chore(k8s/gitea): update gitea/gitea docker tag to v28

kubernetes/app/firefly/release.yaml

@@ -26,7 +26,7 @@ spec:
 
     image:
       # renovate: datasource=docker depName=fireflyiii/core
-      tag: version-6.6.6
+      tag: version-6.7.6
 
     podSecurityContext:
       seccompProfile:

kubernetes/app/gitea/release.yaml

@@ -199,11 +199,11 @@ spec:
         type: RuntimeDefault
 
     image:
-      # renovate: currentValue=1.27.3-rootless currentDigest=sha256:1c17ecaead42eb3b5391553d8708103a4beb0e86edf5b9ebc1eb269c318845f2
+      # renovate: currentValue=28.0.0-rootless currentDigest=sha256:c168e7ccb767164793a67e1e874639488260795567337452b06292d1515bea12
 
-      tag: 1.27.3
+      tag: 28.0.0
 
-      digest: sha256:1c17ecaead42eb3b5391553d8708103a4beb0e86edf5b9ebc1eb269c318845f2
+      digest: sha256:c168e7ccb767164793a67e1e874639488260795567337452b06292d1515bea12
       rootless: true
       pullPolicy: IfNotPresent
 

kubernetes/app/grocy/cronjob-backup.yaml

@@ -25,8 +25,10 @@ spec:
                 - sh
                 - -c
                 - |
+                  set -e
                   apk add --no-cache sqlite
-                  sqlite3 /db-local/grocy.db ".backup /backup/grocy.db"
+                  sqlite3 "file:/db-local/grocy.db?mode=ro" ".backup /backup/grocy.db"
+                  [ "$(sqlite3 /backup/grocy.db 'PRAGMA integrity_check')" = ok ]
               volumeMounts:
                 - name: db
                   mountPath: /db-local

kubernetes/app/homepage/deployment.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: homepage
-          image: ghcr.io/gethomepage/homepage:v2.3.0
+          image: ghcr.io/gethomepage/homepage:v2.4.0
           ports:
             - containerPort: 3000
               name: http

kubernetes/app/immich/release.yaml

@@ -28,7 +28,7 @@ spec:
           main:
             image:
               repository: ghcr.io/immich-app/immich-server
-              tag: v3.2.0
+              tag: v3.2.4
             resources:
               requests:
                 cpu: 100m

kubernetes/app/jellyfin/cronjob-backup.yaml

@@ -5,6 +5,11 @@
 # The volume is mounted read-write on purpose: jellyfin.db is in WAL mode, and
 # SQLite cannot open a WAL database from a read-only filesystem once Jellyfin has
 # closed it and removed the -wal/-shm files (e.g. while scaled to zero).
+# The connection itself is read-only (?mode=ro). A read-write connection that
+# believes it is the last one checkpoints and deletes -wal/-shm on close; when
+# Jellyfin had lost its POSIX locks this deleted them under the running server
+# and corrupted jellyfin.db (2026-09-16). The copy is integrity-checked so a
+# broken snapshot fails the job instead of landing in restic.
 apiVersion: batch/v1
 kind: CronJob
 metadata:
@@ -27,14 +32,15 @@ spec:
           restartPolicy: OnFailure
           initContainers:
             - name: sqlite-backup
-              image: alpine:3.24
+              image: alpine:3.21
               command:
                 - sh
                 - -c
                 - |
                   set -e
                   apk add --no-cache sqlite
-                  sqlite3 /db-local/jellyfin.db ".backup /backup/jellyfin.db"
+                  sqlite3 "file:/db-local/jellyfin.db?mode=ro" ".backup /backup/jellyfin.db"
+                  [ "$(sqlite3 /backup/jellyfin.db 'PRAGMA integrity_check')" = ok ]
               volumeMounts:
                 - name: db
                   mountPath: /db-local
@@ -84,7 +90,8 @@ spec:
 # media files and the metadata providers.
 # Intro Skipper keeps its results in two live WAL-mode SQLite databases, so they
 # are snapshotted with sqlite3 ".backup" rather than copied as files (which could
-# capture a torn page mid-write). Read-write mount for the same reason as above.
+# capture a torn page mid-write). Read-write mount and read-only connection for
+# the same reasons as above.
 apiVersion: batch/v1
 kind: CronJob
 metadata:
@@ -107,7 +114,7 @@ spec:
           restartPolicy: OnFailure
           initContainers:
             - name: sqlite-backup
-              image: alpine:3.24
+              image: alpine:3.21
               command:
                 - sh
                 - -c
@@ -116,7 +123,8 @@ spec:
                   apk add --no-cache sqlite
                   mkdir -p /backup/introskipper
                   for db in introskipper.db introskipper-cache.db; do
-                    sqlite3 "/config/data/introskipper/$db" ".backup /backup/introskipper/$db"
+                    sqlite3 "file:/config/data/introskipper/$db?mode=ro" ".backup /backup/introskipper/$db"
+                    [ "$(sqlite3 "/backup/introskipper/$db" 'PRAGMA integrity_check')" = ok ]
                   done
               volumeMounts:
                 - name: config

