chore(k8s/media): update creativeprojects/resticprofile docker tag to v0.33.1

README.md

@@ -26,7 +26,6 @@ homelab-v2/
     │   └── configs/        # ClusterIssuer, MetalLB config
     ├── app/
     │   ├── archmirror/
-    │   ├── blog/
     │   ├── external/       # External service vars (e.g. Home Assistant)
     │   ├── firefly/
     │   ├── gitea/
@@ -59,7 +58,6 @@ homelab-v2/
 | **Homepage** | Dashboard aggregator |
 | **Podsync** | Podcast downloader |
 | **Archmirror** | Local Arch Linux package repository mirror |
-| **Blog** | Personal static blog served via git-sync + nginx (gh-pages branch) |
 
 ## Infrastructure Stack
 

kubernetes-monitoring/flux-system/gotk-sync.yaml

@@ -1,27 +0,0 @@
-# This manifest was generated by flux. DO NOT EDIT.
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: GitRepository
-metadata:
-  name: flux-system
-  namespace: flux-system
-spec:
-  interval: 1m0s
-  ref:
-    branch: master
-  secretRef:
-    name: flux-system
-  url: https://github.com/berezovskyi-oleksandr/homelab.git
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: flux-system
-  namespace: flux-system
-spec:
-  interval: 10m0s
-  path: ./kubernetes-monitoring
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system

kubernetes-monitoring/flux-system/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- gotk-components.yaml
-- gotk-sync.yaml

kubernetes/app/blog/configmap-nginx.yaml

@@ -1,29 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: blog-nginx-config
-  namespace: blog
-data:
-  default.conf: |
-    server {
-        listen 8080;
-        server_name _;
-        root /git/current;
-        index index.html;
-        absolute_redirect off;
-
-        location /health {
-            access_log off;
-            return 200 "OK";
-            add_header Content-Type text/plain;
-        }
-
-        location ~ /\.git {
-            deny all;
-            return 404;
-        }
-
-        location / {
-            try_files $uri $uri/ =404;
-        }
-    }

kubernetes/app/blog/deployment.yaml

@@ -1,149 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: blog
-  namespace: blog
-  labels:
-    app: blog
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: blog
-  template:
-    metadata:
-      labels:
-        app: blog
-    spec:
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-        # git-sync (uid 65533) writes files; fsGroup makes the emptyDir group-writable by that uid
-        fsGroup: 65533
-      initContainers:
-        - name: git-sync-init
-          image: registry.k8s.io/git-sync/git-sync:v4.5.1
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: GITSYNC_REPO
-              valueFrom:
-                secretKeyRef:
-                  name: blog-git-credentials
-                  key: GITSYNC_REPO
-            - name: GITSYNC_ROOT
-              value: "/git"
-            - name: GITSYNC_REF
-              value: "gh-pages"
-            - name: GITSYNC_LINK
-              value: "current"
-            - name: GITSYNC_DEPTH
-              value: "1"
-            - name: GITSYNC_ONE_TIME
-              value: "true"
-            - name: GITSYNC_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: blog-git-credentials
-                  key: GITSYNC_USERNAME
-            - name: GITSYNC_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: blog-git-credentials
-                  key: GITSYNC_PASSWORD
-          securityContext:
-            runAsUser: 65533
-            runAsGroup: 65533
-          volumeMounts:
-            - name: git-content
-              mountPath: /git
-          resources:
-            requests:
-              cpu: 10m
-              memory: 64Mi
-            limits:
-              memory: 128Mi
-      containers:
-        - name: nginx
-          image: nginxinc/nginx-unprivileged:1.30.0-alpine3.23
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 8080
-              name: http
-              protocol: TCP
-          securityContext:
-            runAsUser: 101
-            runAsGroup: 101
-          volumeMounts:
-            - name: git-content
-              mountPath: /git
-            - name: nginx-config
-              mountPath: /etc/nginx/conf.d/default.conf
-              subPath: default.conf
-          livenessProbe:
-            httpGet:
-              port: 8080
-              path: /health
-            initialDelaySeconds: 10
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              port: 8080
-              path: /health
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-            limits:
-              memory: 64Mi
-        - name: git-sync
-          image: registry.k8s.io/git-sync/git-sync:v4.5.1
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: GITSYNC_REPO
-              valueFrom:
-                secretKeyRef:
-                  name: blog-git-credentials
-                  key: GITSYNC_REPO
-            - name: GITSYNC_ROOT
-              value: "/git"
-            - name: GITSYNC_REF
-              value: "gh-pages"
-            - name: GITSYNC_LINK
-              value: "current"
-            - name: GITSYNC_DEPTH
-              value: "1"
-            - name: GITSYNC_PERIOD
-              value: "30s"
-            - name: GITSYNC_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: blog-git-credentials
-                  key: GITSYNC_USERNAME
-            - name: GITSYNC_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: blog-git-credentials
-                  key: GITSYNC_PASSWORD
-          securityContext:
-            runAsUser: 65533
-            runAsGroup: 65533
-          volumeMounts:
-            - name: git-content
-              mountPath: /git
-          resources:
-            requests:
-              cpu: 5m
-              memory: 32Mi
-            limits:
-              memory: 64Mi
-      volumes:
-        - name: git-content
-          emptyDir: {}
-        - name: nginx-config
-          configMap:
-            name: blog-nginx-config

kubernetes/app/blog/ingress.yaml

@@ -1,23 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: blog
-  namespace: blog
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-spec:
-  tls:
-    - hosts:
-        - ${BLOG_HOST}
-      secretName: blog-tls
-  rules:
-    - host: ${BLOG_HOST}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: blog
-                port:
-                  number: 8080

