feat(helm): update chart pgadmin4 to 1.35.0

This reverts commit 15ef935a88.

Taskfile.yaml

@@ -11,11 +11,8 @@ includes:
 tasks:
   execPostgres:
     desc: Exec into the postgres pod as the postgres user
-    cmd: kubectl -n database exec -it postgres16-1 -- psql -d postgres -U postgres
-  execPostgresImmich:
-    desc: Exec into the postgres pod as the postgres user
-    cmd: kubectl -n database exec -it postgres16-immich-1 -- psql -d postgres -U postgres
+    cmd: kubectl -n database exec -it postgresql-0 -- psql -d postgres -U postgres
 
   execMysql:
     desc: Exec into the mysql pod as the mysql user
-    cmd: kubectl -n database exec -it mysql-0 -- mysql -u root -p
+    cmd: kubectl -n database exec -it mysql-0 -- mysql -u root -p

kubernetes/common/apps/volsync-system/snapshot-controller/app/helm-release.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: snapshot-controller
-      version: 4.0.2
+      version: 4.0.1
       sourceRef:
         kind: HelmRepository
         name: piraeus

kubernetes/common/apps/volsync-system/volsync/app/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: volsync
-      version: 0.12.1
+      version: 0.11.0
       sourceRef:
         kind: HelmRepository
         name: backube

kubernetes/common/bootstrap/flux/kustomization.yaml

@@ -5,7 +5,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - github.com/fluxcd/flux2/manifests/install?ref=v2.5.1
+  - github.com/fluxcd/flux2/manifests/install?ref=v2.4.0
 patches:
   # Resources renamed to match those installed by oci://ghcr.io/fluxcd/flux-manifests
   - target:

kubernetes/main/apps/authentik/app/helm-release.yaml

@@ -11,7 +11,7 @@ spec:
   chart:
     spec:
       chart: authentik
-      version: 2025.2.4
+      version: 2024.12.3
       sourceRef:
         kind: HelmRepository
         name: authentik-charts

kubernetes/main/apps/database/kustomization.yaml

@@ -6,5 +6,4 @@ resources:
 - ./postgresql/ks.yaml
 - ./redis
 - ./minio
-- ./mysql
-- ./mariadb/ks.yaml
+- ./mysql

kubernetes/main/apps/database/mariadb/crds/helm-release.yaml

@@ -1,25 +0,0 @@
----
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: mariadb-operator-crds
-  namespace: database
-spec:
-  chart:
-    spec:
-      chart: mariadb-operator-crds
-      version: 0.38.1
-      sourceRef:
-        kind: HelmRepository
-        name: mariadb-operator
-        namespace: flux-system
-  interval: 30m
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    cleanupOnFail: true
-    remediation:
-      strategy: rollback
-      retries: 3

kubernetes/main/apps/database/mariadb/crds/helm-repository.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: mariadb-operator
-  namespace: flux-system
-spec:
-  interval: 2h
-  url: https://helm.mariadb.com/mariadb-operator

kubernetes/main/apps/database/mariadb/database/db.yaml

@@ -1,11 +0,0 @@
-apiVersion: k8s.mariadb.com/v1alpha1
-kind: MariaDB
-metadata:
-  name: mariadb
-spec:
-  rootPasswordSecretKeyRef:
-    name: mariadb-secrets
-    key: MARIADB_ROOT_PASSWORD
-  storage:
-    size: 2Gi
-    storageClassName: openebs-zfs-mainpool

kubernetes/main/apps/database/mariadb/database/kustomization.yaml

@@ -1,7 +0,0 @@
----
-# yaml-language-server: $schema=https://json.schemastore.org/kustomization
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- db.yaml
-- secret.sops.yaml

kubernetes/main/apps/database/mariadb/database/secret.sops.yaml

@@ -1,72 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: mariadb-secrets
-    labels:
-        k8s.mariadb.com/watch: null
-stringData:
-    MARIADB_ROOT_PASSWORD: ENC[AES256_GCM,data:1yAkRvtIjsBY944raOrlncrd/iBHnaCqAVc3KJRZHlY=,iv:DIYkBfWsZERr9sqwxs7Thwb75cdo+7S2wB/XIWo+EcE=,tag:RYu/QqHg3x5k/JS6timQYQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2025-03-11T23:52:26Z"
-    mac: ENC[AES256_GCM,data:TaagPQ0+BQyZdFU9vyOg5LCjYfdBHz63TJ198xJjFOv1e0ftyvPsG+n0NgpZq7mtHcLqw+JG80rlSgjjOym2jdPwHWEhpRr2qXeydjs+/IsOxy1Vn4s9ZRjuR1vcl/F81vpaDXo4Xd7bdpy5igEnsioLLzp2spOJGiBjCdzqDUY=,iv:R0dg3FQUkp247tsOmL6hoWD5c1/eztQnQK5siK/lR3A=,tag:lZCLvz1qhhxnaqBgnPF61A==,type:str]
-    pgp:
-        - created_at: "2025-03-11T23:52:26Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAyqlIeyoxYovAQ//TK1bjaVbf/EVJUykKpK6DE8gGFYqPa8/IZd5qGl0OJQu
-            90JtavnZcpfA3v3tuwJ4NfG2RiMOxpAniDICHHoPDLE+lp5ZekdC2hUokMTrn5mb
-            NUfJsrKxk7Tasp7ALmAaifJWqcmsbFA5GT9Vt2jpBsl0xHhF2q1Z3VVcwTk3Pv9D
-            R3+FPvy40s3c+J1w2+4XmF1ut3ffovLcCI6jKzeyArGtwEYkeFanO60NAP/FKB/X
-            eBvSrNg47MJXT2FsjO82BcuYA1rOW/NDDa+IAj4QULIakBC70UdjDqnNzwbP9FSu
-            Le5Zy6Ax1jjJmLr7Gs4SHY1bZS0VRFBRia/DSZF6h80qQ7V4Cop5HDjJTfBy2Uch
-            Smx0eHgV4XBtJJewALrz8jeadAfrQqkALTb+vDPTpS/9Sv4AS5RzyDesHq3w6FT6
-            P0H3L8Ad+3gsofup0f0SDajaWEY8d4MqnzQ6nfePrTZF1zmmss5MMwhM0dh05Gj1
-            aCFOfOL9iNJXZBIcP8LrrG00fRfeDnUfvfR/a4W1KaK8wNOZGsk4VYMFQyr5vRjF
-            c8pPmVx33Q3mWvDvnCFvjJxBrr9+j8k7AtqdJBE6suMgQN806RyjzNePfXi/rnJ3
-            H6PERdcciGiGLvzyodSZ69qqoBP0esGTJ5VUldhAW1JiCo4et7alBmNgPQol9PKF
-            AgwDXjg0p2IN1X8BD/4xYqVReeEhYPz6TJAMJz1RZMYBgyjIchKUOYEuD/hkvzfw
-            CSwPrgNV+ocBSQErmjT5XILOaezwX97LrmG7Nve5X8h/8GTvQBGIqlCRQ213wmpc
-            K6SJs7sXcLlO9vhDUNnjCf9bbkL64820LDWSt14wM7eUlcnJ/O93isNxttpQqvkt
-            cgtU2m9YFtY+NsRC9GllCJSsKGyUmp0wLHnKWa4CACXZ03qNefNOjMy7n3fNbfkF
-            qCk2QvpDE/D02VlfKsN4PzqptPClv9S1OzJAHaWOJJDM4L1F4wnOby2H9QFVCBS7
-            0edK/94zHNOYWKW6mLburvt97WI+Pa2oSiG93JKFZWG7zbpovGGrtqVpzFcOg2Cr
-            ILuV17Ms559CICQBQNbp32nH8QNORrb7YLIJGH8pLodgl4Vrk2HnxOJyqQfx0MRU
-            AurFUwyqa5rbhqaDQq+dWAJkXnZHAW/lvoC3OLbNsWgwQAntblDH0pAaIZPy48aW
-            6CzmfDYtoMmXk+gUeeMDrqTMuOXNyGAiqlCnNLayb7nrXIwVEzYS+rEkhFqHQPVR
-            168+uwLZoO4ubQlqNMHH08IC2Z0PgrkyIh79STQn//a9rg8sLxi0eDO4rtcdZeJi
-            eRE0vBpJ2xWK6FbtCeBEh6L+gbLF2BoGUKOBvWPQ1NCOYr6Z7CR1CNlVfopsadRo
-            AQkCENBv+WuM8shr1beGaFeZc5veTb23PZ2ff9LnxK4BI5Xwz4yrqymPm3U3MUwY
-            DXu3aRMBBWlY8k1CB4bayXkXtunzTw14MJM0K6l8odxLb/rYOpS80DxUDSwSV+Cu
-            MFft5VyZzOs=
-            =xFKz
-            -----END PGP MESSAGE-----
-          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
-        - created_at: "2025-03-11T23:52:26Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VAQ//dgyVsRBjBqGIfqbI39jPQqI2mSHge9TFMKePioAITVBF
-            xkzVXXg6vAB3xvMbB6f8mQbnBzk0Ju0gGMnZ7K0XQqYsPrYV6lmXIGm52eavF/uP
-            7B/j37pxO4PoYA1qi3t/Be9/58h2g5+sI9m0uRGcozgmnpVzttLUDzkmAyEXm3LL
-            SmfaiEZ2kCs89SNdowOqGId4J1jwe8xqH/SDpbdUQEdhhuZ4hkWlWuEIqCqx1V0J
-            yzGuOY1PZp06TGPGlYcUsBIHfVQrlXlPVz4zCSbLq4UeIg+4Nzwo/GZzcWkPrl2T
-            hBI/pIWtb0en/ealePcn+YsliT0lfG83Iva90HqorHjkX4i9ro0PRzCzCwK5OAQ+
-            VJanLTLG0szg4IG8Ti0FXuqEU4firgC9P5FGiAXmDF4BlG3fx77dcqE7rUCcAlvK
-            eYU82uRSqoXrQQd9+E7A1gcRZ6VWPt6KolhiH4Gi+6MYrzBDAOkhDqUFVitCDm7r
-            AZvFLIzwAHoV/Y1G8E3KvKg3LUFLEYO10j5muzuvPG3635q7WeL0ifuAKSK+Lgv+
-            V49pR47WLzAH/2hheIydiZdr5WLfvzyp8kZjXkxda15s4sSmyfSV0XU7yIxxxor9
-            TjKYIc3EASjM+U1ERS/QiyYKx4yFoHT1LGNICoM6panfLj3p8xiZ15/JY/WOhnLU
-            aAEJAhD1smYbnJY9levzdHOvLBt9i4mJvv0prcjKlTkp50rSd3dTxnShITV1PeCY
-            Y65TQIJ+uh6Se0Q8UBjimsjnJBOxIc7FPtwbKIw1lY/UzaRhKWr4HswhAmXGehB6
-            e4yoLMaTXB5e
-            =m+sg
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.9.4

kubernetes/main/apps/database/mariadb/ks.yaml

@@ -1,87 +0,0 @@
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: mariadb-operator-crds
-  namespace: flux-system
-spec:
-  timeout: 5m
-  interval: 10m
-  path: ./kubernetes/main/apps/database/mariadb/crds
-  prune: true
-  # cannot specify a namespace since the crds kustomization also creates a helm-repository
-  # in the flux-system namespace.
-  #targetNamespace: database
-  sourceRef:
-    kind: GitRepository
-    name: home-cluster
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  postBuild:
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-settings
-      - kind: Secret
-        name: cluster-secrets
----
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: mariadb-operator
-  namespace: flux-system
-spec:
-  timeout: 5m
-  interval: 10m
-  path: ./kubernetes/main/apps/database/mariadb/operator
-  prune: true
-  targetNamespace: database
-  sourceRef:
-    kind: GitRepository
-    name: home-cluster
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  dependsOn:
-    - name: openebs
-    - name: openebs-sc
-    - name: mariadb-operator-crds
-  postBuild:
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-settings
-      - kind: Secret
-        name: cluster-secrets
----
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: mariadb-database
-  namespace: flux-system
-spec:
-  timeout: 5m
-  interval: 10m
-  path: ./kubernetes/main/apps/database/mariadb/database
-  prune: true
-  targetNamespace: database
-  sourceRef:
-    kind: GitRepository
-    name: home-cluster
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  dependsOn:
-    - name: openebs
-    - name: openebs-sc
-    - name: mariadb-operator
-  postBuild:
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-settings
-      - kind: Secret
-        name: cluster-secrets

kubernetes/main/apps/database/mariadb/operator/helm-release.yaml

@@ -1,34 +0,0 @@
----
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: mariadb-operator
-spec:
-  chart:
-    spec:
-      chart: mariadb-operator
-      version: 0.38.1
-      sourceRef:
-        kind: HelmRepository
-        name: mariadb-operator
-        namespace: flux-system
-  interval: 30m
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    cleanupOnFail: true
-    remediation:
-      strategy: rollback
-      retries: 3
-  dependsOn:
-    # - name: minio
-    #   namespace: database
-    - name: openebs
-      namespace: openebs-system
-    - name: mariadb-operator-crds
-      namespace: database
-  values:
-    metrics:
-      enabled: true

kubernetes/main/apps/database/mysql/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: mysql
-      version: 12.3.4
+      version: 12.2.2
       sourceRef:
         kind: HelmRepository
         name: bitnami-charts

kubernetes/main/apps/database/postgresql/app/helm-release.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: cloudnative-pg
-      version: 0.23.2
+      version: 0.23.0
       sourceRef:
         kind: HelmRepository
         name: cloudnative-pg

kubernetes/main/apps/database/postgresql/cluster/cluster16.yaml

@@ -7,7 +7,7 @@ metadata:
   namespace: database
 spec:
   instances: 3
-  imageName: ghcr.io/cloudnative-pg/postgresql:16.4-28
+  imageName: ghcr.io/tensorchord/cloudnative-pgvecto.rs:16.4 #ghcr.io/cloudnative-pg/postgresql:16.4-28
   primaryUpdateStrategy: unsupervised
   storage:
     size: 20Gi
@@ -16,9 +16,12 @@ spec:
     name: cloudnative-pg-secret
   enableSuperuserAccess: true
   postgresql:
+    shared_preload_libraries:
+      - "vectors.so"
     parameters:
-      max_connections: "600"
+      max_connections: "400"
       shared_buffers: 256MB
+    enableAlterSystem: true # must be set to true to enable pgvecto.rs
   nodeMaintenanceWindow:
     inProgress: false
     reusePVC: true
@@ -37,11 +40,11 @@ spec:
       wal:
         compression: bzip2
         maxParallel: 8
-      destinationPath: s3://cloudnative-pg/primary
+      destinationPath: s3://cloudnative-pg/
       endpointURL: http://minio.database.svc:9000
-      # Note: serverName version needs to be incremented
+      # Note: serverName version needs to be inclemented
       # when recovering from an existing cnpg cluster
-      serverName: &currentCluster postgres16-v3
+      serverName: &currentCluster postgres16-v2
       s3Credentials:
         accessKeyId:
           name: cloudnative-pg-secret
@@ -54,8 +57,7 @@ spec:
   # cluster when recovering from an existing cnpg cluster
   bootstrap:
     recovery:
-      # when this is incremented from v2, remove the externalCluster destinationPath
-      source: &previousCluster postgres16-v2
+      source: &previousCluster postgres16-v1
     # initdb:
     #   import:
     #     type: monolith
@@ -71,8 +73,6 @@ spec:
     - name: *previousCluster
       barmanObjectStore:
         <<: *barmanObjectStore
-        # this previous cluster was put in a different path
-        destinationPath: s3://cloudnative-pg
         serverName: *previousCluster
     # - name: old-cluster
     #   connectionParameters:

kubernetes/main/apps/database/postgresql/immich-cluster/cluster16.yaml

@@ -1,87 +0,0 @@
----
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/postgresql.cnpg.io/cluster_v1.json
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: postgres16-immich
-  namespace: database
-spec:
-  instances: 1
-  imageName: ghcr.io/tensorchord/cloudnative-pgvecto.rs:16.4
-  primaryUpdateStrategy: unsupervised
-  storage:
-    size: 10Gi
-    storageClass: openebs-zfs-mainpool
-  superuserSecret:
-    name: cnpg-immich
-  enableSuperuserAccess: true
-  postgresql:
-    shared_preload_libraries:
-      - "vectors.so"
-    parameters:
-      max_connections: "400"
-      shared_buffers: 256MB
-    enableAlterSystem: true # must be set to true to enable pgvecto.rs
-  nodeMaintenanceWindow:
-    inProgress: false
-    reusePVC: true
-  resources:
-    requests:
-      cpu: 500m
-    limits:
-      memory: 4Gi
-  monitoring:
-    enablePodMonitor: true
-  backup:
-    retentionPolicy: 30d
-    barmanObjectStore: &barmanObjectStore
-      data:
-        compression: bzip2
-      wal:
-        compression: bzip2
-        maxParallel: 4
-      destinationPath: s3://cloudnative-pg/immich
-      endpointURL: http://minio.database.svc:9000
-      # Note: serverName version needs to be incremented
-      # when recovering from an existing cnpg cluster
-      serverName: &currentCluster postgres16-immich-v1
-      s3Credentials:
-        accessKeyId:
-          name: cloudnative-pg-secret
-          key: minioAccessKey
-        secretAccessKey:
-          name: cloudnative-pg-secret
-          key: minioSecretKey
-
-  # Note: previousCluster needs to be set to the name of the previous
-  # cluster when recovering from an existing cnpg cluster
-  bootstrap:
-    recovery:
-      source: &previousCluster postgres16-v2
-    # initdb:
-    #   import:
-    #     type: monolith
-    #     databases:
-    #       - "*"
-    #     roles:
-    #       - "*"
-    #     source:
-    #       externalCluster: old-cluster
-
-  # Note: externalClusters is needed when recovering from an existing cnpg cluster
-  externalClusters:
-    - name: *previousCluster
-      barmanObjectStore:
-        <<: *barmanObjectStore
-        destinationPath: s3://cloudnative-pg
-        serverName: *previousCluster
-    # - name: old-cluster
-    #   connectionParameters:
-    #     # Use the correct IP or host name for the source database
-    #     host: postgresql.database.svc
-    #     user: postgres
-    #     dbname: postgres
-    #     #sslmode: require
-    #   password:
-    #     name: cloudnative-pg-secret
-    #     key: password

kubernetes/main/apps/database/postgresql/immich-cluster/kustomization.yaml

@@ -1,7 +0,0 @@
----
-# yaml-language-server: $schema=https://json.schemastore.org/kustomization
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ./cluster16.yaml
-- ./scheduledbackup.yaml

kubernetes/main/apps/database/postgresql/immich-cluster/scheduledbackup.yaml

@@ -1,13 +0,0 @@
----
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/postgresql.cnpg.io/scheduledbackup_v1.json
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: postgres-immich
-  namespace: database
-spec:
-  schedule: "@daily"
-  immediate: true
-  backupOwnerReference: self
-  cluster:
-    name: postgres16-immich

kubernetes/main/apps/database/postgresql/ks.yaml

@@ -54,34 +54,4 @@ spec:
       - kind: ConfigMap
         name: cluster-settings
       - kind: Secret
-        name: cluster-secrets
----
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: cnpg-cluster-immich
-  namespace: flux-system
-spec:
-  timeout: 5m
-  interval: 10m
-  path: ./kubernetes/main/apps/database/postgresql/immich-cluster
-  prune: true
-  targetNamespace: database
-  sourceRef:
-    kind: GitRepository
-    name: home-cluster
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  dependsOn:
-    - name: openebs
-    - name: openebs-sc
-    - name: cloudnative-pg
-  postBuild:
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-settings
-      - kind: Secret
-        name: cluster-secrets
+        name: cluster-secrets

kubernetes/main/apps/default/ganymede/app/helm-release.yaml

@@ -20,7 +20,7 @@ spec:
           ganymede:
             image:
               repository: ghcr.io/zibbp/ganymede
-              tag: 4.2.0
+              tag: 4.0.3
             envFrom:
               - secretRef:
                   name: ganymede-env

kubernetes/main/apps/default/kustomization.yaml

@@ -10,4 +10,3 @@ resources:
 - ./dendrite/ks.yaml
 - ./ganymede/ks.yaml
 - ./piwigo/ks.yaml
-- ./seafile/ks.yaml

kubernetes/main/apps/default/mealie/app/helm-release.yaml

@@ -30,7 +30,7 @@ spec:
           main:
             image:
               repository: ghcr.io/mealie-recipes/mealie
-              tag: v2.8.0
+              tag: v2.6.0
 
             env:
               ALLOW_SIGNUP: true

kubernetes/main/apps/default/piwigo/app/helm-release.yaml

@@ -30,7 +30,7 @@ spec:
           main:
             image:
               repository: lscr.io/linuxserver/piwigo
-              tag: 15.5.0
+              tag: 15.3.0
 
