chore(k8s/gitea): update gitea/gitea:1.26.1-rootless docker digest to 4c42564

README.md

@@ -26,6 +26,7 @@ homelab-v2/
     │   └── configs/        # ClusterIssuer, MetalLB config
     ├── app/
     │   ├── archmirror/
+    │   ├── blog/
     │   ├── external/       # External service vars (e.g. Home Assistant)
     │   ├── firefly/
     │   ├── gitea/
@@ -58,6 +59,7 @@ homelab-v2/
 | **Homepage** | Dashboard aggregator |
 | **Podsync** | Podcast downloader |
 | **Archmirror** | Local Arch Linux package repository mirror |
+| **Blog** | Personal static blog served via git-sync + nginx (gh-pages branch) |
 
 ## Infrastructure Stack
 

kubernetes/app/blog/configmap-nginx.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blog-nginx-config
+  namespace: blog
+data:
+  default.conf: |
+    server {
+        listen 8080;
+        server_name _;
+        root /git/current;
+        index index.html;
+
+        location /health {
+            access_log off;
+            return 200 "OK";
+            add_header Content-Type text/plain;
+        }
+
+        location ~ /\.git {
+            deny all;
+            return 404;
+        }
+
+        location / {
+            try_files $uri $uri/ =404;
+        }
+    }

kubernetes/app/blog/deployment.yaml

@@ -0,0 +1,149 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: blog
+  namespace: blog
+  labels:
+    app: blog
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: blog
+  template:
+    metadata:
+      labels:
+        app: blog
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+        # git-sync (uid 65533) writes files; fsGroup makes the emptyDir group-writable by that uid
+        fsGroup: 65533
+      initContainers:
+        - name: git-sync-init
+          image: registry.k8s.io/git-sync/git-sync:v4.5.1
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: GITSYNC_REPO
+              valueFrom:
+                secretKeyRef:
+                  name: blog-git-credentials
+                  key: GITSYNC_REPO
+            - name: GITSYNC_ROOT
+              value: "/git"
+            - name: GITSYNC_REF
+              value: "gh-pages"
+            - name: GITSYNC_LINK
+              value: "current"
+            - name: GITSYNC_DEPTH
+              value: "1"
+            - name: GITSYNC_ONE_TIME
+              value: "true"
+            - name: GITSYNC_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: blog-git-credentials
+                  key: GITSYNC_USERNAME
+            - name: GITSYNC_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: blog-git-credentials
+                  key: GITSYNC_PASSWORD
+          securityContext:
+            runAsUser: 65533
+            runAsGroup: 65533
+          volumeMounts:
+            - name: git-content
+              mountPath: /git
+          resources:
+            requests:
+              cpu: 10m
+              memory: 64Mi
+            limits:
+              memory: 128Mi
+      containers:
+        - name: nginx
+          image: nginxinc/nginx-unprivileged:1.30.0-alpine3.23
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8080
+              name: http
+              protocol: TCP
+          securityContext:
+            runAsUser: 101
+            runAsGroup: 101
+          volumeMounts:
+            - name: git-content
+              mountPath: /git
+            - name: nginx-config
+              mountPath: /etc/nginx/conf.d/default.conf
+              subPath: default.conf
+          livenessProbe:
+            httpGet:
+              port: 8080
+              path: /health
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              port: 8080
+              path: /health
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              memory: 64Mi
+        - name: git-sync
+          image: registry.k8s.io/git-sync/git-sync:v4.5.1
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: GITSYNC_REPO
+              valueFrom:
+                secretKeyRef:
+                  name: blog-git-credentials
+                  key: GITSYNC_REPO
+            - name: GITSYNC_ROOT
+              value: "/git"
+            - name: GITSYNC_REF
+              value: "gh-pages"
+            - name: GITSYNC_LINK
+              value: "current"
+            - name: GITSYNC_DEPTH
+              value: "1"
+            - name: GITSYNC_PERIOD
+              value: "30s"
+            - name: GITSYNC_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: blog-git-credentials
+                  key: GITSYNC_USERNAME
+            - name: GITSYNC_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: blog-git-credentials
+                  key: GITSYNC_PASSWORD
+          securityContext:
+            runAsUser: 65533
+            runAsGroup: 65533
+          volumeMounts:
+            - name: git-content
+              mountPath: /git
+          resources:
+            requests:
+              cpu: 5m
+              memory: 32Mi
+            limits:
+              memory: 64Mi
+      volumes:
+        - name: git-content
+          emptyDir: {}
+        - name: nginx-config
+          configMap:
+            name: blog-nginx-config