kubernetes/app/blog/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: blog

kubernetes/app/blog/networkpolicy.yaml

@@ -1,26 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: default-deny-ingress
-  namespace: blog
-spec:
-  podSelector: {}
-  policyTypes:
-    - Ingress
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-ingress-controller
-  namespace: blog
-spec:
-  podSelector:
-    matchLabels:
-      app: blog
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik

kubernetes/app/blog/secret.sops.yaml

@@ -1,24 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: blog-git-credentials
-    namespace: blog
-stringData:
-    GITSYNC_USERNAME: ENC[AES256_GCM,data:6cZnsgZ53xsU,iv:j2qvZr+odimHPnlMKz9xTe8q+zXvyRDF9spH8TkcmBw=,tag:ik6DJ4cMfcNc5UHY5vRy3A==,type:str]
-    GITSYNC_PASSWORD: ENC[AES256_GCM,data:mjQJuOuH2YQ1i1JVO+lFZ7WYLmy4RjCi2xZRErU5hRNi2SdgRo0fwg==,iv:9pl3nVmlnynJ4jMke1Hy4ACBuMyM+65vmGR2kS705I0=,tag:K1dQ9YwVN0sZjieAOU3KWw==,type:str]
-    GITSYNC_REPO: ENC[AES256_GCM,data:ETjdkCP/PSa6HSD9M6JdvWbci/lRwegzzyuPb/IQmX58sxwqT2gUjooVKtcylzsE,iv:kOpvSQYznyxfmLjrehdRuEtwevoceDo0h/vbXTuu/i8=,tag:x+DEmoZUxRN6OksDJ9mQIQ==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYR3FFRWdPajVzbjZGem1N
-            OXA2aVhtSWRxQUpGcDFxLzBFQWkyMlh5L2pvCkgvM25IVTBqSFZ3QmJDaGxqSTJ2
-            blQyOTQwaThRbkhzZ01uUmVoaXg5VHMKLS0tIHJJWlJoSmRXRi90M2VHSTlvdnBH
-            VjRWTHRSWUE0VFpqakwxUmx3aENqYUUK21JXxrt792sHoI2TCYU3aIQKKLL9f8oq
-            1o+qkueVYSYmVetrqcjSWqfGE496BYi+pd4a0mmRwaLpLCZIIgtlvA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
-    encrypted_regex: ^(data|stringData|email)$
-    lastmodified: "2026-05-11T19:25:53Z"
-    mac: ENC[AES256_GCM,data:jK/48Q7INbbcjZWASbS7ob1RrfDNm27jGnm1taL7hEMDC0k7n3igqlqSHmy7ZxCeUUe3Y+s7Jv9Ss1xITEPoUEYFphGrYeDUBVNtVfhBavTEaTPAuEv7WRA8xGpjXH0t9ernwwMyMQJRatazgX2jcc3rfzHMshs7cf5oeov15Zk=,iv:lg0ad1nDFDHBPv8Xvsn63V7SDPMo1p47gvSNFGJGw1I=,tag:fXatyOSOD/rCjEcpvDQpAw==,type:str]
-    version: 3.13.0

kubernetes/app/blog/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: blog
-  namespace: blog
-spec:
-  selector:
-    app: blog
-  ports:
-    - port: 8080
-      targetPort: 8080
-      name: http

kubernetes/app/gitea/cronjob-backup.yaml

@@ -148,65 +148,3 @@ spec:
             - name: data
               persistentVolumeClaim:
                 claimName: gitea-data
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: gitea-extra-backup
-  namespace: gitea
-  labels:
-    app: gitea-backup
-spec:
-  schedule: "15 3 * * *"
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      template:
-        metadata:
-          labels:
-            app: gitea-backup
-        spec:
-          restartPolicy: OnFailure
-          containers:
-            - name: resticprofile
-              image: creativeprojects/resticprofile:0.32.0
-              imagePullPolicy: IfNotPresent
-              command:
-                - sh
-                - -c
-                - |
-                  resticprofile -c /secrets/profiles.yaml -n gitea-extra backup
-                  resticprofile -c /secrets/profiles.yaml -n gitea-extra copy
-              env:
-                - name: B2_ACCOUNT_ID
-                  valueFrom:
-                    secretKeyRef:
-                      name: gitea-backup-config
-                      key: B2_ACCOUNT_ID
-                - name: B2_ACCOUNT_KEY
-                  valueFrom:
-                    secretKeyRef:
-                      name: gitea-backup-config
-                      key: B2_ACCOUNT_KEY
-              resources:
-                requests:
-                  cpu: 100m
-                  memory: 256Mi
-                limits:
-                  memory: 1Gi
-              volumeMounts:
-                - name: secrets
-                  mountPath: /secrets
-                  readOnly: true
-                - name: extra
-                  mountPath: /data-extra
-                  readOnly: true
-          volumes:
-            - name: secrets
-              secret:
-                secretName: gitea-backup-config
-            - name: extra
-              persistentVolumeClaim:
-                claimName: gitea-extra

kubernetes/app/gitea/namespace.yaml

@@ -2,6 +2,3 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: gitea
-  labels:
-    # act_runner DinD sidecar requires privileged; relax PSA enforce for this ns
-    pod-security.kubernetes.io/enforce: privileged

kubernetes/app/gitea/networkpolicy.yaml

@@ -79,26 +79,6 @@ spec:
       ports:
         - port: 5432
 ---
-# Allow act_runner pods to reach gitea-http (HelmRelease for Actions registers and polls jobs via cluster-internal Service)
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-runner-to-gitea
-  namespace: gitea
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: gitea
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: actions-act-runner
-      ports:
-        - port: 3000
----
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:

kubernetes/app/gitea/pvc-extra.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: gitea-extra
-  namespace: gitea
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: nfs-synology-ssd
-  resources:
-    requests:
-      storage: 30Gi

