chore(deps): update ghcr.io/foldergram/foldergram docker tag to v1.0.9

.gitea/workflows/renovate.yaml

@@ -13,7 +13,7 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.103.0@sha256:5ee632f9a617933125fa8ee962482bacc787160a2b5d959c50e0b8b2ef6a94a0
+    container: ghcr.io/renovatebot/renovate:43.99.0@sha256:aae697086b93427dcde46eb92e08e334b018946ce19339bf044ce971ca1626e2
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

clusters/cl01tl/helm/actual/values.yaml

@@ -39,6 +39,7 @@ actual:
         http:
           port: 80
           targetPort: 5006
+          protocol: HTTP
   route:
     main:
       kind: HTTPRoute

clusters/cl01tl/helm/argo-workflows/Chart.lock

@@ -7,6 +7,6 @@ dependencies:
   version: 2.4.21
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.11.1
-digest: sha256:a249bd8faad886fa267cb42e843fd6465b3c4147961d182b73dd64ef9e6ca06e
-generated: "2026-03-31T18:36:18.025982-05:00"
+  version: 7.10.0
+digest: sha256:5635bfe609d8a901df257ef3e6cb469396a21bdd4c6f96e7e33f84036019c52b
+generated: "2026-03-24T16:59:01.228848139Z"

clusters/cl01tl/helm/argo-workflows/Chart.yaml

@@ -25,7 +25,7 @@ dependencies:
     repository: https://argoproj.github.io/argo-helm
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.11.1
+    version: 7.10.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 # renovate: datasource=github-releases depName=argoproj/argo-workflows

clusters/cl01tl/helm/audiobookshelf/values.yaml

@@ -49,9 +49,11 @@ audiobookshelf:
         http:
           port: 80
           targetPort: 80
+          protocol: HTTP
         apprise:
           port: 8000
           targetPort: 8000
+          protocol: HTTP
   serviceMonitor:
     main:
       selector:

clusters/cl01tl/helm/authentik/Chart.lock

@@ -7,9 +7,9 @@ dependencies:
   version: 2.4.0
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.11.1
+  version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-digest: sha256:4b90c5af4cc7f37b04284aafd75ddda1241c71acb726932e7e21520b5bf98543
-generated: "2026-03-31T18:36:26.87524-05:00"
+  version: 0.4.0
+digest: sha256:8c353c5dad4c3d04d518c1445497f0d1cb64261a4201ae17a2c0874454b807a7
+generated: "2026-03-15T20:04:35.99407071Z"

clusters/cl01tl/helm/authentik/Chart.yaml

@@ -25,11 +25,11 @@ dependencies:
     version: 2.4.0
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.11.1
+    version: 7.10.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.5.0
+    version: 0.4.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/authentik.png
 # renovate: datasource=github-releases depName=goauthentik/authentik

clusters/cl01tl/helm/authentik/values.yaml

@@ -77,10 +77,6 @@ authentik:
       enabled: true
 postgres-18-cluster:
   mode: recovery
-  cluster:
-    resources:
-      requests:
-        memory: 150Mi
   recovery:
     method: objectStore
     objectStore:

clusters/cl01tl/helm/backrest/values.yaml

@@ -31,6 +31,7 @@ backrest:
         http:
           port: 80
           targetPort: 9898
+          protocol: TCP
   serviceMonitor:
     main:
       selector:

clusters/cl01tl/helm/bazarr/values.yaml

@@ -35,6 +35,7 @@ bazarr:
         http:
           port: 80
           targetPort: 6767
+          protocol: HTTP
   route:
     main:
       kind: HTTPRoute

clusters/cl01tl/helm/blocky/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 4.6.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-digest: sha256:49b0e666059bad492ebaa4a20119ce5bbd1959a1ee6b22b271a9ca9529122697
-generated: "2026-03-31T18:37:20.549898-05:00"
+  version: 0.4.0
+digest: sha256:a5b0099261d772b24a302a106d106cfa82ac07fa14564141e00cf107d708e859
+generated: "2026-03-09T23:06:16.853255429Z"

clusters/cl01tl/helm/blocky/Chart.yaml

@@ -20,7 +20,7 @@ dependencies:
     version: 4.6.2
   - name: valkey
     alias: valkey
-    version: 0.5.0
+    version: 0.4.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/blocky.png
 # renovate: datasource=github-releases depName=0xerr0r/blocky

clusters/cl01tl/helm/blocky/values.yaml

@@ -144,7 +144,6 @@ blocky:
               objects                         IN      CNAME   traefik-cl01tl
               ollama                          IN      CNAME   traefik-cl01tl
               omni-tools                      IN      CNAME   traefik-cl01tl
-              paperless-ngx                   IN      CNAME   traefik-cl01tl
               photoview                       IN      CNAME   traefik-cl01tl
               plex                            IN      CNAME   traefik-cl01tl
               postiz                          IN      CNAME   traefik-cl01tl

clusters/cl01tl/helm/cloudnative-pg/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: cloudnative-pg
   repository: https://cloudnative-pg.io/charts/
-  version: 0.28.0
+  version: 0.27.1
 - name: plugin-barman-cloud
   repository: https://cloudnative-pg.io/charts/
   version: 0.5.0
-digest: sha256:3e9b26d00fdb61af60f003bcb327e05d02799eb6088e30aaabd01c49c6021aac
-generated: "2026-04-01T20:05:40.198140255Z"
+digest: sha256:e7089ffd089cae87529e28f0e71302b9fc4a869b389cbb6628f1c559644a3a10
+generated: "2026-02-05T19:36:19.473447121Z"

clusters/cl01tl/helm/cloudnative-pg/Chart.yaml

@@ -17,11 +17,11 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: cloudnative-pg
-    version: 0.28.0
+    version: 0.27.1
     repository: https://cloudnative-pg.io/charts/
   - name: plugin-barman-cloud
     version: 0.5.0
     repository: https://cloudnative-pg.io/charts/
 icon: https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg.github.io/refs/heads/main/assets/images/hero_image.png
 # renovate: datasource=github-releases depName=cloudnative-pg/cloudnative-pg
-appVersion: 1.29.0
+appVersion: 1.28.1

clusters/cl01tl/helm/code-server/values.yaml

@@ -12,7 +12,7 @@ code-server:
         main:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.112.0-ls325@sha256:a17ee95f4e1b43284fe5dfea99e82c8a26f096534215ff36817fa80161eec220
+            tag: 4.112.0@sha256:4bb5b8ad22268001687c047f0f04933799fb03df1eb0e1e266ba15ed2d9f4e8b
           env:
             - name: TZ
               value: America/Chicago
@@ -28,7 +28,7 @@ code-server:
           resources:
             requests:
               cpu: 1m
-              memory: 40Mi
+              memory: 50Mi
   service:
     main:
       controller: main
@@ -36,6 +36,7 @@ code-server:
         http:
           port: 8443
           targetPort: 8443
+          protocol: HTTP
   route:
     main:
       kind: HTTPRoute

clusters/cl01tl/helm/dawarich/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.6.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.11.1
+  version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-digest: sha256:1f513bd53430dd0fbba301ab5577aca85e984394dfdca9f615aae944a09c6bc0
-generated: "2026-03-31T18:37:35.858603-05:00"
+  version: 0.4.0
+digest: sha256:7584c2a1613454bbd83b66df46170fd0157df5186842844d483e2dd131398574
+generated: "2026-03-15T20:04:49.68456485Z"

clusters/cl01tl/helm/dawarich/Chart.yaml

@@ -21,12 +21,12 @@ dependencies:
     version: 4.6.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.11.1
+    version: 7.10.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.5.0
+    version: 0.4.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/dawarich.png
 # renovate: datasource=github-releases depName=Freika/dawarich
-appVersion: 1.6.0
+appVersion: 1.4.0

clusters/cl01tl/helm/dawarich/values.yaml

@@ -8,7 +8,7 @@ dawarich:
         main:
           image:
             repository: freikin/dawarich
-            tag: 1.6.0@sha256:5cba4d96fb57976fb6a956b8622365789d74a1178cc3ada1cb7541a4473993a9
+            tag: 1.4.0@sha256:07adb7643b00d1d8f606c675931d3604317fa3851b91b74ec503df8d50734cb8
           command:
             - "web-entrypoint.sh"
           args:
@@ -111,7 +111,7 @@ dawarich:
         sidekiq:
           image:
             repository: freikin/dawarich
-            tag: 1.6.0@sha256:5cba4d96fb57976fb6a956b8622365789d74a1178cc3ada1cb7541a4473993a9
+            tag: 1.4.0@sha256:07adb7643b00d1d8f606c675931d3604317fa3851b91b74ec503df8d50734cb8
           command:
             - "sidekiq-entrypoint.sh"
           args:
@@ -211,9 +211,11 @@ dawarich:
         http:
           port: 80
           targetPort: 3000
+          protocol: TCP
         metrics:
           port: 9394
           targetPort: 9394
+          protocol: TCP
   serviceMonitor:
     main:
       selector:

clusters/cl01tl/helm/democratic-csi-synology-iscsi/values.yaml

@@ -1,8 +1,5 @@
 democratic-csi:
   driver:
-    image:
-      registry: ghcr.io/democratic-csi/democratic-csi
-      tag: v1.9.5@@sha256:fc3b7d7ed3a616714139525075312758e23a5d425ffb539ad12c9bd20fb6001f
     existingConfigSecret: synology-iscsi-config-secret
     config:
       driver: synology-iscsi
@@ -13,23 +10,7 @@ democratic-csi:
   csiDriver:
     name: "org.democratic-csi.iscsi-synology"
   controller:
-    replicaCount: 3
-    externalAttacher:
-      image:
-        registry: registry.k8s.io/sig-storage/csi-attacher
-        tag: v4.11.0@sha256:b74b05b39501565022883fc128002b4cb857a7bb6c858606bcb3fdedba0b0b80
-    externalProvisioner:
-      image:
-        registry: registry.k8s.io/sig-storage/csi-provisioner
-        tag: v3.6.4@sha256:e7ad666f1d9b0caa077c7f0c157c9f87d1e73858390732496f66dcc716ff10c5
-    externalResizer:
-      image:
-        registry: registry.k8s.io/sig-storage/csi-resizer
-        tag: v1.9.4@sha256:522911ef68bd2c5c17d90fb2a6d2b2fb72ae790f2c1463a466b4262a07fdbf5a
-    externalSnapshotter:
-      image:
-        registry: registry.k8s.io/sig-storage/csi-snapshotter
-        tag: v8.5.0@sha256:da081c27e8a6d91f36042c1942362d0515ced8d06e18c11b8f893e58c4d6d797
+    replicaCount: 2
   storageClasses:
     - name: synology-iscsi-delete
       defaultClass: false
@@ -55,7 +36,3 @@ democratic-csi:
           value: /usr/local/sbin/iscsiadm
       iscsiDirHostPath: /var/iscsi
       iscsiDirHostPathType: ""
-  driverRegistrar:
-    image:
-      registry: registry.k8s.io/sig-storage/csi-node-driver-registrar
-      tag: v2.16.0@sha256:ab482308a4921e28a6df09a16ab99a457e9af9641ff44fb1be1a690d07ce8b70