kubernetes/app/blog/ingress.yaml

@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: blog
+  namespace: blog
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+spec:
+  tls:
+    - hosts:
+        - ${BLOG_HOST}
+      secretName: blog-tls
+  rules:
+    - host: ${BLOG_HOST}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: blog
+                port:
+                  number: 8080

kubernetes/app/blog/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: blog

kubernetes/app/blog/networkpolicy.yaml

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-ingress
+  namespace: blog
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-ingress-controller
+  namespace: blog
+spec:
+  podSelector:
+    matchLabels:
+      app: blog
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik

kubernetes/app/blog/secret.sops.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: blog-git-credentials
+    namespace: blog
+stringData:
+    GITSYNC_USERNAME: ENC[AES256_GCM,data:6cZnsgZ53xsU,iv:j2qvZr+odimHPnlMKz9xTe8q+zXvyRDF9spH8TkcmBw=,tag:ik6DJ4cMfcNc5UHY5vRy3A==,type:str]
+    GITSYNC_PASSWORD: ENC[AES256_GCM,data:mjQJuOuH2YQ1i1JVO+lFZ7WYLmy4RjCi2xZRErU5hRNi2SdgRo0fwg==,iv:9pl3nVmlnynJ4jMke1Hy4ACBuMyM+65vmGR2kS705I0=,tag:K1dQ9YwVN0sZjieAOU3KWw==,type:str]
+    GITSYNC_REPO: ENC[AES256_GCM,data:ETjdkCP/PSa6HSD9M6JdvWbci/lRwegzzyuPb/IQmX58sxwqT2gUjooVKtcylzsE,iv:kOpvSQYznyxfmLjrehdRuEtwevoceDo0h/vbXTuu/i8=,tag:x+DEmoZUxRN6OksDJ9mQIQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYR3FFRWdPajVzbjZGem1N
+            OXA2aVhtSWRxQUpGcDFxLzBFQWkyMlh5L2pvCkgvM25IVTBqSFZ3QmJDaGxqSTJ2
+            blQyOTQwaThRbkhzZ01uUmVoaXg5VHMKLS0tIHJJWlJoSmRXRi90M2VHSTlvdnBH
+            VjRWTHRSWUE0VFpqakwxUmx3aENqYUUK21JXxrt792sHoI2TCYU3aIQKKLL9f8oq
+            1o+qkueVYSYmVetrqcjSWqfGE496BYi+pd4a0mmRwaLpLCZIIgtlvA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+    encrypted_regex: ^(data|stringData|email)$
+    lastmodified: "2026-05-11T19:25:53Z"
+    mac: ENC[AES256_GCM,data:jK/48Q7INbbcjZWASbS7ob1RrfDNm27jGnm1taL7hEMDC0k7n3igqlqSHmy7ZxCeUUe3Y+s7Jv9Ss1xITEPoUEYFphGrYeDUBVNtVfhBavTEaTPAuEv7WRA8xGpjXH0t9ernwwMyMQJRatazgX2jcc3rfzHMshs7cf5oeov15Zk=,iv:lg0ad1nDFDHBPv8Xvsn63V7SDPMo1p47gvSNFGJGw1I=,tag:fXatyOSOD/rCjEcpvDQpAw==,type:str]
+    version: 3.13.0