             env:
               PUID: 9000

kubernetes/main/apps/default/seafile/app/conf-env.sops.yaml

@@ -1,70 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: seafile-envfile
-stringData:
-    .env: ENC[AES256_GCM,data:DlsyKwPJ3qQkMFIq377k5M8jMkrF4KyL4BHV72xbSMneKzR4lMinoR9apmLGvlpiH/tOpDlHyAUo3SuLY3VTyPsImWFNv21hyFkp7dEPOTWfTTPUSSLxpKENHnhb4twrqSAEtf1HBRnGqLUHyXxxMXdiyz2mkhDe4COl5SYtSFQh0lCevMp1SJpOLik6WroHwzDi4fDOI9Y/jzoeleRKxP6G5vmAIvEz7LWsra/zPHJQY1LttgNmm7tMzxGR3oy5hRJejEGCC4NN3zEMLJdGGXxqtm2E4D7+lqJfF4Mi84hZucqWKQ6ijac73lm5WK98DZlVZbOMBb7wGu92PBLTajScgI03Z8/eUS0DWNTQ4/JTMvDGnolwum8wzX0u5IMnPjlfkkbthgusfX67ytEEn1RvZi60BwJ6RKtv4dkqraPUO6oX35rhARxtFTYM9l4fA6UxtWgm3W1r35IWSEUs95eC1thIrFKo71G7NfZmQf8fgfa9OFZI0SHlSCD4KQ6dcT6hbqfiy3t9s3hFEJLX1uKUW14DT8DinbvjbJqzr93KFrnvwiSfJZzdHiWI71/a75RYnZS3RWBwRwMd3cYAPhjwJRYQkHx2wfdJpyRMkcDnM9LwStyBIf0UsvKsEKqNR1YTn+EPcMM3WEVHvPPF2/k9aem6hJ1ZMEqf3adkTw==,iv:G//dKOuKzrxKGC9krPYKqT2nhrAUttzpJhCBzZ7yK08=,tag:KWxIrT5NxidQgljWSyUNMA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2025-03-15T18:50:51Z"
-    mac: ENC[AES256_GCM,data:q2zDRVHr77ped7wkLeyYGFopVzjQIVYKUZRRPLHy6aYOaUKr2hUe83RBqnucSBjJZ8jpywOJ6t31nvamCH9TW2h84EDOgbqXzS83Yi2dEi9GsZ0lX7WjGvsRSyDvqe942v3343kSwnTzkoOvlzOSDALWlOCrS2OeVpnqEceBfi4=,iv:obx6gO9YA/yWS9S3/h3Jb7WTBlCBZLmyofJjMVrdUMg=,tag:FRcg1z+F2/zm0OWTj8Pseg==,type:str]
-    pgp:
-        - created_at: "2025-03-15T18:50:51Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAyqlIeyoxYovAQ/8C3IXPbrRmDHKyUoQBoCNy12wx1MNl+eJGjg4Deul7PaN
-            GoqqCwKLcaTsL9nj0MnWSlQdyC1JzMQ/lcGav44ve3gRCTbjvyVLPhEUR1iW/lbs
-            KZpCQ9JWAYAGvebfZsPbVEWteu2fotjI8SCeHrMElcrEIB4qmZ4Hn9xInXGejfIp
-            r41KuKhnMzfmkMQMzOSByg9WXmnMMkS0onTSKckw+qe7JVffb5+BhTb0L7amzON9
-            OhGlM2i3CNJd0gcQtgeEadlIa2TOB94mroY5gf0KvxDUix5r0HMMChMrUKj09KNg
-            CiGFeqTv2gO2JKHsvZKQJ2jCjTeoS9WIdvaFGlvPd0O1cxBBWDhknhSRpUSln3Vp
-            rwx1jfwOqiZSB8jibfAi5POWa7kL3+nLfEFJ5/JoLqXcFZXgk8+UvD8nM++udMYh
-            KNArMAoBHawmcmrbF9Vgw6WU8LABzAWIFFjcJ61m0LRyxSLwP+q/CKh/UmX6rDD/
-            aQeFmTfPqlsqutUgYCsLiKVRvPGGBrx6duhLAUNsQtMf40Yc2rmKbI9xMakMk8S/
-            iV7tfq8W7LwfzV43zI/jr/K9u9c4lFc4OoEFtHWIZ3XmhYkxJW0sfaZDPU3hA7Uw
-            j3PidXHXKkxtsWEl86TSbpgSpcGaGSGPIXAwpF+bocr2zrufk8zPpBv0uF5LO++F
-            AgwDXjg0p2IN1X8BD/9K7j8dtCakHF9jS+N6EYPmCqvwMV+bXXl9kCN5qSxtuA8z
-            Cu2xSZZOMrMl2JY2xTesnHoywdo8qpX0itll2d59zixSNQzlPkLFgIiH8PQsjUrG
-            PYQgR4G1oOvvQHjCJWaY7uQx0qvmc2ZjaP97eaxlpBCCliE7pDJ/ZqHw3xATMzXb
-            7JloRQ/J4g65/0GWiLHeBgbbKyHL0GtSwc5GOAwXrurlAFN+NXTBOKdGTjZe+rh4
-            EO7IcblD5JQyCz3323gqvwK0e2ozN6sSLtL9j5Kt/zDVu03ZxAM/MhHhPzIm5Cax
-            nV7U5+4YQ2dAi53cQpJa3OgUt7gbRs3jyuEIUB9/qAcLKJGQ2I3HZhbIbiHpfwIu
-            BJVJt85KcEYvEEYkrWFoXovaI1l2SxeH45A2urXlCXLjXFo7xeTr/bnC1P1VXVfo
-            aBLEZEBoAX7HwjzMkrG+lEFN8YpSKsoj6CBUmPaL0PiTi2I2jI7O3OghREGnw3fZ
-            0oyVj8LDvMuY/c+zXQHOOFqR/qWnTdD9A7OZutq5ghh7sSZsyPLlxK4mviuydNYb
-            Q0MzR9PJYo5+qNjT0GFTCtbGD6WnQ5OLFeKu+YsGCj35rdZB5o5km1ADgjqAQI5B
-            +rfThl+gEo9tQjQbYKvgEAWQrr/AVvAIhbcwOFj1RBq5Ucgj393Lt4zafTdv/tRo
-            AQkCEPAUdVe2ikv7tERROiF11EyT1rkVw7x+J3TkXiDuKM25PipIOZ6MEtLVIgJk
-            Z4WCzVN15tMrImvgDRdn7zbsR4lTWyWyNWTuAetySjUCfB2KcqyvRUAkmsECQeW1
-            zPvaR4TASEo=
-            =eTqx
-            -----END PGP MESSAGE-----
-          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
-        - created_at: "2025-03-15T18:50:51Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VARAArcP1LgpzM6xSGN8qGr3NBuPHdvl/OUB9sVNahfwN4BAT
-            UxwgOL09g8MRdaa8PA7Vxv8zeJp4GR0hnLlb8KEl7czuM6/IfPsLgTyyXipl9ZXX
-            VaWZ/yO5q6b9/drI1HMhS+X2zzi6OoRuVpEjDXyYevP+P4Qv0M17l9ugdkLaPeeV
-            nteKMNTpqCah6zh1qcFQQt5ZTvFMviX0hxK3sQdbtKjgA/R36LWD5XO9GwQdZdAO
-            Ydun/4cDaKL0upAJDLwxBp5gHSgmhTUV/Xbg2OBegP7j5jyvfRCfNugeUScI4lqJ
-            MiHOLrxU4H9JKFvforh7re2fpkpSHJ1Qa3uEUyMXAj7KpiYDtD5Ecc/J1rip6xER
-            e6MdiCykkqNYLrRAh3c4h1rXAB5/LD3C60wNTBpMn4fLEdq5qq1Y0kiZHd6ueE4/
-            gb8h4oMn6idfRWvvGZ7+B/U2hXUm3vv3JmXxerRTLnQo4suNCck81wNiZRsyxwnB
-            9ahSfZaiqP4tW7AqpkQ3Wmi2GDwN1x/12tC+Ia13viC9QWLcNE2GNpeYTomudAyc
-            Q5OnSt0l8FE+sXQFXS/5iSNsxRrBi9MXtrb3Y0aMNbnG31BGsM33V1Y1pGYgM8jB
-            dOwTsxJYe3i/pDwisFzPkkZUfD9QvxFiRkWVE5k3+8U3os1P6uziYjs25+mM2AzU
-            aAEJAhAI8zjZW8pZ5SZIsgHYsmqaxY/crjJFVGBP0BPeaVK58JpcOZlwG8zcVqG1
-            7oo9DTMFhR4E1QnfT20hJxeBWy7raIA6DeY0WwbZ+kr3BEHipAUvVuEySqCeMORf
-            JJrqkEqlLjJc
-            =0PA/
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.9.4

kubernetes/main/apps/default/seafile/app/helm-release.yaml

@@ -1,66 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: seafile
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.7.1
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-  values:
-    controllers:
-      main:
-#        pod:
-#          securityContext:
-#            runAsNonRoot: true
-#            runAsUser: 10000
-#            runAsGroup: 10000
-#            fsGroup: 10000
-#            fsGroupChangePolicy: OnRootMismatch
-        containers:
-          main:
-            image:
-              repository: seafileltd/seafile-mc
-              tag: 12.0-latest
-            resources:
-              limits:
-                memory: 1Gi
-    service:
-      app:
-        controller: main
-        ports:
-          http:
-            port: 8000
-    ingress:
-      main:
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-        - host: seafile.${SECRET_NEW_DOMAIN}
-          paths:
-          - path: /
-            service:
-              identifier: app
-              port: http
-    persistence:
-      data:
-        type: persistentVolumeClaim
-        storageClass: openebs-zfs-mainpool
-        accessMode: ReadWriteOnce
-        size: 150G
-        globalMounts:
-        - path: /shared
-      config:
-        type: secret
-        name: seafile-envfile
-        globalMounts:
-          - path: /shared/seafile/conf/.env
-            readOnly: false
-            subPath: .env

kubernetes/main/apps/default/seafile/ks.yaml

@@ -1,29 +0,0 @@
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: seafile
-  namespace: flux-system
-spec:
-  timeout: 5m
-  interval: 10m
-  targetNamespace: default
-  path: ./kubernetes/main/apps/default/seafile/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-cluster
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  postBuild:
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-settings
-      - kind: Secret
-        name: cluster-secrets
-  dependsOn:
-    - name: openebs
-    - name: openebs-sc
-    - name: mariadb-database

kubernetes/main/apps/dev/concourse/app/initdb-job.yaml

@@ -1,34 +0,0 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: concourse-initdb
-spec:
-  template:
-    spec:
-      containers:
-      - name: initdb
-        image: ghcr.io/onedr0p/postgres-init:16
-        env:
-        - name: INIT_POSTGRES_DBNAME
-          value: concourse
-        - name: INIT_POSTGRES_HOST
-          value: postgres16-rw.database.svc
-        - name: INIT_POSTGRES_PORT
-          value: "5432"
-        - name: INIT_POSTGRES_USER
-          valueFrom:
-            secretKeyRef:
-              name: concourse-concourse
-              key: postgresql-user
-        - name: INIT_POSTGRES_PASS
-          valueFrom:
-            secretKeyRef:
-              name: concourse-concourse
-              key: postgresql-password
-        - name: INIT_POSTGRES_SUPER_PASS
-          valueFrom:
-            secretKeyRef:
-              name: concourse-postgres
-              key: postgresql-super-password
-      restartPolicy: Never
-  backoffLimit: 3

kubernetes/main/apps/dev/concourse/app/kustomization.yaml

@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- postgres-secret.sops.yaml
-- web-secrets.sops.yaml
-- worker-secrets.sops.yaml
-- secret-values.sops.yaml
-- initdb-job.yaml
-- helm-repository.yaml
-- helm-release.yaml

kubernetes/main/apps/dev/concourse/app/postgres-secret.sops.yaml

@@ -1,70 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: concourse-postgres
-stringData:
-    postgresql-super-password: ENC[AES256_GCM,data:PBIYbZfvFOyliH9HdoSAQQW/2/WRUjWS+J/62HMccSI=,iv:himergQn8gm7HMjkBxv7Ftl8tyAtf1djyKGyUWUUAf8=,tag:7R7hQ54xE/eqCJgiB4f8fA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2025-04-08T21:55:56Z"
-    mac: ENC[AES256_GCM,data:3a3jOyskiD53ECtgE4OqDOey5tCm46ecxFYpdIpgTi59F2LiH0shycf7Gq2byYLSrFGEBiJ+jw5GUEuvzyflLpT5BWYYhHvwhvFYFwMWOu/os6RBtEwG6tggvx/fIKHxNV9PmcrazV3y1qIRIr1JPh4MceHnQgj1QnsGc9vi6Hg=,iv:eeSdHHCQAUHyArprxQi/qOn2ZPNNsM/yUAGQDOFw4OQ=,tag:MQQW/s7LWZfUvUnzphyIdg==,type:str]
-    pgp:
-        - created_at: "2025-04-08T21:55:56Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAyqlIeyoxYovARAArvVLkWEeYzyCDYynNnwZ5bEEKl/i1Xhy19L3KgHCOLOa
-            gM/Tz+YulBPdzNmv0gwHBwHmAbFFgjDS1j3prQiW+LSsQDXVw041W9QrajvnwBCy
-            JuwI19am93dR9TfM4WFQs23pstKhwoXhaTuGGixveEmbOhzYSRaoQiBbt2tJGBU/
-            y5VerKB3+Dpnj+R675pZZykaxw4LbNLCKmAqv14nG6erR0/fTqaJWLjP6uaf0xaU
-            FFydPoLnSkO/Y+xtHXGTaMB13v2RD5ggpT/IHwT0ILu98xHHKHF5h7/3hde9sFML
-            mRAvnqUsnRK1B+IwNSD7kq9ZOEdAeCVSplKXqmu2aN4sQNGiiXzkHMRSGqFuZflS
-            l6grBZcdSEIwSU8FFL+Pi2/dQhiNE4l+K8Lcif+4iABzUUqPlxtHbFIgj4YaEcsC
-            NuBUhJdFaf/L5JleShc4lCivr9xv0pu0Khi3H2iMAM/joYH0bxWubbkN+XpqfFK1
-            +pYMR8pajcjq3HzPZcdt+6uxK7IuP1HSgv61dGDWinam9z5JLpO9ek5yqP+UidJl
-            WFPIcGAVv8qftWXZ+LJvvBc/j42e7twkwyX+KKc3aPy+Rn6Z865nXsekJ82j+tZV
-            wuKrht4gnlP9R5tfv4mDwgXlYfiPYnmdpTOnLP5Sp4KtcI7FKdWYXCVYT/YAErOF
-            AgwDXjg0p2IN1X8BEACDQ4zx0fcRtIAcNqQE4q1GiezuAwjbEUdBugILfJX93Csx
-            FkQR2K1tN2nleDVW4+76wqQyORwVMiHC4I8mUL62K/baPGTTyTi7+9WmHj/KycPl
-            K5z9gkTZrvvDGC9gkYCRRp137MOflS0lqGkUpbcT8rck6gOwUAj9Tkn79HHZ6H8e
-            w9N+F01Qi2CXvTI2Pt/nXS6WoGBHA1oEHD5yYKClsE1yyXtycKpcmVy0jCoyduqZ
-            1AnVb21jag2pw90k1BHovzjikULPXwY/suo9wBrO8CEnmwQpLaU4nTnUuTMUUAGu
-            7vrx6HnsxoMCmB9HrFNfPOTspAqtx3PJ4A9mtzLaQL+Z1B/6JeLl7oxoPGUU3Q5d
-            Fl810BVHKIHRehQ6ykT7DXRNw6jLpp0oLOAUSQmxBGGg6LvMfCQKDBnXr+reOvwP
-            m5gGTiqAU1oZdF/QX2GSoNsL+2CeNPdBVm3P+D+65bri7IoJ/PTRJEBNVsPIggD/
-            e+aliRGy5VxO4fBwUHdV9UvsY5Tfl1KtoRwKovba3YSg9BgGb/3o9lPEc5jtquNy
-            Oe0SlW6PnpGsC093tK4Ax5sYXNORfAutyqxU4mo/xA9MOvJA89Txf5/tUD2bEtir
-            om2BSBirXTaIJf/7Y4IQXeZQvI75VExUJXf/mVBIQetOxNDPLsEygmzSmIOiwNRo
-            AQkCEEVoUIbdmVMBXNeV+HI7vcOw72mjx8EqN9D2sqsCQW7mgBSJrW3UG6S/8FLd
-            vqh6uFNaubyw7uC7flvCrznIz8694o6dMOc+aYLEbzul2EDtPOSFFR9XifKNzSL4
-            lS0nNxrjcD8=
-            =BEL4
-            -----END PGP MESSAGE-----
-          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
-        - created_at: "2025-04-08T21:55:56Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VAQ//b03JFmJzYyWuVpwllkDCs5yK6QzfDhu26e+J4K1b+YV3
-            LtbmAB9fWvnE146Iq+ol4ldqAwQ57f/Xn02cnIsd3plGZJaPq8DhnkLZDR0Omzb6
-            /gEoglMxKh1yFDKWOl0F0mIfMOwQolnaLYcqbV/9/YLe+YmCnQ09ytgzK5RMaABa
-            tXaXJXI31meGAHGmVNTWEeHxqsux7LqsPjA1I1lulOkoFq7T6MH67VNMaxMGtPKI
-            XPLGQ5OeALwbcYCtl83aV7hVNXvRct/KOvar5bD3+FfdHJtBgsoP315u2DtR7Gx4
-            xOmIDQ9tPQOXZb1YrK5acnLOI0O6qaZO0fuo029vnJhBJ1ME4OxLljul+Cn0eSXb
-            1Dc6yBvxmssqxHK1344qClmRk5G/Ksz5WZNVDOL0K/crCnvArAnWPqrp05Q2NrG4
-            zjVIbtmulsUDiIlTU/scZiJGcLsYeaCS2Pf0fngEQoGcgnS9JpoQXwigD7kb/9AQ
-            dFsWj2w9pfqez1GXj+HQk3lDfhFrXBZTNYAtZlghzFF0l11AwtgoQ55P6i0L1oR+
-            lT0Arbp6/IXiQzQVK4mC+DcGVZD2OXwxedj57hTXmRvV2XzteJrvbEyRfVoMpa78
-            muIe+7K4huT1P5+WMYPhsA5eN7FzlsfnzeisIeIMNSCUZBbWnJuBKJey3vM0xmvU
-            aAEJAhApSXyPeubLxVDVYvnclrwbz5oHjCSlTs/gkl2ipH8UGd9bcoeMkPeTec/f
-            1D4nithdC9BqGWsok5WTjN/MCb1sIyJM6cxWRHYG4v8oyVfEnPJYUE2uiBGin0QI
-            ZJXuiOPJ7P0g
-            =Tm2z
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.9.4

kubernetes/main/apps/dev/concourse/app/secret-values.sops.yaml

@@ -1,70 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: concourse-secret-values
-stringData:
-    values.yaml: ENC[AES256_GCM,data:0V5bi1G3V/t5reql/ggVfQBSI9xzn424USo8E2bs8uEz1JTCS/MLEEKzFl/br14WDd+tEoFDdH+UjFFLWzhnU+WhoFJ8hddth6DJthVkuHDdXYL7PSYq5ObDWKH5oruExb7uxTMHU9XqmRb0Ti8nglLwIzAF,iv:cjt1V//Gj5/D9NLHmseFs16JwOAUQ2ZbOUguRII6RQk=,tag:2DIp7PqEMZHR+tHbRpjlWQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2025-04-08T21:57:08Z"
-    mac: ENC[AES256_GCM,data:wZOPhm6ELWdI7TtBxV6zsCXx8moZgAqr1riiGj8rYYsFke50qbdRdObYSqybWVo+vgvn3ND6e41oTvUI+Bc/9mPICZaHxctulJDtbP5Q/9xw2aWVIZ4gayficIuzfZWUopILkj1w3HNNnFN8KcYapDQ25JWfZWD9zQyhhDQJehQ=,iv:Qd6H6JbBhYxs7qKGnLYylWe8evukiyIY/80IYmpM+AE=,tag:3zp5VrBBs9bmyPM9VAzlDQ==,type:str]
-    pgp:
-        - created_at: "2025-04-08T21:57:08Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAyqlIeyoxYovARAAhMY5pcTRWb36FKkG3mAu26WQ7XLEun+BiNGY32qrMz3/
-            KIc7tMXGYpbaWNgoTDUZG1NN1znHjyoYKL+mw12hItM1q5SrDwDPiqUB8GOvOk+h
-            3eVmY8EjkDYOXdOiOrNuZMFKu4DHH7qoKDhNrTURO0iCLHwY+/wB79g3EoXXV6+6
-            9t12PgM8xAWbD2AL0ib0A5Hu9fT2bEDM+AUtHOdvQR0G0j8sH1mmqY9jxV7Q1abv
-            ruYHC6eouePya/MD97tR0X6co7Dcy6GhBJpV9rK/yhO5r93PLthksL7gWA12wt/r
-            6x71YksOC4zOkhL/lQGxo9fDr0COkOBrZdOd1yRyY8zcd4JvduzlLhAt/3bGhE2A
-            VgVJZFnJmCtenEmkDiMEgebN8tllTBQ8unuwP6YnTGsotknvNvvanYrnZjxENpI9
-            nd34bWl6NQuPiMpv8vRBx1o36L91WP+w34jilpSbIkR7A/brGr617nLvotkILVEE
-            vkhmyARkjhLBUh+i904EwwyO+++uoGTMesW+wX8g0tn8XK4St76dd1kmQ1TmsYck
-            MnoW8GGfq16Tw1QdBCdGatYX9ytrkGkreG2JfAf2XUqaIUII2X/nS8/iHEweMjkQ
-            kxTvtIaVOyUPRiPIsYZPD/qjIO0SehezuDcufTJGR9U04Kl6q+C1bDiAzUU5p8+F
-            AgwDXjg0p2IN1X8BEADBxljdS/PYJ7p4uuG70j6PEMHczARPTlJzveBICMFl6NBE
-            FSkK6RF9zvertnVTJ3hxjzwTmOUDBZenwHluAyvk1JO16hZm27xppPpbLyo1TzBV
-            TwtyiJkSyGyYjCMiZoLUnoHf97zBK+GGTy5oDdyR5NK3usPloGtoM3UvCfs79llk
-            3TdbsdyWqyWUOI3z0dfSl1r7h7HGUoYKvc2yJctSG3lZyOEWt1PfmLMlXYp0SY2K
-            m3bVFHXIgUjCTHgSM11ToMLmPXoUk/HTkgsKtfHMwmq/6FcVQlH/OoxpNFWB+RDz
-            9clZu/FJAFZtEtuKVGTyVvKmySnkIWUPAUVuZ4HXYynHc5xgGHoqYYq2lZwGle0n
-            b2RDvT483VG1/17dBbDV4qQwdwiZqmK09rJwDUALydnZ76yECGkUG9iXibf2Cp4T
-            OXdFngYoqo6TRxOOrrKJo18Sjmtkkwx7q8tRMpTA3HFrbwicW85DJ3uiBvgh5kyJ
-            2b4auoHbfXa+eZh1vAlw+jM7ZE2CyRN/tPqpSDo3FEiwVAO1oFhKHkAmHB8u3eKf
-            zh0JBbQD3JgyYkW/1eksArXcVLfLnUZPSXDrCqLBZgXVdqzzIIjV3qRoPPzV8/0/
-            J4brM2c/Kx9hd76ACCynKMIIuGDehYhufGZFJ5sqXphdyoqw9Zd3HZV51tVwyNRo
-            AQkCEHsxdRs9V/ALdeeT/MR39sRVQEMNY6oWQ18mM3TFKSuNfhTc6j/KfjxeA9W+
-            vIVWUeSIARtEbH4ei9V5QF8bdb5+Xh45dTXgn5u7qWPuFCzw24xyw+mHhZRQ62IE
-            G3OzUuiQJOo=
-            =lL+O
-            -----END PGP MESSAGE-----
-          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
-        - created_at: "2025-04-08T21:57:08Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VARAApKzwZgXvEsqYQsXdtmnWVQSLfzUZNFDCOK3KThjFRdI1
-            JBlKvzEo0BvR4huilBPVgS2c32vJ59MRwaCSTvEztxhXBvrB1fwaOcNbSh/xXhlw
-            CO1nA1Fyj2bv+J+AIJ+UvujLrN8ODmhH0ZEZEiBGP1MotWwTw0cOjdsH6gHPnKFw
-            xGafuUyurq5j4wh59+PHfsvRhgXJpMPTfXwU3fLzzywLtMi2YKTBgMcIpOmVc3JH
-            fQe+SRvb9+RDXfQE9BN9wpOfGmrz9QquLGdrYgp1tMOcruueYEscEg89Sm/LmB8h
-            GCOGgAlfCfB3CtWdwXOXytmlPm6z9Plx5B+QiE7thgqO0UqbfvEPQlQ5b5kosij2
-            FHSCU1S80RW600ncGH3Ju/p3YWH71nZVe51C+Ph5k8bhUD7X5v8R0OrJI2rJ9aGh
-            jmbiQHpgvyYQM10j97zYa0UitjBey6xExHf0/X91I629tB+6PqUBbP4irN+V6rvS
-            u/8+jpHUqSKLfm+80TajmxVQgTvAgXI8JWTBs4wYKE/t6RleSkijNwBvbTLejPPf
-            jjYKVrlWINdTAk7hK8y+uP5H8nsnOrTIrZKMcwUwxT6e8caYIEJk+QAMOV5fSAjx
-            CaCvsY0/q39/m9eM+3Py/mq5aOIK1IT/9q+inAzkBydlwB8MCkpH4JHUnijgzPTU
-            aAEJAhAhtmsZXyPeS6egyqmFuLRI8+sEBi4C3AtonvLFJxwmtcM+H40U8reVb5ZM
-            AqR1k5SddSvb4+XgIShX4O7d2PTdVZXymejRPpAwf3Mukt9H8GojBoEtPsEWPVV2
-            j1fuGXWp6K2Z
-            =Q3pu
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.9.4