clusters/cl01tl/helm/directus/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.6.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.11.1
+  version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-digest: sha256:116183cdff428293215553b7e60be9aefafbbaaaf64c01f1fc974badd3e0754b
-generated: "2026-03-31T18:37:42.414041-05:00"
+  version: 0.4.0
+digest: sha256:dfcb5d35e03ecdc4206227d206d36509319f0dcdaed54363840d71337debb3f7
+generated: "2026-03-15T20:05:03.156596646Z"

clusters/cl01tl/helm/directus/Chart.yaml

@@ -21,12 +21,12 @@ dependencies:
     version: 4.6.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.11.1
+    version: 7.10.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.5.0
+    version: 0.4.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/directus.png
 # renovate: datasource=github-releases depName=directus/directus
-appVersion: 11.17.1
+appVersion: 11.17.0

clusters/cl01tl/helm/directus/values.yaml

@@ -8,7 +8,7 @@ directus:
         main:
           image:
             repository: ghcr.io/directus/directus
-            tag: 11.17.1@sha256:1dd2080a50a9f6df2b6f49df15a7734424bbd1a5902983c4b6e447f22027b80b
+            tag: 11.17.0@sha256:076269ccbe7d4a0c44ce5f5b7f11e2ea5f7b3e4c4f704c0f88a52805e069c1c6
             pullPolicy: IfNotPresent
           env:
             - name: PUBLIC_URL
@@ -143,7 +143,7 @@ directus:
           resources:
             requests:
               cpu: 10m
-              memory: 300Mi
+              memory: 1Gi
   service:
     main:
       controller: main
@@ -151,6 +151,7 @@ directus:
         http:
           port: 80
           targetPort: 8055
+          protocol: TCP
   serviceMonitor:
     main:
       selector:
@@ -211,7 +212,3 @@ valkey:
       aclUsers:
         default:
           permissions: "~* &* +@all"
-    # No option to configure metrics when auth is enabled
-    # https://github.com/valkey-io/valkey-helm/issues/135
-    metrics:
-      enabled: false

clusters/cl01tl/helm/elastic-operator/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: eck-operator
   repository: https://helm.elastic.co
-  version: 3.3.2
-digest: sha256:ac7a849a6d8244ef56c11f18438c4c76133f92d245228c5a1c8369d42562c177
-generated: "2026-04-01T21:30:02.975920565Z"
+  version: 3.3.1
+digest: sha256:8585f3ea3e4cafc4ff2969ea7e797017b7cfe4becb3385f0b080725908c02f09
+generated: "2026-02-25T18:48:55.77034549Z"

clusters/cl01tl/helm/elastic-operator/Chart.yaml

@@ -14,7 +14,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: eck-operator
-    version: 3.3.2
+    version: 3.3.1
     repository: https://helm.elastic.co
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/elastic.png
 # renovate: datasource=github-releases depName=elastic/cloud-on-k8s

clusters/cl01tl/helm/excalidraw/values.yaml

@@ -25,6 +25,7 @@ excalidraw:
         http:
           port: 80
           targetPort: 80
+          protocol: HTTP
   route:
     main:
       kind: HTTPRoute

clusters/cl01tl/helm/foldergram/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
 # renovate: datasource=github-releases depName=foldergram/foldergram
-appVersion: v1.0.9
+appVersion: v1.0.8

clusters/cl01tl/helm/foldergram/values.yaml

@@ -36,6 +36,7 @@ foldergram:
         http:
           port: 80
           targetPort: 4141
+          protocol: HTTP
   route:
     main:
       kind: HTTPRoute

clusters/cl01tl/helm/freshrss/Chart.lock

@@ -7,9 +7,9 @@ dependencies:
   version: 2.4.0
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.11.1
+  version: 7.10.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:ebf08159809ef0d69fcb8742b47245c82994b528c2f58e5ed40293555e085ecd
-generated: "2026-03-31T18:37:59.187695-05:00"
+digest: sha256:a7bdbecd50433fedd65d3043102fe3c9e366dc98953c37eb0cfe762bce833e8e
+generated: "2026-03-15T20:05:14.085780861Z"

clusters/cl01tl/helm/freshrss/Chart.yaml

@@ -25,7 +25,7 @@ dependencies:
     version: 2.4.0
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.11.1
+    version: 7.10.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-data

clusters/cl01tl/helm/freshrss/values.yaml

@@ -79,7 +79,7 @@ freshrss:
           resources:
             requests:
               cpu: 1m
-              memory: 100Mi
+              memory: 128Mi
   service:
     main:
       controller: main
@@ -87,6 +87,7 @@ freshrss:
         http:
           port: 80
           targetPort: 80
+          protocol: HTTP
   persistence:
     data:
       forceRename: freshrss-data

clusters/cl01tl/helm/garage/values.yaml

@@ -28,7 +28,7 @@ garage:
           resources:
             requests:
               cpu: 10m
-              memory: 200Mi
+              memory: 400Mi
     server-2:
       type: deployment
       replicas: 1
@@ -57,7 +57,7 @@ garage:
           resources:
             requests:
               cpu: 10m
-              memory: 200Mi
+              memory: 400Mi
     server-3:
       type: deployment
       replicas: 1
@@ -86,7 +86,7 @@ garage:
           resources:
             requests:
               cpu: 10m
-              memory: 200Mi
+              memory: 400Mi
     webui:
       type: deployment
       replicas: 1
@@ -212,15 +212,19 @@ garage:
         s3:
           port: 3900
           targetPort: 3900
+          protocol: HTTP
         rpc:
           port: 3901
           targetPort: 3901
+          protocol: HTTP
         web:
           port: 3902
           targetPort: 3902
+          protocol: HTTP
         admin:
           port: 3903
           targetPort: 3903
+          protocol: HTTP
     server-2:
       forceRename: garage-2
       controller: server-2
@@ -228,15 +232,19 @@ garage:
         s3:
           port: 3900
           targetPort: 3900
+          protocol: HTTP
         rpc:
           port: 3901
           targetPort: 3901
+          protocol: HTTP
         web:
           port: 3902
           targetPort: 3902
+          protocol: HTTP
         admin:
           port: 3903
           targetPort: 3903
+          protocol: HTTP
     server-3:
       forceRename: garage-3
       controller: server-3
@@ -244,21 +252,26 @@ garage:
         s3:
           port: 3900
           targetPort: 3900
+          protocol: HTTP
         rpc:
           port: 3901
           targetPort: 3901
+          protocol: HTTP
         web:
           port: 3902
           targetPort: 3902
+          protocol: HTTP
         admin:
           port: 3903
           targetPort: 3903
+          protocol: HTTP
     webui:
       controller: webui
       ports:
         webui:
           port: 3909
           targetPort: 3909
+          protocol: HTTP
   serviceMonitor:
     main:
       selector:

clusters/cl01tl/helm/gatus/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 1.5.0
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.11.1
+  version: 7.10.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:1f530794c6d9c4a487d30443dce7ddf556524c7f875c6e5249b135e81528f0c5
-generated: "2026-03-31T19:06:30.871275-05:00"
+digest: sha256:83ec84774e0cc708f1cb5d83d657180159bfb75c9928784ebf0280e224b1cbca
+generated: "2026-03-15T20:05:27.625292422Z"

clusters/cl01tl/helm/gatus/Chart.yaml

@@ -20,7 +20,7 @@ dependencies:
     version: 1.5.0
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.11.1
+    version: 7.10.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-data

clusters/cl01tl/helm/gatus/values.yaml

@@ -164,15 +164,15 @@ gatus:
       - name: roundcube
         url: https://mail.alexlebens.net
         <<: *defaults
-      - name: paperless-ngx
-        url: https://paperless-ngx.alexlebens.net
-        <<: *defaults
       - name: kiwix
         url: https://kiwix.alexlebens.net
         <<: *defaults
       - name: excalidraw
         url: https://excalidraw.alexlebens.net
         <<: *defaults
+      - name: languagetool
+        url: https://languagetool.alexlebens.net
+        <<: *defaults
       - name: gitea
         url: https://gitea.alexlebens.net
         <<: *defaults

clusters/cl01tl/helm/generic-device-plugin/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: generic-device-plugin
   repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-  version: 0.20.27
-digest: sha256:b66a7ab013f5eda47ccf94824796e026642e1abfc051e498957ee0f59743e9fc
-generated: "2026-03-31T21:37:08.823163353Z"
+  version: 0.20.26
+digest: sha256:47d12b7555d345dea0438d13ac538896994dbd44b142b9a546dbfe5c0939a92b
+generated: "2026-03-24T16:59:26.537547513Z"

clusters/cl01tl/helm/generic-device-plugin/Chart.yaml

@@ -14,6 +14,6 @@ maintainers:
 dependencies:
   - name: generic-device-plugin
     repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm
-    version: 0.20.27
+    version: 0.20.26
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
 appVersion: 1.0.0

clusters/cl01tl/helm/gitea/Chart.lock

@@ -4,10 +4,10 @@ dependencies:
   version: 12.5.0
 - name: actions
   repository: https://dl.gitea.com/charts/
-  version: 0.0.4
+  version: 0.0.3
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.30.0
+  version: 0.29.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.4.0
@@ -16,12 +16,12 @@ dependencies:
   version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
+  version: 0.4.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
+  version: 0.4.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:a31820970bf7a7e5fa51ff09668238ab5e3b9d4433a71e35d07b779ff632b94c
-generated: "2026-04-01T21:57:18.743604859Z"
+digest: sha256:49862b06fe4884f504d0a892cb899f577262b584053b64a3504bacaf96d70f39
+generated: "2026-03-26T20:59:30.690577-05:00"

clusters/cl01tl/helm/gitea/Chart.yaml

@@ -30,9 +30,9 @@ dependencies:
   - name: actions
     alias: gitea-actions
     repository: https://dl.gitea.com/charts/
-    version: 0.0.4
+    version: 0.0.3
   - name: meilisearch
-    version: 0.30.0
+    version: 0.29.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts
@@ -43,11 +43,11 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-gitea
-    version: 0.5.0
+    version: 0.4.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-renovate
-    version: 0.5.0
+    version: 0.4.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-storage

clusters/cl01tl/helm/gitea/values.yaml

@@ -191,8 +191,8 @@ meilisearch:
     size: 5Gi
   resources:
     requests:
-      cpu: 10m
-      memory: 150Mi
+      cpu: 1m
+      memory: 160Mi
   serviceMonitor:
     enabled: true
 postgres-18-cluster:
@@ -201,7 +201,7 @@ postgres-18-cluster:
     resources:
       requests:
         cpu: 100m
-        memory: 150Mi
+        memory: 100Mi
   recovery:
     method: objectStore
     objectStore:
@@ -224,7 +224,7 @@ valkey-gitea:
     resources:
       requests:
         cpu: 20m
-        memory: 1Gi
+        memory: 2Gi
     dataStorage:
       requestedSize: 10Gi
     replica:

clusters/cl01tl/helm/grafana-operator/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 5.22.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.11.1
+  version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
+  version: 0.4.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-digest: sha256:1f6bf4f0f24f85d8c362766010e4f42d26458c0412b67afab9b05f2e17eacced
-generated: "2026-03-31T19:12:08.326471-05:00"
+  version: 0.4.0
+digest: sha256:a3bf183bcecb4d4b5354fe91a549075997dccb41c193da9daec9ccbe4d659fe2
+generated: "2026-03-18T10:04:15.165729555Z"

clusters/cl01tl/helm/grafana-operator/Chart.yaml

@@ -20,15 +20,15 @@ dependencies:
     repository: https://grafana.github.io/helm-charts
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.11.1
+    version: 7.10.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-unified-alerting
-    version: 0.5.0
+    version: 0.4.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey-remote-cache
-    version: 0.5.0
+    version: 0.4.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/grafana.png
 # renovate: datasource=github-releases depName=grafana/grafana-operator

clusters/cl01tl/helm/grafana-operator/templates/grafana.yaml

@@ -61,7 +61,7 @@ spec:
               resources:
                 requests:
                   cpu: 20m
-                  memory: 150Mi
+                  memory: 120Mi
               env:
                 - name: AUTH_CLIENT_ID
                   valueFrom:

clusters/cl01tl/helm/grafana-operator/values.yaml

@@ -1,9 +1,4 @@
 grafana-operator:
-  image:
-    registry: ghcr.io
-    repository: grafana/grafana-operator
-    # renovate: datasource=docker depName=ghcr.io/grafana/grafana-operator
-    tag: v5.22.2@sha256:d45fc24e8f43d83286d81625ee8d919d0fc88255a6500b63f68d7966a4f9e9af
   replicas: 2
   resources:
     requests:

clusters/cl01tl/helm/grimmory/values.yaml

@@ -44,6 +44,7 @@ grimmory:
         http:
           port: 80
           targetPort: 6060
+          protocol: HTTP
   route:
     main:
       kind: HTTPRoute

clusters/cl01tl/helm/harbor/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 1.18.3
 - name: postgres-cluster
   repository: https://gitea.alexlebens.net/api/packages/alexlebens/helm
-  version: 7.11.1
+  version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-digest: sha256:fb17e2bad9c3a303da2b9d65ee5bd082a58ca6a5cee17d337e2536747982aa2c
-generated: "2026-03-31T18:38:15.510833-05:00"
+  version: 0.4.0
+digest: sha256:e7a5cee56dddb4abc07ff18677cb6ddf55571b38da2eeb7e654e8ad8f7709bfa
+generated: "2026-03-19T04:16:54.362332682Z"

clusters/cl01tl/helm/harbor/Chart.yaml

@@ -4,14 +4,15 @@ version: 1.0.0
 description: Harbor
 keywords:
   - harbor
-  - image-registry
-home: https://docs.alexlebens.dev/applications/harbor/
+  - images
+  - cache
+  - kubernetes
+home: https://wiki.alexlebens.dev/s/7e132c13-afee-48ec-b3dd-efd656d240c9
 sources:
   - https://github.com/goharbor
-  - https://github.com/orgs/goharbor/packages
+  - https://github.com/cloudnative-pg/cloudnative-pg
   - https://github.com/goharbor/harbor-helm
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
 maintainers:
   - name: alexlebens
 dependencies:
@@ -20,11 +21,11 @@ dependencies:
     repository: https://helm.goharbor.io
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.11.1
+    version: 7.10.0
     repository: https://gitea.alexlebens.net/api/packages/alexlebens/helm
   - name: valkey
     alias: valkey
-    version: 0.5.0
+    version: 0.4.0
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/harbor.png
 # renovate: datasource=github-releases depName=goharbor/harbor

clusters/cl01tl/helm/harbor/templates/external-secret.yaml

@@ -14,49 +14,85 @@ spec:
   data:
     - secretKey: HARBOR_ADMIN_PASSWORD
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/harbor/config
+        metadataPolicy: None
         property: admin-password
     - secretKey: secretKey
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/harbor/config
+        metadataPolicy: None
         property: secretKey
     - secretKey: CSRF_KEY
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/harbor/core
+        metadataPolicy: None
         property: CSRF_KEY
     - secretKey: secret
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/harbor/core
+        metadataPolicy: None
         property: secret
     - secretKey: tls.crt
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/harbor/core
+        metadataPolicy: None
         property: tls.crt
     - secretKey: tls.key
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/harbor/core
+        metadataPolicy: None
         property: tls.key
     - secretKey: JOBSERVICE_SECRET
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/harbor/jobservice
+        metadataPolicy: None
         property: JOBSERVICE_SECRET
     - secretKey: REGISTRY_HTTP_SECRET
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/harbor/registry
+        metadataPolicy: None
         property: REGISTRY_HTTP_SECRET
     - secretKey: REGISTRY_REDIS_PASSWORD
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/harbor/registry
+        metadataPolicy: None
         property: REGISTRY_REDIS_PASSWORD
     - secretKey: REGISTRY_HTPASSWD
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/harbor/registry
+        metadataPolicy: None
         property: REGISTRY_HTPASSWD
     - secretKey: REGISTRY_CREDENTIAL_PASSWORD
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/harbor/registry
+        metadataPolicy: None
         property: REGISTRY_CREDENTIAL_PASSWORD
     - secretKey: REGISTRY_PASSWD
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/harbor/registry
+        metadataPolicy: None
         property: REGISTRY_CREDENTIAL_PASSWORD

clusters/cl01tl/helm/harbor/values.yaml

@@ -21,9 +21,13 @@ harbor:
         size: 100Gi
   existingSecretAdminPassword: harbor-secret
   existingSecretAdminPasswordKey: HARBOR_ADMIN_PASSWORD
+  internalTLS:
+    enabled: false
   ipFamily:
     ipv6:
       enabled: false
+    ipv4:
+      enabled: true
   updateStrategy:
     type: Recreate
   existingSecretSecretKey: harbor-secret
@@ -69,12 +73,12 @@ harbor:
     credentials:
       existingSecret: harbor-secret
     upload_purging:
+      enabled: true
       age: 72h
+      interval: 24h
+      dryrun: false
   trivy:
     enabled: true
-    image:
-      repository: ghcr.io/goharbor/trivy-adapter-photon
-      tag: v2.15.0@sha256:6fd6de9cfbbb04cb1d94722cfa01cf71b8994d3f9e7891d3b03a89a7536480ba
   database:
     type: external
     external:
@@ -105,14 +109,32 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
+      # - name: garage-remote
+      #   index: 1
+      #   destinationBucket: postgres-backups
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   retentionPolicy: "90d"
+      #   data:
+      #     compression: bzip2
+      # - name: external
+      #   index: 1
+      #   endpointURL: https://nyc3.digitaloceanspaces.com
+      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 35 14 * * *"
         backupName: garage-local
-valkey:
-  valkey:
-    resources:
-      requests:
-        memory: 30Mi
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 4 * * SAT"
+      #   backupName: garage-remote
+      # - name: daily-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external

clusters/cl01tl/helm/headlamp/Chart.yaml

@@ -5,7 +5,8 @@ description: Headlamp
 keywords:
   - headlamp
   - dashboard
-home: https://docs.alexlebens.dev/applications/headlamp/
+  - kubernetes
+home: https://wiki.alexlebens.dev/s/6cc43960-78df-459d-aab6-433844249243
 sources:
   - https://github.com/headlamp-k8s/headlamp
   - https://github.com/headlamp-k8s/headlamp/tree/main/charts/headlamp

clusters/cl01tl/helm/headlamp/templates/external-secret.yaml

@@ -14,25 +14,43 @@ spec:
   data:
     - secretKey: OIDC_CLIENT_ID
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /authentik/oidc/headlamp
+        metadataPolicy: None
         property: client
     - secretKey: OIDC_CLIENT_SECRET
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /authentik/oidc/headlamp
+        metadataPolicy: None
         property: secret
     - secretKey: OIDC_ISSUER_URL
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /authentik/oidc/headlamp
+        metadataPolicy: None
         property: issuer
     - secretKey: OIDC_SCOPES
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /authentik/oidc/headlamp
+        metadataPolicy: None
         property: scopes
     - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_IDP_ISSUER_URL
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /authentik/oidc/headlamp
+        metadataPolicy: None
         property: validator-issuer-url
     - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_CLIENT_ID
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /authentik/oidc/headlamp
+        metadataPolicy: None
         property: validator-client-id

clusters/cl01tl/helm/headlamp/templates/http-route.yaml

@@ -0,0 +1,28 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: headlamp
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: headlamp
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+  hostnames:
+    - headlamp.alexlebens.net
+  rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: /
+      backendRefs:
+        - group: ''
+          kind: Service
+          name: headlamp
+          port: 80
+          weight: 100

clusters/cl01tl/helm/headlamp/values.yaml

@@ -1,9 +1,5 @@
 headlamp:
   replicaCount: 2
-  image:
-    registry: ghcr.io
-    repository: headlamp-k8s/headlamp
-    tag: v0.41.0@sha256:89c6c65810bfde61796483c93c70d659104355593792bf55cab680d685da8eeb
   config:
     oidc:
       secret:
@@ -14,30 +10,10 @@ headlamp:
     watchPlugins: true
     # Bypasses: https://github.com/kubernetes-sigs/headlamp/issues/4883
     sessionTTL: null
-  httpRoute:
-    enabled: true
-    parentRefs:
-      - group: gateway.networking.k8s.io
-        kind: Gateway
-        name: traefik-gateway
-        namespace: traefik
-    hostnames:
-      - headlamp.alexlebens.net
-    rules:
-      - matches:
-        - path:
-            type: PathPrefix
-            value: /
-        backendRefs:
-          - group: ''
-            kind: Service
-            name: headlamp
-            port: 80
-            weight: 100
   resources:
     requests:
-      cpu: 1m
-      memory: 80Mi
+      cpu: 10m
+      memory: 128Mi
   pluginsManager:
     enabled: true
     securityContext:

clusters/cl01tl/helm/home-assistant/Chart.yaml

@@ -4,13 +4,14 @@ version: 1.0.0
 description: Home Assistant
 keywords:
   - home-assistant
-  - home-automation
-home: https://docs.alexlebens.dev/applications/home-assistant/
+  - home
+  - automation
+home: https://wiki.alexlebens.dev/s/5462c17e-cd39-4082-ad01-94545a2fa3ca
 sources:
+  - https://www.home-assistant.io/
   - https://github.com/home-assistant/core
   - https://github.com/home-assistant/core/pkgs/container/home-assistant
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:
@@ -24,4 +25,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/home-assistant.png
 # renovate: datasource=github-releases depName=home-assistant/core
-appVersion: 2026.4.0
+appVersion: 2026.3.4

clusters/cl01tl/helm/home-assistant/templates/external-secret.yaml

@@ -14,11 +14,17 @@ spec:
   data:
     - secretKey: PASSWORD
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/home-assistant/code-server/auth
+        metadataPolicy: None
         property: PASSWORD
     - secretKey: SUDO_PASSWORD
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/home-assistant/code-server/auth
+        metadataPolicy: None
         property: SUDO_PASSWORD
 