kubernetes/app/gitea/release-actions.yaml

@@ -1,69 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: gitea-actions
-  namespace: flux-system
-spec:
-  chart:
-    spec:
-      chart: actions
-      version: 0.1.0
-      reconcileStrategy: ChartVersion
-      sourceRef:
-        kind: HelmRepository
-        name: gitea
-        namespace: flux-system
-  targetNamespace: gitea
-  interval: 1m0s
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    remediation:
-      retries: 3
-  dependsOn:
-    - name: gitea
-  # chart 0.1.0 has a broken `global.storageClass` helper (extra newline breaks YAML),
-  # so we set storageClassName via a kustomize patch instead.
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              kind: StatefulSet
-              name: gitea-gitea-actions-act-runner
-            patch: |
-              - op: add
-                path: /spec/volumeClaimTemplates/0/spec/storageClassName
-                value: nfs-synology-ssd
-  values:
-    enabled: true
-    giteaRootURL: http://gitea-gitea-http.gitea.svc.cluster.local:3000
-    existingSecret: gitea-runner-token
-    existingSecretKey: token
-    statefulset:
-      replicas: 1
-      timezone: Europe/Kyiv
-      persistence:
-        size: 10Gi
-      resources:
-        requests:
-          cpu: 100m
-          memory: 256Mi
-        limits:
-          memory: 2Gi
-      actRunner:
-        config: |
-          log:
-            level: info
-          cache:
-            enabled: true
-          container:
-            require_docker: true
-            docker_timeout: 300s
-          runner:
-            labels:
-              - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
-              - "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
-              - "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
-      dind:
-        rootless: false

kubernetes/app/gitea/release.yaml

@@ -21,175 +21,6 @@ spec:
   upgrade:
     remediation:
       retries: 3
-  # Patch the init script: Gitea 1.26 removed environment-to-ini; use built-in subcommand instead.
-  # Remove once helm-gitea chart ships a release with the fix (commit 1baf2d0).
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              kind: Secret
-              name: gitea-gitea
-            patch: |
-              apiVersion: v1
-              kind: Secret
-              metadata:
-                name: gitea-gitea
-              stringData:
-                config_environment.sh: |
-                  #!/usr/bin/env bash
-                  set -euo pipefail
-
-                  function env2ini::log() {
-                    printf "$${1}\n"
-                  }
-
-                  function env2ini::read_config_to_env() {
-                    local section="$${1}"
-                    local line="$${2}"
-
-                    if [[ -z "$${line}" ]]; then
-                      # skip empty line
-                      return
-                    fi
-
-                    # 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
-                    local setting="$(awk -F '=' '{print $1}' <<< "$${line}" | xargs echo -n)"
-
-                    if [[ -z "$${setting}" ]]; then
-                      env2ini::log '  ! invalid setting'
-                      exit 1
-                    fi
-
-                    local value=''
-                    local regex="^$${setting}(\s*)=(\s*)(.*)"
-                    if [[ $line =~ $regex ]]; then
-                      value="$${BASH_REMATCH[3]}"
-                    else
-                      env2ini::log '  ! invalid setting'
-                      exit 1
-                    fi
-
-                    env2ini::log "    + '$${setting}'"
-
-                    if [[ -z "$${section}" ]]; then
-                      export "GITEA____$${setting^^}=$${value}"                           # '^^' makes the variable content uppercase
-                      return
-                    fi
-
-                    local masked_section="$${section//./_0X2E_}"                            # '//' instructs to replace all matches
-                    masked_section="$${masked_section//-/_0X2D_}"
-
-                    export "GITEA__$${masked_section^^}__$${setting^^}=$${value}"        # '^^' makes the variable content uppercase
-                  }
-
-                  function env2ini::reload_preset_envs() {
-                    env2ini::log "Reloading preset envs..."
-
-                    while read -r line; do
-                      if [[ -z "$${line}" ]]; then
-                        # skip empty line
-                        return
-                      fi
-
-                      # 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
-                      local setting="$(awk -F '=' '{print $1}' <<< "$${line}" | xargs echo -n)"
-
-                      if [[ -z "$${setting}" ]]; then
-                        env2ini::log '  ! invalid setting'
-                        exit 1
-                      fi
-
-                      local value=''
-                      local regex="^$${setting}(\s*)=(\s*)(.*)"
-                      if [[ $line =~ $regex ]]; then
-                        value="$${BASH_REMATCH[3]}"
-                      else
-                        env2ini::log '  ! invalid setting'
-                        exit 1
-                      fi
-
-                      env2ini::log "  + '$${setting}'"
-
-                      export "$${setting^^}=$${value}"                           # '^^' makes the variable content uppercase
-                    done < "$TMP_EXISTING_ENVS_FILE"
-
-                    rm $TMP_EXISTING_ENVS_FILE
-                  }
-
-
-                  function env2ini::process_config_file() {
-                    local config_file="$${1}"
-                    local section="$(basename "$${config_file}")"
-
-                    if [[ $section == '_generals_' ]]; then
-                      env2ini::log "  [ini root]"
-                      section=''
-                    else
-                      env2ini::log "  $${section}"
-                    fi
-
-                    while read -r line; do
-                      env2ini::read_config_to_env "$${section}" "$${line}"
-                    done < <(awk 1 "$${config_file}")                             # Helm .toYaml trims the trailing new line which breaks line processing; awk 1 ... adds it back while reading
-                  }
-
-                  function env2ini::load_config_sources() {
-                    local path="$${1}"
-
-                    if [[ -d "$${path}" ]]; then
-                      env2ini::log "Processing $(basename "$${path}")..."
-
-                      while read -d '' configFile; do
-                        env2ini::process_config_file "$${configFile}"
-                      done < <(find "$${path}" -type l -not -name '..data' -print0)
-
-                      env2ini::log "\n"
-                    fi
-                  }
-
-                  function env2ini::generate_initial_secrets() {
-                    # These environment variables will either be
-                    #   - overwritten with user defined values,
-                    #   - initially used to set up Gitea
-                    # Anyway, they won't harm existing app.ini files
-
-                    export GITEA__SECURITY__INTERNAL_TOKEN=$(gitea generate secret INTERNAL_TOKEN)
-                    export GITEA__SECURITY__SECRET_KEY=$(gitea generate secret SECRET_KEY)
-                    export GITEA__OAUTH2__JWT_SECRET=$(gitea generate secret JWT_SECRET)
-                    export GITEA__SERVER__LFS_JWT_SECRET=$(gitea generate secret LFS_JWT_SECRET)
-
-                    env2ini::log "...Initial secrets generated\n"
-                  }
-
-                  # save existing envs prior to script execution. Necessary to keep order of preexisting and custom envs
-                  env | (grep -e '^GITEA__' || [[ $? == 1 ]]) > $TMP_EXISTING_ENVS_FILE
-
-                  # MUST BE CALLED BEFORE OTHER CONFIGURATION
-                  env2ini::generate_initial_secrets
-
-                  env2ini::load_config_sources "$ENV_TO_INI_MOUNT_POINT/inlines/"
-                  env2ini::load_config_sources "$ENV_TO_INI_MOUNT_POINT/additionals/"
-
-                  # load existing envs to override auto generated envs
-                  env2ini::reload_preset_envs
-
-                  env2ini::log "=== All configuration sources loaded ===\n"
-
-                  # safety to prevent rewrite of secret keys if an app.ini already exists
-                  if [ -f $${GITEA_APP_INI} ]; then
-                    env2ini::log 'An app.ini file already exists. To prevent overwriting secret keys, these settings are dropped and remain unchanged:'
-                    env2ini::log '  - security.INTERNAL_TOKEN'
-                    env2ini::log '  - security.SECRET_KEY'
-                    env2ini::log '  - oauth2.JWT_SECRET'
-                    env2ini::log '  - server.LFS_JWT_SECRET'
-
-                    unset GITEA__SECURITY__INTERNAL_TOKEN
-                    unset GITEA__SECURITY__SECRET_KEY
-                    unset GITEA__OAUTH2__JWT_SECRET
-                    unset GITEA__SERVER__LFS_JWT_SECRET
-                  fi
-
-                  gitea config edit-ini --apply-env --config "$GITEA_APP_INI" --out "$GITEA_APP_INI"
   values:
     strategy:
       type: Recreate
@@ -199,11 +30,6 @@ spec:
         type: RuntimeDefault
 
