chore(k8s/gitea): update gitea/gitea docker tag to v28

README.md

@@ -63,6 +63,7 @@ homelab-v2/
 | **Blog** | Personal static blog served via git-sync + nginx (gh-pages branch) |
 | **Vikunja** | To-do list and task management, SSO via Authelia OIDC |
 | **Reitti** | Personal location history and timeline (PostGIS), SSO via Authelia OIDC |
+| **Dawarich** | Location history and timeline (PostGIS + Sidekiq), evaluated as a Reitti replacement; SSO via Authelia OIDC |
 
 ## Infrastructure Stack
 

kubernetes/app/archmirror/configmap-nginx.yaml

@@ -6,6 +6,8 @@ metadata:
   namespace: archmirror
 data:
   nginx.conf: |
+    worker_processes auto;
+
     events {
         worker_connections 1024;
     }
@@ -15,6 +17,8 @@ data:
         default_type application/octet-stream;
 
         sendfile on;
+        # NFS reads block the worker; offload them so /health keeps answering
+        aio threads;
         gzip on;
 
         server {

kubernetes/app/dawarich/deployment-redis.yaml

@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dawarich-redis
+  namespace: dawarich
+  labels:
+    app: dawarich-redis
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: dawarich-redis
+  template:
+    metadata:
+      labels:
+        app: dawarich-redis
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 999    # redis user in the alpine image
+        runAsGroup: 999
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: redis
+          image: redis:7.4.11-alpine
+          imagePullPolicy: IfNotPresent
+          # Sidekiq job queue. Snapshots (as in upstream compose) survive container restarts;
+          # the emptyDir is lost with the pod, which only drops queued jobs.
+          args: ["--save", "900", "1", "--save", "300", "10", "--appendonly", "no"]
+          ports:
+            - containerPort: 6379
+              name: redis
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          livenessProbe:
+            tcpSocket:
+              port: 6379
+            periodSeconds: 30
+          readinessProbe:
+            tcpSocket:
+              port: 6379
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 20m
+              memory: 32Mi
+            limits:
+              memory: 256Mi
+      volumes:
+        - name: data
+          emptyDir: {}

kubernetes/app/dawarich/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dawarich

kubernetes/app/dawarich/networkpolicy.yaml

@@ -0,0 +1,114 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-ingress
+  namespace: dawarich
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-ingress-controller
+  namespace: dawarich
+spec:
+  podSelector:
+    matchLabels:
+      app: dawarich
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-app-to-db
+  namespace: dawarich
+spec:
+  podSelector:
+    matchLabels:
+      app: dawarich-db
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: dawarich
+      ports:
+        - port: 5432
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-backup-to-db
+  namespace: dawarich
+spec:
+  podSelector:
+    matchLabels:
+      app: dawarich-db
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: dawarich-backup
+      ports:
+        - port: 5432
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-backup-egress
+  namespace: dawarich
+spec:
+  podSelector:
+    matchLabels:
+      app: dawarich-backup
+  policyTypes:
+    - Egress
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    - ports:
+        - port: 8888
+          protocol: TCP
+    - ports:
+        - port: 443
+          protocol: TCP
+    - ports:
+        - port: 5432
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app: dawarich-db
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-app-to-redis
+  namespace: dawarich
+spec:
+  podSelector:
+    matchLabels:
+      app: dawarich-redis
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: dawarich
+      ports:
+        - port: 6379

