chore(k8s/gitea): update gitea/gitea docker tag to v28

2026-10-07 00:01:29 +00:00
16 changed files with 16 additions and 567 deletions
@@ -63,7 +63,6 @@ homelab-v2/
 | **Blog** | Personal static blog served via git-sync + nginx (gh-pages branch) |
 | **Vikunja** | To-do list and task management, SSO via Authelia OIDC |
 | **Reitti** | Personal location history and timeline (PostGIS), SSO via Authelia OIDC |
-| **Dawarich** | Location history and timeline (PostGIS + Sidekiq), evaluated as a Reitti replacement; SSO via Authelia OIDC |

 ## Infrastructure Stack

@@ -1,55 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: dawarich-redis
-  namespace: dawarich
-  labels:
-    app: dawarich-redis
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: dawarich-redis
-  template:
-    metadata:
-      labels:
-        app: dawarich-redis
-    spec:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 999    # redis user in the alpine image
-        runAsGroup: 999
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: redis
-          image: redis:7.4.11-alpine
-          imagePullPolicy: IfNotPresent
-          # Sidekiq job queue. Snapshots (as in upstream compose) survive container restarts;
-          # the emptyDir is lost with the pod, which only drops queued jobs.
-          args: ["--save", "900", "1", "--save", "300", "10", "--appendonly", "no"]
-          ports:
-            - containerPort: 6379
-              name: redis
-          volumeMounts:
-            - name: data
-              mountPath: /data
-          livenessProbe:
-            tcpSocket:
-              port: 6379
-            periodSeconds: 30
-          readinessProbe:
-            tcpSocket:
-              port: 6379
-            periodSeconds: 10
-          resources:
-            requests:
-              cpu: 20m
-              memory: 32Mi
-            limits:
-              memory: 256Mi
-      volumes:
-        - name: data
-          emptyDir: {}
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: dawarich
@@ -1,114 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: default-deny-ingress
-  namespace: dawarich
-spec:
-  podSelector: {}
-  policyTypes:
-    - Ingress
---
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-ingress-controller
-  namespace: dawarich
-spec:
-  podSelector:
-    matchLabels:
-      app: dawarich
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
---
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-app-to-db
-  namespace: dawarich
-spec:
-  podSelector:
-    matchLabels:
-      app: dawarich-db
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - podSelector:
-            matchLabels:
-              app: dawarich
-      ports:
-        - port: 5432
---
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-backup-to-db
-  namespace: dawarich
-spec:
-  podSelector:
-    matchLabels:
-      app: dawarich-db
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - podSelector:
-            matchLabels:
-              app: dawarich-backup
-      ports:
-        - port: 5432
---
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-backup-egress
-  namespace: dawarich
-spec:
-  podSelector:
-    matchLabels:
-      app: dawarich-backup
-  policyTypes:
-    - Egress
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-    - ports:
-        - port: 8888
-          protocol: TCP
-    - ports:
-        - port: 443
-          protocol: TCP
-    - ports:
-        - port: 5432
-          protocol: TCP
-      to:
-        - podSelector:
-            matchLabels:
-              app: dawarich-db
---
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-app-to-redis
-  namespace: dawarich
-spec:
-  podSelector:
-    matchLabels:
-      app: dawarich-redis
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - podSelector:
-            matchLabels:
-              app: dawarich
-      ports:
-        - port: 6379
@@ -1,190 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: dawarich
-  namespace: flux-system
-spec:
-  chart:
-    spec:
-      chart: dawarich
-      version: 2.9.3
-      reconcileStrategy: ChartVersion
-      sourceRef:
-        kind: HelmRepository
-        name: cogitri
-        namespace: flux-system
-  targetNamespace: dawarich
-  interval: 1m0s
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    remediation:
-      retries: 3
-  # The chart hardcodes an unpinned busybox wait-for-postgres init container, no deployment
-  # strategy, and a 130s web startupProbe — too short for the first start, which runs every
-  # migration and seeds the countries table before Puma listens.
