yt-dlp-bot: deploy update to b9088d9

Per https://docs.goauthentik.io/install-config/configuration/#using-a-postgresql-connection-pooler

attic/bucket.yaml

@@ -0,0 +1,10 @@
+apiVersion: objectbucket.io/v1alpha1
+kind: ObjectBucketClaim
+metadata:
+  name: attic-bucket
+  namespace: attic
+spec:
+  additionalConfig:
+    maxSize: 100Gi
+  bucketName: attic-bucket
+  storageClassName: weyma-s3-bucket

attic/config.yaml

@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: attic-config
+data:
+  server.toml: |
+    listen = "[::]:8080"
+    allowed-hosts = []
+
+    #api-endpoint = "https://nix-cache.dubyatp.xyz/"
+
+    [database]
+    url = "sqlite:///var/empty/.local/share/attic/server.db"
+
+    [storage]
+    path = "/data/.local/share/attic/storage"
+    type = "local"
+    #region = "us-east-1"
+    #bucket = "attic-bucket"
+    #endpoint = "https://weyma-s3.infra.dubyatp.xyz"
+
+    [chunking]
+    nar-size-threshold = 65536
+    min-size = 16384
+    avg-size = 65536
+    max-size = 262144
+
+    [compression]
+    type = "zstd"
+
+    [garbage-collection]
+    interval = "12 hours"
+
+    [jwt]
+
+    [jwt.signing]

attic/deployment.yaml

@@ -3,6 +3,7 @@ kind: Deployment
 metadata:
   name: attic
 spec:
+  replicas: 1
   selector:
     matchLabels:
       app: attic
@@ -13,17 +14,24 @@ spec:
     spec:
       containers:
       - name: attic
-        image: ghcr.io/zhaofengli/attic:ff8a897d1f4408ebbf4d45fa9049c06b3e1e3f4e
+        image: ghcr.io/zhaofengli/attic:c4ffb5e86e928572e867bd3f81545293313e0a08
         envFrom:
         - secretRef:
             name: attic-secret
+        - secretRef:
+            name: attic-bucket
         volumeMounts:
         - name: attic-pvc
-          mountPath: /var/empty
+          mountPath: /var/empty/
         resources:
           limits:
             memory: "2Gi"
             cpu: "500m"
+      - name: multitool
+        image: wbitt/network-multitool
+        volumeMounts:
+        - name: attic-pvc
+          mountPath: /var/empty/
       volumes:
       - name: attic-pvc
         persistentVolumeClaim:

authentik/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: authentik
-  version: 2025.12.3
+  version: 2026.2.0
   repository: https://charts.goauthentik.io

authentik/values.yaml

@@ -15,6 +15,35 @@ authentik:
       service:
         labels:
           metrics_enabled: "true"
+    livenessProbe:
+      failureThreshold: 3      
+      initialDelaySeconds: 5
+      periodSeconds: 10
+      successThreshold: 1
+      timeoutSeconds: 10       
+      httpGet:
+        path: "{{ .Values.authentik.web.path }}-/health/live/"
+        port: http
+
+    readinessProbe:
+      failureThreshold: 3      
+      initialDelaySeconds: 5
+      periodSeconds: 10
+      successThreshold: 1
+      timeoutSeconds: 10       
+      httpGet:
+        path: "{{ .Values.authentik.web.path }}-/health/ready/"
+        port: http
+
+    startupProbe:
+      failureThreshold: 60     
+      initialDelaySeconds: 5
+      periodSeconds: 10
+      successThreshold: 1
+      timeoutSeconds: 10       
+      httpGet:
+        path: "{{ .Values.authentik.web.path }}-/health/live/"
+        port: http
   worker:
     replicas: 3
     volumeMounts:
@@ -32,8 +61,10 @@ authentik:
           secretKeyRef:
             name: authentik-credentials
             key: authentik-secret-key
+      - name: AUTHENTIK_POSTGRESQL__DISABLE_SERVER_SIDE_CURSORS
+        value: "true"
       - name: AUTHENTIK_POSTGRESQL__HOST
-        value: pooler-weyma-rw.cloudnativepg.svc.cluster.local
+        value: pooler-weyma-rw-authentik.cloudnativepg.svc.cluster.local
       - name: AUTHENTIK_POSTGRESQL__NAME
         value: authentik
       - name: AUTHENTIK_POSTGRESQL__USER
@@ -58,6 +89,22 @@ authentik:
             key: smtp-password
       - name: AUTHENTIK_EMAIL__TIMEOUT
         value: "30"
+      - name: AUTHENTIK_STORAGE__BACKEND
+        value: "s3"
+      - name: AUTHENTIK_STORAGE__S3__ENDPOINT
+        value: "https://weyma-s3.infra.dubyatp.xyz"
+      - name: AUTHENTIK_STORAGE__S3__BUCKET_NAME
+        value: "authentik-files"
+      - name: AUTHENTIK_STORAGE__S3__ACCESS_KEY
+        valueFrom:
+          secretKeyRef:
+            name: authentik-files
+            key: AWS_ACCESS_KEY_ID
+      - name: AUTHENTIK_STORAGE__S3__SECRET_KEY
+        valueFrom:
+          secretKeyRef:
+            name: authentik-files
+            key: AWS_SECRET_ACCESS_KEY      
   additionalObjects:
     - apiVersion: networking.k8s.io/v1
       kind: Ingress
@@ -145,4 +192,13 @@ authentik:
         target:
           creationPolicy: Owner
           deletionPolicy: Retain
-          name: authentik-db-auth
+          name: authentik-db-auth
+    - apiVersion: objectbucket.io/v1alpha1
+      kind: ObjectBucketClaim
+      metadata:
+        name: authentik-files
+      spec:
+        additionalConfig:
+          maxSize: 20Gi
+        bucketName: authentik-files
+        storageClassName: weyma-s3-bucket