kubernetes/main/apps/dev/concourse/app/web-secrets.sops.yaml

@@ -1,80 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: concourse-web
-stringData:
-    encryption-key: ENC[AES256_GCM,data:2SJEbPr9ZX0tJVrnzGcXlX1Eahyb9qpJnBly69tPAXQ=,iv:4B5pNcGjwoI6IdlUXSgZfRIpz7qBRn5wgmYR4fSjdH0=,tag:cJK+CnycJcvNI1zYoWbNFQ==,type:str]
-    client-id: ENC[AES256_GCM,data:b+xSUhxfawHrPo7p4tKY6+9dujrtySVh3eHb6U1+5iw=,iv:aZmfEdfX9ZzzseumlaHyyplrY9ga8OCCWAmxT13lv1c=,tag:lh2pqZnL/fav+TWuEgzxiw==,type:str]
-    client-secret: ENC[AES256_GCM,data:pzqoDQB7BOkEtwu963f8HMK9cFe4eJp4cPsxQejSuLI=,iv:qs7pJAY2xfc3mVbwoGDY/DeS9dHtbQZrdw+HetVQrGE=,tag:lnTECWrZT+HDS5sVzXTvQg==,type:str]
-    tsa-client-id: ENC[AES256_GCM,data:QQM9EmjNPp/XowxfL7q25Aws6zPD3AtTNXG7JI2uQzI=,iv:Z01NuBKjfGbjZ41W+Mh/NjWb/GgazXLNDjZfh7/hyL0=,tag:l3vOGVrALAoVBt5PqAa28w==,type:str]
-    tsa-client-secret: ENC[AES256_GCM,data:/s5+ZZ5Tp0n5yjOiBnVI6LPg+l2KdWyOqhaHqeSCZFI=,iv:8XL+9RrMq0xD8365PkKq73dXDfqnaMbEX8qzluhjso0=,tag:eB/ppycvIW+ykO7ri3fVvw==,type:str]
-    postgresql-user: ENC[AES256_GCM,data:niFQpRDJp0gF,iv:uK6K/Z2vjrpvhB0COEhZQoc5jmRi+98NKw0+i0xQAko=,tag:jnBW8ggFp0I0hD1D7Jvyvw==,type:str]
-    postgresql-password: ENC[AES256_GCM,data:jtNz9otL38E9H85I4nS6YcTkA3v84amyXxGWR06ZK4g=,iv:pVJJMPNiwQltdqljcs5+w3qrvcT6WjW1qtuH+blDwy4=,tag:V86Ex1n6ZVYscTG+OaQxFg==,type:str]
-    local-users: ENC[AES256_GCM,data:Xzzo/Xp4q1E7NIWYoZDqErhuDBwwUbRec+eIdRoinnQVvcinp2s3wjj7hUtwsLLNtvrViMgLLUWQglGFm0RzK/HH,iv:tLrPghhgunRLoneoY6733PpBcyedmy5AGO+pB83K6cs=,tag:AbbNrGmxUgoR12cQJVESfA==,type:str]
-    session-signing-key: ENC[AES256_GCM,data:kCcP/FszlyM9z8i2D0J62wD6dVbY8Imdu9q7lXkQxA20qANoN7qPAEYhh//pGJhyvpab4p7HezgviY4Mqp9iZpl8DXYwzSuIh0A3AjrdFceI5VYOVndzwolcN3zE4DsalWH1FVXK0vmEyH+a+A2TS/5ulmh+GpnApRPc+yonBO8P7IiSR2Cy3NuSs3FxR/g1XxC29Wkf79/cuNtq7p5s1y3zHdwui9UUxRD8R9ukON5ztq5NbuThepl6Mr79Y+jHkbAW4JGd0KC05qm8Ua26VmbUn+o9HrDlPp9mq9fNsszc8N+x1QVtg1IDQPNx/nguublHH9Mar0xFLpzqd1NOkbDhiQTwJQ2LIcQ5g7jI1K0UmsX7vklSx5z/zwVMhgr3HUFjSoLCW9kkA7iwmnPg7fVuo8JipN11Zq1+nT2j7wHWHjjFo0gT0znfgT5jsm4rjoN46ZawCn5+duwCLu2Dc7ai3nc7angqjUBHDu/sl0d8XngMWJWhUs/fkyZtlAntpVs5oz7IlEhye6IhmwSnuqsFCXqfF3fKCJ6X7XbDNr5+jc4D9HyrduEgOvhoMuhPpNVPzlFleR1VLNpBDv+XHKtobcofrmFmNJ0ag35VBmc+oT27lCMo9ew5j546ppccGQ+AR1n2co8psltiHtF6BM8ou8/oAeEyagM3g4rxX6JBsHQ+NI4RAX/1e1Kzeh0yvHlCKlvBVvdQ+1UNmcQKp4dTSs64G75EiCPBduF83bYsjH0R7t6mymeXAhrfkb8y5FLsLJcAqJgvzcHd42ca5PCuj5oZuioI0lJB5WAIJwAxOZenpTgQ/l0k9P5if7EPNcF9koO4JbIJSvhu75QrCNnHTaI2gFWgCLMX/X3P1dSpOw8iV+K8Vqm5xutxK1j6xTMOlzZNJPvp2OdIHS7GQJxKir4IuzOlgq2YWpYjQ0bj8GZp+DzzknxdCsQpW85LTIHZGi6cX6FJlrqmlllQXAiU0PA7dP1NHjw1Dixh/1FHOaoAt8E7ejy63bHzp5OUJzC6JQ/GIYE8ZiBFvpOGp5XLmLInL70BDexmrb5B8/AA6KzOjHH1vA3TdL97EvvO14sNRFDIWHO5usXa+XSVy+jQ+hor9yGjNJ9VthSQ/KDVSPITS67vIOHNLYWTaP754Satlgj5wSobmY/eaNoUGbKp8MZ8wSoa/P6GyGNYYOse9lNcqV4jLaYsbOy/ko/MZyGIDLLg7ZL+pUDmh6rZB/CWsF/vdjDkrgyNBM1YIBx/om8rb51iLXA5P3fModf8JIB/p7zdjBp45hWCQp+FYQogiC5u3ZyIs7lpalYLT1TKGW5W55Ofgxe7NkVal+m/KrvzpJgQf2pBHxy6/wDfH9R1u9R+/sYJ66ocFFMd8bJLjdxJHy+Awum7u95gwNLTKd8QVs07kYzLMFZo2rc2Cbu2SxnY0teg967gWmLB4mh0qsEcAZrTqXfl7/lA5Jwqzt8Tkg2uiyqPOcGnJ7y0ctnVvj14/WsKdlMnCh41IWVPPZ1u88m+O1OpHb89dOMFYm4wEZrQPO6ubbYmHCBZwWpoY0umjBaIM9Fq5YXiymqi01uLETvLEPc97e21y0/QHOMIYX5OpWuB4wd6kn0QNLhaW2HrvZ66of5qepHUAgVMYqN18QifXoRKQJgIGpoW5nN0JOdh3liH5YAGxXn8C6pJ6vYaBu01cEOMQ4EpMFxF0sQpRFQNm+g+++OnsTinfAWWs8/lnDNtjFYUGXkgxCzb16V8sPjQ7p2MwRu3+4nADIhhA5P8k/32rZqbXnzpXj/HvxXEh4vpjrxWJxewfdzbms0WqOKGf9xEA+emOYethGT75hY2XwAnKAZsJzstmySN7chUb4o07SkA+/zob8HQpc1cqKvgvdvlGOjEEy6KUR1TcZJ8TK6Z5e7Wgdcq9UuF3imKHo69Eo3JyuZKVCUJnYcXwRsXmYjAWwe8jhallCxlqxZzSgsIFBF2B0W3tQnh5n3J//ksEStYGyzvrEkaTOd+JIRX2HjdthBKm+1rivNUe4V9u/lKRhi3sTJdw/1xFExuu8RzCSS56DporVBCt6x88EZ5cKv2cacQZ3tcS3KROYdb7Odl/i1WcsPwYpJ4t7SY9j+0aEqqwCHGmByRwT030mLMLYqADZ1BZsRxJSlyd0fw0NJVNnwLJWUpAWGHo3N4ZSSXfAF8lXeg//GAOwOJ97Zk+zW9ntT4gSu0UIIn0eeBBNQKYAcXkqGkDmg/5wCaAVXwQudpv3adMtnP65Zf6ajulH+FUSwiaGAAXJ6EOIB7lm6x3odxTQa5NqPSLtc5s1Y2BsO0mRBEBpP11tC5gqOJQw5VH7jT4c4YoN2SnHOKYC9fq7gVZ7Qhe6jEaV4sAHKTcyhF3Uzf+xv2gj6um88+1cgzAhIYVskqIBrIrlEtxU/GkpcqvDU66WT6GaGDe0WmXUZZR2JwcevQ/LmszjoNENqcZExZ8LbML00i0UsVouqU0soFX1X8S2R+GaSiokNlln3tKsXZXXaQe2W7z5+5G/k+mWo+9CaEMdd0ZAmbar9dexzHZ/0esz8rnaZ/N2hfdcnHzTw8w1IlAQ9ihFygMVenFFjJ5gpbL4QkszOa6iTjXhSyy80+woHJz6DsKA7YH7bguPLYs6fKn97Jp4EjFGKn7n+WPSCzTXtXidKhSFpLLmuK0LgSBClauOZAbkwFZYZxNkVgbB+C08IACkpJCXC848+K1Bl5667m3nlqzpnuDW1ClrYvvT4b7CiE1du3i9dIg6671JWB8QS0IZYsT2B6drUZA6guI55a0Nhv2IK/I/0qyEDtO4mdUM4ypKvHKpxIZfjWNSOmnntPXfV/1XCMcGNzfrJNgamZIz3mTCga6UzR973CJuEElg+tO2obP8EApyk4HJbelPRVX7mmB8PGQ00WqGttbPOqSSkhDLcUqZyRNP2/ZoMctRA0RxtKy0Ree+vAMz1o2HBUVW2a36Xvocr4hmT1ht1yMmL4Vtx51bPE5O76iG2sxLpHmPfKbXzarQ2vmOHkF8kE8PhI7oY+0Z24SogNCTJrVrpcUQSOj6yBtKW/f1UZ/XoXLQthhFc/mgAfaoOL/nWJQpFvpQYognCxQpCzgTyMNlN9f56D6Vtvhrg8oNZFF0NeRxHOM2+YYc5uX3kaCwAykhWNj3SsQv5Ax1KyfQhAljsTD9GigrKay0nXG6Z/DoAOXvIMoPApxTXBcGgUrlKQGVA5/B6TA3/Yz39jNDT4v3vf7VSuBAFdCleyn4iAiQU914oYjFYhIcJUFRtP+rtIH0CynMvCAifpOh8eQupN/4xefwQdLJjgrj2TvPAa07uqZXmseKztpI5wkLO4tp/yrBauG3eYDecmYwztrucMtxu2aRzorCPUp+xmf1w6h00im9UrmkPCo2qIMIUMriz/Wma+mhCsKjYL8vxVAu+2/qfy/IrpI6ou8khOl2tUgKltjZgKFxShuA9lbtAEaX0McvH5rgq3bELrW6CUnrh3NsvcsRPUJiLYvFKVfR14BrfoStsT12wGzG5RJbs9426ZxBaAPN8DPUQkMy6gcyyq3qFNxvk+EU4aYjdTzyGWlat+FDfY1evxsNu3Wl8C0uR5JNy5JxL6vdLANU7kahWvV/G7Do6pCOWzbXkcpTrAGF2zCvow5GspAc2HqdITli6hDRv0I6I00LCNIkt5j2Y+zg3mUZU/o5EggzEhnmU2brrputxmp1LFl5FYcGnfOoDixGXbWQr5i5wnlCI9GAMG8rzKkywnEfOcFpR0nzxVV2fgW9DgpBrldYTIiEerb/yxwnJ8sGZBmQQxaQxqXWYO48v5vSVu2wLtJ8rIbyNtcr3wJT++zvAq7yXXpIbP4Pq10XZPqnbiOYNoL2IfkUnXMrgCUMar/2W2JjVRfaWTyoXUjU+7sKThUTkCHBqlb8b0ibbR760f0bJNOhWHfRYacnBE1OjD2fyND6AGEvFd6jNHNYEYXdVGrEfALfet6JlPqkY6vPUlGY7umfvYezIDbB81FHJHnO082kNnjqQQEwbPz9hA6arxAxAsF2jM+E+7sHbE5GxeTabuI0JUzwdiTF5RSsF338PbdcrAZ4VNh3BMo9325rLyvJ7DcQhTP3iiVlM0QplEb3ZyYcvptYSOLBB2PtrMXuK9/fqyAPuT1s0r941nGYWToBVZaTcFamCWOKKsEbji0c94zj0LDoVRj/0BtMJ0usx2jEnpBC1wsZ5Vo1QaqP/xwyjlPRXTMJ5ry/KPZK/gMRkRmYn1i9cixbCcYyo0l/Z7kudmF9GBqZq/gL3eYSPyzU1gB9O1IA==,iv:2IeSb7snjsCcceiGCgsPSu253Nau+GFnxsMjYZS7pIc=,tag:nMNVwerN0HzM7VzOV7XaYQ==,type:str]
-    host-key: ENC[AES256_GCM,data:3U6uRvnQ6J6gmz3aNxFW9X+NSUhDR22LiLAEi+eaIwgi4BqFGtBhaEtB04FjFYXJ+fG3NlR4G+JfvPM/vC4cSn+EhHt+5tdVjgaQVIT1og9keofUaVXUmtjS5pXdt817VLx065Vh993tuh0yZGkUF4hKilVGsCrr05SEFc6c8tPmFf1GFmWnjqngC5yN+H/WsosqWQ/sz0uK8V3SIHfUYM9AhCD0TXOGi2lV0T8beMmThQGf7Lj6Unv1vgTGyMMkorDXYhKgKhQbrwcWeQARzokelublybbe6nJKRjmlvJKNOghFI5x8rk+ddT/bUVSVBFOpC0WWY94ErBekcA7o6LUlnFEJZhH3EkSwRLWBIt5zMaDzKn+NzaKw0ur+6BUicOClS0uwoiwtgwRU0tIYaQqG2JKN7gQH5FOQqK2pFEYz9iTS/JXQyTKwof6UjeKtTuqyjuz3YiSsbT65KvXBEB8ktMlSu4PXU3IdLEwlnHyDJkl8+d5RBq2XC6buS22X5drP9t47+bwMa+BVQ7sjLKUkYrfv/O/nSYTBWXWQfgUI9EFCMEH6NEAIrR7arlKV9YOWjim/K684T8giQxQ3iCoKzqnMt5AW2bY63wR3BjhJqdjUubMHo7yTfj7yU/cdYD8r7VnaGJiYIkhWgk7k8HBbDDFsEnpALnaDcdZSSqnJnm3YMWT4aSkEupFglXVoHuUkOhSP8JCSqH74I7yjmigXaWK6PWr6UxcWP80QN8hdqhoVFJ2C0FitmicXNppozPaekbxSClFD06gO9YwnaK56ZBPMV6f9dmuo+pF4aQu/QNyYSlHrY0cmQfmTNnVEgvZpIvy9UzSC0VAsrXpb6n8z8ImCHtEzb4BODLhyyCBiWjLWGw5wNjx5ifCGKl7BVQr823jR6fi1eHPSf7zFMciYBnEuGOyZ//MdRsF7PJVqXt66R7In4eZMb0RtNiUda8HVwUHlyYC4F07xfjwioUoOlJ9q6oe+hlGT25K7blJdDH3bkeyY5Z0vcaNt4kiBfaW2TEe1v5LYZXVZV5kfJIEgZhBO9HNdZcGp9l4kzTejsbcxDBKcwMTbaqoms9/SGaaUQrHqXK/pun2v2BWdT4NyCMj39ZdLgMteuMA6Gb1pHUX2dOFpx/BVjQjMvwodiEmmU+U0xdW0uq+fZTYWLvdhkVVXoyGULmruNylIencoHuYerO9C07+sRs++qQwYPcOCzUT9jv7xVoQdq+oaQA9zTBdQSTOlTYTsbkHrGULeU+/JHqVO9RfgLImtA3bzDgVH6/AJLpI4ZTfLGi6iVvZ/RZfMRxQ6f34Y7cSfCoRWPrVpQvoIXrWNMol65J8992Akxm9luonlwJQafIUo1VL4kFFJJyu/NN7NoY+fJM0WqZkDiBufGdml7QbROT6EfVtgPn07+0h6L9ufQoNck9XFWUEQ8zJX+BZy5nyOafU+C4kuT0UJc8HASGEeqIso5f5wu1BcJFl9UJX86/ealW7QDTXKlHESMLnm63/4Qmq5IeFKaqyCbqOY1j2odWOa02PGgJonMOZ/+EtsCO4TxOJ2lPFf8kL0OHZswMFMjk0iuXPOzLrlvPhgrWWqOY0XaVhqtGlRmQOAf8wCTAqxplJz9ZBVgMWjcz/klWrSq98z1dpKY4DsfJyQFE67Hqk/3b3zCDaw2dn0ct7fd7Tb32eR+8NrnMZQaCfPwr86wkNYoxjKebe5aOK5kZ5b14pWLoIRtnGNQLVldbuOo6M06AOisQp1fwsjz53PutZb+BVIGZ4vumKgZJW4vJ1W5zXBnN6vBE9scf9kwzgqqANslXTbwawIsLbyODn8cxa/RVoJ9DEZ7FyyHqweFDMhxNj//Gfr9AarOZ0rjRP/6YZhlntfo+fGhFdZZZ62KfdhgqEcbH3+pgCIXZlaw0QKjXkUPBhJO7kqC2joB8bqsF+jsuE3zZ2smhwDjQtqO/en+G9RFw6pXjw/GBYzKsNPvrVAx1XAEhiShcqD0YdeT/zZ9GhDdA7HVxbQNxiv+V5N9BV42V2VZaB2oeJNWvPWqVyfjVJpboAeyfzmEfaycNDrQ1NyrFcAS6xgjQCeXlWqWiQ86AqL6nNc/9Q7/g7YsjdE43iGAQgrcxDhgWu2iUoQeR5PD1hyYxxHS7U3thS47132gWrtnQTR8VVALmtO9WfJWkUdgpkny46BwraWtdHJprXjV0L3MSt5nDvwRyQxxAdnwqx5TITnw/PMFiW7mhjUeOl3ISmWP/Lx08qB414bdJ7HxY2n+5v5ClZdNRXJGv7FZbPQbOdziTB4615jqJdkFFW51JQpQ2KEcuhQk/SrLU6PhVkGLsUOANefcSXEIjDBucl6UVqPTyxmp7Fc/wDiNWWkPH6vm3yjMOJdjQYVMUg0m1b7IfQLfbGQQNY1IaYFwkNauSvVgz/ocnON62UwqoZUF7fikZ6PxYI6/98xHmkQoXP+B8Ag6D6QakHqR0h7O6+8dWZb02E985b4UkVX4LnMIB693OUT6uq92q2p7i+Z+uDhSvjNLYTkciH1TlE9ZQwsymdq/5ofMs3zwOfgTt372++n0J5e9BDsDm2Kp4RJhYQNdKgJwwLf7KsEZbWNfWDxZdSVON6g73pffV/DYe4GkAU/jwGMQh9mktDwvxnV7VeQD+1hv3Yh2vtc1GdcXZVD0CVP+qcJS1CEI4PnTrNrhgvn8vhyGsTeOOtehs1ei5Ng4JqRjj3AEHqDu/3yP5nAacILdjknrs8Kih3Rbc6rsUzLd1kUpv+m3azs9B5AQ6GRrPrkNen/N8gInMRaHfVl/KmaePf2XWt+bU/F90DFNwR6booAkZLdhbhSdpcU2DDt/2p7VIsBQ0EDjtvdmGSl1OMbBKQh22cOcK/E+7AU/W7C+gbpicOddvNqKEUGvCuzCUHv4t6VqmUKdP/kOb2Nuhh7dyaoFGIvWbA4O4U6qk4S7KYr3X+v8Jrhq47a1rfOc9YRGg1xGzUNXYHeTDW9GOnqQzm8m9qL5U6Lec18/svskwbVoQakYuDwg4TiZPbwPdoScM0vmf43EiQL/7w9S/GcctvxGMVHh7kC6XZkqXPs8AYfAI+yu+NmGWEFB/jP0NsJj6IA+0bqjBNflhazM0f/yG3uzPHjdw1R+SEnYnPN0ZZ7/6dpzMAEFL5kYbsm/YCliij+T/LPI86XStmu0vNffoVkOiKMfiKNWqKOtEfGAfopu8BY1v43TP45rqWH+bKK0ixDyefmjIb1GaWdhPRa09Aig9zGmqB9NCLuU+hLWK2i0LOYDwlGVJbBIOp8VVwxnAwGaQoHS9d7eRQ13Hui8eC71tNA5sYgVJpNRvKDN0vZJ6OXouLXC9XHiiCE4MjQyyWkz2XxUg7xcV8VHnUpc2uX/WxAWCLOsjgGJn3hGZgRDx9q8/8MKkcTl2woYXeUGLPBHAh5Ou6DFwhBQzRt8HA4Q5KppR2VE7hI4BIeGnxGTSUS8J0dBe8kgQWKwW+DdYcdDTC6D7/rYeDHe54Y6ZlqOtvcguoaDwrfzASwEMPKfCVYHVpS7MXwzSWhbuMq+lbj2O8XzVUF2c1xDf65FtLUD+0UjNjMprJGFrlHincoyUl/EeVb+8SpMSFlYybg9EpWcFnDstxmeJi+qDs7jKeQv0EMnVj6Dk/GJIcJ2apf7AyHfmfbc38GJnXo3HpkTicNx4DvdqplQUsB4DrCiXd2Dn6bi1jtpjI7ivRB1dmEZsNi2IfsbYVYtFd5Bnhsva1FZO5ga834AML3zkcI4Yx7UpYMShr1KxLt8owflWbeVhpnxefR25BwioD6dGsEORgOt8JY7n3D0OQHGDwJP4j7R2W2YA6FefczCsuHOw/PaOB28Gyn1K3haaGM1sjY3MFo3br9wz5tOhbEi7Np7xlC/8by2p1WdhUxgFHnWXIbfcscoRhjgIj3Ym8XC8aGB7oClXzVCXUpf0lCgt1fwOzKLNInqgnsqwgh884wNe7ChnhPfdOE8aX+LV8A0sH3RVA90dTNOK6wfS2pNTByfyyCUxjaRTU6W2Yi5Vr6GqFPfoTCyb/D8Wrp9tZAWrh3NoWUnKXo45aFi1L9kYj/XN+lS8wgY7hRcCQ/21MkrS3880weNmcRV9uV8bFNe7O2BLwUVGr/32tGreiNMEdgQN39Qd6AqYxZ7OLa0Oyz86TIY/nnL0dg7meiFEYqB3WalfT7Tg0M2BsqOjfMG6FtjKX01PocOiXFsAGsV1UWwWI9zdgZQJLu2vNccspl5sxBujsBc6ESv9eBITRTSBsjlqYc5uwk43z0LX9ZOPJEIzPEdSiZm2qPT1SnmA==,iv:5QBYsLmvyIxTjw2kb4+emqPyifQuHvRSehOQfO/Mj80=,tag:3EXyTav5LxxZ9piSGUKWzQ==,type:str]
-    worker-key-pub: ENC[AES256_GCM,data:E6p6JlDfxY2ylbZ19+ZfGKCCVljzsf07hPQMtiptLnTbxLkI9m7su8cpkg+3B3BG1rJvL0tOFcExRQXEX3ygJBSw7Ks3xbo0fV9U3hUcOwhrA1Qsu+cMFvuUUTm4GJBP2AkDmyOuRPPnUP2q2c48rVQ4on+AuvgKBBLoi5xIijRGMB0iwpS+aHP+0AyLy75CMv86h7XI2rk4t2D5QChrbMwC1oPLTrRqVuWcqlODYyoCJYXJvzRvOpLZWoq3oQWSiRS7mdrD5pxhwkvDWW9wX9ZL9XC4vMq5T8XdNpTCmb8/JRa0AZ5wGExAurnEnHhXnUjcktcIGOgsyLam8+23vGHNPJ9a0e72TH7Fo+W3y613UkXy+T4jCDXz2PwEjvlEqjhxhuDf1W2GIdoN3yPj5G9n6C9G6gEfmeV3WvrQF+LDfpstbM2KCEYg+GIQGyP6N+xxs6NuZQumdLn4pX9CUnPk4kM9brrvGKUn+68VGDzI1Okeuf9FYusi1qTGVE/WJL2ecbMIjjs5CgfT3Mq3dKdRZuEO5UqvV4wFrfKBz5+fnOJYBQQrzhfhgOhdp6KCUuIrOz62U8CZxu+4SfrpEBInoWsqfzMfzDiPjeIcujrJbWRYNfOZt3x5S7QcpQP1mj2b+h3AWepkPw5WKUqP2/RKOaUIxY/RRo6oz7q2K5yq3ZY9xpEjCdIzHGYqORIXnl9Ejf8AStNAGaGTh2L7AAbv7BFu3oM1ExU9z9r11bP+ZLgtccVAD11lPmOPV3KHQsvV6zoRgZuyaI9jWJ4pFnkMV9nwxq8O/602OTa4/xOvL0wvrQGicJw/dn3AE7Mdx9JiDy3/VwjZGKrkjJ571aVxxcmrJratV3jS733CWE3595ePaV6VEAZt44xuQNi+AIl9se3uyPDQfA86LvImWJEIfkqoHC33KuBgPCm9MwvTlyh+doTYDtjzKZQM7/NrOBYqnHs=,iv:7QkrHJnj5n441/K/58+p5oSi17rSWlWzEGKRUqKXySg=,tag:dSqEQWc9/F9NDJ4CPhckSg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2025-04-08T21:57:08Z"
-    mac: ENC[AES256_GCM,data:XH/nDUr7Dd2c/Z46t4mtLOUjzNHLCc++CPHRYHCJFp+jHWpRB9/cnkX5TbNUWaSM1xhVu7uNbnmdkYV+we1TmktX3LFoWPEA+IYzIStsq7YAyVK3eFg9o626hXpjXsp7bGsjesevwyfmjBpzub7o2j41AULJFPVOKWrlSHM6UXs=,iv:GbdDSduaoU3D/Ka92VRRvqV5vcjdwaPS6ObHUgPG6IM=,tag:NDTlPkz2JPwoerw2R2BuiA==,type:str]
-    pgp:
-        - created_at: "2025-04-08T21:57:08Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAyqlIeyoxYovARAAnyaIJF7IWVWUmkAV7MfnqSamXdtGPLicvgmK4xPi5QCy
-            i1o2KmAcdRN5DZwLz87A71SM5iUwnUTerQW/Lae4TcqYYwJUmJxBhaRUoBgUUD8t
-            x12xD5RM55D04k2oVXFxQQhqFxTb93sxvIE0He5efTwp2ExD7G9HYhyR7Zr/DKpi
-            CZmgcQylktrU6uESaSSIgHLRmT+ScO0H/LjgBKZqu4jiefYBHHaLXen8ZPRt3eld
-            dlV3gnIdmDXZvMLSfTY5tIKgKXaGANadaS0omRoYTRp1DbMkpIrF6SZlGgz7lLCi
-            CgKOYxNcSw85j/bF+/d8UkJaEEXql23r1QC3AHrgOsjfV4j1m0TGqEXE0PCizpwK
-            YhAk9D5d1TdndgBCvi7MexqWVP+ZO4yzb/z/XPpi26bRW9Lfp585Eeb0AAPoIBLF
-            kdEUxRAnayPmjAtAvi07HsfocSuFDRDWYsmWjI/oQEtm5l46KZnc6EHXVSSCjA5V
-            P5GBbOPg6O7DWrC3U0Vk+s1Mtt9UuczRYhSXKIlBbEEPXxMCjkhqAH/XaG0YaqTn
-            60Zvwj/4f6u6VdJkUKW22nyVZgdEA4jW999JI8BACOl3VrsTVCWYkqycxpuQu5+v
-            K2U0gpjbtnqMtktaSD3+YgJW9z3F60L7IkNY4BpSv85VM/Fn06t4JAC83ZDuBVeF
-            AgwDXjg0p2IN1X8BEADlOHa7GS3Uo7p7hKSvB9EEFb/J4jBdb4zehyoI682fbtDP
-            k/Df9fKEb3YHipdgDa1ZZjqETVsm/Mx5HG5onomcgn+4qbBTPgjDVJDSDm3DPsmt
-            P4IuCq3gSHhVgNLmSXxFeg0upx/RlPqFYYX4OVbmZh6vqMTof1nsS5HFhOliKq5B
-            Voxx8OPAdI+yajH0kTEG2OmyV1RMoBM9+T4SXWONlWy6SvWfEbVCdzFv5+TIJv5j
-            hUh+Xi0Aqugn6C0tyipheb/DGe4EtxPfb+wID05GYeFXv+MPQ23VKgSWptnUnLIc
-            J00cCN4qNtW+zSu8jpG7t41AqN3prk719s4a5BSZuAKIDJnsXYJGVenCek5Ydr9r
-            AQ4IPpycaqWgAJUgBkLFGt5dY9lzqPt/RkLLsyDGWqBm+k4MkyjErx0WF0sl87DH
-            v5159wclK8cidVxepuA9/y45/NFIoET2GC3unBGufkhUGOOEtWhvKbIrPxFQyCpm
-            AtWx8LvIzbBObaUDY3bk1MihaedGx+vcaVkQ+qrHuua9fN4HVfjNchaUQh/VxOfu
-            oCuwjhCYB5uhEkRQsx9BJNXbm636PaqoP9Nwg3leaPaQNMIQLZw3JJDeAnoNM+f1
-            75SCum+Hg7q3G3Fqdan/vJQXChelUIxMX0zQrVwyfV+FKmYSdKgoyKvcY+skK9Rm
-            AQkCEFmkCD4m50us9/XxgT3ejV5ZN6XPC4gMBGfq78iw3ZPlYn7N6v5jIg7duuE4
-            f/Wgv1/HEZOCuxd1IpCgiJbM0R7U6POoHmmdBnYhKVIVXL3pEL+e7iTE5vIjnntv
-            DbA7zmUM
-            =sCJc
-            -----END PGP MESSAGE-----
-          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
-        - created_at: "2025-04-08T21:57:08Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VARAAuhXWnLvetsGV2F5e3deRQmwoO0DfT1zU1zp4ZSiG7lZb
-            eWZ8LzyQnTdS7BHuZau3fxgn4LsFtjzLOaJpqUrvfRyDUcFNuO1jFtuZ2+cDSIhx
-            s1Zuit3uhNDJ90GibmhDFTwGqXzqPZU3IuSpajbbrKqmNaAX6KZ5tIpKrmCAYUWq
-            WHBa10JypucFJCoPTdUxmu4aZpwpgOOTWLzG3g1kxWHmXsjW25OhP/6R7icUREoc
-            755Wyxd8m7Y1ywGllL5GQB3ZFPuqWjW6vJxcU6It/sphALvXNbQNu/c+7g2yI+ne
-            G+Dls3tCpw+n8tdyLKKf+6DPw5eQWQSyalJqi3iHiqmoRmSaywhTlmCVsn3lCaZK
-            Z2cKJ0E/ZcLRxtz/MCxCRae2QL0Rzzk0ePtnwpeySr+/0SSGQotDpe7jrbCTl1zh
-            qBHeJvy0cZhY5VC8RffXLsQ21XnxpVb18aSPb9a5+MOICTzv63UUdzJcNOVNofUw
-            2eJ3m1HnQuD04/Abkl6bKLe+kjGI9NVawHH2ZKhvZbM3Ra8kgDOAg2jLtIEDxiMZ
-            JLRTQAbSPtZVi00T9a91RFeWsFlSW9h4GwiXCkU4YwI6NTJDuOefP4mN8K/S4Pfx
-            tbE5MpTFYpOmr123AIVzGrh0/SVraofLSLboGIhkwmAEZlgHlWYHok5yPv+L//bU
-            ZgEJAhDGHxZL3G12JJX1jmIDlwpFTcNwmk8UrUSpC6V7botWhtEb06a2LEzIAP4R
-            bagUxRESCQXUMO9fHtKk8PK0neOJD0TNZpH3GI7AyRXmGA2Fz6nFOyAKbSgN+KhQ
-            PfpTQJXsBg==
-            =yeNG
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.9.4

