chore(k8s/gitea): update gitea/gitea docker tag to v28

README.md

@@ -63,7 +63,6 @@ homelab-v2/
 | **Blog** | Personal static blog served via git-sync + nginx (gh-pages branch) |
 | **Vikunja** | To-do list and task management, SSO via Authelia OIDC |
 | **Reitti** | Personal location history and timeline (PostGIS), SSO via Authelia OIDC |
-| **Dawarich** | Location history and timeline (PostGIS + Sidekiq), evaluated as a Reitti replacement; SSO via Authelia OIDC |
 
 ## Infrastructure Stack
 

kubernetes/app/archmirror/configmap-nginx.yaml

@@ -6,8 +6,6 @@ metadata:
   namespace: archmirror
 data:
   nginx.conf: |
-    worker_processes auto;
-
     events {
         worker_connections 1024;
     }
@@ -17,8 +15,6 @@ data:
         default_type application/octet-stream;
 
         sendfile on;
-        # NFS reads block the worker; offload them so /health keeps answering
-        aio threads;
         gzip on;
 
         server {

kubernetes/app/dawarich/deployment-redis.yaml

@@ -1,55 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: dawarich-redis
-  namespace: dawarich
-  labels:
-    app: dawarich-redis
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: dawarich-redis
-  template:
-    metadata:
-      labels:
-        app: dawarich-redis
-    spec:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 999    # redis user in the alpine image
-        runAsGroup: 999
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: redis
-          image: redis:7.4.11-alpine
-          imagePullPolicy: IfNotPresent
-          # Sidekiq job queue. Snapshots (as in upstream compose) survive container restarts;
-          # the emptyDir is lost with the pod, which only drops queued jobs.
-          args: ["--save", "900", "1", "--save", "300", "10", "--appendonly", "no"]
-          ports:
-            - containerPort: 6379
-              name: redis
-          volumeMounts:
-            - name: data
-              mountPath: /data
-          livenessProbe:
-            tcpSocket:
-              port: 6379
-            periodSeconds: 30
-          readinessProbe:
-            tcpSocket:
-              port: 6379
-            periodSeconds: 10
-          resources:
-            requests:
-              cpu: 20m
-              memory: 32Mi
-            limits:
-              memory: 256Mi
-      volumes:
-        - name: data
-          emptyDir: {}

kubernetes/app/dawarich/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: dawarich

kubernetes/app/dawarich/networkpolicy.yaml

@@ -1,114 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: default-deny-ingress
-  namespace: dawarich
-spec:
-  podSelector: {}
-  policyTypes:
-    - Ingress
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-ingress-controller
-  namespace: dawarich
-spec:
-  podSelector:
-    matchLabels:
-      app: dawarich
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-app-to-db
-  namespace: dawarich
-spec:
-  podSelector:
-    matchLabels:
-      app: dawarich-db
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - podSelector:
-            matchLabels:
-              app: dawarich
-      ports:
-        - port: 5432
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-backup-to-db
-  namespace: dawarich
-spec:
-  podSelector:
-    matchLabels:
-      app: dawarich-db
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - podSelector:
-            matchLabels:
-              app: dawarich-backup
-      ports:
-        - port: 5432
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-backup-egress
-  namespace: dawarich
-spec:
-  podSelector:
-    matchLabels:
-      app: dawarich-backup
-  policyTypes:
-    - Egress
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-    - ports:
-        - port: 8888
-          protocol: TCP
-    - ports:
-        - port: 443
-          protocol: TCP
-    - ports:
-        - port: 5432
-          protocol: TCP
-      to:
-        - podSelector:
-            matchLabels:
-              app: dawarich-db
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-app-to-redis
-  namespace: dawarich
-spec:
-  podSelector:
-    matchLabels:
-      app: dawarich-redis
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - podSelector:
-            matchLabels:
-              app: dawarich
-      ports:
-        - port: 6379