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              kind: Deployment
-              name: dawarich
-            patch: |
-              apiVersion: apps/v1
-              kind: Deployment
-              metadata:
-                name: dawarich
-              spec:
-                strategy:
-                  type: Recreate
-                template:
-                  spec:
-                    initContainers:
-                      - name: wait-for-postgres
-                        image: busybox:1.38
-                        imagePullPolicy: IfNotPresent
-                    containers:
-                      - name: dawarich
-                        startupProbe:
-                          failureThreshold: 60
-                        livenessProbe:
-                          periodSeconds: 30
-                          timeoutSeconds: 10
-                          failureThreshold: 6
-                        readinessProbe:
-                          timeoutSeconds: 5
-          - target:
-              kind: Deployment
-              name: dawarich-sidekiq
-            patch: |
-              apiVersion: apps/v1
-              kind: Deployment
-              metadata:
-                name: dawarich-sidekiq
-              spec:
-                strategy:
-                  type: Recreate
-                template:
-                  spec:
-                    initContainers:
-                      - name: wait-for-postgres
-                        image: busybox:1.38
-                        imagePullPolicy: IfNotPresent
-  values:
-    # Release name is dawarich-dawarich (targetNamespace prefix); keep resource names short.
-    fullnameOverride: dawarich
-
-    image:
-      # renovate: datasource=docker depName=freikin/dawarich
-      tag: "1.15.3"
-
-    keyBase:
-      existingSecret: dawarich-credentials    # key: value
-
-    # Every key is rendered into the ConfigMap as UPPER_SNAKE_CASE.
-    env:
-      timeZone: Europe/Kyiv
-      # TLS terminates at Traefik; "https" here turns on Rails force_ssl.
-      applicationProtocol: http
-      distanceUnit: km
-      # Upstream compose default; each thread holds an import batch in memory.
-      backgroundProcessingConcurrency: "3"
-      # OIDC-only login (blocks the web form and the API password sign-in since 1.14.4).
-      allowEmailPasswordLogin: "false"
-
-    # Authentication against Authelia over OIDC only. Unknown Authelia users are auto-created
-    # as regular (non-admin) users.
-    oidc:
-      enabled: true
-      providerName: Authelia
-      clientId:
-        existingSecret: dawarich-credentials
-        existingSecretKeyName: OIDC_CLIENT_ID
-      clientSecret:
-        existingSecret: dawarich-credentials
-        existingSecretKeyName: OIDC_CLIENT_SECRET
-      issuer: https://auth.${AUTHELIA_DOMAIN}
-      redirectUri: https://${DAWARICH_HOST}/users/auth/openid_connect/callback
-      autoRegister: true
-      allowEmailPasswordRegistration: false
-
-    dawarich:
-      hosts:
-        - ${DAWARICH_HOST}
-      resources:
-        requests:
-          cpu: 100m
-          memory: 512Mi
-        limits:
-          memory: 2Gi
-
-    sidekiq:
-      resources:
-        requests:
-          cpu: 100m
-          memory: 512Mi
-        limits:
-          memory: 4Gi    # imports parse whole files in memory (Google Records.json)
-
-    postgresql:
-      host: dawarich-db
-      auth:
-        database: dawarich
-        existingSecret: dawarich-credentials    # keys: username, password
-
-    # Own single Redis (deployment-redis.yaml) instead of the bundled 3-node redis-ha.
-    redis:
-      enabled: false
-      host: dawarich-redis
-      auth: false
-
-    # RWO volumes shared by web and sidekiq — fine on the single node.
-    persistence:
-      public:
-        # Static assets, re-synced from the image on every web start.
-        storageClass: nfs-synology-ssd
-        size: 1Gi
-      watched:
-        # Drop folder: <user-email>/<file> is auto-imported.
-        storageClass: nfs-synology-ssd
-        size: 1Gi
-      storage:
-        # ActiveStorage: uploaded imports, exports, videos.
-        storageClass: nfs-synology-ssd
-        size: 10Gi
-
-    serviceAccount:
-      automount: false
-
-    podLabels:
-      app: dawarich
-
-    # The image starts as root only to chown volumes and gosu-drop when PUID/PGID are set.
-    # Running as 1000 directly skips that; tmp/ is 0777 in the image and the NFS subdir
-    # provisioner creates directories 0777.
-    podSecurityContext:
-      runAsNonRoot: true
-      runAsUser: 1000
-      runAsGroup: 1000
-      seccompProfile:
-        type: RuntimeDefault
-    securityContext:
-      allowPrivilegeEscalation: false
-
-    ingress:
-      enabled: true
-      # No Authelia forward-auth middleware — Dawarich authenticates against Authelia
-      # natively over OIDC. A middleware here would break the OIDC callback and the
-      # api_key-authenticated /api ingest endpoints (OwnTracks, Overland, mobile app).
