chore(k8s/dawarich): update busybox docker tag to v1.38

kubernetes/app/archmirror/configmap-nginx.yaml

@@ -6,8 +6,6 @@ metadata:
   namespace: archmirror
 data:
   nginx.conf: |
-    worker_processes auto;
-
     events {
         worker_connections 1024;
     }
@@ -17,8 +15,6 @@ data:
         default_type application/octet-stream;
 
         sendfile on;
-        # NFS reads block the worker; offload them so /health keeps answering
-        aio threads;
         gzip on;
 
         server {

kubernetes/app/dawarich/release.yaml

@@ -42,7 +42,7 @@ spec:
                   spec:
                     initContainers:
                       - name: wait-for-postgres
-                        image: busybox:1.37
+                        image: busybox:1.38
                         imagePullPolicy: IfNotPresent
                     containers:
                       - name: dawarich
@@ -69,7 +69,7 @@ spec:
                   spec:
                     initContainers:
                       - name: wait-for-postgres
-                        image: busybox:1.37
+                        image: busybox:1.38
                         imagePullPolicy: IfNotPresent
   values:
     # Release name is dawarich-dawarich (targetNamespace prefix); keep resource names short.
@@ -77,7 +77,7 @@ spec:
 
     image:
       # renovate: datasource=docker depName=freikin/dawarich
-      tag: "1.16.0"
+      tag: "1.15.3"
 
     keyBase:
       existingSecret: dawarich-credentials    # key: value

kubernetes/app/firefly/release.yaml

@@ -26,7 +26,7 @@ spec:
 
     image:
       # renovate: datasource=docker depName=fireflyiii/core
-      tag: version-6.7.9
+      tag: version-6.7.7
 
     podSecurityContext:
       seccompProfile:

kubernetes/app/gitea/release.yaml

@@ -199,11 +199,11 @@ spec:
         type: RuntimeDefault
 
     image:
-      # renovate: currentValue=28.2.0-rootless currentDigest=sha256:94807314454f6525994a3b76286ba12bc7e7f8cd14f61d9e67431767f8103306
+      # renovate: currentValue=1.27.3-rootless currentDigest=sha256:1c17ecaead42eb3b5391553d8708103a4beb0e86edf5b9ebc1eb269c318845f2
 
-      tag: 28.2.0
+      tag: 1.27.3
 
-      digest: sha256:94807314454f6525994a3b76286ba12bc7e7f8cd14f61d9e67431767f8103306
+      digest: sha256:1c17ecaead42eb3b5391553d8708103a4beb0e86edf5b9ebc1eb269c318845f2
       rootless: true
       pullPolicy: IfNotPresent
 

kubernetes/app/homepage/deployment.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: homepage
-          image: ghcr.io/gethomepage/homepage:v2.6.0
+          image: ghcr.io/gethomepage/homepage:v2.4.0
           ports:
             - containerPort: 3000
               name: http

kubernetes/app/immich/release.yaml

@@ -28,7 +28,7 @@ spec:
           main:
             image:
               repository: ghcr.io/immich-app/immich-server
-              tag: v3.3.3
+              tag: v3.3.0
             resources:
               requests:
                 cpu: 100m

kubernetes/app/lubelogger/release.yaml

@@ -18,7 +18,7 @@ spec:
   values:
     image:
       # renovate: datasource=docker depName=ghcr.io/hargata/lubelogger
-      tag: "v1.7.4"
+      tag: "v1.7.3"
 
     updateStrategy:
       type: RollingUpdate

kubernetes/app/media/deployment-prowlarr.yaml

@@ -49,9 +49,6 @@ spec:
           envFrom:
             - configMapRef:
                 name: media-common-env
-          env:
-            - name: PROWLARR__SERVER__TRUSTEDNETWORKS
-              value: ${POD_CIDR}
           ports:
             - containerPort: 9696
               name: http

kubernetes/app/media/deployment-radarr.yaml

@@ -58,9 +58,6 @@ spec:
           envFrom:
             - configMapRef:
                 name: media-common-env
-          env:
-            - name: RADARR__SERVER__TRUSTEDNETWORKS
-              value: ${POD_CIDR}
           ports:
             - containerPort: 7878
               name: http

