Merge branch 'tmp/secrets-5' of https://gitea.alexlebens.net/alexlebens/infrastructure into tmp/secrets-5

feat: add more
2026-04-23 17:44:45 -05:00 · 2026-04-23 17:25:56 -05:00 · 2026-04-23 16:40:37 -05:00 · 2026-04-22 20:12:26 -05:00 · 2026-04-22 19:38:17 -05:00 · 2026-04-22 19:14:38 -05:00
219 changed files with 1685 additions and 2011 deletions
--- a/.gitea/workflows/lint-test-helm.yaml
+++ b/.gitea/workflows/lint-test-helm.yaml
@@ -169,10 +169,9 @@ jobs:

          echo ">> Running linting on changed charts ..."

-          lint_chart() {
-            local DIR="$1"
-            local CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
-            local CHART_NAME=$(basename "${CHART_PATH}")
+          for DIR in ${CHANGED_CHARTS}; do
+            CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
+            CHART_NAME=$(basename "${CHART_PATH}")

            if [ -f "${CHART_PATH}/Chart.yaml" ]; then
              echo ""
@@ -183,8 +182,15 @@ jobs:
              echo ">> Linting helm chart ${CHART_NAME} ..."

              if ! helm lint "${CHART_PATH}" --namespace "default"; then
-                echo "${DIR}" > ".failed_chart_${CHART_NAME}"
-                return 1
+                EXIT_CODE=1
+
+                if [ -z "${FAILED_CHARTS}" ]; then
+                  FAILED_CHARTS="${DIR}"
+
+                else
+                  FAILED_CHARTS="${FAILED_CHARTS}, ${DIR}"
+
+                fi
              fi

            else
@@ -192,20 +198,8 @@ jobs:
              echo ">> Directory ${CHART_PATH} does not contain a Chart.yaml. Skipping ..."

            fi
-          }

-          export -f lint_chart
-          export CLUSTER
-
-          for DIR in ${CHANGED_CHARTS}; do
-            echo "${DIR}"
-          done | xargs -P 4 -I {} bash -c 'OUT=$(lint_chart "$@" 2>&1); printf "%s\n" "$OUT"' _ {}
-
-          if ls .failed_chart_* 1> /dev/null 2>&1; then
-            EXIT_CODE=1
-            FAILED_CHARTS=$(cat .failed_chart_* | paste -sd ',' - | sed 's/,/, /g')
-            rm -f .failed_chart_*
-          fi
+          done

          echo ""
          echo "----"
@@ -335,9 +329,8 @@ jobs:
          EXIT_CODE=0
          FAILED_CHARTS=""

-          validate_chart() {
-            local DIR="$1"
-            local CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
+          for DIR in ${CHANGED_CHARTS}; do
+            CHART_PATH="clusters/${CLUSTER}/helm/${DIR}"
            echo ""
            echo ">> Validating: ${DIR}"

@@ -350,23 +343,18 @@ jobs:
                -strict \
                -summary; then

-              echo "${DIR}" > ".failed_chart_${DIR}"
-              return 1
+              EXIT_CODE=1
+
+              if [ -z "${FAILED_CHARTS}" ]; then
+                FAILED_CHARTS="${DIR}"
+
+              else
+                FAILED_CHARTS="${FAILED_CHARTS}, ${DIR}"
+
+              fi
            fi
-          }

-          export -f validate_chart
-          export CLUSTER SCHEMA_LOCATIONS
-
-          for DIR in ${CHANGED_CHARTS}; do
-            echo "${DIR}"
-          done | xargs -P 4 -I {} bash -c 'OUT=$(validate_chart "$@" 2>&1); printf "%s\n" "$OUT"' _ {}
-
-          if ls .failed_chart_* 1> /dev/null 2>&1; then
-            EXIT_CODE=1
-            FAILED_CHARTS=$(cat .failed_chart_* | paste -sd ',' - | sed 's/,/, /g')
-            rm -f .failed_chart_*
-          fi
+          done

          echo ""
          echo "----"
--- a/.gitea/workflows/renovate.yaml
+++ b/.gitea/workflows/renovate.yaml
@@ -12,8 +12,8 @@ on:

 jobs:
  renovate:
-    runs-on: ubuntu-js
-    container: ghcr.io/renovatebot/renovate:43.144.0@sha256:d6c68d8226a0b4f1fc00942f1c14b33d5135c6c52e8c9d29a2588b46f199c14f
+    runs-on: ubuntu-latest
+    container: ghcr.io/renovatebot/renovate:43.139.6@sha256:2ed9f867ea7a7d2448847ce704f78af09e9b881c63f843a1aa0f590691737c42
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
--- a/clusters/cl01tl/helm/actual/Chart.lock
+++ b/clusters/cl01tl/helm/actual/Chart.lock
@@ -2,8 +2,5 @@ dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.6.2
- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:ee1ff98af82f76ddf0b672abf9f4973ae41faff3cd61d81849f496c089cfdbd3
-generated: "2026-04-26T14:57:34.863614-05:00"
+digest: sha256:1c04c187e6cf768117f7f91f3a3b082937ad5854c1cf6a681ad7c02687cd543d
+generated: "2026-04-18T20:15:22.778699-05:00"
--- a/clusters/cl01tl/helm/actual/Chart.yaml
+++ b/clusters/cl01tl/helm/actual/Chart.yaml
@@ -18,10 +18,10 @@ dependencies:
    alias: actual
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.6.2
-  - name: volsync-target
-    alias: volsync-target-data
-    version: 1.0.0
-    repository: oci://harbor.alexlebens.net/helm-charts
+  # - name: volsync-target
+  #   alias: volsync-target-data
+  #   version: 0.8.0
+  #   repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/actual-budget.png
 # renovate: datasource=github-releases depName=actualbudget/actual
 appVersion: 26.4.0
--- a/clusters/cl01tl/helm/argocd/Chart.lock
+++ b/clusters/cl01tl/helm/argocd/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
  repository: https://argoproj.github.io/argo-helm
-  version: 9.5.4
-digest: sha256:3d21f3de99812af73615ef0e75f835d41d49b81a840107194b44e06057d7311f
-generated: "2026-04-24T18:07:49.106452954Z"
+  version: 9.5.2
+digest: sha256:5d9e6405ee944bf94df6af247164ebb9b8899144853b9a7eafabe8606affe84e
+generated: "2026-04-19T19:53:40.43789-05:00"
--- a/clusters/cl01tl/helm/argocd/Chart.yaml
+++ b/clusters/cl01tl/helm/argocd/Chart.yaml
@@ -13,8 +13,8 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: argo-cd
-    version: 9.5.4
+    version: 9.5.2
    repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-cd
-appVersion: v3.3.8
+appVersion: v3.3.7
--- a/clusters/cl01tl/helm/argocd/templates/prometheus-rule.yaml
+++ b/clusters/cl01tl/helm/argocd/templates/prometheus-rule.yaml
@@ -1,108 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: haproxy
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: haproxy
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  groups:
-    - name: EmbeddedExporter
-      rules:
-        - alert: HAProxyHighHTTP4xxErrorRateBackend
-          expr: ((sum by (proxy) (rate(haproxy_server_http_responses_total{code="4xx"}[1m])) / sum by (proxy) (rate(haproxy_server_http_responses_total[1m]))) * 100) > 5 and sum by (proxy) (rate(haproxy_server_http_responses_total[1m])) > 0
-          for: 1m
-          labels:
-            severity: critical
-          annotations:
-            summary: HAProxy high HTTP 4xx error rate backend (instance {{ `{{ $labels.instance }}` }})
-            description: "Too many HTTP requests with status 4xx (> 5%) on backend {{ `{{ $labels.proxy }}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyHighHTTP5xxErrorRateBackend
-          expr: ((sum by (proxy) (rate(haproxy_server_http_responses_total{code="5xx"}[1m])) / sum by (proxy) (rate(haproxy_server_http_responses_total[1m]))) * 100) > 5 and sum by (proxy) (rate(haproxy_server_http_responses_total[1m])) > 0
-          for: 1m
-          labels:
-            severity: critical
-          annotations:
-            summary: HAProxy high HTTP 5xx error rate backend (instance {{ `{{ $labels.instance }}` }})
-            description: "Too many HTTP requests with status 5xx (> 5%) on backend {{ `{{ $labels.proxy }}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyHighHTTP4xxErrorRateServer
-          expr: ((sum by (server) (rate(haproxy_server_http_responses_total{code="4xx"}[1m])) / sum by (server) (rate(haproxy_server_http_responses_total[1m]))) * 100) > 5 and sum by (server) (rate(haproxy_server_http_responses_total[1m])) > 0
-          for: 1m
-          labels:
-            severity: critical
-          annotations:
-            summary: HAProxy high HTTP 4xx error rate server (instance {{ `{{ $labels.instance }}` }})
-            description: "Too many HTTP requests with status 4xx (> 5%) on server {{ `{{ $labels.server }}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyHighHTTP5xxErrorRateServer
-          expr: ((sum by (server) (rate(haproxy_server_http_responses_total{code="5xx"}[1m])) / sum by (server) (rate(haproxy_server_http_responses_total[1m]))) * 100) > 5 and sum by (server) (rate(haproxy_server_http_responses_total[1m])) > 0
-          for: 1m
-          labels:
-            severity: critical
-          annotations:
-            summary: HAProxy high HTTP 5xx error rate server (instance {{ `{{ $labels.instance }}` }})
-            description: "Too many HTTP requests with status 5xx (> 5%) on server {{ `{{ $labels.server }}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyServerResponseErrors
-          expr: (sum by (server) (rate(haproxy_server_response_errors_total[1m])) / sum by (server) (rate(haproxy_server_http_responses_total[1m]))) * 100 > 5 and sum by (server) (rate(haproxy_server_http_responses_total[1m])) > 0
-          for: 1m
-          labels:
-            severity: critical
-          annotations:
-            summary: HAProxy server response errors (instance {{ `{{ $labels.instance }}` }})
-            description: "Too many response errors to {{ `{{ $labels.server }}` }} server (> 5%).\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyBackendConnectionErrors
-          expr: (sum by (proxy) (rate(haproxy_backend_connection_errors_total[1m]))) > 100
-          for: 1m
-          labels:
-            severity: critical
-          annotations:
-            summary: HAProxy backend connection errors (instance {{ `{{ $labels.instance }}` }})
-            description: "Too many connection errors to {{ `{{ $labels.proxy }}` }} backend (> 100 req/s). Request throughput may be too high.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyServerConnectionErrors
-          expr: (sum by (proxy) (rate(haproxy_server_connection_errors_total[1m]))) > 100
-          for: 0m
-          labels:
-            severity: critical
-          annotations:
-            summary: HAProxy server connection errors (instance {{ `{{ $labels.instance }}` }})
-            description: "Too many connection errors to {{ `{{ $labels.proxy }}` }} (> 100 req/s). Request throughput may be too high.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyBackendMaxActiveSession>80%
-          expr: (haproxy_backend_current_sessions / haproxy_backend_limit_sessions * 100) > 80 and haproxy_backend_limit_sessions > 0
-          for: 2m
-          labels:
-            severity: warning
-          annotations:
-            summary: HAProxy backend max active session > 80% (instance {{ `{{ $labels.instance }}` }})
-            description: "Session limit from backend {{ `{{ $labels.proxy }}` }} reached 80% of limit - {{ `{{ $value | printf \"%.2f\"}}` }}%\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyPendingRequests
-          expr: sum by (proxy) (haproxy_backend_current_queue) > 0
-          for: 2m
-          labels:
-            severity: warning
-          annotations:
-            summary: HAProxy pending requests (instance {{ `{{ $labels.instance }}` }})
-            description: "Some HAProxy requests are pending on {{ `{{ $labels.proxy }}` }} - {{ `{{ $value | printf \"%.2f\"}}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyRetryHigh
-          expr: sum by (proxy) (rate(haproxy_backend_retry_warnings_total[1m])) > 10
-          for: 2m
-          labels:
-            severity: warning
-          annotations:
-            summary: HAProxy retry high (instance {{ `{{ $labels.instance }}` }})
-            description: "High rate of retry on {{ `{{ $labels.proxy }}` }} - {{ `{{ $value | printf \"%.2f\"}}` }}\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyFrontendSecurityBlockedRequests
-          expr: sum by (proxy) (rate(haproxy_frontend_denied_connections_total[2m])) > 10
-          for: 2m
-          labels:
-            severity: warning
-          annotations:
-            summary: HAProxy frontend security blocked requests (instance {{ `{{ $labels.instance }}` }})
-            description: "HAProxy is blocking requests for security reason\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: HAProxyServerHealthcheckFailure
-          expr: increase(haproxy_server_check_failures_total[1m]) > 2
-          for: 0m
-          labels:
-            severity: warning
-          annotations:
-            summary: HAProxy server healthcheck failure (instance {{ `{{ $labels.instance }}` }})
-            description: "Some server healthcheck are failing on {{ `{{ $labels.server }}` }} ({{ `{{ $value }}` }} in the last 1m)\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
--- a/clusters/cl01tl/helm/argocd/values.yaml
+++ b/clusters/cl01tl/helm/argocd/values.yaml
@@ -103,7 +103,7 @@ argo-cd:
      enabled: true
      image:
        repository: haproxy
-        tag: 3.3.6-alpine@sha256:4f97a2cb7f02fd08402259e74a65ef12fcfa3dff1ef78fddecb5228a17b7f4ad
+        tag: 3.3.6-alpine@sha256:744be2dca649a44d490a4c565d36968d19482dd387f1bdd44c168f4322bc6b1e
      resources:
        requests:
          cpu: 5m
--- a/clusters/cl01tl/helm/audiobookshelf/Chart.lock
+++ b/clusters/cl01tl/helm/audiobookshelf/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 4.6.2
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
+  version: 0.8.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:c6af4b1dd96410281d53ff8f63235bc79bd9a1d493d6da097d9e4ff088e09538
-generated: "2026-04-26T14:57:40.219612-05:00"
+  version: 0.8.0
+digest: sha256:7ee4cfdf7f908401c39b3cda0cf8783b25dcb9cf93e7c911609bab9e303ec5bf
+generated: "2026-03-06T01:05:03.534042627Z"
--- a/clusters/cl01tl/helm/audiobookshelf/Chart.yaml
+++ b/clusters/cl01tl/helm/audiobookshelf/Chart.yaml
@@ -24,11 +24,11 @@ dependencies:
    version: 4.6.2
  - name: volsync-target
    alias: volsync-target-config
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-metadata
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/audiobookshelf.png