-      annotations:
-        cert-manager.io/cluster-issuer: letsencrypt
-      hosts:
-        - host: ${DAWARICH_HOST}
-          paths:
-            - path: /
-              pathType: Prefix
-      tls:
-        - secretName: dawarich-tls
-          hosts:
-            - ${DAWARICH_HOST}
@@ -1,38 +0,0 @@
-{
-  "kubernetes": {
-    "fileMatch": ["kubernetes/app/dawarich/.+\\.yaml$"]
-  },
-  "customManagers": [
-    {
-      "customType": "regex",
-      "fileMatch": ["kubernetes/app/dawarich/release\\.yaml$"],
-      "matchStrings": [
-        "#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)\\s*\\n\\s*tag:\\s*[\"']?(?<currentValue>[^\\s\"']+)"
-      ]
-    }
-  ],
-  "packageRules": [
-    {
-      "matchFileNames": ["kubernetes/app/dawarich/**"],
-      "semanticCommitScope": "k8s/dawarich"
-    },
-    {
-      "matchFileNames": ["kubernetes/app/dawarich/**"],
-      "matchPackageNames": ["freikin/dawarich"],
-      "matchUpdateTypes": ["patch", "minor"],
-      "automerge": true
-    },
-    {
-      "matchFileNames": ["kubernetes/app/dawarich/**"],
-      "matchPackageNames": ["freikin/dawarich"],
-      "matchUpdateTypes": ["major"],
-      "automerge": false
-    },
-    {
-      "description": "Ignore infrastructure images",
-      "matchFileNames": ["kubernetes/app/dawarich/**"],
-      "matchPackageNames": ["postgis/postgis", "redis", "creativeprojects/resticprofile"],
-      "enabled": false
-    }
-  ]
-}
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: cogitri
-  namespace: flux-system
-spec:
-  interval: 1m0s
-  url: https://charts.cogitri.dev
@@ -1,27 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: dawarich-credentials
-    namespace: dawarich
-stringData:
-    #ENC[AES256_GCM,data:3gPe9ezMvEnV02kKbZkjtsq2FmJJzXmhtp6CfwYh8icAv/PdAwa3DQCu0oRbgkIV9claZCqDSrhPIaYy5wsQUshL8hyGUYDm/mLNVDsAl9HPz6MlDA==,iv:QOG8JpMEA3IYlcLyrWM8yH9ZHbpwNM1EpC+02J8PCDU=,tag:eIGomi40Pe+7MSOU8POO4w==,type:comment]
-    username: ENC[AES256_GCM,data:Tpj/Iq4oLlg=,iv:9RORl+XlNqG87y3qsqCNj/oRrLzmdVlZCAXD4R1RfXY=,tag:67MSd0HIYEhTqQYfDNUJ2g==,type:str]
-    password: ENC[AES256_GCM,data:BhB59Y5J5pKobyKWOsIWP8jMxPzkL12TkFrTJuCGexw=,iv:VDJdyx7dyHgZh/doBTxBfAiN3NqzmvdCz3Hpxwsafac=,tag:AUtd1ubgOWMbgxm2FzfDpw==,type:str]
-    value: ENC[AES256_GCM,data:Ok4GM6+qnZSQ3c9fyedlXE+LlAoSzIvIQMrCSKLPGp3TQT6PpbouXbR0QveZWZgROmexn0YMs62WCkCdfNfv2DC7SooJ+EksWHKi/m8UTWay7X/WYBlMmSClS3/MeFwsRz5/G4MayIT166C6OhXKB2rPicRMzlU+3dbL9MBDLpw=,iv:gi6C0rbYy3Ie6ati6ACnlqeXjONR/HC3o8xmPGUIF/Y=,tag:jcAQ3YSWZ1DZqr8u+KIBWg==,type:str]
-    OIDC_CLIENT_ID: ENC[AES256_GCM,data:qddOrkEvw0g=,iv:NrS1vRqZG3/4cQyWtEONu16GbFlHJplcHVc75h7+CpQ=,tag:l5Fu5vsPiU6rFGFWziCnzg==,type:str]
-    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:uisMM3Gd6ChnLvg/eyxff9ZGq6uAfs9fryuVOgf+ZGVexKoRn0NT1Ic7rpJ9pUwzhTAO6WGo941MdJmkSxbxXw==,iv:HNZhiPMTMk/aG7Z9hr0r97CFzo8C0PKRL3FtIW2vGns=,tag:+sbLFE2zbdn4M4eyWrvqTA==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTSUdIeXZKNDBVcXVURWpz
-            Wmwrd1hWb0tTcDFmMWZHVG4vZmFmUDNZUnhjCk1PVzQ2RG5Qa2VQZk5PV1VwS09M