kubernetes/app/media/deployment-sonarr.yaml

@@ -58,9 +58,6 @@ spec:
           envFrom:
             - configMapRef:
                 name: media-common-env
-          env:
-            - name: SONARR__SERVER__TRUSTEDNETWORKS
-              value: ${POD_CIDR}
           ports:
             - containerPort: 8989
               name: http

kubernetes/app/paperless/deployment.yaml

@@ -86,31 +86,6 @@ spec:
               value: allauth.socialaccount.providers.openid_connect
             - name: PAPERLESS_SOCIALACCOUNT_ALLOW_SIGNUPS
               value: "false"
-            - name: PAPERLESS_AI_ENABLED
-              value: "true"
-            - name: PAPERLESS_AI_LLM_BACKEND
-              value: openai-like
-            - name: PAPERLESS_AI_LLM_ENDPOINT
-              value: https://api.anthropic.com/v1/
-            - name: PAPERLESS_AI_LLM_MODEL
-              value: claude-haiku-5-5
-            - name: PAPERLESS_AI_LLM_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: paperless-ai
-                  key: anthropic-api-key
-            # Haiku 5.5 only accepts temperature 1; llama-index defaults to 0.1
-            - name: PAPERLESS_AI_LLM_EXTRA_PARAMS
-              value: '{"temperature": 1}'
-            - name: PAPERLESS_AI_LLM_OUTPUT_LANGUAGE
-              value: Ukrainian
-            - name: PAPERLESS_AI_LLM_EMBEDDING_BACKEND
-              value: huggingface
-            - name: PAPERLESS_AI_LLM_EMBEDDING_MODEL
-              value: intfloat/multilingual-e5-small
-            # matches the embedding model's 512-token input limit
-            - name: PAPERLESS_AI_LLM_EMBEDDING_CHUNK_SIZE
-              value: "512"
           volumeMounts:
             - name: data
               mountPath: /usr/src/paperless/data
@@ -135,9 +110,9 @@ spec:
           resources:
             requests:
               cpu: 100m
-              memory: 1536Mi
+              memory: 512Mi
             limits:
-              memory: 6Gi
+              memory: 5Gi
       volumes:
         - name: data
           persistentVolumeClaim:

kubernetes/app/paperless/secret-ai.sops.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: paperless-ai
-    namespace: paperless
-stringData:
-    anthropic-api-key: ENC[AES256_GCM,data:kTSTHIO771Zl8/kEyv1seKF1GyodZ4lxhjUSjsyIyCneC+aFdqrq/QYFnqtlQnjBOMq94LQxy0T4Ox2an2+0v2ywP+lIZzYDkE22JdXgbJgCW2aJTBqPtEFV7M2EP0LexDeD2aqebwicxA==,iv:IeO0+Y3jAL0iYM3UbpTtFU7TgqogUYt2gipYUJO2ABQ=,tag:qffHT+GkrNWFmJ1EffHEWg==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4Nzg2Zmc4ZVNvRzhzQmVp
-            Mlp6MXhRUExmOU1yWHRESmhBQWlsczZCZEQ0CmkvZDEzVTFwWmt6N3E5eXlsQ0d5
-            VDU1YWIvRDdocXFQNlhnK29CNDVtME0KLS0tIEMybTgzaGs4cVEyeTdEL1RPUmR3
-            S2VvK2FMZ0JnQWJUZG41MmIrRjkxVHcKzjclDColGY9ciQZPRodQrH8UkmsHTsTC
-            hExT/sbhwIznhryfzw/Wkgrm8bzH4NxEkjOWRXvEEJ7Fp5gkvfo0tQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
-    encrypted_regex: ^(data|stringData|email)$
-    lastmodified: "2026-10-10T18:39:57Z"
-    mac: ENC[AES256_GCM,data:SG3jk09+cI2mYvovl8PvT5Ay8QrD/wWYVJAdJWhE83bI+MgwgoXvkdW9B+3epcIfvNWV4Z83w2vS89+bo5k81CEIu66yAQPDA+wSCReiRalZdHYGidmnW5ZccmfjTGTNRIIY8RbJlB2ZW6EJJnjjT8Bp4wZskIk5EhGhU2+5jg8=,iv:XeyO9yKzZv6qHwe3LfBqqeRJ3gnU1AmGmeVv3Zp/UyY=,tag:xCgbaWR4fd738hF2T/QVAw==,type:str]
-    version: 3.13.3

