chore(k8s/jellyfin): update alpine docker tag to v3.24

kubernetes/app/firefly/release.yaml

@@ -26,7 +26,7 @@ spec:
 
     image:
       # renovate: datasource=docker depName=fireflyiii/core
-      tag: version-6.5.9
+      tag: version-6.6.6
 
     podSecurityContext:
       seccompProfile:

kubernetes/app/homepage/deployment.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: homepage
-          image: ghcr.io/gethomepage/homepage:v1.10.1
+          image: ghcr.io/gethomepage/homepage:v2.3.0
           ports:
             - containerPort: 3000
               name: http
@@ -33,8 +33,12 @@ spec:
             - secretRef:
                 name: homepage-credentials
           env:
+            - name: MY_POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
             - name: HOMEPAGE_ALLOWED_HOSTS
-              value: "${HOMEPAGE_HOST}"
+              value: "$(MY_POD_IP):3000,${HOMEPAGE_HOST}"
           volumeMounts:
             - name: config
               mountPath: /app/config/settings.yaml
@@ -54,13 +58,13 @@ spec:
           livenessProbe:
             httpGet:
               port: 3000
-              path: /
+              path: /api/healthcheck
             initialDelaySeconds: 30
             periodSeconds: 30
           readinessProbe:
             httpGet:
               port: 3000
-              path: /
+              path: /api/healthcheck
             initialDelaySeconds: 10
             periodSeconds: 10
           resources:

kubernetes/app/jellyfin/cronjob-backup.yaml

@@ -0,0 +1,163 @@
+# Jellyfin SQLite database backup.
+# jellyfin.db lives on the local-path PVC (/config/data/jellyfin.db is a symlink
+# to it), so it is read from jellyfin-data directly. sqlite3 ".backup" uses the
+# online backup API — no downtime, consistent snapshot while Jellyfin runs.
+# The volume is mounted read-write on purpose: jellyfin.db is in WAL mode, and
+# SQLite cannot open a WAL database from a read-only filesystem once Jellyfin has
+# closed it and removed the -wal/-shm files (e.g. while scaled to zero).
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: jellyfin-db-backup
+  namespace: jellyfin
+  labels:
+    app: jellyfin-backup
+spec:
+  schedule: "30 2 * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: jellyfin-backup
+        spec:
+          restartPolicy: OnFailure
+          initContainers:
+            - name: sqlite-backup
+              image: alpine:3.24
+              command:
+                - sh
+                - -c
+                - |
+                  set -e
+                  apk add --no-cache sqlite
+                  sqlite3 /db-local/jellyfin.db ".backup /backup/jellyfin.db"
+              volumeMounts:
+                - name: db
+                  mountPath: /db-local
+                - name: backup-tmp
+                  mountPath: /backup
+          containers:
+            - name: resticprofile
+              image: creativeprojects/resticprofile:0.32.0
+              command:
+                - sh
+                - -c
+                - |
+                  resticprofile -c /secrets/profiles.yaml -n jellyfin-db backup
+                  resticprofile -c /secrets/profiles.yaml -n jellyfin-db copy
+              env:
+                - name: B2_ACCOUNT_ID
+                  valueFrom:
+                    secretKeyRef:
+                      name: jellyfin-backup-config
+                      key: B2_ACCOUNT_ID
+                - name: B2_ACCOUNT_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: jellyfin-backup-config
+                      key: B2_ACCOUNT_KEY
+              volumeMounts:
+                - name: secrets
+                  mountPath: /secrets
+                  readOnly: true
+                - name: backup-tmp
+                  mountPath: /backup
+          volumes:
+            - name: secrets
+              secret:
+                secretName: jellyfin-backup-config
+            - name: db
+              persistentVolumeClaim:
+                claimName: jellyfin-data
+            - name: backup-tmp
+              emptyDir: {}
+---
+# Jellyfin configuration backup.
+# Only non-regenerable state: server config, library definitions, plugin
+# configuration (including the Authelia SSO settings), collections, and the
+# Intro Skipper analysis results. Metadata (27G), trickplay (20G) and extracted
+# subtitles (1.7G) are deliberately excluded — they are regenerable from the
+# media files and the metadata providers.
+# Intro Skipper keeps its results in two live WAL-mode SQLite databases, so they
+# are snapshotted with sqlite3 ".backup" rather than copied as files (which could
+# capture a torn page mid-write). Read-write mount for the same reason as above.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: jellyfin-config-backup
+  namespace: jellyfin
+  labels:
+    app: jellyfin-backup
+spec:
+  schedule: "30 3 * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: jellyfin-backup
+        spec:
+          restartPolicy: OnFailure
+          initContainers:
+            - name: sqlite-backup
+              image: alpine:3.24
+              command:
+                - sh
+                - -c
+                - |
+                  set -e
+                  apk add --no-cache sqlite
+                  mkdir -p /backup/introskipper
+                  for db in introskipper.db introskipper-cache.db; do
+                    sqlite3 "/config/data/introskipper/$db" ".backup /backup/introskipper/$db"
+                  done
+              volumeMounts:
+                - name: config
+                  mountPath: /config
+                - name: backup-tmp
+                  mountPath: /backup
+          containers:
+            - name: resticprofile
+              image: creativeprojects/resticprofile:0.32.0
+              command:
+                - sh
+                - -c
+                - |
+                  resticprofile -c /secrets/profiles.yaml -n jellyfin-config backup
+                  resticprofile -c /secrets/profiles.yaml -n jellyfin-config copy
+              env:
+                - name: B2_ACCOUNT_ID
+                  valueFrom:
+                    secretKeyRef:
+                      name: jellyfin-backup-config
+                      key: B2_ACCOUNT_ID
+                - name: B2_ACCOUNT_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: jellyfin-backup-config
+                      key: B2_ACCOUNT_KEY
+              volumeMounts:
+                - name: secrets
+                  mountPath: /secrets
+                  readOnly: true
+                - name: config
+                  mountPath: /config
+                  readOnly: true
+                - name: backup-tmp
+                  mountPath: /backup
+          volumes:
+            - name: secrets
+              secret:
+                secretName: jellyfin-backup-config
+            - name: config
+              persistentVolumeClaim:
+                claimName: jellyfin-config
+            - name: backup-tmp
+              emptyDir: {}