kubernetes/app/dawarich/release.yaml

@@ -0,0 +1,190 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: dawarich
+  namespace: flux-system
+spec:
+  chart:
+    spec:
+      chart: dawarich
+      version: 2.9.3
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        kind: HelmRepository
+        name: cogitri
+        namespace: flux-system
+  targetNamespace: dawarich
+  interval: 1m0s
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  # The chart hardcodes an unpinned busybox wait-for-postgres init container, no deployment
+  # strategy, and a 130s web startupProbe — too short for the first start, which runs every
+  # migration and seeds the countries table before Puma listens.
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              kind: Deployment
+              name: dawarich
+            patch: |
+              apiVersion: apps/v1
+              kind: Deployment
+              metadata:
+                name: dawarich
+              spec:
+                strategy:
+                  type: Recreate
+                template:
+                  spec:
+                    initContainers:
+                      - name: wait-for-postgres
+                        image: busybox:1.37
+                        imagePullPolicy: IfNotPresent
+                    containers:
+                      - name: dawarich
+                        startupProbe:
+                          failureThreshold: 60
+                        livenessProbe:
+                          periodSeconds: 30
+                          timeoutSeconds: 10
+                          failureThreshold: 6
+                        readinessProbe:
+                          timeoutSeconds: 5
+          - target:
+              kind: Deployment
+              name: dawarich-sidekiq
+            patch: |
+              apiVersion: apps/v1
+              kind: Deployment
+              metadata:
+                name: dawarich-sidekiq
+              spec:
+                strategy:
+                  type: Recreate
+                template:
+                  spec:
+                    initContainers:
+                      - name: wait-for-postgres
+                        image: busybox:1.37
+                        imagePullPolicy: IfNotPresent
+  values:
+    # Release name is dawarich-dawarich (targetNamespace prefix); keep resource names short.
+    fullnameOverride: dawarich
+
+    image:
+      # renovate: datasource=docker depName=freikin/dawarich
+      tag: "1.16.0"
+
+    keyBase:
+      existingSecret: dawarich-credentials    # key: value
+
+    # Every key is rendered into the ConfigMap as UPPER_SNAKE_CASE.
+    env:
+      timeZone: Europe/Kyiv
+      # TLS terminates at Traefik; "https" here turns on Rails force_ssl.
+      applicationProtocol: http
+      distanceUnit: km
+      # Upstream compose default; each thread holds an import batch in memory.
+      backgroundProcessingConcurrency: "3"
+      # OIDC-only login (blocks the web form and the API password sign-in since 1.14.4).
+      allowEmailPasswordLogin: "false"
+
+    # Authentication against Authelia over OIDC only. Unknown Authelia users are auto-created
+    # as regular (non-admin) users.
+    oidc:
+      enabled: true
+      providerName: Authelia
+      clientId:
+        existingSecret: dawarich-credentials
+        existingSecretKeyName: OIDC_CLIENT_ID
+      clientSecret:
+        existingSecret: dawarich-credentials
+        existingSecretKeyName: OIDC_CLIENT_SECRET
+      issuer: https://auth.${AUTHELIA_DOMAIN}
+      redirectUri: https://${DAWARICH_HOST}/users/auth/openid_connect/callback
+      autoRegister: true
+      allowEmailPasswordRegistration: false
+
+    dawarich:
+      hosts:
+        - ${DAWARICH_HOST}
+      resources:
+        requests:
+          cpu: 100m
+          memory: 512Mi
+        limits:
+          memory: 2Gi
+
+    sidekiq:
+      resources:
+        requests:
+          cpu: 100m
+          memory: 512Mi
+        limits:
+          memory: 4Gi    # imports parse whole files in memory (Google Records.json)
+
+    postgresql:
+      host: dawarich-db
+      auth:
+        database: dawarich
+        existingSecret: dawarich-credentials    # keys: username, password
+
+    # Own single Redis (deployment-redis.yaml) instead of the bundled 3-node redis-ha.
+    redis:
+      enabled: false
+      host: dawarich-redis
+      auth: false
+
+    # RWO volumes shared by web and sidekiq — fine on the single node.
+    persistence:
+      public:
+        # Static assets, re-synced from the image on every web start.
+        storageClass: nfs-synology-ssd
+        size: 1Gi
+      watched:
+        # Drop folder: <user-email>/<file> is auto-imported.
+        storageClass: nfs-synology-ssd
+        size: 1Gi
+      storage:
+        # ActiveStorage: uploaded imports, exports, videos.
+        storageClass: nfs-synology-ssd
+        size: 10Gi
+
+    serviceAccount:
+      automount: false
+
+    podLabels:
+      app: dawarich
+
+    # The image starts as root only to chown volumes and gosu-drop when PUID/PGID are set.
+    # Running as 1000 directly skips that; tmp/ is 0777 in the image and the NFS subdir
+    # provisioner creates directories 0777.
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 1000
+      runAsGroup: 1000
+      seccompProfile:
+        type: RuntimeDefault
+    securityContext:
+      allowPrivilegeEscalation: false
+
+    ingress:
+      enabled: true
+      # No Authelia forward-auth middleware — Dawarich authenticates against Authelia
+      # natively over OIDC. A middleware here would break the OIDC callback and the
+      # api_key-authenticated /api ingest endpoints (OwnTracks, Overland, mobile app).
+      annotations:
+        cert-manager.io/cluster-issuer: letsencrypt
+      hosts:
+        - host: ${DAWARICH_HOST}
+          paths:
+            - path: /
+              pathType: Prefix
+      tls:
+        - secretName: dawarich-tls
+          hosts:
+            - ${DAWARICH_HOST}