kubernetes/app/reitti/deployment-tile-cache.yaml

@@ -23,7 +23,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: tile-cache
-          image: dedicatedcode/reitti-tile-cache:5.7.0
+          image: dedicatedcode/reitti-tile-cache:5.6.1
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80

kubernetes/app/reitti/deployment.yaml

@@ -28,7 +28,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: reitti
-          image: dedicatedcode/reitti:5.7.0
+          image: dedicatedcode/reitti:5.6.1
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

kubernetes/config/cluster-vars.sops.yaml

@@ -40,7 +40,6 @@ stringData:
     BACKUP_LOCAL_HOST: ENC[AES256_GCM,data:ABaTI3NKkhF7K2FpPwvvrHA0l/tCxAi4Qek=,iv:34ixxSpKU1c12uoMdk4nz2Vo/+5A/npB7NWMsWFytIM=,tag:qjw2fQBebCKnqCnAPiBHaw==,type:str]
     REITTI_HOST: ENC[AES256_GCM,data:Zx0T6aUL/v6ogX1miRxzDmDQ31EImg==,iv:0LBRaaG1FHBXFWrtDX8Z6Cs75BEA7hNYm5FFrBHhyYk=,tag:Tup6HoL6E+L9GJKmv3x17Q==,type:str]
     DAWARICH_HOST: ENC[AES256_GCM,data:Gpt9acoks8gnlvHnMLsFhH18fzu0sLjp,iv:QrJd20KcFtMlWarCgMVv1riUlJF3Qj/aYa2vJQizmpg=,tag:JTmmJHZ9u4ecg3/8frYSEA==,type:str]
-    POD_CIDR: ENC[AES256_GCM,data:TX6OQd+8IlgAk2C2kQ==,iv:F+sDxOPvWg3dgPB8NlzfpC7toY88FBeKXzjgUSk1H8M=,tag:NUdzsKszagRhG2+U4YlOcw==,type:str]
 sops:
     age:
         - enc: |
@@ -53,6 +52,6 @@ sops:
             -----END AGE ENCRYPTED FILE-----
           recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
     encrypted_regex: ^(data|stringData|email)$
-    lastmodified: "2026-10-18T10:53:13Z"
+    lastmodified: "2026-10-08T10:16:10Z"
-    mac: ENC[AES256_GCM,data:UqYOF0M6gaVjrE3/OQK/vQ0+lUcwan6fIvrJnm2BE6O28pDFL9iIDAo1ebp0oYhT8+cxNl/tTGlfH5TCblxpSCzu77/8eOgTdn19xqhTC8H8Yw56HVnYWNKZaQTyH+Qw6cG9HFf+d5OTYKeOEZufxZzpF7gT6M8BIssQ1vxEFQM=,iv:Vt1ln9ur5Dejod4X2+JUxwMwjlS198EWMASIw0Gf3Hk=,tag:NSnVkPLLTkHckVLEdTylWg==,type:str]
+    mac: ENC[AES256_GCM,data:CYjhG3nyn95vgIdpaSxiRl+wR5tm+YOQv2GbfAIPBe62j5dEPxYF6JRFDMxBrQIbQkEgSQ+lWYN8verXZ1SnBSUJ7elKeFDn6ioJsuXF3eMBMZhgQKLo8kgOnYajgVh5sNJsmtdrH9Ret+DudeMb+bvgV7gSETKhVKAWC8h64f8=,iv:4hNo9beooqlJYkOB9i3vzfiXofUcPMy6BDcktIm1U6k=,tag:prnXCtS3bjjUs+1YS9CzlA==,type:str]
     version: 3.13.3