Merge caee7c25ab into b4a63fb4a5

bootstrap/flux-system/gotk-components.yaml

@@ -3563,7 +3563,7 @@ spec:
               fieldPath: metadata.namespace
         - name: TUF_ROOT
           value: /tmp/.sigstore
-        image: ghcr.io/fluxcd/source-controller:v1.4.1
+        image: ghcr.io/fluxcd/source-controller:v1.3.0
         imagePullPolicy: IfNotPresent
         livenessProbe:
           httpGet:
@@ -5299,7 +5299,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
-        image: ghcr.io/fluxcd/kustomize-controller:v1.4.0
+        image: ghcr.io/fluxcd/kustomize-controller:v1.3.0
         imagePullPolicy: IfNotPresent
         livenessProbe:
           httpGet:
@@ -7975,7 +7975,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
-        image: ghcr.io/fluxcd/notification-controller:v1.4.0
+        image: ghcr.io/fluxcd/notification-controller:v1.3.0
         imagePullPolicy: IfNotPresent
         livenessProbe:
           httpGet:

projects/adguard/values/adguard.yaml

@@ -1,6 +1,6 @@
 image:
   repository: adguard/adguardhome
-  tag: v0.107.54
+  tag: v0.107.53
 
 env:
   TZ: Europe/Amsterdam

projects/ai/values/flowise.yml

@@ -4,7 +4,7 @@ controllers:
       main:
         image:
           repository: flowiseai/flowise
-          tag: 2.2.0
+          tag: 1.8.4
         command:
           - flowise
           - start

projects/ai/values/localai.yaml

@@ -4,7 +4,7 @@ deployment:
   image: 
     repository: quay.io/go-skynet/local-ai
     #tag: latest-aio-gpu-nvidia-cuda-12
-    tag: v2.23.0-cublas-cuda12-ffmpeg
+    tag: v2.22.0-cublas-cuda12-ffmpeg
   pullPolicy: Always
   runtimeClassName: nvidia
 

projects/ai/values/qdrant.yml

@@ -1,7 +1,7 @@
 image:
   repository: docker.io/qdrant/qdrant
   pullPolicy: IfNotPresent
-  tag: "v1.12.4"
+  tag: "v1.10.1"
   useUnprivilegedImage: true
 
 env:

projects/argocd/values/argocd.yaml

@@ -8,7 +8,7 @@ installCRDs: true
 global:
   image:
     repository: quay.io/argoproj/argocd
-    tag: v2.13.1
+    tag: v2.11.11
 #    imagePullPolicy: IfNotPresent
   securityContext:
     runAsUser: 999
@@ -176,7 +176,7 @@ repoServer:
 
   initContainers:
   - name: copy-cmp-server
-    image: quay.io/argoproj/argocd:v2.13.1
+    image: quay.io/argoproj/argocd:v2.11.11
     command:
     - cp
     - -n

projects/arrstack/values/ombi.yaml

@@ -1,6 +1,6 @@
 image:
   repository: ghcr.io/linuxserver/ombi
-  tag: 4.44.1
+  tag: 4.43.5
 
 ingress:
   main:

projects/arrstack/values/prowlarr.yaml

@@ -9,7 +9,7 @@ image:
   # -- image repository
   repository: ghcr.io/onedr0p/prowlarr-develop
   # @default -- chart.appVersion
-  tag: "1.27"
+  tag: "1.21"
   # -- image pull policy
   pullPolicy: IfNotPresent
 

projects/arrstack/values/radarr.yaml

@@ -1,6 +1,6 @@
 image:
   repository: ghcr.io/onedr0p/radarr
-  tag: 5.15.1.9463
+  tag: 5.8.3.8933
 
 env:
   UMASK: "002"

projects/arrstack/values/sonarr.yaml

@@ -1,6 +1,6 @@
 image:
   repository: ghcr.io/onedr0p/sonarr
-  tag: 4.0.11.2680
+  tag: 4.0.9.2244
 
 securityContext:
   privileged: true

projects/core/project.yml

@@ -42,19 +42,19 @@ apps:
   namespace: ingress-internal
   repoURL: https://kubernetes.github.io/ingress-nginx
   chart: ingress-nginx
-  targetRevision: 4.11.3
+  targetRevision: 4.11.1
   syncWave: '0'
 