kubernetes/app/dawarich/renovate.json

@@ -0,0 +1,38 @@
+{
+  "kubernetes": {
+    "fileMatch": ["kubernetes/app/dawarich/.+\\.yaml$"]
+  },
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": ["kubernetes/app/dawarich/release\\.yaml$"],
+      "matchStrings": [
+        "#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)\\s*\\n\\s*tag:\\s*[\"']?(?<currentValue>[^\\s\"']+)"
+      ]
+    }
+  ],
+  "packageRules": [
+    {
+      "matchFileNames": ["kubernetes/app/dawarich/**"],
+      "semanticCommitScope": "k8s/dawarich"
+    },
+    {
+      "matchFileNames": ["kubernetes/app/dawarich/**"],
+      "matchPackageNames": ["freikin/dawarich"],
+      "matchUpdateTypes": ["patch", "minor"],
+      "automerge": true
+    },
+    {
+      "matchFileNames": ["kubernetes/app/dawarich/**"],
+      "matchPackageNames": ["freikin/dawarich"],
+      "matchUpdateTypes": ["major"],
+      "automerge": false
+    },
+    {
+      "description": "Ignore infrastructure images",
+      "matchFileNames": ["kubernetes/app/dawarich/**"],
+      "matchPackageNames": ["postgis/postgis", "redis", "creativeprojects/resticprofile"],
+      "enabled": false
+    }
+  ]
+}

kubernetes/app/dawarich/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cogitri
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  url: https://charts.cogitri.dev

