Update Helm release grafana-operator to v5.21.1

change class
migrate to new chart
2025-12-17 22:25:16 +00:00 · 2025-12-17 16:23:41 -06:00 · 2025-12-17 14:17:07 -06:00 · 2025-12-17 14:14:18 -06:00 · 2025-12-17 13:32:53 -06:00 · 2025-12-17 13:29:14 -06:00
126 changed files with 592 additions and 2174 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 /**/archive/
 /**/charts/
 /**/manifests/
+/**/tmpcharts*/
--- a/README.md
+++ b/README.md
@@ -2,6 +2,12 @@

 GitOps definied infrastrucutre for the alexlebens.net domain.

+## Stack-cl01tl
+
+https://argocd.alexlebens.net/api/badge?name=stack-cl01tl&revision=true&showAppName=true
+
+App-of-Apps Application for cl01tl
+
 ## License

 This project is licensed under the terms of the Apache 2.0 License license.
--- a/clusters/cl01tl/helm/code-server/Chart.lock
+++ b/clusters/cl01tl/helm/code-server/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 4.5.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.2
+  version: 2.0.0
 - name: volsync-target
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.5.0
-digest: sha256:bd1cbd66ccb360978a342ee218bfb01006a486fb85c5714acd593b9e1389b151
-generated: "2025-12-15T21:50:58.968382-06:00"
+digest: sha256:e6d01e000d1e4df73854cb739c2c3797b6b127f454809c2f99df84581749ee1f
+generated: "2025-12-17T14:16:43.148302-06:00"
--- a/clusters/cl01tl/helm/code-server/Chart.yaml
+++ b/clusters/cl01tl/helm/code-server/Chart.yaml
@@ -23,7 +23,7 @@ dependencies:
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.2
+    version: 2.0.0
  - name: volsync-target
    alias: volsync-target-config
    version: 0.5.0
--- a/clusters/cl01tl/helm/code-server/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/code-server/templates/external-secret.yaml
@@ -26,26 +26,3 @@ spec:
        key: /cl01tl/code-server/auth
        metadataPolicy: None
        property: SUDO_PASSWORD
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: code-server-cloudflared-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: code-server-cloudflared-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: cf-tunnel-token
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cloudflare/tunnels/codeserver
-        metadataPolicy: None
-        property: token
--- a/clusters/cl01tl/helm/code-server/values.yaml
+++ b/clusters/cl01tl/helm/code-server/values.yaml
@@ -47,8 +47,6 @@ code-server:
          main:
            - path: /config
              readOnly: false
-cloudflared:
-  existingSecretName: code-server-cloudflared-secret
 volsync-target-config:
  pvcTarget: code-server-config
  moverSecurityContext:
--- a/clusters/cl01tl/helm/grafana-operator/Chart.lock
+++ b/clusters/cl01tl/helm/grafana-operator/Chart.lock
@@ -1,7 +1,7 @@
 dependencies:
 - name: grafana-operator
  repository: https://grafana.github.io/helm-charts
-  version: v5.20.0
+  version: 5.21.1
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 7.1.3
@@ -11,5 +11,5 @@ dependencies:
 - name: redis-replication
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.5.0
-digest: sha256:7efeacd496cb0dc009013164641868c9de71acc3f26dab8c6eee10e0a9f82c06
-generated: "2025-12-17T16:10:04.690538844Z"
+digest: sha256:485cf44121c365717b671a4c9538d7498bd9279f7cceb856dad5a796f9482afe
+generated: "2025-12-17T22:25:08.200081528Z"
--- a/clusters/cl01tl/helm/grafana-operator/Chart.yaml
+++ b/clusters/cl01tl/helm/grafana-operator/Chart.yaml
@@ -17,7 +17,7 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: grafana-operator
-    version: v5.20.0
+    version: 5.21.1
    repository: https://grafana.github.io/helm-charts
  - name: postgres-cluster
    alias: postgres-18-cluster
--- a/clusters/cl01tl/helm/jellyfin/values.yaml
+++ b/clusters/cl01tl/helm/jellyfin/values.yaml
@@ -27,7 +27,7 @@ jellyfin:
              memory: 2Gi
    vue:
      type: deployment
-      replicas: 3
+      replicas: 1
      strategy: Recreate
      revisionHistoryLimit: 3
      containers:
--- a/clusters/cl01tl/helm/kube-prometheus-stack/values.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/values.yaml
@@ -149,7 +149,7 @@ redis-replication:
      spec:
        resources:
          requests:
-            storage: 5Gi
+            storage: 10Gi
  redisSentinel:
    enabled: true
    clusterSize: 3
--- a/clusters/cl01tl/helm/kubernetes-cloudflare-ddns/values.yaml
+++ b/clusters/cl01tl/helm/kubernetes-cloudflare-ddns/values.yaml
@@ -8,8 +8,8 @@ kubernetes-cloudflare-ddns:
        timeZone: US/Central
        schedule: "30 4 * * *"
        startingDeadlineSeconds: 90
-        successfulJobsHistory: 3
-        failedJobsHistory: 3
+        successfulJobsHistory: 1
+        failedJobsHistory: 1
        backoffLimit: 3
        parallelism: 1
      containers:
--- a/clusters/cl01tl/helm/libation/templates/persistent-volume-claim.yaml
+++ b/clusters/cl01tl/helm/libation/templates/persistent-volume-claim.yaml
@@ -1,24 +1,5 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
-metadata:
-  name: libation-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: libation-config
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  volumeMode: Filesystem
-
---
-apiVersion: v1
-kind: PersistentVolumeClaim
 metadata:
  name: libation-nfs-storage
  namespace: {{ .Release.Namespace }}
--- a/clusters/cl01tl/helm/libation/values.yaml
+++ b/clusters/cl01tl/helm/libation/values.yaml
@@ -8,8 +8,8 @@ libation:
        timeZone: US/Central
        schedule: 0 0 1 1 *
        startingDeadlineSeconds: 90
-        successfulJobsHistory: 3
-        failedJobsHistory: 3
+        successfulJobsHistory: 1
+        failedJobsHistory: 1
        backoffLimit: 3
        parallelism: 1
      containers:
@@ -45,7 +45,7 @@ libation:
              cpu: 10m
              memory: 32Mi
  persistence:
-    config-new:
+    config:
      forceRename: libation
      storageClass: ceph-block
      accessMode: ReadWriteOnce
--- a/clusters/cl01tl/helm/lidarr/Chart.lock
+++ b/clusters/cl01tl/helm/lidarr/Chart.lock
@@ -5,5 +5,8 @@ dependencies:
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 7.1.3
-digest: sha256:66944bedb53a1cf3aff6cb8e1218f23cd9ccf3cca9489064f0eee46c66f59ac4
-generated: "2025-12-17T16:10:52.803256851Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:b12b64a6fac9ef6c2743b404547e40451bb47d04c13b509f8a07179aaad6071d
+generated: "2025-12-17T10:41:06.633712-06:00"
--- a/clusters/cl01tl/helm/lidarr/Chart.yaml
+++ b/clusters/cl01tl/helm/lidarr/Chart.yaml
@@ -26,5 +26,9 @@ dependencies:
    alias: postgres-18-cluster
    version: 7.1.3
    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/lidarr.png
 appVersion: 3.1.0
--- a/clusters/cl01tl/helm/lidarr/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/lidarr/templates/external-secret.yaml
@@ -1,62 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
-metadata:
-  name: lidarr-config-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: lidarr-config-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/lidarr2/lidarr2-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
 metadata:
  name: lidarr-postgresql-18-cluster-backup-secret
  namespace: {{ .Release.Namespace }}
--- a/clusters/cl01tl/helm/lidarr/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/lidarr/templates/replication-source.yaml
@@ -1,28 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: lidarr-config-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: lidarr-config-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: lidarr-config