 - name: cilium
   existingNamespace: kube-system
   repoURL: https://helm.cilium.io
   chart: cilium
-  targetRevision: 1.16.4
+  targetRevision: 1.15.9
 
 - name: external-dns
   repoURL: https://kubernetes-sigs.github.io/external-dns
   chart: external-dns
-  targetRevision: 1.15.0
+  targetRevision: 1.14.5
   secrets:
   - name: cloudflare-api
     keys:
@@ -63,7 +63,7 @@ apps:
 - name: external-dns-adguard
   repoURL: https://kubernetes-sigs.github.io/external-dns
   chart: external-dns
-  targetRevision: 1.15.0
+  targetRevision: 1.14.5
   secrets:
   - name: adguard-config
     keys:
@@ -75,7 +75,7 @@ apps:
   namespace: cert-manager
   repoURL: https://charts.jetstack.io
   chart: cert-manager
-  targetRevision: v1.16.2
+  targetRevision: v1.15.3
   secrets:
   - name: cert-manager-vault-approle
     keys:

projects/core/values/cilium.yaml

@@ -64,7 +64,7 @@ ipv4:
 ipv6:
   enabled: false
 
-kubeProxyReplacement: true
+kubeProxyReplacement: strict
 l2NeighDiscovery:
   enabled: false
   refreshPeriod: "30s"

projects/core/values/external-dns-adguard.yaml

@@ -4,7 +4,7 @@
 
 image:
   repository: registry.k8s.io/external-dns/external-dns
-  tag: "v0.15.0"
+  tag: "v0.14.2"
   pullPolicy: IfNotPresent
 
 shareProcessNamespace: false

projects/core/values/external-dns.yaml

@@ -4,7 +4,7 @@
 
 image:
   repository: registry.k8s.io/external-dns/external-dns
-  tag: "v0.15.0"
+  tag: "v0.14.2"
   pullPolicy: IfNotPresent
 
 shareProcessNamespace: false

projects/crossplane/project.yml

@@ -6,7 +6,7 @@ apps:
 - name: crossplane
   repoURL: https://charts.crossplane.io/stable
   chart: crossplane
-  targetRevision: 1.18.0
+  targetRevision: 1.16.0
   secrets:
   - name: terraform
     keys:

projects/downloader/values/qbittorrent.yaml

@@ -1,7 +1,7 @@
 ---
 image:
   repository: ghcr.io/onedr0p/qbittorrent
-  tag: 5.0.2
+  tag: 4.6.7
 
 ingress:
   main:

projects/forgejo/values/forgejo.yml

@@ -13,7 +13,7 @@ strategy:
 image:
   registry: codeberg.org
   repository: forgejo/forgejo
-  tag: "9.0"
+  tag: "7.0"
   rootless: true
 
 podSecurityContext:

projects/grafana/project.yml

@@ -5,7 +5,7 @@ apps:
 - name: kube-prometheus-stack
   repoURL: https://prometheus-community.github.io/helm-charts
   chart: kube-prometheus-stack
-  targetRevision: 66.2.2
+  targetRevision: 60.5.0
   secrets:
     - name: grafana
       keys:

projects/grafana/values/kube-prometheus-stack.yaml

@@ -11,7 +11,7 @@ grafana:
 
   image:
     repository: grafana/grafana
-    tag: 11.3.1
+    tag: 11.1.7
 
   persistence:
     enabled: true

projects/grafana/values/loki-stack.yaml

@@ -2,7 +2,7 @@ loki:
   enabled: true
   image:
     repository: grafana/loki
-    tag: 3.3.0
+    tag: 3.1.2
 
 promtail:
   enabled: true

projects/grafana/values/prometheus.yaml

@@ -24,7 +24,7 @@ server:
   enabled: true
   image:
     repository: quay.io/prometheus/prometheus
-    tag: v2.55.1
+    tag: v2.53.2
  
   strategy:
     type: Recreate

projects/homeassistant/values/homeassistant.yaml

@@ -4,7 +4,7 @@ controllers:
       main:
         image:
           repository: homeassistant/home-assistant
-          tag: "2024.11"
+          tag: "2024.10"
 