kubernetes/app/dawarich/secret.sops.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: dawarich-credentials
+    namespace: dawarich
+stringData:
+    #ENC[AES256_GCM,data:3gPe9ezMvEnV02kKbZkjtsq2FmJJzXmhtp6CfwYh8icAv/PdAwa3DQCu0oRbgkIV9claZCqDSrhPIaYy5wsQUshL8hyGUYDm/mLNVDsAl9HPz6MlDA==,iv:QOG8JpMEA3IYlcLyrWM8yH9ZHbpwNM1EpC+02J8PCDU=,tag:eIGomi40Pe+7MSOU8POO4w==,type:comment]
+    username: ENC[AES256_GCM,data:Tpj/Iq4oLlg=,iv:9RORl+XlNqG87y3qsqCNj/oRrLzmdVlZCAXD4R1RfXY=,tag:67MSd0HIYEhTqQYfDNUJ2g==,type:str]
+    password: ENC[AES256_GCM,data:BhB59Y5J5pKobyKWOsIWP8jMxPzkL12TkFrTJuCGexw=,iv:VDJdyx7dyHgZh/doBTxBfAiN3NqzmvdCz3Hpxwsafac=,tag:AUtd1ubgOWMbgxm2FzfDpw==,type:str]
+    value: ENC[AES256_GCM,data:Ok4GM6+qnZSQ3c9fyedlXE+LlAoSzIvIQMrCSKLPGp3TQT6PpbouXbR0QveZWZgROmexn0YMs62WCkCdfNfv2DC7SooJ+EksWHKi/m8UTWay7X/WYBlMmSClS3/MeFwsRz5/G4MayIT166C6OhXKB2rPicRMzlU+3dbL9MBDLpw=,iv:gi6C0rbYy3Ie6ati6ACnlqeXjONR/HC3o8xmPGUIF/Y=,tag:jcAQ3YSWZ1DZqr8u+KIBWg==,type:str]
+    OIDC_CLIENT_ID: ENC[AES256_GCM,data:qddOrkEvw0g=,iv:NrS1vRqZG3/4cQyWtEONu16GbFlHJplcHVc75h7+CpQ=,tag:l5Fu5vsPiU6rFGFWziCnzg==,type:str]
+    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:uisMM3Gd6ChnLvg/eyxff9ZGq6uAfs9fryuVOgf+ZGVexKoRn0NT1Ic7rpJ9pUwzhTAO6WGo941MdJmkSxbxXw==,iv:HNZhiPMTMk/aG7Z9hr0r97CFzo8C0PKRL3FtIW2vGns=,tag:+sbLFE2zbdn4M4eyWrvqTA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTSUdIeXZKNDBVcXVURWpz
+            Wmwrd1hWb0tTcDFmMWZHVG4vZmFmUDNZUnhjCk1PVzQ2RG5Qa2VQZk5PV1VwS09M
+            YUdzVWtsc3dJY256dzRkUTMxdG83OGsKLS0tIERBVVRXTTBsYk1jTTRadmNoOHM0
+            c1F5Q1RsQ1Y1SW9rQUw1ZkwrVVREV1UKI0bO6Nq92fPVPqImWMtWCe5s4r5pLGAf
+            6FWWzTkerOnQ4n7iGoAPtnuFbo6wUBypm4yirbgX6ErzU5vTWJWHWw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+    encrypted_regex: ^(data|stringData|email)$
+    lastmodified: "2026-10-08T10:16:10Z"
+    mac: ENC[AES256_GCM,data:HcMG1/LqcljJ6b6LZvXZqKdT3LGFNikH/1PQKzxL+71lwSqlg3k5L0pDNObSfRZeYMeCQTMJWCzgt2qlUlpML58DFTRC0B6K3bofHJixhJT1cS62rzngR0iRY4KVepI6qZACfTh8mwzt15Zrpy9ZMRvV1GSwnxpgaXJVyCMqWnw=,iv:7GHyXB1nA1WAbkI396l4Vw5RtcsYW9n70b+ybOUo6ds=,tag:YbqsKjek9ZnExzghSupuDw==,type:str]
+    version: 3.13.3

kubernetes/app/dawarich/service-db.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: dawarich-db
+  namespace: dawarich
+spec:
+  clusterIP: None
+  selector:
+    app: dawarich-db
+  ports:
+    - port: 5432
+      targetPort: 5432

kubernetes/app/dawarich/service-redis.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: dawarich-redis
+  namespace: dawarich
+spec:
+  selector:
+    app: dawarich-redis
+  ports:
+    - port: 6379
+      targetPort: 6379
+      name: redis

kubernetes/app/dawarich/statefulset-db.yaml

@@ -0,0 +1,88 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: dawarich-db
+  namespace: dawarich
+  labels:
+    app: dawarich-db
+spec:
+  serviceName: dawarich-db
+  replicas: 1
+  selector:
+    matchLabels:
+      app: dawarich-db
+  template:
+    metadata:
+      labels:
+        app: dawarich-db
+    spec:
+      securityContext:
+        runAsUser: 999
+        runAsGroup: 999
+        fsGroup: 999
+      containers:
+        - name: postgres
+          # Dawarich requires PostGIS; the Debian variant keeps the postgres user at UID 999
+          # (the alpine variant upstream uses has 70). The image creates the postgis extension in POSTGRES_DB.
+          image: postgis/postgis:17-3.5
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: dawarich-credentials
+                  key: username
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: dawarich-credentials
+                  key: password
+            - name: POSTGRES_DB
+              value: dawarich
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          ports:
+            - containerPort: 5432
+          startupProbe:
+            tcpSocket:
+              port: 5432
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            failureThreshold: 30
+          livenessProbe:
+            tcpSocket:
+              port: 5432
+            periodSeconds: 30
+            failureThreshold: 5
+          readinessProbe:
+            tcpSocket:
+              port: 5432
+            periodSeconds: 10
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 50m
+              memory: 256Mi
+            limits:
+              memory: 2Gi    # includes the 1Gi /dev/shm below
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+            - name: shm
+              mountPath: /dev/shm
+      volumes:
+        # Upstream compose sets shm_size: 1G — parallel queries over the points table
+        # exceed the 64M container default.
+        - name: shm
+          emptyDir:
+            medium: Memory
+            sizeLimit: 1Gi
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        storageClassName: nfs-synology-ssd
+        resources:
+          requests:
+            storage: 10Gi