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: lidarr-config-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      runAsUser: 1000
-      runAsGroup: 1000
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
--- a/clusters/cl01tl/helm/lidarr/values.yaml
+++ b/clusters/cl01tl/helm/lidarr/values.yaml
@@ -144,3 +144,10 @@ postgres-18-cluster:
      #   immediate: true
      #   schedule: "0 0 4 * * SAT"
      #   backupName: garage-remote
+volsync-target-config:
+  pvcTarget: lidarr-config
+  moverSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
--- a/clusters/cl01tl/helm/lidatube/Chart.lock
+++ b/clusters/cl01tl/helm/lidatube/Chart.lock
@@ -2,5 +2,8 @@ dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.5.0
-digest: sha256:486139f48e88e912593a7ee18973bc4872a6ddc4881fcfa933558f5a7749503b
-generated: "2025-12-05T17:08:12.627557611Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:8dc18a31138c2e4eb4f6499058aaec0437ecd76ba4f0c5db4ec1ef46e90f9628
+generated: "2025-12-17T10:07:48.72533-06:00"
--- a/clusters/cl01tl/helm/lidatube/Chart.yaml
+++ b/clusters/cl01tl/helm/lidatube/Chart.yaml
@@ -18,5 +18,9 @@ dependencies:
    alias: lidatube
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.5.0
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/lidatube.png
 appVersion: 0.2.42
--- a/clusters/cl01tl/helm/lidatube/values.yaml
+++ b/clusters/cl01tl/helm/lidatube/values.yaml
@@ -64,3 +64,10 @@ lidatube:
          main:
            - path: /lidatube/downloads
              readOnly: false
+volsync-target-config:
+  pvcTarget: lidatube-config
+  moverSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
--- a/clusters/cl01tl/helm/listenarr/Chart.lock
+++ b/clusters/cl01tl/helm/listenarr/Chart.lock
@@ -2,5 +2,8 @@ dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.5.0
-digest: sha256:1f215356d77b524ae23c0bb178d48fd2d602d9224dd7459658628903ff5b6e4c
-generated: "2025-12-05T17:08:24.614701742Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:bb2dd513e76b8f2597967ea48a9c7df7018ed5d40a5f8dabc3402e15cdb4c74a
+generated: "2025-12-17T10:10:10.316764-06:00"
--- a/clusters/cl01tl/helm/listenarr/Chart.yaml
+++ b/clusters/cl01tl/helm/listenarr/Chart.yaml
@@ -17,4 +17,8 @@ dependencies:
    alias: listenarr
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.5.0
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 appVersion: 0.2.35
--- a/clusters/cl01tl/helm/listenarr/values.yaml
+++ b/clusters/cl01tl/helm/listenarr/values.yaml
@@ -28,6 +28,7 @@ listenarr:
          protocol: HTTP
  persistence:
    config:
+      forceRename: listenarr
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 5Gi
@@ -44,3 +45,10 @@ listenarr:
          main:
            - path: /data
              readOnly: false
+volsync-target-config:
+  pvcTarget: listenarr
+  moverSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
--- a/clusters/cl01tl/helm/matrix-synapse/Chart.lock
+++ b/clusters/cl01tl/helm/matrix-synapse/Chart.lock
@@ -26,5 +26,17 @@ dependencies:
 - name: redis-replication
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.5.0
-digest: sha256:c08d2fd5436ca9f0d1b159d6d424ab42d171a967ca97178b2f8dd60de83f9cc9
-generated: "2025-12-15T15:56:54.377467-06:00"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:d7487cc29147c4cc2719ffca559a77a3c9c50abf5087ba34f9557eb36a9302fc
+generated: "2025-12-17T10:23:12.737976-06:00"
--- a/clusters/cl01tl/helm/matrix-synapse/Chart.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/Chart.yaml
@@ -63,5 +63,21 @@ dependencies:
    alias: redis-replication-hookshot
    version: 0.5.0
    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-synapse
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-hookshot
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-discord
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-whatsapp
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/matrix.png
 appVersion: 1.144.0
--- a/clusters/cl01tl/helm/matrix-synapse/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/templates/external-secret.yaml
@@ -245,175 +245,6 @@ spec:
        metadataPolicy: None
        property: token

---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/matrix-synapse/matrix-synapse"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: mautrix-discord-data-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/matrix-synapse/mautrix-discord-data"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: mautrix-whatsapp-data-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/matrix-synapse/mautrix-whatsapp-data"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
--- a/clusters/cl01tl/helm/matrix-synapse/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/templates/replication-source.yaml
@@ -1,85 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: matrix-synapse-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: matrix-synapse
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: matrix-synapse-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-
---
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: mautrix-discord-data-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: mautrix-discord-data-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: mautrix-discord
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: mautrix-discord-data-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      runAsUser: 1337
-      runAsGroup: 1337
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-
---
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: mautrix-whatsapp-data-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: mautrix-whatsapp-data-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: mautrix-whatsapp
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: mautrix-whatsapp-data-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      runAsUser: 1337
-      runAsGroup: 1337
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
--- a/clusters/cl01tl/helm/matrix-synapse/values.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/values.yaml
@@ -204,6 +204,7 @@ matrix-hookshot:
              mountPropagation: None
              subPath: passkey.pem
    data:
+      forceRename: matrix-hookshot
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 500Mi
@@ -285,6 +286,7 @@ mautrix-discord:
              mountPropagation: None
              subPath: mautrix-discord-registration.yaml
    data:
+      forceRename: mautrix-discord
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 500Mi
@@ -369,6 +371,7 @@ mautrix-whatsapp:
              mountPropagation: None
              subPath: mautrix-whatsapp-registration.yaml
    data:
+      forceRename: mautrix-whatsapp
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 500Mi
@@ -473,3 +476,17 @@ redis-replication-hookshot:
  redisSentinel:
    enabled: true
    clusterSize: 3
+volsync-target-synapse:
+  pvcTarget: matrix-synapse
+volsync-target-hookshot:
+  pvcTarget: matrix-hookshot
+volsync-target-discord:
+  pvcTarget: mautrix-discord
+  moverSecurityContext:
+    runAsUser: 1337
+    runAsGroup: 1337
+volsync-target-whatsapp:
+  pvcTarget: mautrix-whatsapp
+  moverSecurityContext:
+    runAsUser: 1337
+    runAsGroup: 1337
--- a/clusters/cl01tl/helm/n8n/Chart.lock
+++ b/clusters/cl01tl/helm/n8n/Chart.lock
@@ -8,5 +8,8 @@ dependencies:
 - name: redis-replication
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.5.0
-digest: sha256:4f3ed81241b432b988d6b6277192d360f98a5258ad34c88ac0645505d0acc0a5
-generated: "2025-12-17T16:11:02.717745162Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:d5f9a1471b38c11f4ca44bd764243309b5be739a3bb1605ee229e1f456d19643
