers:
|
||||
s3-backup-local:
|
||||
image:
|
||||
repository: d3fk/s3cmd
|
||||
tag: latest@sha256:d66cc5677b30b31a7981f9fde0af064a9072e8b8a57d5e9b4cc02f44f02acbf2
|
||||
command:
|
||||
- /bin/sh
|
||||
args:
|
||||
- -ec
|
||||
- /scripts/backup.sh
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: vault-ntfy-config
|
||||
env:
|
||||
- name: BUCKET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: vault-backup-local-config
|
||||
key: BUCKET
|
||||
- name: TARGET
|
||||
value: Local
|
||||
s3-backup-remote:
|
||||
image:
|
||||
repository: d3fk/s3cmd
|
||||
tag: latest@sha256:d66cc5677b30b31a7981f9fde0af064a9072e8b8a57d5e9b4cc02f44f02acbf2
|
||||
command:
|
||||
- /bin/sh
|
||||
args:
|
||||
- -ec
|
||||
- /scripts/backup.sh
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: vault-ntfy-config
|
||||
env:
|
||||
- name: BUCKET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: vault-backup-remote-config
|
||||
key: BUCKET
|
||||
- name: TARGET
|
||||
value: Remote
|
||||
persistence:
|
||||
snapshot-script:
|
||||
enabled: true
|
||||
type: configMap
|
||||
name: vault-snapshot-script
|
||||
defaultMode: 0755
|
||||
advancedMounts:
|
||||
snapshot:
|
||||
snapshot:
|
||||
- path: /scripts/snapshot.sh
|
||||
subPath: snapshot.sh
|
||||
backup-script:
|
||||
enabled: true
|
||||
type: configMap
|
||||
name: vault-backup-script
|
||||
defaultMode: 0755
|
||||
advancedMounts:
|
||||
snapshot:
|
||||
s3-backup-local:
|
||||
- path: /scripts/backup.sh
|
||||
subPath: backup.sh
|
||||
s3-backup-remote:
|
||||
- path: /scripts/backup.sh
|
||||
subPath: backup.sh
|
||||
s3-backup-external:
|
||||
- path: /scripts/backup.sh
|
||||
subPath: backup.sh
|
||||
backup-local-config:
|
||||
type: custom
|
||||
volumeSpec:
|
||||
csi:
|
||||
driver: secrets-store.csi.k8s.io
|
||||
readOnly: true
|
||||
volumeAttributes:
|
||||
secretProviderClass: vault-backup-local-config
|
||||
advancedMounts:
|
||||
snapshot:
|
||||
s3-backup-local:
|
||||
- path: /root/.s3cfg
|
||||
readOnly: true
|
||||
mountPropagation: None
|
||||
subPath: .s3cfg
|
||||
backup-remote-config:
|
||||
type: custom
|
||||
volumeSpec:
|
||||
csi:
|
||||
driver: secrets-store.csi.k8s.io
|
||||
readOnly: true
|
||||
volumeAttributes:
|
||||
secretProviderClass: vault-backup-remote-config
|
||||
advancedMounts:
|
||||
snapshot:
|
||||
s3-backup-remote:
|
||||
- path: /root/.s3cfg
|
||||
readOnly: true
|
||||
mountPropagation: None
|
||||
subPath: .s3cfg
|
||||
backup-external-config:
|
||||
type: custom
|
||||
volumeSpec:
|
||||
csi:
|
||||
driver: secrets-store.csi.k8s.io
|
||||
readOnly: true
|
||||
volumeAttributes:
|
||||
secretProviderClass: vault-backup-external-config
|
||||
advancedMounts:
|
||||
snapshot:
|
||||
s3-backup-external:
|
||||
- path: /root/.s3cfg
|
||||
readOnly: true
|
||||
mountPropagation: None
|
||||
subPath: .s3cfg
|
||||
backup:
|
||||
existingClaim: vault-storage-backup
|
||||
advancedMounts:
|
||||
snapshot:
|
||||
snapshot:
|
||||
- path: /opt/backup
|
||||
readOnly: false
|
||||
s3-backup-local:
|
||||
- path: /opt/backup
|
||||
readOnly: false
|
||||
s3-backup-remote:
|
||||
- path: /opt/backup
|
||||
readOnly: false
|
||||
s3-backup-external:
|
||||
- path: /opt/backup
|
||||
readOnly: false
|
||||
unseal:
|
||||
global:
|
||||
fullnameOverride: vault-unseal
|
||||
controllers:
|
||||
unseal-1:
|
||||
type: deployment
|
||||
replicas: 1
|
||||
strategy: Recreate
|
||||
containers:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/lrstanley/vault-unseal
|
||||
tag: 1.0.0@sha256:9b936fadc8dea2a473972806bffc218a4dd2fbc3b373566138a60e058cc544aa