kubernetes/main/apps/dev/concourse/app/worker-secrets.sops.yaml

@@ -1,72 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: concourse-worker
-stringData:
-    host-key-pub: ENC[AES256_GCM,data:xby7HETGfhgYY/32CDvKMTVtHMdzL00cEApASd8wViwsqLstciTal3Wzp0/+lldQfR5Xu7K35DJnrYjL4uRh5gppmRgAPOUKkNAUlQoO3vr6duRGYOOdicfsBdHa22yyOOdg8SvjNdStlLQ+gr/5xsAtiUaL/qXeP+7A3GTK2Hus9zOUTv8Uj6DkcHGh8YT1eZLO9b7/UyBUKtm21QnYxIbLDAY4/7RCCr2mc40/WTSXhq0Fe1wBVbkoPi/vbftkERDo+BEgrZv2vgWSgZAi3QX5HYZEdvU1YkCj/c6QPn/jgYYi/IwyebU1Z03OY0YATVxqlwECJYsHmgJn6s62UMX9wssJHbvAzjXLfDyHvXsaA4kB9n3nsH70Z55z8o28b9RGgbx+NwDoFJC5cKFpnXyvt0GduC3Jjk5Yizvn3Fbc4GVRS10TLxkyffyDLwcAbXkDtwjgY8Mm/O5VRa+5LECpxu2Fh92wMg/LalTqQoZNufkqSWVePImDHbYXgrZHWMYuTyzQSc9kkNbKWs+8yIYIogS1/7tTz6n3M+0dg9FS23P0wi9wVctEMCvkqYemSn7dGOvipU+Sa1YIijtOCnakHUo5TN76LLAojJjyd8yGX8NlisQlmF5WaBdBPJ4bfbcWR4EPA9ysWNg3aoHO8Zuye8fwBI7bRDthR1dJDUnKUy/R2n2eQA6Releb6eTZoQRJSH2TConYM6V3ANCGo8McZISZQr+PuESC3NLptSECSI1d/RKnW3P0iC9hxKmpCutWjB6YPb+sjcP1ui6DQq1tGjLQapFYhXlTeod7FCtU/Vb0YncDxpxMFUonYPNEPkUPfHqGeSbYHlXDPYg74p8WTPhLLiwFK4Ob7OGAjln8qlRokMWfzKALMQZ+pc7kVLcOdYPOzSlEPlPC0QfpPoy8Nu0Yid54IeSTmCK/9DOWzaIRAaZ18VjcV41tHVjX4mAoBw==,iv:mOmzjQ6JwX+dLQL3gjsJ/lmXV60xMjM3hl3UrgjMlz0=,tag:cST8gvbo8sQQA/b+5+pXnA==,type:str]
-    worker-key-pub: ENC[AES256_GCM,data:UeWikcZdXF/cY0+GmjO8R/BY1mE8D/yKzvlWJhtefruZyC718ihTefKpErV42UT3CllD9S5AZcNIxkmrzZzSkaBo72T98mzUlmKf82/Zd88jkC1I9HIYu2hAN3KQvzo4WQVkY2VY5CjvV8WS9LNS7Ly9fDKGmR5ECOjItD9Z3hmB27/a7B5tDBS/ARaECkwA5E0HFr+bDvXkKY7MTryE1t//qFsnVsrv9q4D8fKjyzlWtp8W76N0HrzXgDlSVFQEwu7AKoppiNMrc2iAsjfjb3LLkfnD/C6XvsKBXZYA4QcYNtWwSwiGJ9zCP8Z35qz61OlGJMxex2/BzDGqsbK+KxVtT6Wude+B37HA4FErsuZtSDefdBcVmu4krify/GEF5ouMAbLQDQpl8OefeCyHvTYFLbZeAs/nmzY3+aOvWmHHsmgr8Bm4lgF5TJD5de6Vztrl5OJt08j4ko4bGaftmkjx8tN1DAFI639RlV6crK11DMUvBEM0+jQiLUs3KMLnb6vMJ/Deb4rF3bBL8AeB8dTEGAEtb7l+S06Xz/fn2KHYS8gryQs37bsXAWiDUCKSCGJaigRH+0pIXLPkn+MEzjqRsxcZ8UA96G5pGj5zXr0iH+1w4pgYujVb8Fm9l8KVtAMJzKou8F/6KgSasZf099z29N9G5cn04c7ZYwKEj7TWxmOfbTr1hX3poJdPp87htU44eXvaTiLcgMqhdO0y8lHNL4ByP0vjWA/Ru4bb1kxumyCi8V3nI0650VGzylQ+OLmJ9+YOSpHjBDA9Wt2fJUZYLcebVGnGqNj1wZD5xqcAzGsbC/RfBr3/JVBg2OHdbiAf1p9kgP6IHViNHNTNL9yD+TzXOg03zaH22f+dPmkE6ouiBAm3+ANh2/8AsS/kfN4AmJWEqiLgCzfUS6Ijf37xnb+UQYX24GyXwRTd7zWplndHZs6NSBCcoXEt6SGxvkzp1Q==,iv:TvcAESGxU+YZTn598PnsIsbj2iCikboIFEeeWnqGCOo=,tag:ObH4LMWMs5JfRP7n10eDHw==,type:str]
-    worker-key: ENC[AES256_GCM,data:OWGxJTF0pEoYLjSGnAdxn/UNfsp7qZCbo/034YAVyF5Fmp4gCIM0ZYD4H4FG5rgLd68hsRooNUy2WYLmjbPmxbLhydvLChEoP1PniyOJjepGIllsa/4jBCmtHt28Y5ZVvJJ8YhgaJWpBsmQGCzjG/y/2v3cPHmcjOEFaQG6o6cEIGIl2i3GmjqlQz+BaeckRktDN6rkgLCa174X8qHhtFx4M86x7lVLp54o8Vu6Ftt45odFq4PCPnhtts5wC31Fnno5UwL6MfZucMlsabVuFmn3HMbEdh5tJH7szYNl8IntlUi+gr+hAhM0YEWH56R0LrVa0ofK28HUe06ToKdhEBA9pXGEkJY4gOUecJuKP/l/ECTs6GrfOmFWzU4yHORGH+9kNGPnmUihGTfSG1pwALfIOxkQQu75VN4JNVYs1afD9MP36eAdhG6am1UbyT8YOtjWtk2BnmIMjUNCBZZHaaxu0Om5NuV4/Xf2qfPHQ6I0SDbI6nufDCdiSwrfnaQUwB++kCraTHj67i1VFE6Vu0yhiB5pGjlRahtIw7gVuoO6Sc++IaVl6JAnYoPjs5LcRWI+B8ZnrcrYkDHnecVvlnfDJNzsuK96d+JTzRprhyNWBrfrXNWpQcyGtLivmDgY6PEhuLdZJ6gOEIJ+AIGTJE3qANSyzHMGMjlwtSJmmRH1FPiRGNSOk5VL3rV6wmryrnZOJX3yUQaLDJ9BeadUhvkkPVbsoYWQZnzORhjl5mWI5K6UvGDJ63CMm3euHaw7RSUiu3kugP7aPXp2mRKLahGEynkdTPU72mMYleUPNiqyuYudNabGsioMJPIzIYjPj5EO0PiB2cD6LCkPucO6qlyUiIr4+tOb1KeW6xmiKf7IDhGuXzwEv3NUAZmNnOGFpxJUPNUQ99YhqYEadRPxIkBlpzrT6yFcv+SVkOT9DEWBxujfugBHwm9UF6AxBB4dmeBFipv5Ia9vuywlky+GOTBanhFgd9DcXW1GNf/ENFVwIXKXjLLZlkp8349eTKqAKZ5j9uJFGt5ZUCFGSTIRX84WDtdjmqFQTfvckO17V7ksdYXWeiz3df5UF5XtFiv3Z/r6QiGzL5bXWeFQXuMVgFSFylsQRUee8AGdx7vBjXNBPOgtIHQLgbIE+R6rI8VH8mHmX0CV1q4tzqpHfof3hH9xMkuGSbhP4zcGQFr31lYL3sfYnPSxsrwUlwW8lf0TQXBxlDoeG41vnrXQ5XWvV/h28kbM+mll/c1j1M6pdz1c0bM++WYt1tjMh2BWXo1JNsxkr9Nla4XZmvSHZNLPxsELdhZWaiKi57b+1LG9HnIfBEkkkSX21RawpIcfuL08yZ0V5QTfm1y3AfyV3w+xsvRWewL8eaV2ddjNkd0V8OYebtxmKAWHH+zSRcuCE8RNrxGbNJf1iKb9QTtq6DwX0dfj/dPoYOazZ/TAAvt1E6ZS1QyZwVYQ8JnLFaZOyAHKU4dqcMUirtFriDCxsMGiZsAZvz+mQyMY02nOiK9IRHKKOjKraTWYF4dj1NSkw9VsTmQGIC4v2llF+qAWSHAqMNXIcjoTO1yP8rKO7EktmVlXGUYi3K9/OCWsqvG1SxCS1OyYP1LKMWCcXA/WXhN1jfTAw15SPwBvyvOkYjZEKcFZb3T/MwGB+9BS51N2hHG7SeO2n8SrkL1CwRrvai7+ruVMNeZbqepsv38OAmq5Up8xgq0l5VaJEljltzIdcywZwEoGQJRPZ3E4HiVn4QR+msuCSeQfhFXRlJ0/5XD9Hg5heWkOtLfu2VP0EnofGzcBTambbK6z17fQ8SK3ZT0DZTeHROuyoSYoamBIXPIZ0QsEx7PiIiRgiy5u2tENgxhajTKDSaDKtOVqQPAwfkD7/+WrKm4ih2HTq17slGjBlMJ0wKf+z/VeU2ZyUlBwzuGenxMjEQF67HDtZFcq0VUpJd/NCtoHUizg1GQ2iCfmTMy1ZWdzQtNWYJI7nVoySHIAFD685qzY3dGn+Fb1sZJHkAXE2amRoefTmOlY/B5nxepNXcl4AckiIibGtW8AZ/prnfdJMoIYQ+YgU4+45Y5yZs0WIpKrZzVaT6VAqvTO70kdyUL2J6VTF2fKHCQReFtqjeQ2+7HHyZ2EOa/laEUjakoLUXN2kZnQ45x+VJ8oqU+e05WxbBvyMcCcu1+38QT3J/c9f6gFTk60MNYHJFsKAB629y/A+aBGa9KX/OzQGhopS5MHNvvPCFtxmkiKMn9npD8O2U1n0u6gUoJ7mvxr7lObdOJNqQ6K+mKg+dK0Rsk8pejmuM+YNSNLWGs+LF+tog2eQWl0o6ORpXa204gMRmzygH3Se7kmNinOg6t3ZAfjZFAEZzEw2RZ2jueExl9hupt18w/DQneb1y/g9+2ZppekGN8K0d8RGqplI6A/giAWXJwNwrEkugAeBmRmilSgAItRFo/gqbpigj1ibYiQ4QfXHMY/0eevOFUeMAOSra7OocY+YO2TJ07PCAQe3kGTKeWom+fd9F9RnBWkT26iMl0G4KQZ6zm87WHHHNt8ysBHkAV+/rhfOEj9B78lPb//A+++aAPyb5f6bsXW3ZOJ0qQ8eqXVEYx5oBz3i5zVA0DploxVCldf7HPkmPVHuCaHdOvoOvMNQ0edqDIIarpvvzh23maTbzyt0KLz8+UTrpPunveycqmhVF8LZlw7gszHGWw1BnRjCu/ZX+sG2E2hp/+QTID4t3CH7EMqxTqZ1j9+yRDXzlTEXi/NmxDMtzTUJ4rQdSk+59EaIB8dx9cRG/DZIdLAELnrpzCG4Bwo7XD5RLjnoLaG/ITGoMeBxsHJM/XVyfPqVLmrwfVSMUWTPvE7UTAPf+0QVmt/kJKT2hjOxVl6UftGFiiNC4eV+NY2CRy4ByMFyljq+M643idJIvXA3LIhAMg2oEMDNFCM5r3strVqVOGCh69lWN63HjFb3gRfrHvbDBNEQWxLMeJiOnpE34ASQT+6CWTa2Z1uaONd/kzvPEH7oCxJhFqAwTb0KBYABlf9ipsGkwWH1Nvq7hLp1cBmxNTG3mvr2ICNXQ3xPzwhIqLQKdSJlGdNkwLvVSr9n9WU/ZKs9Vs4exDkFdW7aVhkI8i6HxIWV8T9F4+/rWOjPqTj0S8jyAShxJG5I16/e7Icsn398S+SgFgZLvjuntqGMwDynZrTKfbMICAvLWYO1WZ+553UaCTzWs2PQLFviIzWU6gDOPv1RJR98jyc+uWhw3wEjXaaaeQTsVlyn4c6kjdWtwvXyS5JJryW6JYaJ6S+7ZKMutB5DC3ZSbxz/MYIVeeyWfYJ2KfkaSmtVl2FOQhV5MiDjamlO7Aoqwfvl2vvXUYRzJ/6LZPnTgxOR5f6P1T0H1IrRId+BlaAYqP2AyG8tJ/EsknMbLqDbqoh1ML47DMEp5XWTWBraX8glVjUE2L0p+5/hEytOxUExDSAUjiHJF6IgR8uaxV5LMp1zTWSU3zs57zcrZdzOH5IJPFxVWvQtVJC+C6Y3mY5DTmyg8q9sn2QicE9Wz7qI3ygAQsyh3O5cWmrLNaTEtiD79nFYQCnJJZk8Mf+WXCVv7XitXaAkKggRlmM70OAVyyuWqcKTmaABzTpKEjvkrQUq0OW+aXdal0V/eJ48ogEz0SdzJmmq6Kos5061um1Koy2IZ7sDwjN9zS7NZ2CpgYbh+Dt7xpqp3MPcPU8XMLqaBFVoMDk+5Ff8QHF2KxzXl1DTfFuPQg3PaqkJXphJPdH+tfetLwHMRMyqXHQ0xHPrY38lwRpzECqVjgUQZA2dr/bWFsU4CXk11aNeKVT09880n7K1ShGapJ+0wVVV2f51/chonIFOSgpOtUMcZKtei+x81d5eVDbh8XWJaJEsmqdrJLjf/BfamYoO9PWX0mTFR6POmXmhrxA+jQK2k7PKSAfnMX5UzVCeJm8tmX8n25n2UbYiDqlCQrn+bY4Y/XCTfE90nZKNLqrQSdUVfKHBqTxaOjAIpeHAgDMTktORXRCalh0uJFFzezIsYhPXW1eDTQIf8sSy++DurykfWpGNp95nTT4cPTgbmbv3RWFTG22YFhHBPL2VKMIzSgk2n+LqfAwQrMjaxTTVPgUaZgcCNDeNcloV2vXYqWIcVgQ3DLwXHYy/bDv6NZATpYpRO2mU2HH4/QLU3ppF7LqEi1vNSC/FRHs2HGPCOw3u9GJVJILRjqgKDvQ7K0lbUWZDejTh8RYN8u8aaL0GCortEV/IFmeUs5EoGDx5aSdIuqIqgQe6jYDJyfvsOrUM8npRl4TLEiZPz5d193sZw/uGAQpc3gLuZf17ITj4ZLd5Y9yYn7/bgQ==,iv:WaOwvtObfyO+U0nygyVs/VCNgCRaWwIOTc0GVRocYt8=,tag:7Vqjpy65n1vwVAbDyldGFg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2025-04-08T21:57:08Z"
-    mac: ENC[AES256_GCM,data:+ju3gRQUa0NiS07diV6bXeaDI4i2E6DgeyzlZlubNZVvMIJ2e9RKsuT/zWt6cuLU8LIFQDbAxst1hMvwbUXj5hnVo+msBvhfyTB9y5k9wSoqcrfaBXe+9oMdxMSiNxB8yLUlsZWpXn4RdchhII1u6a+zq3GSlz8KC8CAW8W7EC8=,iv:9Vu1toeesoVfaFm/aeXjGMGJBFaX5ZC/jcJ3T/EROEs=,tag:PleLm4UQJw1GVjMUP+Ve6Q==,type:str]
-    pgp:
-        - created_at: "2025-04-08T21:57:08Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAyqlIeyoxYovARAAoTmvOAFm5UZHpid9OZajIXIBq5wlwxMOOZRLZhP8zff3
-            IxwxJcdSCSPsEZxjHnuyKNq2Ln/0MfcvZj8bmXfvA/3BPjD2uUTXsoNG9UWRMk8c
-            +tCAq2QjCYYHbrBmO0CNAnglV4+7bwqOCEmgR5Zm4BTRI7pJ4mR/oZ5CWUs+8SNv
-            pnJHhYtgnqU8rPiIqkKQR2g3qMAUUQFp2eH+DGg68pq9yEjcurpbLwq3gc/LEKDc
-            Mg69N0iRAoNcrwkug2SlpwEVUSePMP4IYZPNyaiJXwYw1zKh+82sA6h5ac0qBn1L
-            ShN1HkLDByAnZV6+4t0XusH84JEnvww6g+cKpOGroDZHwFh5yCGB/qzrPyTKalIA
-            w7/Ch+YR6hwHt7RXHTQLI8DQcz0jS5gtJJK8YDinS9TpjQcLvx2Z1EhlRm1naTtn
-            RpNO+dUKTKmexG1kMFcG5N9ATXVt8qwySXIC47zxbQ5EwZDZVrLAcX4TU5VOmwRx
-            MBfrv2u1qv5kMUjTXmrt8iydXa6ls/dz3sssnR7vVMPa7qOoFTjnMWx7Dh2BYr71
-            sU/kzPhlROm5pPvXyreMQx4xF3/e8DCO91WsNTRls2kMx1i1DDldDkpmtstS/awO
-            3pWexKPaW6WO7Fefjxs3oR4XXy6o5mAZTh8NaBL7cDcPiPO7VG/W5gGwVWr5ommF
-            AgwDXjg0p2IN1X8BEACqZJ/pNGE8kl89aG5MzUkoh+lgvjuzS+PB9urH8Va9MqbB
-            qgxykLMZVfM2OPSgVOilG0p3EjyrnUk7tnFXmFCPnjXhlkSrxe2K2Y3C+e1mD58Q
-            Q4UIzLogA1Wmk9PMF01zGkMZ7Ek6ushaK3b+FXFUC6htMv/5qPE9PSnP3qy1tYRl
-            FBi/GW/rGrjBP2OyfIBLa2Qw5ku8u+/k5JwKNJnER2UOqdJe/s1xdLV4PyYi74/d
-            k6orhlrngTKbyHpYDkJnDdvHgIGo1fjBhdYmCDi5ftK7UeBc50ApwVUjlQYY7o2r
-            fvgpX9dB5rhmD3EQdqbYxvMjj+3zsztTjiu0jfNCaJQp/nfWMeORpiO0mLCQJ5q7
-            VR9WvWl8mwr4BTXe5uw09HcGicG4pqYyMLPtNLesgFZkIyGQL6SV6n12xmEJNEjm
-            5XHybBbIHvjd42xdNQawk/odFOjTI0/pEn3IKpltVpigbRd4bfIWwPuMh93wsnda
-            g3PmOjs57MmxkdW1KCMEQzYgJRQtqgV3h/RpOZPeLPTEO+Tmpc3D+EVA7e3iJC0p
-            HHLAgsAoakTwVteGdbxJdfM4f/VaJPvOemdGuiXfRZxbxJnfuNV9PG7HO9mQ+guf
-            DzntDd2WIL/VfIqMn1g4pOgUYqQzbP4uUOUQLmPqokDwaBBhMiPdcN0X9xe74dRo
-            AQkCEBYS9ExomGHSZymdMQEiEC1hYyY2d9rCBy0oibGMzN68JTlRcX+3BxAFnMWn
-            l1SLNXsvdUl3ZDvIt1D3NyXlUkPUTu/ylcEmlgypPu27DjYsdArrCpyy07N00nYC
-            DO9JDW9RgdI=
-            =1ed8
-            -----END PGP MESSAGE-----
-          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
-        - created_at: "2025-04-08T21:57:08Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VARAArG6J39y42v9mj/M49BRT5qKbguiLTHsvmAWk+5D6yFxF
-            GEpWBIQnRFk2BU71krEmQK2VjTDlfBcutuYLdg9r5RwEL1rdNm9V97p50kX58xtp
-            FjE1UEn96s1/Yl5qtKv+bJAnLyzXyks4boJAVIVeL2xnDFBueTdq8G0Nt1HEk04Z
-            6fBbAqFUUNflUluDVvjeo9O4NQAP3o5C7hzjZCfDCuH0XCV+cX61TnHEECAQH0Or
-            NJ6rUgYJ6TpU0YTlv2/Mg8cduvqGnLMPwumkvZ96yey9ldGnL6Wthxy6oRUz1ctz
-            YALXx60OfPp/788ovw74pmtCxiyrWPxOS6BJQLZuH2Qlxyiaii5TF/qkMAsinW7D
-            7RICvCsXIxa04q4eU4L4epxZMmfUJLb+p7WRtACAoV+UxtbCPYzjtOj5vw/wefm+
-            DEifJQmmRRX3IvlOrPMnQy+XoJeQKWlf8lFt27NwABBppU3a4YE/dRC0Kk/3ofbE
-            HKvyRnRoYg6Ewh72xtC3UNp6+ZmTShlBay+dK6gz2mAIDpwQd9Z+y/l3b/zxZbah
-            xd9dl+UpM8lKnWQwTvVIUU9kbGAJiOGho2Bs85EFV+XndwufNhYvtpRYh9rjtupo
-            oydYTi0pLUOslo2PDCtWXxQA04i+k+uqxHpTQKt6pYx0VdliGmXY1ZNgIbYfYdDU
-            aAEJAhBHOlqGjrmRZ08TYa5tS7DXXsfDOAO1gvCvpnmiVZQyLLReI3GJI9awzcRI
-            Pd39QKf72G7Q5qB7BKSJa7JkDitn81h9EF2lwT59SbiJ0F/IjX3VRVmYT8lmYGzD
-            cG5KStgfvvTC
-            =uKg1
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.9.4

kubernetes/main/apps/dev/concourse/ks.yaml

@@ -1,25 +0,0 @@
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: concourse
-  namespace: flux-system
-spec:
-  timeout: 5m
-  interval: 10m
-  targetNamespace: dev
-  path: ./kubernetes/main/apps/dev/concourse/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-cluster
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  postBuild:
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-settings
-      - kind: Secret
-        name: cluster-secrets

kubernetes/main/apps/dev/forgejo-runner/app/config.yaml

@@ -17,9 +17,6 @@ data:
       capacity: 3
       # Extra environment variables to run jobs.
       envs:
-        DOCKER_HOST: tcp://localhost:2376
-        DOCKER_TLS_VERIFY: 1
-        DOCKER_CERT_PATH: /certs/client
         # A_TEST_ENV_NAME_1: a_test_env_value_1
         # A_TEST_ENV_NAME_2: a_test_env_value_2
       # Extra environment variables to run jobs from a file.
@@ -79,14 +76,14 @@ data:
       # Specifies the network to which the container will connect.
       # Could be host, bridge or the name of a custom network.
       # If it's empty, create a network automatically.
-      network: host
+      network: ""
       # Whether to create networks with IPv6 enabled. Requires the Docker daemon to be set up accordingly.
       # Only takes effect if "network" is set to "".
       enable_ipv6: false
       # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
       privileged: false
       # And other options to be used when the container is started (eg, --add-host=my.forgejo.url:host-gateway).
-      options: -v /certs/client:/certs/client
+      options:
       # The parent directory of a job's working directory.
       # If it's empty, /workspace will be used.
       workdir_parent:
@@ -99,8 +96,7 @@ data:
       # If you want to allow any volume, please use the following configuration:
       # valid_volumes:
       #   - '**'
-      valid_volumes:
-        - /certs/client
+      valid_volumes: []
       # overrides the docker client host with the specified one.
       # If "-" or "", an available docker host will automatically be found.
       # If "automount", an available docker host will automatically be found and mounted in the job container (e.g. /var/run/docker.sock).

