feat(k8s/infrastructure/authelia): skip OIDC consent screen with implicit consent mode

kubernetes/app/archmirror/configmap-nginx.yaml

@@ -6,6 +6,8 @@ metadata:
   namespace: archmirror
 data:
   nginx.conf: |
+    worker_processes auto;
+
     events {
         worker_connections 1024;
     }
@@ -15,6 +17,8 @@ data:
         default_type application/octet-stream;
 
         sendfile on;
+        # NFS reads block the worker; offload them so /health keeps answering
+        aio threads;
         gzip on;
 
         server {

kubernetes/app/dawarich/release.yaml

@@ -42,7 +42,7 @@ spec:
                   spec:
                     initContainers:
                       - name: wait-for-postgres
-                        image: busybox:1.38
+                        image: busybox:1.37
                         imagePullPolicy: IfNotPresent
                     containers:
                       - name: dawarich
@@ -69,7 +69,7 @@ spec:
                   spec:
                     initContainers:
                       - name: wait-for-postgres
-                        image: busybox:1.38
+                        image: busybox:1.37
                         imagePullPolicy: IfNotPresent
   values:
     # Release name is dawarich-dawarich (targetNamespace prefix); keep resource names short.
@@ -77,7 +77,7 @@ spec:
 
     image:
       # renovate: datasource=docker depName=freikin/dawarich
-      tag: "1.15.3"
+      tag: "1.21.0"
 
     keyBase:
       existingSecret: dawarich-credentials    # key: value

kubernetes/app/firefly/release.yaml

@@ -26,7 +26,7 @@ spec:
 
     image:
       # renovate: datasource=docker depName=fireflyiii/core
-      tag: version-6.7.7
+      tag: version-6.7.9
 
     podSecurityContext:
       seccompProfile:

kubernetes/app/homepage/deployment.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: homepage
-          image: ghcr.io/gethomepage/homepage:v2.4.0
+          image: ghcr.io/gethomepage/homepage:v2.7.0
           ports:
             - containerPort: 3000
               name: http

kubernetes/app/immich/release.yaml

@@ -28,7 +28,7 @@ spec:
           main:
             image:
               repository: ghcr.io/immich-app/immich-server
-              tag: v3.3.0
+              tag: v3.3.6
             resources:
               requests:
                 cpu: 100m

kubernetes/app/jellyfin/deployment.yaml

@@ -43,7 +43,7 @@ spec:
               mountPath: /db-local
       containers:
         - name: jellyfin
-          image: jellyfin/jellyfin:12.2
+          image: jellyfin/jellyfin:12.4
           env:
             - name: JELLYFIN_PublishedServerUrl
               value: https://${JELLYFIN_HOST}

kubernetes/app/lubelogger/release.yaml

@@ -18,7 +18,7 @@ spec:
   values:
     image:
       # renovate: datasource=docker depName=ghcr.io/hargata/lubelogger
-      tag: "v1.7.3"
+      tag: "v1.7.4"
 
     updateStrategy:
       type: RollingUpdate

kubernetes/app/media/deployment-prowlarr.yaml

@@ -45,10 +45,13 @@ spec:
             - psql -d postgres -c 'CREATE DATABASE "prowlarr-log"' || true
       containers:
         - name: prowlarr
-          image: lscr.io/linuxserver/prowlarr:2.6.5
+          image: lscr.io/linuxserver/prowlarr:2.7.0
           envFrom:
             - configMapRef:
                 name: media-common-env
+          env:
+            - name: PROWLARR__SERVER__TRUSTEDNETWORKS
+              value: ${POD_CIDR}
           ports:
             - containerPort: 9696
               name: http

kubernetes/app/media/deployment-qbittorrent.yaml

@@ -29,7 +29,7 @@ spec:
               mountPath: /media
       containers:
         - name: qbittorrent
-          image: lscr.io/linuxserver/qbittorrent:5.2.4
+          image: lscr.io/linuxserver/qbittorrent:5.3.0
           envFrom:
             - configMapRef:
                 name: media-common-env

kubernetes/app/media/deployment-radarr.yaml

@@ -58,6 +58,9 @@ spec:
           envFrom:
             - configMapRef:
                 name: media-common-env
+          env:
+            - name: RADARR__SERVER__TRUSTEDNETWORKS
+              value: ${POD_CIDR}
           ports:
             - containerPort: 7878
               name: http