 ---
@@ -38,5 +44,8 @@ spec:
   data:
     - secretKey: bearer-token
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/home-assistant/auth
+        metadataPolicy: None
         property: bearer-token

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -4,29 +4,28 @@ home-assistant:
       type: deployment
       replicas: 1
       strategy: Recreate
-      pod:
-        securityContext:
-          fsGroup: 1000
-          fsGroupChangePolicy: OnRootMismatch
+      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: ghcr.io/home-assistant/home-assistant
-            tag: 2026.4.0@sha256:7fbf6a5e006e889d7799476ad7646bd18e9dc73e8a4ccd9326b41798de6bb3bf
+            tag: 2026.3.4
+            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: America/Chicago
+              value: US/Central
           resources:
             requests:
-              cpu: 1m
-              memory: 400Mi
+              cpu: 50m
+              memory: 512Mi
         code-server:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.112.0-ls325@sha256:a17ee95f4e1b43284fe5dfea99e82c8a26f096534215ff36817fa80161eec220
+            tag: 4.112.0@sha256:4bb5b8ad22268001687c047f0f04933799fb03df1eb0e1e266ba15ed2d9f4e8b
+            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: America/Chicago
+              value: US/Central
             - name: PUID
               value: 1000
             - name: PGID
@@ -36,6 +35,10 @@ home-assistant:
           envFrom:
             - secretRef:
                 name: home-assistant-code-server-password-secret
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
   service:
     main:
       controller: main
@@ -43,12 +46,14 @@ home-assistant:
         http:
           port: 80
           targetPort: 8123
+          protocol: TCP
     code-server:
       controller: main
       ports:
         http:
           port: 8443
           targetPort: 8443
+          protocol: HTTP
   serviceMonitor:
     main:
       selector:
@@ -77,8 +82,11 @@ home-assistant:
         - home-assistant.alexlebens.net
       rules:
         - backendRefs:
-            - name: home-assistant-main
+            - group: ''
+              kind: Service
+              name: home-assistant-main
               port: 80
+              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -94,8 +102,11 @@ home-assistant:
         - home-assistant-code-server.alexlebens.net
       rules:
         - backendRefs:
-            - name: home-assistant-code-server
+            - group: ''
+              kind: Service
+              name: home-assistant-code-server
               port: 8443
+              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -117,6 +128,8 @@ home-assistant:
 volsync-target-config:
   pvcTarget: home-assistant-config
   moverSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
     fsGroup: 1000
     fsGroupChangePolicy: OnRootMismatch
   local:

clusters/cl01tl/helm/homepage/Chart.yaml

@@ -5,7 +5,7 @@ description: Homepage
 keywords:
   - homepage
   - dashboard
-home: https://docs.alexlebens.dev/applications/homepage/
+home: https://wiki.alexlebens.dev/s/a5fabd91-3d89-4e2b-9417-06111aedaeaa
 sources:
   - https://github.com/gethomepage/homepage
   - https://github.com/gethomepage/homepage/pkgs/container/homepage
@@ -19,4 +19,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/homepage.png
 # renovate: datasource=github-releases depName=gethomepage/homepage
-appVersion: v1.12.3
+appVersion: v1.12.0

clusters/cl01tl/helm/homepage/templates/external-secret.yaml

@@ -14,69 +14,120 @@ spec:
   data:
     - secretKey: HOMEPAGE_VAR_GITEA_API_TOKEN
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/gitea/auth/homepage
+        metadataPolicy: None
         property: token
     - secretKey: HOMEPAGE_VAR_ARGOCD_API_TOKEN
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/argocd/credentials/homepage
+        metadataPolicy: None
         property: token
     - secretKey: HOMEPAGE_VAR_KOMODO_API_KEY
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/komodo/homepage
+        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_KOMODO_API_SECRET
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/komodo/homepage
+        metadataPolicy: None
         property: secret
     - secretKey: HOMEPAGE_VAR_JELLYSTAT_API_KEY
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/jellystat/homepage
+        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_SYNOLOGY_USER
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /synology/auth/cl01tl
+        metadataPolicy: None
         property: user
     - secretKey: HOMEPAGE_VAR_SYNOLOGY_PASSWORD
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /synology/auth/cl01tl
+        metadataPolicy: None
         property: password
     - secretKey: HOMEPAGE_VAR_UNIFI_API_KEY
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /unifi/auth/cl01tl
+        metadataPolicy: None
         property: api-key
     - secretKey: HOMEPAGE_VAR_SONARR_KEY
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/sonarr4/key
+        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_SONARR4K_KEY
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/sonarr4-4k/key
+        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_SONARRANIME_KEY
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/sonarr4-anime/key
+        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_RADARR_KEY
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/radarr5/key
+        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_RADARR4K_KEY
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/radarr5-4k/key
+        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_RADARRANIME_KEY
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/radarr5-anime/key
+        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_RADARRSTANDUP_KEY
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/radarr5-standup/key
+        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_LIDARR_KEY
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/lidarr2/key
+        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_PROWLARR_KEY
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/prowlarr/key
+        metadataPolicy: None
         property: key