+generated: "2025-12-17T10:42:04.895167-06:00"
--- a/clusters/cl01tl/helm/n8n/Chart.yaml
+++ b/clusters/cl01tl/helm/n8n/Chart.yaml
@@ -26,5 +26,9 @@ dependencies:
  - name: redis-replication
    version: 0.5.0
    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-data
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/n8n.png
 appVersion: 2.0.1
--- a/clusters/cl01tl/helm/n8n/values.yaml
+++ b/clusters/cl01tl/helm/n8n/values.yaml
@@ -375,3 +375,5 @@ redis-replication:
  redisSentinel:
    enabled: true
    clusterSize: 3
+volsync-target-data:
+  pvcTarget: n8n
--- a/clusters/cl01tl/helm/ollama/Chart.lock
+++ b/clusters/cl01tl/helm/ollama/Chart.lock
@@ -5,5 +5,8 @@ dependencies:
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 7.1.3
-digest: sha256:639e6a2931f61cba27b306b6949bf5dd1fffb04682b4179f29b2561dc1f22b48
-generated: "2025-12-17T16:11:11.863081712Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:d3b6a59e3f33b0f9b75ab5de98a027df2cff8d8a8fd5eb921d86eb2b62f6b072
+generated: "2025-12-17T11:28:44.339984-06:00"
--- a/clusters/cl01tl/helm/ollama/Chart.yaml
+++ b/clusters/cl01tl/helm/ollama/Chart.yaml
@@ -25,5 +25,9 @@ dependencies:
    alias: postgres-18-cluster
    version: 7.1.3
    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-data
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ollama.png
 appVersion: 0.13.3
--- a/clusters/cl01tl/helm/ollama/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/ollama/templates/external-secret.yaml
@@ -51,63 +51,6 @@ spec:
        metadataPolicy: None
        property: secret

---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: ollama-web-data-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ollama-web-data-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/ollama/ollama-web"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
--- a/clusters/cl01tl/helm/ollama/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/ollama/templates/replication-source.yaml
@@ -1,28 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: ollama-web-data-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ollama-web-data-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: ollama-web-data
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: ollama-web-data-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      runAsUser: 1337
-      runAsGroup: 1337
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
--- a/clusters/cl01tl/helm/ollama/values.yaml
+++ b/clusters/cl01tl/helm/ollama/values.yaml
@@ -227,6 +227,7 @@ ollama:
            - path: /root/.ollama
              readOnly: false
    web-data:
+      forceRename: ollama-web-data
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 5Gi
@@ -292,3 +293,8 @@ postgres-18-cluster:
      #   immediate: true
      #   schedule: "0 0 4 * * SAT"
      #   backupName: garage-remote
+volsync-target-data:
+  pvcTarget: ollama-web-data
+  moverSecurityContext:
+    runAsUser: 1337
+    runAsGroup: 1337
--- a/clusters/cl01tl/helm/postiz/Chart.lock
+++ b/clusters/cl01tl/helm/postiz/Chart.lock
@@ -11,5 +11,11 @@ dependencies:
 - name: redis-replication
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 0.5.0
-digest: sha256:89320b12971fe3aca51771776352f6841cc8ad85ce4e67799e47d34c28d0dd10
-generated: "2025-12-17T16:11:43.175332626Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:8bca371950ea2088ed3229f2e2dbfaa859668de408077b3ffc6c9ade8cacc4b7
+generated: "2025-12-17T11:32:26.293547-06:00"
--- a/clusters/cl01tl/helm/postiz/Chart.yaml
+++ b/clusters/cl01tl/helm/postiz/Chart.yaml
@@ -31,5 +31,13 @@ dependencies:
  - name: redis-replication
    version: 0.5.0
    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-upload
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/postiz.png
 appVersion: v2.10.1
--- a/clusters/cl01tl/helm/postiz/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/postiz/templates/external-secret.yaml
@@ -87,120 +87,6 @@ spec:
        metadataPolicy: None
        property: secret

---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: postiz-config-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: postiz-config-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/postiz/postiz-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: postiz-uploads-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: postiz-uploads-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/postiz/postiz-uploads"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
--- a/clusters/cl01tl/helm/postiz/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/postiz/templates/replication-source.yaml
@@ -1,52 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: postiz-config-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: postiz-config-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: postiz-config
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: postiz-config-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-
---
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: postiz-uploads-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: postiz-uploads-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: postiz-uploads
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: postiz-uploads-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
--- a/clusters/cl01tl/helm/postiz/values.yaml
+++ b/clusters/cl01tl/helm/postiz/values.yaml
@@ -83,6 +83,7 @@ postiz:
          protocol: HTTP
  persistence:
    config:
+      forceRename: postiz-config
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 2Gi
@@ -93,6 +94,7 @@ postiz:
            - path: /config
              readOnly: false
    uploads:
+      forceRename: postiz-uploads
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 10Gi
@@ -169,3 +171,7 @@ redis-replication:
  redisSentinel:
    enabled: true
    clusterSize: 3
+volsync-target-config:
+  pvcTarget: postiz-config
+volsync-target-upload:
+  pvcTarget: postiz-uploads
--- a/clusters/cl01tl/helm/prowlarr/Chart.lock
+++ b/clusters/cl01tl/helm/prowlarr/Chart.lock
@@ -2,5 +2,8 @@ dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.5.0
-digest: sha256:dfdb5ed2a8dafc2d0cb125af396032c4d7b4bff96eb54934fcb776df39dee5e9
-generated: "2025-12-05T17:10:55.27077318Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:e6c51831324467888dcfcf2434761f15e165312d38fa583c495096d59cb741d6
+generated: "2025-12-17T11:34:01.003589-06:00"
--- a/clusters/cl01tl/helm/prowlarr/Chart.yaml
+++ b/clusters/cl01tl/helm/prowlarr/Chart.yaml
@@ -19,5 +19,9 @@ dependencies:
    alias: prowlarr
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.5.0
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prowlarr.png
 appVersion: 2.3.0
--- a/clusters/cl01tl/helm/prowlarr/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/prowlarr/templates/external-secret.yaml
@@ -1,55 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: prowlarr-config-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: prowlarr-config-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/prowlarr/prowlarr-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
--- a/clusters/cl01tl/helm/prowlarr/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/prowlarr/templates/replication-source.yaml
@@ -1,35 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: prowlarr-config-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: prowlarr-config-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: prowlarr-config