kubernetes/app/media/deployment-sonarr.yaml

@@ -58,6 +58,9 @@ spec:
           envFrom:
             - configMapRef:
                 name: media-common-env
+          env:
+            - name: SONARR__SERVER__TRUSTEDNETWORKS
+              value: ${POD_CIDR}
           ports:
             - containerPort: 8989
               name: http

kubernetes/app/media/release-seerr.yaml

@@ -18,7 +18,7 @@ spec:
   targetNamespace: media
   values:
     image:
-      tag: v3.5.0
+      tag: v3.5.1
     podLabels:
       app: seerr
     extraEnv:

kubernetes/app/paperless/deployment-tika.yaml

@@ -21,7 +21,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: tika
-          image: apache/tika:3.3.1.0
+          image: apache/tika:3.3.3.0
           env:
             - name: TZ
               value: Europe/Kyiv

kubernetes/app/paperless/deployment.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: paperless
-          image: ghcr.io/paperless-ngx/paperless-ngx:3.3
+          image: ghcr.io/paperless-ngx/paperless-ngx:3.4
           ports:
             - containerPort: 8000
               name: http
@@ -86,6 +86,31 @@ spec:
               value: allauth.socialaccount.providers.openid_connect
             - name: PAPERLESS_SOCIALACCOUNT_ALLOW_SIGNUPS
               value: "false"
+            - name: PAPERLESS_AI_ENABLED
+              value: "true"
+            - name: PAPERLESS_AI_LLM_BACKEND
+              value: openai-like
+            - name: PAPERLESS_AI_LLM_ENDPOINT
+              value: https://api.anthropic.com/v1/
+            - name: PAPERLESS_AI_LLM_MODEL
+              value: claude-haiku-5-5
+            - name: PAPERLESS_AI_LLM_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: paperless-ai
+                  key: anthropic-api-key
+            # Haiku 5.5 only accepts temperature 1; llama-index defaults to 0.1
+            - name: PAPERLESS_AI_LLM_EXTRA_PARAMS
+              value: '{"temperature": 1}'
+            - name: PAPERLESS_AI_LLM_OUTPUT_LANGUAGE
+              value: Ukrainian
+            - name: PAPERLESS_AI_LLM_EMBEDDING_BACKEND
+              value: huggingface
+            - name: PAPERLESS_AI_LLM_EMBEDDING_MODEL
+              value: intfloat/multilingual-e5-small
+            # matches the embedding model's 512-token input limit
+            - name: PAPERLESS_AI_LLM_EMBEDDING_CHUNK_SIZE
+              value: "512"
           volumeMounts:
             - name: data
               mountPath: /usr/src/paperless/data
@@ -110,9 +135,9 @@ spec:
           resources:
             requests:
               cpu: 100m
-              memory: 512Mi
+              memory: 1536Mi
             limits:
-              memory: 5Gi
+              memory: 6Gi
       volumes:
         - name: data
           persistentVolumeClaim:

kubernetes/app/paperless/secret-ai.sops.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: paperless-ai
+    namespace: paperless
+stringData:
+    anthropic-api-key: ENC[AES256_GCM,data:kTSTHIO771Zl8/kEyv1seKF1GyodZ4lxhjUSjsyIyCneC+aFdqrq/QYFnqtlQnjBOMq94LQxy0T4Ox2an2+0v2ywP+lIZzYDkE22JdXgbJgCW2aJTBqPtEFV7M2EP0LexDeD2aqebwicxA==,iv:IeO0+Y3jAL0iYM3UbpTtFU7TgqogUYt2gipYUJO2ABQ=,tag:qffHT+GkrNWFmJ1EffHEWg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4Nzg2Zmc4ZVNvRzhzQmVp
+            Mlp6MXhRUExmOU1yWHRESmhBQWlsczZCZEQ0CmkvZDEzVTFwWmt6N3E5eXlsQ0d5
+            VDU1YWIvRDdocXFQNlhnK29CNDVtME0KLS0tIEMybTgzaGs4cVEyeTdEL1RPUmR3
+            S2VvK2FMZ0JnQWJUZG41MmIrRjkxVHcKzjclDColGY9ciQZPRodQrH8UkmsHTsTC
+            hExT/sbhwIznhryfzw/Wkgrm8bzH4NxEkjOWRXvEEJ7Fp5gkvfo0tQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+    encrypted_regex: ^(data|stringData|email)$
+    lastmodified: "2026-10-10T18:39:57Z"
+    mac: ENC[AES256_GCM,data:SG3jk09+cI2mYvovl8PvT5Ay8QrD/wWYVJAdJWhE83bI+MgwgoXvkdW9B+3epcIfvNWV4Z83w2vS89+bo5k81CEIu66yAQPDA+wSCReiRalZdHYGidmnW5ZccmfjTGTNRIIY8RbJlB2ZW6EJJnjjT8Bp4wZskIk5EhGhU2+5jg8=,iv:XeyO9yKzZv6qHwe3LfBqqeRJ3gnU1AmGmeVv3Zp/UyY=,tag:xCgbaWR4fd738hF2T/QVAw==,type:str]
+    version: 3.13.3