kubernetes/app/firefly/release.yaml

@@ -26,7 +26,7 @@ spec:
 
     image:
       # renovate: datasource=docker depName=fireflyiii/core
-      tag: version-6.7.7
+      tag: version-6.7.9
 
     podSecurityContext:
       seccompProfile:

kubernetes/app/gitea/release.yaml

@@ -199,11 +199,11 @@ spec:
         type: RuntimeDefault
 
     image:
-      # renovate: currentValue=1.27.3-rootless currentDigest=sha256:1c17ecaead42eb3b5391553d8708103a4beb0e86edf5b9ebc1eb269c318845f2
+      # renovate: currentValue=28.2.0-rootless currentDigest=sha256:94807314454f6525994a3b76286ba12bc7e7f8cd14f61d9e67431767f8103306
 
-      tag: 1.27.3
+      tag: 28.2.0
 
-      digest: sha256:1c17ecaead42eb3b5391553d8708103a4beb0e86edf5b9ebc1eb269c318845f2
+      digest: sha256:94807314454f6525994a3b76286ba12bc7e7f8cd14f61d9e67431767f8103306
       rootless: true
       pullPolicy: IfNotPresent
 

kubernetes/app/homepage/deployment.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: homepage
-          image: ghcr.io/gethomepage/homepage:v2.4.0
+          image: ghcr.io/gethomepage/homepage:v2.6.0
           ports:
             - containerPort: 3000
               name: http

kubernetes/app/immich/release.yaml

@@ -28,7 +28,7 @@ spec:
           main:
             image:
               repository: ghcr.io/immich-app/immich-server
-              tag: v3.2.4
+              tag: v3.3.3
             resources:
               requests:
                 cpu: 100m

kubernetes/app/lubelogger/release.yaml

@@ -18,7 +18,7 @@ spec:
   values:
     image:
       # renovate: datasource=docker depName=ghcr.io/hargata/lubelogger
-      tag: "v1.7.3"
+      tag: "v1.7.4"
 
     updateStrategy:
       type: RollingUpdate

kubernetes/app/media/deployment-prowlarr.yaml

@@ -49,6 +49,9 @@ spec:
           envFrom:
             - configMapRef:
                 name: media-common-env
+          env:
+            - name: PROWLARR__SERVER__TRUSTEDNETWORKS
+              value: ${POD_CIDR}
           ports:
             - containerPort: 9696
               name: http

kubernetes/app/media/deployment-radarr.yaml

@@ -58,6 +58,9 @@ spec:
           envFrom:
             - configMapRef:
                 name: media-common-env
+          env:
+            - name: RADARR__SERVER__TRUSTEDNETWORKS
+              value: ${POD_CIDR}
           ports:
             - containerPort: 7878
               name: http

kubernetes/app/media/deployment-sonarr.yaml

@@ -58,6 +58,9 @@ spec:
           envFrom:
             - configMapRef:
                 name: media-common-env
+          env:
+            - name: SONARR__SERVER__TRUSTEDNETWORKS
+              value: ${POD_CIDR}
           ports:
             - containerPort: 8989
               name: http