clusters/cl01tl/helm/homepage/values.yaml

@@ -5,7 +5,7 @@ homepage:
     main:
       type: deployment
       replicas: 1
-      strategy: Recreate
+      strategy: RollingUpdate
       annotations:
         reloader.stakater.com/auto: "true"
       serviceAccount:
@@ -16,7 +16,8 @@ homepage:
         main:
           image:
             repository: ghcr.io/gethomepage/homepage
-            tag: v1.12.3@sha256:cc84f2f5eb3c7734353701ccbaa24ed02dacb0d119114e50e4251e2005f3990a
+            tag: v1.12.0
+            pullPolicy: IfNotPresent
           env:
             - name: HOMEPAGE_ALLOWED_HOSTS
               value: home.alexlebens.net
@@ -25,8 +26,8 @@ homepage:
                 name: homepage-keys-secret
           resources:
             requests:
-              cpu: 1m
-              memory: 128Mi
+              cpu: 10m
+              memory: 256Mi
   serviceAccount:
     homepage:
       enabled: true
@@ -56,7 +57,7 @@ homepage:
             - Media:
                 tab: Applications
                 icon: mdi-multimedia-#ffffff
-            - External:
+            - Public:
                 tab: Applications
                 icon: mdi-earth-#ffffff
             - Internal:
@@ -188,7 +189,7 @@ homepage:
                   siteMonitor: http://photoview.photoview:80
                   statusStyle: dot
               - Pictures:
-                  icon: sh-foldergram.webp
+                  icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
                   description: Foldergram
                   href: https://foldergram.alexlebens.net
                   siteMonitor: http://foldergram.foldergram:80
@@ -199,7 +200,7 @@ homepage:
                   href: https://grimmory.alexlebens.net
                   siteMonitor: http://grimmory.grimmory:80
                   statusStyle: dot
-          - External:
+          - Public:
               - Site:
                   icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.png
                   description: Profile Website
@@ -303,12 +304,6 @@ homepage:
                   href: https://mail.alexlebens.net
                   siteMonitor: http://roundcube.roundcube:80
                   statusStyle: dot
-              - Documents:
-                  icon: sh-paperless-ngx.webp
-                  description: Paperless-ngx
-                  href: https://paperless-ngx.alexlebens.net
-                  siteMonitor: http://paperless-ngx.paperless-ngx:80
-                  statusStyle: dot
               - Wiki:
                   icon: sh-kiwix-light.webp
                   description: Kiwix
@@ -322,7 +317,7 @@ homepage:
                   siteMonitor: http://excalidraw.excalidraw:80
                   statusStyle: dot
           - Code:
-              - Code (External):
+              - Code (Public):
                   icon: sh-gitea.webp
                   description: Gitea
                   href: https://gitea.alexlebens.dev
@@ -344,13 +339,13 @@ homepage:
                   href: https://gitea.alexlebens.net
                   siteMonitor: https://gitea.alexlebens.net
                   statusStyle: dot
-              - Code (Remote):
+              - Code (ps10rp):
                   icon: sh-gitea.webp
                   description: Gitea
                   href: https://gitea-ps10rp.boreal-beaufort.ts.net
                   siteMonitor: https://gitea-ps10rp.boreal-beaufort.ts.net
                   statusStyle: dot
-              - IDE (External):
+              - IDE (Public):
                   icon: sh-visual-studio-code.webp
                   description: VS Code
                   href: https://codeserver.alexlebens.dev
@@ -468,31 +463,25 @@ homepage:
                         query: prometheus_tsdb_storage_blocks_bytes
                         format:
                           type: bytes
-              - Jellyfin Monitor:
+              - Jellystat:
                   icon: sh-jellystat.webp
-                  description: Jellystat
+                  description: Jellyfin Monitoring
                   href: https://jellystat.alexlebens.net
                   siteMonitor: http://jellystat.jellystat:80
                   statusStyle: dot
-              - Media Library Statistics:
+              - MediaLyze:
                   icon: https://raw.githubusercontent.com/frederikemmer/MediaLyze/d8f69c0628bac7c047b90f91a66341648029c273/frontend/public/favicon.svg
-                  description: MediaLyze
+                  description: Jellyfin Media Monitoring
                   href: https://medialyze.alexlebens.net
                   siteMonitor: http://medialyze.medialyze:80
                   statusStyle: dot
           - Services:
-              - Auth (External):
+              - Auth (Public):
                   icon: sh-authentik.webp
                   description: Authentik
                   href: https://auth.alexlebens.dev
                   siteMonitor: https://auth.alexlebens.dev
                   statusStyle: dot
-                  namespace: authentik
-                  app: authentik
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          authentik
-                      )
               - Auth (Local):
                   icon: sh-authentik.webp
                   description: Authentik
@@ -505,36 +494,18 @@ homepage:
                   href: https://stalwart.alexlebens.net
                   siteMonitor: http://stalwart.stalwart:80
                   statusStyle: dot
-                  namespace: stalwart
-                  app: stalwart
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          stalwart
-                      )
               - Notifications:
                   icon: sh-ntfy.webp
                   description: ntfy
                   href: https://ntfy.alexlebens.net
                   siteMonitor: http://ntfy.ntfy:80
                   statusStyle: dot
-                  namespace: ntfy
-                  app: ntfy
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          ntfy
-                      )
               - Reverse Proxy:
                   icon: sh-traefik.webp
                   description: Traefik
                   href: https://traefik-cl01tl.alexlebens.net/dashboard/#/
                   siteMonitor: https://traefik-cl01tl.alexlebens.net/dashboard/#/
                   statusStyle: dot
-                  namespace: traefik
-                  app: traefik
-                  podSelector: >-
-                      app.kubernetes.io/name in (
-                          traefik
-                      )
                   widget:
                     type: traefik
                     url: https://traefik-cl01tl.alexlebens.net
@@ -544,14 +515,8 @@ homepage:
                   href: https://harbor.alexlebens.net
                   siteMonitor: http://harbor-portal.harbor:80
                   statusStyle: dot
-                  namespace: harbor
-                  app: harbor
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          harbor
-                      )
           - Hardware:
-              - Network Management (Local):
+              - Network Management (alexlebens.net):
                   icon: sh-ubiquiti-unifi.webp
                   description: Unifi
                   href: https://unifi.alexlebens.net
@@ -604,22 +569,13 @@ homepage:
                   href: https://ceph.alexlebens.net
                   siteMonitor: http://rook-ceph-mgr-dashboard.rook-ceph:7000
                   statusStyle: dot
-                  namespace: rook-ceph
-                  app: rook-ceph
-                  podSelector: ""
-              - Object Storage (Local):
+              - Object Storage (NAS):
                   icon: sh-garage.webp
                   description: Garage
                   href: https://garage-webui.alexlebens.net
                   siteMonitor: http://garage-webui.garage:3909
                   statusStyle: dot
-                  namespace: garage
-                  app: garage
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          garage
-                      )
-              - Object Storage (Remote):
+              - Object Storage (ps10rp):
                   icon: sh-garage.webp
                   description: Garage
                   href: https://garage-ui-ps10rp.boreal-beaufort.ts.net
@@ -637,24 +593,12 @@ homepage:
                   href: https://vault.alexlebens.net
                   siteMonitor: http://vault.vault:8200
                   statusStyle: dot
-                  namespace: vault
-                  app: vault
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          vault
-                      )
               - Backups:
                   icon: sh-backrest-light.webp
                   description: Backrest
                   href: https://backrest.alexlebens.net
                   siteMonitor: http://backrest.backrest:80
                   statusStyle: dot
-                  namespace: backrest
-                  app: backrest
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          backrest
-                      )
                   widget:
                       type: backrest
                       url: http://backrest.backrest:80
@@ -665,12 +609,6 @@ homepage:
                   href: https://qui.alexlebens.net
                   siteMonitor: http://qbittorrent-qui.qbittorrent:80
                   statusStyle: dot
-                  namespace: qbittorrent
-                  app: qbittorrent
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          qbittorrent
-                      )
                   widget:
                     type: qbittorrent
                     url: http://qbittorrent.qbittorrent:8080
@@ -699,12 +637,6 @@ homepage:
                   href: https://tdarr.alexlebens.net
                   siteMonitor: http://tdarr-web.tdarr:8265
                   statusStyle: dot
-                  namespace: tdarr
-                  app: tdarr
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          tdarr
-                      )
                   widget:
                     type: tdarr
                     url: http://tdarr-web.tdarr:8265
@@ -715,12 +647,6 @@ homepage:
                   href: https://sonarr.alexlebens.net
                   siteMonitor: http://sonarr.sonarr:80
                   statusStyle: dot
-                  namespace: sonarr
-                  app: sonarr
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          sonarr
-                      )
                   widget:
                     type: sonarr
                     url: http://sonarr.sonarr:80
@@ -733,12 +659,6 @@ homepage:
                   href: https://sonarr-4k.alexlebens.net
                   siteMonitor: http://sonarr-4k.sonarr-4k:80
                   statusStyle: dot
-                  namespace: sonarr-4k
-                  app: sonarr-4k
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          sonarr-4k
-                      )
                   widget:
                     type: sonarr
                     url: http://sonarr-4k.sonarr-4k:80
@@ -751,12 +671,6 @@ homepage:
                   href: https://sonarr-anime.alexlebens.net
                   siteMonitor: http://sonarr-anime.sonarr-anime:80
                   statusStyle: dot
-                  namespace: sonarr-anime
-                  app: sonarr-anime
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          sonarr-anime
-                      )
                   widget:
                     type: sonarr
                     url: http://sonarr-anime.sonarr-anime:80
@@ -770,12 +684,6 @@ homepage:
                   href: https://radarr.alexlebens.net
                   siteMonitor: http://radarr.radarr:80
                   statusStyle: dot
-                  namespace: radarr
-                  app: radarr
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          radarr
-                      )
                   widget:
                     type: radarr
                     url: http://radarr.radarr:80
@@ -788,12 +696,6 @@ homepage:
                   href: https://radarr-4k.alexlebens.net
                   siteMonitor: http://radarr-4k.radarr-4k:80
                   statusStyle: dot
-                  namespace: radarr-4k
-                  app: radarr-4k
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          radarr-4k
-                      )
                   widget:
                     type: radarr
                     url: http://radarr-4k.radarr-4k:80
@@ -806,12 +708,6 @@ homepage:
                   href: https://radarr-anime.alexlebens.net
                   siteMonitor: http://radarr-anime.radarr-anime:80
                   statusStyle: dot
-                  namespace: radarr-anime
-                  app: radarr-anime
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          radarr-anime
-                      )
                   widget:
                     type: radarr
                     url: http://radarr-anime.radarr-anime:80
@@ -824,12 +720,6 @@ homepage:
                   href: https://radarr-standup.alexlebens.net
                   siteMonitor: http://radarr-standup.radarr-standup:80
                   statusStyle: dot
-                  namespace: radarr-standup
-                  app: radarr-standup
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          radarr-standup
-                      )
                   widget:
                     type: radarr
                     url: http://radarr-standup.radarr-standup:80
@@ -843,12 +733,6 @@ homepage:
                   href: https://lidarr.alexlebens.net
                   siteMonitor: http://lidarr.lidarr:80
                   statusStyle: dot
-                  namespace: lidarr
-                  app: lidarr
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          lidarr
-                      )
                   widget:
                     type: lidarr
                     url: http://lidarr.lidarr:80
@@ -872,12 +756,6 @@ homepage:
                   href: https://slskd.alexlebens.net
                   siteMonitor: http://slskd.slskd:5030
                   statusStyle: dot
-                  namespace: slskd
-                  app: slskd
-                  podSelector: >-
-                      app.kubernetes.io/instance in (
-                          slskd
-                      )
           - Books:
               - Shelfmark:
                   icon: sh-shelfmark.webp
@@ -944,6 +822,7 @@ homepage:
         http:
           port: 80
           targetPort: 3000
+          protocol: HTTP
   route:
     main:
       kind: HTTPRoute
@@ -956,8 +835,11 @@ homepage:
         - home.alexlebens.net
       rules:
         - backendRefs:
-            - name: homepage
+            - group: ''
+              kind: Service
+              name: homepage
               port: 80
+              weight: 100
           matches:
             - path:
                 type: PathPrefix

clusters/cl01tl/helm/houndarr/Chart.yaml

@@ -5,12 +5,10 @@ description: Houndarr
 keywords:
   - houndarr
   - servarr
-home: https://docs.alexlebens.dev/applications/houndarr/
+home: https://wiki.alexlebens.dev/s/
 sources:
   - https://github.com/av1155/houndarr
-  - https://github.com/av1155/houndarr/pkgs/container/houndarr
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:
@@ -22,6 +20,6 @@ dependencies:
     alias: volsync-target-data
     version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
-icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/houndarr.png
+icon: https://raw.githubusercontent.com/av1155/houndarr/main/src/houndarr/static/img/houndarr-logo-dark.png
 # renovate: datasource=github-releases depName=av1155/houndarr
-appVersion: v1.6.5
+appVersion: v1.6.3

clusters/cl01tl/helm/houndarr/values.yaml

@@ -4,11 +4,13 @@ houndarr:
       type: deployment
       replicas: 1
       strategy: Recreate
+      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: ghcr.io/av1155/houndarr
-            tag: v1.6.5@sha256:f3adbd745094919166bafcd9b428738d1087f651b1562adeaba44ff975827d87
+            tag: v1.6.3
+            pullPolicy: IfNotPresent
           env:
             - name: TZ
               value: America/Chicago
@@ -22,8 +24,8 @@ houndarr:
               value: 10.96.0.0/12
           resources:
             requests:
-              cpu: 1m
-              memory: 60Mi
+              cpu: 10m
+              memory: 128Mi
   service:
     main:
       controller: main
@@ -31,6 +33,7 @@ houndarr:
         http:
           port: 80
           targetPort: 8877
+          protocol: HTTP
   route:
     main:
       kind: HTTPRoute
@@ -43,8 +46,11 @@ houndarr:
         - houndarr.alexlebens.net
       rules:
         - backendRefs:
-            - name: houndarr
+            - group: ''
+              kind: Service
+              name: houndarr
               port: 80
+              weight: 100
           matches:
             - path:
                 type: PathPrefix

clusters/cl01tl/helm/immich/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 4.6.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.11.1
+  version: 7.10.0
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
+  version: 0.4.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:b52be61811b2c4b8f1ac733be19de51e33540589b71337af99fc97727a1894e8
-generated: "2026-04-01T19:49:30.408077-05:00"
+digest: sha256:b79ea8c506f0172deed820247a33c79329f34426435c8b5eb27b206ac8831b13
+generated: "2026-03-15T20:06:27.091094433Z"

clusters/cl01tl/helm/immich/Chart.yaml

@@ -5,13 +5,12 @@ description: Immich
 keywords:
   - immich
   - photos
-home: https://docs.alexlebens.dev/applications/immich/
+home: https://wiki.alexlebens.dev/s/9377ae08-2041-4b6d-bc2b-61a4f5e8faae
 sources:
   - https://github.com/immich-app/immich
+  - https://github.com/cloudnative-pg/cloudnative-pg
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:
@@ -21,11 +20,11 @@ dependencies:
     version: 4.6.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.11.1
+    version: 7.10.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: valkey
     alias: valkey
-    version: 0.5.0
+    version: 0.4.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-data

clusters/cl01tl/helm/immich/templates/external-secrets.yaml

@@ -14,5 +14,8 @@ spec:
   data:
     - secretKey: immich.json
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/immich/config
+        metadataPolicy: None
         property: immich.json