gitea-runner/config.yaml

@@ -0,0 +1,41 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: runner-config
+data:
+  config.yaml: |-
+    log:
+      level: info
+    runner:
+      file: /data/.runner
+      capacity: 1
+      env_file: .env
+      timeout: 3h
+      shutdown_timeout: 0s
+      insecure: false
+      fetch_timeout: 5s
+      fetch_interval: 2s
+      labels:
+        - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+        - "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
+        - "ubuntu-20.04:docker://docker.gitea.com/runner-images:ubuntu-20.04"
+    cache:
+      enabled: true
+      dir: ""
+      host: ""
+      port: 0
+      external_server: ""
+    container:
+      network: "host"
+      privileged: false
+      options:
+      workdir_parent: /scratch
+      valid_volumes:
+        - /scratch/**
+      docker_host: ""
+      force_pull: true
+      force_rebuild: false
+      require_docker: false
+      docker_timeout: 0s
+    host:
+      workdir_parent:

gitea-runner/statefulset.yaml

@@ -16,22 +16,35 @@ spec:
       labels:
         app: act-runner
     spec:
-      containers:
-      - name: runner
+      initContainers:
+      - name: sysctl
+        image: busybox
+        securityContext:
+          privileged: true
         command:
           - sh
           - -c
-          - while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...';
-            sleep 5; done; /sbin/tini -- run.sh
-        image: gitea/act_runner:nightly
+          - echo 28633 > /proc/sys/user/max_user_namespaces
+      - name: chown-data
+        image: busybox
+        securityContext:
+          runAsUser: 0
+        command:
+          - sh
+          - -c
+          - chown -R 1000:1000 /data
+        volumeMounts:
+        - name: runner-data
+          mountPath: /data
+      containers:
+      - name: runner
+        image: gitea/act_runner:nightly-dind-rootless
         imagePullPolicy: Always
         env:
+          - name: CONFIG_FILE
+            value: /config/config.yaml
           - name: DOCKER_HOST
-            value: tcp://localhost:2376
-          - name: DOCKER_CERT_PATH
-            value: /certs/client
-          - name: DOCKER_TLS_VERIFY
-            value: "1"
+            value: unix:///run/user/1000/docker.sock
           - name: GITEA_INSTANCE_URL
             value: https://git.dubyatp.xyz
           - name: GITEA_RUNNER_REGISTRATION_TOKEN
@@ -39,33 +52,29 @@ spec:
               secretKeyRef:
                 key: registration-token
                 name: gitea-runner-token
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-        volumeMounts:
-        - name: docker-certs
-          mountPath: /certs
-        - name: runner-data
-          mountPath: /data
-      - name: daemon
-        env:
-          - name: DOCKER_TLS_CERTDIR
-            value: /certs
-        image: docker:23.0.6-dind
-        imagePullPolicy: IfNotPresent
         securityContext:
           privileged: true
         terminationMessagePath: /dev/termination-log
         terminationMessagePolicy: File
         volumeMounts:
-          - mountPath: /certs
-            name: docker-certs
+        - name: runner-config
+          mountPath: /config
+        - name: runner-data
+          mountPath: /data
+        - name: runner-scratch
+          mountPath: /scratch
       dnsPolicy: ClusterFirst
-      hostNetwork: true
       restartPolicy: Always
       schedulerName: default-scheduler
       terminationGracePeriodSeconds: 30
       volumes:
-        - name: docker-certs
+        - name: runner-scratch
+          emptyDir:
+            medium: Memory
+            sizeLimit: 5Gi
+        - name: runner-config
+          configMap:
+            name: runner-config
   volumeClaimTemplates:
   - metadata:
       name: runner-data

gitea/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: gitea
-  version: 12.5.4
+  version: 12.5.6
   repository: https://weyma-s3.infra.dubyatp.xyz/helm-bucket-ea34bc44-ef19-480d-a16a-1e583991f123/charts/

yt-dlp-bot/deployment.yaml

@@ -14,7 +14,7 @@ spec:
     spec:
       containers:
         - name: yt-dlp-bot
-          image: 'git.dubyatp.xyz/williamp/yt-dlp-bot:d7ad90a'
+          image: 'git.dubyatp.xyz/williamp/yt-dlp-bot:b9088d9'
           env:
             - name: OUT_PATH
               value: /data/youtube-vids