-            YUdzVWtsc3dJY256dzRkUTMxdG83OGsKLS0tIERBVVRXTTBsYk1jTTRadmNoOHM0
-            c1F5Q1RsQ1Y1SW9rQUw1ZkwrVVREV1UKI0bO6Nq92fPVPqImWMtWCe5s4r5pLGAf
-            6FWWzTkerOnQ4n7iGoAPtnuFbo6wUBypm4yirbgX6ErzU5vTWJWHWw==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
-    encrypted_regex: ^(data|stringData|email)$
-    lastmodified: "2026-10-08T10:16:10Z"
-    mac: ENC[AES256_GCM,data:HcMG1/LqcljJ6b6LZvXZqKdT3LGFNikH/1PQKzxL+71lwSqlg3k5L0pDNObSfRZeYMeCQTMJWCzgt2qlUlpML58DFTRC0B6K3bofHJixhJT1cS62rzngR0iRY4KVepI6qZACfTh8mwzt15Zrpy9ZMRvV1GSwnxpgaXJVyCMqWnw=,iv:7GHyXB1nA1WAbkI396l4Vw5RtcsYW9n70b+ybOUo6ds=,tag:YbqsKjek9ZnExzghSupuDw==,type:str]
-    version: 3.13.3
@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: dawarich-db
-  namespace: dawarich
-spec:
-  clusterIP: None
-  selector:
-    app: dawarich-db
-  ports:
-    - port: 5432
-      targetPort: 5432
@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: dawarich-redis
-  namespace: dawarich
-spec:
-  selector:
-    app: dawarich-redis
-  ports:
-    - port: 6379
-      targetPort: 6379
-      name: redis
@@ -1,88 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: dawarich-db
-  namespace: dawarich
-  labels:
-    app: dawarich-db
-spec:
-  serviceName: dawarich-db
-  replicas: 1
-  selector:
-    matchLabels:
-      app: dawarich-db
-  template:
-    metadata:
-      labels:
-        app: dawarich-db
-    spec:
-      securityContext:
-        runAsUser: 999
-        runAsGroup: 999
-        fsGroup: 999
-      containers:
-        - name: postgres
-          # Dawarich requires PostGIS; the Debian variant keeps the postgres user at UID 999
-          # (the alpine variant upstream uses has 70). The image creates the postgis extension in POSTGRES_DB.
-          image: postgis/postgis:17-3.5
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: dawarich-credentials
-                  key: username
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: dawarich-credentials
-                  key: password
-            - name: POSTGRES_DB
-              value: dawarich
-            - name: PGDATA
-              value: /var/lib/postgresql/data/pgdata
-          ports:
-            - containerPort: 5432
-          startupProbe:
-            tcpSocket:
-              port: 5432
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            failureThreshold: 30
-          livenessProbe:
-            tcpSocket:
-              port: 5432
-            periodSeconds: 30
-            failureThreshold: 5
-          readinessProbe:
-            tcpSocket:
-              port: 5432
-            periodSeconds: 10
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 50m
-              memory: 256Mi
-            limits:
-              memory: 2Gi    # includes the 1Gi /dev/shm below
-          volumeMounts:
-            - name: data
-              mountPath: /var/lib/postgresql/data
-            - name: shm
-              mountPath: /dev/shm
-      volumes:
-        # Upstream compose sets shm_size: 1G — parallel queries over the points table
-        # exceed the 64M container default.