     image:
-      # renovate: currentValue=1.26.2-rootless currentDigest=sha256:c5c21a7705a16f2b2369384a3b7d67c5ed761a818bbb0a55187b5cf98cdc2e68
-
-      tag: 1.26.2
-
-      digest: sha256:c5c21a7705a16f2b2369384a3b7d67c5ed761a818bbb0a55187b5cf98cdc2e68
       rootless: true
       pullPolicy: IfNotPresent
 
@@ -225,14 +51,6 @@ spec:
       accessModes:
         - ReadWriteOnce
 
-    extraVolumes:
-      - name: gitea-extra
-        persistentVolumeClaim:
-          claimName: gitea-extra
-    extraContainerVolumeMounts:
-      - name: gitea-extra
-        mountPath: /data/extra
-
     resources:
       requests:
         cpu: 100m
@@ -307,21 +125,6 @@ spec:
           UPDATE_AVATAR: true
           REGISTER_EMAIL_CONFIRM: false
 
-        actions:
-          ENABLED: true
-          DEFAULT_ACTIONS_URL: github
-          LOG_RETENTION_DAYS: 7
-          ARTIFACT_RETENTION_DAYS: 7
-          LOG_COMPRESSION: zstd
-
-        "storage.packages":
-          PATH: /data/extra/packages
-        "storage.actions_log":
-          PATH: /data/extra/actions_log
-        "storage.actions_artifacts":
-          STORAGE_TYPE: local
-          PATH: /data/extra/actions_artifacts
-
       additionalConfigFromEnvs:
         - name: GITEA__database__DB_TYPE
           value: postgres

kubernetes/app/gitea/renovate.json

@@ -1,33 +0,0 @@
-{
-  "customManagers": [
-    {
-      "customType": "regex",
-      "description": "Track gitea rootless image; chart appends -rootless to tag automatically",
-      "fileMatch": ["kubernetes/app/gitea/release\\.yaml$"],
-      "matchStrings": [
-        "(?<indentation>\\s+)# renovate: currentValue=(?<currentValue>[^\\s]+) currentDigest=(?<currentDigest>sha256:[a-f0-9]+)\\n\\s+tag: [^\\s]+\\n\\s+digest: [^\\s]+"
-      ],
-      "depNameTemplate": "gitea/gitea",
-      "datasourceTemplate": "docker",
-      "autoReplaceStringTemplate": "{{indentation}}# renovate: currentValue={{newValue}} currentDigest={{#if newDigest}}{{{newDigest}}}{{else}}{{{currentDigest}}}{{/if}}\n{{indentation}}tag: {{newMajor}}.{{newMinor}}.{{newPatch}}\n{{indentation}}digest: {{#if newDigest}}{{{newDigest}}}{{else}}{{{currentDigest}}}{{/if}}"
-    }
-  ],
-  "packageRules": [
-    {
-      "matchFileNames": ["kubernetes/app/gitea/**"],
-      "semanticCommitScope": "k8s/gitea"
-    },
-    {
-      "matchFileNames": ["kubernetes/app/gitea/**"],
-      "matchPackageNames": ["gitea/gitea"],
-      "matchUpdateTypes": ["patch", "minor"],
-      "automerge": true
-    },
-    {
-      "description": "Ignore infrastructure images",
-      "matchFileNames": ["kubernetes/app/gitea/**"],
-      "matchPackageNames": ["creativeprojects/resticprofile", "postgres"],
-      "enabled": false
-    }
-  ]
-}