kubernetes/app/dawarich/release.yaml

@@ -1,190 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: dawarich
-  namespace: flux-system
-spec:
-  chart:
-    spec:
-      chart: dawarich
-      version: 2.9.3
-      reconcileStrategy: ChartVersion
-      sourceRef:
-        kind: HelmRepository
-        name: cogitri
-        namespace: flux-system
-  targetNamespace: dawarich
-  interval: 1m0s
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    remediation:
-      retries: 3
-  # The chart hardcodes an unpinned busybox wait-for-postgres init container, no deployment
-  # strategy, and a 130s web startupProbe — too short for the first start, which runs every
-  # migration and seeds the countries table before Puma listens.
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              kind: Deployment
-              name: dawarich
-            patch: |
-              apiVersion: apps/v1
-              kind: Deployment
-              metadata:
-                name: dawarich
-              spec:
-                strategy:
-                  type: Recreate
-                template:
-                  spec:
-                    initContainers:
-                      - name: wait-for-postgres
-                        image: busybox:1.37
-                        imagePullPolicy: IfNotPresent
-                    containers:
-                      - name: dawarich
-                        startupProbe:
-                          failureThreshold: 60
-                        livenessProbe:
-                          periodSeconds: 30
-                          timeoutSeconds: 10
-                          failureThreshold: 6
-                        readinessProbe:
-                          timeoutSeconds: 5
-          - target:
-              kind: Deployment
-              name: dawarich-sidekiq
-            patch: |
-              apiVersion: apps/v1
-              kind: Deployment
-              metadata:
-                name: dawarich-sidekiq
-              spec:
-                strategy:
-                  type: Recreate
-                template:
-                  spec:
-                    initContainers:
-                      - name: wait-for-postgres
-                        image: busybox:1.37
-                        imagePullPolicy: IfNotPresent
-  values:
-    # Release name is dawarich-dawarich (targetNamespace prefix); keep resource names short.
-    fullnameOverride: dawarich
-
-    image:
-      # renovate: datasource=docker depName=freikin/dawarich
-      tag: "1.20.0"
-
-    keyBase:
-      existingSecret: dawarich-credentials    # key: value
-
-    # Every key is rendered into the ConfigMap as UPPER_SNAKE_CASE.
-    env:
-      timeZone: Europe/Kyiv
-      # TLS terminates at Traefik; "https" here turns on Rails force_ssl.
-      applicationProtocol: http
-      distanceUnit: km
-      # Upstream compose default; each thread holds an import batch in memory.
-      backgroundProcessingConcurrency: "3"
-      # OIDC-only login (blocks the web form and the API password sign-in since 1.14.4).
-      allowEmailPasswordLogin: "false"
-
-    # Authentication against Authelia over OIDC only. Unknown Authelia users are auto-created
-    # as regular (non-admin) users.
-    oidc:
-      enabled: true
-      providerName: Authelia
-      clientId:
-        existingSecret: dawarich-credentials
-        existingSecretKeyName: OIDC_CLIENT_ID
-      clientSecret:
-        existingSecret: dawarich-credentials
-        existingSecretKeyName: OIDC_CLIENT_SECRET
-      issuer: https://auth.${AUTHELIA_DOMAIN}
-      redirectUri: https://${DAWARICH_HOST}/users/auth/openid_connect/callback
-      autoRegister: true
-      allowEmailPasswordRegistration: false
-
-    dawarich:
-      hosts:
-        - ${DAWARICH_HOST}
-      resources:
-        requests:
-          cpu: 100m
-          memory: 512Mi
-        limits:
-          memory: 2Gi
-
-    sidekiq:
-      resources:
-        requests:
-          cpu: 100m
-          memory: 512Mi
-        limits:
-          memory: 4Gi    # imports parse whole files in memory (Google Records.json)
-
-    postgresql:
-      host: dawarich-db
-      auth:
-        database: dawarich
-        existingSecret: dawarich-credentials    # keys: username, password
-
-    # Own single Redis (deployment-redis.yaml) instead of the bundled 3-node redis-ha.
-    redis:
-      enabled: false
-      host: dawarich-redis
-      auth: false
-
-    # RWO volumes shared by web and sidekiq — fine on the single node.
-    persistence:
-      public:
-        # Static assets, re-synced from the image on every web start.
-        storageClass: nfs-synology-ssd
-        size: 1Gi
-      watched:
-        # Drop folder: <user-email>/<file> is auto-imported.
-        storageClass: nfs-synology-ssd
-        size: 1Gi
-      storage:
-        # ActiveStorage: uploaded imports, exports, videos.
-        storageClass: nfs-synology-ssd
-        size: 10Gi
-
-    serviceAccount:
-      automount: false
-
-    podLabels:
-      app: dawarich
-
-    # The image starts as root only to chown volumes and gosu-drop when PUID/PGID are set.
-    # Running as 1000 directly skips that; tmp/ is 0777 in the image and the NFS subdir
-    # provisioner creates directories 0777.
-    podSecurityContext:
-      runAsNonRoot: true
-      runAsUser: 1000
-      runAsGroup: 1000
-      seccompProfile:
-        type: RuntimeDefault
-    securityContext:
-      allowPrivilegeEscalation: false
-
-    ingress:
-      enabled: true
-      # No Authelia forward-auth middleware — Dawarich authenticates against Authelia
-      # natively over OIDC. A middleware here would break the OIDC callback and the
-      # api_key-authenticated /api ingest endpoints (OwnTracks, Overland, mobile app).
-      annotations:
-        cert-manager.io/cluster-issuer: letsencrypt
-      hosts:
-        - host: ${DAWARICH_HOST}
-          paths:
-            - path: /
-              pathType: Prefix
-      tls:
-        - secretName: dawarich-tls
-          hosts:
-            - ${DAWARICH_HOST}