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: prowlarr-config-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      runAsUser: 568
-      runAsGroup: 568
-      fsGroup: 568
-      fsGroupChangePolicy: OnRootMismatch
-      supplementalGroups:
-        - 44
-        - 100
-        - 109
-        - 65539
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
--- a/clusters/cl01tl/helm/prowlarr/values.yaml
+++ b/clusters/cl01tl/helm/prowlarr/values.yaml
@@ -49,3 +49,15 @@ prowlarr:
          main:
            - path: /config
              readOnly: false
+volsync-target-config:
+  pvcTarget: prowlarr-config
+  moverSecurityContext:
+    runAsUser: 568
+    runAsGroup: 568
+    fsGroup: 568
+    fsGroupChangePolicy: OnRootMismatch
+    supplementalGroups:
+      - 44
+      - 100
+      - 109
+      - 65539
--- a/clusters/cl01tl/helm/qbittorrent/Chart.lock
+++ b/clusters/cl01tl/helm/qbittorrent/Chart.lock
@@ -2,5 +2,14 @@ dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.5.0
-digest: sha256:6a7348951304a43f3e848889ceae04a0a66c4dc6ebf619efe6d69397d8af3437
-generated: "2025-12-05T17:11:05.489733462Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:2a52a5e028dbfd6c197857815b084e474f0a2c34e2b17fdd718386fd4a949287
+generated: "2025-12-17T12:42:06.415903-06:00"
--- a/clusters/cl01tl/helm/qbittorrent/Chart.yaml
+++ b/clusters/cl01tl/helm/qbittorrent/Chart.yaml
@@ -26,5 +26,17 @@ dependencies:
    alias: qbittorrent
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.5.0
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-qbit-manage-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-qui-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/qbittorrent.png
 appVersion: 5.1.4
--- a/clusters/cl01tl/helm/qbittorrent/templates/config-map.yaml
+++ b/clusters/cl01tl/helm/qbittorrent/templates/config-map.yaml
@@ -14,10 +14,86 @@ data:
        echo "curl could not be found, installing";
        apk add curl;
    fi;
-    curl -i -X POST --silent --write-out '%{http_code}' -d "json={\"random_port\": \"true\"}" "http://localhost:8080/api/v2/app/setPreferences";
-    sleep 10
-    echo "updating port with $1";
-    curl -i -X POST --silent --write-out '%{http_code}' -d "json={\"listen_port\": \"${1}\"}" "http://localhost:8080/api/v2/app/setPreferences";
+
+    if ! command -v jq 2>&1 >/dev/null
+    then
+        echo "jq could not be found, installing";
+        apk add jq;
+    fi;
+
+    API_ENDPOINT="http://localhost:8080/api/v2";
+
+    # echo " ";
+    # echo ">> Authentication ...";
+    # curl -i --silent --header 'Referer: http://localhost:8080' --output response_body_auth.json --data 'username=admin&password=adminadmin' "${API_ENDPOINT}/auth/login" -c cookie;
+
+    echo " ";
+    echo ">> Test access ...";
+    HTTP_STATUS=$(curl -i -X GET --silent --write-out '%{http_code}' --output response_body_test.json -b cookie -c cookie "${API_ENDPOINT}/app/version");
+    echo ">> HTTP Status Code: $HTTP_STATUS"
+
+    VERSION=$(tail -n 1 ./test/response_body_test.json)
+
+    if [ "$HTTP_STATUS" == "200" ]; then
+        echo ">> Access confirmed, qBittorrent version: ${VERSION}"
+        HTTP_STATUS=""
+    else
+        echo ">> ERROR: HTTP status code: $HTTP_STATUS"
+        exit 1
+    fi
+
+    PAYLOAD=$( jq -n \
+    --arg random_port "true" \
+    '{random_port: $random_port' );
+
+    echo " ";
+    echo ">> Setting port to random ...";
+    HTTP_STATUS=$(curl -i -X POST --silent -b cookie -c cookie --write-out '%{http_code}' --output response_body_random.json --data "$PAYLOAD" "${API_ENDPOINT}/app/setPreferences");
+
+    if [ "$HTTP_STATUS" == "200" ]; then
+        echo ">> Random port set"
+        HTTP_STATUS=""
+    else
+        echo ">> ERROR: HTTP status code: $HTTP_STATUS"
+        exit 1
+    fi
+
+    echo " ";
+    echo ">> Sleeping for changes to take effect";
+    sleep 5;
+
+    PAYLOAD=$( jq -n \
+    --arg listen_port "${1}" \
+    '{listen_port: $listen_port' );
+
+    echo " ";
+    echo ">> Updating port with ${1} ...";
+    curl -i -X POST --silent -b cookie -c cookie --write-out '%{http_code}' --output response_body_update.json --data "$PAYLOAD" "${API_ENDPOINT}/app/setPreferences";
+
+    if [ "$HTTP_STATUS" == "200" ]; then
+        echo ">> Port set"
+        HTTP_STATUS=""
+    else
+        echo ">> ERROR: HTTP status code: $HTTP_STATUS"
+        exit 1
+    fi
+
+    echo " ";
+    echo ">> Sleeping for changes to take effect";
+    sleep 5;
+
+    echo " ";
+    echo ">> Qbittorrent's post is now:";
+    curl -i -X GET --silent -b cookie -c cookie --write-out '%{http_code}' --output response_body_check.json "${API_ENDPOINT}/app/preferences";
+
+    LISTEN_PORT=$(cat response_body_check.json | jq -r .listen_port)
+
+    [[ "$HTTP_STATUS" == "200" || "$LISTEN_PORT" == "${1}" ]];
+        echo ">> Port updated successfully!"
+    else
+        echo ">> ERROR: HTTP status code: $HTTP_STATUS"
+        exit 1
+    fi

 ---
 apiVersion: v1
--- a/clusters/cl01tl/helm/qbittorrent/templates/persistent-volume-claim.yaml
+++ b/clusters/cl01tl/helm/qbittorrent/templates/persistent-volume-claim.yaml
@@ -1,24 +1,5 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
-metadata:
-  name: qbittorrent-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: qbittorrent-config
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: qbittorrent-config
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-
---
-apiVersion: v1
-kind: PersistentVolumeClaim
 metadata:
  name: qbittorrent-nfs-storage
  namespace: {{ .Release.Namespace }}
--- a/clusters/cl01tl/helm/qbittorrent/templates/persistent-volume.yaml
+++ b/clusters/cl01tl/helm/qbittorrent/templates/persistent-volume.yaml
@@ -1,30 +1,5 @@
 apiVersion: v1
 kind: PersistentVolume
-metadata:
-  name: qbittorrent-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: qbittorrent-config
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage/Torrent/QBITTORRENT
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac
-
---
-apiVersion: v1
-kind: PersistentVolume
 metadata:
  name: qbittorrent-nfs-storage
  namespace: {{ .Release.Namespace }}
--- a/clusters/cl01tl/helm/qbittorrent/values.yaml
+++ b/clusters/cl01tl/helm/qbittorrent/values.yaml
@@ -41,12 +41,6 @@ qbittorrent:
              value: "002"
            - name: WEBUI_PORT
              value: 8080
-            - name: DOCKER_MODS
-              value: ghcr.io/themepark-dev/theme.park:qbittorrent
-            - name: TP_COMMUNITY_THEME
-              value: true
-            - name: TP_THEME
-              value: catppuccin-mocha
          resources:
            requests:
              cpu: 500m
@@ -257,28 +251,6 @@ qbittorrent:
          targetPort: 9074
          protocol: HTTP
  persistence:
-    config:
-      type: persistentVolumeClaim
-      existingClaim: qbittorrent-config
-      advancedMounts:
-        main:
-          qbittorrent:
-            - path: /config
-              readOnly: false
-        qbit-manage:
-          qbit-manage:
-            - path: /qbittorrent
-              readOnly: false
-    theme-data:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 1Gi
-      retain: true
-      advancedMounts:
-        main:
-          qbittorrent:
-            - path: /themepark
-              readOnly: false
    update-script:
      enabled: true
      type: configMap
@@ -289,19 +261,6 @@ qbittorrent:
          gluetun:
            - path: /gluetun/update.sh
              subPath: update.sh