         env:
           TZ: Europe/Berlin

projects/homeassistant/values/nodered.yaml

@@ -172,7 +172,7 @@ sidecar:
     # -- The image repository to pull from
     repository: kiwigrid/k8s-sidecar
     # -- The image tag to pull, default: `1.23.1`
-    tag: 1.28.0
+    tag: 1.27.6
     # -- The image pull policy, default: `IfNotPresent`
     pullPolicy: IfNotPresent
   # -- The extra volume mounts for the sidecar

projects/homer/project.yml

@@ -4,7 +4,7 @@ apps:
 - name: homer
   repoURL: https://djjudas21.github.io/charts
   chart: homer
-  targetRevision: 8.2.2
+  targetRevision: 8.1.12
   include:
   - ingress-internal
   - noRoot

projects/homer/values/homer.yml

@@ -1,6 +1,6 @@
 image:
   repository: b4bz/homer
-  tag: v24.11.5
+  tag: v24.05.1
 
 initContainers:
   clone-assets:

projects/ingress-external/project.yml

@@ -13,5 +13,5 @@ apps:
 - name: ingress-external
   repoURL: https://kubernetes.github.io/ingress-nginx
   chart: ingress-nginx
-  targetRevision: 4.11.3
+  targetRevision: 4.11.1
   syncWave: '0'

projects/mqtt/values/zigbee2mqtt.yaml

@@ -1,6 +1,6 @@
 image:
   repository: koenkk/zigbee2mqtt
-  tag: 1.41.0
+  tag: 1.39.1
 
 service:
   main:

projects/music/values/navidrome.yaml

@@ -1,6 +1,6 @@
 image:
   repository: ghcr.io/navidrome/navidrome
-  tag: 0.53.3
+  tag: 0.52.5
 
 env:
   TZ: "Europe/Amsterdam"
@@ -71,4 +71,4 @@ resources:
     cpu: 10m
     memory: 50Mi
   limits:
-    memory: 2Gi
+    memory: 750Mi

projects/nextcloud/project.yaml

@@ -14,7 +14,7 @@ apps:
 - name: nextcloud
   repoURL: https://nextcloud.github.io/helm
   chart: nextcloud
-  targetRevision: 6.2.4
+  targetRevision: 5.2.0
   secrets:
   - name: nextcloud-user
     keys:

projects/nextcloud/values/nextcloud.yaml

@@ -1,5 +1,5 @@
 image:
-  tag: 30-fpm
+  tag: 29-fpm
   pullPolicy: Always
 
 nextcloud:

projects/paperless/values/paperless.yml

@@ -15,7 +15,7 @@ ingress:
       - paperless.dc
 image:
   repository: ghcr.io/paperless-ngx/paperless-ngx
-  tag: 2.13.5
+  tag: 2.11.6
   pullPolicy: IfNotPresent
 
 # -- See the following files for additional environment variables:

projects/services/project.yml

@@ -11,7 +11,7 @@ apps:
   namespace: s3
   repoURL: https://charts.min.io
   chart: minio
-  targetRevision: 5.3.0
+  targetRevision: 5.2.0
   secrets:
   - name: minio-root
     keys:
@@ -22,7 +22,7 @@ apps:
   namespace: cnpg-system
   repoURL: https://cloudnative-pg.github.io/charts
   chart: cloudnative-pg
-  targetRevision: 0.22.1
+  targetRevision: 0.21.6
 
 - name: redis-operator
   repoURL: https://ot-container-kit.github.io/helm-charts

projects/vault/project.yml

@@ -5,7 +5,7 @@ apps:
 - name: vault
   repoURL: https://helm.releases.hashicorp.com
   chart: vault
-  targetRevision: 0.29.1
+  targetRevision: 0.28.1
   syncWave: '-3'
   ignoreDiff:
     - group: "*"
@@ -18,5 +18,5 @@ apps:
   namespace: vault-secrets-operator
   repoURL: https://ricoberger.github.io/helm-charts
   chart: vault-secrets-operator
-  targetRevision: 2.6.1
+  targetRevision: 2.5.10
   syncWave: '-2'

projects/vault/values/vault.yaml

@@ -11,7 +11,7 @@ server:
   enabled: true
   image:
     repository: "hashicorp/vault"
-    tag: "1.18.2"
+    tag: "1.17.6"
   auditStorage:
     accessMode: ReadWriteOnce
     annotations: {}

projects/woodpecker/values/woodpecker-agent.yml

@@ -19,7 +19,6 @@ env:
   WOODPECKER_BACKEND_K8S_POD_ANNOTATIONS: ''
   WOODPECKER_CONNECT_RETRY_COUNT: '1'
 