kubernetes/main/apps/dev/forgejo-runner/app/runner-dep.yaml

@@ -29,7 +29,7 @@ spec:
       # https://forgejo.org/docs/v1.21/admin/actions/#offline-registration
       initContainers:
         - name: runner-register
-          image: &runnerImg code.forgejo.org/forgejo/runner:6.3.1
+          image: &runnerImg code.forgejo.org/forgejo/runner:6.2.2
           command: ["forgejo-runner", "register", "--no-interactive", "--token", $(RUNNER_SECRET), "--name", $(RUNNER_NAME), "--instance", $(FORGEJO_INSTANCE_URL)]
           env:
             - name: RUNNER_NAME
@@ -88,7 +88,7 @@ spec:
         - name: forgejo-runner-cache
           mountPath: /cache
       - name: daemon
-        image: docker:28.1.1-dind
+        image: docker:27.5.1-dind
         env:
         - name: DOCKER_TLS_CERTDIR
           value: /certs

kubernetes/main/apps/dev/kustomization.yaml

@@ -4,4 +4,3 @@ resources:
 - ./namespace.yaml
 - ./forgejo-runner/ks.yaml
 - ./airflow
-- ./concourse/ks.yaml

kubernetes/main/apps/download/autobrr/app/helm-release.yaml

@@ -1,114 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: autobrr
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.7.3
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-  values:
-    controllers:
-      autobrr:
-        initContainers:
-          init-db:
-            image:
-              repository: ghcr.io/onedr0p/postgres-init
-              tag: 16
-            env:
-              INIT_POSTGRES_DBNAME: &dbName autobrr
-              INIT_POSTGRES_HOST: &dbHost postgres16-rw.database.svc
-              INIT_POSTGRES_PORT: &dbPort "5432"
-            envFrom: &envFrom
-              - secretRef:
-                  name: autobrr-secret
-        containers:
-          app:
-            image:
-              repository: ghcr.io/autobrr/autobrr
-              tag: v1.61.0
-            envFrom: *envFrom
-            env:
-              AUTOBRR__HOST: "0.0.0.0"
-              AUTOBRR__PORT: &port 8080
-              AUTOBRR__LOG_LEVEL: "TRACE"
-              AUTOBRR__CHECK_FOR_UPDATES: false
-              AUTOBRR__DATABASE_TYPE: postgres
-              AUTOBRR__POSTGRES_HOST: *dbHost
-              AUTOBRR__POSTGRES_PORT: *dbPort
-              AUTOBRR__POSTGRES_DATABASE: *dbName
-              AUTOBRR__OIDC_ENABLED: true
-              AUTOBRR__OIDC_ISSUER: https://auth.${SECRET_NEW_DOMAIN}/application/o/autobrr/
-              AUTOBRR__OIDC_REDIRECT_URL: https://autobrr.${SECRET_NEW_DOMAIN}/api/auth/oidc/callback
-              AUTOBRR__OIDC_DISABLE_BUILT_IN_LOGIN: false
-              AUTOBRR__METRICS_ENABLED: true
-              AUTOBRR__METRICS_HOST: "0.0.0.0"
-              AUTOBRR__METRICS_PORT: &metricsPort 8081
-            probes:
-              liveness: &probes
-                enabled: true
-                custom: true
-                spec:
-                  httpGet:
-                    path: /
-                    port: *port
-                  initialDelaySeconds: 0
-                  periodSeconds: 10
-                  timeoutSeconds: 1
-                  failureThreshold: 3
-              readiness: *probes
-            securityContext:
-              allowPrivilegeEscalation: false
-              readOnlyRootFilesystem: true
-              capabilities: { drop: ["ALL"] }
-            resources:
-              requests:
-                memory: 100Mi
-              limits:
-                memory: 4Gi
-    defaultPodOptions:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 10000
-        runAsGroup: 10000
-        fsGroup: 10000
-        fsGroupChangePolicy: OnRootMismatch
-    service:
-      app:
-        controller: autobrr
-        ports:
-          http:
-            port: *port
-          metrics:
-            port: *metricsPort
-            protocol: HTTP
-    ingress:
-      app:
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          #traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-        hosts:
-        - host: "autobrr.${SECRET_NEW_DOMAIN}"
-          paths:
-          - path: /
-            service:
-              identifier: app
-              port: http
-    persistence:
-      # Autobrr is configured through environmental vars. This is being made to provide a place for temporary log files
-      config:
-        type: emptyDir
-        globalMounts:
-          - path: /config
-      # must mount writable tmp dir
-      tmp:
-        type: emptyDir
-        globalMounts:
-        - path: /tmp

kubernetes/main/apps/download/autobrr/app/secret.sops.yaml

@@ -1,77 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: autobrr-secret
-stringData:
-    AUTOBRR__SESSION_SECRET: ENC[AES256_GCM,data:xEhcTyYP9PceXNI9xJs+QA==,iv:hWYNf/xmv0Vi2ruLDRoAzaASeg7UBCbItJZgzjTizxk=,tag:wFYlxAMAKRzfxjk5eAAXUQ==,type:str]
-    AUTOBRR__POSTGRES_USER: ENC[AES256_GCM,data:LOi58PMKPA==,iv:igYoiROSptVkt9hmeDM+Moc3laYgncTQGm7vJWb8/94=,tag:CTTrddTKmDml1f299mNjCg==,type:str]
-    AUTOBRR__POSTGRES_PASS: ENC[AES256_GCM,data:VT4b94gZhTSg97jUAMEvKS8RUeGC9e5HEn032/++Itc=,iv:xalpnfAXn1ph5r5AOsvjLQR3VKncKm2MuF19o6pUefk=,tag:f0StIuqgK1uqtaS9BekZ6g==,type:str]
-    AUTOBRR__OIDC_CLIENT_ID: ENC[AES256_GCM,data:AGoj63v2RNMkYXOHgTOXqUz4u5PrYmRZ9m1zDaAMw6cyIUUj/Krc9Q==,iv:wv6ABGBkbzA6yb2Zwma9J4V0yISjS2lLZp64FY92Q64=,tag:zBGrHn9qXV+cWEnMEC4iyA==,type:str]
-    AUTOBRR__OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:/V0PtS0o25P4eh6Xfts23uItVet8B9MIdJtHfkzvIsZMGz/sYeROvsBbkQy18W5KVs7GaU6meHw7ZiTmCQRxYPmqp93/ySZ32O2bd+rRAGp8u0LQwgdE9OidNCfJ5gf4iQN1bP7GQY86/VjRzdF3RCR8c1CcsL+arju1WS3JwNk=,iv:xZ3lGSADrkmAJFJTY4hASHHwpmhjPbKWCs5hmtKzJSU=,tag:BOpodVxFGkZfMYWNtLhWOw==,type:str]
-    INIT_POSTGRES_USER: ENC[AES256_GCM,data:bvUsMs/cDQ==,iv:MOBNIDE6OImx18vvhhl3FHSSYYFs60p6n4Ey8SiMQ28=,tag:u5Kb5HWJ74SuVfOcdgT3wg==,type:str]
-    INIT_POSTGRES_PASS: ENC[AES256_GCM,data:zEUPNqMHk+q8yVKTlCiAB/xDdedm5O2VCLlW0HyI+cY=,iv:2RK898FwD00o7aUdDxrdf16aVV5mWinsJMKknrhUFCg=,tag:a+VW0NgA/eTafKgqWhTLiA==,type:str]
-    INIT_POSTGRES_SUPER_PASS: ENC[AES256_GCM,data:NuFh2zhgaIyrsRAWcZWkA7PlHspLvhEE2Dy96A5keZ0=,iv:dJyNM4HlV4D0jPoFKju2y9QTJsjrbAN/HGyuJA0x84s=,tag:GwfRUi+bHcMLA92juJgKqg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2025-03-20T19:51:38Z"
-    mac: ENC[AES256_GCM,data:zV5WovvM0jyWESeBWcPRyC42x9augsDJ8z7DXpXu7LnpAJdOyoZsXkfdu+O3UYW+FuATrzZUMPPoEAsH3hMQV0bApAVtCJXIMJdGEFsQpQLVKasGAA4JKRGFS3qD9MongWekwi+C1/j+6IRiFYIHGeJTbuG1/j+oIXeDWLG2qFA=,iv:RpoZixoI0DnN9V9ORKO8eElgRa72P/hRRN29r4TUH7U=,tag:ANerkIvcp3iQnB+9qTNiqg==,type:str]
-    pgp:
-        - created_at: "2025-03-20T19:51:38Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAyqlIeyoxYovARAAhU3NBIO3rhokF9ZikQNP4oydIeFG9P3WRSzvx5B/p2Ks
-            hjslSqgw6g5yMnsmk+syXxz+I+uyGwcztKzjMcp5CJdXdJysI7GDmqDXl9vexkTT
-            DtrN5rcbIDaZ2XzeZ4VMr87SEj+4H4iqLwR0Sb0Lf5XSoYAVYRJyAcj273azcz94
-            okJ3ZcNZZJU/gCYkRiG/o+vWYNIZ2rMWq0E089Ek1SRVxtHsWnk+8rtYCEDj9scV
-            m0jR4OCPsluahicvqlTl/QtzdkUTT+NtUnj2mQitbIzRJtmlew5GtZzBL9KDEIRs
-            4oIFGINFjMSn2+ytUo+/Yyt1Vkemm02KeifG04BQVEeDWsDGc1UmWXiQDwowQcfU
-            QmJHVzvtYeNuekoqkOZyLj52rDf21wW8eY+UJ38mkf1omfieCRbQ4HvnNCVsECgO
-            kiHrvYJ6Jr5G6J9mw+Vbs5D4CZz1/RStPRp394+txBF55RtNtEMCtHqxepSNahRG
-            O22MWhhIRXzbYbHqRkcN/CFC+xLf2lVJ+PxQdgDJJl3fyfa1XlPOLsSFlJOmgu7W
-            xiWe1Fe3vaVB6Re6q8RFjuUC1r84GvONwbGKKQK1zLXxfeFi1OWu+1KrIZNfuZju
-            D/ZaGsoPVwWh5jiTCPBhpekh/sJWuWsEaDvqCxLIV3jnt+bzNz5h5ZIvzgRMxfuF
-            AgwDXjg0p2IN1X8BD/96+Q0n3oVrMfRTHqu7Gv+NwFq3cz8s5RRcIUuXoF/WOH/B
-            gfpn792JJSsmkeuZRiDqywnYTgvm9Yi0Oo2cppmGJFOd7p6hggrHtcxiwG1/WjLV
-            4mo2JFjK+cKSAzEcTqS7K3tF/yxwswG5L5Gf3sBbF9VEX2PcYyP0Rv86TnCZ1TVX
-            QPK5qkvqyFZrlHtb1vVZMJs2gJNX4bYVFnAEox+NA/6BWJSt8tzICexw8CfEYHHm
-            DHCJlbEPlZ29UFxzksIbu9R9TCB6Q6cmmPbAKok6rwLjxKmpdfm/3sB7PQ8YMSKO
-            L15ZGez2HvKlPiCO6qz+sLAxfG79E2ACmJmRryVglfY67tneEfjNplF0n/0EfD1t
-            /7Jzrasy4BWCsbyGFrpJbmEG/k0jegImUOnLTUg0R4Qu7Uc0P8qO1CFW9vkGA1qS
-            w4dk18ZzR0w6ajS9QfDiMb+Kt6QAQA7/s/gqC1k3Z19cBprmRY/T6PL+4NpWvH5l
-            1XdlVyj9tR1VYopHa+0vtn5H+LdqOaJYLFYQxiz3mKvKetD3q5DVnjoGwo3F1dSR
-            Xw56CwpuyLxRBYnR/XkNcRsKTmFcSYHzHM9m/yNEAagzJSi9vMuXVR/KexzPHAdw
-            9IY+RA/XhC5UIVSE1BZhqtPVrLbaR8LAL/14csSUb1hdkgtWiRbBUJhWaOMdsdRo
-            AQkCEHlyGcQjdeZ30+HuTF85IDw82+9b1Kk8muNafkAyBINgEuaEne2/ZNrepM4J
-            uJct2gU78EhhoAk8Hi4l2KXseC1VMDNnUiw7W0w+Z+5bVoenR8eyy5+ml93AiUam
-            B0+4GtSBYMw=
-            =jnRJ
-            -----END PGP MESSAGE-----
-          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
-        - created_at: "2025-03-20T19:51:38Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VARAAg6sD00LCw21Mc2a8jPwX2/UMjYTpeqnMJd9dPfqX6zi2
-            nNpS4DEyOzgkowly+8Vo+Vf8mXpyh/GusNDUvW74X+hLafiKsJnbwKUkAUlcKx/i
-            kDamivaOFBxdaYVTJ3H6W7gwitGhh6HAQgBckZG+NwkI3HMT6IuT7lpYBrrGdS8K
-            JIo7pteiRpjJXJhKN+GjeNsJRpU3Oi3ityBA8GZvy0cwjI4zu3nKnehZshVPMOes
-            BVmds+TZmtltirDor/8exHawsRy0gxFW7QBlz4CJ8PEzpK6FEk8EaTKyxYCwQNEt
-            r5K9Qsr3o5Ds5D2NDugyrkYdmHUpZwWHCMaoY1YH3u3K2DRZCr908Q/e84MPoCfm
-            zMJ4aurMYG+YSFg8V7QQ2i1FXf+cNpxWVXJ+xVvd4Ss1CYmxnQ9fhVPSn1lrBOql
-            NYFdy8rUmvdOVoOyPeB21MLxhpUmdVxseYKI3w0O+cq/qcMQr4IlCJ/vOqYKBWCo
-            EpfVguyMWMuTDobNpZmZnnOeYQrmy2z26Iy4MzKFk6s2Z+CPdX3u7qmDj6Tg9f43
-            3LgHh3UnD0Eud32SvlDOmluz5cLvwvuTIRr7MF0aazSd59g/gyDfa/FAsNTYS3X5
-            x2XpN45PpyRzsbZ5MwlTaW4fZS/A6j77nUSODIq/CYcCLiJY01LZp2+MiQm+nXzU
-            aAEJAhADP93pxFhePrrwneD0c+sy4tWtOWgF7FIKdl7DyDUwXSogDSnjhJ4yyCEo
-            Oc+MlTI6hCCNra6RQQ3jrjU13rnpq63468XuZi17rtp9jXH8a41FiXCsjTYakqPE
-            0QW6Hfzks7rP
-            =E4za
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.9.4

kubernetes/main/apps/download/autobrr/ks.yaml

@@ -1,29 +0,0 @@
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app autobrr
-  namespace: flux-system
-spec:
-  timeout: 5m
-  interval: 10m
-  targetNamespace: download
-  path: ./kubernetes/main/apps/download/autobrr/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-cluster
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  dependsOn:
-    - name: openebs
-    - name: openebs-sc
-    - name: qbittorrent
-  postBuild:
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-settings
-      - kind: Secret
-        name: cluster-secrets

kubernetes/main/apps/download/bazarr/app/helm-release.yaml

@@ -1,104 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: bazarr
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.7.3
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-  values:
-    controllers:
-      bazarr:
-        containers:
-          app:
-            image:
-              repository: ghcr.io/home-operations/bazarr
-              tag: 1.5.1
-            env:
-              TZ: America/New_York
-            probes:
-              liveness: &probes
-                enabled: true
-                custom: true
-                spec:
-                  httpGet:
-                    path: /
-                    port: &port 6767
-                  initialDelaySeconds: 0
-                  periodSeconds: 10
-                  timeoutSeconds: 1
-                  failureThreshold: 3
-              readiness: *probes
-            securityContext:
-              allowPrivilegeEscalation: false
-              readOnlyRootFilesystem: true
-              capabilities: { drop: ["ALL"] }
-            resources:
-              requests:
-                cpu: 2m
-                memory: 175Mi
-              limits:
-                memory: 750Mi
-    defaultPodOptions:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 10000
-        runAsGroup: 10000
-        fsGroup: 10000
-        fsGroupChangePolicy: OnRootMismatch
-    service:
-      app:
-        controller: bazarr
-        ports:
-          http:
-            port: *port
-    ingress:
-      app:
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-        hosts:
-        - host: "subs.${SECRET_NEW_DOMAIN}"
-          paths:
-          - path: /
-            service:
-              identifier: app
-              port: http
-    persistence:
-      config:
-        existingClaim: bazarr
-        globalMounts:
-          - path: /config
-      cache:
-        type: persistentVolumeClaim
-        storageClass: openebs-zfs-mainpool
-        size: 1G
-        accessMode: ReadWriteOnce
-        globalMounts:
-          - path: /config/cache
-      storage:
-        type: hostPath
-        hostPath: /mnt/MainPool/Media/Media
-        globalMounts:
-          - path: /storage/Media
-      # a bunch of extra folders in /config that dont need to be backed up
-      backup:
-        type: emptyDir
-        globalMounts:
-        - path: /config/backup
-      logs:
-        type: emptyDir
-        globalMounts:
-        - path: /config/log
-      tmp:
-        type: emptyDir
-        globalMounts:
-        - path: /tmp

kubernetes/main/apps/download/bazarr/app/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ../../../../../common/templates/volsync
-- ./helm-release.yaml

kubernetes/main/apps/download/bazarr/helm-release.yaml

@@ -0,0 +1,70 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: bazarr
+  namespace: download
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.3.x
+      sourceRef:
+        kind: HelmRepository
+        name: bjws-charts
+        namespace: flux-system
+
+  values:
+    image:
+      repository: ghcr.io/onedr0p/bazarr
+      tag: "1.5.1"
+
+    env:
+      TZ: America/New_York
+
+    service:
+      main:
+        ports:
+          http:
+            port: 6767
+
+    probes:
+      liveness:
+        enabled: false
+
+    ingress:
+      main:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-production
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
+        hosts:
+          - host: &host "subs.${SECRET_NEW_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+
+    persistence:
+      config:
+        enabled: true
+        type: hostPath
+        hostPath: /mnt/MainPool/Kubernetes/bazarr
+        mountPath: /config
+
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+      fsGroupChangePolicy: OnRootMismatch
+
+    resources:
+      requests:
+        cpu: 5m
+        memory: 175Mi
+      limits:
+        memory: 750Mi

kubernetes/main/apps/download/bazarr/ks.yaml

@@ -1,32 +0,0 @@
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app bazarr
-  namespace: flux-system
-spec:
-  timeout: 5m
-  interval: 10m
-  targetNamespace: download
-  path: ./kubernetes/main/apps/download/bazarr/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-cluster
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  dependsOn:
-    - name: openebs
-    - name: openebs-sc
-    - name: qbittorrent
-  postBuild:
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-settings
-      - kind: Secret
-        name: cluster-secrets
-    substitute:
-      APP: *app
-      VOLSYNC_CAPACITY: 2Gi

kubernetes/main/apps/download/bazarr/kustomization.yaml

@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- helm-release.yaml
+- ./helm-release.yaml

kubernetes/main/apps/download/kapowarr/app/helm-release.yaml

@@ -28,7 +28,7 @@ spec:
           app:
             image:
               repository: git.seanomik.net/seanomik/kapowarr
-              tag: devel-d973d45 #v1.1.0-python3.10-debug
+              tag: v1.1.0-python3.10
               pullPolicy: Always
 
     service:

kubernetes/main/apps/download/kustomization.yaml

@@ -8,7 +8,8 @@ resources:
 - ./radarr/ks.yaml
 - ./sonarr/ks.yaml
 - ./prowlarr
-- ./bazarr/ks.yaml
+- ./bazarr
+#- ./readarr
 #- ./mylar3
 - ./unpackerr
 - ./media-dashboard.yaml
@@ -16,5 +17,3 @@ resources:
 - ./kapowarr/ks.yaml
 - ./sabnzbd
 - ./lazy-librarian/ks.yaml
-- ./autobrr/ks.yaml
-- ./manga-watch/ks.yaml

kubernetes/main/apps/download/manga-watch/app/config.yaml

@@ -1,32 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: manga-watch-config
-data:
-  watch.yaml: |
-    # scan_on_start: true
-    watch_dirs:
-    - /storage/Torrents/MangaWeekly
-    - /storage/Torrents/manga
-
-    default_library: Manga
-    libraries:
-    - name: Manga
-      naming: "/{{ title }}/{{ title }} {{ chapter }}\
-        {% if release_year %} ({{ release_year }}){% endif %}\
-        {% if release_group %} ({{ release_group }}){% endif %}\
-        .{{ file_ext }}"
-      path: /storage/Media/Manga
-      webhooks:
-      - name: Komga Manga Library
-        url: https://comics.seanomik.net/api/v1/libraries/0F1CMFTETE8ER/scan
-        headers:
-          X-API-Key: ENV_VAR_MANGA_WATCHER_KOMGA_KEY
-
-    mangas:
-    - title: WITCH WATCH
-    - title: Tower Dungeon
-    - title: RuriDragon
-    - title: Dandadan
-    - title: Demon Slayer
-    - title: Kagurabachi