-    qbit-manage-config-data:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 1Gi
-      retain: true
-      advancedMounts:
-        qbit-manage:
-          init-copy-config:
-            - path: /app/config
-              readOnly: false
-          qbit-manage:
-            - path: /app/config
-              readOnly: false
    qbit-manage-config:
      enabled: true
      type: configMap
@@ -318,14 +277,37 @@ qbittorrent:
              readOnly: true
              mountPropagation: None
              subPath: config.yml
-    qbit-manage-config-var:
-      type: emptyDir
+    config-data:
+      forceRename: qbittorrent-config-data
+      storageClass: ceph-filesystem
+      accessMode: ReadWriteMany
+      size: 1Gi
+      retain: true
      advancedMounts:
+        main:
+          qbittorrent:
+            - path: /config/qBittorrent
+              readOnly: false
        qbit-manage:
          qbit-manage:
-            - path: /app/var
+            - path: /qbittorrent/qBittorrent
+              readOnly: false
+    qbit-manage-config-data:
+      forceRename: qbittorrent-qbit-manage-config-data
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 1Gi
+      retain: true
+      advancedMounts:
+        qbit-manage:
+          init-copy-config:
+            - path: /app/config
+              readOnly: false
+          qbit-manage:
+            - path: /app/config
              readOnly: false
    qui-config-data:
+      forceRename: qbittorrent-qui-config-data
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 1Gi
@@ -335,6 +317,13 @@ qbittorrent:
          qui:
            - path: /config
              readOnly: false
+    qbit-manage-config-var:
+      type: emptyDir
+      advancedMounts:
+        qbit-manage:
+          qbit-manage:
+            - path: /app/var
+              readOnly: false
    storage:
      type: persistentVolumeClaim
      existingClaim: qbittorrent-nfs-storage
@@ -347,3 +336,29 @@ qbittorrent:
          qbit-manage:
            - path: /mnt/store
              readOnly: false
+volsync-target-config:
+  pvcTarget: qbittorrent-config-data
+  moverSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
+  local:
+    restic:
+      copyMethod: Snapshot
+      storageClassName: ceph-filesystem
+      volumeSnapshotClassName: ceph-filesystem-snapshot
+  remote:
+    restic:
+      copyMethod: Snapshot
+      storageClassName: ceph-filesystem
+      volumeSnapshotClassName: ceph-filesystem-snapshot
+  external:
+    restic:
+      copyMethod: Snapshot
+      storageClassName: ceph-filesystem
+      volumeSnapshotClassName: ceph-filesystem-snapshot
+volsync-target-qbit-manage-config:
+  pvcTarget: qbittorrent-qbit-manage-config-data
+volsync-target-qui-config:
+  pvcTarget: qbittorrent-qui-config-data
--- a/clusters/cl01tl/helm/radarr-4k/Chart.lock
+++ b/clusters/cl01tl/helm/radarr-4k/Chart.lock
@@ -5,5 +5,8 @@ dependencies:
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 7.1.3
-digest: sha256:b61b9bd12d2576cc2ce7686283c34a4ca572e1a6004edaa4333f6298a81cfa6c
-generated: "2025-12-17T16:11:55.289060592Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:9d66ccb57066b202b4bdb12ff82fe58ce6f223b8cf52f41dbe71b63e2a06e1da
+generated: "2025-12-17T13:19:56.898192-06:00"
--- a/clusters/cl01tl/helm/radarr-4k/Chart.yaml
+++ b/clusters/cl01tl/helm/radarr-4k/Chart.yaml
@@ -29,5 +29,9 @@ dependencies:
    alias: postgres-18-cluster
    version: 7.1.3
    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/radarr-4k.png
 appVersion: 6.0.4
--- a/clusters/cl01tl/helm/radarr-4k/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/radarr-4k/templates/external-secret.yaml
@@ -1,62 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
-metadata:
-  name: radarr-4k-config-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr-4k-config-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/radarr5-4k/radarr5-4k-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
 metadata:
  name: radarr-4k-postgresql-18-cluster-backup-secret
  namespace: {{ .Release.Namespace }}
--- a/clusters/cl01tl/helm/radarr-4k/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/radarr-4k/templates/replication-source.yaml
@@ -1,30 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: radarr-4k-config-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr-4k-config-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: radarr-4k-config
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: radarr-4k-config-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      runAsUser: 1000
-      runAsGroup: 1000
-      fsGroup: 1000
-      fsGroupChangePolicy: OnRootMismatch
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
--- a/clusters/cl01tl/helm/radarr-4k/values.yaml
+++ b/clusters/cl01tl/helm/radarr-4k/values.yaml
@@ -144,3 +144,10 @@ postgres-18-cluster:
      #   immediate: true
      #   schedule: "0 0 4 * * SAT"
      #   backupName: garage-remote
+volsync-target-config:
+  pvcTarget: radarr-4k-config
+  moverSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
--- a/clusters/cl01tl/helm/radarr-anime/Chart.lock
+++ b/clusters/cl01tl/helm/radarr-anime/Chart.lock
@@ -5,5 +5,8 @@ dependencies:
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 7.1.3
-digest: sha256:faf85a053ac36925b51a326d638fcbea233a76e718a40fce46354889c1bd7afa
-generated: "2025-12-17T16:12:05.3064082Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:1a14ec1d5d6a61c3428e4578c391e38ecc87f8995c572e53982e950e35a4705f
+generated: "2025-12-17T13:19:58.852583-06:00"
--- a/clusters/cl01tl/helm/radarr-anime/Chart.yaml
+++ b/clusters/cl01tl/helm/radarr-anime/Chart.yaml
@@ -29,5 +29,9 @@ dependencies:
    alias: postgres-18-cluster
    version: 7.1.3
    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/radarr-anime.png
 appVersion: 6.0.4
--- a/clusters/cl01tl/helm/radarr-anime/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/radarr-anime/templates/external-secret.yaml
@@ -1,62 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
-metadata:
-  name: radarr-anime-config-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr-anime-config-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/radarr5-anime/radarr5-anime-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
 metadata:
  name: radarr-anime-postgresql-18-cluster-backup-secret
  namespace: {{ .Release.Namespace }}
--- a/clusters/cl01tl/helm/radarr-anime/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/radarr-anime/templates/replication-source.yaml
@@ -1,30 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: radarr-anime-config-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr-anime-config-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: radarr-anime-config
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: radarr-anime-config-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      runAsUser: 1000
-      runAsGroup: 1000
-      fsGroup: 1000
-      fsGroupChangePolicy: OnRootMismatch
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
--- a/clusters/cl01tl/helm/radarr-anime/values.yaml
+++ b/clusters/cl01tl/helm/radarr-anime/values.yaml
@@ -142,3 +142,10 @@ postgres-18-cluster:
      #   immediate: true
      #   schedule: "0 0 4 * * SAT"
      #   backupName: garage-remote
+volsync-target-config:
+  pvcTarget: radarr-anime-config
+  moverSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
--- a/clusters/cl01tl/helm/radarr-standup/Chart.lock
+++ b/clusters/cl01tl/helm/radarr-standup/Chart.lock
@@ -5,5 +5,8 @@ dependencies:
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 7.1.3
-digest: sha256:7164911e79adc854bbf86e0904cfa1a55de6a00ed06c82def1f63dd2ed8a3dac
-generated: "2025-12-17T16:12:16.593155376Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:2545d799b67e86e41f6d8295af7020da7669ce4f3bb6439e9f16c2d19fbc58c5
+generated: "2025-12-17T13:20:01.335355-06:00"
--- a/clusters/cl01tl/helm/radarr-standup/Chart.yaml
+++ b/clusters/cl01tl/helm/radarr-standup/Chart.yaml
@@ -28,5 +28,9 @@ dependencies:
    alias: postgres-18-cluster
    version: 7.1.3
    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/radarr.png
 appVersion: 6.0.4
--- a/clusters/cl01tl/helm/radarr-standup/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/radarr-standup/templates/external-secret.yaml
@@ -1,62 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
-metadata:
-  name: radarr-standup-config-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr-standup-config-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/radarr5-standup/radarr5-standup-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
 metadata:
  name: radarr-standup-postgresql-18-cluster-backup-secret
  namespace: {{ .Release.Namespace }}
--- a/clusters/cl01tl/helm/radarr-standup/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/radarr-standup/templates/replication-source.yaml
@@ -1,30 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: radarr-standup-config-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr-standup-config-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: radarr-standup-config
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: radarr-standup-config-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      runAsUser: 1000
-      runAsGroup: 1000
-      fsGroup: 1000
-      fsGroupChangePolicy: OnRootMismatch
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
--- a/clusters/cl01tl/helm/radarr-standup/values.yaml
+++ b/clusters/cl01tl/helm/radarr-standup/values.yaml
@@ -142,3 +142,10 @@ postgres-18-cluster:
      #   immediate: true
      #   schedule: "0 0 4 * * SAT"
      #   backupName: garage-remote
+volsync-target-config:
+  pvcTarget: radarr-standup-config
+  moverSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
--- a/clusters/cl01tl/helm/radarr/Chart.lock
+++ b/clusters/cl01tl/helm/radarr/Chart.lock
@@ -5,5 +5,8 @@ dependencies:
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 7.1.3
-digest: sha256:863b0b67060b5253741619a8361f1fcd99ecbd7960f0ea7ffeba99387f9f3550
-generated: "2025-12-17T16:12:26.786928598Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:2b8911d7e83318bb6857c08ba44d7b327b736211b385215b856c54fb36804ed5
+generated: "2025-12-17T12:53:31.573079-06:00"
--- a/clusters/cl01tl/helm/radarr/Chart.yaml
+++ b/clusters/cl01tl/helm/radarr/Chart.yaml
@@ -28,5 +28,9 @@ dependencies:
    alias: postgres-18-cluster
    version: 7.1.3
    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/radarr.png
 appVersion: 6.0.4
--- a/clusters/cl01tl/helm/radarr/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/radarr/templates/external-secret.yaml
@@ -1,62 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
-metadata:
-  name: radarr-config-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr-config-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/radarr5/radarr5-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
 metadata:
  name: radarr-postgresql-18-cluster-backup-secret
  namespace: {{ .Release.Namespace }}
--- a/clusters/cl01tl/helm/radarr/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/radarr/templates/replication-source.yaml
@@ -1,30 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: radarr-config-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr-config-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: radarr-config
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: radarr-config-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      runAsUser: 1000
-      runAsGroup: 1000
-      fsGroup: 1000
-      fsGroupChangePolicy: OnRootMismatch
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
--- a/clusters/cl01tl/helm/radarr/values.yaml
+++ b/clusters/cl01tl/helm/radarr/values.yaml
@@ -144,3 +144,10 @@ postgres-18-cluster:
      #   immediate: true
      #   schedule: "0 0 4 * * SAT"
      #   backupName: garage-remote
+volsync-target-config:
+  pvcTarget: radarr-config
+  moverSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
--- a/clusters/cl01tl/helm/roundcube/Chart.lock
+++ b/clusters/cl01tl/helm/roundcube/Chart.lock
@@ -5,5 +5,8 @@ dependencies:
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 7.1.3
-digest: sha256:a6968fb1b6cdceb6ca4da497524ed86979fffe604186b5fbdc2cd3b24ea2e197
-generated: "2025-12-17T16:12:37.159933773Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:4c762abe68b0a21bad7c3ba9a86c6f2b4d9936136d3071711f1e5ea3f94dc321
+generated: "2025-12-17T13:20:10.972807-06:00"
--- a/clusters/cl01tl/helm/roundcube/Chart.yaml
+++ b/clusters/cl01tl/helm/roundcube/Chart.yaml
@@ -23,5 +23,9 @@ dependencies:
    alias: postgres-18-cluster
    version: 7.1.3
    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-data
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/roundcube.png
 appVersion: 1.6.11
--- a/clusters/cl01tl/helm/roundcube/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/roundcube/templates/external-secret.yaml
@@ -20,63 +20,6 @@ spec:
        metadataPolicy: None
        property: DES_KEY

---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: roundcube-data-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: roundcube-data-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/roundcube/roundcube-data"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
--- a/clusters/cl01tl/helm/roundcube/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/roundcube/templates/replication-source.yaml
@@ -1,25 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: roundcube-data-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: roundcube-data-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: roundcube-data
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: roundcube-data-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
--- a/clusters/cl01tl/helm/roundcube/values.yaml
+++ b/clusters/cl01tl/helm/roundcube/values.yaml
@@ -77,8 +77,8 @@ roundcube:
        timeZone: US/Central
        schedule: 30 4 * * *
        startingDeadlineSeconds: 90
-        successfulJobsHistory: 3
-        failedJobsHistory: 3
+        successfulJobsHistory: 1
+        failedJobsHistory: 1
        backoffLimit: 3
        parallelism: 1
      containers:
@@ -173,6 +173,17 @@ roundcube:
          targetPort: 80
          protocol: HTTP
  persistence:
+    config:
+      enabled: true
+      type: configMap
+      name: roundcube-config
+      advancedMounts:
+        main:
+          nginx:
+            - path: /etc/nginx/conf.d/default.conf
+              readOnly: true
+              mountPropagation: None
+              subPath: default.conf
    data:
      forceRename: roundcube-data
      storageClass: ceph-block
@@ -194,17 +205,6 @@ roundcube:
          main:
            - path: /tmp/roundcube-temp
              readOnly: false
-    config:
-      enabled: true
-      type: configMap
-      name: roundcube-config
-      advancedMounts:
-        main:
-          nginx:
-            - path: /etc/nginx/conf.d/default.conf
-              readOnly: true
-              mountPropagation: None
-              subPath: default.conf
 postgres-18-cluster:
  mode: recovery
  cluster:
@@ -259,3 +259,5 @@ postgres-18-cluster:
      #   immediate: true
      #   schedule: "0 0 4 * * SAT"
      #   backupName: garage-remote
+volsync-target-data:
+  pvcTarget: roundcube-data
--- a/clusters/cl01tl/helm/searxng/Chart.lock
+++ b/clusters/cl01tl/helm/searxng/Chart.lock
@@ -2,5 +2,8 @@ dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.5.0
-digest: sha256:668ec4b9fb6310a34fa64de817e935554fc24bce69893bf9f0821e94bb6ccf8a
-generated: "2025-12-05T17:12:23.589903216Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:83b7f010f0cbf4d218519d9ad521239ae687139d41c1fca105b584439cd61d24
+generated: "2025-12-17T13:20:14.572103-06:00"
--- a/clusters/cl01tl/helm/searxng/Chart.yaml
+++ b/clusters/cl01tl/helm/searxng/Chart.yaml
@@ -16,5 +16,9 @@ dependencies:
    alias: searxng
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.5.0
+  - name: volsync-target
+    alias: volsync-target-data
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/searxng.png
 appVersion: 1.0.0
--- a/clusters/cl01tl/helm/searxng/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/searxng/templates/external-secret.yaml
@@ -79,60 +79,3 @@ spec:
        key: /cl01tl/searxng/api/config
        metadataPolicy: None
        property: limiter.toml
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: searxng-browser-data-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: searxng-browser-data-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/searxng/searxng-browser-data"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
--- a/clusters/cl01tl/helm/searxng/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/searxng/templates/replication-source.yaml
@@ -1,25 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: searxng-browser-data-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: searxng-browser-data-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: searxng-browser-data
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: searxng-browser-data-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
--- a/clusters/cl01tl/helm/searxng/values.yaml
+++ b/clusters/cl01tl/helm/searxng/values.yaml
@@ -131,6 +131,7 @@ searxng:
              mountPropagation: None
              subPath: limiter.toml
    api-data:
+      forceRename: searxng-api-data
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 5Gi
@@ -140,6 +141,7 @@ searxng:
            - path: /etc/searxng
              readOnly: false
    browser-data:
+      forceRename: searxng-browser-data
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 5Gi
@@ -157,3 +159,5 @@ searxng:
          valkey:
            - path: /data
              readOnly: false
+volsync-target-data:
+  pvcTarget: searxng-browser-data
--- a/clusters/cl01tl/helm/seerr/Chart.lock
+++ b/clusters/cl01tl/helm/seerr/Chart.lock
@@ -2,5 +2,8 @@ dependencies:
 - name: seerr-chart
  repository: oci://ghcr.io/seerr-team/seerr
  version: 3.0.0
-digest: sha256:6cf3525ac452922339261fa2a5ecc9d8cdf66b21bc30e032395d8d80bb79dc6c
-generated: "2025-12-08T20:48:24.567069-06:00"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:a2e3b8de34259b47a665f86c55b8a2d41e60e864257fee7157670cb37df4d4e7
+generated: "2025-12-17T13:20:16.402386-06:00"
--- a/clusters/cl01tl/helm/seerr/Chart.yaml
+++ b/clusters/cl01tl/helm/seerr/Chart.yaml
@@ -18,5 +18,9 @@ dependencies:
  - name: seerr-chart
    repository: oci://ghcr.io/seerr-team/seerr
    version: 3.0.0
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/overseerr.png
 appVersion: develop
--- a/clusters/cl01tl/helm/seerr/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/seerr/templates/external-secret.yaml
@@ -1,55 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: seerr-config-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: seerr-config-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/seerr/seerr-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
--- a/clusters/cl01tl/helm/seerr/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/seerr/templates/replication-source.yaml
@@ -1,26 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: seerr-config-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: seerr-config-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: seerr-seerr-chart-config
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: seerr-config-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-    cacheCapacity: 10Gi
--- a/clusters/cl01tl/helm/seerr/values.yaml
+++ b/clusters/cl01tl/helm/seerr/values.yaml
@@ -29,3 +29,5 @@ seerr-chart:
    requests:
      cpu: 10m
      memory: 128Mi
+volsync-target-config:
+  pvcTarget: seerr-seerr-chart-config
--- a/clusters/cl01tl/helm/sonarr-4k/Chart.lock
+++ b/clusters/cl01tl/helm/sonarr-4k/Chart.lock
@@ -5,5 +5,8 @@ dependencies:
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 7.1.3
-digest: sha256:5e26665c86f0d26bcc577ab578a14a033cc984de0a08fa6f6bfb6abf98324cf3
-generated: "2025-12-17T16:12:46.874715502Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:36a5f9bc034285ab8c73f3caedadbfddfef557ec63798b9e8e86691c97bf7a00
+generated: "2025-12-17T13:20:29.470722-06:00"
--- a/clusters/cl01tl/helm/sonarr-4k/Chart.yaml
+++ b/clusters/cl01tl/helm/sonarr-4k/Chart.yaml
@@ -29,5 +29,9 @@ dependencies:
    alias: postgres-18-cluster
    version: 7.1.3
    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/sonarr.png
 appVersion: 4.0.14
--- a/clusters/cl01tl/helm/sonarr-4k/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/sonarr-4k/templates/external-secret.yaml
@@ -1,62 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
-metadata:
-  name: sonarr-4k-config-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr-4k-config-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/sonarr4-4k/sonarr4-4k-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
 metadata:
  name: sonarr-4k-postgresql-18-cluster-backup-secret
  namespace: {{ .Release.Namespace }}
--- a/clusters/cl01tl/helm/sonarr-4k/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/sonarr-4k/templates/replication-source.yaml
@@ -1,30 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: sonarr-4k-config-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr-4k-config-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: sonarr-4k-config
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: sonarr-4k-config-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      runAsUser: 1000
-      runAsGroup: 1000
-      fsGroup: 1000
-      fsGroupChangePolicy: OnRootMismatch
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
--- a/clusters/cl01tl/helm/sonarr-4k/values.yaml
+++ b/clusters/cl01tl/helm/sonarr-4k/values.yaml
@@ -142,3 +142,10 @@ postgres-18-cluster:
      #   immediate: true
      #   schedule: "0 0 4 * * SAT"
      #   backupName: garage-remote
+volsync-target-config:
+  pvcTarget: sonarr-4k-config
+  moverSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
--- a/clusters/cl01tl/helm/sonarr-anime/Chart.lock
+++ b/clusters/cl01tl/helm/sonarr-anime/Chart.lock
@@ -5,5 +5,8 @@ dependencies:
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 7.1.3
-digest: sha256:8ea1513ce6a088120b1e59148088c7d9c88d8ce4c5821f5a7aa4382a790972e0
-generated: "2025-12-17T16:12:56.720822569Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:a0d788481260502173ead09be09869f7f5f8b563b4258aafa685a0493cc6afd9
+generated: "2025-12-17T13:20:32.181564-06:00"
--- a/clusters/cl01tl/helm/sonarr-anime/Chart.yaml
+++ b/clusters/cl01tl/helm/sonarr-anime/Chart.yaml