 # renovate: datasource=github-releases depName=advplyr/audiobookshelf
--- a/clusters/cl01tl/helm/audiobookshelf/values.yaml
+++ b/clusters/cl01tl/helm/audiobookshelf/values.yaml
@@ -23,7 +23,7 @@ audiobookshelf:
        apprise-api:
          image:
            repository: ghcr.io/caronc/apprise
-            tag: v1.4.0@sha256:9d97a6b9b42cf6afdf3b5466dbed2a59cd42a4bb777ec6aa57b5f2ee623569eb
+            tag: v1.3.3@sha256:4bfeac268ba87b8e08e308c9aa0182fe99e9501ec464027afc333d1634e65977
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/authentik/Chart.lock
+++ b/clusters/cl01tl/helm/authentik/Chart.lock
@@ -4,12 +4,12 @@ dependencies:
  version: 2026.2.2
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.6.0
+  version: 2.5.0
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.6.1
-digest: sha256:d1dbca83e5b63a58a9bf9f2903d1b45bbadca3e8599541367bc61ef2ce938cdb
-generated: "2026-04-24T21:50:21.398658595Z"
+digest: sha256:22fe4d9ec592aa74cbff5596e8d900f607bd68ea14c7df70a94b4ef76727614d
+generated: "2026-04-13T20:32:12.748342469Z"
--- a/clusters/cl01tl/helm/authentik/Chart.yaml
+++ b/clusters/cl01tl/helm/authentik/Chart.yaml
@@ -22,10 +22,10 @@ dependencies:
    repository: https://charts.goauthentik.io/
  - name: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.6.0
+    version: 2.5.0
  - name: postgres-cluster
    alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey
--- a/clusters/cl01tl/helm/backrest/Chart.lock
+++ b/clusters/cl01tl/helm/backrest/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 4.6.2
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
+  version: 0.8.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:4c3010c4ef30f7baaad7564d1fda9bdfe18184fab0e3f47a8a1f4c74e340e557
-generated: "2026-04-24T22:50:23.056323614Z"
+  version: 0.8.0
+digest: sha256:f203538010828e77336f3cf39451a1072c90aeb8ece7c173a3476c49883b46d1
+generated: "2026-03-06T01:05:24.935421139Z"
--- a/clusters/cl01tl/helm/backrest/Chart.yaml
+++ b/clusters/cl01tl/helm/backrest/Chart.yaml
@@ -20,11 +20,11 @@ dependencies:
    version: 4.6.2
  - name: volsync-target
    alias: volsync-target-config
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-data
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/backrest.png
 # renovate: datasource=github-releases depName=garethgeorge/backrest
--- a/clusters/cl01tl/helm/bazarr/Chart.lock
+++ b/clusters/cl01tl/helm/bazarr/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 4.6.2
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:ee94a588fa517303597c8a6159befdbac00b651afc5c1d7c779b3cb28d3ba8c6
-generated: "2026-04-24T22:50:33.529825344Z"
+  version: 0.8.0
+digest: sha256:ce88e4cd451613c9dbc25d285700970789ff678452ef277f3c8465dbf6157f1f
+generated: "2026-03-06T01:05:44.405374459Z"
--- a/clusters/cl01tl/helm/bazarr/Chart.yaml
+++ b/clusters/cl01tl/helm/bazarr/Chart.yaml
@@ -24,7 +24,7 @@ dependencies:
    version: 4.6.2
  - name: volsync-target
    alias: volsync-target-config
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/bazarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-bazarr
--- a/clusters/cl01tl/helm/cert-manager/templates/prometheus-rule.yaml
+++ b/clusters/cl01tl/helm/cert-manager/templates/prometheus-rule.yaml
@@ -1,44 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: cert-manager
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: cert-manager
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  groups:
-    - name: EmbeddedExporter
-      rules:
-        - alert: Cert-ManagerAbsent
-          expr: absent(up{job="cert-manager"})
-          for: 10m
-          labels:
-            severity: critical
-          annotations:
-            summary: Cert-Manager absent (instance {{ `{{ $labels.instance }}` }})
-            description: "Cert-Manager has disappeared from Prometheus service discovery. New certificates will not be able to be minted, and existing ones can't be renewed until cert-manager is back.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: Cert-ManagerCertificateExpiringSoon
-          expr: avg by (exported_namespace, namespace, name) (certmanager_certificate_expiration_timestamp_seconds - time()) < (21 * 24 * 3600)
-          for: 1h
-          labels:
-            severity: warning
-          annotations:
-            summary: Cert-Manager certificate expiring soon (instance {{ `{{ $labels.instance }}` }})
-            description: "The certificate {{ `{{ $labels.name }}` }} is expiring in less than 21 days.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: Cert-ManagerCertificateNotReady
-          expr: max by (name, exported_namespace, namespace, condition) (certmanager_certificate_ready_status{condition!="True"} == 1)
-          for: 10m
-          labels:
-            severity: critical
-          annotations:
-            summary: Cert-Manager certificate not ready (instance {{ `{{ $labels.instance }}` }})
-            description: "The certificate {{ `{{ $labels.name }}` }} in namespace {{ `{{ $labels.exported_namespace }}` }} is not ready to serve traffic.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: Cert-ManagerHittingACMERateLimits
-          expr: sum by (host) (rate(certmanager_acme_client_request_count{status="429"}[5m])) > 0
-          for: 5m
-          labels:
-            severity: critical
-          annotations:
-            summary: Cert-Manager hitting ACME rate limits (instance {{ `{{ $labels.instance }}` }})
-            description: "Cert-Manager is being rate-limited by the ACME provider. Certificate issuance and renewal may be blocked for up to a week.\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
--- a/clusters/cl01tl/helm/cloudnative-pg/Chart.lock
+++ b/clusters/cl01tl/helm/cloudnative-pg/Chart.lock
@@ -5,11 +5,5 @@ dependencies:
 - name: plugin-barman-cloud
  repository: https://cloudnative-pg.io/charts/
  version: 0.6.0
- name: rclone-bucket
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.3
- name: rclone-bucket
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.3
-digest: sha256:75d7078b7009082521a1bb8b49141e20b442343dabe7f76f5e7a16a352cfe205
-generated: "2026-04-26T15:36:31.678086-05:00"
+digest: sha256:48241acb753e635a01b306b90cfbce13ed3c0105a33ec7d36f159e3a7fe607f3
+generated: "2026-04-14T09:03:10.332065288Z"
--- a/clusters/cl01tl/helm/cloudnative-pg/Chart.yaml
+++ b/clusters/cl01tl/helm/cloudnative-pg/Chart.yaml
@@ -13,7 +13,6 @@ sources:
  - https://github.com/cloudnative-pg/postgres-containers/pkgs/container/postgresql
  - https://github.com/cloudnative-pg/charts/tree/main/charts/cloudnative-pg
  - https://github.com/cloudnative-pg/charts/tree/main/charts/plugin-barman-cloud
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/rclone-bucket
 maintainers:
  - name: alexlebens
 dependencies:
@@ -23,14 +22,6 @@ dependencies:
  - name: plugin-barman-cloud
    version: 0.6.0
    repository: https://cloudnative-pg.io/charts/
-  - name: rclone-bucket
-    alias: rclone-postgres-backups-remote
-    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.4.3
-  - name: rclone-bucket
-    alias: rclone-postgres-backups-external
-    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.4.3
 icon: https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg.github.io/refs/heads/main/assets/images/hero_image.png
 # renovate: datasource=github-releases depName=cloudnative-pg/cloudnative-pg
 appVersion: 1.29.0
--- a/clusters/cl01tl/helm/cloudnative-pg/values.yaml
+++ b/clusters/cl01tl/helm/cloudnative-pg/values.yaml
@@ -14,62 +14,3 @@ plugin-barman-cloud:
    requests:
      cpu: 1m
      memory: 20Mi
-rclone-postgres-backups-remote:
-  nameOverride: postgres-backups-remote-rclone
-  cronJob:
-    suspend: false
-    schedule: 0 6 * * 6
-  rclone:
-    source:
-      bucketName: postgres-backups
-    destination:
-      bucketName: postgres-backups
-  prune:
-    enabled: true
-    ageToPrune: 45d
-    include: "/cl01tl/*/*/*/base/**"
-    exclude: "**/walls/**"
-  secret:
-    externalSecret:
-      source:
-        credentials:
-          path: /garage/home-infra/postgres-backups
-        config:
-          path: /garage/config
-      destination:
-        credentials:
-          path: /garage/home-infra/postgres-backups
-        config:
-          path: /garage/config
-rclone-postgres-backups-external:
-  nameOverride: postgres-backups-external-rclone
-  cronJob:
-    suspend: true
-    schedule: 0 6 * * 6
-  rclone:
-    source:
-      bucketName: openbao-backups
-    destination:
-      bucketName: postgres-backups-ecc1010276b61716
-      providerType: DigitalOcean
-  prune:
-    enabled: true
-    ageToPrune: 45d
-    include: "/cl01tl/*/*/*/base/**"
-    exclude: "**/walls/**"
-  secret:
-    externalSecret:
-      source:
-        credentials:
-          path: /garage/home-infra/postgres-backups
-        config:
-          path: /garage/config
-      destination:
-        credentials:
-          path: /digital-ocean/home-infra/postgres-backups
-          keyIdProperty: AWS_ACCESS_KEY_ID
-          secretKeyProperty: AWS_SECRET_ACCESS_KEY
-          regionProperty: AWS_REGION
-        config:
-          path: /digital-ocean/config
-          endpointProperty: ENDPOINT
--- a/clusters/cl01tl/helm/coredns/Chart.yaml
+++ b/clusters/cl01tl/helm/coredns/Chart.yaml
@@ -17,4 +17,4 @@ dependencies:
    repository: https://coredns.github.io/helm
 icon: https://raw.githubusercontent.com/coredns/coredns.io/refs/heads/master/static/images/favicon.png
 # renovate: datasource=github-releases depName=coredns/coredns
-appVersion: v1.14.3
+appVersion: v1.14.2
--- a/clusters/cl01tl/helm/dawarich/Chart.lock
+++ b/clusters/cl01tl/helm/dawarich/Chart.lock
@@ -4,18 +4,18 @@ dependencies:
  version: 4.6.2
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.6.1
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
+  version: 0.8.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
+  version: 0.8.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:675bca89787669fd5b23eb2d4b49a44acee2556044982bb634f678a39cec7db4
-generated: "2026-04-24T22:50:43.987901153Z"
+  version: 0.8.0
+digest: sha256:6ece439d5549b7d7ccd75053846bb9b2e8f9798a2e2163eac6f62bf5cf222587
+generated: "2026-04-13T20:32:54.380897459Z"
--- a/clusters/cl01tl/helm/dawarich/Chart.yaml
+++ b/clusters/cl01tl/helm/dawarich/Chart.yaml
@@ -22,7 +22,7 @@ dependencies:
    version: 4.6.2
  - name: postgres-cluster
    alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey
@@ -30,16 +30,16 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-storage
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-public
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-watched
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/dawarich.png
 # renovate: datasource=github-releases depName=Freika/dawarich
-appVersion: 1.7.0
+appVersion: 1.6.1
--- a/clusters/cl01tl/helm/dawarich/values.yaml
+++ b/clusters/cl01tl/helm/dawarich/values.yaml
@@ -8,7 +8,7 @@ dawarich:
        main:
          image:
            repository: freikin/dawarich
-            tag: 1.7.0@sha256:7d5f99c61121fcfa4cbdd6a153392630d9f059ffb0156759278d3e049085ec62
+            tag: 1.6.1@sha256:a884f69f19ce0f66992f3872d24544d1e587e133b8a003e072711aafc1e02429
          command:
            - "web-entrypoint.sh"
          args:
@@ -111,7 +111,7 @@ dawarich:
        sidekiq:
          image:
            repository: freikin/dawarich
-            tag: 1.7.0@sha256:7d5f99c61121fcfa4cbdd6a153392630d9f059ffb0156759278d3e049085ec62
+            tag: 1.6.1@sha256:a884f69f19ce0f66992f3872d24544d1e587e133b8a003e072711aafc1e02429
          command:
            - "sidekiq-entrypoint.sh"
          args:
@@ -161,12 +161,12 @@ dawarich:
            - name: OIDC_CLIENT_ID
              valueFrom:
                secretKeyRef:
-                  name: dawarich-oidc-authentik
+                  name: dawarich-oidc-secret
                  key: client
            - name: OIDC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
-                  name: dawarich-oidc-authentik
+                  name: dawarich-oidc-secret
                  key: secret
            - name: OIDC_PROVIDER_NAME
              value: Authentik
--- a/clusters/cl01tl/helm/democratic-csi-synology-iscsi/values.yaml
+++ b/clusters/cl01tl/helm/democratic-csi-synology-iscsi/values.yaml
@@ -47,8 +47,6 @@ democratic-csi:
        fsType: ext4
  node:
    hostPID: true
-    rbac:
-      enabled: true
    driver:
      extraEnv:
        - name: ISCSIADM_HOST_STRATEGY
@@ -61,4 +59,3 @@ democratic-csi:
    image:
      registry: registry.k8s.io/sig-storage/csi-node-driver-registrar
      tag: v2.16.0@sha256:ab482308a4921e28a6df09a16ab99a457e9af9641ff44fb1be1a690d07ce8b70
-  enablePSP: true
--- a/clusters/cl01tl/helm/directus/Chart.lock
+++ b/clusters/cl01tl/helm/directus/Chart.lock
@@ -4,12 +4,9 @@ dependencies:
  version: 4.6.2
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.6.1
- name: rclone-bucket
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.3
-digest: sha256:df3b79c6b8868d749d98d232741fef4a26b73894bce3bf4588581340c15fc3da
-generated: "2026-04-26T21:06:27.85398357Z"
+digest: sha256:78f5065d1125792c88e4d24f5ac1ee3d6310b4997f552020c44d0615335ea329
+generated: "2026-04-13T20:33:13.909018545Z"
--- a/clusters/cl01tl/helm/directus/Chart.yaml
+++ b/clusters/cl01tl/helm/directus/Chart.yaml
@@ -12,7 +12,6 @@ sources:
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/rclone-bucket
 maintainers:
  - name: alexlebens
 dependencies:
@@ -22,16 +21,12 @@ dependencies:
    version: 4.6.2
  - name: postgres-cluster
    alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey
    version: 0.6.1
    repository: oci://harbor.alexlebens.net/helm-charts
-  - name: rclone-bucket
-    alias: rclone-directus-assets-remote
-    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.4.3
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/directus.png
 # renovate: datasource=github-releases depName=directus/directus
 appVersion: 11.17.3
--- a/clusters/cl01tl/helm/directus/values.yaml
+++ b/clusters/cl01tl/helm/directus/values.yaml
@@ -214,24 +214,3 @@ valkey:
    # https://github.com/valkey-io/valkey-helm/issues/135
    metrics:
      enabled: false
-rclone-directus-assets-remote:
-  cronJob:
-    suspend: false
-    schedule: 0 0 * * *
-  rclone:
-    source:
-      bucketName: directus-assets
-    destination:
-      bucketName: directus-assets
-  secret:
-    externalSecret:
-      source:
-        credentials:
-          path: /garage/home-infra/directus-assets
-        config:
-          path: /garage/config
-      destination:
-        credentials:
-          path: /garage/home-infra/directus-assets
-        config:
-          path: /garage/config
--- a/clusters/cl01tl/helm/element-web/Chart.lock
+++ b/clusters/cl01tl/helm/element-web/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 1.4.34
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.6.0
-digest: sha256:e988be9f997351a8f658bf5151ec4fb04ae7d877389c9bf01b7331e1a58005ef
-generated: "2026-04-24T21:06:15.882448748Z"
+  version: 2.5.0
+digest: sha256:8640b8a250bdcd9e7561e3d28538ccf4644a7159a035ee0a5fdbcf71dc5b2bbe
+generated: "2026-04-10T01:17:19.932208699Z"
--- a/clusters/cl01tl/helm/element-web/Chart.yaml
+++ b/clusters/cl01tl/helm/element-web/Chart.yaml
@@ -19,7 +19,7 @@ dependencies:
    repository: https://ananace.gitlab.io/charts
  - name: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.6.0
+    version: 2.5.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/element.png
 # renovate: datasource=github-releases depName=element-hq/element-web
 appVersion: v1.12.15
--- a/clusters/cl01tl/helm/excalidraw/Chart.yaml
+++ b/clusters/cl01tl/helm/excalidraw/Chart.yaml
@@ -19,4 +19,4 @@ dependencies:
    version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/excalidraw.png
 # renovate: datasource=github-releases depName=excalidraw/excalidraw
-appVersion: v0.18.1
+appVersion: v0.18.0
--- a/clusters/cl01tl/helm/external-dns/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/external-dns/templates/external-secret.yaml
@@ -13,5 +13,5 @@ spec:
  data:
    - secretKey: api-key
      remoteRef:
-        key: /unifi/users/cl01tl
+        key: /unifi/auth/cl01tl
        property: api-key
--- a/clusters/cl01tl/helm/external-secrets/Chart.lock
+++ b/clusters/cl01tl/helm/external-secrets/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: external-secrets
  repository: https://charts.external-secrets.io
-  version: 2.4.0
-digest: sha256:a31b4ba5b5ec296036576c8d7d26f8b42061eec7142817f9ca0c256a457a2ea1
-generated: "2026-04-24T19:03:31.856576444Z"
+  version: 2.3.0
+digest: sha256:fedb79c937be24d4bb72f665122b468b445de95f3f02de419903e3136186e42f
+generated: "2026-04-10T15:10:52.488487421Z"
--- a/clusters/cl01tl/helm/external-secrets/Chart.yaml
+++ b/clusters/cl01tl/helm/external-secrets/Chart.yaml
@@ -14,8 +14,8 @@ sources:
 dependencies:
  - name: external-secrets
    alias: external-secrets
-    version: 2.4.0
+    version: 2.3.0
    repository: https://charts.external-secrets.io
 icon: https://raw.githubusercontent.com/external-secrets/external-secrets/refs/heads/main/assets/eso-logo-large.png
 # renovate: datasource=github-releases depName=external-secrets/external-secrets
-appVersion: v2.4.0
+appVersion: v2.3.0
--- a/clusters/cl01tl/helm/external-secrets/templates/cluster-secret-store.yaml
+++ b/clusters/cl01tl/helm/external-secrets/templates/cluster-secret-store.yaml
@@ -1,5 +1,25 @@
 apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
+metadata:
+  name: vault
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider:
+    vault:
+      server: http://vault-internal.vault:8200
+      path: secret
+      auth:
+        tokenSecretRef:
+          namespace: vault
+          name: vault-token
+          key: token
+
+---
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
 metadata:
  name: openbao
  namespace: {{ .Release.Namespace }}
--- a/clusters/cl01tl/helm/external-secrets/values.yaml
+++ b/clusters/cl01tl/helm/external-secrets/values.yaml
@@ -2,7 +2,7 @@ external-secrets:
  replicaCount: 3
  image:
    repository: ghcr.io/external-secrets/external-secrets
-    tag: v2.4.0@sha256:d2b74514f63f5b55360d08351f1fe5af3b1db794a81fa10389abe2ff2999c566
+    tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
  installCRDs: true
  crds:
    createClusterExternalSecret: true
@@ -29,7 +29,7 @@ external-secrets:
  webhook:
    image:
      repository: ghcr.io/external-secrets/external-secrets
-      tag: v2.4.0@sha256:d2b74514f63f5b55360d08351f1fe5af3b1db794a81fa10389abe2ff2999c566
+      tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
    resources:
      requests:
        cpu: 1m
@@ -37,7 +37,7 @@ external-secrets:
  certController:
    image:
      repository: ghcr.io/external-secrets/external-secrets
-      tag: v2.4.0@sha256:d2b74514f63f5b55360d08351f1fe5af3b1db794a81fa10389abe2ff2999c566
+      tag: v2.3.0@sha256:c425f51f422506c380550ad32fbf155412c7be84dd1c4b196130dcf04497be80
    resources:
      requests:
        cpu: 1m
--- a/clusters/cl01tl/helm/foldergram/Chart.lock
+++ b/clusters/cl01tl/helm/foldergram/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 4.6.2
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.6.0
+  version: 2.5.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:c42d896ab065b1278e0ae9f297e15ba2165fec99148003bf67f56aa641cf406a
-generated: "2026-04-24T22:50:55.336683873Z"
+  version: 0.8.0
+digest: sha256:06e321d19ffe0df94b3cd6bcc306804729710f74ca2f9962652628377836c33e
+generated: "2026-04-11T15:26:16.743784-05:00"
--- a/clusters/cl01tl/helm/foldergram/Chart.yaml
+++ b/clusters/cl01tl/helm/foldergram/Chart.yaml
@@ -21,10 +21,10 @@ dependencies:
    version: 4.6.2
  - name: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.6.0
+    version: 2.5.0
  - name: volsync-target
    alias: volsync-target-db
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
 # renovate: datasource=github-releases depName=foldergram/foldergram
--- a/clusters/cl01tl/helm/foldergram/templates/_helpers.tpl
+++ b/clusters/cl01tl/helm/foldergram/templates/_helpers.tpl
@@ -16,6 +16,6 @@ app.kubernetes.io/part-of: {{ .Release.Name }}
 {{/*
 NFS names
 */}}
-{{- define "custom.storageMiaNfsName" -}}
-foldergram-pictures-collection-mia-nfs-storage
+{{- define "custom.storageNfsName" -}}
+foldergram-pictures-collections-nfs-storage
 {{- end -}}
--- a/clusters/cl01tl/helm/foldergram/templates/persistent-volume-claim.yaml
+++ b/clusters/cl01tl/helm/foldergram/templates/persistent-volume-claim.yaml
@@ -1,13 +1,13 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ include "custom.storageMiaNfsName" . }}
+  name: {{ include "custom.storageNfsName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: {{ include "custom.storageMiaNfsName" . }}