kubernetes/app/dawarich/renovate.json

@@ -1,38 +0,0 @@
-{
-  "kubernetes": {
-    "fileMatch": ["kubernetes/app/dawarich/.+\\.yaml$"]
-  },
-  "customManagers": [
-    {
-      "customType": "regex",
-      "fileMatch": ["kubernetes/app/dawarich/release\\.yaml$"],
-      "matchStrings": [
-        "#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)\\s*\\n\\s*tag:\\s*[\"']?(?<currentValue>[^\\s\"']+)"
-      ]
-    }
-  ],
-  "packageRules": [
-    {
-      "matchFileNames": ["kubernetes/app/dawarich/**"],
-      "semanticCommitScope": "k8s/dawarich"
-    },
-    {
-      "matchFileNames": ["kubernetes/app/dawarich/**"],
-      "matchPackageNames": ["freikin/dawarich"],
-      "matchUpdateTypes": ["patch", "minor"],
-      "automerge": true
-    },
-    {
-      "matchFileNames": ["kubernetes/app/dawarich/**"],
-      "matchPackageNames": ["freikin/dawarich"],
-      "matchUpdateTypes": ["major"],
-      "automerge": false
-    },
-    {
-      "description": "Ignore infrastructure images",
-      "matchFileNames": ["kubernetes/app/dawarich/**"],
-      "matchPackageNames": ["postgis/postgis", "redis", "creativeprojects/resticprofile"],
-      "enabled": false
-    }
-  ]
-}

kubernetes/app/dawarich/repository.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: cogitri
-  namespace: flux-system
-spec:
-  interval: 1m0s
-  url: https://charts.cogitri.dev