-        - name: shm
-          emptyDir:
-            medium: Memory
-            sizeLimit: 1Gi
-  volumeClaimTemplates:
-    - metadata:
-        name: data
-      spec:
-        accessModes: ["ReadWriteOnce"]
-        storageClassName: nfs-synology-ssd
-        resources:
-          requests:
-            storage: 10Gi
@@ -199,11 +199,11 @@ spec:
        type: RuntimeDefault

    image:
-      # renovate: currentValue=1.27.3-rootless currentDigest=sha256:1c17ecaead42eb3b5391553d8708103a4beb0e86edf5b9ebc1eb269c318845f2
+      # renovate: currentValue=28.1.0-rootless currentDigest=sha256:b1a90409ae9afcd5a5725404c3639da7245248848b99e35332968891290b953e

-      tag: 1.27.3
+      tag: 28.1.0

-      digest: sha256:1c17ecaead42eb3b5391553d8708103a4beb0e86edf5b9ebc1eb269c318845f2
+      digest: sha256:b1a90409ae9afcd5a5725404c3639da7245248848b99e35332968891290b953e
      rootless: true
      pullPolicy: IfNotPresent

@@ -28,7 +28,7 @@ spec:
          main:
            image:
              repository: ghcr.io/immich-app/immich-server
-              tag: v3.3.0
+              tag: v3.2.4
            resources:
              requests:
                cpu: 100m
@@ -39,7 +39,6 @@ stringData:
    VIKUNJA_HOST: ENC[AES256_GCM,data:1VVkvVrdx02jPxHsQoQI9zJKN9v/9mE=,iv:ZagDcljNclEGvmMzS6pJWTv+FMa/a/X6POaWb+kHJuo=,tag:RuaUoX8O4LrEs491Sp4UyQ==,type:str]
    BACKUP_LOCAL_HOST: ENC[AES256_GCM,data:ABaTI3NKkhF7K2FpPwvvrHA0l/tCxAi4Qek=,iv:34ixxSpKU1c12uoMdk4nz2Vo/+5A/npB7NWMsWFytIM=,tag:qjw2fQBebCKnqCnAPiBHaw==,type:str]
    REITTI_HOST: ENC[AES256_GCM,data:Zx0T6aUL/v6ogX1miRxzDmDQ31EImg==,iv:0LBRaaG1FHBXFWrtDX8Z6Cs75BEA7hNYm5FFrBHhyYk=,tag:Tup6HoL6E+L9GJKmv3x17Q==,type:str]
-    DAWARICH_HOST: ENC[AES256_GCM,data:Gpt9acoks8gnlvHnMLsFhH18fzu0sLjp,iv:QrJd20KcFtMlWarCgMVv1riUlJF3Qj/aYa2vJQizmpg=,tag:JTmmJHZ9u4ecg3/8frYSEA==,type:str]
 sops:
    age:
        - enc: |
@@ -52,6 +51,6 @@ sops:
            -----END AGE ENCRYPTED FILE-----
          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
    encrypted_regex: ^(data|stringData|email)$
-    lastmodified: "2026-10-08T10:16:10Z"
-    mac: ENC[AES256_GCM,data:CYjhG3nyn95vgIdpaSxiRl+wR5tm+YOQv2GbfAIPBe62j5dEPxYF6JRFDMxBrQIbQkEgSQ+lWYN8verXZ1SnBSUJ7elKeFDn6ioJsuXF3eMBMZhgQKLo8kgOnYajgVh5sNJsmtdrH9Ret+DudeMb+bvgV7gSETKhVKAWC8h64f8=,iv:4hNo9beooqlJYkOB9i3vzfiXofUcPMy6BDcktIm1U6k=,tag:prnXCtS3bjjUs+1YS9CzlA==,type:str]
+    lastmodified: "2026-10-03T20:20:00Z"
+    mac: ENC[AES256_GCM,data:xN+k2RvU+IJyYzLRIExm0qM5F/K4s19jm0Sp1fo4L3V2dZHSb1J/JtdtxpbalA3qGxy82qDosagrhrNtdsL2/Ht7JO5f1T3Q1Z5smOBOkvWrjPqnyOWGGwe4j77UY41k50kXNh1VFbhjBYkEei+8191BlMkEmTNSdBvFdvzydIw=,iv:1Q3otFunhnMgrJI8z4XFsp92PHmogEvYi99qAkgJomo=,tag:ikTXnDjTG9fNFrumBGW5Lw==,type:str]
    version: 3.13.3
@@ -13,8 +13,7 @@
    "local>oleksandr/homelab//kubernetes/app/lubelogger/renovate.json",
    "local>oleksandr/homelab//kubernetes/app/firefly/renovate.json",
    "local>oleksandr/homelab//kubernetes/app/podsync/renovate.json",
-    "local>oleksandr/homelab//kubernetes/app/reitti/renovate.json",
-    "local>oleksandr/homelab//kubernetes/app/dawarich/renovate.json"
+    "local>oleksandr/homelab//kubernetes/app/reitti/renovate.json"
  ],
  "enabledManagers": ["kubernetes", "custom.regex"],
  "automergeType": "branch",