-mapAgentSecret: false
 # -- Add extra secret that is contains environment variables
 extraSecretNamesForEnvFrom:
   - woodpecker-secret

projects/woodpecker/values/woodpecker-server.yml

@@ -31,6 +31,10 @@ extraSecretNamesForEnvFrom:
   - woodpecker-secret
   - github-oauth
 
+# -- Create a generic secret to store things in, e.g. env values
+secrets:
+  - name: woodpecker-store
+
 persistentVolume:
   enabled: true
   size: 10Gi

renovate.json

@@ -1,179 +1,101 @@
 {
-  "enabled": true,
+    "enabled": true,
-  "timezone": "Europe/Berlin",
+    "timezone": "Europe/Berlin",
-  "dependencyDashboard": true,
+    "dependencyDashboard": true,
-  "dependencyDashboardTitle": "Renovate Dashboard",
+    "dependencyDashboardTitle": "Renovate Dashboard",
-  "commitMessageSuffix": "",
+    "commitMessageSuffix": "",
-  "commitBody": "",
+    "commitBody": "",
-  "prHourlyLimit": 20,
+    "suppressNotifications": ["prIgnoreNotification"],
-  "suppressNotifications": [
+    "rebaseWhen": "conflicted",
-    "prIgnoreNotification"
+    "assignees": ["@nold360"],
-  ],
+    "helm-values": {
-  "rebaseWhen": "conflicted",
+      "fileMatch": ["projects/.*/values/.+\\.ya?ml$"]
-  "assignees": [
+    },
-    "@nold360"
+    "kubernetes": {
-  ],
+      "fileMatch": ["\\.ya?ml$"],
-  "helm-values": {
+      "ignorePaths": [
-    "fileMatch": [
+        "projects",
-      "projects/.*/values/.+\\.ya?ml$"
+        "ansible",
-    ]
+        "scripts",
-  },
+        ".github"
-  "kubernetes": {
+      ]
-    "fileMatch": [
+    },
-      "\\.ya?ml$"
+    "regexManagers": [
+      {
+        "fileMatch": ["project.ya?ml$"],
+        "matchStrings": [
+          "repoURL: (?<registryUrl>.*?)\n *chart: (?<depName>.*?)\n *targetRevision: (?<currentValue>.*)\n"
+        ],
+        "datasourceTemplate": "helm"
+      }
     ],
-    "ignorePaths": [
+    "packageRules": [
-      "projects",
+      {
-      "ansible",
+      	"datasources": ["helm"],
-      "scripts",
+      	"managers": ["regex"],
-      ".github"
+      	"packageNames": [
+					"app-template",
+          "common"
+      	],
+      	"registryUrls": ["https://bjw-s.github.io/helm-charts"]
+      },
+      {
+        "datasources": ["helm"],
+        "commitMessageTopic": "Helm chart {{depName}}",
+        "separateMinorPatch": true
+      },
+      {
+        "datasources": ["docker"],
+        "commitMessageTopic": "Docker image {{depName}}",
+        "commitMessageExtra": "to {{#if isSingleVersion}}v{{{toVersion}}}{{else}}{{{newValue}}}{{/if}}",
+        "enabled": true,
+        "separateMinorPatch": true
+      },
+      {
+        "datasources": ["docker"],
+        "updateTypes": ["major"],
+        "labels": ["renovate/image-release", "dependency/major"]
+      },
+      {
+        "datasources": ["docker"],
+        "updateTypes": ["minor"],
+        "labels": ["renovate/image-release", "dependency/minor"]
+      },
+      {
+        "datasources": ["docker"],
+        "updateTypes": ["patch"],
+        "labels": ["renovate/image-release", "dependency/patch"]
+      },
+      {
+        "datasources": ["helm"],
+        "updateTypes": ["major"],
+        "labels": ["renovate/helm-release", "dependency/major"]
+      },
+      {
+        "datasources": ["helm"],
+        "updateTypes": ["minor"],
+        "labels": ["renovate/helm-release", "dependency/minor"]
+      },
+      {
+        "datasources": ["helm"],
+        "updateTypes": ["patch"],
+        "labels": ["renovate/helm-release", "dependency/patch"]
+      },
+      {
+        "datasources": ["docker"],