kubernetes/app/dawarich/secret.sops.yaml

@@ -1,27 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: dawarich-credentials
-    namespace: dawarich
-stringData:
-    #ENC[AES256_GCM,data:3gPe9ezMvEnV02kKbZkjtsq2FmJJzXmhtp6CfwYh8icAv/PdAwa3DQCu0oRbgkIV9claZCqDSrhPIaYy5wsQUshL8hyGUYDm/mLNVDsAl9HPz6MlDA==,iv:QOG8JpMEA3IYlcLyrWM8yH9ZHbpwNM1EpC+02J8PCDU=,tag:eIGomi40Pe+7MSOU8POO4w==,type:comment]
-    username: ENC[AES256_GCM,data:Tpj/Iq4oLlg=,iv:9RORl+XlNqG87y3qsqCNj/oRrLzmdVlZCAXD4R1RfXY=,tag:67MSd0HIYEhTqQYfDNUJ2g==,type:str]
-    password: ENC[AES256_GCM,data:BhB59Y5J5pKobyKWOsIWP8jMxPzkL12TkFrTJuCGexw=,iv:VDJdyx7dyHgZh/doBTxBfAiN3NqzmvdCz3Hpxwsafac=,tag:AUtd1ubgOWMbgxm2FzfDpw==,type:str]
-    value: ENC[AES256_GCM,data:Ok4GM6+qnZSQ3c9fyedlXE+LlAoSzIvIQMrCSKLPGp3TQT6PpbouXbR0QveZWZgROmexn0YMs62WCkCdfNfv2DC7SooJ+EksWHKi/m8UTWay7X/WYBlMmSClS3/MeFwsRz5/G4MayIT166C6OhXKB2rPicRMzlU+3dbL9MBDLpw=,iv:gi6C0rbYy3Ie6ati6ACnlqeXjONR/HC3o8xmPGUIF/Y=,tag:jcAQ3YSWZ1DZqr8u+KIBWg==,type:str]
-    OIDC_CLIENT_ID: ENC[AES256_GCM,data:qddOrkEvw0g=,iv:NrS1vRqZG3/4cQyWtEONu16GbFlHJplcHVc75h7+CpQ=,tag:l5Fu5vsPiU6rFGFWziCnzg==,type:str]
-    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:uisMM3Gd6ChnLvg/eyxff9ZGq6uAfs9fryuVOgf+ZGVexKoRn0NT1Ic7rpJ9pUwzhTAO6WGo941MdJmkSxbxXw==,iv:HNZhiPMTMk/aG7Z9hr0r97CFzo8C0PKRL3FtIW2vGns=,tag:+sbLFE2zbdn4M4eyWrvqTA==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTSUdIeXZKNDBVcXVURWpz
-            Wmwrd1hWb0tTcDFmMWZHVG4vZmFmUDNZUnhjCk1PVzQ2RG5Qa2VQZk5PV1VwS09M
-            YUdzVWtsc3dJY256dzRkUTMxdG83OGsKLS0tIERBVVRXTTBsYk1jTTRadmNoOHM0
-            c1F5Q1RsQ1Y1SW9rQUw1ZkwrVVREV1UKI0bO6Nq92fPVPqImWMtWCe5s4r5pLGAf
-            6FWWzTkerOnQ4n7iGoAPtnuFbo6wUBypm4yirbgX6ErzU5vTWJWHWw==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
-    encrypted_regex: ^(data|stringData|email)$
-    lastmodified: "2026-10-08T10:16:10Z"
-    mac: ENC[AES256_GCM,data:HcMG1/LqcljJ6b6LZvXZqKdT3LGFNikH/1PQKzxL+71lwSqlg3k5L0pDNObSfRZeYMeCQTMJWCzgt2qlUlpML58DFTRC0B6K3bofHJixhJT1cS62rzngR0iRY4KVepI6qZACfTh8mwzt15Zrpy9ZMRvV1GSwnxpgaXJVyCMqWnw=,iv:7GHyXB1nA1WAbkI396l4Vw5RtcsYW9n70b+ybOUo6ds=,tag:YbqsKjek9ZnExzghSupuDw==,type:str]
-    version: 3.13.3

kubernetes/app/dawarich/service-db.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: dawarich-db
-  namespace: dawarich
-spec:
-  clusterIP: None
-  selector:
-    app: dawarich-db
-  ports:
-    - port: 5432
-      targetPort: 5432

kubernetes/app/dawarich/service-redis.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: dawarich-redis
-  namespace: dawarich
-spec:
-  selector:
-    app: dawarich-redis
-  ports:
-    - port: 6379
-      targetPort: 6379
-      name: redis

