chore(deps): update docker.io/bats/bats docker tag to v1.14.0

Reviewed-on: #112

arr-stack/flaresolverr/deployment.yaml

@@ -14,7 +14,7 @@ spec:
     spec:
       containers:
       - name: flaresolverr
-        image: ghcr.io/flaresolverr/flaresolverr:v3.4.1
+        image: ghcr.io/flaresolverr/flaresolverr:v3.4.6
         resources:
           requests:
             memory: "2Gi"

arr-stack/prowlarr/deployment.yaml

@@ -16,7 +16,7 @@ spec:
     spec:
       containers:
       - name: prowlarr
-        image: linuxserver/prowlarr:version-2.0.5.5160
+        image: linuxserver/prowlarr:version-2.3.0.5236
         volumeMounts:
           - name: config
             mountPath: /config

arr-stack/radarr/deployment.yaml

@@ -16,7 +16,7 @@ spec:
     spec:
       containers:
       - name: radarr
-        image: linuxserver/radarr:version-5.27.5.10198
+        image: linuxserver/radarr:version-6.0.4.10291
         volumeMounts:
           - name: config
             mountPath: /config

arr-stack/sonarr/deployment.yaml

@@ -16,7 +16,7 @@ spec:
     spec:
       containers:
       - name: sonarr
-        image: linuxserver/sonarr:4.0.15
+        image: linuxserver/sonarr:version-4.0.16.2944
         volumeMounts:
           - name: config
             mountPath: /config

arr-stack/tunnel/deployment.yaml

@@ -14,7 +14,7 @@ spec:
       containers:
       - name: deluge-tunnel
         image: kroniak/ssh-client:3.21
-        command: ["/bin/sh", "-c", "ssh -o StrictHostKeyChecking=no weyma-talos@45.152.211.243 -p 2222 -L 0.0.0.0:58846:127.0.0.1:58846 -L 0.0.0.0:8112:127.0.0.1:8112 -N"]
+        command: ["/bin/sh", "-c", "ssh -o StrictHostKeyChecking=no weyma-talos@184.107.106.14 -L 0.0.0.0:58846:127.0.0.1:58846 -L 0.0.0.0:8112:127.0.0.1:8112 -N"]
         volumeMounts:
           - name: ssh-keys
             mountPath: /root/.ssh

attic/bucket.yaml

@@ -0,0 +1,10 @@
+apiVersion: objectbucket.io/v1alpha1
+kind: ObjectBucketClaim
+metadata:
+  name: attic-bucket
+  namespace: attic
+spec:
+  additionalConfig:
+    maxSize: 100Gi
+  bucketName: attic-bucket
+  storageClassName: weyma-s3-bucket

attic/cert-dubyatp-xyz.yaml

@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cert-dubyatp-xyz
-  annotations:
-    replicator.v1.mittwald.de/replicate-from: "cert-manager/cert-dubyatp-xyz"
-    replicator.v1.mittwald.de/replicated-keys: "tls.crt,tls.key"
-data:
-  tls.crt: ""
-  tls.key: ""

attic/config.yaml

@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: attic-config
+data:
+  server.toml: |
+    listen = "[::]:8080"
+    allowed-hosts = []
+
+    #api-endpoint = "https://nix-cache.dubyatp.xyz/"
+
+    [database]
+    url = "sqlite:///var/empty/.local/share/attic/server.db"
+
+    [storage]
+    path = "/data/.local/share/attic/storage"
+    type = "local"
+    #region = "us-east-1"
+    #bucket = "attic-bucket"
+    #endpoint = "https://weyma-s3.infra.dubyatp.xyz"
+
+    [chunking]
+    nar-size-threshold = 65536
+    min-size = 16384
+    avg-size = 65536
+    max-size = 262144
+
+    [compression]
+    type = "zstd"
+
+    [garbage-collection]
+    interval = "12 hours"
+
+    [jwt]
+
+    [jwt.signing]