+        "automerge": true,
+        "requiredStatusChecks": null,
+        "schedule": "after 1am and before 5am",
+        "updateTypes": ["minor", "patch"],
+        "excludePackagePatterns": [ ".*cilium.*", ".*hubble.*", ".*cilium/operator"]
+      },
+      {
+        "datasources": ["helm"],
+        "automerge": true,
+        "requiredStatusChecks": null,
+        "schedule": "after 1am and before 5am",
+        "updateTypes": ["minor", "patch"],
+        "excludePackageNames": []
+      }
     ]
-  },
+  }
-  "customManagers": [
-    {
-      "customType": "regex",
-      "fileMatch": [
-        "project.ya?ml$"
-      ],
-      "matchStrings": [
-        "repoURL: (?<registryUrl>.*?)\n *chart: (?<depName>.*?)\n *targetRevision: (?<currentValue>.*)\n"
-      ],
-      "datasourceTemplate": "helm"
-    }
-  ],
-  "packageRules": [
-    {
-      "matchDatasources": [
-        "helm"
-      ],
-      "matchManagers": [
-        "custom.regex"
-      ],
-      "matchPackageNames": [
-        "app-template",
-        "common"
-      ],
-      "registryUrls": [
-        "https://bjw-s.github.io/helm-charts"
-      ]
-    },
-    {
-      "matchDatasources": [
-        "helm"
-      ],
-      "commitMessageTopic": "Helm chart {{depName}}",
-      "separateMinorPatch": true
-    },
-    {
-      "matchDatasources": [
-        "docker"
-      ],
-      "commitMessageTopic": "Docker image {{depName}}",
-      "commitMessageExtra": "to {{#if isSingleVersion}}v{{{newVersion}}}{{else}}{{{newValue}}}{{/if}}",
-      "enabled": true,
-      "separateMinorPatch": true
-    },
-    {
-      "matchDatasources": [
-        "docker"
-      ],
-      "matchUpdateTypes": [
-        "major"
-      ],
-      "labels": [
-        "renovate/image-release",
-        "dependency/major"
-      ]
-    },
-    {
-      "matchDatasources": [
-        "docker"
-      ],
-      "matchUpdateTypes": [
-        "minor"
-      ],
-      "labels": [
-        "renovate/image-release",
-        "dependency/minor"
-      ]
-    },
-    {
-      "matchDatasources": [
-        "docker"
-      ],
-      "matchUpdateTypes": [
-        "patch"
-      ],
-      "labels": [
-        "renovate/image-release",
-        "dependency/patch"
-      ]
-    },
-    {
-      "matchDatasources": [
-        "helm"
-      ],
-      "matchUpdateTypes": [
-        "major"
-      ],
-      "labels": [
-        "renovate/helm-release",
-        "dependency/major"
-      ]
-    },
-    {
-      "matchDatasources": [
-        "helm"
-      ],
-      "matchUpdateTypes": [
-        "minor"
-      ],
-      "labels": [
-        "renovate/helm-release",
-        "dependency/minor"
-      ]
-    },
-    {
-      "matchDatasources": [
-        "helm"
-      ],
-      "matchUpdateTypes": [
-        "patch"
-      ],
-      "labels": [
-        "renovate/helm-release",
-        "dependency/patch"
-      ]
-    },
-    {
-      "matchDatasources": [
-        "docker"
-      ],
-      "automerge": true,
-      "ignoreTests": true,
-      "schedule": "after 1am and before 5am",
-      "matchUpdateTypes": [
-        "minor",
-        "patch"
-      ],
-      "matchPackageNames": [
-        "!/.*cilium.*/",
-        "!/.*hubble.*/",
-        "!/.*cilium/operator/"
-      ]
-    },
-    {
-      "matchDatasources": [
-        "helm"
-      ],
-      "automerge": true,
-      "ignoreTests": true,
-      "schedule": "after 1am and before 5am",
-      "matchUpdateTypes": [
-        "minor",
-        "patch"
-      ],
-      "matchPackageNames": []
-    }
-  ]
-}