kubernetes/app/jellyfin/deployment.yaml

@@ -43,7 +43,7 @@ spec:
               mountPath: /db-local
       containers:
         - name: jellyfin
-          image: jellyfin/jellyfin:10.11.11
+          image: jellyfin/jellyfin:12.0
           env:
             - name: JELLYFIN_PublishedServerUrl
               value: https://${JELLYFIN_HOST}
@@ -62,6 +62,15 @@ spec:
           resources:
             limits:
               gpu.intel.com/i915: "1"
+          # 12.0's first boot runs one-way database migrations that take several
+          # minutes and must not be interrupted. startupProbe holds liveness off
+          # until the server answers; liveness/readiness take over once up.
+          startupProbe:
+            httpGet:
+              port: 8096
+              path: /health
+            failureThreshold: 90
+            periodSeconds: 10
           livenessProbe:
             httpGet:
               port: 8096

kubernetes/app/jellyfin/networkpolicy.yaml

@@ -45,3 +45,29 @@ spec:
           protocol: UDP
         - port: 1900
           protocol: UDP
+---
+# Backup jobs need DNS, the Synology rest-server (8888) and B2 over HTTPS.
+# Declaring egress here also confines the backup pods to exactly those.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-backup-egress
+  namespace: jellyfin
+spec:
+  podSelector:
+    matchLabels:
+      app: jellyfin-backup
+  policyTypes:
+    - Egress
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    - ports:
+        - port: 8888
+          protocol: TCP
+    - ports:
+        - port: 443
+          protocol: TCP

kubernetes/app/jellyfin/renovate.json

@@ -7,6 +7,11 @@
       "matchFileNames": ["kubernetes/app/jellyfin/**"],
       "semanticCommitScope": "k8s/jellyfin"
     },
+    {
+      "matchFileNames": ["kubernetes/app/jellyfin/**"],
+      "matchPackageNames": ["jellyfin/jellyfin"],
+      "versioning": "regex:^(?<minor>\\d+)\\.(?<patch>\\d+)$"
+    },
     {
       "matchFileNames": ["kubernetes/app/jellyfin/**"],
       "matchPackageNames": ["jellyfin/jellyfin"],