+    app.kubernetes.io/name: {{ include "custom.storageNfsName" . }}
    {{- include "custom.labels" . | nindent 4 }}
 spec:
-  volumeName: {{ include "custom.storageMiaNfsName" . }}
+  volumeName: {{ include "custom.storageNfsName" . }}
  storageClassName: nfs-client
  accessModes:
    - ReadWriteMany
--- a/clusters/cl01tl/helm/foldergram/templates/persistent-volume.yaml
+++ b/clusters/cl01tl/helm/foldergram/templates/persistent-volume.yaml
@@ -1,10 +1,10 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: {{ include "custom.storageMiaNfsName" . }}
+  name: {{ include "custom.storageNfsName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: {{ include "custom.storageMiaNfsName" . }}
+    app.kubernetes.io/name: {{ include "custom.storageNfsName" . }}
    {{- include "custom.labels" . | nindent 4 }}
 spec:
  persistentVolumeReclaimPolicy: Retain
@@ -14,7 +14,7 @@ spec:
  accessModes:
    - ReadWriteMany
  nfs:
-    path: '/volume2/Storage/Pictures/Collections/Minneapolis Institute of Art'
+    path: /volume2/Storage/Pictures/Collections
    server: synologybond.alexlebens.net
  mountOptions:
    - vers=4
--- a/clusters/cl01tl/helm/foldergram/values.yaml
+++ b/clusters/cl01tl/helm/foldergram/values.yaml
@@ -17,7 +17,7 @@ foldergram:
            - name: IMAGE_DETAIL_SOURCE
              value: original
            - name: DERIVATIVE_MODE
-              value: lazy
+              value: eager
            - name: DATA_ROOT
              value: ./data
            - name: GALLERY_ROOT
@@ -70,18 +70,18 @@ foldergram:
      forceRename: foldergram-data
      storageClass: synology-iscsi-delete
      accessMode: ReadWriteOnce
-      size: 500Gi
+      size: 250Gi
      advancedMounts:
        main:
          main:
            - path: /app/data
              readOnly: false
-    pictures-mia:
-      existingClaim: foldergram-pictures-collection-mia-nfs-storage
+    pictures:
+      existingClaim: foldergram-pictures-collections-nfs-storage
      advancedMounts:
        main:
          main:
-            - path: '/gallery/Minneapolis Institute of Art'
+            - path: /gallery
              readOnly: true
 volsync-target-db:
  pvcTarget: foldergram-db
--- a/clusters/cl01tl/helm/freshrss/Chart.lock
+++ b/clusters/cl01tl/helm/freshrss/Chart.lock
@@ -4,12 +4,12 @@ dependencies:
  version: 4.6.2
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.6.0
+  version: 2.5.0
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:ad75160abdeec46eb8cbcfa25ce69cc99c0ec5e73142560df3ef5b1490a2a3f3
-generated: "2026-04-24T22:51:06.194383563Z"
+  version: 0.8.0
+digest: sha256:2a13aac2d207555bf33ee01db493d210e860e660433cd6f5b9b67fadf91f8f74
+generated: "2026-04-10T01:17:32.585138713Z"
--- a/clusters/cl01tl/helm/freshrss/Chart.yaml
+++ b/clusters/cl01tl/helm/freshrss/Chart.yaml
@@ -22,14 +22,14 @@ dependencies:
    version: 4.6.2
  - name: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.6.0
+    version: 2.5.0
  - name: postgres-cluster
    alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-data
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/freshrss.png
 # renovate: datasource=github-releases depName=FreshRSS/FreshRSS
--- a/clusters/cl01tl/helm/gatus/Chart.lock
+++ b/clusters/cl01tl/helm/gatus/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 1.5.0
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:a1e4ca6f575989ad15501f31842b7b0a505cc7b2fc21d61587b8ae9ad7d39ffc
-generated: "2026-04-24T22:51:17.210954901Z"
+  version: 0.8.0
+digest: sha256:b2a7ef962a91dff4313f66c1d04356f1b2aeefc752d672a9a27ea227db4b8c7d
+generated: "2026-04-04T21:02:09.187828-05:00"
--- a/clusters/cl01tl/helm/gatus/Chart.yaml
+++ b/clusters/cl01tl/helm/gatus/Chart.yaml
@@ -20,11 +20,11 @@ dependencies:
    version: 1.5.0
  - name: postgres-cluster
    alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-data
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/gatus.png
 # renovate: datasource=github-releases depName=TwiN/gatus
--- a/clusters/cl01tl/helm/gitea/Chart.lock
+++ b/clusters/cl01tl/helm/gitea/Chart.lock
@@ -10,10 +10,10 @@ dependencies:
  version: 0.32.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.6.0
+  version: 2.5.0
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.6.1
@@ -22,6 +22,6 @@ dependencies:
  version: 0.6.1
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:a90e8908ef9f5349f444e53474692af302999b0ddcfa6d68f24ede9ef55d97e5
-generated: "2026-04-24T22:51:28.783181948Z"
+  version: 0.8.0
+digest: sha256:2144d55ea34ba25bd81c1e479ee5cd27097fafb5676b96e63aa0e32ad2868925
+generated: "2026-04-16T20:09:26.031592859Z"
--- a/clusters/cl01tl/helm/gitea/Chart.yaml
+++ b/clusters/cl01tl/helm/gitea/Chart.yaml
@@ -37,10 +37,10 @@ dependencies:
    repository: https://meilisearch.github.io/meilisearch-kubernetes
  - name: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.6.0
+    version: 2.5.0
  - name: postgres-cluster
    alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey-gitea
@@ -52,7 +52,7 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-storage
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/gitea.png
 # renovate: datasource=github-releases depName=go-gitea/gitea
--- a/clusters/cl01tl/helm/gitea/templates/prometheus-rule.yaml
+++ b/clusters/cl01tl/helm/gitea/templates/prometheus-rule.yaml
@@ -1,28 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: meilisearch
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: meilisearch
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  groups:
-    - name: EmbeddedExporter
-      rules:
-        - alert: MeilisearchIndexIsEmpty
-          expr: meilisearch_index_docs_count == 0
-          for: 0m
-          labels:
-            severity: warning
-          annotations:
-            summary: Meilisearch index is empty (instance {{ `{{ $labels.instance }}` }})
-            description: "Meilisearch index {{ `{{ $labels.index }}` }} has zero documents\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: MeilisearchHttpResponseTime
-          expr: meilisearch_http_response_time_seconds > 0.5
-          for: 0m
-          labels:
-            severity: warning
-          annotations:
-            summary: Meilisearch http response time (instance {{ `{{ $labels.instance }}` }})
-            description: "Meilisearch http response time is too high\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
--- a/clusters/cl01tl/helm/gitea/values.yaml
+++ b/clusters/cl01tl/helm/gitea/values.yaml
@@ -194,7 +194,7 @@ gitea-actions:
      registry: docker.io
      repository: gitea/act_runner
      # renovate: datasource=docker depName=gitea/act_runner
-      tag: 0.5.0@sha256:9946000491cf19c3ed487c23e5da4f0c287010d791f495796c756e41e7a79cbe
+      tag: 0.4.1@sha256:696a59b51ad3d149521e3beb0229d5fb88f87295e1616f940199793274415b56
      extraVolumeMounts:
        - name: workspace-vol
          mountPath: /workspace
@@ -206,13 +206,14 @@ gitea-actions:
        runner:
          labels:
            - "ubuntu-latest:docker://harbor.alexlebens.net/proxy-hub.docker/gitea/runner-images:ubuntu-24.04"
-            - "ubuntu-latest-slim:docker://harbor.alexlebens.net/proxy-hub.docker/gitea/runner-images:ubuntu-24.04-slim"
            - "ubuntu-js:docker://harbor.alexlebens.net/proxy-ghcr.io/catthehacker/ubuntu:js-24.04"
+            - "ubuntu-24.04:docker://harbor.alexlebens.net/proxy-hub.docker/gitea/runner-images:ubuntu-24.04"
+            - "ubuntu-22.04:docker://harbor.alexlebens.net/proxy-hub.docker/gitea/runner-images:ubuntu-22.04"
    dind:
      registry: docker.io
      repository: docker
      # renovate: datasource=docker depName=docker
-      tag: 29.4.1-dind@sha256:c77e5d7912f9b137cc67051fdc2991d8f5ae22c55ddf532bb836dcb693a04940
+      tag: 29.4.0-dind@sha256:f80c26212befc1c1988b529495532c6b9180d9b1dab1611f4a1efbe9da8ec821
      extraVolumeMounts:
        - name: docker-vol
          mountPath: /var/lib/docker
--- a/clusters/cl01tl/helm/grafana-operator/Chart.lock
+++ b/clusters/cl01tl/helm/grafana-operator/Chart.lock
@@ -4,12 +4,12 @@ dependencies:
  version: 5.22.2
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.6.1
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.6.1
-digest: sha256:fffa0806096edeb2b6a6ceead50427544ef3880a3d135afb4a9c7570d05b2042
-generated: "2026-04-24T21:52:27.743114014Z"
+digest: sha256:6c086da896f573fdb1b81abab43b90181f2af7bf57a62333c4426f3f30496ffa
+generated: "2026-04-13T20:33:58.123069628Z"
--- a/clusters/cl01tl/helm/grafana-operator/Chart.yaml
+++ b/clusters/cl01tl/helm/grafana-operator/Chart.yaml
@@ -20,7 +20,7 @@ dependencies:
    repository: https://grafana.github.io/helm-charts
  - name: postgres-cluster
    alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey-unified-alerting
--- a/clusters/cl01tl/helm/grimmory/Chart.lock
+++ b/clusters/cl01tl/helm/grimmory/Chart.lock
@@ -7,6 +7,6 @@ dependencies:
  version: 26.3.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:d09beb99121c26ff41807ad0e04c8603e4b4a898b4da9dabae111b6a117533bd
-generated: "2026-04-24T22:51:44.025287784Z"
+  version: 0.8.0
+digest: sha256:6ee403da03c1bcc0289a9abdef0508344072d51173da996eda69b8305d5feefa
+generated: "2026-03-23T20:35:19.743257-05:00"
--- a/clusters/cl01tl/helm/grimmory/Chart.yaml
+++ b/clusters/cl01tl/helm/grimmory/Chart.yaml
@@ -24,8 +24,8 @@ dependencies:
    repository: https://helm.mariadb.com/mariadb-operator
  - name: volsync-target
    alias: volsync-target-config
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grimmory.png
 # renovate: datasource=github-releases depName=grimmory-tools/grimmory
-appVersion: v3.0.2
+appVersion: v2.3.0
--- a/clusters/cl01tl/helm/grimmory/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/grimmory/templates/external-secret.yaml
@@ -1,10 +1,10 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: grimmory-database-secret
+  name: grimmory-database-config
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: grimmory-database-secret
+    app.kubernetes.io/name: grimmory-database-config
    {{- include "custom.labels" . | nindent 4 }}
 spec:
  secretStoreRef:
@@ -33,11 +33,11 @@ spec:
    - secretKey: access
      remoteRef:
        key: /digital-ocean/home-infra/mariadb-backups
-        property: AWS_ACCESS_KEY_ID
+        property: access
    - secretKey: secret
      remoteRef:
        key: /digital-ocean/home-infra/mariadb-backups
-        property: AWS_SECRET_ACCESS_KEY
+        property: secret