kubernetes/app/jellyfin/deployment.yaml

@@ -43,7 +43,7 @@ spec:
               mountPath: /db-local
       containers:
         - name: jellyfin
-          image: jellyfin/jellyfin:12.0
+          image: jellyfin/jellyfin:12.1
           env:
             - name: JELLYFIN_PublishedServerUrl
               value: https://${JELLYFIN_HOST}

kubernetes/app/media/deployment-prowlarr.yaml

@@ -45,7 +45,7 @@ spec:
             - psql -d postgres -c 'CREATE DATABASE "prowlarr-log"' || true
       containers:
         - name: prowlarr
-          image: lscr.io/linuxserver/prowlarr:2.5.2
+          image: lscr.io/linuxserver/prowlarr:2.6.5
           envFrom:
             - configMapRef:
                 name: media-common-env

kubernetes/app/media/deployment-qbittorrent.yaml

@@ -29,7 +29,7 @@ spec:
               mountPath: /media
       containers:
         - name: qbittorrent
-          image: lscr.io/linuxserver/qbittorrent:5.2.3
+          image: lscr.io/linuxserver/qbittorrent:5.2.4
           envFrom:
             - configMapRef:
                 name: media-common-env

kubernetes/app/media/deployment-radarr.yaml

@@ -54,7 +54,7 @@ spec:
             - psql -d postgres -c 'CREATE DATABASE "radarr-log"' || true
       containers:
         - name: radarr
-          image: lscr.io/linuxserver/radarr:6.3.0
+          image: lscr.io/linuxserver/radarr:6.4.4
           envFrom:
             - configMapRef:
                 name: media-common-env

kubernetes/app/media/deployment-sonarr.yaml

@@ -54,7 +54,7 @@ spec:
             - psql -d postgres -c 'CREATE DATABASE "sonarr-log"' || true
       containers:
         - name: sonarr
-          image: lscr.io/linuxserver/sonarr:4.0.19
+          image: lscr.io/linuxserver/sonarr:4.0.20
           envFrom:
             - configMapRef:
                 name: media-common-env

kubernetes/app/media/release-seerr.yaml

@@ -18,7 +18,7 @@ spec:
   targetNamespace: media
   values:
     image:
-      tag: v3.4.1
+      tag: v3.5.0
     podLabels:
       app: seerr
     extraEnv:

kubernetes/app/paperless/deployment.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: paperless
-          image: ghcr.io/paperless-ngx/paperless-ngx:3.1
+          image: ghcr.io/paperless-ngx/paperless-ngx:3.2
           ports:
             - containerPort: 8000
               name: http

kubernetes/app/pihole/deployment.yaml

@@ -27,7 +27,7 @@ spec:
               mountPath: /data
       containers:
         - name: pihole
-          image: pihole/pihole:2026.02.0
+          image: pihole/pihole:2026.07.2
           envFrom:
             - configMapRef:
                 name: pihole-config
@@ -95,7 +95,7 @@ spec:
               mountPath: /data
 
