.sops.yaml

@@ -10,7 +10,7 @@ creation_rules:
       286791FB6648539775DB31B8FCB98C2A3EC6F601,
       B137EE1549DFAF960DD1E2B15147025FB9F09E07
   - path_regex: (clusters|apps|infrastructure)/k8s01/.*.yaml
-    encrypted_regex: ^(data|stringData|email|dnsZones?|dnsNames?|.*(H|h)osts?|tang|externalURL|.*-secret|.*Secrets?|.*-domain|password|subjects|node|apiURL|.*(S|s)erverNames?|.*SecretKey|externalName)$
+    encrypted_regex: ^(data|stringData|email|dnsZones?|dnsNames?|.*(H|h)osts?|tang|externalURL|.*-secret|.*Secrets?|.*-domain|password|subjects|node|apiURL|.*(S|s)erverNames?|.*SecretKey|externalName|url|static)$
     pgp: >-
       286791FB6648539775DB31B8FCB98C2A3EC6F601,
       B137EE1549DFAF960DD1E2B15147025FB9F09E07

Earthfile

@@ -8,7 +8,7 @@ images:
     BUILD +images-earthly --CONTAINER_REGISTRY=${CONTAINER_REGISTRY} --latest=$latest
 
 images-src:
-    FROM quay.io/fedora/fedora:40
+    FROM quay.io/fedora/fedora:41
     COPY images/ ./images
 
 images-earthly:

apps/base/forecastle/release.yaml

@@ -15,7 +15,7 @@ spec:
         kind: HelmRepository
         name: stakater
         namespace: forecastle
-      version: v1.0.146
+      version: v1.0.150
   driftDetection:
     mode: enabled
   interval: 5m

apps/base/gitlab-runner/release.yaml

@@ -14,7 +14,7 @@ spec:
         kind: HelmRepository
         name: gitlab-runner
         namespace: gitlab-runner
-      version: 0.70.2
+      version: 0.71.0
   interval: 5m
   install:
     remediation:

apps/base/goharbor/release.yaml

@@ -14,7 +14,7 @@ spec:
         kind: HelmRepository
         name: goharbor
         namespace: goharbor
-      version: 1.15.1
+      version: 1.16.0
   driftDetection:
     mode: enabled
   interval: 5m

apps/base/immich/kustomization.yaml

@@ -12,9 +12,9 @@ commonLabels:
 
 images:
   - name: ghcr.io/immich-app/immich-machine-learning
-    newTag: v1.118.2@sha256:4d89a309fd08a93649f1ae4a7572ae98f09d66b4c1dfb7916b71d31dec7eda38
+    newTag: v1.120.2@sha256:3cca923bc8eaa3616c48fc6088005e08d574cf1acf6c1253c92393ae11e4788d
   - name: ghcr.io/immich-app/immich-server
-    newTag: v1.118.2@sha256:f158810c90f80162f9b08729bbaec963731f12662960be38ff93093b78a0bbdf
+    newTag: v1.120.2@sha256:99f97cb61cd1b49c23fbee46a0ed067f171970518d8834c7e8b2dd3ac0d39c63
 
 configMapGenerator:
   - name: immich-env

apps/base/immich/machine-learning/deployment.yaml

@@ -21,7 +21,7 @@ spec:
       enableServiceLinks: false
       containers:
         - name: machine-learning
-          image: ghcr.io/immich-app/immich-machine-learning:release@sha256:4d89a309fd08a93649f1ae4a7572ae98f09d66b4c1dfb7916b71d31dec7eda38
+          image: ghcr.io/immich-app/immich-machine-learning:release@sha256:3cca923bc8eaa3616c48fc6088005e08d574cf1acf6c1253c92393ae11e4788d
           envFrom:
             - configMapRef:
                 name: immich-env

apps/base/immich/monitoring-integrity/cronjob.yaml

@@ -24,7 +24,7 @@ spec:
           restartPolicy: Never
           containers:
             - name: server
-              image: ghcr.io/immich-app/immich-server:release@sha256:f158810c90f80162f9b08729bbaec963731f12662960be38ff93093b78a0bbdf
+              image: ghcr.io/immich-app/immich-server:release@sha256:99f97cb61cd1b49c23fbee46a0ed067f171970518d8834c7e8b2dd3ac0d39c63
               imagePullPolicy: IfNotPresent
               env:
                 - name: INTEGRITY_FILE_REPOSITORY

apps/base/immich/prometheus-monitoring/deployment-patch.yaml

 - op: add
   path: /spec/template/spec/containers/0/env/-
   value:
-    name: IMMICH_METRICS
-    value: "true"
+    name: IMMICH_TELEMETRY_INCLUDE
+    value: "all"
+- op: add
+  path: /spec/template/spec/containers/0/env/-
+  value:
+    name: IMMICH_TELEMETRY_EXCLUDE
+    value: host
 - op: add
   path: /spec/template/spec/containers/0/ports/-
   value:

apps/base/immich/server/deployment.yaml

@@ -18,7 +18,7 @@ spec:
       enableServiceLinks: false
       containers:
         - name: server
-          image: ghcr.io/immich-app/immich-server:release@sha256:f158810c90f80162f9b08729bbaec963731f12662960be38ff93093b78a0bbdf
+          image: ghcr.io/immich-app/immich-server:release@sha256:99f97cb61cd1b49c23fbee46a0ed067f171970518d8834c7e8b2dd3ac0d39c63
           imagePullPolicy: IfNotPresent
           env:
             - name: CPU_CORES
@@ -44,6 +44,7 @@ spec:
                 - immich-healthcheck
             failureThreshold: 120
             periodSeconds: 5
+            timeoutSeconds: 3
           livenessProbe:
             failureThreshold: 5
             exec:
@@ -57,7 +58,7 @@ spec:
               command:
                 - immich-healthcheck
             periodSeconds: 10
-            timeoutSeconds: 1
+            timeoutSeconds: 3
           securityContext:
             readOnlyRootFilesystem: true
             capabilities:
@@ -80,4 +81,4 @@ spec:
       volumes:
         - name: library
           persistentVolumeClaim:
-            claimName: immich-data
\ No newline at end of file
+            claimName: immich-data

apps/base/jellyfin/deployment.yaml

@@ -32,7 +32,7 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.namespace
-        image: docker.io/jellyfin/jellyfin:10.9.11@sha256:fc1b51f4be3fba725e42dae2022d9c6a5b069acce01bef04d32fdee025dc511e
+        image: docker.io/jellyfin/jellyfin:10.10.3@sha256:17c3a8d9dddb97789b5f37112840ebf96566442c14d4754193a6c2eb154bc221
         imagePullPolicy: IfNotPresent
         name: jellyfin
         readinessProbe:

apps/base/jellyfin/pvc.yaml

@@ -8,7 +8,7 @@ spec:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 10Gi
+      storage: 30Gi
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim

apps/base/loki/loki.yaml

@@ -12,7 +12,7 @@ spec:
         kind: HelmRepository
         name: grafana
         namespace: loki
-      version: 6.18.0
+      version: 6.22.0
   interval: 5m
   upgrade:
     remediation:
@@ -79,7 +79,12 @@ data:
     ruler:
       enabled: false
     monitoring:
-      enabled: true
+      dashboards:
+        enabled: true
+      rules:
+        enabled: true
+      serviceMonitor:
+        enabled: true
       selfMonitoring:
         grafanaAgent:
           installOperator: false

apps/base/matrix/release.yaml

@@ -14,7 +14,7 @@ spec:
         kind: HelmRepository
         name: matrix-synapse
         namespace: matrix
-      version: 3.9.12
+      version: 3.10.2
   interval: 5m
   install:
     remediation:

apps/base/matrix/synatainer/synatainer.yaml

@@ -21,7 +21,7 @@ spec:
           serviceAccountName: synatainer
           containers:
           - name: synatainer
-            image: registry.gitlab.com/mb-saces/synatainer:0.4.3
+            image: registry.gitlab.com/mb-saces/synatainer:0.4.4@sha256:b5e1270a0b7d9be6a6bd651332483fedb678b097775d8254fde3188d5525338d
             imagePullPolicy: IfNotPresent
             args:
               - /usr/local/bin/synatainer-cron.sh

apps/base/paperless/deployment.yaml

@@ -17,6 +17,9 @@ spec:
       containers:
         - name: paperless
           volumeMounts:
+            - name: storage
+              mountPath: /tmp/paperless
+              subPath: tmp
             - name: storage
               mountPath: /usr/src/paperless/data
               subPath: data

apps/base/paperless/kustomization.yaml

@@ -11,9 +11,9 @@ commonLabels:
 
 images:
   - name: ghcr.io/paperless-ngx/paperless-ngx
-    newTag: 2.13.2@sha256:d440c8682b445fff3dccc538ab88c604e389d3221f9267352f15e7d1e551a98d
+    newTag: 2.13.5@sha256:199c67ed55bfb9d58bf90db2ee280880ae9ebc63413e54c73522f9c4ebdc7bad
   - name: docker.io/gotenberg/gotenberg
-    newTag: 8.12.0@sha256:b10708db3ccabbee040d0b6d9ec68b6034a066c1d4e27b13fb7a6af4ade012e4
+    newTag: 8.14.1@sha256:c81f625afc869ba10819622f7e7d6d76708b2a32645b3fb74fbee610bf030465
   - name: docker.io/apache/tika
     newTag: 2.9.2.1
 # Config example, put in your own kustomization

apps/base/renovate/release.yaml

@@ -13,7 +13,7 @@ spec:
       sourceRef:
         kind: HelmRepository
         name: renovate
-      version: 38.135.2
+      version: 39.28.0
   interval: 5m
   valuesFrom:
     - kind: ConfigMap

apps/k8s01/blog/blog.yaml

@@ -13,7 +13,7 @@ spec:
       automountServiceAccountToken: false
       containers:
         - name: blog
-          image: quay.io/shivering-isles/blog:2024.10.28.1915
+          image: quay.io/shivering-isles/blog:2024.11.29.1932
           ports:
             - containerPort: 8080
               protocol: TCP

apps/k8s01/dns/dashboards/blocky.json

@@ -2026,11 +2026,7 @@
   "tags": [],
   "templating": {
     "list": [{
-      "current": {
-        "selected": false,
-        "text": "default",
-        "value": "default"
-      },
+      "current": {},
       "hide": 0,
       "includeAll": false,
       "multi": false,
@@ -2038,7 +2034,7 @@
       "options": [],
       "query": "prometheus",
       "refresh": 1,
-      "regex": "default",
+      "regex": "",
       "skipUrlSync": false,
       "type": "datasource"
     }]
@@ -2066,4 +2062,4 @@
   "uid": "JvOqE4gRk",
   "version": 5,
   "weekStart": ""
-}
\ No newline at end of file
+}