kubernetes/app/blog/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: blog
+  namespace: blog
+spec:
+  selector:
+    app: blog
+  ports:
+    - port: 8080
+      targetPort: 8080
+      name: http

kubernetes/app/gitea/TODO.md

@@ -1,122 +0,0 @@
-# Gitea setup checklist
-
-## Secrets (must be done before committing)
-
-- [+] Generate OIDC client secret:
-  ```bash
-  docker run --rm authelia/authelia:latest authelia crypto hash generate pbkdf2 \
-    --variant sha512 --iterations 310000 --random --random.length 72
-  ```
-  - Plaintext → `secret.sops.yaml` (`gitea-oauth-authelia.secret`)
-  - Hash → Authelia configmap (`sops -d -i kubernetes/infrastructure/controllers/authelia/configmap.sops.yaml`, replace `CHANGE_ME_pbkdf2_hash`, `sops -e -i`)
-
-- [+] Fill in `secret.sops.yaml` (`gitea-credentials`, `gitea-admin` passwords and email) then encrypt:
-  ```bash
-  cd kubernetes && sops -e -i app/gitea/secret.sops.yaml
-  ```
-
-- [+] Fill in `secret-backup.sops.yaml` (both `CHANGE_ME` in repo URLs, restic passwords, B2 creds) then encrypt:
-  ```bash
-  cd kubernetes && sops -e -i app/gitea/secret-backup.sops.yaml
-  ```
-
-## Synology / Backups
-
-- [+] Add htpasswd user `gitea` on rest-server:
-  ```bash
-  docker run --rm httpd:2-alpine htpasswd -nbB gitea 'YOUR_PW'
-  # append output to /volume1/docker/rest-server/config/htpasswd on Synology
-  ```
-
-- [+] Init restic repos:
-  ```bash
-  restic -r "rest:http://gitea:OQXxm5MHxXNCQuXrzXSUjj8zHO6KKtRYtrWLINFVsmhJq2QuA6CclpA12lAZ4Zwj@synology.mgmt.lviv:8888/gitea-db/" init
-  restic -r "rest:http://gitea:OQXxm5MHxXNCQuXrzXSUjj8zHO6KKtRYtrWLINFVsmhJq2QuA6CclpA12lAZ4Zwj@synology.mgmt.lviv:8888/gitea-data/" init
-  B2_ACCOUNT_ID=003c68ad65aa815000000000f B2_ACCOUNT_KEY='K003NHIj6SX+UO04MhycojpI/NTgIiM' restic -r "b2:berezovskyi-backup-homelab-gitea:/db/"   init
-  B2_ACCOUNT_ID=003c68ad65aa815000000000f B2_ACCOUNT_KEY='K003NHIj6SX+UO04MhycojpI/NTgIiM' restic -r "b2:berezovskyi-backup-homelab-gitea:/data/" init
-  ```
-
-- [+] Create B2 bucket `berezovskyi-backup-homelab-gitea` (if it doesn't exist yet)
-
-## Network / DNS
-
-- [+] Router: forward `WAN:22/tcp` → `<node-ip>:32022/tcp`
-- [+] Ensure node firewall allows `32022/tcp` from router
-- [+] DNS: point `gitea.berezovskyi.dev` → cluster external IP (same as other `*.berezovskyi.dev` services)
-
-## Deploy & verify
-
-- [+] Commit and push; wait for Flux to reconcile (~1 min):
-  ```bash
-  flux get hr -n flux-system gitea
-  kubectl get pods -n gitea
-  ```
-
-- [+] Functional checks:
-  - `https://gitea.berezovskyi.dev` loads, only "Sign in with authelia" button visible (no local login form)