attic/db_auth.yaml

@@ -0,0 +1,24 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: attic-db-auth
+spec:
+  data:
+  - remoteRef:
+      conversionStrategy: Default
+      decodingStrategy: None
+      key: cloudnativepg
+      metadataPolicy: None
+      property: attic_pw
+    secretKey: password
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: weyma-vault
+  target:
+    template:
+      data:
+        ATTIC_SERVER_DATABASE_URL: "postgres://attic:{{ .password }}@pooler-weyma-rw.cloudnativepg.svc.cluster.local/attic"
+    creationPolicy: Owner
+    deletionPolicy: Retain
+    name: attic-db-auth

attic/deployment.yaml

@@ -3,6 +3,7 @@ kind: Deployment
 metadata:
   name: attic
 spec:
+  replicas: 3
   selector:
     matchLabels:
       app: attic
@@ -13,17 +14,26 @@ spec:
     spec:
       containers:
       - name: attic
-        image: ghcr.io/zhaofengli/attic:ff8a897d1f4408ebbf4d45fa9049c06b3e1e3f4e
+        image: ghcr.io/zhaofengli/attic:c4ffb5e86e928572e867bd3f81545293313e0a08
         envFrom:
         - secretRef:
             name: attic-secret
+        - secretRef:
+            name: attic-db-auth
+        - secretRef:
+            name: attic-bucket
         volumeMounts:
         - name: attic-pvc
-          mountPath: /var/empty
+          mountPath: /var/empty/
         resources:
           limits:
             memory: "2Gi"
             cpu: "500m"
+      - name: multitool
+        image: wbitt/network-multitool
+        volumeMounts:
+        - name: attic-pvc
+          mountPath: /var/empty/
       volumes:
       - name: attic-pvc
         persistentVolumeClaim:

attic/gateway.yaml

@@ -0,0 +1,18 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: traefik
+spec:
+  gatewayClassName: traefik
+  listeners:
+    - name: https
+      protocol: HTTPS
+      port: 8443
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - name: cert-dubyatp-xyz
+            namespace: cert-manager
+      allowedRoutes:
+        namespaces:
+          from: Same

attic/httproute.yaml

@@ -0,0 +1,19 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: attic
+spec:
+  parentRefs:
+    - name: traefik
+      sectionName: https
+      kind: Gateway
+  hostnames:
+    - nix-cache.dubyatp.xyz
+  rules:
+     - matches:
+        - path:
+            type: PathPrefix
+            value: /
+       backendRefs:
+        - name: attic-svc
+          port: 8080

authentik/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: authentik
-  version: 2025.12.3
+  version: 2026.5.5
   repository: https://charts.goauthentik.io

authentik/values.yaml

@@ -32,8 +32,10 @@ authentik:
           secretKeyRef:
             name: authentik-credentials
             key: authentik-secret-key
+      - name: AUTHENTIK_POSTGRESQL__DISABLE_SERVER_SIDE_CURSORS
+        value: "true"
       - name: AUTHENTIK_POSTGRESQL__HOST
-        value: pooler-weyma-rw.cloudnativepg.svc.cluster.local
+        value: pooler-weyma-rw-authentik.cloudnativepg.svc.cluster.local
       - name: AUTHENTIK_POSTGRESQL__NAME
         value: authentik
       - name: AUTHENTIK_POSTGRESQL__USER
@@ -58,7 +60,41 @@ authentik:
             key: smtp-password
       - name: AUTHENTIK_EMAIL__TIMEOUT
         value: "30"
+      - name: AUTHENTIK_STORAGE__BACKEND
+        value: "s3"
+      - name: AUTHENTIK_STORAGE__S3__ENDPOINT
+        value: "https://weyma-s3.infra.dubyatp.xyz"
+      - name: AUTHENTIK_STORAGE__S3__BUCKET_NAME
+        value: "authentik-files"
+      - name: AUTHENTIK_STORAGE__S3__ACCESS_KEY
+        valueFrom:
+          secretKeyRef:
+            name: authentik-files
+            key: AWS_ACCESS_KEY_ID
+      - name: AUTHENTIK_STORAGE__S3__SECRET_KEY
+        valueFrom:
+          secretKeyRef:
+            name: authentik-files
+            key: AWS_SECRET_ACCESS_KEY      
   additionalObjects:
+    - apiVersion: gateway.networking.k8s.io/v1
+      kind: Gateway
+      metadata:
+        name: traefik
+      spec:
+        gatewayClassName: traefik
+        listeners:
+          - name: https
+            protocol: HTTPS
+            port: 8443
+            tls:
+              mode: Terminate
+              certificateRefs:
+                - name: cert-dubyatp-xyz
+                  namespace: cert-manager
+            allowedRoutes:
+              namespaces:
+                from: Same
     - apiVersion: networking.k8s.io/v1
       kind: Ingress
       metadata:
@@ -146,3 +182,12 @@ authentik:
           creationPolicy: Owner
           deletionPolicy: Retain
           name: authentik-db-auth
+    - apiVersion: objectbucket.io/v1alpha1
+      kind: ObjectBucketClaim
+      metadata:
+        name: authentik-files
+      spec:
+        additionalConfig:
+          maxSize: 20Gi
+        bucketName: authentik-files
+        storageClassName: weyma-s3-bucket