kubernetes/app/jellyfin/secret-backup.sops.yaml

@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: jellyfin-backup-config
+    namespace: jellyfin
+stringData:
+    profiles.yaml: ENC[AES256_GCM,data:A1EdRDhXncj5EIjg6iyw+mmiW7ObrGVlBmnQn1GJbF6P+yHmw97h4Hk/yHfMM1tDrNhiy8jpMWmXHGuHa56QFGPQzPCkaMtjqwO2pUcXrdrv8ThVtX3ZgyzvHX1fL5lwDm5aG0mMjuV51+j5URR6P3n+GCCg3OYP/DbEngroT5f7QKhFb4hwHdGnF9tHLwKH/hZrXJIH8XLeJD5BbjHBRFiXEpYlgmHtZ3Vb3SzJRMSMBMH4wBj2obxL2nOqKDXaK/NRV1XHuN+/enKvQaFm9j3h7F4G4MD1Gfr6LwjtGiV5S8ngcQo9gQptardTVqxTtKHKA80pbtSoqwP3TuR6Vh6U9KNqDiaLte6wqoOxQ6Tb3oCTnFJOLn1WE/PBxTPp9VDRfwXBlhPtYK8JhaTcQHdjkM1xw3qzyL09XMNKWf1wvlaoszurwlxI+bSKNlDQjC/dUd/j067xFf1SRNze++75QJkrp1o2+4DCrdK4QiPd9FeacgUml/uI957i0ZkBQLTn9WHUcp7kLmALzu8byDHgf2jkHYEfJ3QKg5yjpE0aQ2Iub/8fnQC732YOUGeP5HKcFTl8fU4xdRrIPbz8K728FYukeU4pzLQY+2qOENfMSFoVMIYpD5LSyv+RqIejb6x1ZYIchPQ91aBsnkXRSL6b2Lj60vccF1cyilrPAgBAzM6FeAvAHqbalSMdvyMwd6AgHgW0jOE9dGquxQfliCyoU9vcsNKY/2y01MWiH7wa80IjvrrUTiuQHh7h2g+JYqiXoyA2R9qXQBScjiWQbtUAYQjBqqKGdTSxiUzYiCBw75FMJxj2BUE739bQQNCBN18WLSyietS7LiTu50cL0jD79zNYGqi4vduHdK+MZuhZa5I/5OoHo71VGj1nkyKYBOemA5zdW3xbS4ZOnblOYeEkhx0It1KafAbN4JnY7ZPCQqH7JyAxKIV1YR4zKEMpFgEzIKUFl0Cr7PrZ5/hoA6HhuzzWq6GvtQ+4PJusp5Spu+d7AEZLSPqPrSlK6iCQA3nKG+A/wau4BI4P83Q2LzW5Aa4aujNZJ+mCYAyPkkQqt6+MTWgFCKa61fZT8Rypw+q1+BRJrY+/2PU/DUeEBb6hBTcL24YRHEkcPlcU4FkK4/WppALM/FWySFgfdwL9XqhOWwuhJ3nfMFEMFR9TkbrTHGNzC7JRTcIo4FIhvgoNtQ2WujgB01a79cqGcw2sSWDTeUCH5SaeYiQSfmI1n7OyBP9vk3pc8FrqRVZkpetlrYCdart6FKDuO+P4YhOpk42GrL+0lWis4Hkmos9REpKP0jAkvgcI9nDHTq1stHbPuqVXsBaah0mrbk450ZAREmGMx/4Gc3ltXh8YfgT26HSDCl3SRtXgnLsTA9XKYgR1zgvT8a82EYDg08af5X1yGQFutxIkfIwIijAIx+Y9NY6KeWvgBYxjgkKkNvY29kCZZ5POKw5L9YiMOcp4jSTK+dNdPqCWplSzyaLgrFGBbzOcQVagm9UkZEXLv44H60fMMExdHzuo81Bh1JV6luVqqDcHlnigxM6QNMNavgT6G60kFfRmEyRldSrpefKkH9GtxJMJgWMgZhhdDkkOzFsou/GuaWCLQp3JyOmZiKisJu5Nytkl4h0rPGR+Oe26Z5IxCYOjRgmp8+TT4JMmHIvlL7Ljf1PRQS6eWz9ICvoK/nvLaj0/rjEvQ9BZKY1WVzGGSYrvrNzNbprhaT6+DE1Xdd9qmwaP+B9czB54KCrKd17knL0GWYkneOM/M+UNeD4nDeK8fShHJeIYI5+7QRh54BsGlmwgw8mYnysagsQeav56aZC7Lcg3e1uCeVSHY7RdrUJ7i+++5v95TpIP8tQCFO5RvlIp7UPChdHOyxqlGqGMWs66Jvpq47ENN6OObAdR0uAHPA/MsvVO0ygmANE8Sog2JLJbQO6+3Wsmg/n+Is2Ps1lEjSft6Kn/SrmPG3ilOedpirrnn1cfWOHAXtfruZ9xB2GIdhBHgVFgjSUmAvd+9R+MV+urq3d/Czr1+w2WDryOPPw=,iv:+DuENxnJKTQ3ZKom2uNsW7QU1eMsrO+ZFCo5aW51pwE=,tag:4MiKklkRuvJuCvlu8tV07w==,type:str]