kubernetes/app/dawarich/statefulset-db.yaml

@@ -1,88 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: dawarich-db
-  namespace: dawarich
-  labels:
-    app: dawarich-db
-spec:
-  serviceName: dawarich-db
-  replicas: 1
-  selector:
-    matchLabels:
-      app: dawarich-db
-  template:
-    metadata:
-      labels:
-        app: dawarich-db
-    spec:
-      securityContext:
-        runAsUser: 999
-        runAsGroup: 999
-        fsGroup: 999
-      containers:
-        - name: postgres
-          # Dawarich requires PostGIS; the Debian variant keeps the postgres user at UID 999
-          # (the alpine variant upstream uses has 70). The image creates the postgis extension in POSTGRES_DB.
-          image: postgis/postgis:17-3.5
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: dawarich-credentials
-                  key: username
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: dawarich-credentials
-                  key: password
-            - name: POSTGRES_DB
-              value: dawarich
-            - name: PGDATA
-              value: /var/lib/postgresql/data/pgdata
-          ports:
-            - containerPort: 5432
-          startupProbe:
-            tcpSocket:
-              port: 5432
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            failureThreshold: 30
-          livenessProbe:
-            tcpSocket:
-              port: 5432
-            periodSeconds: 30
-            failureThreshold: 5
-          readinessProbe:
-            tcpSocket:
-              port: 5432
-            periodSeconds: 10
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 50m
-              memory: 256Mi
-            limits:
-              memory: 2Gi    # includes the 1Gi /dev/shm below
-          volumeMounts:
-            - name: data
-              mountPath: /var/lib/postgresql/data
-            - name: shm
-              mountPath: /dev/shm
-      volumes:
-        # Upstream compose sets shm_size: 1G — parallel queries over the points table
-        # exceed the 64M container default.
-        - name: shm
-          emptyDir:
-            medium: Memory
-            sizeLimit: 1Gi
-  volumeClaimTemplates:
-    - metadata:
-        name: data
-      spec:
-        accessModes: ["ReadWriteOnce"]
-        storageClassName: nfs-synology-ssd
-        resources:
-          requests:
-            storage: 10Gi

kubernetes/app/firefly/release.yaml

@@ -26,7 +26,7 @@ spec:
 
     image:
       # renovate: datasource=docker depName=fireflyiii/core
-      tag: version-6.7.9
+      tag: version-6.7.7
 
     podSecurityContext:
       seccompProfile:

kubernetes/app/gitea/release.yaml

@@ -199,11 +199,11 @@ spec:
         type: RuntimeDefault
 
     image:
-      # renovate: currentValue=28.3.0-rootless currentDigest=sha256:40c5a68a0463c0940e1ae32626c8300dd0572f3558e390073ad8379ca67c0e1d
+      # renovate: currentValue=28.1.0-rootless currentDigest=sha256:b1a90409ae9afcd5a5725404c3639da7245248848b99e35332968891290b953e
 
-      tag: 28.3.0
+      tag: 28.1.0
 
-      digest: sha256:40c5a68a0463c0940e1ae32626c8300dd0572f3558e390073ad8379ca67c0e1d
+      digest: sha256:b1a90409ae9afcd5a5725404c3639da7245248848b99e35332968891290b953e
       rootless: true
       pullPolicy: IfNotPresent
 

kubernetes/app/homepage/deployment.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: homepage
-          image: ghcr.io/gethomepage/homepage:v2.7.0
+          image: ghcr.io/gethomepage/homepage:v2.4.0
           ports:
             - containerPort: 3000
               name: http

kubernetes/app/immich/release.yaml

@@ -28,7 +28,7 @@ spec:
           main:
             image:
               repository: ghcr.io/immich-app/immich-server
-              tag: v3.3.5
+              tag: v3.2.4
             resources:
               requests:
                 cpu: 100m