 ---
 apiVersion: external-secrets.io/v1
--- a/clusters/cl01tl/helm/grimmory/values.yaml
+++ b/clusters/cl01tl/helm/grimmory/values.yaml
@@ -12,7 +12,7 @@ grimmory:
        main:
          image:
            repository: ghcr.io/grimmory-tools/grimmory
-            tag: v3.0.2@sha256:4557a78321add7d70bef7c0b89c2617c8c023246ae39698bc2cbe636f8c97f9b
+            tag: v2.3.0@sha256:9014247f591074529894f81115ca40f899db697e89f72c2fe91ec530e3f19597
          env:
            - name: TZ
              value: America/Chicago
@@ -27,7 +27,7 @@ grimmory:
            - name: DATABASE_PASSWORD
              valueFrom:
                secretKeyRef:
-                  name: grimmory-database-secret
+                  name: grimmory-database-config
                  key: password
            - name: GRIMMORY_PORT
              value: 6060
@@ -98,7 +98,7 @@ mariadb-cluster:
  mariadb:
    rootPasswordSecretKeyRef:
      generate: false
-      name: grimmory-database-secret
+      name: grimmory-database-config
      key: password
    storage:
      size: 5Gi
--- a/clusters/cl01tl/helm/harbor/Chart.lock
+++ b/clusters/cl01tl/helm/harbor/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 1.18.3
 - name: postgres-cluster
  repository: https://gitea.alexlebens.net/api/packages/alexlebens/helm
-  version: 7.12.1
+  version: 7.11.2
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.6.1
-digest: sha256:b1f69102ef2b48dc219b41a6f92ab26d3fda803877948b3288a3c5ebc8e69d86
-generated: "2026-04-24T21:52:56.225496919Z"
+digest: sha256:fc508a58ea7dffe1b92049a89c3fe2f0034d05ecdad38807bb6e02c68a1cb957
+generated: "2026-04-13T20:34:25.515547207Z"
--- a/clusters/cl01tl/helm/harbor/Chart.yaml
+++ b/clusters/cl01tl/helm/harbor/Chart.yaml
@@ -20,7 +20,7 @@ dependencies:
    repository: https://helm.goharbor.io
  - name: postgres-cluster
    alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
    repository: https://gitea.alexlebens.net/api/packages/alexlebens/helm
  - name: valkey
    alias: valkey
--- a/clusters/cl01tl/helm/home-assistant/Chart.lock
+++ b/clusters/cl01tl/helm/home-assistant/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 4.6.2
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:481ed6b5635e7005687c80bdb4d18e500b45b9a7c58f15b19bd2de77c96ddbd4
-generated: "2026-04-24T22:51:56.321419086Z"
+  version: 0.8.0
+digest: sha256:dc33c006806b1ac93403a6e77c12e013cac6cf64586bc1d26c54841e6ddf7d2c
+generated: "2026-03-06T01:08:23.774548766Z"
--- a/clusters/cl01tl/helm/home-assistant/Chart.yaml
+++ b/clusters/cl01tl/helm/home-assistant/Chart.yaml
@@ -20,8 +20,8 @@ dependencies:
    version: 4.6.2
  - name: volsync-target
    alias: volsync-target-config
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/home-assistant.png
 # renovate: datasource=github-releases depName=home-assistant/core
-appVersion: 2026.4.4
+appVersion: 2026.4.3
--- a/clusters/cl01tl/helm/home-assistant/values.yaml
+++ b/clusters/cl01tl/helm/home-assistant/values.yaml
@@ -12,7 +12,7 @@ home-assistant:
        main:
          image:
            repository: ghcr.io/home-assistant/home-assistant
-            tag: 2026.4.4@sha256:c1e5f0147f4cb51ccb05bb30b62a1269cc1bd48a6274792d3b38a77ab274dfd2
+            tag: 2026.4.3@sha256:ae0800c81fea16bc1241ce03bddb9c6260566e90f58b09d3e5a629e4f68bdc0b
          env:
            - name: TZ
              value: America/Chicago
@@ -23,7 +23,7 @@ home-assistant:
        code-server:
          image:
            repository: ghcr.io/linuxserver/code-server
-            tag: 4.117.0-ls334@sha256:1f384394d473c43ab6a39b2227ba3aa9c95af648ce3a67e1b4da1969c16c7c0d
+            tag: 4.116.0-ls333@sha256:4620adace18935dd6ca79d77e3bc1c379e21875392192f970cf5d6b0fb4aefcd
          env:
            - name: TZ
              value: America/Chicago
--- a/clusters/cl01tl/helm/houndarr/Chart.lock
+++ b/clusters/cl01tl/helm/houndarr/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 4.6.2
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:e8d72b23589fc6a8bb05021f7697529b4715d9b25a408dfb9fcb4809ae2f72c2
-generated: "2026-04-24T22:52:07.350582175Z"
+  version: 0.8.0
+digest: sha256:375d6c2eb2f097717c44c5a28cb162da24f4ff154a971e5a68ccd0e0b77e936f
+generated: "2026-03-21T22:31:01.142752-05:00"
--- a/clusters/cl01tl/helm/houndarr/Chart.yaml
+++ b/clusters/cl01tl/helm/houndarr/Chart.yaml
@@ -21,7 +21,7 @@ dependencies:
    version: 4.6.2
  - name: volsync-target
    alias: volsync-target-data
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/houndarr.png
 # renovate: datasource=github-releases depName=av1155/houndarr
--- a/clusters/cl01tl/helm/immich/Chart.lock
+++ b/clusters/cl01tl/helm/immich/Chart.lock
@@ -4,12 +4,12 @@ dependencies:
  version: 4.6.2
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.6.1
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:cd1a40aea6636d17bb205c8cc71126892d98ebff18191acdebd330ff6eae9c46
-generated: "2026-04-24T22:52:19.021425151Z"
+  version: 0.8.0
+digest: sha256:73ee46c366adf205ca50a7382a404ccd0e548a2ebeb39fa5f5afbadf6e0d539f
+generated: "2026-04-13T20:34:57.11369553Z"
--- a/clusters/cl01tl/helm/immich/Chart.yaml
+++ b/clusters/cl01tl/helm/immich/Chart.yaml
@@ -21,7 +21,7 @@ dependencies:
    version: 4.6.2
  - name: postgres-cluster
    alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey
@@ -29,7 +29,7 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-data
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/immich.png
 # renovate: datasource=github-releases depName=immich-app/immich
--- a/clusters/cl01tl/helm/isponsorblocktv/Chart.lock
+++ b/clusters/cl01tl/helm/isponsorblocktv/Chart.lock
@@ -1,6 +0,0 @@
-dependencies:
- name: app-template
-  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
-digest: sha256:65da71c32b4576a11e590f059d97dae22137448cb71049258d018cf5b7bb4a92
-generated: "2026-04-26T14:59:16.326539-05:00"
--- a/clusters/cl01tl/helm/jellyfin/Chart.lock
+++ b/clusters/cl01tl/helm/jellyfin/Chart.lock
@@ -7,6 +7,6 @@ dependencies:
  version: 0.32.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:dbe485a392b36a9045aac6c28df5c10802a8596eef2f695a2d7b562624daa754
-generated: "2026-04-24T22:52:31.690924714Z"
+  version: 0.8.0
+digest: sha256:09e0de3cf33b4b463b07237d547172ad72fcc77c0fcb8e5ed7542f9ee3b1df3a
+generated: "2026-04-16T14:10:45.330521031Z"
--- a/clusters/cl01tl/helm/jellyfin/Chart.yaml
+++ b/clusters/cl01tl/helm/jellyfin/Chart.yaml
@@ -26,7 +26,7 @@ dependencies:
    repository: https://meilisearch.github.io/meilisearch-kubernetes
  - name: volsync-target
    alias: volsync-target-config
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/jellyfin.png
 # renovate: datasource=github-releases depName=jellyfin/jellyfin
--- a/clusters/cl01tl/helm/jellyfin/templates/prometheus-rule.yaml
+++ b/clusters/cl01tl/helm/jellyfin/templates/prometheus-rule.yaml
@@ -1,28 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: meilisearch
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: meilisearch
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  groups:
-    - name: EmbeddedExporter
-      rules:
-        - alert: MeilisearchIndexIsEmpty
-          expr: meilisearch_index_docs_count == 0
-          for: 0m
-          labels:
-            severity: warning
-          annotations:
-            summary: Meilisearch index is empty (instance {{ `{{ $labels.instance }}` }})
-            description: "Meilisearch index {{ `{{ $labels.index }}` }} has zero documents\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: MeilisearchHttpResponseTime
-          expr: meilisearch_http_response_time_seconds > 0.5
-          for: 0m
-          labels:
-            severity: warning
-          annotations:
-            summary: Meilisearch http response time (instance {{ `{{ $labels.instance }}` }})
-            description: "Meilisearch http response time is too high\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
--- a/clusters/cl01tl/helm/jellystat/Chart.lock
+++ b/clusters/cl01tl/helm/jellystat/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 4.6.2
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:733c0b935ff897ddb115604f63d03738b47cab712d548b336785893544b7cc04
-generated: "2026-04-24T22:52:44.501898916Z"
+  version: 0.8.0
+digest: sha256:4ff8555c97c457923957fac499a0c9469edac8b3dd7ab0fab46f7d4e07e8eff5
+generated: "2026-04-04T21:02:58.694365-05:00"
--- a/clusters/cl01tl/helm/jellystat/Chart.yaml
+++ b/clusters/cl01tl/helm/jellystat/Chart.yaml
@@ -21,11 +21,11 @@ dependencies:
    version: 4.6.2
  - name: postgres-cluster
    alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-data
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/jellystat.png
 # renovate: datasource=github-releases depName=CyferShepard/Jellystat
--- a/clusters/cl01tl/helm/jellystat/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/jellystat/templates/external-secret.yaml
@@ -21,5 +21,5 @@ spec:
        property: user
    - secretKey: password
      remoteRef:
-        key: /cl01tl/jellystat/config
+        key: /cl01tl/jellystat/cconfig
        property: password
--- a/clusters/cl01tl/helm/karakeep/Chart.lock
+++ b/clusters/cl01tl/helm/karakeep/Chart.lock
@@ -7,12 +7,9 @@ dependencies:
  version: 0.32.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.6.0
+  version: 2.5.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
- name: rclone-bucket
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.4.3
-digest: sha256:376ee64d93cc959afc02c5cf5b308bbf12a0b5dfb339a6a853b3243e6033604c
-generated: "2026-04-26T21:07:05.718924873Z"
+  version: 0.8.0
+digest: sha256:a5074b9aa3d0ad4e8e3f0d5d10e92e7112bf1fd263d6bade8ae47e36d544cb6d
+generated: "2026-04-16T14:11:10.620563905Z"
--- a/clusters/cl01tl/helm/karakeep/Chart.yaml
+++ b/clusters/cl01tl/helm/karakeep/Chart.yaml
@@ -15,7 +15,6 @@ sources:
  - https://github.com/meilisearch/meilisearch-kubernetes/tree/main/charts/meilisearch
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/rclone-bucket
 maintainers:
  - name: alexlebens
 dependencies:
@@ -28,15 +27,11 @@ dependencies:
    repository: https://meilisearch.github.io/meilisearch-kubernetes
  - name: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 2.6.0
+    version: 2.5.0
  - name: volsync-target
    alias: volsync-target-data
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
-  - name: rclone-bucket
-    alias: rclone-karakeep-assets-remote
-    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 0.4.3
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/karakeep.png
 # renovate: datasource=github-releases depName=karakeep-app/karakeep
 appVersion: 0.31.0
--- a/clusters/cl01tl/helm/karakeep/templates/prometheus-rule.yaml
+++ b/clusters/cl01tl/helm/karakeep/templates/prometheus-rule.yaml
@@ -1,28 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: meilisearch
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: meilisearch
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  groups:
-    - name: EmbeddedExporter
-      rules:
-        - alert: MeilisearchIndexIsEmpty
-          expr: meilisearch_index_docs_count == 0
-          for: 0m
-          labels:
-            severity: warning
-          annotations:
-            summary: Meilisearch index is empty (instance {{ `{{ $labels.instance }}` }})
-            description: "Meilisearch index {{ `{{ $labels.index }}` }} has zero documents\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
-        - alert: MeilisearchHttpResponseTime
-          expr: meilisearch_http_response_time_seconds > 0.5
-          for: 0m
-          labels:
-            severity: warning
-          annotations:
-            summary: Meilisearch http response time (instance {{ `{{ $labels.instance }}` }})
-            description: "Meilisearch http response time is too high\n  VALUE = {{ `{{ $value }}` }}\n  LABELS = {{ `{{ $labels }}` }}"
--- a/clusters/cl01tl/helm/karakeep/values.yaml
+++ b/clusters/cl01tl/helm/karakeep/values.yaml
@@ -172,24 +172,3 @@ volsync-target-data:
  external:
    enabled: true
    schedule: 30 10 * * *
-rclone-karakeep-assets-remote:
-  cronJob:
-    suspend: false
-    schedule: 10 0 * * *
-  rclone:
-    source:
-      bucketName: karakeep-assets
-    destination:
-      bucketName: karakeep-assets
-  secret:
-    externalSecret:
-      source:
-        credentials:
-          path: /garage/home-infra/karakeep-assets
-        config:
-          path: /garage/config
-      destination:
-        credentials:
-          path: /garage/home-infra/karakeep-assets
-        config:
-          path: /garage/config
--- a/clusters/cl01tl/helm/komodo/Chart.lock
+++ b/clusters/cl01tl/helm/komodo/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 4.6.2
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:5fd317a68abfed5e7bd60a888d1689e8bcf855e6c92181149b06865bbfd2142a
-generated: "2026-04-24T22:53:10.456647793Z"
+  version: 0.8.0
+digest: sha256:ed3362c98ab60b195a47d0789f2420e041e907be955cdd122f84e363a00f4c73
+generated: "2026-04-04T21:03:12.459168-05:00"
--- a/clusters/cl01tl/helm/komodo/Chart.yaml
+++ b/clusters/cl01tl/helm/komodo/Chart.yaml
@@ -23,11 +23,11 @@ dependencies:
    version: 4.6.2
  - name: postgres-cluster
    alias: postgresql-17-fdb-cluster
-    version: 7.12.1
+    version: 7.11.2
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-keys
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/komodo.png
 # renovate: datasource=github-releases depName=moghtech/komodo
--- a/clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock
@@ -1,7 +1,7 @@
 dependencies:
 - name: kube-prometheus-stack
  repository: oci://ghcr.io/prometheus-community/charts
-  version: 84.3.0
+  version: 83.7.0
 - name: prometheus-operator-crds
  repository: oci://ghcr.io/prometheus-community/charts
  version: 28.0.1
@@ -11,5 +11,5 @@ dependencies:
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.6.1
-digest: sha256:88beedf9486adb9cb27b36c24021759401fcff106fc0e0cadbb3282d7e57d03c
-generated: "2026-04-27T19:03:58.288039768Z"
+digest: sha256:d4435b0e182ec588250d52bee0957b22d7b69abc5be8b60606d4811bfc0ed8d6
+generated: "2026-04-21T17:08:18.793790591Z"
--- a/clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml
@@ -20,7 +20,7 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: kube-prometheus-stack
-    version: 84.3.0
+    version: 83.7.0
    repository: oci://ghcr.io/prometheus-community/charts
  - name: prometheus-operator-crds
    version: 28.0.1
--- a/clusters/cl01tl/helm/kube-prometheus-stack/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/templates/external-secret.yaml
@@ -13,7 +13,7 @@ spec:
  data:
    - secretKey: ntfy_password
      remoteRef:
-        key: /cl01tl/kube-prometheus-stack/ntfy-alertmanager
+        key: / cl01tl/ntfy/users/cl01tl
        property: password