kubernetes/app/gitea/secret-backup.sops.yaml

@@ -4,23 +4,23 @@ metadata:
     name: gitea-backup-config
     namespace: gitea
 stringData:
-    profiles.yaml: ENC[AES256_GCM,data:qtegwOuO6px5lTrzgy3XWky/HV77Z/e6Oqx7Jwdieg2y4KKN0zelC74SpACsOZTd4/irGmdHrtkP2PNVnNB8ylPLv1mKPNi5fvTl4JsHSOZlHfIxmTxgljtsXh4N8o02RIPi5pYKGj/UDIF2yin7HdgtAZfsEhDcXbxENc8iyM1DYMGLVaHo3Z2SoEtILjqz8+fOmm+Pj/snaMZ6qst+a8Fyr5/wdc4S2WjsLyeZ1UDbzy549nBCpszp5Ncy4mGqyFBvQzgCT75cmAxtwYjfEh+Abc65EjB6CNmf9ciIAjlMJ8olQe6k8xTpGhzcT0jaWZfHw3VV454fMhCF9f20PLoGg3UCPgSanSy9OCjLT310ezMaO9ukWJ4dNzJKD/x2xsOCkGRG4Zm2kmJFoDsFILpLToGyfNxHr38M/otZxS9UiuZ7aLSWJW0UubhsPJ1niLnZB/XSd2bTrIbzunm/pgDCOI2wusrT6Qo/iVzMxAt9CKgFzdmvfsThdFflSKb5pK1fA8SRit3B4YTuXX6NiSUUAiAy+PfPGUgixneRJ6DiYKzIAC6X4dZLf8yS04gVPPOL5BaGq7Vh+5RawqEogsnJuNFCpcbVtUmZd4BnydNptueqZKHoxdgNV8ZYlsbWdwF2yhnC99tdXsYp+5CDD4Zm9qBtOjIIW1e/yGQ6Tjsq9qk0yRTYkFjM9awETgKnE+/6mieg5yY3uSIwwP4ZegUW92KH+SrnOs3QrcrTTJY/wlRs4SWQWw7aEUS4yuPZXtPmhYjccl3dWNN3lT1LbOMVTqekoQlJptefbfKLiXy+A6iEYJuORxH1hcjfvqlpk722kJqwWpgqFDP6f0x/wPJxHm3XpzBVo+6qclJ0sFU+OgDReDrgh+qH1IBGuz5A39rvfx6MLuaLOVwWswqArACWe2p9lg0yPTc51nDhloeNwOVMVZ5+StYBMIydYU9wU3SDT1cox7Sd6ahz23XHzSDq30m0uIWpZZNJm5P6KQHk4XEVIk3g9K6GMf1NgafWAFePgTHBt3/A2yXAXwYVK3dyBN6Rwl3F4Neq2n0OJRN6es89rrrf0VhdJJTPW7WjIzmrMyKi8qX7KnN5oI8316N+899CahwL/e1NdD16V7DxWNMjeG74j3lxSmzXWnPn5k0y0POcIkegLdksTNEtqLQgmMzI4gn5Avn/G5CIiz7cexno+4cUeTMVRwx6YH0KxAmxHXJXp9yuqGNoo0pIACTmwpOqvMACrKEPRanxVWbCD/ZQLSiwFzfmUoexH8iUiqcFe01WQh09rXSf87Yhsf/QP/xHZS+a21f0pAtC1ZeNc0wwad5ycI5RgkcokQNcDzCEvPAKt8IKuGvk7Ti6GXXBPhMcIW0yJtuxTL1DAxfYBte/lqvGIGfl3/7b9E+FR/vgnZUl5ykQnwiHTAAmZ0ySEWyyVs93rFt5UecPEUZRyn6tNYrCjJ7hqL4NgwmGEmlLH0V/aBRSZgGNafRfXQi6w2m6Pbdo86Pn55H4fH2HCIXNPBWzFWhzohBFjLTSC4EqjYUvT72r4IimOCqOGUKYuF0giAHvkVWM0GF48x1fiUI11p+N+bDM3Coi0m4mLkof/d+yk1sOcvt1h5XOn5NbmLz/X6HhJrEo8APPhJvu4qzF4KTujafP7KF5dDWBjp5GlooyE74gRj4tLEN0vfcaezS0IwMefmkCPFrpTB/wnDavic1EJ9lYRREggdCVPJLlU9omLhvRTCBRDF62GbQVtgUqVAHqVM0EkdVzeCoSDo3TWUSFi6Dv/ivWuXGJKChM5n4cDVenatbzi4htAXR1bW3zIRXVmQy8HkgLrj42Kg==,iv:PGm23iUxhuDcnKqJeF8/kAwFJ1646ufstWCGSH+0yKA=,tag:2J/E98gHS9N0Agt+nfMTug==,type:str]
+    profiles.yaml: ENC[AES256_GCM,data:uHgGYQxpS3FZ46aVqp8Qu/N4hV6uLRefYRGx/zr0aPcfHGtzsl1Bibw08x3lw6zl5fjS6S8P4rqD/RutSzldQ81/YVXEMu7XIHpyeVwGyFWcYXm7MLkXrhTxuyHjeNAhNJRgrkka45tLxOzf2JSQ7csjLtQ1/fBZ7BbUyZst5WuyJ9cRAX8ljYEwE84EkoXwN3j76913iq/tU8qZG77jf3nfCZIMHcsfEQRtHTkLVwa3kRXkmdOuUhlUB70cN5B1jl0nYvhV6dfGm5jw3jOdxos14w91IVJR7kAmNCJh0HND13frOuNVZNjBQ6Jx5DlhjKQ83aDZS3IxBAzNafptTn0V529EuRYbVr9hKLNzu+MJ8T7ao17zNbUTcpd0wXxQwESyywxea6scXxu6KkAbPKVZJLGC4gyjJAJdnHBMQAbn/XvEUturdA/ExG+B6Nt05KT8sObePyY2k3NwlUjRJxk01Y+di+44E2msg/K6D4u/yZX1Eg4FikMJL5ldBpCmBaeiM2gwdZEnO4hufNr46cdGH4nZxe+HMgsD6NrCpJzeTKnwHxa6DZpBkNk/XOmCU+HLQoIspqHiKVDB6kUY8EaSb+i3Qvqq9IHi7DooiZmXNVTHjEj2RTzqd+/I8S2JmANTs7zvEdtfJJ2K+KhK4tfqjdxRAv3yc+MoCb3AQEf86ZtIEtrjOaVtrZLZEb4GVk43VAHo2t34EXo5/FDQWVRdtdIs7L5TajT9jDZgpvqZQAe9yFwP9thbo+wG3zQaWDcgSWRE16zm14DXLcB58kV08YTyUKKw4KDC8TnHU8SfDpwhgq62z72XIdAADxLHtcAYlQak/2bMAISciEtgoC6XhYHvV85L79DLp5GZTta6mYWo3LJwjxzUgSyXQv6yMfQXw9q/4sQCkz1z19Qi6yAaqtkc6aTv1cN2zCPdFjjsmPdxkPATLhUFfLgNfJspedHiRxM5NWLJPDtpk2hzzp2KPnchTVjSUX1M2MD+z3bowxFPm4NJoiyFgmJRMr+F7HJciZa3s9HUv+0mn9R7T6mABM6XugVpJne50KMylb8mCPz46gV10nUy2xfYT3OuFHVPyN/SWjUkhm7BXm16yXQwZG+O+TNBUA3uxZmXl91GQZGqf14OMeX+S2B++LIxbrVAN3QamaTTJX4O+gZIWAQLOCR4gQUmazQE2cqroqWM00nDG1ZTo9ZzLTPsl8Fo8pGgJfiP/tGc7hjSVsz6vfvRdQs=,iv:3t0Qate3LKwYCMoR4jdAzCtJfMCVW0k3T9EK22io8vU=,tag:AQrbWLhhoWxwOtdxrwvdbA==,type:str]