kubernetes/app/paperless/deployment.yaml

@@ -86,6 +86,31 @@ spec:
               value: allauth.socialaccount.providers.openid_connect
             - name: PAPERLESS_SOCIALACCOUNT_ALLOW_SIGNUPS
               value: "false"
+            - name: PAPERLESS_AI_ENABLED
+              value: "true"
+            - name: PAPERLESS_AI_LLM_BACKEND
+              value: openai-like
+            - name: PAPERLESS_AI_LLM_ENDPOINT
+              value: https://api.anthropic.com/v1/
+            - name: PAPERLESS_AI_LLM_MODEL
+              value: claude-haiku-5-5
+            - name: PAPERLESS_AI_LLM_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: paperless-ai
+                  key: anthropic-api-key
+            # Haiku 5.5 only accepts temperature 1; llama-index defaults to 0.1
+            - name: PAPERLESS_AI_LLM_EXTRA_PARAMS
+              value: '{"temperature": 1}'
+            - name: PAPERLESS_AI_LLM_OUTPUT_LANGUAGE
+              value: Ukrainian
+            - name: PAPERLESS_AI_LLM_EMBEDDING_BACKEND
+              value: huggingface
+            - name: PAPERLESS_AI_LLM_EMBEDDING_MODEL
+              value: intfloat/multilingual-e5-small
+            # matches the embedding model's 512-token input limit
+            - name: PAPERLESS_AI_LLM_EMBEDDING_CHUNK_SIZE
+              value: "512"
           volumeMounts:
             - name: data
               mountPath: /usr/src/paperless/data
@@ -110,9 +135,9 @@ spec:
           resources:
             requests:
               cpu: 100m
-              memory: 512Mi
+              memory: 1536Mi
             limits:
-              memory: 5Gi
+              memory: 6Gi
       volumes:
         - name: data
           persistentVolumeClaim:

kubernetes/app/paperless/secret-ai.sops.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: paperless-ai
+    namespace: paperless
+stringData:
+    anthropic-api-key: ENC[AES256_GCM,data:kTSTHIO771Zl8/kEyv1seKF1GyodZ4lxhjUSjsyIyCneC+aFdqrq/QYFnqtlQnjBOMq94LQxy0T4Ox2an2+0v2ywP+lIZzYDkE22JdXgbJgCW2aJTBqPtEFV7M2EP0LexDeD2aqebwicxA==,iv:IeO0+Y3jAL0iYM3UbpTtFU7TgqogUYt2gipYUJO2ABQ=,tag:qffHT+GkrNWFmJ1EffHEWg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4Nzg2Zmc4ZVNvRzhzQmVp
+            Mlp6MXhRUExmOU1yWHRESmhBQWlsczZCZEQ0CmkvZDEzVTFwWmt6N3E5eXlsQ0d5
+            VDU1YWIvRDdocXFQNlhnK29CNDVtME0KLS0tIEMybTgzaGs4cVEyeTdEL1RPUmR3
+            S2VvK2FMZ0JnQWJUZG41MmIrRjkxVHcKzjclDColGY9ciQZPRodQrH8UkmsHTsTC
+            hExT/sbhwIznhryfzw/Wkgrm8bzH4NxEkjOWRXvEEJ7Fp5gkvfo0tQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+    encrypted_regex: ^(data|stringData|email)$
+    lastmodified: "2026-10-10T18:39:57Z"
+    mac: ENC[AES256_GCM,data:SG3jk09+cI2mYvovl8PvT5Ay8QrD/wWYVJAdJWhE83bI+MgwgoXvkdW9B+3epcIfvNWV4Z83w2vS89+bo5k81CEIu66yAQPDA+wSCReiRalZdHYGidmnW5ZccmfjTGTNRIIY8RbJlB2ZW6EJJnjjT8Bp4wZskIk5EhGhU2+5jg8=,iv:XeyO9yKzZv6qHwe3LfBqqeRJ3gnU1AmGmeVv3Zp/UyY=,tag:xCgbaWR4fd738hF2T/QVAw==,type:str]
+    version: 3.13.3

kubernetes/app/reitti/deployment-tile-cache.yaml

@@ -23,7 +23,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: tile-cache
-          image: dedicatedcode/reitti-tile-cache:5.6.1
+          image: dedicatedcode/reitti-tile-cache:5.7.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80

kubernetes/app/reitti/deployment.yaml

@@ -28,7 +28,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: reitti
-          image: dedicatedcode/reitti:5.6.1
+          image: dedicatedcode/reitti:5.7.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