kubernetes/main/apps/download/manga-watch/app/helm-release.yaml

@@ -1,53 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: manga-watch
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.7.3
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-  values:
-    controllers:
-      kapowarr:
-        pod:
-          securityContext:
-            runAsNonRoot: true
-            runAsUser: 10000
-            runAsGroup: 10000
-            fsGroup: 10000
-            fsGroupChangePolicy: OnRootMismatch
-        containers:
-          app:
-            image:
-              repository: git.seanomik.net/seanomik/manga-watch
-              tag: v0.5.1
-              pullPolicy: Always
-            envFrom:
-            - secretRef:
-                name: manga-watch-webhooks
-            securityContext:
-              allowPrivilegeEscalation: false
-              readOnlyRootFilesystem: true
-              capabilities: { drop: ["ALL"] }
-            resources:
-              limits:
-                memory: 75Mi
-    persistence:
-      storage:
-        type: hostPath
-        hostPath: /mnt/MainPool/Media
-        globalMounts:
-        - path: /storage
-      config:
-        type: configMap
-        name: manga-watch-config
-        globalMounts:
-        - path: /config/watch.yaml
-          subPath: watch.yaml

kubernetes/main/apps/download/manga-watch/app/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ./config.yaml
-- ./webhook-secrets.sops.yaml
-- ./helm-release.yaml

kubernetes/main/apps/download/manga-watch/app/webhook-secrets.sops.yaml

@@ -1,70 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: manga-watch-webhooks
-stringData:
-    MANGA_WATCHER_KOMGA_KEY: ENC[AES256_GCM,data:qh/QzBUQfpcLeySrXh1H6BQEoz3EqjepDgjpdf3L/30=,iv:/PhmI2px74HTYlnC/+zq7Eot+eU377mZ0W2JKATq5Gw=,tag:DAneMF3JC2fD9lv6Fggegg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2025-04-01T00:17:55Z"
-    mac: ENC[AES256_GCM,data:9FPBGpqx9MJGsY0XcvPOR192SG72vGPmQTQ5efLRk7f/xI2oF0GsrE4BofTw+wEHl1YQeo1VP31S8KjGAse+zk6Mzfi5GobDa31gC8NDDBYx2uQHC5PAvyTfPnhihFisP4R1FCST5dMGz3joiyUo53kVoXCpvcu09HljkQBTF+I=,iv:PcVZuEFd5FjKVkEx5a7poY+3zB4SeylBWbRaldWtxAY=,tag:YJgaksXxGZWjLOYyXKgCYg==,type:str]
-    pgp:
-        - created_at: "2025-04-01T00:17:55Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAyqlIeyoxYovAQ//diTVs8dwsAnSt5g3qPLNrBTdhy9QQbrc6keYX2gIWLrN
-            QgnvTt9lXJiujzPXw5ix/IXbUqPraes7zzaeEBL8pOMYhwyLuaGu7jBNuDuBregK
-            zKD07fCpKgyf4sUkQcmtAPoQdxQEPcett0HK0xG9DpUWAw2dmeWUNHyYWzGJfr7q
-            BShrUtFG6leqEe5h8tGOFuurfPkXZyGtvMsHOEEQn/Z5aK96wbJkPV1j+Wi95GKY
-            OxjLwq0ttE9S16Gx1UJsGabQnZdhS3irr8ySGF9/3z3sjhZhbc+H8GUfu/i38vUe
-            rraJqUdI6W2aUyyYTMQRYzqA9h6BMBZfedPPsHb5UuvT9+zbh1ufkIxOS/zYZz5u
-            wN6xPE1wYKdzwL2iQdvbXSTduDc1SRfkiT172ASkiI2tx6ALn8FJoYXLpblfbJcF
-            r9yWtnqMRxUibCioxKVWboLDj63QGK6tpJs105qOzO4TV0xQ+D/iH3ipPdCbqeQo
-            cGpl6EZPuSVdL0Ux3m0/ocP97PAjSbh4xK5YIhXI8YBIF5FOwiFWSw6IMPHrPNu2
-            XWgH6ysIiAtfvO9KmVvrQlfJRgWdD/3H/KohQ3xzKpFMhxPrsVayjqZroc3R0Y46
-            AnpeWrsPGO7gmNvf5qSGAtZPP2FJPa7MuRBjSmmERfH9G9o6eNowg6vlF7zpUnGF
-            AgwDXjg0p2IN1X8BD/0b7hKXHqk3FztP2UbIucQbyZ8WpLyYYQId9Hn6ZSkwNLDb
-            n0RZwcG7wqT8A654miz0zVBXzB3XE8LIK6ziW/1M88sxiw5R64N/nP8ICNEArUiV
-            SKGUh7DkVRO6OII1guAOqaxRn17hXSh0aEjFrWTdasqx8EihBTVkmAx6290yvHvl
-            QhcrRfVG6WHHViwnFj+ddRAKyTcbprRx8UbSJqpfLCEEGlFhhu7CkRqCJc795qdL
-            5YT8u5sRx66KTo8qy13Kfk4lYZtQdxv4EeF6nNU9OdgeRIS6pBZEJwheDYyLcyMV
-            QZwkLu3ZsPIv5l91gO04k3mXQi21mJdMAMpy6Wci80wYdkJPhqLumzsgXhlxtWQ2
-            ayyCBF0v2LDzTwm4YYmmJFom/+3ZMOKYp3VsXhvKPJr07gUN26UtmHL6fcjII/zs
-            DHVn67m96v+xLYhOdfvy8S8JC0FyEsRQF1XH9T1iOzGkMZAaUztI6Vkeu0lqJO0a
-            sEllrwdO5ipxEcUwJ36XsiuqtitE5952gRjonXUwKeBrk3P+6ZrGYE/ORpdriwGJ
-            xvxSXaaonLofOWiVkGNeL1yegC++KXkqmrXaZNN455BUNYX6V6nGXPagw3Pbr90i
-            7/oKs40MdM9ptOa5nZXFWzCuIk3jvSpDVpKdxWmXGJp5oqXichnFtbEtG3K1AdRo
-            AQkCEMz3XrOR6OycfiokFZBbPYg+4m9tqI3XpOl1Gm5p/73xrIhVJivH6oqKrgHC
-            Q0ridYzEsC6yziLV7GpLv2I6j7DHSbxwNSIGM24STndqSrepRrUAP9locvAR03v3
-            43NMnX4bMz4=
-            =ojrR
-            -----END PGP MESSAGE-----
-          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
-        - created_at: "2025-04-01T00:17:55Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VARAAhLpMx5PiD/MXS29s0e6y/jw7za7XlM/0ys8lXx2CFWwV
-            v3ZRZvVYgZyR0K0NZJ43WSU/SC1Ma18jbrh2MLbCktil3Gab5FM1WD1x+pQm2TOH
-            V5TjSJbx+6vWJY8cuzAaLFQGNHGvL6THxbs70nBW9StoLAcT1wY03gPWcrp/zcup
-            pHIHUoiL7/zRhAtoLai+t4kcvQNzt1v+5Nj7tsVZ+nB+JZkKXVxV0UT0PIVt+5i2
-            bzzq0a9RdsnnD4HrYhhCmUk/toPMHY9TRF5PVhqCoykP0oZ17JszU07yKgonyOZT
-            qAFKqPdN72kk9GgASe+kpzCRwuQjCsmhzsoZAjzleSeUEDNLwNUNEF7XRLJ00ZyW
-            46V9AQsVfaBXR8rvFEXBf3McDBIAh3M3CtGe9a8TSZatsWNHjfUsWBD5PgNoYBFb
-            ilqL0TSZZCqU8oMHlE/oXjC2PPTGbKFDeqMTwnirA7nh2S2MI1Ky/a+3m865dNBf
-            NDNMICczkwA9e4/9VphgYOUSb367o9dMx5Fn3MEFuuelMVEZxlaTaxXmUslSFVJw
-            9mR6hg/ndi9CkhxcS3TWKn/LUYSXF+T7FankpNzgiq7FsBcPEfhUW5hFco03AFni
-            71oP+MVGq7tN/P/j3g7JFZuCoLH9ISiGxwCkxAn7SYdPtWKC0OenKU7+6BdV+8nU
-            aAEJAhCR9rod9+niLrqlg1QUgzhE9rvw3A8YJudnBQXB3ylc6D2FWqLmKEJMHj7p
-            A81SlbcvqX1oyg73WeoOK139bF465egwaqkJPkVy1jpGesyR9bqVc+AAaex+LGNe
-            ALTM9W1yFCJy
-            =GkmJ
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.9.4

kubernetes/main/apps/download/manga-watch/ks.yaml

@@ -1,25 +0,0 @@
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: manga-watch
-  namespace: flux-system
-spec:
-  timeout: 5m
-  interval: 10m
-  targetNamespace: download
-  path: ./kubernetes/main/apps/download/manga-watch/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-cluster
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  postBuild:
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-settings
-      - kind: Secret
-        name: cluster-secrets

kubernetes/main/apps/download/mylar3/helm-release.yaml

@@ -17,7 +17,7 @@ spec:
   values:
     image:
       repository: lscr.io/linuxserver/mylar3
-      tag: "0.8.2"
+      tag: "0.8.1"
 
     env:
       TZ: America/New_York

kubernetes/main/apps/download/prowlarr/helm-release.yaml

@@ -16,13 +16,13 @@ spec:
 
   values:
     image:
-      repository: ghcr.io/home-operations/prowlarr
-      tag: "1.34.0.5016"
+      repository: ghcr.io/onedr0p/prowlarr-develop
+      tag: "1.31.1.4959"
 
     # Metrics sidecar
     sidecars:
       exportarr:
-        image: ghcr.io/onedr0p/exportarr:v2.2.0
+        image: ghcr.io/onedr0p/exportarr:v2.0.1
         args:
         - prowlarr
         ports:
@@ -111,4 +111,4 @@ spec:
         cpu: 2m
         memory: 150Mi
       limits:
-        memory: 500Mi
+        memory: 500Mi

kubernetes/main/apps/download/qbit-manage/app/helm-release.yaml

@@ -39,7 +39,7 @@ spec:
           app:
             image:
               repository: bobokun/qbit_manage
-              tag: v4.2.1
+              tag: v4.1.17
             env:
               QBT_STARTUP_DELAY: 45 # seconds
               QBT_SCHEDULE: 720 # 720min = 12hr

kubernetes/main/apps/download/radarr/app/helm-release.yaml

@@ -34,8 +34,8 @@ spec:
         containers:
           app:
             image:
-              repository: ghcr.io/home-operations/radarr
-              tag: 5.22.3.9889
+              repository: ghcr.io/onedr0p/radarr-develop
+              tag: 5.19.1.9704
             envFrom: *envFrom
             env:
               TZ: America/New_York
@@ -76,7 +76,7 @@ spec:
           exportarr:
             image:
               repository: ghcr.io/onedr0p/exportarr
-              tag: v2.2.0
+              tag: v2.0.1
             args:
             - radarr
             env:

kubernetes/main/apps/download/readarr/audiobook-helm.yaml

@@ -0,0 +1,120 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: readarr-audiobooks
+  namespace: download
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.3.x
+      sourceRef:
+        kind: HelmRepository
+        name: bjws-charts
+        namespace: flux-system
+
+  values:
+    image:
+      repository: ghcr.io/onedr0p/readarr-develop
+      tag: "0.3.32.2587"
+      pullPolicy: Always
+
+    # Metrics sidecar
+    sidecars:
+      exportarr:
+        image: ghcr.io/onedr0p/exportarr:v2.0.1
+        args:
+        - readarr
+        ports:
+        - name: metrics
+          containerPort: 9000
+        env:
+        - name: URL
+          value: "http://localhost"
+        - name: CONFIG
+          value: "/config/config.xml"
+        - name: PORT
+          value: 9000
+        - name: ENABLE_ADDITIONAL_METRICS
+          value: "true"
+        - name: ENABLE_UNKNOWN_QUEUE_ITEMS
+          value: "true"
+        volumeMounts:
+        - name: config
+          mountPath: /config
+          readOnly: true
+
+    env:
+      TZ: America/New_York
+
+    service:
+      main:
+        labels:
+          app: audiobook-readarr-service
+
+        ports:
+          http:
+            port: 8787
+
+          metrics:
+            enabled: true
+            port: 9000
+            protocol: HTTP
+
+    probes:
+      liveness:
+        enabled: true
+        custom: true
+        spec:
+          httpGet:
+            path: /ping
+            port: 8787
+          initialDelaySeconds: 0
+          periodSeconds: 10
+          timeoutSeconds: 1
+          failureThreshold: 3
+      startup:
+        enabled: false
+
+    ingress:
+      main:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-production
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
+        hosts:
+          - host: &host "readarr-audiobooks.${SECRET_NEW_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+
+    persistence:
+      config:
+        enabled: true
+        type: hostPath
+        hostPath: /mnt/MainPool/Kubernetes/readarr-audiobooks
+        mountPath: /config
+      storage:
+        enabled: true
+        type: hostPath
+        hostPath: /mnt/MainPool/Media
+        mountPath: /storage
+
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+      fsGroupChangePolicy: OnRootMismatch
+
+    resources:
+      requests:
+        cpu: 1m
+        memory: 150Mi
+      limits:
+        memory: 2000Mi

kubernetes/main/apps/download/readarr/audiobook-monitor.yaml

@@ -0,0 +1,16 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: audiobook-readarr-exportarr
+  namespace: download
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      app: audiobook-readarr-service
+  endpoints:
+  - port: metrics
+    interval: 30s
+    scrapeTimeout: 20s
+    path: /metrics

kubernetes/main/apps/download/readarr/ebook-helm.yaml

@@ -0,0 +1,120 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: readarr-ebooks
+  namespace: download
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.3.x
+      sourceRef:
+        kind: HelmRepository
+        name: bjws-charts
+        namespace: flux-system
+
+  values:
+    image:
+      repository: ghcr.io/onedr0p/readarr-develop
+      tag: "0.3.32.2587"
+      pullPolicy: Always
+
+    # Metrics sidecar
+    sidecars:
+      exportarr:
+        image: ghcr.io/onedr0p/exportarr:v2.0.1
+        args:
+        - readarr
+        ports:
+        - name: metrics
+          containerPort: 9000
+        env:
+        - name: URL
+          value: "http://localhost"
+        - name: CONFIG
+          value: "/config/config.xml"
+        - name: PORT
+          value: 9000
+        - name: ENABLE_ADDITIONAL_METRICS
+          value: "true"
+        - name: ENABLE_UNKNOWN_QUEUE_ITEMS
+          value: "true"
+        volumeMounts:
+        - name: config
+          mountPath: /config
+          readOnly: true
+
+    env:
+      TZ: America/New_York
+
+    service:
+      main:
+        labels:
+          app: ebook-readarr-service
+
+        ports:
+          http:
+            port: 8787
+
+          metrics:
+            enabled: true
+            port: 9000
+            protocol: HTTP
+
+    probes:
+      liveness:
+        enabled: true
+        custom: true
+        spec:
+          httpGet:
+            path: /ping
+            port: 8787
+          initialDelaySeconds: 0
+          periodSeconds: 10
+          timeoutSeconds: 1
+          failureThreshold: 3
+      startup:
+        enabled: false
+
+    ingress:
+      main:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-production
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
+        hosts:
+          - host: &host "readarr-ebooks.${SECRET_NEW_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+
+    persistence:
+      config:
+        enabled: true
+        type: hostPath
+        hostPath: /mnt/MainPool/Kubernetes/readarr-ebooks
+        mountPath: /config
+      storage:
+        enabled: true
+        type: hostPath
+        hostPath: /mnt/MainPool/Media
+        mountPath: /storage
+
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+      fsGroupChangePolicy: OnRootMismatch
+
+    resources:
+      requests:
+        cpu: 1m
+        memory: 150Mi
+      limits:
+        memory: 2000Mi

kubernetes/main/apps/download/readarr/ebook-monitor.yaml

@@ -0,0 +1,16 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: ebook-readarr-exportarr
+  namespace: download
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      app: ebook-readarr-service
+  endpoints:
+  - port: metrics
+    interval: 30s
+    scrapeTimeout: 20s
+    path: /metrics

kubernetes/main/apps/download/readarr/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./audiobook-helm.yaml
+- ./ebook-helm.yaml
+- ./audiobook-monitor.yaml
+- ./ebook-monitor.yaml

kubernetes/main/apps/download/sabnzbd/helm-release.yaml

@@ -30,7 +30,7 @@ spec:
           app:
             image:
               repository: lscr.io/linuxserver/sabnzbd
-              tag: 4.5.1
+              tag: 4.4.1
 
             env:
               PGID: 10000

kubernetes/main/apps/download/sonarr/app/helm-release.yaml

@@ -34,8 +34,8 @@ spec:
         containers:
           app:
             image:
-              repository: ghcr.io/home-operations/sonarr
-              tag: 4.0.14.2938
+              repository: ghcr.io/onedr0p/sonarr-develop
+              tag: 4.0.13.2931
             envFrom: *envFrom
             env:
               TZ: America/New_York
@@ -77,7 +77,7 @@ spec:
           exportarr:
             image:
               repository: ghcr.io/onedr0p/exportarr
-              tag: v2.2.0
+              tag: v2.0.1
             args:
             - sonarr
             env:

kubernetes/main/apps/game-servers/factorio/helm-release.yaml

@@ -17,7 +17,7 @@ spec:
   values:
     image:
       repository: goofball222/factorio
-      tag: "2.0.43"
+      tag: "2.0.32"
 
     service:
       main:

kubernetes/main/apps/media/audiobookshelf/helm-release.yaml

@@ -23,7 +23,7 @@ spec:
           main:
             image:
               repository: ghcr.io/advplyr/audiobookshelf
-              tag: 2.20.0
+              tag: 2.19.3
 
     service:
       app:

kubernetes/main/apps/media/freshrss/helm-release.yaml

@@ -17,7 +17,7 @@ spec:
   values:
     image:
       repository: linuxserver/freshrss
-      tag: "1.26.1"
+      tag: "1.25.0"
 
     env:
       PUID: 10000

kubernetes/main/apps/media/immich/app/helm-release.yaml

@@ -25,7 +25,7 @@ spec:
           alter-db-searchpath:
             image:
               repository: ghcr.io/tensorchord/cloudnative-pgvecto.rs
-              tag: 16.8
+              tag: 16.6
             envFrom: &envFrom
               - secretRef:
                   name: immich-secret
@@ -40,7 +40,7 @@ spec:
           app:
             image:
               repository: ghcr.io/immich-app/immich-server
-              tag: v1.131.3
+              tag: v1.126.1
             env: &sharedEnv
               IMMICH_TELEMETRY_INCLUDE: all
             envFrom: &sharedEnvFrom
@@ -76,7 +76,7 @@ spec:
           machine-learning:
             image:
               repository: ghcr.io/immich-app/immich-machine-learning
-              tag: v1.131.2-openvino
+              tag: v1.126.1-openvino
             env: *sharedEnv
             envFrom: *sharedEnvFrom
             resources:

kubernetes/main/apps/media/immich/app/secret.sops.yaml

@@ -4,70 +4,75 @@ metadata:
     name: immich-secret
     namespace: media
 stringData:
-    REDIS_HOSTNAME: ENC[AES256_GCM,data:V0LfmmRGYcs2qWuhJLfsZbJ+5E+OtWU0Eg==,iv:Q6Pr6ZvzA3fE7xNZQW4DkC3qokftIkwL0a/tNtvtYnA=,tag:F4cYrYyzUMg3dgG8EUX0YQ==,type:str]
-    REDIS_PASSWORD: ENC[AES256_GCM,data:AylVNuolaCEvIUpC2qb62tuk1Z90ELMPshIgGgw=,iv:S1c/xPul9l5pvIbApdKOHoHo9NBPzSJfk6WdhVE4TK8=,tag:31Pw1aaw9+qmYxrJ7TDV7A==,type:str]
-    DB_HOSTNAME: ENC[AES256_GCM,data:qMJatJcMvNHSOR3tkygq5HnaLELCb+fPKnwuQiE5ASGI,iv:g79AAHutWFDZPMwJM14ePA0OwwfRsZdSECtWZPzkyuE=,tag:8Mf3Ujl6CHzWW+uzGAMYwg==,type:str]
-    DB_DATABASE_NAME: ENC[AES256_GCM,data:pyFwK6Ec,iv:owTvbg/eJEOSp/WG/XJ68WCXwZ2k2MS7i8gbV20xb9U=,tag:rhHgB0jk/eDN6/wU/ecBVw==,type:str]
-    DB_USERNAME: ENC[AES256_GCM,data:2VU+gTqC,iv:yyMDzHJwHpDPlNiPdUZQqUA/SgnVa3zVgc1W8E3wWSE=,tag:2dyDS8mSg+BZ0ZAPIdeTTA==,type:str]
-    DB_PASSWORD: ENC[AES256_GCM,data:DTPOEP0Eg1Y9kx8jd3asMkfubFXB8TJNMw0iYfuJtXc=,iv:pFxCzJIQfoNpdA6uQ6v6hG2GbOKtUkYDh0wsYBV3Cj8=,tag:yhqwysYHlHrPU5S093slng==,type:str]
-    DB_ROOT_PASSWORD: ENC[AES256_GCM,data:ndapbHBtlj8VEIPN3iAyeepNHycKg5AbAJzzpJrJKMxKg4o=,iv:fe/JcFdk5sNI9+dizCbzj45er06r4KjNJFFuEe4xV0k=,tag:MKbXYM64RCmtCaQqceykgA==,type:str]
-    IMMICH_MACHINE_LEARNING_URL: ENC[AES256_GCM,data:Whxs6NHrT80EZD5K8gMx8cdOY3cy,iv:hKnkD5KFcXD0K5/2N/k3MPKAtgfbnvh6NoMvTzOhfNI=,tag:M04nJYrALfANSRwxnbtbsg==,type:str]
+    REDIS_HOSTNAME: ENC[AES256_GCM,data:4nsNrMpzeEa2latEYKMY3gqdeJHb2uMI1A==,iv:WNeXzxIABhAlg8jwtFiVgqM7ZX4zMRBafJItKYQOjvk=,tag:KfCQ0cvzHU5oiGCvxFXOvQ==,type:str]
+    REDIS_PASSWORD: ENC[AES256_GCM,data:Vbg29adZQFfoQKAYtw/SiVYQLA8ldb6wp0+fANU=,iv:aPDiPlW1eZ3k5LceGsetVa29nK1/Xh4mTPariid9gWA=,tag:BRwR0/P2RJyeo0GA7qnkCg==,type:str]
+    DB_HOSTNAME: ENC[AES256_GCM,data:1Km16AQ7ZI6Vp8gJ2X1GWDueiPSsUARyV1E=,iv:VpUhbBHzYQwNn7w9dkl9SeDjenJGCMtkMxKUNUBSJVQ=,tag:iOh2Z64ZETVh3A9GgVCFQg==,type:str]
+    DB_DATABASE_NAME: ENC[AES256_GCM,data:qnjumUy7,iv:YcHNvN5spm1dQiEnwx+pUoYhYOjyhV2BglSvdvvvBS0=,tag:qp+n+utODDLgIEr5wLxkqA==,type:str]
+    DB_USERNAME: ENC[AES256_GCM,data:5AwXhp2q,iv:BPsl5ksxYBERpEDABG4RCBf7XHInA4rpLbavQ3Joapk=,tag:sEdCDujhTsIYwW8w+ACbWA==,type:str]
+    DB_PASSWORD: ENC[AES256_GCM,data:VLOXKhj4ULr8WdR7WZwLj7L9CKnGho6p/xpbmiyHYRw=,iv:dr2wTeZ1TVG5kiC5BKiedrqGdIACfHGTgfMEvmjz/8E=,tag:061iGQw/11He9PIx0xJ75Q==,type:str]
+    DB_ROOT_PASSWORD: ENC[AES256_GCM,data:T6yzWXz6z3crQRvRzcidMYeApQ3l6T947ZZSYu2R3p3oSlo=,iv:YBRTrIqlKLTc8kd4NsjwbOwJ8jygdqH1OvmbrPzvdeI=,tag:5yjWEoX39rtRu4u36cPuvQ==,type:str]
+    IMMICH_MACHINE_LEARNING_URL: ENC[AES256_GCM,data:hjCUGBZJBHG/vHaHoqZb96u+2XKV,iv:Ly0t+1oRZpyljC43r+3iNvFhs0I/KWcM++QZ+pRzw3o=,tag:40So3dnDNUVVFciU+5yn/g==,type:str]
 sops:
-    lastmodified: "2025-04-17T00:41:49Z"
-    mac: ENC[AES256_GCM,data:TS/JpoExsSroJCyzg1oa238EwO0mu6beulHZTqrGU4X4oLRb/IaFfYBgjcdoYW6BI5Fok/KxVnYUIZGxo1+PESqHkisGJmAuGWZ5QaTwOQdyUbzWTfsD/DVV3A1uHp5VTwzIPg33TYyCQy+whrgzyejuE6EFeSXWi5cidPH19o8=,iv:z/4oLwsso1v3e6Tdd1cemWvQXF3LcusB+2dv5SPwn54=,tag:gf1OrYcCZjq2NSNEcCSLAA==,type:str]
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-12-31T02:19:39Z"
+    mac: ENC[AES256_GCM,data:nXE+rMdrJzS64iPt+N6mSZKSyNJq0ba6kQD+DHaBEc3lX/njrWyd49+VWEUL7gZC7PDem2LFZk7AIgb6Gn9HMkTntpMSco2GU2V8TQdR/PqPBs4uqwTGtNz1X1iSpIqS4tFZD/9HA5abbMIgE+QZhYBn7alVbe1H7bFOztxPh5w=,iv:aENXRfDwtx97VSgMur5RFAPf8VE3xbgwpkb/5bDKEtA=,tag:vJ/E6CIzjj0ABYVzreeSWA==,type:str]
     pgp:
-        - created_at: "2025-04-17T00:41:49Z"
+        - created_at: "2024-12-31T02:19:39Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMAyqlIeyoxYovARAA47GvZpJPutimcKxdHGDPDqopc92GvujCOOJZ3oau3bki
-            1Fws9rc+681yp1C/oOvT+d0B4XpLKJXw+BD04GJhamp2m/qJx+vN8Bslken4WmDG
-            87Aq3IJr8EEVHZTcbN22lnpNNwOYb4mENsPdQBwBuLDc1hLgPE5e+jI4h9lC1cBM
-            9LmdvmqKrNG2JJ8SjmrSHIjPhBjUiXx9WNWu5S9q7O5IjbN8zDzGeYK2woYo+ZBI
-            ElZmEwtHnqsxYeH3NT/0xWapSVXwr+IfPiwkxOzbR1FAcPTviPKMMq0/HDj7xN5f
-            voTQXLYwb8tdA7ZtPJvp2V/N+NysKx96MryuSEnootiUhhcEnj9QFXoFN8S4eoQH
-            0oH8EcjJXRB6h1tkSbR/CMaDeYJEh3p/JgAWtoJTwAenco6ETQSYB5w4U6SgAkBr
-            1yG6a09Xi15GotXWqHmCO2Vv7eFhLywXNb85gYD9llqn2u7DJiwZqPAvD7lm84px
-            CVupy4cj5FyRKSQuFfN95NSZdSITY7UwYtfGqDmitrOUEgT+S1F7DGPOU5m/3W1r
-            6tXNQyhvqWh9iCYS8G6IhCFFrg5anZfCVgifobCuDpd8sCxux4bBiFisYckSh+vM
-            6lx5hZP6WvcaIdHdRF/+1789+t4wkeZ0smYvCKzR1V0Ovjwz2vcP6ROA7jfQXL2F
-            AgwDXjg0p2IN1X8BD/wJirT8iLc8661KjwRBACm54y2Gk4Uu3JuoIIw5u9Ocs5w5
-            1lNO7FZcuPf/EtXWg4WWomzQoH8kiCX3HlX0Djf6uuRZ3e5+5ilnCFl4KagBaKUb
-            bET6paIv2r3bfpNR1SRmxdopyQvdGD1LkMA0/YKBCZI2+DzDUlF7j3Dwv1VoEDpo
-            yMFkp8Pz/4Zn8J8BRiC1sLdSulIePtvRKGEAmSWCX0qJC5puEYA+GN6dbWvRuOmA
-            7wLJrGjNOvwJxIU4XJWMVV3kA+yMRNICuin5mhFn+l4f4ZrqYLoW6M7dCnrQKPBl
-            /pERLPDq8GloRR7s9bVD8SMZkwrePYXhwbRsC8DEqYndAakLH2mh68j8R0YqTZdv
-            E4eFJ/RllzoPIEItVpkMYXjtbZ+fPeBLDLV9vddJoSQHRUtr3RQp3IrQbY0WL1Ib
-            iOVFnUCNfqeHtpns/Iz7TEhESTTl6pB/AMfXdp9BjYJRt/KzYyyc1y7+dDuMWhXs
-            BgD+Lk/B8aYsJQev/fkQ1xKIkdoKj1nJmnY7yBgnogIL0CdCCW+ksb6aM4Kv9BxK
-            KwJNa4XmRVoLwnnevhbpLd9DGd9pwB2CMgMDnONrisFw7dmjvyYuEvSsWN0gZlDO
-            W3UfS7JjpTbRiPY7EcXzuppQ7JmKLAdzI4RA2UGLfxfw/VofJSiMke8De8BMvtRm
-            AQkCEPVXHGdmaM8X4xwUojPud5+GTJJsH7o/PhFcY/8BEbnpVFDp0/WNeYnkuJ/d
-            h/GpdXMCC5meUtr7k007AQY/CiUYdfo7Jnv1f7jUZVcRuzCZFUX57eIEVbIui16p
-            ROb0Bo3B
-            =tXmq
+            hQIMAyqlIeyoxYovARAAuvTe9MiIAvkJrPfasQ+B6FpkiqGOZd0FWZf6uUomFQXp
+            /4MApT0Jk2V8IGuyZ5FYeNkLAIiaX5KfT2NHeN5DH+2oyyhpvTeePOyfgSTVmiaq
+            7Eq8vRmAsNGm0X6E5ukKAw61NfFB5dmjR5Z3ZO/F6f3M0r+f4MaBIRQmYCl7YueJ
+            pmpxIj/I5kyl1Q4P+b2Z0t2l6+m3VnEGLEcL8k2oQwjM8kSiW/j0MtFHSmgyqz/w
+            K1MwwpK+1GBpbYpjthBCSzNFAWA066nZuu89bdA4+1gLJhFdq2zNOm3ATDYbF0a7
+            lLw0ZA5SUHsFOGbxozUNewOqPJufrAcxah02hVq6DrdTsOK9VfOMjTRIOTIZFoJ7
+            JJzZQ5Y7Nb7jCKXXu6pQOe15kh5dHdzHn410w5/xth1bYJOCuCRcALZA+egFIc34
+            jXNB0kkGTEF5JUd+OBYD3BU++39o7eV5QNIdH4dHbiHVEgMFASpYKFqaxKeLNOX/
+            9ie02/PG2dhp792vnECXprKxJN7BRsbF4vm5E3jiOom0uUVdHWoCpEb3jlq6l7Ch
+            bn4UuK4kwFRJNHRS54hoJeX6s1yjmEcTB7UKEcspUUGtPSt4H0bjQMEeXaztKGeG
+            XjwnrbzCo1kjN5bDGjePbtRoLl2HFD+YTryE1MIycqeVf4D4Uq7+TAefJ3JdFZ+F
+            AgwDXjg0p2IN1X8BD/9oJTQStY5Q09a3c3hfgOsm8vqxInk6fhvPgr4VhpaRfjbc
+            rjaB42IEhg1MZBpcV14jqoD+aD3IdXAFAd4XIxApmwrpIAv6jPpWbEewmLvxrhNj
+            zA69gAKh+n4l2eGENI3EOkVnsYmtmvTqQm8OIW7UXTwwrYuWe8DUwTmmt06t2Vuo
+            gMppzG/Payo31oaSRetMU+flMoesur7T1WWqrM7PAoCmg6IE241z0LjhYa5ms9Nc
+            yaUmWoJ5Yct2WgGunEQ1fHExIk6vcyCmSU86Hzz/d6u40nfu08ILfseKQr4+hhml
+            YIh8asIfD3+BMxlwlflWPhDhqR1rsLpNS+DMa78A0HlOCkS/rFhoWV8e4qrSO95F
+            cD0Cqm56Tv80zEw1yul4/CF23CUG9aFvEIkCxMo4at+jFGhADNfvlgSJbZYrtQiD
+            vk3Od2443fFLeAh6zEEn4xOnwZnesj4xk0FIW0RahctWQJ161R+UOurrYN77j2Nv
+            F/OcxqA5lBBR2yAqvWABUeSDeED8OW/lLVb55qviYK1uaFxTo1HcrWFPeVbec8gx
+            wb8gggNwccVlpkEUldBwQFbW9lmCBHTd5N4rJG9n8asEKhxVijL0aS3cgHVLpvc0
+            KOXhR9HssH81gQ4hWJpXtgItwLv/sF+iKH/mimga+AyvvlLAyg8/7TgZEg3WNNRo
+            AQkCEOlbXVh11uilDr80Pf9wvH/2enP/dqBilyhkuNmffRodr8XiWJT7PXXXNn1q
+            6oAaZoSpbO1tv26pOPhB0MX9ZDsXd1g2a/tQis6GniADUqjxDlkEY9kb1SnESXMz
+            Fteid2zhWM4=
+            =Z+fR
             -----END PGP MESSAGE-----
           fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
-        - created_at: "2025-04-17T00:41:49Z"
+        - created_at: "2024-12-31T02:19:39Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMAy5t8IMoPu4VAQ/8Cr2N1xWlQnkpJHhRG7ReKyI0GtBuvcEVG4nyay4WPxp/
-            iQ0nhPmwZqvsK1vPSPOqK9C2GMU0vHXXylwKmyNXciMVOsxQzrk/bKBFBDs2lLID
-            kwfqBS1K4B1Tii9mVnbk750VVDVfTslS28RR09M3aXHAyrehhy4fozQO/p/T7zXr
-            lbffvPySlmXJFVRqyZXnk60sCkDeQeeBPgWsVGxe4j7rixgNwlAI6IWCOLL/4ASM
-            ML/mdMEvKK9EwGX5SECTYy+d0oL9iFDvUC7Qbq0MokzgBMJV/jya4aq1NIlJkUvs
-            QJ06H54aWPxqFapBSH5M8BPqqqkUF7syCnHyJcQ53mvX0u3GKH3eQmYngdDJoCsl
-            RauAUJ65xE8+k6K6dO74+llPzE1SbNOSRl0whIyld23vbIrqpFHlzSlxGHwb2BFG
-            4F4ZDfXimf3vjwjo14E0RuwFf7+RuwLU3pW/bJ6JpbzdBkoG8vNuKFeX8BbfYRzv
-            9zhYppC9g2DZT7qRFuGNpFUyLYDUpgz+2hbsJRCu1qOQsDPngJaV1L/wiZa6LwOa
-            H0IF9H9dSMOUQDuFrWJnmgeGoYsTR3dSJm9VuBISQcmfoBZ9WBLJK9dLbi9gP/ne
-            MIYDb/z0g3+YDDxhw+oGmGAM27zwnWKebFEIYAurDezyvHOXomDm5kGCdO0DyD/U
-            ZgEJAhAIMe2wI5dC0G9gbDpvDmIgIh/O9R1DDFAr/VaAWUUBidWRhA1tUqOyCmDV
-            UmvkuSGi7m0dAqPU3+spHtfEh8nbxCPOXwitajLJfveblu2lG0rZpgc2DZwzi5C2
-            WS9yiV+IuA==
-            =B2+5
+            hQIMAy5t8IMoPu4VAQ/+Nb7iDU+kNeJ5FxJ5mxcxlqdlEZq8St3ST5IAoOZoszPf
+            uy+f0kM3qTLI+AZlQi79+iOROmI4C/3DZ5S4RJ51iZsIFJMVu2O22XTPSqw4DwTb
+            EQBDOd2xsgopqVObjvSUjrKKRD0LBwC/DjJgWqT5+I6vWccx/51+LjX2uwpN146S
+            xg8DkwVJIBwoviAOZxJP2IhBnhaIsyygJyY9JwHbiPEm0b9U+4HdGn00GyLYtNFg
+            TCW2nQoXSR3j48f2udgCDhbbrQ3XurKZy3JpSbbG+WCc0rW7EgOXZQCdhD+6b1ap
+            CPiC2epj4Jr/GDZegVQDtFDHLAYG5vcW2tonFIcnfVh930OT+KCEVmz0VLUvoddU
+            Fqfrssep2JlWYpWVc5L9ocHgGcM3ewk/xtVUskUEf7X4jAoaDMEJNa/vjD44FsvB
+            yVb1FTOo9v6WUcC7sI2wOMM0AJxX2TCrQByM1gBWz0LP4AoVvQtGp1ef5Dwtz92E
+            VX1P2ifpFV+XibcZMB7fEXUtmmCrtQ4vL2yQR4f09wAPSLYNBkxVXeExybhlcypM
+            2acw1Z7IMRyGZq9iJ/ZI+J/zch5AI8n4GoA3/cQN7g9/xgvelnCQ3gPeGC/gnhGS
+            DYNQB+R45krPrOcA76lI7FtEiLYGXm+CLZKu7N8OUYyMtEYFHvVIf3i2e+F7qGzU
+            aAEJAhAT6RWTS7KgK5AYCOshkWkAzwbs6WDNzG8/HxouaoZgEPGhinOjbRZwAJrt
+            CSSO5zft+ZliEczqbKovyIXoGFs8yL1wbTeUCt7z09YJZsRsAG1775mIlpGixQWt
+            5zqvSVeF6ILU
+            =vttn
             -----END PGP MESSAGE-----
           fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
     encrypted_regex: ^(data|stringData)$
-    version: 3.10.1
+    version: 3.9.1

kubernetes/main/apps/media/jellyfin/helm-release.yaml

@@ -22,7 +22,7 @@ spec:
           app:
             image:
               repository: linuxserver/jellyfin
-              tag: 10.10.7
+              tag: 10.10.6
             
             env:
               PUID: 10000

kubernetes/main/apps/media/jellyseerr/app/helm-release.yaml

@@ -1,85 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: jellyseerr
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.7.3
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-  dependsOn:
-    - name: jellyfin
-  values:
-    controllers:
-      jellyseerr:
-        containers:
-          app:
-            image:
-              repository: fallenbagel/jellyseerr
-              tag: 2.5.2
-            env:
-              TZ: America/New_York
-            probes:
-              liveness: &probes
-                enabled: true
-                custom: true
-                spec:
-                  httpGet:
-                    path: /
-                    port: &port 5055
-                  initialDelaySeconds: 0
-                  periodSeconds: 10
-                  timeoutSeconds: 1
-                  failureThreshold: 3
-              readiness: *probes
-              startup:
-                enabled: true
-                spec:
-                  failureThreshold: 30
-                  periodSeconds: 10
-            resources:
-              requests:
-                cpu: 1m
-                memory: 140Mi
-              limits:
-                memory: 300Mi
-    defaultPodOptions:
-      securityContext:
-        runAsUser: 700
-        runAsGroup: 700
-        fsGroup: 700
-        fsGroupChangePolicy: OnRootMismatch
-    service:
-      app:
-        controller: jellyseerr
-        ports:
-          http:
-            port: *port
-    ingress:
-      app:
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: "jellyseerr.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                service:
-                  identifier: app
-                  port: http
-    persistence:
-      data:
-        type: persistentVolumeClaim
-        existingClaim: jellyseerr
-        globalMounts:
-          - path: /app/config
-      cache:
-        type: emptyDir
-        globalMounts:
-          - path: /app/.next/cache

kubernetes/main/apps/media/jellyseerr/app/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ../../../../../common/templates/volsync
-- ./helm-release.yaml

kubernetes/main/apps/media/jellyseerr/helm-release.yaml

@@ -0,0 +1,62 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: jellyseerr
+  namespace: media
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.3.x
+      sourceRef:
+        kind: HelmRepository
+        name: bjws-charts
+        namespace: flux-system
+
+  values:
+    image:
+      repository: fallenbagel/jellyseerr
+      tag: "2.3.0"
+
+    env:
+      TZ: America/New_York
+
+    service:
+      main:
+        ports:
+          http:
+            port: 5055
+
+    probes:
+      liveness:
+        enabled: false
+
+    ingress:
+      main:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-production
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        hosts:
+          - host: &host "jellyseerr.${SECRET_NEW_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+
+    persistence:
+      config:
+        enabled: true
+        type: hostPath
+        hostPath: /mnt/MainPool/Kubernetes/jellyseerr
+        mountPath: /app/config
+
+    resources:
+      requests:
+        cpu: 1m
+        memory: 140Mi
+      limits:
+        memory: 300Mi

kubernetes/main/apps/media/jellyseerr/ks.yaml

@@ -1,28 +0,0 @@
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app jellyseerr
-  namespace: flux-system
-spec:
-  timeout: 5m
-  interval: 10m
-  targetNamespace: media
-  path: ./kubernetes/main/apps/media/jellyseerr/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-cluster
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  postBuild:
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-settings
-      - kind: Secret
-        name: cluster-secrets
-    substitute:
-      APP: *app
-      VOLSYNC_CAPACITY: 1Gi

kubernetes/main/apps/media/jellyseerr/kustomization.yaml

@@ -1,5 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- ./pvc.yaml
-- ./helm-release.yaml
+- ./helm-release.yaml

kubernetes/main/apps/media/komf/app/configmap.yaml

@@ -1,73 +0,0 @@
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: komf-config
-  namespace: default
-data:
-  application.yml: |
-    komga:
-      baseUri: "https://comics.${SECRET_NEW_DOMAIN}"
-      komgaUser: "komf@${SECRET_NEW_DOMAIN}"
-      # komgaPassword <- specified with KOMF_KOMGA_PASSWORD env var
-      eventListener:
-        metadataSeriesExcludeFilter: []
-      metadataUpdate:
-        library:
-          "0F1CMFTETE8ER":
-            libraryType: "MANGA"
-            postProcessing:
-              alternativeSeriesTitleLanguages:
-              - "jp"
-              - "en"
-              orderBooks: true
-              languageValue: "en"
-              scoreTagName: "score"
-          "0BH3FYR727XP3":
-            libraryType: "COMIC"
-            overrideExistingCovers: false
-            postProcessing:
-              alternativeSeriesTitleLanguages:
-              - "en"
-              orderBooks: true
-              readingDirectionValue: "LEFT_TO_RIGHT"
-              languageValue: "en"
-              scoreTagName: "score"
-    database:
-      file: "/config/database.sqlite"
-    metadataProviders:
-      malClientId: ""
-      # comicVineApiKey <- specified with KOMF_METADATA_PROVIDERS_COMIC_VINE_API_KEY env var
-      defaultProviders:
-        mangaUpdates:
-          priority: 1
-          enabled: true
-        mal:
-          priority: 20
-        nautiljon:
-          priority: 30
-        aniList:
-          priority: 40
-        yenPress:
-          priority: 50
-        kodansha:
-          priority: 2
-          enabled: true
-        viz:
-          priority: 3
-          enabled: true
-        bookWalker:
-          priority: 4
-          enabled: true
-        mangaDex:
-          priority: 5
-          enabled: true
-        bangumi:
-          priority: 100
-        comicVine:
-          priority: 6
-          enabled: true
-          mediaType: "COMIC"
-        hentag:
-          priority: 120
-    notifications:
-      templatesDirectory: "/config"

kubernetes/main/apps/media/komf/app/helm-release.yaml

@@ -1,86 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: komf
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.5.1
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-  values:
-    controllers:
-      komf:
-        containers:
-          app:
-            image:
-              repository: sndxr/komf
-              tag: 1.3.0
-            envFrom:
-            - secretRef:
-                name: komf-credentials
-            probes:
-              liveness: &probes
-                enabled: true
-                custom: true
-                spec:
-                  httpGet:
-                    path: /
-                    port: &port 8085
-                  initialDelaySeconds: 0
-                  periodSeconds: 10
-                  timeoutSeconds: 1
-                  failureThreshold: 3
-              readiness: *probes
-              startup:
-                enabled: true
-                spec:
-                  failureThreshold: 30
-                  periodSeconds: 10
-            securityContext:
-              allowPrivilegeEscalation: false
-              readOnlyRootFilesystem: true
-              capabilities: { drop: ["ALL"] }
-    defaultPodOptions:
-      securityContext:
-        runAsUser: 10000
-        runAsGroup: 10000
-        fsGroup: 10000
-        fsGroupChangePolicy: OnRootMismatch
-    service:
-      app:
-        controller: komf
-        ports:
-          http:
-            port: *port
-    ingress:
-      app:
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-        hosts:
-          - host: "komf.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                service:
-                  identifier: app
-                  port: http
-                  
-    persistence:
-      database:
-        existingClaim: komf
-        globalMounts:
-          - path: /config
-      config:
-        name: komf-config
-        type: configMap
-        defaultMode: 0777
-        globalMounts:
-        - path: /config/application.yml
-          subPath: application.yml

kubernetes/main/apps/media/komf/app/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ../../../../../common/templates/volsync
-- ./secret.sops.yaml
-- ./configmap.yaml
-- ./helm-release.yaml

kubernetes/main/apps/media/komf/app/secret.sops.yaml

@@ -1,71 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: komf-credentials
-stringData:
-    KOMF_KOMGA_PASSWORD: ENC[AES256_GCM,data:OK/oiS+e4bcb95YN04UzX4SJaskarQTkztLo5lHE0h0=,iv:mgWhsvmE6nYsb763wVyMQBvvCadiDamhme+O+C4rh9o=,tag:7J8WI8H+u4zZGANpw75C+Q==,type:str]
-    KOMF_METADATA_PROVIDERS_COMIC_VINE_API_KEY: ENC[AES256_GCM,data:f9C6pFWgGQhiF+f3GqyYoM/hybHGnNc2JX+HfsoGruBKVr+FotV54A==,iv:Sfd6Fs8NGLbRRv8Q9wbDoGlhYpCZdt0KrhrLQlbBhBY=,tag:i/fEXvQ574nEL/txK6e0Iw==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2025-02-24T23:44:55Z"
-    mac: ENC[AES256_GCM,data:4sBI8DsSEzSomNghQjaIqoCip94jGxBaTE5da83GPm+LkEUo2nIe+50fFYmvAx14tdIRWT626XQ14hDaWAqy7gp3utqOPDOARWFP0YSz8Ha/Tv5Su9V4vlbXLX46MFsrJoVz/bpQVg4lLIpxxveRS2hvlZ0oHQV5N9oOThXS9vo=,iv:BSFs48JMiazr2cfXrACvZAeC3SBlUbVH+HNqhu91UaE=,tag:91aLFqMvafROuZr/aimbAw==,type:str]
-    pgp:
-        - created_at: "2025-02-24T23:44:55Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAyqlIeyoxYovARAAuphhZLT4EV844l6DVY6W2NJEdCjd02X9xP1PBQmRnMJq
-            ff42OfpMN6ud12i7C1Ba/BBHZgupGlg9a6N/Pgj90LZe5qRPwLij6/6Ose2v6/F2
-            A5FPH4XeOIgOV0CSEQs1CFmFX6aL4kOYZ9fU6Lb6G5OSuojs9soSxeqMkqi62dJw
-            8H1d+/BvUuJMExX//KeA8P/6rXYV3RXShAHIObmfZI80xkCwETxS1NR73LgaBljE
-            ba3/SMVUPnyeB3oEq+/0EkHZGWq6pS85KCfcAub5znWdHdKi8aQYNXSUrgQ6dtfw
-            6QF6Tl7IWz+VrhRFb0ZdKvucrdUZQSbKCGM6njd8IW8m2h+Eafs9jypkHfVwhBv2
-            h/eV3BJZ0xvmy+WKU6o0aKRPcer0KbVHZ3Q2RdUcjDth3OIoHkRwV9Sx8tpuN2oi
-            5Nb29UllXp7SCXgTDTUJWOcee2jrqGWwKJru+Y72opEVkG+6/Cw5raU1S7TBT5dY
-            JcV35Au+e2fMPdeb70Gxb/yfxmgHOthTsaPxnVtKS1N+jWtcFkZxMn/IYBiK7nVB
-            rhoEEgqE4QsIlSwdYd0Ov0KLrcZ3upln9oTuqdfNbOdX9bd+cZg8IatumKTUI0/0
-            G7ANRCWi96Bx+XCfeWjFCe4X4TMGLOK2I7VIbUEQ9ns3qJYGXTcu4EFv+pePhu+F
-            AgwDXjg0p2IN1X8BD/9V8OH/pzn303owOjztf7Pf4nJVnSsnJE15wodWuZV/graN
-            gFc4/gMscXni8ydT6TYoVsT6e66ly3MSK/rWeMoEXpwZ56TT9Nr7b1bXAym/Vgxx
-            Cv2q3yjlfns+6G+tXxArpPjvcRqV13mOdtRitnpUX8v+SQoqI0wsM99y+N6DzyDb
-            D6sXqBCggM/VNTKcpU6ao5iTv8MiMg35RsqaRVXf0Zz1mxUWQiDr1DqlKH2gS4Ol
-            ivqlRVxlRQGw1sdvp96CGnJquWXIjd7ghfRcqH5ucdQUmy7T1nZQxtw5N5TTdigg
-            CPR9KWI10pegowyElb1wRTdYOTFwtke1wei/R4A9amncOfq2Zt6juV12ATPc6MtZ
-            AQZXcT85aHqJ8IqZdRqZIfDnA9jkxCBKazZVDs1NNQXc2nFQKlQ67kL8Sc3FSkNJ
-            Mc5QOE8eSU1CthivDHrlqasLHFknyrGQx9gmN+FZN66KX+Bz1rgPcU++YFljnyHW
-            c+T8tEaWbpk9FIyxSKIEe17pLGcSdobc0bwPAqI2L6oPCuddJsygUjIQHQv7hf+B
-            8A7vzqCNOtA5Zld9YHWFLRAvo2oGBLz4kKnD16r4t7DEKrvT65wFNMjsQXPltTTq
-            AazMwQT9tsYFBlPXFrarJxUS6rezB4126ssUjSJrtZBnqTnh93D8w3sANwGwhNRo
-            AQkCEGxKwpiyHHVq6N69tMCY9b1tgTjXNQy7+7dvYMbBvlLVjUx1v6DfxkF2s+ub
-            g4777azvI7XfFPESGAdHxIQ8ffFtmbK/CyTHtSyvUIBb5swOeuFSOuTLpmGT2wKd
-            d9VulaohK9c=
-            =RLC9
-            -----END PGP MESSAGE-----
-          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
-        - created_at: "2025-02-24T23:44:55Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VAQ/+Jnd2eRtSVrfCRaWN1wiOWnGhNBkuF78MozqsFkxVhao6
-            thInvXMiVPZ+SfGhjPPrkJGQGalikrR8Xo7R+q5QOIkQRCcW643Fn2e6A3RBShkp
-            IYkp4Gt4SZwjOZvjZ9T7zbbQyMFbUNqtpmW3WWPPohN88yUJDGXDaVEvsvJwwqOZ
-            nesl5duFozmbsSAVXpm1E3VvSUlSvBrWiRHg3W4qbzEzcs1uptoQfNAPu4eN1yo+
-            0MTb18aQkifnryltZygVjsfT2VWIPMSmVoUZzY6kBaQfGD/nzXrn56NWh5fN+GEU
-            Q7VsIAZGBTzknb+JLrKybRzStoHlF5tlia0b5RJvZVqEdnVtN45Hvj0O7sOEyjik
-            eWNeQbVd3HIkO6X05b8yYYwUw2+NBkt2n8DzIi+7bqhLnd83Q0PiG9HD4Z/9mlOs
-            PzCndfLiPUJ+uRDX9w2n8rOADJOigDUv7qdot1Svn1ZiS5hVppVu46bjNcc/13eY
-            VugeC9EynHravMyIUv56Kwhdhf6TcPWW5Snb/TNPtOP6pehnEtvegT1vPWB+owUi
-            Jzdk5fIL7DMZI9RfOniNdQ0IjPpzi/BnQrIWMuXPylj8MjGzWo/Kbzwd2fUycIOJ
-            izJFN+ywcm8Jo3yewM+Duwd4jTWCY+UHL0BNiLFO9DY9jBXkNs9OQWmPWeHi8zPU
-            aAEJAhBLAv78hu67duPsotGqYUlFIb0kHRndZ/9uwSju/qIrK1pb6DaT2nZA59jZ
-            /o07LlY4W19HdYAruoaJLq5yAuuvjCehik4yUd6VE+Z8cCHuY3uYT8f3COhf+APt
-            BicXJEygXhXg
-            =og3e
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.9.1