-  - Click SSO → Authelia 2FA → back to Gitea, logged in
-  - `ssh -T -p 32022 git@<node-ip>` → `Hi <user>! You've successfully authenticated...`
-  - Test backup: `kubectl create job --from=cronjob/gitea-db-backup gitea-db-backup-test -n gitea`
-  - Verify snapshot: `restic -r "rest:http://gitea:<pw>@synology.storage.lviv:8888/gitea-db/" snapshots`
-
-## Actions + Container Registry (Phase 1 + Phase 2)
-
-### Phase 1 — Gitea config, extra PVC, backup (single commit)
-
-- [+] Init restic repo for `gitea-extra`:
-  ```bash
-  restic -r "rest:http://gitea:OQXxm5MHxXNCQuXrzXSUjj8zHO6KKtRYtrWLINFVsmhJq2QuA6CclpA12lAZ4Zwj@synology.storage.lviv:8888/gitea-extra/" init
-  B2_ACCOUNT_ID=003c68ad65aa815000000000f B2_ACCOUNT_KEY='K003NHIj6SX+UO04MhycojpI/NTgIiM' \
-    restic -r "b2:berezovskyi-backup-homelab-gitea:/extra/" init
-  ```
-
-- [ ] Commit Phase 1 files (`release.yaml`, `pvc-extra.yaml`, `cronjob-backup.yaml`, `secret-backup.sops.yaml`, `networkpolicy.yaml`) → wait for Flux:
-  ```bash
-  flux reconcile hr -n flux-system gitea
-  kubectl get pvc -n gitea gitea-extra
-  kubectl exec -n gitea gitea-0 -- ls -la /data/extra
-  ```
-
-- [ ] Test backup:
-  ```bash
-  kubectl create job --from=cronjob/gitea-extra-backup gitea-extra-backup-test -n gitea
-  ```
-
-### Phase 2 — act_runner (separate commit, after token is generated)
-
-- [ ] Generate runner registration token:
-  ```bash
-  kubectl exec -n gitea gitea-0 -- gitea --config /data/gitea/conf/app.ini actions generate-runner-token
-  ```
-
-- [ ] Replace `REPLACE_ME_WITH_RUNNER_TOKEN` in `secret-runner.sops.yaml` with the value above, then encrypt:
-  ```bash
-  cd kubernetes && sops -e -i app/gitea/secret-runner.sops.yaml
-  ```
-
-- [ ] Commit Phase 2 files (`secret-runner.sops.yaml`, `release-actions.yaml`).
-
-- [ ] Verify runner:
-  ```bash
-  kubectl get hr -n flux-system gitea-actions
-  kubectl logs -n gitea statefulset/gitea-actions-act-runner -c act-runner | tail -20
-  ```
-  In UI: `https://gitea.berezovskyi.dev/-/admin/actions/runners` → runner with status `Idle`.
-
-- [ ] Smoke-test workflow (in any repo, `.gitea/workflows/test.yaml`):
-  ```yaml
-  on: push
-  jobs:
-    test:
-      runs-on: ubuntu-latest
-      steps:
-        - uses: actions/checkout@v4
-        - run: echo "ok"
-  ```
-
-- [ ] Smoke-test container registry:
-  ```bash
-  echo "$GITEA_TOKEN" | docker login gitea.berezovskyi.dev -u <user> --password-stdin
-  docker tag alpine:3 gitea.berezovskyi.dev/<user>/test:latest
-  docker push gitea.berezovskyi.dev/<user>/test:latest
-  ```