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: vault-unseal-config-1
|
||||
- secretRef:
|
||||
name: vault-ntfy-unseal-config
|
||||
resources:
|
||||
requests:
|
||||
cpu: 1m
|
||||
memory: 10Mi
|
||||
unseal-2:
|
||||
type: deployment
|
||||
replicas: 1
|
||||
strategy: Recreate
|
||||
containers:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/lrstanley/vault-unseal
|
||||
tag: 1.0.0@sha256:9b936fadc8dea2a473972806bffc218a4dd2fbc3b373566138a60e058cc544aa
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: vault-unseal-config-2
|
||||
- secretRef:
|
||||
name: vault-ntfy-unseal-config
|
||||
resources:
|
||||
requests:
|
||||
cpu: 1m
|
||||
memory: 10Mi
|
||||
unseal-3:
|
||||
type: deployment
|
||||
replicas: 1
|
||||
strategy: Recreate
|
||||
containers:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/lrstanley/vault-unseal
|
||||
tag: 1.0.0@sha256:9b936fadc8dea2a473972806bffc218a4dd2fbc3b373566138a60e058cc544aa
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: vault-unseal-config-3
|
||||
- secretRef:
|
||||
name: vault-ntfy-unseal-config
|
||||
resources:
|
||||
requests:
|
||||
cpu: 1m
|
||||
memory: 10Mi
|
||||
@@ -7,6 +7,6 @@ dependencies:
|
||||
version: 7.15.0
|
||||
- name: valkey
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.9.0
|
||||
digest: sha256:848a8909b9501f6fd3561dd7eb2cff70773c423830504974d8ebb215de02a807
|
||||
generated: "2026-05-21T20:10:56.867322828Z"
|
||||
version: 0.8.0
|
||||
digest: sha256:04ea98422ecc9be6841f35f9b9a248d2ec6ba98d5037246b035e02041e868baf
|
||||
generated: "2026-05-19T16:35:07.738203081Z"
|
||||
|
||||
@@ -25,7 +25,7 @@ dependencies:
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: valkey
|
||||
alias: valkey
|
||||
version: 0.9.0
|
||||
version: 0.8.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/yamtrack.png
|
||||
# renovate: datasource=github-releases depName=FuzzyGrim/Yamtrack
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
services:
|
||||
tailscale-invoke-ai:
|
||||
image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
|
||||
image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
|
||||
container_name: tailscale-invoke-ai
|
||||
cap_add:
|
||||
- net_admin
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
services:
|
||||
tailscale-ollama:
|
||||
image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
|
||||
image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
|
||||
container_name: tailscale-ollama
|
||||
cap_add:
|
||||
- net_admin
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
services:
|
||||
tailscale-stable-diffusion:
|
||||
image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
|
||||
image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
|
||||
container_name: tailscale-stable-diffusion
|
||||
cap_add:
|
||||
- net_admin
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
services:
|
||||
tailscale-blocky:
|
||||
image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
|
||||
image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
|
||||
container_name: tailscale-blocky
|
||||
cap_add:
|
||||
- net_admin
|
||||
|
||||
@@ -142,6 +142,7 @@ customDNS:
|
||||
sparkyfitness IN CNAME traefik-cl01tl
|
||||
tdarr IN CNAME traefik-cl01tl
|
||||
tubearchivist IN CNAME traefik-cl01tl
|
||||
vault IN CNAME traefik-cl01tl
|
||||
whodb IN CNAME traefik-cl01tl
|
||||
yamtrack IN CNAME traefik-cl01tl
|
||||
yubal IN CNAME traefik-cl01tl
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
services:
|
||||
tailscale-blocky:
|
||||
image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
|
||||
image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