         - name: dnscrypt-proxy
-          image: klutchell/dnscrypt-proxy:v2.1.15
+          image: klutchell/dnscrypt-proxy:v2.1.18
           imagePullPolicy: IfNotPresent
           env:
             - name: TZ

kubernetes/app/podsync/configmap.sops.yaml

@@ -4,19 +4,19 @@ metadata:
     name: podsync-config
     namespace: podsync
 data:
-    config.toml: ENC[AES256_GCM,data:4C8zSvWM9kMxII0RU9EhfUvQGgZMJTtMUOVM9LGunfpkmZQjH3IrbsytgzZBbw7ha7IHjhLxvdXleHNXbc2ZCbphp/lhIrqOLsa2f8J/P/ppyJVLafEt+bQB4lVXVauhy72bV/9RZYIgCatDYMR7+sJVWGyl1f6ZnJ3S+nVXROXPmlxlDhJnCwPUVj+OVq7OKnDjspZpnlZizr5tRzMMJPVuVTDi9cKDFHnoL2x7iINyzvJk8Wb4N+k481sY7isJ5BJyTno3RNKhcykL8cfZQunQ1mlBodvZiSph1gAxY3H3oljb2uB0Zf4J3FkpSCPkIQBpGec+NiQAjPRk5zot0VCZVvtAEL1UfctvhcnhbMwNQbEfdvewFXbIF6lwuatI/gd2+ICuas19n6luzwAfw+WGOHtEDbsIccl6l9lfphid7TotKs992LqBVL3BuCoGM4kqe/8QZc+iaw2VbjGxJhim9T0NnvvPlj8WJ/hnOy+e4wLmzKZcryUNjqQdpzlPr/CFwlnKgU26zjyb6438vf0mC06Mp1AHCoqznZkLPOeJC7YeEybf0T2Dm1/7e0iBFVFVSX3zCUQ0fS1vCyulszUUNsJtAsgg/KkqDSiqT6YWWsUaDZ5qbkcIsQNBFcQVX3Owm7x2tcppi9xYOCFfIDxAx0ugx6kKTf/4XfZ4yIRyUhIETny3P/4WoHCzIz6Hd65RaxbIwbyRz8U8mFbsDtk3o+7c/6UsX1uEFJjoFFlrOcy9ID1um8LXGxicB6VdrtNfwWiFq9Vwf+eHdKFMC5fSqtuSu/yDHKC8w2eb98IG9k0rf+4NHzRlxYPhCUs8YJsWJYpXC4tK8fPWLg7zuByf8nnUQ405Ga8ZvcuDQ9xDWFtMg8JJoZ1wODHIJiovIxNlZQmuxGrrpI5+S4CZKVjEVgD7GRXn3ewDVMk8Tdaf1iq0x09cxj52rgf3VxeOiVolrNJgzygePvYSxb30nsMpQSmmLCGCp5viJ0FhH6MuccJK9wmzJiEYuC5OkhGHaQLkAUDdroZTBDek/AQGzdu8J+NL+Qk3KuJ1ZQs1xgzpB74vqAdjAUUNzZlDw5hejv7enjstTjU1usy88Y8Lf1AORHiGcLzxpwjdeQQFsTuBqPVCHs7Nt9xYYk5nbv8wXM8Z7gk/+SMJayTOq5PDfLZNd530M1rMBIZ1HSBvYsAQvGVd91xjoMvMs04VCoGZcFZuurukx9Rh6U/5pm5roIXkmWHFp/2S3HfnBqEbQYbqrV5jXGQs6yIEQcRT91UY7csdnDL9fzlR37T21cOXfo2CrCzZyaTfGh+y6GusC9xg9qaBihno+PxOV++h80Nd5MsYSXIjaXTX8CioKaCMCToEXHzWUUsr+tHopMR0fG+QJAiZ2Fa7c5dYAU2EKkyfziuhGPSxHBxrc9W/0VjfB10Vf+iFVGCP2JEm99G7esQNh9kszSkyY2wOycUllqQO3eT9dHsSFdswq/bvKgkvQz0oOmJcubE1jvUn7YW8CF6KABlM5L/hi+ntcNc2YWLWqaNghOQsjCbpiqjdp6pejiM9g+3NbC7O2Z8Nf0zwgka7FRQXaJfl+FHFb3X2Qk4VGiinoK+EVCQX4CCD9EYK065jkdTpqDDESy1n4SUMIkE2iA==,iv:cpa826ZkBPSc/ZX4P6sJ5kgDXMfryd+d3UAsbfb7764=,tag:V3FERsM9ZfNO8TbHEsf86w==,type:str]