kubernetes/app/gitea/namespace.yaml

@@ -2,3 +2,6 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: gitea
+  labels:
+    # act_runner DinD sidecar requires privileged; relax PSA enforce for this ns
+    pod-security.kubernetes.io/enforce: privileged

kubernetes/app/gitea/release-actions.yaml

@@ -23,13 +23,23 @@ spec:
       retries: 3
   dependsOn:
     - name: gitea
+  # chart 0.1.0 has a broken `global.storageClass` helper (extra newline breaks YAML),
+  # so we set storageClassName via a kustomize patch instead.
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              kind: StatefulSet
+              name: gitea-gitea-actions-act-runner
+            patch: |
+              - op: add
+                path: /spec/volumeClaimTemplates/0/spec/storageClassName
+                value: nfs-synology-ssd
   values:
     enabled: true
-    giteaRootURL: http://gitea-http.gitea.svc.cluster.local:3000
+    giteaRootURL: http://gitea-gitea-http.gitea.svc.cluster.local:3000
     existingSecret: gitea-runner-token
     existingSecretKey: token
-    global:
-      storageClass: nfs-synology-ssd
     statefulset:
       replicas: 1
       timezone: Europe/Kyiv

kubernetes/app/gitea/renovate.json

@@ -0,0 +1,33 @@
+{
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Track gitea rootless image; chart appends -rootless to tag automatically",
+      "fileMatch": ["kubernetes/app/gitea/release\\.yaml$"],
+      "matchStrings": [
+        "(?<indentation>\\s+)# renovate: currentValue=(?<currentValue>[^\\s]+) currentDigest=(?<currentDigest>sha256:[a-f0-9]+)\\n\\s+tag: [^\\s]+\\n\\s+digest: [^\\s]+"
+      ],
+      "depNameTemplate": "gitea/gitea",
+      "datasourceTemplate": "docker",
+      "autoReplaceStringTemplate": "{{indentation}}# renovate: currentValue={{newValue}} currentDigest={{#if newDigest}}{{{newDigest}}}{{else}}{{{currentDigest}}}{{/if}}\n{{indentation}}tag: {{newMajor}}.{{newMinor}}.{{newPatch}}\n{{indentation}}digest: {{#if newDigest}}{{{newDigest}}}{{else}}{{{currentDigest}}}{{/if}}"
+    }
+  ],
+  "packageRules": [
+    {
+      "matchFileNames": ["kubernetes/app/gitea/**"],
+      "semanticCommitScope": "k8s/gitea"
+    },
+    {
+      "matchFileNames": ["kubernetes/app/gitea/**"],
+      "matchPackageNames": ["gitea/gitea"],
+      "matchUpdateTypes": ["patch", "minor"],
+      "automerge": true
+    },
+    {
+      "description": "Ignore infrastructure images",
+      "matchFileNames": ["kubernetes/app/gitea/**"],
+      "matchPackageNames": ["creativeprojects/resticprofile", "postgres"],
+      "enabled": false
+    }
+  ]
+}