clusters/cl01tl/helm/immich/values.yaml

@@ -4,14 +4,16 @@ immich:
       type: deployment
       replicas: 1
       strategy: Recreate
+      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: ghcr.io/immich-app/immich-server
-            tag: v2.6.3@sha256:0cc1f82953d9598eb9e9dd11cbde1f50fe54f9c46c4506b089e8ad7bfc9d1f0c
+            tag: v2.6.3
+            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: America/Chicago
+              value: US/Central
             - name: IMMICH_TELEMETRY_INCLUDE
               value: all
             - name: IMMICH_CONFIG_FILE
@@ -85,7 +87,7 @@ immich:
             requests:
               gpu.intel.com/i915: 1
               cpu: 10m
-              memory: 500Mi
+              memory: 512Mi
   service:
     main:
       controller: main
@@ -93,12 +95,15 @@ immich:
         http:
           port: 2283
           targetPort: 2283
+          protocol: TCP
         metrics-api:
           port: 8081
           targetPort: 8081
+          protocol: TCP
         metrics-ms:
           port: 8082
           targetPort: 8082
+          protocol: TCP
   serviceMonitor:
     main:
       selector:
@@ -127,8 +132,11 @@ immich:
         - immich.alexlebens.net
       rules:
         - backendRefs:
-            - name: immich
+            - group: ''
+              kind: Service
+              name: immich
               port: 2283
+              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -184,12 +192,35 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
+      # - name: garage-remote
+      #   index: 1
+      #   destinationBucket: postgres-backups
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   retentionPolicy: "90d"
+      #   data:
+      #     compression: bzip2
+      # - name: external
+      #   index: 1
+      #   endpointURL: https://nyc3.digitaloceanspaces.com
+      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 40 14 * * *"
         backupName: garage-local
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 4 * * SAT"
+      #   backupName: garage-remote
+      # - name: daily-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
 volsync-target-data:
   pvcTarget: immich
   local:

clusters/cl01tl/helm/intel-device-plugin/Chart.yaml

@@ -4,9 +4,10 @@ version: 1.0.0
 description: Intel Device Plugin
 keywords:
   - intel-device-plugin
-  - gpu
   - operator
-home: https://docs.alexlebens.dev/applications/intel-device-plugin/
+  - gpu
+  - kubernetes
+home: https://wiki.alexlebens.dev/s/340746b2-b0ab-4b6b-95eb-323038ecdd35
 sources:
   - https://github.com/intel/intel-device-plugins-for-kubernetes
   - https://github.com/intel/helm-charts/tree/main/charts/device-plugin-operator

clusters/cl01tl/helm/intel-device-plugin/values.yaml

@@ -1,20 +1,6 @@
-intel-device-plugins-operator:
-  manager:
-    image:
-      hub: intel
-      # renovate: datasource=docker depName=intel/intel-deviceplugin-operator
-      tag: 0.35.0@sha256:d7eeac081bd17e58d8d4d542f3cb33d67cc1bdab314b09ad591e8eacb51dd5ec
-  resources:
-    limits:
-      cpu: null
-      memory: null
-    requests:
-      cpu: 10m
-      memory: 50Mi
 intel-device-plugins-gpu:
   name: gpudeviceplugin
-  image:
-    hub: intel
-    # renovate: datasource=docker depName=intel/intel-gpu-plugin
-    tag: 0.35.0
   sharedDevNum: 5
+  nodeSelector:
+    intel.feature.node.kubernetes.io/gpu: 'true'
+  nodeFeatureRule: false

clusters/cl01tl/helm/jellyfin/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.6.2
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.30.0
+  version: 0.29.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:32b9a206e77eabcdf1bbbc4d7e93067c40d6a621e4a07c1827e4d23961e2d82b
-generated: "2026-03-30T16:13:40.879082765Z"
+digest: sha256:0dcc864984130902acce6d81fa2cf708c3ac748246f94b11d2db90c0b488cce2
+generated: "2026-03-26T16:03:11.654482999Z"

clusters/cl01tl/helm/jellyfin/Chart.yaml

@@ -5,15 +5,18 @@ description: Jellyfin
 keywords:
   - jellyfin
   - media
-home: https://docs.alexlebens.dev/applications/jellyfin/
+  - movies
+  - tv shows
+  - books
+  - music
+home: https://wiki.alexlebens.dev/s/a58be5b0-7935-458a-b990-b45223e39d68
 sources:
   - https://github.com/jellyfin/jellyfin
   - https://github.com/rebelcore/jellyfin_exporter
+  - https://github.com/meilisearch/meilisearch
   - https://hub.docker.com/r/jellyfin/jellyfin
   - https://hub.docker.com/r/rebelcore/jellyfin-exporter
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/meilisearch/meilisearch-kubernetes/tree/main/charts/meilisearch
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:
@@ -22,7 +25,7 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
   - name: meilisearch
-    version: 0.30.0
+    version: 0.29.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: volsync-target
     alias: volsync-target-config
@@ -30,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/jellyfin.png
 # renovate: datasource=github-releases depName=jellyfin/jellyfin
-appVersion: 10.11.7
+appVersion: 10.11.6

clusters/cl01tl/helm/jellyfin/templates/external-secret.yaml

@@ -14,7 +14,10 @@ spec:
   data:
     - secretKey: token
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/jellyfin/exporter
+        metadataPolicy: None
         property: token
 
 ---
@@ -34,5 +37,8 @@ spec:
   data:
     - secretKey: MEILI_MASTER_KEY
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/jellyfin/meilisearch
+        metadataPolicy: None
         property: MEILI_MASTER_KEY

clusters/cl01tl/helm/jellyfin/values.yaml

@@ -4,25 +4,16 @@ jellyfin:
       type: deployment
       replicas: 1
       strategy: Recreate
-      pod:
-        affinity:
-          podAntiAffinity:
-            requiredDuringSchedulingIgnoredDuringExecution:
-              - labelSelector:
-                  matchExpressions:
-                    - key: app.kubernetes.io/name
-                      operator: In
-                      values:
-                        - plex
-                topologyKey: kubernetes.io/hostname
+      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: ghcr.io/jellyfin/jellyfin
-            tag: 10.11.7@sha256:2b93aa3830dcd0aab7185c635e20edef1f8dc5d2e999768baf1724e88c078004
+            tag: 10.11.6
+            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: America/Chicago
+              value: US/Central
             - name: JELLYFIN_hostwebclient
               value: true
             - name: JELLYFIN_PublishedServerUrl
@@ -33,11 +24,12 @@ jellyfin:
             requests:
               gpu.intel.com/i915: 1
               cpu: 1
-              memory: 1Gi
+              memory: 2Gi
         exporter:
           image:
             repository: rebelcore/jellyfin-exporter
-            tag: v1.4.0@sha256:dd35d901df663141025670b4b44a62a178b331e9fa084b17016f6fba46343ce9
+            tag: v1.4.0
+            pullPolicy: IfNotPresent
           args:
             - '--jellyfin.address=http://127.0.0.1:8096'
             - '--jellyfin.token=$(TOKEN)'
@@ -55,9 +47,11 @@ jellyfin:
         http:
           port: 80
           targetPort: 8096
+          protocol: HTTP
         metrics:
           port: 9594
           targetPort: 9594
+          protocol: HTTP
   serviceMonitor:
     main:
       selector:
@@ -83,8 +77,11 @@ jellyfin:
         - jellyfin.alexlebens.net
       rules:
         - backendRefs:
-            - name: jellyfin
+            - group: ''
+              kind: Service
+              name: jellyfin
               port: 80
+              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -95,16 +92,14 @@ jellyfin:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 100Gi
+      retain: true
       advancedMounts:
         main:
           main:
             - path: /config
               readOnly: false
     cache:
-      forceRename: jellyfin-cache
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 20Gi
+      type: emptyDir
       advancedMounts:
         main:
           main:
@@ -131,14 +126,17 @@ meilisearch:
     MEILI_EXPERIMENTAL_DUMPLESS_UPGRADE: true
   auth:
     existingMasterKeySecret: jellyfin-meilisearch-master-key-secret
+  service:
+    type: ClusterIP
+    port: 7700
   persistence:
     enabled: true
-    storageClass: ceph-block
+    storageClass: local-path
     size: 5Gi
   resources:
     requests:
       cpu: 10m
-      memory: 1Gi
+      memory: 128Mi
   serviceMonitor:
     enabled: true
 volsync-target-config:

clusters/cl01tl/helm/jellystat/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.6.2
 - name: postgres-cluster
   repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.11.1
+  version: 7.10.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:a5b2ddd5097971d246b0d1f519ffafb662594d9f84ddc854b8eedf8702d2035f
-generated: "2026-04-01T19:49:45.674314-05:00"
+digest: sha256:f779185ce82045b47fc75bf95c4a8215acbd387f44a4bdb764486406d9b03748
+generated: "2026-03-15T20:06:38.720993367Z"

clusters/cl01tl/helm/jellystat/Chart.yaml

@@ -5,13 +5,13 @@ description: Jellystat
 keywords:
   - jellystat
   - jellyfin
-home: https://docs.alexlebens.dev/applications/jellystat/
+home: https://wiki.alexlebens.dev/s/d3fd2bf1-d2ab-4e94-a127-ee35f2d90142
 sources:
   - https://github.com/CyferShepard/Jellystat
+  - https://github.com/cloudnative-pg/cloudnative-pg
   - https://hub.docker.com/r/cyfershepard/jellystat
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:
@@ -21,7 +21,7 @@ dependencies:
     version: 4.6.2
   - name: postgres-cluster
     alias: postgres-18-cluster
-    version: 7.11.1
+    version: 7.10.0
     repository: oci://harbor.alexlebens.net/helm-charts
   - name: volsync-target
     alias: volsync-target-data

clusters/cl01tl/helm/jellystat/templates/external-secret.yaml

@@ -14,13 +14,22 @@ spec:
   data:
     - secretKey: secret-key
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/jellystat/auth
+        metadataPolicy: None
         property: secret-key
     - secretKey: user
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/jellystat/auth
+        metadataPolicy: None
         property: user
     - secretKey: password
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/jellystat/auth
+        metadataPolicy: None
         property: password

clusters/cl01tl/helm/jellystat/values.yaml

@@ -4,14 +4,16 @@ jellystat:
       type: deployment
       replicas: 1
       strategy: Recreate
+      revisionHistoryLimit: 3
       containers:
         main:
           image:
-            repository: ghcr.io/cyfershepard/jellystat
-            tag: 1.1.8@sha256:c8c451704ba7985340142cd047e2364cabaf41b613669b6c5340688ed217f82a
+            repository: cyfershepard/jellystat
+            tag: 1.1.8
+            pullPolicy: IfNotPresent
           env:
             - name: TZ
-              value: America/Chicago
+              value: US/Central
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
@@ -55,7 +57,7 @@ jellystat:
           resources:
             requests:
               cpu: 10m
-              memory: 400Mi
+              memory: 256Mi
   service:
     main:
       controller: main
@@ -63,6 +65,7 @@ jellystat:
         http:
           port: 80
           targetPort: 3000
+          protocol: HTTP
   route:
     main:
       kind: HTTPRoute
@@ -75,8 +78,11 @@ jellystat:
         - jellystat.alexlebens.net
       rules:
         - backendRefs:
-            - name: jellystat
+            - group: ''
+              kind: Service
+              name: jellystat
               port: 80
+              weight: 100
           matches:
             - path:
                 type: PathPrefix
@@ -87,6 +93,7 @@ jellystat:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 5Gi
+      retain: true
       advancedMounts:
         main:
           main:
@@ -105,12 +112,35 @@ postgres-18-cluster:
         destinationBucket: postgres-backups
         externalSecretCredentialPath: /garage/home-infra/postgres-backups
         isWALArchiver: true
+      # - name: garage-remote
+      #   index: 1
+      #   destinationBucket: postgres-backups
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   retentionPolicy: "90d"
+      #   data:
+      #     compression: bzip2
+      # - name: external
+      #   index: 1
+      #   endpointURL: https://nyc3.digitaloceanspaces.com
+      #   destinationBucket: postgres-backups-ce540ddf106d186bbddca68a
+      #   externalSecretCredentialPath: /garage/home-infra/postgres-backups
+      #   isWALArchiver: false
     scheduledBackups:
       - name: live-backup
         suspend: false
         immediate: true
         schedule: "0 45 14 * * *"
         backupName: garage-local
+      # - name: weekly-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 4 * * SAT"
+      #   backupName: garage-remote
+      # - name: daily-backup
+      #   suspend: true
+      #   immediate: true
+      #   schedule: "0 0 0 * * *"
+      #   backupName: external
 volsync-target-data:
   pvcTarget: jellystat-data
   local:

clusters/cl01tl/helm/karakeep/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 4.6.2
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.30.0
+  version: 0.29.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.4.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:6046192bb4ff88692bd0623fd0eb00a33bf83f6066a0b471950db8776e868661
-generated: "2026-03-30T16:14:17.687854336Z"
+digest: sha256:a3a3400d95d62591012d33ce318075b67412c4b321a30fe5c2c19d9c9566eb86
+generated: "2026-03-26T16:03:24.623811889Z"

clusters/cl01tl/helm/karakeep/Chart.yaml

@@ -5,16 +5,15 @@ description: Karakeep
 keywords:
   - karakeep
   - bookmarks
-home: https://docs.alexlebens.dev/applications/karakeep/
+home: https://wiki.alexlebens.dev/s/f8177591-8253-4e21-82d5-a556f0aeafad
 sources:
   - https://github.com/karakeep-app/karakeep
-  - https://github.com/jlandure/alpine-chrome
+  - https://github.com/cloudflare/cloudflared
+  - https://github.com/meilisearch/meilisearch
   - https://github.com/karakeep-app/karakeep/pkgs/container/karakeep
-  - https://console.cloud.google.com/artifacts/docker/zenika-hub/us/gcr.io/alpine-chrome
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
   - https://github.com/meilisearch/meilisearch-kubernetes/tree/main/charts/meilisearch
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
 maintainers:
   - name: alexlebens
 dependencies:
@@ -23,7 +22,7 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
   - name: meilisearch
-    version: 0.30.0
+    version: 0.29.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/helm/karakeep/templates/external-secret.yaml

@@ -14,11 +14,17 @@ spec:
   data:
     - secretKey: key
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/karakeep/key
+        metadataPolicy: None
         property: key
     - secretKey: prometheus-token
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/karakeep/key
+        metadataPolicy: None
         property: prometheus-token
 
 ---
@@ -38,11 +44,17 @@ spec:
   data:
     - secretKey: AUTHENTIK_CLIENT_ID
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /authentik/oidc/karakeep
+        metadataPolicy: None
         property: client
     - secretKey: AUTHENTIK_CLIENT_SECRET
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /authentik/oidc/karakeep
+        metadataPolicy: None
         property: secret
 
 ---
@@ -62,15 +74,24 @@ spec:
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /garage/home-infra/karakeep-assets
+        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: ACCESS_SECRET_KEY
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /garage/home-infra/karakeep-assets
+        metadataPolicy: None
         property: ACCESS_SECRET_KEY
     - secretKey: ACCESS_REGION
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /garage/home-infra/karakeep-assets
+        metadataPolicy: None
         property: ACCESS_REGION
 
 ---
@@ -90,5 +111,8 @@ spec:
   data:
     - secretKey: MEILI_MASTER_KEY
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/karakeep/meilisearch
+        metadataPolicy: None
         property: MEILI_MASTER_KEY

clusters/cl01tl/helm/karakeep/values.yaml

@@ -4,11 +4,13 @@ karakeep:
       type: deployment
       replicas: 1
       strategy: Recreate
+      revisionHistoryLimit: 3
       containers:
         main:
           image:
             repository: ghcr.io/karakeep-app/karakeep
-            tag: 0.31.0@sha256:20754dbdafb11dfe288bbb1c2342a7855081b08ea069e86fcf2d4a2d945d3653
+            tag: 0.31.0
+            pullPolicy: IfNotPresent
           env:
             - name: DATA_DIR
               value: /data
@@ -89,11 +91,12 @@ karakeep:
           resources:
             requests:
               cpu: 10m
-              memory: 500Mi
+              memory: 256Mi
         chrome:
           image:
             repository: gcr.io/zenika-hub/alpine-chrome
-            tag: 124@sha256:1a0046448e0bb6c275c88f86e01faf0de62b02ec8572901256ada0a8c08be23f
+            tag: 124
+            pullPolicy: IfNotPresent
           args:
             - --no-sandbox
             - --disable-gpu
@@ -101,6 +104,10 @@ karakeep:
             - --remote-debugging-address=0.0.0.0
             - --remote-debugging-port=9222
             - --hide-scrollbars
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
   service:
     main:
       controller: main
@@ -108,9 +115,11 @@ karakeep:
         http:
           port: 3000
           targetPort: 3000
+          protocol: HTTP
         chrome:
           port: 9222
           targetPort: 9222
+          protocol: HTTP
   serviceMonitor:
     main:
       selector:
@@ -133,6 +142,7 @@ karakeep:
       storageClass: ceph-block
       accessMode: ReadWriteOnce
       size: 10Gi
+      retain: true
       advancedMounts:
         main:
           main:
@@ -145,6 +155,9 @@ meilisearch:
     MEILI_EXPERIMENTAL_DUMPLESS_UPGRADE: true
   auth:
     existingMasterKeySecret: karakeep-meilisearch-master-key-secret
+  service:
+    type: ClusterIP
+    port: 7700
   persistence:
     enabled: true
     storageClass: ceph-block
@@ -152,7 +165,7 @@ meilisearch:
   resources:
     requests:
       cpu: 10m
-      memory: 50Mi
+      memory: 128Mi
   serviceMonitor:
     enabled: true
 volsync-target-data:

clusters/cl01tl/helm/komodo/Chart.yaml

@@ -31,4 +31,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/komodo.png
 # renovate: datasource=github-releases depName=moghtech/komodo
-appVersion: v2.1.0
+appVersion: v2.0.0

clusters/cl01tl/helm/komodo/values.yaml

@@ -9,7 +9,7 @@ komodo:
         main:
           image:
             repository: ghcr.io/moghtech/komodo-core
-            tag: 2.1.0@sha256:4915d91b5c6e9de4e8fd59391eed5cad090ec84dcf6a1a9233d97edfdbbb88e7
+            tag: 2.0.0@sha256:3cc134272b39313ae1fb34ea8a3c8a0c2f629a3c2eeaf71258702159f154f9e9
             pullPolicy: IfNotPresent
           env:
             - name: COMPOSE_LOGGING_DRIVER

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 82.16.1
+  version: 82.15.1
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.6.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
-digest: sha256:ece31be37d2fa7c7c59058e2d47e8190bea3baa742b4f04fe793956cd2d52f7f
-generated: "2026-04-02T07:03:55.367235416Z"
+digest: sha256:7be2f0d61a12e674af175046960df7ba06a7248dc92db0b2d9c9b63a77a5bc17
+generated: "2026-03-28T01:54:34.406941487Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 82.16.1
+    version: 82.15.1
     repository: oci://ghcr.io/prometheus-community/charts
   - name: app-template
     alias: ntfy-alertmanager

clusters/cl01tl/helm/kube-prometheus-stack/values.yaml

@@ -148,7 +148,7 @@ ntfy-alertmanager:
         main:
           image:
             repository: xenrox/ntfy-alertmanager
-            tag: 1.0.0
+            tag: 0.5.0
             pullPolicy: IfNotPresent
   service:
     main:

clusters/cl01tl/helm/libation/values.yaml

@@ -35,7 +35,7 @@ libation:
         main:
           image:
             repository: ubuntu
-            tag: resolute-20260401
+            tag: resolute-20260312
             pullPolicy: IfNotPresent
           command:
             - "sleep"

clusters/cl01tl/helm/medialyze/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     version: 4.6.2
 icon: https://raw.githubusercontent.com/frederikemmer/MediaLyze/d8f69c0628bac7c047b90f91a66341648029c273/frontend/public/favicon.svg
 # renovate: datasource=github-releases depName=frederikemmer/MediaLyze
-appVersion: 0.4.1
+appVersion: 0.3.0

clusters/cl01tl/helm/medialyze/values.yaml

@@ -9,7 +9,7 @@ medialyze:
         main:
           image:
             repository: ghcr.io/frederikemmer/medialyze
-            tag: 0.4.1
+            tag: 0.3.0
             pullPolicy: IfNotPresent
           env:
             - name: HOST_PORT

clusters/cl01tl/helm/movie-roulette/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
     version: 4.6.2
 icon: https://raw.githubusercontent.com/sahara101/Movie-Roulette/refs/heads/main/static/icons/icon.png
 # renovate: datasource=github-releases depName=sahara101/Movie-Roulette
-appVersion: v5.4.1
+appVersion: v5.4.0

clusters/cl01tl/helm/movie-roulette/values.yaml

@@ -9,7 +9,7 @@ movie-roulette:
         main:
           image:
             repository: ghcr.io/sahara101/movie-roulette
-            tag: v5.4.2
+            tag: v5.4.0
             pullPolicy: IfNotPresent
           env:
             - name: FLASK_SECRET_KEY

clusters/cl01tl/helm/music-grabber/Chart.yaml

@@ -17,5 +17,4 @@ dependencies:
     alias: music-grabber
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
-# renovate: datasource=docker depName=g33kphr33k/musicgrabber
-appVersion: 2.5.4
+appVersion: 2.0.4

clusters/cl01tl/helm/music-grabber/values.yaml

@@ -9,7 +9,7 @@ music-grabber:
         main:
           image:
             repository: g33kphr33k/musicgrabber
-            tag: 2.5.4
+            tag: 2.5.2
             pullPolicy: IfNotPresent
           env:
             - name: MUSIC_DIR

clusters/cl01tl/helm/navidrome/values.yaml

@@ -9,7 +9,7 @@ navidrome:
         main:
           image:
             repository: deluan/navidrome
-            tag: 0.61.0@sha256:b14a6acb5cd5ee73f3a13d63d8d68ede82dedb796aa522fbada94769d990cf0b
+            tag: 0.60.3@sha256:a5dce8f33304714dd138e870cca0dcab3d937ca236be1a9f2b97da009d1a0048
             pullPolicy: IfNotPresent
           env:
             - name: ND_MUSICFOLDER