-    restic-password-nas: ENC[AES256_GCM,data:fMbuwG48Wc2YScNDYO+V2LjmOsjadatzHYSz0m8kvVfe7tw7lCChZanTSuldX9++E8NSxSGh6cvyRXFoX7ISCw==,iv:zSk8hk9+blNC7AZD2iEMly+t/anLzxjsJrqJzdLlqgE=,tag:C2aRaBHR8m6fRoBI/AMm6Q==,type:str]
+    restic-password-nas: ENC[AES256_GCM,data:Hp6UPBipoot5NmFKf6jqYWfPUFFi0QNZAjBhuiGCj3h9t9nTxo8vHL9wlP1fY+vNmRTPcG0YFabgV5Q/4yQZTw==,iv:9gWAoQ2RxsnjJfWKbMw2CFoATb84pMdrTvXd+AsSrlk=,tag:12AxyQrODLvQ4TdZazt+3w==,type:str]
-    restic-password-b2: ENC[AES256_GCM,data:7/Os6960fd0HF8FHgI/UIRS2XahEcu39VJne5usDznIqQgnp1338mZ3S/9Wf4ZBKgGe0bieE/OKOWddSn2UbZA==,iv:WrMvh6++E+ENqg1r8K/q8qgOEBYBziBhIW+3FqtUH8Q=,tag:or+eTDz9QLI//IQgulGJFg==,type:str]
+    restic-password-b2: ENC[AES256_GCM,data:QaTM08WEy2pQSs9s8VWQGi7HPu4cirbQhUixi49Ddjj5ffbqAuL+g7jhJNNCEZKI1Ljra51cv9lAFWTDUhbGwQ==,iv:oSbY9X1HPYG5Kgr8vW5tBN/kBu6APqbav+ONKisxRQI=,tag:Gzfz/O2uTkAtoRSfGxPj+g==,type:str]
-    B2_ACCOUNT_ID: ENC[AES256_GCM,data:4hEA1VTpo5OKyBhB7TfwC0tMS9thhls3aA==,iv:zfueemMDGJBHVMo5XZkuBlczB0SR51ygG5FCx15kZ5s=,tag:oe0Uvy8xHpOrRFPa4eIkww==,type:str]
+    B2_ACCOUNT_ID: ENC[AES256_GCM,data:9FSQY03LaT4Jm21+XQ5VVcfMQJ/QGEU2MA==,iv:OguTShXUeF5cm3Pfb9rC5aHS6LMQP5SlviV12KUi2mE=,tag:OyqEGluTuqYdeaA/g4BGWQ==,type:str]
-    B2_ACCOUNT_KEY: ENC[AES256_GCM,data:ypKpSJtPrdiJXbjNHPIblw2vH3MxlnXoG9p6UJODsw==,iv:g3QCmZI5Z2fmcYuGQZKaydJkrnzSOABFZvARhbzYM/E=,tag:hn/7CnjvQlTekQI3MbiAKQ==,type:str]
+    B2_ACCOUNT_KEY: ENC[AES256_GCM,data:d+qcw1eDNzcVrGoJy2+hy+xpptckxJYN7rSQ+Y/bug==,iv:I5IIcZ8MURrZqn8SncqNvsgaM3QgRMnpzfjwpat5pPw=,tag:CBiigK5dYpxwoVDYYeax2A==,type:str]
 sops:
     age:
-        - enc: |
+        - recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2RXRnQTIvc3pBZUYxUXZo
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0TmpUWGVWczArYllEc2x6
-            VElZVkdNcE95bEdKVGxUdTZuMThvRDdETkdnCmxucXJvYWxHVGZCM0xEMkFDK0I2
+            a3lxNnVmMDdLTTVENVhhQkhnNmFBcHpzdnlZCnRNTENWRUxKZ2VQazJxYmJOS0Ro
-            WjJ2QnY1Y09tU3lyOVVXcWIweGt5R28KLS0tIGNvMS8ydDhaaXVrdEpWUnNySEtI
+            SjlKT1RXdDkyYXpqdlY5bEkvME1YYWMKLS0tIHErcUdRUDBEdTlzbUNZa0Vya2xn
-            MTllRmtEZVdKcElMK3crOUlLQmJ4TEEKXzZkkRdGq/O+0jVB3930QD9ryczL3B7m
+            ckpUQUQ0cGlNVk9BaEZKUDVHQzRjQmMKcCznhR3n3tG96SdrGKarLNKAZoTi4Xj7
-            Mgw9+KXlp3jfOv7xEP2JFjGve4FOP/saJ0OXX8i2gIhNMFUZYoCBHQ==
+            28m3avAtcOMryv0IrHvL4ogC3CdARRuJzh0UL1J+fOnvmwCZeiIjDg==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+    lastmodified: "2026-04-29T19:40:09Z"
+    mac: ENC[AES256_GCM,data:vr6nY1wUMfB131ApoErgg7bIzGfBy9ZOebeTCsB/UI42Y4ZxHWQbP3IQz9RXwlqgSH1/oeslOrHVgQDSX429XgzKkz4GLA4ebybe/hMQQH3tNIYUEMFq4oQCjZ20sbhnQUV98+Bir6GQMjq+r7BueHFixwmOA4lTu/vM4r82Zvw=,iv:MNyWngFH4pPA3hZhDg1kqd5cBanmSBk03Q8pCyA7m+0=,tag:aNCPGwUGqb3hsoCCIiG40A==,type:str]
     encrypted_regex: ^(data|stringData|email)$
-    lastmodified: "2026-05-11T18:13:47Z"
+    version: 3.12.2
-    mac: ENC[AES256_GCM,data:pwrzvtizBP/GRW0gu3aQ6r9YgW6e+s689g4nlePs6Qzs+BljFMlb00Ko+LnX3XGgoynbJFHcsmhQBEDQ/8BYV7BaXPMtYW6V59ShaLUviSnhM47x2QbEoJkNqxBA1YL6fWDz4RL39L9vVeV9uhVJk2xc/+qsXqU3sHieIjjL2UI=,iv:qyLRgnXMKuW6GAuiK5Xn5pDVcHOpBgOfJ7TUOL5HHR4=,tag:lTPrHqKeveXo85yuS6CslQ==,type:str]
-    version: 3.13.0