kubernetes/app/gitea/secret-backup.sops.yaml

@@ -7,8 +7,8 @@ stringData:
     profiles.yaml: ENC[AES256_GCM,data:qtegwOuO6px5lTrzgy3XWky/HV77Z/e6Oqx7Jwdieg2y4KKN0zelC74SpACsOZTd4/irGmdHrtkP2PNVnNB8ylPLv1mKPNi5fvTl4JsHSOZlHfIxmTxgljtsXh4N8o02RIPi5pYKGj/UDIF2yin7HdgtAZfsEhDcXbxENc8iyM1DYMGLVaHo3Z2SoEtILjqz8+fOmm+Pj/snaMZ6qst+a8Fyr5/wdc4S2WjsLyeZ1UDbzy549nBCpszp5Ncy4mGqyFBvQzgCT75cmAxtwYjfEh+Abc65EjB6CNmf9ciIAjlMJ8olQe6k8xTpGhzcT0jaWZfHw3VV454fMhCF9f20PLoGg3UCPgSanSy9OCjLT310ezMaO9ukWJ4dNzJKD/x2xsOCkGRG4Zm2kmJFoDsFILpLToGyfNxHr38M/otZxS9UiuZ7aLSWJW0UubhsPJ1niLnZB/XSd2bTrIbzunm/pgDCOI2wusrT6Qo/iVzMxAt9CKgFzdmvfsThdFflSKb5pK1fA8SRit3B4YTuXX6NiSUUAiAy+PfPGUgixneRJ6DiYKzIAC6X4dZLf8yS04gVPPOL5BaGq7Vh+5RawqEogsnJuNFCpcbVtUmZd4BnydNptueqZKHoxdgNV8ZYlsbWdwF2yhnC99tdXsYp+5CDD4Zm9qBtOjIIW1e/yGQ6Tjsq9qk0yRTYkFjM9awETgKnE+/6mieg5yY3uSIwwP4ZegUW92KH+SrnOs3QrcrTTJY/wlRs4SWQWw7aEUS4yuPZXtPmhYjccl3dWNN3lT1LbOMVTqekoQlJptefbfKLiXy+A6iEYJuORxH1hcjfvqlpk722kJqwWpgqFDP6f0x/wPJxHm3XpzBVo+6qclJ0sFU+OgDReDrgh+qH1IBGuz5A39rvfx6MLuaLOVwWswqArACWe2p9lg0yPTc51nDhloeNwOVMVZ5+StYBMIydYU9wU3SDT1cox7Sd6ahz23XHzSDq30m0uIWpZZNJm5P6KQHk4XEVIk3g9K6GMf1NgafWAFePgTHBt3/A2yXAXwYVK3dyBN6Rwl3F4Neq2n0OJRN6es89rrrf0VhdJJTPW7WjIzmrMyKi8qX7KnN5oI8316N+899CahwL/e1NdD16V7DxWNMjeG74j3lxSmzXWnPn5k0y0POcIkegLdksTNEtqLQgmMzI4gn5Avn/G5CIiz7cexno+4cUeTMVRwx6YH0KxAmxHXJXp9yuqGNoo0pIACTmwpOqvMACrKEPRanxVWbCD/ZQLSiwFzfmUoexH8iUiqcFe01WQh09rXSf87Yhsf/QP/xHZS+a21f0pAtC1ZeNc0wwad5ycI5RgkcokQNcDzCEvPAKt8IKuGvk7Ti6GXXBPhMcIW0yJtuxTL1DAxfYBte/lqvGIGfl3/7b9E+FR/vgnZUl5ykQnwiHTAAmZ0ySEWyyVs93rFt5UecPEUZRyn6tNYrCjJ7hqL4NgwmGEmlLH0V/aBRSZgGNafRfXQi6w2m6Pbdo86Pn55H4fH2HCIXNPBWzFWhzohBFjLTSC4EqjYUvT72r4IimOCqOGUKYuF0giAHvkVWM0GF48x1fiUI11p+N+bDM3Coi0m4mLkof/d+yk1sOcvt1h5XOn5NbmLz/X6HhJrEo8APPhJvu4qzF4KTujafP7KF5dDWBjp5GlooyE74gRj4tLEN0vfcaezS0IwMefmkCPFrpTB/wnDavic1EJ9lYRREggdCVPJLlU9omLhvRTCBRDF62GbQVtgUqVAHqVM0EkdVzeCoSDo3TWUSFi6Dv/ivWuXGJKChM5n4cDVenatbzi4htAXR1bW3zIRXVmQy8HkgLrj42Kg==,iv:PGm23iUxhuDcnKqJeF8/kAwFJ1646ufstWCGSH+0yKA=,tag:2J/E98gHS9N0Agt+nfMTug==,type:str]