clusters/cl01tl/helm/ntfy/Chart.yaml

@@ -20,4 +20,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ntfy.png
 # renovate: datasource=github-releases depName=binwiederhier/ntfy
-appVersion: 2.21.0
+appVersion: 2.20.1

clusters/cl01tl/helm/ntfy/values.yaml

@@ -9,7 +9,7 @@ ntfy:
         main:
           image:
             repository: binwiederhier/ntfy
-            tag: v2.21.0
+            tag: v2.20.1
             pullPolicy: IfNotPresent
           args: ["serve"]
           env:

clusters/cl01tl/helm/ollama/Chart.yaml

@@ -31,4 +31,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ollama.png
 # renovate: datasource=github-releases depName=ollama/ollama
-appVersion: 0.19.0
+appVersion: 0.18.3

clusters/cl01tl/helm/ollama/values.yaml

@@ -22,7 +22,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.19.0
+            tag: 0.18.3
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE
@@ -58,7 +58,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.19.0
+            tag: 0.18.3
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE
@@ -94,7 +94,7 @@ ollama:
         main:
           image:
             repository: ollama/ollama
-            tag: 0.19.0
+            tag: 0.18.3
             pullPolicy: IfNotPresent
           env:
             - name: OLLAMA_KEEP_ALIVE

clusters/cl01tl/helm/paperless-ngx/Chart.lock

@@ -1,24 +0,0 @@
-dependencies:
-- name: app-template
-  repository: https://bjw-s-labs.github.io/helm-charts/
-  version: 4.6.2
-- name: postgres-cluster
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 7.11.0
-- name: valkey
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.5.0
-- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-- name: volsync-target
-  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 0.8.0
-digest: sha256:08acc0818deaede4bb7515be7cbb1253f30036b70af6038caa69e4bd3cc02412
-generated: "2026-03-30T20:25:47.995874-05:00"

clusters/cl01tl/helm/paperless-ngx/Chart.yaml

@@ -1,51 +0,0 @@
-apiVersion: v2
-name: paperless-ngx
-version: 1.0.0
-description: Paperless-ngx
-keywords:
-  - paperless-ngx
-  - documents
-home: https://docs.alexlebens.dev/applications/paperless-ngx/
-sources:
-  - https://github.com/paperless-ngx/paperless-ngx
-  - https://github.com/gotenberg/gotenberg
-  - https://github.com/paperless-ngx/paperless-ngx/pkgs/container/paperless-ngx
-  - https://hub.docker.com/r/gotenberg/gotenberg
-  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/valkey
-  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: paperless-ngx
-    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.6.2
-  - name: postgres-cluster
-    alias: postgres-18-cluster
-    version: 7.11.0
-    repository: oci://harbor.alexlebens.net/helm-charts
-  - name: valkey
-    alias: valkey
-    version: 0.5.0
-    repository: oci://harbor.alexlebens.net/helm-charts
-  - name: volsync-target
-    alias: volsync-target-data
-    version: 0.8.0
-    repository: oci://harbor.alexlebens.net/helm-charts
-  - name: volsync-target
-    alias: volsync-target-media
-    version: 0.8.0
-    repository: oci://harbor.alexlebens.net/helm-charts
-  - name: volsync-target
-    alias: volsync-target-export
-    version: 0.8.0
-    repository: oci://harbor.alexlebens.net/helm-charts
-  - name: volsync-target
-    alias: volsync-target-consume
-    version: 0.8.0
-    repository: oci://harbor.alexlebens.net/helm-charts
-icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/paperless-ngx.png
-# renovate: datasource=github-releases depName=paperless-ngx/paperless-ngx
-appVersion: 2.20.13

clusters/cl01tl/helm/paperless-ngx/templates/external-secret.yaml

@@ -1,54 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: paperless-ngx-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: paperless-ngx-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: secret-key
-      remoteRef:
-        key: /cl01tl/paperless-ngx/secret
-        property: secret-key
-    - secretKey: admin-user
-      remoteRef:
-        key: /cl01tl/paperless-ngx/secret
-        property: admin-user
-    - secretKey: admin-password
-      remoteRef:
-        key: /cl01tl/paperless-ngx/secret
-        property: admin-password
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: paperless-ngx-oidc-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: paperless-ngx-oidc-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: OIDC_CLIENT_ID
-      remoteRef:
-        key: /authentik/oidc/paperless-ngx
-        property: client
-    - secretKey: OIDC_CLIENT_SECRET
-      remoteRef:
-        key: /authentik/oidc/paperless-ngx
-        property: secret
-    - secretKey: PAPERLESS_SOCIALACCOUNT_PROVIDERS
-      remoteRef:
-        key: /authentik/oidc/paperless-ngx
-        property: PAPERLESS_SOCIALACCOUNT_PROVIDERS

clusters/cl01tl/helm/paperless-ngx/values.yaml

@@ -1,212 +0,0 @@
-paperless-ngx:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      containers:
-        main:
-          image:
-            repository: ghcr.io/paperless-ngx/paperless-ngx
-            tag: 2.20.13@sha256:4b05bcd28e6923768000b5d247cbf2c66fd49bdc3f3b05955bd4f6790a638b01
-          env:
-            - name: PAPERLESS_REDIS
-              value: redis://paperless-ngx-valkey.paperless-ngx:6379
-            - name: PAPERLESS_DBHOST
-              valueFrom:
-                secretKeyRef:
-                  name: paperless-ngx-postgresql-18-cluster-app
-                  key: host
-            - name: PAPERLESS_DBPORT
-              valueFrom:
-                secretKeyRef:
-                  name: paperless-ngx-postgresql-18-cluster-app
-                  key: port
-            - name: PAPERLESS_DBNAME
-              valueFrom:
-                secretKeyRef:
-                  name: paperless-ngx-postgresql-18-cluster-app
-                  key: dbname
-            - name: PAPERLESS_DBUSER
-              valueFrom:
-                secretKeyRef:
-                  name: paperless-ngx-postgresql-18-cluster-app
-                  key: user
-            - name: PAPERLESS_DBPASS
-              valueFrom:
-                secretKeyRef:
-                  name: paperless-ngx-postgresql-18-cluster-app
-                  key: password
-            - name: PAPERLESS_TIKA_ENABLED
-              value: true
-            - name: PAPERLESS_TIKA_GOTENBERG_ENDPOINT
-              value: http://localhost:3000/
-            - name: PAPERLESS_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: paperless-ngx-secret
-                  key: secret-key
-            - name: PAPERLESS_URL
-              value: https://paperless-ngx.alexlebens.net
-            - name: PAPERLESS_ALLOWED_HOSTS
-              value: paperless-ngx.alexlebens.net, paperless-ngx.paperless-ngx
-            - name: PAPERLESS_ADMIN_USER
-              valueFrom:
-                secretKeyRef:
-                  name: paperless-ngx-secret
-                  key: admin-user
-            - name: PAPERLESS_ADMIN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: paperless-ngx-secret
-                  key: admin-password
-            - name: PAPERLESS_ACCOUNT_ALLOW_SIGNUPS
-              value: true
-            - name: PAPERLESS_SOCIAL_AUTO_SIGNUP
-              value: true
-            - name: PAPERLESS_SOCIALACCOUNT_ALLOW_SIGNUPS
-              value: true
-            - name: PAPERLESS_APPS
-              value: allauth.socialaccount.providers.openid_connect
-            - name: PAPERLESS_LOGOUT_REDIRECT_URL
-              value: https://authentik.alexlebens.net/application/o/paperless-ngx/end-session/
-            - name: PAPERLESS_SOCIALACCOUNT_PROVIDERS
-              valueFrom:
-                secretKeyRef:
-                  name: paperless-ngx-oidc-secret
-                  key: PAPERLESS_SOCIALACCOUNT_PROVIDERS
-            - name: PAPERLESS_TIME_ZONE
-              value: America/Chicago
-          resources:
-            requests:
-              cpu: 1m
-              memory: 100Mi
-        gotenberg:
-          image:
-            repository: gotenberg/gotenberg
-            tag: 8.29.1@sha256:36c925776fa0db0fd1030408d131fde7ac3453027a559883555155b72adb16a7
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 8000
-  route:
-    main:
-      kind: HTTPRoute
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: traefik-gateway
-          namespace: traefik
-      hostnames:
-        - paperless-ngx.alexlebens.net
-      rules:
-        - backendRefs:
-            - name: paperless-ngx
-              port: 80
-          matches:
-            - path:
-                type: PathPrefix
-                value: /
-  persistence:
-    data:
-      forceRename: paperless-ngx-data
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 2Gi
-      advancedMounts:
-        main:
-          main:
-            - path: /usr/src/paperless/data
-    media:
-      forceRename: paperless-ngx-media
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 10Gi
-      advancedMounts:
-        main:
-          main:
-            - path: /usr/src/paperless/media
-    export:
-      forceRename: paperless-ngx-export
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 2Gi
-      advancedMounts:
-        main:
-          main:
-            - path: /usr/src/paperless/export
-    consume:
-      forceRename: paperless-ngx-consume
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 2Gi
-      advancedMounts:
-        main:
-          main:
-            - path: /usr/src/paperless/consume
-postgres-18-cluster:
-  mode: recovery
-  recovery:
-    method: objectStore
-    objectStore:
-      index: 1
-  backup:
-    objectStore:
-      - name: garage-local
-        index: 1
-        destinationBucket: postgres-backups
-        externalSecretCredentialPath: /garage/home-infra/postgres-backups
-        isWALArchiver: true
-    scheduledBackups:
-      - name: live-backup
-        suspend: false
-        immediate: true
-        schedule: "0 15 15 * * *"
-        backupName: garage-local
-volsync-target-data:
-  pvcTarget: paperless-ngx-data
-  local:
-    enabled: true
-    schedule: 2 8 * * *
-  remote:
-    enabled: true
-    schedule: 2 9 * * *
-  external:
-    enabled: true
-    schedule: 2 10 * * *
-volsync-target-media:
-  pvcTarget: paperless-ngx-metadata
-  local:
-    enabled: true
-    schedule: 4 8 * * *
-  remote:
-    enabled: true
-    schedule: 4 9 * * *
-  external:
-    enabled: true
-    schedule: 4 10 * * *
-volsync-target-export:
-  pvcTarget: paperless-ngx-data
-  local:
-    enabled: true
-    schedule: 2 8 * * *
-  remote:
-    enabled: true
-    schedule: 2 9 * * *
-  external:
-    enabled: true
-    schedule: 2 10 * * *
-volsync-target-consume:
-  pvcTarget: paperless-ngx-metadata
-  local:
-    enabled: true
-    schedule: 4 8 * * *
-  remote:
-    enabled: true
-    schedule: 4 9 * * *
-  external:
-    enabled: true
-    schedule: 4 10 * * *