kubernetes/app/gitea/secret-runner.sops.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: gitea-runner-token
-    namespace: gitea
-stringData:
-    token: ENC[AES256_GCM,data:FyNROq6IY5SYfhiFTV5FoXcFrhyYaDh7x5alZw+J7KRNw4sUQEni2g==,iv:aEFhinL9lsD/Cja3ZIa70AguBtba1qUXC2JOGsSU+Nc=,tag:6Z6HPZQAUgVa6+bQ3weM/g==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaXZiU2RRZU9XbjY3S3Mz
-            anpQV1c4SDJuUEUyYjJldEE1RG9YdTMyMlg4CkFuU3NtMk9nbDEvWWlhUWtzNklI
-            bjBBMjdlQlNqK0dpeU9VdTkvZ3lCdFUKLS0tIE4yWWpsM3B3MSsxdjd0V3hoeUgy
-            UW5pcm01ZXk5cE8rZzR4K1RzcUdxYVEKWxiIA3KFYxXAx803x9GayNi3Sv9DkeC0
-            zbedDZCevB5xiQ5tFekmgu8A6FIMB/lF1IqSqYcUVa6YYcUVfIZmaw==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
-    encrypted_regex: ^(data|stringData|email)$
-    lastmodified: "2026-05-11T18:04:32Z"
-    mac: ENC[AES256_GCM,data:a2l+uFG4HRJRqk7Gj0UsAzexaLwwv5ffNMjs6Oz7esCcAZf/941Yn13evk3hWOsqMTO3AWj5B9blgtakYYO5y5dmI8mD8GdoXiCZF69NCLSGvGuLL6HH3mvp/ZjQQypHQF0W1O4vntdbra4FJp1Nm9iulWeFG/DAO5F8eiv87tU=,iv:Z47KwItcBzBDA1lTZNB9UUGlFUV3jHDrrGyF6AaH+9Q=,tag:0h1dB/WL2MRThvnuj4VT+w==,type:str]
-    version: 3.13.0

kubernetes/app/jellyfin/deployment.yaml

@@ -43,7 +43,7 @@ spec:
               mountPath: /db-local
       containers:
         - name: jellyfin
-          image: jellyfin/jellyfin:10.11.11
+          image: jellyfin/jellyfin:10.11.8
           env:
             - name: JELLYFIN_PublishedServerUrl
               value: https://${JELLYFIN_HOST}

kubernetes/app/media/cronjob-backup.yaml

@@ -129,7 +129,7 @@ spec:
                   mountPath: /backup
           containers:
             - name: resticprofile
-              image: creativeprojects/resticprofile:0.32.0
+              image: creativeprojects/resticprofile:0.33.1
               command:
                 - sh
                 - -c

kubernetes/app/media/deployment-prowlarr.yaml

@@ -45,7 +45,7 @@ spec:
             - psql -d postgres -c 'CREATE DATABASE "prowlarr-log"' || true
       containers:
         - name: prowlarr
-          image: lscr.io/linuxserver/prowlarr:2.4.0
+          image: lscr.io/linuxserver/prowlarr:2.3.5
           envFrom:
             - configMapRef:
                 name: media-common-env