     restic-password-nas: ENC[AES256_GCM,data:fMbuwG48Wc2YScNDYO+V2LjmOsjadatzHYSz0m8kvVfe7tw7lCChZanTSuldX9++E8NSxSGh6cvyRXFoX7ISCw==,iv:zSk8hk9+blNC7AZD2iEMly+t/anLzxjsJrqJzdLlqgE=,tag:C2aRaBHR8m6fRoBI/AMm6Q==,type:str]
     restic-password-b2: ENC[AES256_GCM,data:7/Os6960fd0HF8FHgI/UIRS2XahEcu39VJne5usDznIqQgnp1338mZ3S/9Wf4ZBKgGe0bieE/OKOWddSn2UbZA==,iv:WrMvh6++E+ENqg1r8K/q8qgOEBYBziBhIW+3FqtUH8Q=,tag:or+eTDz9QLI//IQgulGJFg==,type:str]
-    B2_ACCOUNT_ID: ENC[AES256_GCM,data:WlKjo0lJlw+75hbtqx4c82ruHe8mritacA==,iv:Vf3nb2vPDINMZ984on9k+490aC78QgxsfzeB08HJuDU=,tag:dRuvQHGDUEerhYwMT5nVgg==,type:str]
-    B2_ACCOUNT_KEY: ENC[AES256_GCM,data:PG1b6qHjjHivuFtXDfXlARCETQwG7m/Z4jcN213ZCQ==,iv:lFpNYXAF9Lvl/5tMlrDK/ZyVSX5gWeuPXDy1onuUSw4=,tag:TPesJVqqs+7lb2YKNzUQEg==,type:str]
+    B2_ACCOUNT_ID: ENC[AES256_GCM,data:4hEA1VTpo5OKyBhB7TfwC0tMS9thhls3aA==,iv:zfueemMDGJBHVMo5XZkuBlczB0SR51ygG5FCx15kZ5s=,tag:oe0Uvy8xHpOrRFPa4eIkww==,type:str]
+    B2_ACCOUNT_KEY: ENC[AES256_GCM,data:ypKpSJtPrdiJXbjNHPIblw2vH3MxlnXoG9p6UJODsw==,iv:g3QCmZI5Z2fmcYuGQZKaydJkrnzSOABFZvARhbzYM/E=,tag:hn/7CnjvQlTekQI3MbiAKQ==,type:str]
 sops:
     age:
         - enc: |
@@ -21,6 +21,6 @@ sops:
             -----END AGE ENCRYPTED FILE-----
           recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
     encrypted_regex: ^(data|stringData|email)$
-    lastmodified: "2026-05-11T17:54:38Z"
-    mac: ENC[AES256_GCM,data:i2cKO0rJB+BJi6JLH8ikz/yv+2xxtbJQZuMNIcXIAIAyqBVjiGhyj/yNmEAiFcT5DBQEQAIGduX7yvZtnM5PIjgRlJmKfnhsWCOvuzGTcpXdUlX6ckRcSoLIYmyVvOjcckY2XebokI3Pgn/RrOW5gHUIm8xU95E+Mc4Tkn4hSz4=,iv:9rUjRdmYQZ87uHaSFGmWWEpl0aB3olxbnAd1I/NYll4=,tag:OGXf3gVtTzTfxj8BSWugAA==,type:str]
+    lastmodified: "2026-05-11T18:13:47Z"
+    mac: ENC[AES256_GCM,data:pwrzvtizBP/GRW0gu3aQ6r9YgW6e+s689g4nlePs6Qzs+BljFMlb00Ko+LnX3XGgoynbJFHcsmhQBEDQ/8BYV7BaXPMtYW6V59ShaLUviSnhM47x2QbEoJkNqxBA1YL6fWDz4RL39L9vVeV9uhVJk2xc/+qsXqU3sHieIjjL2UI=,iv:qyLRgnXMKuW6GAuiK5Xn5pDVcHOpBgOfJ7TUOL5HHR4=,tag:lTPrHqKeveXo85yuS6CslQ==,type:str]
     version: 3.13.0