gitea-runner/config.yaml

@@ -0,0 +1,41 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: runner-config
+data:
+  config.yaml: |-
+    log:
+      level: info
+    runner:
+      file: /data/.runner
+      capacity: 1
+      env_file: .env
+      timeout: 3h
+      shutdown_timeout: 0s
+      insecure: false
+      fetch_timeout: 5s
+      fetch_interval: 2s
+      labels:
+        - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+        - "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
+        - "ubuntu-20.04:docker://docker.gitea.com/runner-images:ubuntu-20.04"
+    cache:
+      enabled: true
+      dir: ""
+      host: ""
+      port: 0
+      external_server: ""
+    container:
+      network: "host"
+      privileged: false
+      options: ""
+      workdir_parent: /scratch
+      valid_volumes:
+        - /scratch/**
+      docker_host: ""
+      force_pull: true
+      force_rebuild: false
+      require_docker: false
+      docker_timeout: 0s
+    host:
+      workdir_parent:

gitea-runner/statefulset.yaml

@@ -16,22 +16,37 @@ spec:
       labels:
         app: act-runner
     spec:
-      containers:
+      initContainers:
-      - name: runner
+      - name: sysctl
+        image: busybox
+        securityContext:
+          privileged: true
         command:
           - sh
           - -c
-          - while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...';
+          - echo 28633 > /proc/sys/user/max_user_namespaces
-            sleep 5; done; /sbin/tini -- run.sh
+      - name: chown-data
-        image: gitea/act_runner:nightly
+        image: busybox
+        securityContext:
+          runAsUser: 0
+        command:
+          - sh
+          - -c
+          - chown -R 1000:1000 /data
+        volumeMounts:
+        - name: runner-data
+          mountPath: /data
+      containers:
+      - name: runner
+        image: gitea/act_runner:nightly-dind-rootless
         imagePullPolicy: Always
         env:
+          - name: DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS
+            value: "--net=slirp4netns --copy-up=/etc"
+          - name: CONFIG_FILE
+            value: /config/config.yaml
           - name: DOCKER_HOST
-            value: tcp://localhost:2376
+            value: unix:///run/user/1000/docker.sock
-          - name: DOCKER_CERT_PATH
-            value: /certs/client
-          - name: DOCKER_TLS_VERIFY
-            value: "1"
           - name: GITEA_INSTANCE_URL
             value: https://git.dubyatp.xyz
           - name: GITEA_RUNNER_REGISTRATION_TOKEN
@@ -39,33 +54,29 @@ spec:
               secretKeyRef:
                 key: registration-token
                 name: gitea-runner-token
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-        volumeMounts:
-        - name: docker-certs
-          mountPath: /certs
-        - name: runner-data
-          mountPath: /data
-      - name: daemon
-        env:
-          - name: DOCKER_TLS_CERTDIR
-            value: /certs
-        image: docker:23.0.6-dind
-        imagePullPolicy: IfNotPresent
         securityContext:
           privileged: true
         terminationMessagePath: /dev/termination-log
         terminationMessagePolicy: File
         volumeMounts:
-          - mountPath: /certs
+        - name: runner-config
-            name: docker-certs
+          mountPath: /config
+        - name: runner-data
+          mountPath: /data
+        - name: runner-scratch
+          mountPath: /scratch
       dnsPolicy: ClusterFirst
-      hostNetwork: true
       restartPolicy: Always
       schedulerName: default-scheduler
       terminationGracePeriodSeconds: 30
       volumes:
-        - name: docker-certs
+        - name: runner-scratch
+          emptyDir:
+            medium: Memory
+            sizeLimit: 5Gi
+        - name: runner-config
+          configMap:
+            name: runner-config
   volumeClaimTemplates:
   - metadata:
       name: runner-data