kubernetes/app/media/deployment-qbittorrent.yaml

@@ -29,7 +29,7 @@ spec:
               mountPath: /media
       containers:
         - name: qbittorrent
-          image: lscr.io/linuxserver/qbittorrent:5.2.2
+          image: lscr.io/linuxserver/qbittorrent:5.2.0
           envFrom:
             - configMapRef:
                 name: media-common-env

kubernetes/app/media/deployment-radarr.yaml

@@ -54,7 +54,7 @@ spec:
             - psql -d postgres -c 'CREATE DATABASE "radarr-log"' || true
       containers:
         - name: radarr
-          image: lscr.io/linuxserver/radarr:6.2.1
+          image: lscr.io/linuxserver/radarr:6.1.1
           envFrom:
             - configMapRef:
                 name: media-common-env

kubernetes/app/media/release-seerr.yaml

@@ -18,7 +18,7 @@ spec:
   targetNamespace: media
   values:
     image:
-      tag: v3.3.0
+      tag: v3.2.0
     podLabels:
       app: seerr
     extraEnv:

kubernetes/config/cluster-vars.sops.yaml

@@ -35,11 +35,11 @@ stringData:
     SEERR_HOST: ENC[AES256_GCM,data:l64ttp+rLNU8GfwIE4fhJROSMDEb,iv:1vHOw0LyGN9OMhYemhtRq9GE2fc4J2EprZU3bp/h4kk=,tag:WNV0Jh7816ra7IIOBMspBg==,type:str]
     FIREFLY_HOST: ENC[AES256_GCM,data:EQdrW33PVlD/brZCqh/sTkqLdPWW/bo=,iv:zbNnjsT1J6lpCEWtvNyL4A3bjWsusCjI5goWcZ8hajk=,tag:VwA6YA056bsyYIKB+X59bw==,type:str]
     GITEA_HOST: ENC[AES256_GCM,data:Ky3tXS9E9iadabpVzoK5zEbigmtn,iv:t6OdQeQ7Kxzb7qbi+KeoOkJd0XE2Dse5P1fFyiHM6tg=,tag:GpmHtVDr0IQVbpbALVx40g==,type:str]
-    BLOG_HOST: ENC[AES256_GCM,data:eADRFTla/PPFLVCoP9uKvPZ1YhY=,iv://xbCGLkZ6guGMDU0MnVtGR0adgMqNbe0zrCerj7w8k=,tag:HHXvN6y3YvJ4U4TkENkYVA==,type:str]
     BACKUP_LOCAL_HOST: ENC[AES256_GCM,data:ABaTI3NKkhF7K2FpPwvvrHA0l/tCxAi4Qek=,iv:34ixxSpKU1c12uoMdk4nz2Vo/+5A/npB7NWMsWFytIM=,tag:qjw2fQBebCKnqCnAPiBHaw==,type:str]
 sops:
     age:
-        - enc: |
+        - recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXekorS3lvckhHelE0NGVP
             Z0JSSmtTRk1yZEoxTVU4MnhaN2VjajU2cmhnCkEyWU0yandxUnZGZm5yWXJmQlM4
@@ -47,8 +47,7 @@ sops:
             MGJ6TFpwR0diNjlEN2syZkhNMFNwRDQK9pzmQGB0GQu6ogMIJW+kugvBNj3w+dxW
             bfEF9GAznIM/N5rPytF4wNgqwfoAF7GwumgA+iD43wprKtUJn+6dqw==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+    lastmodified: "2026-04-29T19:47:22Z"
+    mac: ENC[AES256_GCM,data:WgVeGY1tGl3Y97FRGNVEkM2J4WKeHil6ki2Jsww1QOsAdGyL7QaL0vPpfRfDc8FRHhyeahS7ShacUvBKnL5Lihxnrqhkd8wA0BgxONk0k/W8/WtU/tvhXpTwxTWgQ5VyPtX3QwwkAcGTARBu+Xrp2y9QGXU8NPO56eH6cUGPEW4=,iv:KjZbbRfhy4ZHtv38MHlX8jxK+9pp/U2aGaX+d8HRK3E=,tag:wcdQVdpYR9czzeYMi554oQ==,type:str]
     encrypted_regex: ^(data|stringData|email)$
-    lastmodified: "2026-05-11T19:20:10Z"
+    version: 3.12.2
-    mac: ENC[AES256_GCM,data:eA4MCmIA7iuC6gelQqWfIWPBb5w+93BLfU2ZhqLMbIna+OIk0tOjogcVz89H+x72ryMB+39a1vD+cYzLcF16Zl0uVHB5UiK9UDssJ26nbt8SK18F9Ew0a0WLp+gCj2qNAB2Od8+rLOKccfmHm1x+C5RuvYnRE4A1U1VNu6sPx3Q=,iv:epN8ZWNF0taoWm94eR+Unx9TUvjSIlKMgacLfbyj94w=,tag:a9f+8K7SOQmFJaZZ2PjnMQ==,type:str]
-    version: 3.13.0

kubernetes/infrastructure/controllers/authelia/redis-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: redis
-      version: 25.5.3
+      version: 25.x
       reconcileStrategy: ChartVersion
       sourceRef:
         kind: HelmRepository

renovate.json

@@ -5,8 +5,7 @@
     ":semanticCommits",
     "local>oleksandr/homelab//kubernetes/app/jellyfin/renovate.json",
     "local>oleksandr/homelab//kubernetes/app/media/renovate.json",
-    "local>oleksandr/homelab//kubernetes/app/immich/renovate.json",
+    "local>oleksandr/homelab//kubernetes/app/immich/renovate.json"
-    "local>oleksandr/homelab//kubernetes/app/gitea/renovate.json"
   ],
   "enabledManagers": ["kubernetes", "custom.regex"],
   "automergeType": "branch",