kubernetes/main/apps/media/komf/ks.yaml

@@ -1,31 +0,0 @@
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app komf
-  namespace: flux-system
-spec:
-  timeout: 5m
-  interval: 10m
-  targetNamespace: media
-  path: ./kubernetes/main/apps/media/komf/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-cluster
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  dependsOn:
-    - name: openebs
-    - name: openebs-sc
-  postBuild:
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-settings
-      - kind: Secret
-        name: cluster-secrets
-    substitute:
-      APP: *app
-      VOLSYNC_CAPACITY: 1Gi

kubernetes/main/apps/media/komga/app/helm-release.yaml

@@ -20,7 +20,7 @@ spec:
           app:
             image:
               repository: gotson/komga
-              tag: 1.21.2
+              tag: 1.19.1
             env:
               TZ: America/New_York
             probes:

kubernetes/main/apps/media/kustomization.yaml

@@ -6,12 +6,11 @@ resources:
 - ./komga/ks.yaml
 - ./kavita
 - ./jellyfin
-- ./jellyseerr/ks.yaml
+- ./jellyseerr
 - ./audiobookshelf
 - ./plex/ks.yaml
-- ./tautulli/ks.yaml
+- ./tautulli
 - ./ombi
 - ./freshrss
 - ./navidrome/ks.yaml
 - ./immich/ks.yaml
-#- ./komf/ks.yaml

kubernetes/main/apps/media/navidrome/app/helm-release.yaml

@@ -21,7 +21,7 @@ spec:
           app:
             image:
               repository: deluan/navidrome
-              tag: 0.55.2
+              tag: 0.54.4
             
             env:
               ND_SCANSCHEDULE: 1h

kubernetes/main/apps/media/plex/app/helm-release.yaml

@@ -20,8 +20,8 @@ spec:
         containers:
           app:
             image:
-              repository: ghcr.io/home-operations/plex
-              tag: 1.41.6
+              repository: ghcr.io/onedr0p/plex
+              tag: 1.41.3.9314-a0bfb8370
             
             env:
               TZ: America/New_York

kubernetes/main/apps/media/tautulli/app/helm-release.yaml

@@ -1,99 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: tautulli
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.7.3
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-  values:
-    controllers:
-      tautulli:
-        containers:
-          app:
-            image:
-              repository: ghcr.io/home-operations/tautulli
-              tag: 2.15.2
-            probes:
-              liveness: &probes
-                enabled: true
-                custom: true
-                spec:
-                  httpGet:
-                    path: /
-                    port: &port 8181
-                  initialDelaySeconds: 0
-                  periodSeconds: 10
-                  timeoutSeconds: 1
-                  failureThreshold: 3
-              readiness: *probes
-              startup:
-                enabled: true
-                spec:
-                  failureThreshold: 30
-                  periodSeconds: 10
-            securityContext:
-              allowPrivilegeEscalation: false
-              readOnlyRootFilesystem: true
-              capabilities: { drop: ["ALL"] }
-            resources:
-              requests:
-                cpu: 10m
-                memory: 250Mi
-              limits:
-                memory: 500Mi
-    defaultPodOptions:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 700
-        runAsGroup: 700
-        fsGroup: 700
-        fsGroupChangePolicy: OnRootMismatch
-        #supplementalGroups: [44, 10000]
-        #seccompProfile: { type: RuntimeDefault }
-    service:
-      app:
-        controller: tautulli
-        ports:
-          http:
-            port: *port
-    ingress:
-      app:
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: "tautulli.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                service:
-                  identifier: app
-                  port: http
-    persistence:
-      config:
-        type: persistentVolumeClaim
-        existingClaim: tautulli
-        globalMounts:
-          - path: /config
-      # Read only file system, must mount something
-      tmp:
-        type: emptyDir
-      # Dont backup logs or cache
-      logs:
-        type: emptyDir
-        globalMounts:
-          - path: /config/logs
-      cache:
-        type: persistentVolumeClaim
-        storageClass: openebs-zfs-mainpool
-        size: 2G
-        accessMode: ReadWriteOnce
-        globalMounts:
-          - path: /config/cache

kubernetes/main/apps/media/tautulli/app/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ../../../../../common/templates/volsync
-- ./helm-release.yaml

kubernetes/main/apps/media/tautulli/helm-release.yaml

@@ -0,0 +1,64 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: tautulli
+  namespace: media
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.3.x
+      sourceRef:
+        kind: HelmRepository
+        name: bjws-charts
+        namespace: flux-system
+
+  values:
+
+    image:
+      repository: ghcr.io/onedr0p/tautulli
+      tag: 2.15.1@sha256:a8f4aa34e7973e5cb678692c1198e9c1790b7a3b49ce833b7196ce9c641e61f1
+
+    env:
+      TZ: "America/New_York"
+
+    service:
+      main:
+        ports:
+          http:
+            port: 8181
+
+    probes:
+      liveness:
+        enabled: false
+
+    ingress:
+      main:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-production
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        hosts:
+          - host: &host "tautulli.${SECRET_NEW_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+
+    persistence:
+      config:
+        enabled: true
+        type: hostPath
+        hostPath: /mnt/MainPool/Kubernetes/tautulli
+        mountPath: /config
+
+    resources:
+      requests:
+        cpu: 10m
+        memory: 250Mi
+        
+      limits:
+        memory: 500Mi

kubernetes/main/apps/media/tautulli/ks.yaml

@@ -1,31 +0,0 @@
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app tautulli
-  namespace: flux-system
-spec:
-  timeout: 5m
-  interval: 10m
-  targetNamespace: media
-  path: ./kubernetes/main/apps/media/tautulli/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-cluster
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  dependsOn:
-    - name: openebs
-    - name: openebs-sc
-  postBuild:
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-settings
-      - kind: Secret
-        name: cluster-secrets
-    substitute:
-      APP: *app
-      VOLSYNC_CAPACITY: 5Gi

kubernetes/main/apps/media/tautulli/kustomization.yaml

@@ -1,5 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- helm-repository.yaml
-- helm-release.yaml
+- ./helm-release.yaml

kubernetes/main/apps/monitoring/grafana/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: grafana
-      version: "8.12.1"
+      version: "8.10.0"
       sourceRef:
         kind: HelmRepository
         name: grafana-charts

kubernetes/main/apps/monitoring/grafana/secret.sops.yaml

@@ -4,69 +4,56 @@ metadata:
     name: grafana-secrets
     namespace: monitoring
 stringData:
-    client_id: ENC[AES256_GCM,data:hDtNQnqGIxG/CXPqatfLKas8m8l+w4sjqLoaCXucHdeOTM/mTw2LYA==,iv:Fplw3fDTrnql5mGLhCJ2OdyPLhGDLe2X79ZgP6MkEzQ=,tag:LaAPA9vbZKq+7eOBvsSuBw==,type:str]
-    client_secret: ENC[AES256_GCM,data:3IOfGn4qvxZX8kmHAL4mtqIKEsffDnwMQE3Sb5L6bOfMDkkzZaIKs5CzTflK3AdD2Jc5zY9VEvoxbv1F/LhY0d8nWFqNWnPhImkYVxCCFoxTRRVEfGfMyvXqiGGznHnPUIfylZh9IeEKcdn4EJK1ypjzzfEqN/c9kxIv7rtV13I=,iv:6Q+GF7y1gjNz9XvybTASmcEmV8pstjddj4XNCtL/deU=,tag:xZz/CYDPPo8x0DhfP6d1+Q==,type:str]
+    client_id: ENC[AES256_GCM,data:9nDR+Mx3xCDEe/3n2pdfWWihTLPj4/TqoaqbM7+uBzqAlu2oPeEF8A==,iv:xh+GOONaVbExUdJCna0HpmUvBvV1TcV5BizUaVy7Jfs=,tag:N/jkW7ZCiiei6M7Bbv5j4g==,type:str]
+    client_secret: ENC[AES256_GCM,data:v6DMkzI+wD/7lQh8fR+GZl0l1cGKxQ3jy++H1U92U9JGA9uHYf7c1pgCZAb26eaUVou90oeTsh5pc98tbUnwsnq8WWYskKsfEy8W32dZSIm3VRs7uKAyOcRT6Ink2UXlH6wvMkTobqUEt/Quwlr5YIDmeGviEVQUuBk2JwYQE/E=,iv:AiYcuKy6MXsYGSa/S0Fdu+8Zxof4vKZAhxYB/pVFigM=,tag:eya2Xj5Q2YLHOASZN/2gyQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
     azure_kv: []
     hc_vault: []
     age: []
-    lastmodified: "2025-03-13T00:50:34Z"
-    mac: ENC[AES256_GCM,data:bqDOFObh+bq6on1ZflBVNZPEeX1ngUcgj4uJFZKO9sQLelyJ3Ej9RriQ//iyXmHpUrFGe7qWFLESpr8DZAOHYwenupbJH0T11Fw5ArGBwhb5D1yyJTS2oaDjWgY3bCu/p8BkhK+oZcCAEcnz3C6LZW2ijo3NwRMh/b6qaeyT2yM=,iv:KOb6KKlIZXj4n1tTCb0G1vzW4meNr6BmlwS4fkFbKsw=,tag:pQCzUNC7h2rV4WV50+mj4A==,type:str]
+    lastmodified: "2023-10-01T23:25:40Z"
+    mac: ENC[AES256_GCM,data:LqK/sMdQpT+EJQyJIAJe9GpSefMAdDO57RDOoikLAvhA/CZxtlIFfKQ9D0v+P1T6nogCybhgc2CqvtXF2pLSLdjej9V17wmBZGn/kA3vO3GKmUoJSmKUHSf/CbUcJNE92f+6HUOTI1yWrdZNqLJdDk9FrVUhOiLKGocx2V6PCEk=,iv:YP3z8US1CfGeZliCDfQAIEiGCDz5TxRvYNxLMOdTSB4=,tag:TdNFISNgjNSVHy1EDKOwtQ==,type:str]
     pgp:
-        - created_at: "2025-03-13T00:50:34Z"
+        - created_at: "2023-10-01T23:25:40Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMAyqlIeyoxYovAQ//bQAB+ZzZgJXfNkVw02nYU1/TpoXk9+nuXbnDBQLkRQWm
-            B1M//i+gl8GG9UvAutffC4xPb7kHF/bLtX38D6lUdnD5IaMmpTA8CThp1xx4nPO9
-            xPxHLpEhemN1DKkV0oZFvWM8sjig9dvlsIHpZkwb42Tx7rEqPNwAob04EffjNQGn
-            zfYaA408wHnQADb324JJ+iqbydzhfwTaHDTZT9E6yl6GbvMFcCSremJocGcceFPH
-            Oeyo9qk8NL/+mgx3n2kH3+GzqhNXYp3f6IGpJVzdhG74DPFWRwdWu9xt9AcxRwsZ
-            gUcRkTU+DR2h6SdkLEgkNhzfsjKq0DN0MdVaoh0UPYTopMsT/vMa6/fsmWmXfUvN
-            eTw7yiiP4qQ1nzjvjj9H43AHfo8LrIsggTK74uZy/qQU3tllvpNgaJNc4m/uK4pU
-            a+NaV/5au+3k6OC9z2hdw1AMIk9/h8q2mozTpHfaxa3kYsJYXN9K21KrgO2u4i5r
-            HQ56yaEwUruH0ZD/BCpqEzetqrHNc7k6JqoAoVIgFUFM5+fW4mSCIGUq/gKtpzWp
-            8OHW2hKQkj/zhEHHCkdy3DsQJwe2TaivHv0scN2lUgGtqer1MghOcYi3cG/aKkdW
-            MyfjMHr9RtuCVyP/BTdPcAEpckRW3JmQJhq7KdGjFYHUFv4vjtIWgcw8FGVFj0uF
-            AgwDXjg0p2IN1X8BEADlJUQaXyAFxzz1yj8cPHgvYRyGNea5XpwDKYkUrfbi5+F2
-            Bt5GyTVamxNBdddEbfbZESjrDAouo7caDGbuqD935iPyR4mdye0a7uEKwqetnj9u
-            uaoLpCweZXWKknCeIv7dLH3mfa/b15m2xDBfRdXSgvxYFM9QhHwwnkBalnsy6e76
-            DaT/AtNge60VcS2bhMFIhTf7Wcq5dIqiF9UxbG8klrYIAb3Z84kvYDm8sMVD/40i
-            3oZ2x8V/8EMcIReE+npuZccSiC9p+aNNB9QvaaxT2M28tlFwHTrz8RfhyfJwlXKP
-            WPbxWSX4qXAFttmz6tYCr1Dr/cRKp4toyUc4Dp0SsUsdpjEyqD9/U4C+9rrRX6hE
-            Icx0FMde7XKdM7a5FFkDBOvuRqg7la5MoDzC0e+iWxXJeRnLbs9qK/3UO7Emuj7u
-            xbJI6tDSGapTHUDoLh5WFJ4xebGVDIwKNtIvZo1RaqlfGnaXCVBtfC9iR3RM4Px7
-            izZbU6L2kleQDkfbocTypnMs3UlUgiLL0yc69089Gykpd7OaeZKby5veMIzjmxvg
-            nwKU/5OTVMR00U08OfgSMC6uXit6LPermyTcDGwru48tEM7MaRw9Y9RtKrGfzvl4
-            yoyNWIfTBkivYP3aAJi7ROLvZytL/VFTuA6Ca04BZGTYxdT/F2QM9osW0+lCE9Ro
-            AQkCEBfMBjj/RHTXOpCu0eqYfOr8xqCnOHQ6FXU8NiwFl9dtasx+oif1Gy419RfI
-            fXCGIgMyQ37y0ZUVTkxO7UR6C+AqDsJ7u9ev82ZbBjAenlYpK4WlrVIYkGFb2ZnL
-            rHI6K65C93o=
-            =PU3G
+            hQIMAzKleRwoSoixAQ//bkp2YBFG0TAICxbXBaPhOD5CBdhCUqGcBTVH+qWZnKY7
+            ftsTk4Y1g/2aUC+0fL7GbKgGAU3SNXiq9wYaNziihP0o7pQpDIipOXblEyB/VaR0
+            duBGSVL1dPj7ZTLDyGDnfXlyEFgpv5u/Ss9q4S6pmnEVNThtaBO6GCOs16TfYz9b
+            cW/y0eGWSm7rLzL51nklgg2pddOzCqdiylK4R5L2ngoke9M22TkzsojENM92/c8w
+            trvsvG92fJ+0XX/rVyI4LavJV6wT9vaLX+jJs8ysTHSpel6H7wr/7UXHtPRH7SU+
+            AUgLjxBujI7MQjtBwR57R4KzhD7k5+6coFo9E/oJHafx1RrgEPBoRFB2V8btuNZs
+            8H0lxPdOFNmC6bfQ8E7/Cwv+TbQMiW4T7M0W665pwXBlMBfG4xoeVvGVB409SpwP
+            Lr1aNYWuk8NS0riwU8jUerX+YCXVK5kGBEhvZXlotwoJsgo/CdA/wPaDRVxBuH9m
+            qnBKr7Er0dbQjEsPk36/fMOVRa8LPjcU2550zsUwpk9/7IIWo+zjV3Urav2fSmGX
+            njYhy90NlIT+kkC6eLU8tIqCekYTjSOoyqRJbeivLszQsj8lT3xF4hW5JyTZ+g4Y
+            8V8Uao5cQNl+JVBzfZpzzrZDXyaDdiUt7TFtRg0h7aSMx17V993F2KNsQa5fDKnS
+            XgGEAMUZ69PL1HWVMxhwfmjfZkY8tDyvBT6Wtm6zUWybOlJsurZiFserW4o4LHNQ
+            1zPrZYdFMHkq7fIJn5PJrCH7Yx/DahRyb3h/VxiZlgpl594nf73ekr4e2bhi+98=
+            =CcmB
             -----END PGP MESSAGE-----
-          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
-        - created_at: "2025-03-13T00:50:34Z"
+          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
+        - created_at: "2023-10-01T23:25:40Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMAy5t8IMoPu4VARAAr58UmhbNpPUo3zGNl/AdpIApbA6eFplbp8wcdhgMrg14
-            Qh9TGuWt1SyAbcmN3i6+3XatFPkOWpmEWKDDC7cSe2CIQ/9O4KuFwBWPNBxSS2Fq
-            74slATEWYUayNtgEcD9hL42WAEgVE0MvPxuje5qB4YXKYtk9SmFAhy9+IQe4BX6I
-            MKGmZAcaLy+cwNaIf+p/oUsparyDmdNWK0x/wXWqm9v5Z0ythZPIp3Hh7KVfIXyr
-            tv3SuQ02SHdh0dPDucV+kTSryz2wdXtiiUbky0p0vd/26rXSeG5i8Pc/rmcLYxt0
-            oUzPMYPOgpIyFRcECACPn60LZrtr/M+wnaeef+swFqibBTk6BkuPQeQGMu+d+dFa
-            OzarKJHYpoipOE+cKkiyyOozE/2Xw5cWfYmWLs35d2izhV1Ef705f8d43YOqpXwE
-            IfgXgur0MmKw38ceGzJxCkvnavTg6OUYEhZMw5X4yp05thW/Ma2+L/li0xwW9ez7
-            ESwVroSdEB+Uw3Q0yhsTCG6UJeVlbBkaCRalRbg7YxFfTofWzohmXtuUaujlLgWd
-            mfR2LlWNb1zbBXDNqFCIf6BssDw2z6Ympzz/JvBP0UaGSjVzlc/GVxNlzpxfiYNB
-            luVMgS+XZKVNYURZgcfHXO+XZoFhCAkwUeEQqeGE2uaqqCaP0Q54KNm1vDaWUNbU
-            aAEJAhAeTHTWnOZOICcuvnI4H/M9xVQUylF/iqkFi/5XxxkGlAliu8LQA/BoBvRu
-            yEkz25K+2jUaXOnrvKW1iRE56F26TVXhPq+bMX6D/vK5b7l7QrqFQ2yzqubJ8u0e
-            kK2U9o6u2D46
-            =KBms
+            hQIMAy5t8IMoPu4VAQ/+NNma0ciWbimhjGxVRyPpnmnvaV6cowm+5k+29LOp4EyG
+            BZVm0pS1uIuQBls5BAdqi0cNbWyF6rQPE1r26Q1/jx4XS1M+LAadoufC4OcIDpOK
+            p8/UqVdAeMrS0Xn+kUvEdbKVAwGRBVRnd067+3QAY6jYcCy6iWLRCdwI3kOu1B69
+            ZcfUJ+BJcXomqrSKa9H+iOUqcaxZUvGDpa+MBGfgY8Gdxtz0idW282P3hMrPZ+pP
+            Y63/Eik6Uf4DmyQQbI6gsnERL2jtCDSoAfyYkqpAg9R2EWLjf50G7I9r2YHXb+c1
+            FrNSCmGFuYPwW6WMXLayi1hdw18ySYliYA92dMhq84bCx78K/9RPByTVuh7YVu3J
+            QEThL8nPAEqVVyW0qht5NA6NTcN6XbiDd/CvUXPgMSJ/xE9QKInvQ249g8lBD+Pb
+            kcBieDr/jzUd6lDmy+CgNKcNQetyczkC9XeFKJJEiDcNn5al7iuYGI2LqNzxJmEY
+            NOBornabsW6E7psEFK0wxyo6ePYqsBSPtwYXvyvF/jO3DJvHCXrdG86BvnqR19im
+            T2UiUB984MSYSic3y4+8zNPkOFlzwmew2Q5cyRsY/UuKqmTKeMcYvKl9CKCMS44p
+            enrWB3vIEfCmQluwIn30kyX7F7hGgHl2QkhwIcsFHYQavwwXqhHsPVULNqbb7WjS
+            XgGKHjVfDDhoMzZDYEqiJX5sAEWy1qyP7tJinnBfK1RN8pEF5nKAQr7hJLDil5O5
+            rUzQzJIVeVzB7WIGR6jMY68tHkonV/D6YwgqdXsnAjwY2hKz4JOrFgGx5CDtQ0E=
+            =WHrr
             -----END PGP MESSAGE-----
           fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
     encrypted_regex: ^(data|stringData)$
-    version: 3.9.4
+    version: 3.8.0

kubernetes/main/apps/monitoring/kube-prometheus-stack/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: kube-prometheus-stack
-      version: "70.7.0"
+      version: "69.3.1"
       sourceRef:
         kind: HelmRepository
         name: prometheus-community-charts

kubernetes/main/apps/monitoring/proxmoxve-exporter/helm-release.yaml

@@ -17,7 +17,7 @@ spec:
   values:
     image:
       repository: prompve/prometheus-pve-exporter
-      tag: "3.5.3"
+      tag: "3.5.1"
 
     args:
     - --config.file

kubernetes/main/apps/monitoring/victoria-metrics/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: victoria-metrics-single
-      version: 0.17.1
+      version: 0.13.10
       sourceRef:
         kind: HelmRepository
         name: victoria-metrics-charts

kubernetes/main/apps/tools/vaultwarden/ks.yaml

@@ -8,7 +8,7 @@ spec:
   timeout: 5m
   interval: 10m
   targetNamespace: tools
-  path: ./kubernetes/main/apps/tools/vaultwarden/app
+  path: ./kubernetes/main/apps/tools/vaultwarden
   prune: true
   sourceRef:
     kind: GitRepository
@@ -29,4 +29,4 @@ spec:
         name: cluster-secrets
     substitute:
       APP: *app
-      VOLSYNC_CAPACITY: 5Gi
+      VOLSYNC_CAPACITY: 5Gi

kubernetes/main/core/kube-system/cilium/app/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: cilium
-      version: 1.17.3
+      version: 1.17.1
       sourceRef:
         kind: HelmRepository
         name: cilium

kubernetes/main/core/longhorn/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: longhorn
-      version: "1.8.1"
+      version: "1.8.0"
       sourceRef:
         kind: HelmRepository
         name: longhorn-charts

kubernetes/main/core/traefik/app/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: traefik
-      version: '35.0.1'
+      version: '34.3.0'
       sourceRef:
         kind: HelmRepository
         name: traefik-charts

kubernetes/main/crds/traefik/crds.yaml

@@ -9,7 +9,7 @@ spec:
   url: https://github.com/traefik/traefik-helm-chart.git
   ref:
     # renovate: registryUrl=https://helm.traefik.io/traefik chart=traefik
-    tag: v35.0.1
+    tag: v34.3.0
   ignore: |
     # exclude all
     /*

kubernetes/thin/apps/database/postgresql/app/helm-release.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: cloudnative-pg
-      version: 0.23.2
+      version: 0.23.0
       sourceRef:
         kind: HelmRepository
         name: cloudnative-pg