kubernetes/app/reitti/deployment-tile-cache.yaml

@@ -23,7 +23,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: tile-cache
-          image: dedicatedcode/reitti-tile-cache:5.6.1
+          image: dedicatedcode/reitti-tile-cache:5.9.1
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80

kubernetes/app/reitti/deployment.yaml

@@ -28,7 +28,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: reitti
-          image: dedicatedcode/reitti:5.6.1
+          image: dedicatedcode/reitti:5.9.1
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

kubernetes/app/vikunja/deployment.yaml

@@ -27,7 +27,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: vikunja
-          image: vikunja/vikunja:2.7.0
+          image: vikunja/vikunja:2.7.1
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 3456

kubernetes/config/cluster-vars.sops.yaml

@@ -40,6 +40,7 @@ stringData:
     BACKUP_LOCAL_HOST: ENC[AES256_GCM,data:ABaTI3NKkhF7K2FpPwvvrHA0l/tCxAi4Qek=,iv:34ixxSpKU1c12uoMdk4nz2Vo/+5A/npB7NWMsWFytIM=,tag:qjw2fQBebCKnqCnAPiBHaw==,type:str]
     REITTI_HOST: ENC[AES256_GCM,data:Zx0T6aUL/v6ogX1miRxzDmDQ31EImg==,iv:0LBRaaG1FHBXFWrtDX8Z6Cs75BEA7hNYm5FFrBHhyYk=,tag:Tup6HoL6E+L9GJKmv3x17Q==,type:str]
     DAWARICH_HOST: ENC[AES256_GCM,data:Gpt9acoks8gnlvHnMLsFhH18fzu0sLjp,iv:QrJd20KcFtMlWarCgMVv1riUlJF3Qj/aYa2vJQizmpg=,tag:JTmmJHZ9u4ecg3/8frYSEA==,type:str]
+    POD_CIDR: ENC[AES256_GCM,data:TX6OQd+8IlgAk2C2kQ==,iv:F+sDxOPvWg3dgPB8NlzfpC7toY88FBeKXzjgUSk1H8M=,tag:NUdzsKszagRhG2+U4YlOcw==,type:str]
 sops:
     age:
         - enc: |
@@ -52,6 +53,6 @@ sops:
             -----END AGE ENCRYPTED FILE-----
           recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
     encrypted_regex: ^(data|stringData|email)$
-    lastmodified: "2026-10-08T10:16:10Z"
-    mac: ENC[AES256_GCM,data:CYjhG3nyn95vgIdpaSxiRl+wR5tm+YOQv2GbfAIPBe62j5dEPxYF6JRFDMxBrQIbQkEgSQ+lWYN8verXZ1SnBSUJ7elKeFDn6ioJsuXF3eMBMZhgQKLo8kgOnYajgVh5sNJsmtdrH9Ret+DudeMb+bvgV7gSETKhVKAWC8h64f8=,iv:4hNo9beooqlJYkOB9i3vzfiXofUcPMy6BDcktIm1U6k=,tag:prnXCtS3bjjUs+1YS9CzlA==,type:str]
+    lastmodified: "2026-10-18T10:53:13Z"
+    mac: ENC[AES256_GCM,data:UqYOF0M6gaVjrE3/OQK/vQ0+lUcwan6fIvrJnm2BE6O28pDFL9iIDAo1ebp0oYhT8+cxNl/tTGlfH5TCblxpSCzu77/8eOgTdn19xqhTC8H8Yw56HVnYWNKZaQTyH+Qw6cG9HFf+d5OTYKeOEZufxZzpF7gT6M8BIssQ1vxEFQM=,iv:Vt1ln9ur5Dejod4X2+JUxwMwjlS198EWMASIw0Gf3Hk=,tag:NSnVkPLLTkHckVLEdTylWg==,type:str]
     version: 3.13.3