+    restic-password-nas: ENC[AES256_GCM,data:2uDszBmHa4YG1oYyhN4Wjw0Lcc6/MpmrCHldwNF22kFiokbx4R+zrd8ML4NvK1ezmQmMDhlb3RsyAcQNRgJ9Ng==,iv:96pdW1B6M97+eG1EC2YPbNmO4OQmt47uiJOWuvzdYzE=,tag:dQKHD+2LeWL5+tcQbrbN0g==,type:str]
+    restic-password-b2: ENC[AES256_GCM,data:ceHYbKn174cIm38qnlGvx9edxP8apPWkwx7wAkNncSF6kIE5OvXVsNAWcjsZKQLEgYXFX5NwLZMDPY0edtAhNQ==,iv:mDki/Soljcnp60cfihK2EqfTNHv/VnoieetBThFqLtE=,tag:5VMRM0fe4nFDal3BO+ninw==,type:str]
+    B2_ACCOUNT_ID: ENC[AES256_GCM,data:6u+UlYRILbb0TRTdISi7TdVItw4omfodFw==,iv:A+be6o3ZjfYsyvEk750DcoSlBsKYM2FncSY8kqkcpqs=,tag:9ReTmil5sAfo+04IfdaKYw==,type:str]
+    B2_ACCOUNT_KEY: ENC[AES256_GCM,data:p+irC0iQR3RjhmElD+tZcXcgWsV8ROGHsEOJ7kxXvg==,iv:2VgptxIaJ0v1e5jejLyBIPHnvxD6ldgTWn/3oa1M32Y=,tag:9gHDOD0524IAoQQLOytT+w==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5Mk5NMVNxOG5JWHhkMjlh
+            YzRyYVhYT2tncmVzRzB5NXc2aEZQcUVtVFUwCnl2U2JQSkdpTjZVb1pPTmlPeVRt
+            SURJNFFzUTFTdVZpckV5d2puN2xQTmcKLS0tIDUxeXFLdGxOdDVLdng2SFRWb296
+            NFpDSkZmYkY0Vyt4Nml3N3VXbFdZZ0kKfNoqtyb+16qpDdCHgp3uiDCHqtiDXEjB
+            p1kaQkgF6xqFohomV+6x0RsW+r7PaGh8oWRut0NBRahZwIKBucZUTw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+    encrypted_regex: ^(data|stringData|email)$
+    lastmodified: "2026-09-13T13:09:04Z"
+    mac: ENC[AES256_GCM,data:E8xZZ+0hdRPKE/nss00gopEg7feF7t4pXBqYkEtr9yzHn1Vz4Opfv4vBDDgwqntZdekE40rpzWTuPJDAfOrhDsCsgZjOgWa6VpSRNM9GQ37Ax/fv/G42CXtwBPCzY1p2GuXr9nsJI+/P4c6sx4FIXZ0o4QLCHuStkYpjbHlyIFA=,iv:LJCUP/KbZ0tZPdG2hedHfZMfYWS+w4T73JaI7nLe2uQ=,tag:J7GT2jm6iHFZ8oMV2ecEIw==,type:str]
+    version: 3.13.3

kubernetes/app/lubelogger/release.yaml

@@ -18,7 +18,7 @@ spec:
   values:
     image:
       # renovate: datasource=docker depName=ghcr.io/hargata/lubelogger
-      tag: "v1.6.1"
+      tag: "v1.7.3"
 
     updateStrategy:
       type: RollingUpdate

kubernetes/app/paperless/deployment-tika.yaml

@@ -21,7 +21,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: tika
-          image: apache/tika:3.2.3.0
+          image: apache/tika:3.3.1.0
           env:
             - name: TZ
               value: Europe/Kyiv

kubernetes/app/paperless/deployment.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: paperless
-          image: ghcr.io/paperless-ngx/paperless-ngx:2.20
+          image: ghcr.io/paperless-ngx/paperless-ngx:3.1
           ports:
             - containerPort: 8000
               name: http