kubernetes/app/jellyfin/deployment.yaml

@@ -43,7 +43,7 @@ spec:
               mountPath: /db-local
       containers:
         - name: jellyfin
-          image: jellyfin/jellyfin:12.4
+          image: jellyfin/jellyfin:12.2
           env:
             - name: JELLYFIN_PublishedServerUrl
               value: https://${JELLYFIN_HOST}

kubernetes/app/lubelogger/release.yaml

@@ -18,7 +18,7 @@ spec:
   values:
     image:
       # renovate: datasource=docker depName=ghcr.io/hargata/lubelogger
-      tag: "v1.7.4"
+      tag: "v1.7.3"
 
     updateStrategy:
       type: RollingUpdate

kubernetes/app/media/deployment-prowlarr.yaml

@@ -45,13 +45,10 @@ spec:
             - psql -d postgres -c 'CREATE DATABASE "prowlarr-log"' || true
       containers:
         - name: prowlarr
-          image: lscr.io/linuxserver/prowlarr:2.7.0
+          image: lscr.io/linuxserver/prowlarr:2.6.5
           envFrom:
             - configMapRef:
                 name: media-common-env
-          env:
-            - name: PROWLARR__SERVER__TRUSTEDNETWORKS
-              value: ${POD_CIDR}
           ports:
             - containerPort: 9696
               name: http

kubernetes/app/media/deployment-qbittorrent.yaml

@@ -29,7 +29,7 @@ spec:
               mountPath: /media
       containers:
         - name: qbittorrent
-          image: lscr.io/linuxserver/qbittorrent:5.3.0
+          image: lscr.io/linuxserver/qbittorrent:5.2.4
           envFrom:
             - configMapRef:
                 name: media-common-env

kubernetes/app/media/deployment-radarr.yaml

@@ -58,9 +58,6 @@ spec:
           envFrom:
             - configMapRef:
                 name: media-common-env
-          env:
-            - name: RADARR__SERVER__TRUSTEDNETWORKS
-              value: ${POD_CIDR}
           ports:
             - containerPort: 7878
               name: http

kubernetes/app/media/deployment-sonarr.yaml

@@ -58,9 +58,6 @@ spec:
           envFrom:
             - configMapRef:
                 name: media-common-env
-          env:
-            - name: SONARR__SERVER__TRUSTEDNETWORKS
-              value: ${POD_CIDR}
           ports:
             - containerPort: 8989
               name: http

kubernetes/app/media/release-seerr.yaml

@@ -18,7 +18,7 @@ spec:
   targetNamespace: media
   values:
     image:
-      tag: v3.5.1
+      tag: v3.5.0
     podLabels:
       app: seerr
     extraEnv:

kubernetes/app/paperless/deployment-tika.yaml

@@ -21,7 +21,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: tika
-          image: apache/tika:3.3.3.0
+          image: apache/tika:3.3.1.0
           env:
             - name: TZ
               value: Europe/Kyiv

kubernetes/app/paperless/deployment.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: paperless
-          image: ghcr.io/paperless-ngx/paperless-ngx:3.4
+          image: ghcr.io/paperless-ngx/paperless-ngx:3.3
           ports:
             - containerPort: 8000
               name: http
@@ -86,31 +86,6 @@ spec:
               value: allauth.socialaccount.providers.openid_connect
             - name: PAPERLESS_SOCIALACCOUNT_ALLOW_SIGNUPS
               value: "false"
-            - name: PAPERLESS_AI_ENABLED
-              value: "true"
-            - name: PAPERLESS_AI_LLM_BACKEND
-              value: openai-like
-            - name: PAPERLESS_AI_LLM_ENDPOINT
-              value: https://api.anthropic.com/v1/
-            - name: PAPERLESS_AI_LLM_MODEL
-              value: claude-haiku-5-5
-            - name: PAPERLESS_AI_LLM_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: paperless-ai
-                  key: anthropic-api-key
-            # Haiku 5.5 only accepts temperature 1; llama-index defaults to 0.1
-            - name: PAPERLESS_AI_LLM_EXTRA_PARAMS
-              value: '{"temperature": 1}'
-            - name: PAPERLESS_AI_LLM_OUTPUT_LANGUAGE
-              value: Ukrainian
-            - name: PAPERLESS_AI_LLM_EMBEDDING_BACKEND
-              value: huggingface
-            - name: PAPERLESS_AI_LLM_EMBEDDING_MODEL
-              value: intfloat/multilingual-e5-small
-            # matches the embedding model's 512-token input limit
-            - name: PAPERLESS_AI_LLM_EMBEDDING_CHUNK_SIZE
-              value: "512"
           volumeMounts:
             - name: data
               mountPath: /usr/src/paperless/data
@@ -135,9 +110,9 @@ spec:
           resources:
             requests:
               cpu: 100m
-              memory: 1536Mi
+              memory: 512Mi
             limits:
-              memory: 6Gi
+              memory: 5Gi
       volumes:
         - name: data
           persistentVolumeClaim:

kubernetes/app/paperless/secret-ai.sops.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: paperless-ai
-    namespace: paperless
-stringData:
-    anthropic-api-key: ENC[AES256_GCM,data:kTSTHIO771Zl8/kEyv1seKF1GyodZ4lxhjUSjsyIyCneC+aFdqrq/QYFnqtlQnjBOMq94LQxy0T4Ox2an2+0v2ywP+lIZzYDkE22JdXgbJgCW2aJTBqPtEFV7M2EP0LexDeD2aqebwicxA==,iv:IeO0+Y3jAL0iYM3UbpTtFU7TgqogUYt2gipYUJO2ABQ=,tag:qffHT+GkrNWFmJ1EffHEWg==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4Nzg2Zmc4ZVNvRzhzQmVp
-            Mlp6MXhRUExmOU1yWHRESmhBQWlsczZCZEQ0CmkvZDEzVTFwWmt6N3E5eXlsQ0d5
-            VDU1YWIvRDdocXFQNlhnK29CNDVtME0KLS0tIEMybTgzaGs4cVEyeTdEL1RPUmR3
-            S2VvK2FMZ0JnQWJUZG41MmIrRjkxVHcKzjclDColGY9ciQZPRodQrH8UkmsHTsTC
-            hExT/sbhwIznhryfzw/Wkgrm8bzH4NxEkjOWRXvEEJ7Fp5gkvfo0tQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
-    encrypted_regex: ^(data|stringData|email)$
-    lastmodified: "2026-10-10T18:39:57Z"
-    mac: ENC[AES256_GCM,data:SG3jk09+cI2mYvovl8PvT5Ay8QrD/wWYVJAdJWhE83bI+MgwgoXvkdW9B+3epcIfvNWV4Z83w2vS89+bo5k81CEIu66yAQPDA+wSCReiRalZdHYGidmnW5ZccmfjTGTNRIIY8RbJlB2ZW6EJJnjjT8Bp4wZskIk5EhGhU2+5jg8=,iv:XeyO9yKzZv6qHwe3LfBqqeRJ3gnU1AmGmeVv3Zp/UyY=,tag:xCgbaWR4fd738hF2T/QVAw==,type:str]
-    version: 3.13.3

kubernetes/app/reitti/deployment-tile-cache.yaml

@@ -23,7 +23,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: tile-cache
-          image: dedicatedcode/reitti-tile-cache:5.8.1
+          image: dedicatedcode/reitti-tile-cache:5.6.1
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80

kubernetes/app/reitti/deployment.yaml

@@ -28,7 +28,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: reitti
-          image: dedicatedcode/reitti:5.8.1
+          image: dedicatedcode/reitti:5.6.1
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

kubernetes/app/vikunja/deployment.yaml

@@ -27,7 +27,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: vikunja
-          image: vikunja/vikunja:2.7.1
+          image: vikunja/vikunja:2.7.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 3456