gitea/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: gitea
-  version: 12.5.4
+  version: 12.7.0
   repository: https://weyma-s3.infra.dubyatp.xyz/helm-bucket-ea34bc44-ef19-480d-a16a-1e583991f123/charts/

gitea/values.yaml

@@ -1,15 +1,27 @@
 gitea:
   replicaCount: 3
-  ingress:
+#  ingress:
+#    enabled: true
+#    hosts:
+#      - host: git.dubyatp.xyz
+#        paths:
+#          - path: /
+#    tls:
+#      - secretName: cert-dubyatp-xyz
+#        hosts:
+#          - git.dubyatp.xyz
+  gateway:
+    httpRoute:
       enabled: true
-    hosts:
+      hostnames:
-      - host: git.dubyatp.xyz
+        - git.dubyatp.xyz
+      parentRefs:
+        - name: traefik
+          sectionName: https
+          kind: Gateway
+      pathType: PathPrefix
       paths:
         - path: /
-    tls:
-      - secretName: cert-dubyatp-xyz
-        hosts:
-          - git.dubyatp.xyz
   persistence:
     enabled: true
     create: true
@@ -105,16 +117,24 @@ gitea:
           services:
           - name: gitea-ssh
             port: 22
-    - apiVersion: v1
+    - apiVersion: gateway.networking.k8s.io/v1
-      kind: Secret
+      kind: Gateway
       metadata:
-        name: cert-dubyatp-xyz
+        name: traefik
-        annotations:
+      spec:
-          replicator.v1.mittwald.de/replicate-from: "cert-manager/cert-dubyatp-xyz"
+        gatewayClassName: traefik
-          replicator.v1.mittwald.de/replicated-keys: "tls.crt,tls.key"
+        listeners:
-      data:
+          - name: https
-        tls.crt: ""
+            protocol: HTTPS
-        tls.key: ""
+            port: 8443
+            tls:
+              mode: Terminate
+              certificateRefs:
+                - name: cert-dubyatp-xyz
+                  namespace: cert-manager
+            allowedRoutes:
+              namespaces:
+                from: Same
     - apiVersion: external-secrets.io/v1
       kind: ExternalSecret
       metadata:

grafana/values.yaml

@@ -191,6 +191,6 @@ grafana:
     image:
       registry: docker.io
       repository: bats/bats
-      tag: 1.13.0
+      tag: 1.14.0
     imagePullPolicy: IfNotPresent
   useStatefulSet: false

jellyfin/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: jellyfin
-  version: 2.7.0
+  version: 3.2.0
   repository: https://jellyfin.github.io/jellyfin-helm

jellyfin/templates/gateway.yaml

@@ -0,0 +1,18 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: traefik
+spec:
+  gatewayClassName: traefik
+  listeners:
+    - name: https
+      protocol: HTTPS
+      port: 8443
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - name: cert-dubyatp-xyz
+            namespace: cert-manager
+      allowedRoutes:
+        namespaces:
+          from: Same