|
||||
container_name: tailscale-blocky
|
||||
cap_add:
|
||||
- net_admin
|
||||
|
||||
@@ -163,6 +163,7 @@ customDNS:
|
||||
sparkyfitness IN CNAME traefik-cl01tl
|
||||
tdarr IN CNAME traefik-cl01tl
|
||||
tubearchivist IN CNAME traefik-cl01tl
|
||||
vault IN CNAME traefik-cl01tl
|
||||
whodb IN CNAME traefik-cl01tl
|
||||
yamtrack IN CNAME traefik-cl01tl
|
||||
yubal IN CNAME traefik-cl01tl
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
services:
|
||||
tailscale-blocky:
|
||||
image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
|
||||
image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
|
||||
container_name: tailscale-blocky
|
||||
cap_add:
|
||||
- net_admin
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
services:
|
||||
tailscale-garage:
|
||||
image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
|
||||
image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
|
||||
container_name: tailscale-garage
|
||||
cap_add:
|
||||
- net_admin
|
||||
@@ -20,7 +20,7 @@ services:
|
||||
- /dev/net/tun:/dev/net/tun
|
||||
|
||||
tailscale-garage-ui:
|
||||
image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
|
||||
image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
|
||||
container_name: tailscale-garage-ui
|
||||
cap_add:
|
||||
- net_admin
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
services:
|
||||
tailscale-gitea:
|
||||
image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
|
||||
image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
|
||||
container_name: tailscale-gitea
|
||||
cap_add:
|
||||
- net_admin
|
||||
@@ -33,7 +33,7 @@ services:
|
||||
- postgresql18:/var/lib/postgresql
|
||||
|
||||
gitea:
|
||||
image: gitea/gitea:1.26.2@sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031
|
||||
image: gitea/gitea:1.26.1@sha256:d8667667b4ccbd1f67b86a376bffcc0a17b16cf71309ed04e3918231776d47dd
|
||||
container_name: gitea
|
||||
depends_on:
|
||||
- postgresql
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
services:
|
||||
tailscale-homepage:
|
||||
image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
|
||||
image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
|
||||
container_name: tailscale-homepage
|
||||
cap_add:
|
||||
- net_admin
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
services:
|
||||
tailscale-komodo-periphery:
|
||||
image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
|
||||
image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
|
||||
container_name: tailscale-komodo-periphery
|
||||
cap_add:
|
||||
- net_admin
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
services:
|
||||
tailscale-node-exporter:
|
||||
image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
|
||||
image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
|
||||
container_name: tailscale-node-exporter
|
||||
cap_add:
|
||||
- net_admin
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
services:
|
||||
tailscale:
|
||||
image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
|
||||
image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
|
||||
container_name: tailscale-subnet
|
||||
cap_add:
|
||||
- net_admin
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
services:
|
||||
tailscale-traefik:
|
||||
image: ghcr.io/tailscale/tailscale:v1.98.3@sha256:854b77123b9536adae2e97f5a5fdb1790ed03438b911ab7f07780155e0af6ce2
|
||||
image: ghcr.io/tailscale/tailscale:v1.96.5@sha256:dbeff02d2337344b351afac203427218c4d0a06c43fc10a865184063498472a6
|
||||
container_name: tailscale-traefik
|
||||
cap_add:
|
||||
- net_admin
|
||||
|
||||
Reference in New Issue
Block a user