 ---
--- a/clusters/cl01tl/helm/kube-prometheus-stack/values.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/values.yaml
@@ -30,7 +30,7 @@ kube-prometheus-stack:
              http_config:
                basic_auth:
                  username: ntfy-alertmanager
-                  password_file: /etc/alertmanager/secrets/alertmanager-ntfy-config/ntfy_password
+                  password_file: /etc/alertmanager/secrets/alertmanager-config-secret/ntfy_password
    route:
      main:
        enabled: true
@@ -98,8 +98,8 @@ kube-prometheus-stack:
            namespace: traefik
    prometheusSpec:
      scrapeInterval: 30s
-      retention: 60d
-      retentionSize: 450GiB
+      retention: 45d
+      retentionSize: 240GiB
      externalUrl: https://prometheus.alexlebens.net
      ruleSelectorNilUsesHelmValues: false
      serviceMonitorSelectorNilUsesHelmValues: false
@@ -112,7 +112,7 @@ kube-prometheus-stack:
            accessModes: ["ReadWriteOnce"]
            resources:
              requests:
-                storage: 500Gi
+                storage: 250Gi
 ntfy-alertmanager:
  global:
    fullnameOverride: ntfy-alertmanager
--- a/clusters/cl01tl/helm/languagetool/Chart.lock
+++ b/clusters/cl01tl/helm/languagetool/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 4.6.2
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:f2dcc0a6855355730edf953bdc85ba96e0976e4bb3c1eb36ea7e7b8b875f0993
-generated: "2026-04-24T22:53:22.939567191Z"
+  version: 0.8.0
+digest: sha256:cb14506ada77add5ffcb93d38763e2a5c962312e5754618265d15c4361fea783
+generated: "2026-03-20T17:49:46.393059-05:00"
--- a/clusters/cl01tl/helm/languagetool/Chart.yaml
+++ b/clusters/cl01tl/helm/languagetool/Chart.yaml
@@ -21,7 +21,7 @@ dependencies:
    version: 4.6.2
  - name: volsync-target
    alias: volsync-target-data
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/languagetool.png
 # renovate: datasource=github-releases depName=Erikvl87/docker-languagetool
--- a/clusters/cl01tl/helm/libation/Chart.lock
+++ b/clusters/cl01tl/helm/libation/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 4.6.2
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:cf767b6293e91fd87c0d42578ae26e453c98f3dc394b03a980fc50daccc5e91a
-generated: "2026-04-24T22:53:35.66922158Z"
+  version: 0.8.0
+digest: sha256:0cdd20ce501fafcd8fdedb4115352eed88c578713de6b325d661ec630b14ef17
+generated: "2026-03-06T01:10:32.425014216Z"
--- a/clusters/cl01tl/helm/libation/Chart.yaml
+++ b/clusters/cl01tl/helm/libation/Chart.yaml
@@ -22,8 +22,8 @@ dependencies:
    version: 4.6.2
  - name: volsync-target
    alias: volsync-target-config
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/libation.png
 # renovate: datasource=github-releases depName=rmcrackan/Libation
-appVersion: 13.3.5
+appVersion: 13.3.4
--- a/clusters/cl01tl/helm/libation/values.yaml
+++ b/clusters/cl01tl/helm/libation/values.yaml
@@ -12,7 +12,7 @@ libation:
        main:
          image:
            repository: rmcrackan/libation
-            tag: 13.3.5@sha256:fcfeaa406a3567e3de89d85bf761d17868029c6e8a127922672770cb812b9be8
+            tag: 13.3.4@sha256:eb0357e8a880ed0049dffd2a99a9d2eda322ed33b3b9e16f4fb93eb15275f396
          env:
            - name: SLEEP_TIME
              value: "-1"
--- a/clusters/cl01tl/helm/lidarr/Chart.lock
+++ b/clusters/cl01tl/helm/lidarr/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 4.6.2
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:fcabcf8fd610e30a32e891fd226a17ff9546def197e022229060bcad9ce078d5
-generated: "2026-04-24T22:53:46.881913432Z"
+  version: 0.8.0
+digest: sha256:eaa092df6ae81137c5a62622f9e09495a9bc886ae908202b120969948206d786
+generated: "2026-04-04T21:03:34.837519-05:00"
--- a/clusters/cl01tl/helm/lidarr/Chart.yaml
+++ b/clusters/cl01tl/helm/lidarr/Chart.yaml
@@ -25,11 +25,11 @@ dependencies:
    version: 4.6.2
  - name: postgres-cluster
    alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-config
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/lidarr.png
 # renovate: datasource=github-releases depName=linuxserver/docker-lidarr
--- a/clusters/cl01tl/helm/loki/Chart.lock
+++ b/clusters/cl01tl/helm/loki/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 6.55.0
 - name: alloy
  repository: https://grafana.github.io/helm-charts
-  version: 1.8.0
-digest: sha256:e3c7508c21ed7737f692387ca79a0c001c3393edbedff7b05c60325469a4fb2b
-generated: "2026-04-24T17:01:55.023153925Z"
+  version: 1.7.0
+digest: sha256:e6a06dc016858215a461d05c543b937f7a87ecc1bb58381cd6fb825ba524fa66
+generated: "2026-04-02T19:05:47.897397013Z"
--- a/clusters/cl01tl/helm/loki/Chart.yaml
+++ b/clusters/cl01tl/helm/loki/Chart.yaml
@@ -18,7 +18,7 @@ dependencies:
    version: 6.55.0
    repository: https://grafana.github.io/helm-charts
  - name: alloy
-    version: 1.8.0
+    version: 1.7.0
    repository: https://grafana.github.io/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/loki.png
 # renovate: datasource=github-releases depName=grafana/loki
--- a/clusters/cl01tl/helm/matrix-synapse/Chart.lock
+++ b/clusters/cl01tl/helm/matrix-synapse/Chart.lock
@@ -13,13 +13,13 @@ dependencies:
  version: 4.6.2
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.6.0
+  version: 2.5.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 2.6.0
+  version: 2.5.0
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.12.1
+  version: 7.11.2
 - name: valkey
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.6.1
@@ -28,15 +28,15 @@ dependencies:
  version: 0.6.1
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
+  version: 0.8.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
+  version: 0.8.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
+  version: 0.8.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:263754d5c844ddc1b74f9fa06e64760a4fc7a3b5213255c81ed444149793fe10
-generated: "2026-04-24T22:53:58.552457385Z"
+  version: 0.8.0
+digest: sha256:e3b47e528b086c6f1b2aefb3b429026e77a5e7b95ff3946ef0769b366542ba5a
+generated: "2026-04-13T20:35:45.244907297Z"
--- a/clusters/cl01tl/helm/matrix-synapse/Chart.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/Chart.yaml
@@ -42,15 +42,15 @@ dependencies:
    version: 4.6.2
  - name: cloudflared
    alias: cloudflared-synapse
-    version: 2.6.0
+    version: 2.5.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: cloudflared
    alias: cloudflared-hookshot
-    version: 2.6.0
+    version: 2.5.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: postgres-cluster
    alias: postgres-18-cluster
-    version: 7.12.1
+    version: 7.11.2
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: valkey
    alias: valkey-matrix-synapse
@@ -62,19 +62,19 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-synapse
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-hookshot
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-discord
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: volsync-target
    alias: volsync-target-whatsapp
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/matrix.png
 # renovate: datasource=github-releases depName=element-hq/synapse
--- a/clusters/cl01tl/helm/matrix-synapse/templates/_helpers.tpl
+++ b/clusters/cl01tl/helm/matrix-synapse/templates/_helpers.tpl
@@ -14,7 +14,7 @@ app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}