+    config.toml: ENC[AES256_GCM,data:MvMimo9Cn94BXQzCQqnlt3z0aSzoDwq5t2I9OHXATGuX2+q7lTksBMh3Vz5CHm5YY9xvXtPqO5kRPtoYuaDwvsM3vWe9zXclThJOQJqND/haV188yvoDw1jCWe7a2zGQ3SsgpJYBncZJ44/cMYn9mWj7wXdUegFOFfi/4g+xGBZ2c4aQmJAD5lHz3PJW9WrDYqlfBbX8Ipt1OQtZd1FKHSTmbifqvzoLv34qUKxz/LY9RiFOpBNXRhH53aDRpiMuHdtl4I9eFZi4B/EXqhdFZXLCTAKMi2bDT2xSHkefAfexvyHzV0Uv2z+ZWdzuUua/S17JHkA53sIxMk60bkE9VU8JDuStqRGj1kZy7dgGoKZceuK7O7SF9RMj6f/zsnmAYhye65T0EziK764TqEMibOL/tgfOMSmQcEae4+YzuD9KepTe0sLjowFRfb7fwCHMU/AO96u0HyWx67mrZwPMCyffCPIZDKPflQ+qPpmcSqGHJ7q7TBiPyPApv/Vp/91oULuwPLlgY7ovLvfV5xsjzKkeFHsYB2G+rgG2qGMvykAwtGaoD65/Cm4PG6rqy9pUKEy3yU+cX6ie2uX1aAKBsBSMgZsT9+fK7Eh/Oq/O9jwiCbDztEQ0CpSAVxwHDEwHa5ibCDFCSw92/JKEu/wy8Mt5xzeXbZt9t9tgB2jrZlYUfRNqlPPjYsLAd4WLSlovqKg7qkn6u96tXaMAagdSXu7P4Su4GjMljai4az5FQRUoIC6t6aPa9pIU+JHmI/UzX6dnrX7RygkfIFZyl2llpmtoICKOZkA58/3arzebkrcpASWn4g3gNIEFUa6Cxev9WAk557LLybJ4bc9meqyZfagsCATk2HfAaVMWvWu+Ul3w2DaXoklbOPlT1Mn+WtpHT1h6wj0h7JDz+WYA88Bk9f+aAxPPSv+JE6lEzrnCtPxFHpNmN6iSvX36S6ZKAJO/djDkHt/A2D52mme6j1GGfwZ3UtKACgDEV6fvw+Rcedu3O9IvyzOQZwxOODasIN4nhPzfyhXvHQT9sjZSMIYoKIlfVEylfEEHtlc3eHc18WUMpFJROUuteDmiAalD+swNBNZ6xEv2KTjkK3kSMvbdkC0ZyFZf43D72JCLwHK4Pcn3vFUeXQ3pZVjSTSnDntcs6HPJvBywxQqUmj02zks47TfOVcdWGSeZ2hmyTqrQfHD/n5ChO2yp0629CqlGtBfnQht+tUo7vnUNiY1+vbCHzAi3D4mBCQs4ftOvPqbWmN/s1NbPG9+TR/BricGoRTr5nNrlgtRBA8DEldpQjEyvrtIEoS/qgKeNFOVBqs8mHBr0fnk4ZQgMJx2KOPxcG210xfvQOOmhUHbdo1fF7K430TsI/PszN2QsI8MgmSoLp0CoeQWdVzWiGbOyww6vdYMgstELWE9YVrr+EXIp2lcwvIZFDApRx9PofArUNEGIiOQJ9BLR9QjFiicLXboz/l6XuQov4nnLJc9oL7Jfyv3zjbnCzzhwFN+bs0RjaBqEv7uA6BAnPre7tSwKqNjTwyPu9DSffGiZFQdjtGZgYyxxGiMAqE++vj5eU8YVkVO9BO7sMfa4pl0GH7g6Lu7MSMv5B4MU79RTjr5E5n/LCIIcWF8PE963NATScK+rh8BmEC6tm3VQ4FFAT+wwX8vGlBIFJ0Xr0hpgr6tnKD9vFMx+wHEvJEydQZgDDmmOyOWHe+eNWdJxSTZBSrteGx62HysjeA0Xivb9dH5qgF/UDNNNDFjrAqyEALfke+XTOX9PkvOwP7S+RcfkfNH2pIALYksSox8+CSUrEfSffFmywn7mrGP5moFHod3kHQumF+/HLAlP6AvU+J1WNrXggNn