@@ -28,5 +28,9 @@ dependencies:
    alias: postgres-18-cluster
    version: 7.1.3
    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/sonarr.png
 appVersion: 4.0.14
--- a/clusters/cl01tl/helm/sonarr-anime/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/sonarr-anime/templates/external-secret.yaml
@@ -1,62 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
-metadata:
-  name: sonarr-anime-config-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr-anime-config-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/sonarr4-anime/sonarr4-anime-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
 metadata:
  name: sonarr-anime-postgresql-18-cluster-backup-secret
  namespace: {{ .Release.Namespace }}
--- a/clusters/cl01tl/helm/sonarr-anime/templates/replication-source.yaml
+++ b/clusters/cl01tl/helm/sonarr-anime/templates/replication-source.yaml
@@ -1,30 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: sonarr-anime-config-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr-anime-config-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: sonarr-anime-config
-  trigger:
-    schedule: 0 4 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: sonarr-anime-config-backup-secret
-    retain:
-      hourly: 1
-      daily: 3
-      weekly: 2
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      runAsUser: 1000
-      runAsGroup: 1000
-      fsGroup: 1000
-      fsGroupChangePolicy: OnRootMismatch
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
--- a/clusters/cl01tl/helm/sonarr-anime/values.yaml
+++ b/clusters/cl01tl/helm/sonarr-anime/values.yaml
@@ -142,3 +142,10 @@ postgres-18-cluster:
      #   immediate: true
      #   schedule: "0 0 4 * * SAT"
      #   backupName: garage-remote
+volsync-target-config:
+  pvcTarget: sonarr-anime-config
+  moverSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
--- a/clusters/cl01tl/helm/sonarr/Chart.lock
+++ b/clusters/cl01tl/helm/sonarr/Chart.lock
@@ -5,5 +5,8 @@ dependencies:
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 7.1.3
-digest: sha256:5acb57a3b6eaf3f4e15e6551eeea370cdf4a4ed7f787cadc26433fdb942c82c2
-generated: "2025-12-17T16:13:05.489126306Z"
+- name: volsync-target
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 0.5.0
+digest: sha256:718a6f0608eb176481373c8bb071dc582bf1cbb8ece5a700980bf606ab00687f
+generated: "2025-12-17T13:20:27.312673-06:00"
--- a/clusters/cl01tl/helm/sonarr/Chart.yaml
+++ b/clusters/cl01tl/helm/sonarr/Chart.yaml
@@ -28,5 +28,9 @@ dependencies:
    alias: postgres-18-cluster
    version: 7.1.3
    repository: oci://harbor.alexlebens.net/helm-charts
+  - name: volsync-target
+    alias: volsync-target-config
+    version: 0.5.0
+    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/sonarr.png
 appVersion: 4.0.16
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Renovate Bot	a6a56bf45b	Update Helm release grafana-operator to v5.21.1 All checks were successful renovate/stability-days Updates have met minimum release age requirement Details	2025-12-17 22:25:16 +00:00
Alex Lebens	09628ea5ed	change class Some checks are pending renovate / renovate (push) Waiting to run Details lint-test-helm / lint-helm (push) Successful in 12s Details render-manifests-push / render-manifests-push (push) Successful in 1m29s Details	2025-12-17 16:23:41 -06:00
Alex Lebens	365f657493	migrate to new chart	2025-12-17 14:17:07 -06:00
Alex Lebens	47d625d244	add tmpcharts to ignore	2025-12-17 14:14:18 -06:00
Alex Lebens	ebae841fa2	reduce job history	2025-12-17 13:32:53 -06:00
Alex Lebens	24a97d65e9	move volsync to chart	2025-12-17 13:29:14 -06:00
Alex Lebens	9c080b9407	move volsync to chart	2025-12-17 13:29:09 -06:00
Alex Lebens	0f11d6ed6b	move volsync to chart	2025-12-17 13:29:03 -06:00
Alex Lebens	7383156468	move volsync to chart	2025-12-17 13:28:58 -06:00
Alex Lebens	763bff2371	move volsync to chart	2025-12-17 13:28:41 -06:00
Alex Lebens	6df133a384	move volsync to chart	2025-12-17 13:28:34 -06:00
Alex Lebens	15645efda7	move volsync to chart	2025-12-17 13:28:23 -06:00
Alex Lebens	bdd9fbfcad	move volsync to chart	2025-12-17 13:28:02 -06:00
Alex Lebens	f2a000f286	move volsync to chart	2025-12-17 13:27:48 -06:00
Alex Lebens	51c9aa1b48	scale down to 1 instance	2025-12-17 13:27:22 -06:00
Alex Lebens	c7e9835f54	add tmpcharts to ignore	2025-12-17 13:27:03 -06:00
Alex Lebens	4861f22e95	update script All checks were successful lint-test-helm / lint-helm (push) Successful in 9s Details render-manifests-push / render-manifests-push (push) Successful in 26s Details renovate / renovate (push) Successful in 1m23s Details	2025-12-17 12:49:10 -06:00
Alex Lebens	577bad693b	remove old config and add volsync	2025-12-17 12:48:54 -06:00
Alex Lebens	2664810903	change storage All checks were successful render-manifests-push / render-manifests-push (push) Successful in 34s Details lint-test-helm / lint-helm (push) Successful in 11s Details renovate / renovate (push) Successful in 2m27s Details	2025-12-17 12:10:01 -06:00
Alex Lebens	01f12f9408	add volsync, organize data All checks were successful lint-test-helm / lint-helm (push) Successful in 10s Details render-manifests-push / render-manifests-push (push) Successful in 29s Details renovate / renovate (push) Successful in 1m46s Details	2025-12-17 11:56:59 -06:00
Alex Lebens	f838adb8fc	remove theme	2025-12-17 11:43:01 -06:00
Alex Lebens	605b170072	remove old config All checks were successful renovate / renovate (push) Successful in 1m48s Details lint-test-helm / lint-helm (push) Successful in 15s Details render-manifests-push / render-manifests-push (push) Successful in 22s Details	2025-12-17 11:40:09 -06:00
Alex Lebens	fc478400c6	add logging to script	2025-12-17 11:36:44 -06:00
Alex Lebens	c89f3ced65	move volsync to chart All checks were successful renovate / renovate (push) Successful in 1m50s Details lint-test-helm / lint-helm (push) Successful in 10s Details render-manifests-push / render-manifests-push (push) Successful in 26s Details	2025-12-17 11:34:10 -06:00
Alex Lebens	a1d73da0a1	move volsync to chart Some checks failed lint-test-helm / lint-helm (push) Successful in 8s Details render-manifests-push / render-manifests-push (push) Successful in 36s Details renovate / renovate (push) Has been cancelled Details	2025-12-17 11:32:45 -06:00
Alex Lebens	6f43520c94	move volsync to chart All checks were successful lint-test-helm / lint-helm (push) Successful in 12s Details render-manifests-push / render-manifests-push (push) Successful in 28s Details renovate / renovate (push) Successful in 2m12s Details	2025-12-17 11:29:03 -06:00
Alex Lebens	e135f87ef5	expand idsk All checks were successful lint-test-helm / lint-helm (push) Successful in 16s Details render-manifests-push / render-manifests-push (push) Successful in 23s Details renovate / renovate (push) Successful in 56s Details	2025-12-17 10:58:10 -06:00
Alex Lebens	313eb2423f	ignore serverside diff All checks were successful lint-test-helm / lint-helm (push) Successful in 12s Details render-manifests-push / render-manifests-push (push) Successful in 45s Details renovate / renovate (push) Successful in 1m57s Details	2025-12-17 10:42:22 -06:00
Alex Lebens	47e9e9f1a2	add badge	2025-12-17 10:42:22 -06:00
Alex Lebens	a12ee3b161	rebase	2025-12-17 10:42:18 -06:00
Alex Lebens	4bbbefbe72	move volsync to chart	2025-12-17 10:41:40 -06:00
Alex Lebens	a14474690e	add volsync	2025-12-17 10:41:40 -06:00
Alex Lebens	aba571167a	add volsync	2025-12-17 10:41:40 -06:00
Alex Lebens	b1c587f6bb	rebase	2025-12-17 10:41:33 -06:00