kubernetes/config/cluster-vars.sops.yaml

@@ -35,11 +35,11 @@ stringData:
     SEERR_HOST: ENC[AES256_GCM,data:l64ttp+rLNU8GfwIE4fhJROSMDEb,iv:1vHOw0LyGN9OMhYemhtRq9GE2fc4J2EprZU3bp/h4kk=,tag:WNV0Jh7816ra7IIOBMspBg==,type:str]
     FIREFLY_HOST: ENC[AES256_GCM,data:EQdrW33PVlD/brZCqh/sTkqLdPWW/bo=,iv:zbNnjsT1J6lpCEWtvNyL4A3bjWsusCjI5goWcZ8hajk=,tag:VwA6YA056bsyYIKB+X59bw==,type:str]
     GITEA_HOST: ENC[AES256_GCM,data:Ky3tXS9E9iadabpVzoK5zEbigmtn,iv:t6OdQeQ7Kxzb7qbi+KeoOkJd0XE2Dse5P1fFyiHM6tg=,tag:GpmHtVDr0IQVbpbALVx40g==,type:str]
+    BLOG_HOST: ENC[AES256_GCM,data:eADRFTla/PPFLVCoP9uKvPZ1YhY=,iv://xbCGLkZ6guGMDU0MnVtGR0adgMqNbe0zrCerj7w8k=,tag:HHXvN6y3YvJ4U4TkENkYVA==,type:str]
     BACKUP_LOCAL_HOST: ENC[AES256_GCM,data:ABaTI3NKkhF7K2FpPwvvrHA0l/tCxAi4Qek=,iv:34ixxSpKU1c12uoMdk4nz2Vo/+5A/npB7NWMsWFytIM=,tag:qjw2fQBebCKnqCnAPiBHaw==,type:str]
 sops:
     age:
-        - recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXekorS3lvckhHelE0NGVP
             Z0JSSmtTRk1yZEoxTVU4MnhaN2VjajU2cmhnCkEyWU0yandxUnZGZm5yWXJmQlM4
@@ -47,7 +47,8 @@ sops:
             MGJ6TFpwR0diNjlEN2syZkhNMFNwRDQK9pzmQGB0GQu6ogMIJW+kugvBNj3w+dxW
             bfEF9GAznIM/N5rPytF4wNgqwfoAF7GwumgA+iD43wprKtUJn+6dqw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-29T19:47:22Z"
-    mac: ENC[AES256_GCM,data:WgVeGY1tGl3Y97FRGNVEkM2J4WKeHil6ki2Jsww1QOsAdGyL7QaL0vPpfRfDc8FRHhyeahS7ShacUvBKnL5Lihxnrqhkd8wA0BgxONk0k/W8/WtU/tvhXpTwxTWgQ5VyPtX3QwwkAcGTARBu+Xrp2y9QGXU8NPO56eH6cUGPEW4=,iv:KjZbbRfhy4ZHtv38MHlX8jxK+9pp/U2aGaX+d8HRK3E=,tag:wcdQVdpYR9czzeYMi554oQ==,type:str]
+          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
     encrypted_regex: ^(data|stringData|email)$
-    version: 3.12.2
+    lastmodified: "2026-05-11T19:20:10Z"
+    mac: ENC[AES256_GCM,data:eA4MCmIA7iuC6gelQqWfIWPBb5w+93BLfU2ZhqLMbIna+OIk0tOjogcVz89H+x72ryMB+39a1vD+cYzLcF16Zl0uVHB5UiK9UDssJ26nbt8SK18F9Ew0a0WLp+gCj2qNAB2Od8+rLOKccfmHm1x+C5RuvYnRE4A1U1VNu6sPx3Q=,iv:epN8ZWNF0taoWm94eR+Unx9TUvjSIlKMgacLfbyj94w=,tag:a9f+8K7SOQmFJaZZ2PjnMQ==,type:str]
+    version: 3.13.0

renovate.json

@@ -5,7 +5,8 @@
     ":semanticCommits",
     "local>oleksandr/homelab//kubernetes/app/jellyfin/renovate.json",
     "local>oleksandr/homelab//kubernetes/app/media/renovate.json",
-    "local>oleksandr/homelab//kubernetes/app/immich/renovate.json"
+    "local>oleksandr/homelab//kubernetes/app/immich/renovate.json",
+    "local>oleksandr/homelab//kubernetes/app/gitea/renovate.json"
   ],
   "enabledManagers": ["kubernetes", "custom.regex"],
   "automergeType": "branch",