85mPcFuHhR8tW5JNpvUpDhVzM7Jzb+4ZM3y6ZE3Dk+cdrfBntdh6p6i3VIfX0/pmm8hgzbKn/V77SYEkUaX0n7pjyjYrRMoGOh7qOjKWgxla48LthD4JS8qxIMpmbMy6z1Fy5PY3/gFJ7ATmKgdj2UgB5Wy/48P18HQZ665gnInBLpY01f59XaCVCoPZ0oszzht4Xcyl7mW3a5voh4DTqtKcrPlVKC7Acjuobi16/gtUUOwsCR0AQa9XTqT+yvX0rZwG0TNeLWBOchWX1HGFrrGN/m2GY5LmSXmcIfTb0KVy7ufQWblnbLxmUSvhwtbu2hwc466B2NFijlqJd3fi4Tz9xRdX0JJj0BV4A75agqg==,iv:ArCBeoyoh0RvuQSQ9W6RNF83T5ukZzBUaMZ5QIX9Jmw=,tag:7FFKbTG3iWeADE5fWdo25w==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2QTBUbnNBcGFhYjNiNGRG
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaVFQxWG40NEVzcVBVTmp0
-            T3JqdFY0dTIzWDA3OGNVUkoreVhONXVDeFVVCkR0amlYMThyejlPaWlPSkdGL0xy
+            bXJrWlRmdW0vK0JaaytiamNrVGM0dG9lQkYwCldjSVQ3akhlbTNITUxvTEE1Z2pY
-            YUN3VEhGajJoQjNiRVV5ckw0cE1JaTAKLS0tIDFSWnpWWVFxQ0VVY2U4bUFtTWVk
+            WGFjQTBoT2w0aXFreFdwcVlVWlBhRGcKLS0tIDBYRnZaK2FkL0YwRkZZb2loRmQx
-            bkg3K01kWFl4ZWZuK21KRTIxUEhDUEEKPGWzrJlyZGNOsvrVhWKw56y8iAwrqDQK
+            VkZOR2g4bWJQTlRudVoyU01KT3FVREkKgqZ3NJtwtWgYThwdOxrerzl0KlaS5Wve
-            OWJYIq0gt9NWfNBao8UpiuKJXU4SX01hW4fa1OEfGSDJAjNNxGpFVA==
+            QxiwAtIrK+zXp/JL0q4UEVs5duO8VnrlS8kc1LvxR+uDt9iVpAWyeg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
     encrypted_regex: ^(data|stringData|email)$
-    lastmodified: "2026-06-22T19:19:33Z"
+    lastmodified: "2026-09-16T20:20:54Z"
-    mac: ENC[AES256_GCM,data:Rd0q5r8DA3I7rNNbv9t/5c1LD0Dm1897rGvqhi4l91g9KpSCxQFu0+z6cUH7yhLCopFSWCezQHnBYEGFEkESl04DYkAAj/+ntLSnAhfHijbZshCdHhzr+bxMInajVbDMJTs0DXm2moFMUpcpVn3EHC3UTr/kj/PDfsK9oXugIW0=,iv:ZmlXvPONTD2w+Agh5QqYr8DMMbAeM/QQuWRsFcrw728=,tag:IRoRIxkcQQQuLbG+ccTxuA==,type:str]
+    mac: ENC[AES256_GCM,data:DY3u/NKp/be29EqpFoWE8B+b6t2rjJ4yy+3iONYgG0o04o8FfAr4IsToncdN9p1SZNqtEyxTmogzazRxqp2eTe4TBBg+Uqnpl2yEWhj9+ESIUJs+2YoWHpnB97+VOHy9hN6jDtUWSoIH7B1E4O54u5dISiw35v5O1bEl4Oxk8fk=,iv:9tUIfbmnjJ1D7nDIYoTxtmtA9Wah5wNwnzeZQkNh2U4=,tag:FNYW90bX5zxTBEb5aRBskg==,type:str]
-    version: 3.13.1
+    version: 3.13.3