kubernetes/config/cluster-vars.sops.yaml

@@ -39,6 +39,8 @@ stringData:
     VIKUNJA_HOST: ENC[AES256_GCM,data:1VVkvVrdx02jPxHsQoQI9zJKN9v/9mE=,iv:ZagDcljNclEGvmMzS6pJWTv+FMa/a/X6POaWb+kHJuo=,tag:RuaUoX8O4LrEs491Sp4UyQ==,type:str]
     BACKUP_LOCAL_HOST: ENC[AES256_GCM,data:ABaTI3NKkhF7K2FpPwvvrHA0l/tCxAi4Qek=,iv:34ixxSpKU1c12uoMdk4nz2Vo/+5A/npB7NWMsWFytIM=,tag:qjw2fQBebCKnqCnAPiBHaw==,type:str]
     REITTI_HOST: ENC[AES256_GCM,data:Zx0T6aUL/v6ogX1miRxzDmDQ31EImg==,iv:0LBRaaG1FHBXFWrtDX8Z6Cs75BEA7hNYm5FFrBHhyYk=,tag:Tup6HoL6E+L9GJKmv3x17Q==,type:str]
+    DAWARICH_HOST: ENC[AES256_GCM,data:Gpt9acoks8gnlvHnMLsFhH18fzu0sLjp,iv:QrJd20KcFtMlWarCgMVv1riUlJF3Qj/aYa2vJQizmpg=,tag:JTmmJHZ9u4ecg3/8frYSEA==,type:str]
+    POD_CIDR: ENC[AES256_GCM,data:TX6OQd+8IlgAk2C2kQ==,iv:F+sDxOPvWg3dgPB8NlzfpC7toY88FBeKXzjgUSk1H8M=,tag:NUdzsKszagRhG2+U4YlOcw==,type:str]
 sops:
     age:
         - enc: |
@@ -51,6 +53,6 @@ sops:
             -----END AGE ENCRYPTED FILE-----
           recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
     encrypted_regex: ^(data|stringData|email)$
-    lastmodified: "2026-10-03T20:20:00Z"
+    lastmodified: "2026-10-18T10:53:13Z"
-    mac: ENC[AES256_GCM,data:xN+k2RvU+IJyYzLRIExm0qM5F/K4s19jm0Sp1fo4L3V2dZHSb1J/JtdtxpbalA3qGxy82qDosagrhrNtdsL2/Ht7JO5f1T3Q1Z5smOBOkvWrjPqnyOWGGwe4j77UY41k50kXNh1VFbhjBYkEei+8191BlMkEmTNSdBvFdvzydIw=,iv:1Q3otFunhnMgrJI8z4XFsp92PHmogEvYi99qAkgJomo=,tag:ikTXnDjTG9fNFrumBGW5Lw==,type:str]
+    mac: ENC[AES256_GCM,data:UqYOF0M6gaVjrE3/OQK/vQ0+lUcwan6fIvrJnm2BE6O28pDFL9iIDAo1ebp0oYhT8+cxNl/tTGlfH5TCblxpSCzu77/8eOgTdn19xqhTC8H8Yw56HVnYWNKZaQTyH+Qw6cG9HFf+d5OTYKeOEZufxZzpF7gT6M8BIssQ1vxEFQM=,iv:Vt1ln9ur5Dejod4X2+JUxwMwjlS198EWMASIw0Gf3Hk=,tag:NSnVkPLLTkHckVLEdTylWg==,type:str]
     version: 3.13.3

renovate.json

@@ -13,7 +13,8 @@
     "local>oleksandr/homelab//kubernetes/app/lubelogger/renovate.json",
     "local>oleksandr/homelab//kubernetes/app/firefly/renovate.json",
     "local>oleksandr/homelab//kubernetes/app/podsync/renovate.json",
-    "local>oleksandr/homelab//kubernetes/app/reitti/renovate.json"
+    "local>oleksandr/homelab//kubernetes/app/reitti/renovate.json",
+    "local>oleksandr/homelab//kubernetes/app/dawarich/renovate.json"
   ],
   "enabledManagers": ["kubernetes", "custom.regex"],
   "automergeType": "branch",