 {{/*
-ServiceAccount names
+NFS names
 */}}
 {{- define "custom.serviceAccountName" -}}
 matrix-synapse
--- a/clusters/cl01tl/helm/matrix-synapse/templates/secret-provider-class.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/templates/secret-provider-class.yaml
@@ -16,102 +16,22 @@ spec:
        fileName: config.yaml
        secretPath: secret/data/cl01tl/matrix-synapse/config
        secretKey: config.yaml
-
---
-apiVersion: secrets-store.csi.x-k8s.io/v1
-kind: SecretProviderClass
-metadata:
-  name: matrix-synapse-oidc-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-oidc-config
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  provider: openbao
-  parameters:
-    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: matrix-synapse
-    objects: |
      - objectName: oidc.yaml
        fileName: oidc.yaml
        secretPath: secret/data/cl01tl/matrix-synapse/config
        secretKey: oidc.yaml
-
---
-apiVersion: secrets-store.csi.x-k8s.io/v1
-kind: SecretProviderClass
-metadata:
-  name: matrix-synapse-hookshot-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-hookshot-config
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  provider: openbao
-  parameters:
-    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: matrix-synapse
-    objects: |
      - objectName: hookshot-registration.yaml
        fileName: hookshot-registration.yaml
        secretPath: secret/data/cl01tl/matrix-synapse/hookshot
        secretKey: hookshot-registration.yaml
-
---
-apiVersion: secrets-store.csi.x-k8s.io/v1
-kind: SecretProviderClass
-metadata:
-  name: matrix-synapse-mautrix-discord-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-mautrix-discord-config
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  provider: openbao
-  parameters:
-    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: matrix-synapse
-    objects: |
      - objectName: mautrix-discord-registration.yaml
        fileName: mautrix-discord-registration.yaml
        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-discord
        secretKey: mautrix-discord-registration.yaml
-
---
-apiVersion: secrets-store.csi.x-k8s.io/v1
-kind: SecretProviderClass
-metadata:
-  name: matrix-synapse-mautrix-whatsapp-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-mautrix-whatsapp-config
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  provider: openbao
-  parameters:
-    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: matrix-synapse
-    objects: |
      - objectName: mautrix-whatsapp-registration.yaml
        fileName: mautrix-whatsapp-registration.yaml
        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-whatsapp
        secretKey: mautrix-whatsapp-registration.yaml
-
---
-apiVersion: secrets-store.csi.x-k8s.io/v1
-kind: SecretProviderClass
-metadata:
-  name: matrix-synapse-double-puppet-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-double-puppet-config
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  provider: openbao
-  parameters:
-    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: matrix-synapse
-    objects: |
      - objectName: double-puppet-registration.yaml
        fileName: double-puppet-registration.yaml
        secretPath: secret/data/cl01tl/matrix-synapse/double-puppet
--- a/clusters/cl01tl/helm/matrix-synapse/values.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/values.yaml
@@ -37,73 +37,17 @@ matrix-synapse:
    strategy:
      type: Recreate
    extraVolumes:
-      - name: synapse-config
+      - name: config
        csi:
          driver: secrets-store.csi.k8s.io
          readOnly: true
          volumeAttributes:
            secretProviderClass: matrix-synapse-config
-      - name: oidc-config
-        csi:
-          driver: secrets-store.csi.k8s.io
-          readOnly: true
-          volumeAttributes:
-            secretProviderClass: matrix-synapse-oidc-config
-      - name: hookshot-config
-        csi:
-          driver: secrets-store.csi.k8s.io
-          readOnly: true
-          volumeAttributes:
-            secretProviderClass: matrix-synapse-hookshot-config
-      - name: mautrix-discord-config
-        csi:
-          driver: secrets-store.csi.k8s.io
-          readOnly: true
-          volumeAttributes:
-            secretProviderClass: matrix-synapse-mautrix-discord-config
-      - name: mautrix-whatsapp-config
-        csi:
-          driver: secrets-store.csi.k8s.io
-          readOnly: true
-          volumeAttributes:
-            secretProviderClass: matrix-synapse-mautrix-whatsapp-config
-      - name: double-puppet-config
-        csi:
-          driver: secrets-store.csi.k8s.io
-          readOnly: true
-          volumeAttributes:
-            secretProviderClass: matrix-synapse-double-puppet-config
    extraVolumeMounts:
-      - name: synapse-config
-        mountPath: /synapse/config/conf.d/config.yaml
+      - name: config
+        mountPath: /synapse/config/conf.d
        mountPropagation: None
        readOnly: true
-        subPath: config.yaml
-      - name: oidc-config
-        mountPath: /synapse/config/conf.d/oidc.yaml
-        mountPropagation: None
-        readOnly: true
-        subPath: oidc.yaml
-      - name: hookshot-config
-        mountPath: /synapse/config/conf.d/hookshot-registration.yaml
-        mountPropagation: None
-        readOnly: true
-        subPath: hookshot-registration.yaml
-      - name: mautrix-discord-config
-        mountPath: /synapse/config/conf.d/mautrix-discord-registration.yaml
-        mountPropagation: None
-        readOnly: true
-        subPath: mautrix-discord-registration.yaml
-      - name: mautrix-whatsapp-config
-        mountPath: /synapse/config/conf.d/mautrix-whatsapp-registration.yaml
-        mountPropagation: None
-        readOnly: true
-        subPath: mautrix-whatsapp-registration.yaml
-      - name: double-puppet-config
-        mountPath: /synapse/config/conf.d/double-puppet-registration.yaml
-        mountPropagation: None
-        readOnly: true
-        subPath: double-puppet-registration.yaml
    resources:
      requests:
        cpu: 10m
@@ -165,8 +109,6 @@ matrix-synapse:
    enabled: false
  gateway:
    enabled: false
-  serviceAccount:
-    name: matrix-synapse
 matrix-hookshot:
  global:
    nameOverride: matrix-hookshot
@@ -176,8 +118,6 @@ matrix-hookshot:
      type: deployment
      replicas: 1
      strategy: Recreate
-      serviceAccount:
-        name: matrix-synapse
      containers:
        main:
          image:
--- a/clusters/cl01tl/helm/medialyze/Chart.lock
+++ b/clusters/cl01tl/helm/medialyze/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 4.6.2
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.0.0
-digest: sha256:9ead931baa8eb7bccb6c5366fb298fd1a2c452ceb9309e2b5f6c7e2569a1bedc
-generated: "2026-04-24T22:54:12.562228272Z"
+  version: 0.8.0
+digest: sha256:213297b2f245e3f98b655a9210bc81cb92f38c9db06e787d6dd89c97f2d6cfa4
+generated: "2026-04-09T19:45:54.699005-05:00"
--- a/clusters/cl01tl/helm/medialyze/Chart.yaml
+++ b/clusters/cl01tl/helm/medialyze/Chart.yaml
@@ -20,8 +20,8 @@ dependencies:
    version: 4.6.2
  - name: volsync-target
    alias: volsync-target-data
-    version: 1.0.0
+    version: 0.8.0
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/frederikemmer/MediaLyze/d8f69c0628bac7c047b90f91a66341648029c273/frontend/public/favicon.svg
 # renovate: datasource=github-releases depName=frederikemmer/MediaLyze
-appVersion: 0.9.0
+appVersion: 0.8.2
--- a/clusters/cl01tl/helm/medialyze/values.yaml
+++ b/clusters/cl01tl/helm/medialyze/values.yaml
@@ -12,7 +12,7 @@ medialyze:
        main:
          image:
            repository: ghcr.io/frederikemmer/medialyze
-            tag: 0.9.0@sha256:3d88b4f4a3e6cf2489a5236e5174d58d6274e99008ce2ddd4159d1389744473f
+            tag: 0.8.2@sha256:dd9f034f6daf32f68f386971540f9696c49699063abe553be5f58b4a964ae80f
          env:
            - name: HOST_PORT
              value: 8080
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Alex Lebens	b9fb25dbfe	Merge branch 'tmp/secrets-5' of https://gitea.alexlebens.net/alexlebens/infrastructure into tmp/secrets-5 All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 10m10s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 13m10s Details	2026-04-23 17:44:45 -05:00
Alex Lebens	995efc147b	feat: add more All checks were successful lint-test-docker / lint-docker-compose (pull_request) Successful in 1m0s Details lint-test-helm / lint-helm (pull_request) Successful in 9m50s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 11m46s Details	2026-04-23 17:25:56 -05:00
Alex Lebens	3d58df753b	feat: add more All checks were successful lint-test-docker / lint-docker-compose (pull_request) Successful in 42s Details lint-test-helm / lint-helm (pull_request) Successful in 15m53s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 16m48s Details	2026-04-23 16:40:37 -05:00
Alex Lebens	4cda238587	feat: add more All checks were successful lint-test-docker / lint-docker-compose (pull_request) Successful in 2m0s Details lint-test-helm / lint-helm (pull_request) Successful in 9m32s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 9m26s Details	2026-04-22 20:12:26 -05:00
Alex Lebens	5cf0638c16	feat: add more All checks were successful lint-test-docker / lint-docker-compose (pull_request) Successful in 1m10s Details lint-test-helm / lint-helm (pull_request) Successful in 8m57s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 10m14s Details	2026-04-22 19:38:17 -05:00
Alex Lebens	134ce4ae01	feat: add more All checks were successful lint-test-docker / lint-docker-compose (pull_request) Successful in 1m8s Details lint-test-helm / lint-helm (pull_request) Successful in 9m3s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 10m26s Details	2026-04-22 19:14:38 -05:00
Alex Lebens	8282c9a8fb	feat: add more All checks were successful lint-test-docker / lint-docker-compose (pull_request) Successful in 32s Details lint-test-helm / lint-helm (pull_request) Successful in 14m19s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 16m8s Details	2026-04-22 17:44:05 -05:00
Alex Lebens	6e5435df6d	feat: add matrix synapse All checks were successful lint-test-docker / lint-docker-compose (pull_request) Successful in 18s Details lint-test-helm / lint-helm (pull_request) Successful in 11m19s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 11m1s Details	2026-04-22 17:19:58 -05:00
Alex Lebens	152f505392	feat: add more All checks were successful lint-test-docker / lint-docker-compose (pull_request) Successful in 1m29s Details lint-test-helm / lint-helm (pull_request) Successful in 14m5s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 15m47s Details	2026-04-22 16:30:51 -05:00
Alex Lebens	ea88f7bedc	feat: add kubelet-cerT All checks were successful lint-test-docker / lint-docker-compose (pull_request) Successful in 1m50s Details lint-test-helm / lint-helm (pull_request) Successful in 15m8s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 17m33s Details	2026-04-22 15:55:48 -05:00
Alex Lebens	f99d2e89a1	feat: add prom All checks were successful lint-test-docker / lint-docker-compose (pull_request) Successful in 1m25s Details lint-test-helm / lint-helm (pull_request) Successful in 8m17s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 9m55s Details	2026-04-22 15:50:30 -05:00
Alex Lebens	6b02b1d331	feat: remove	2026-04-22 15:50:30 -05:00
Alex Lebens	7116db2e89	fix: wrong indent	2026-04-22 15:50:30 -05:00
Alex Lebens	77e0319ec8	feat: Add ispon	2026-04-22 15:50:30 -05:00
Renovate Bot	b41ef0a840	chore(deps): update searxng/searxng:latest docker digest to 37c616a	2026-04-22 15:50:30 -05:00
Renovate Bot	f1137e7a58	chore(deps): update ghcr.io/linuxserver/lidarr:3.1.2-nightly docker digest to d17f32d	2026-04-22 15:50:30 -05:00
Alex Lebens	f2280ff40a	feat: add more All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 12m40s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 14m29s Details	2026-04-21 21:13:37 -05:00
Alex Lebens	e104eae55e	feat: convert many Some checks failed lint-test-helm / lint-helm (pull_request) Successful in 9m13s Details lint-test-helm / validate-kubeconform (pull_request) Failing after 10m43s Details	2026-04-21 20:47:16 -05:00