kubernetes/config/cluster-vars.sops.yaml

@@ -39,8 +39,6 @@ stringData:
     VIKUNJA_HOST: ENC[AES256_GCM,data:1VVkvVrdx02jPxHsQoQI9zJKN9v/9mE=,iv:ZagDcljNclEGvmMzS6pJWTv+FMa/a/X6POaWb+kHJuo=,tag:RuaUoX8O4LrEs491Sp4UyQ==,type:str]
     BACKUP_LOCAL_HOST: ENC[AES256_GCM,data:ABaTI3NKkhF7K2FpPwvvrHA0l/tCxAi4Qek=,iv:34ixxSpKU1c12uoMdk4nz2Vo/+5A/npB7NWMsWFytIM=,tag:qjw2fQBebCKnqCnAPiBHaw==,type:str]
     REITTI_HOST: ENC[AES256_GCM,data:Zx0T6aUL/v6ogX1miRxzDmDQ31EImg==,iv:0LBRaaG1FHBXFWrtDX8Z6Cs75BEA7hNYm5FFrBHhyYk=,tag:Tup6HoL6E+L9GJKmv3x17Q==,type:str]
-    DAWARICH_HOST: ENC[AES256_GCM,data:Gpt9acoks8gnlvHnMLsFhH18fzu0sLjp,iv:QrJd20KcFtMlWarCgMVv1riUlJF3Qj/aYa2vJQizmpg=,tag:JTmmJHZ9u4ecg3/8frYSEA==,type:str]
-    POD_CIDR: ENC[AES256_GCM,data:TX6OQd+8IlgAk2C2kQ==,iv:F+sDxOPvWg3dgPB8NlzfpC7toY88FBeKXzjgUSk1H8M=,tag:NUdzsKszagRhG2+U4YlOcw==,type:str]
 sops:
     age:
         - enc: |
@@ -53,6 +51,6 @@ sops:
             -----END AGE ENCRYPTED FILE-----
           recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
     encrypted_regex: ^(data|stringData|email)$
-    lastmodified: "2026-10-18T10:53:13Z"
+    lastmodified: "2026-10-03T20:20:00Z"
-    mac: ENC[AES256_GCM,data:UqYOF0M6gaVjrE3/OQK/vQ0+lUcwan6fIvrJnm2BE6O28pDFL9iIDAo1ebp0oYhT8+cxNl/tTGlfH5TCblxpSCzu77/8eOgTdn19xqhTC8H8Yw56HVnYWNKZaQTyH+Qw6cG9HFf+d5OTYKeOEZufxZzpF7gT6M8BIssQ1vxEFQM=,iv:Vt1ln9ur5Dejod4X2+JUxwMwjlS198EWMASIw0Gf3Hk=,tag:NSnVkPLLTkHckVLEdTylWg==,type:str]
+    mac: ENC[AES256_GCM,data:xN+k2RvU+IJyYzLRIExm0qM5F/K4s19jm0Sp1fo4L3V2dZHSb1J/JtdtxpbalA3qGxy82qDosagrhrNtdsL2/Ht7JO5f1T3Q1Z5smOBOkvWrjPqnyOWGGwe4j77UY41k50kXNh1VFbhjBYkEei+8191BlMkEmTNSdBvFdvzydIw=,iv:1Q3otFunhnMgrJI8z4XFsp92PHmogEvYi99qAkgJomo=,tag:ikTXnDjTG9fNFrumBGW5Lw==,type:str]
     version: 3.13.3

renovate.json

@@ -13,8 +13,7 @@
     "local>oleksandr/homelab//kubernetes/app/lubelogger/renovate.json",
     "local>oleksandr/homelab//kubernetes/app/firefly/renovate.json",
     "local>oleksandr/homelab//kubernetes/app/podsync/renovate.json",
-    "local>oleksandr/homelab//kubernetes/app/reitti/renovate.json",
+    "local>oleksandr/homelab//kubernetes/app/reitti/renovate.json"
-    "local>oleksandr/homelab//kubernetes/app/dawarich/renovate.json"
   ],
   "enabledManagers": ["kubernetes", "custom.regex"],
   "automergeType": "branch",