jellyfin/templates/metrics-block.yaml

@@ -1,4 +1,4 @@
-{{- if and (.Values.jellyfin.metrics.enabled) (.Values.jellyfin.ingress.enabled) -}}
+{{- if and (.Values.jellyfin.metrics.enabled) (.Values.jellyfin.httpRoute.enabled) -}}
 ---
 apiVersion: v1
 kind: Service
@@ -13,21 +13,22 @@ spec:
       port: 6767
       targetPort: 6767
 ---
-apiVersion: networking.k8s.io/v1
+apiVersion: gateway.networking.k8s.io/v1
-kind: Ingress
+kind: HTTPRoute
 metadata:
   name: block-metrics
   namespace: {{ .Release.Namespace }}
 spec:
+  parentRefs:
+    {{- toYaml .Values.jellyfin.httpRoute.parentRefs | nindent 4 }}
+  hostnames:
+    {{- toYaml .Values.jellyfin.httpRoute.hostnames | nindent 4 }}
   rules:
-  - host: {{ (index .Values.jellyfin.ingress.hosts 0).host }}
+    - matches:
-    http:
+        - path:
-      paths:
+            type: PathPrefix
-      - pathType: Prefix
+            value: /metrics
-        path: "/metrics"
+      backendRefs:
-        backend:
+        - name: dummy-svc
-          service:
+          port: 6767
-            name: dummy-svc
-            port: 
-              number: 6767
 {{- end }}

jellyfin/templates/ssl-cert.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-data:
-  tls.crt:
-  tls.key:
-kind: Secret
-metadata:
-  annotations:
-    replicator.v1.mittwald.de/replicate-from: cert-manager/cert-dubyatp-xyz
-    replicator.v1.mittwald.de/replicated-keys: tls.crt,tls.key
-  name: cert-dubyatp-xyz
-type: Opaque

jellyfin/values.yaml

@@ -1,16 +1,13 @@
 jellyfin:
   deploymentStrategy:
     type: Recreate
-  ingress:
+  httpRoute:
     enabled: true
-    hosts:
+    parentRefs:
-      - host: jellyfin.dubyatp.xyz
+      - name: traefik
-        paths:
+        sectionName: https
-          - path: /
+        kind: Gateway
-            pathType: ImplementationSpecific
+    hostnames:
-    tls:
-      - secretName: cert-dubyatp.xyz
-        hosts:
       - jellyfin.dubyatp.xyz
   persistence:
     config:
@@ -26,10 +23,6 @@ jellyfin:
       nfs:
         server: 10.105.15.20
         path: /mnt/hdd-pool/movies
-    - name: dvr
-      nfs:
-        server: 10.105.15.20
-        path: /mnt/hdd-pool/DVR
     - name: youtube-vids
       nfs:
         server: 10.105.15.20
@@ -50,8 +43,6 @@ jellyfin:
       mountPath: /mnt/tv-shows
     - name: movies
       mountPath: /mnt/movies
-    - name: dvr
-      mountPath: /mnt/dvr
     - name: youtube-vids
       mountPath: /mnt/youtube-vids
     - name: transcode-temp

netmaker/statefulset.yaml

@@ -54,7 +54,7 @@ spec:
         envFrom:
           - configMapRef:
               name: netmaker-config
-        image: gravitl/netmaker:v1.4.0
+        image: gravitl/netmaker:v1.6.0
         imagePullPolicy: Always
         name: netmaker
         ports:

netmaker/ui/deployment.yaml

@@ -14,7 +14,7 @@ spec:
     spec:
       containers:
       - name: netmaker-ui
-        image: gravitl/netmaker-ui:v1.1.0
+        image: gravitl/netmaker-ui:v1.6.0
         env:
         - name: BACKEND_URL
           value: 'https://api.netmaker.infra.dubyatp.xyz'

searxng/Chart.yaml

@@ -0,0 +1,28 @@
+apiVersion: v2
+name: searxng
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+appVersion: "1.0"
+
+dependencies:
+- name: searxng
+  version: 1.1.4
+  repository: https://charts.kubito.dev

yt-dlp-bot/deployment.yaml

@@ -14,12 +14,14 @@ spec:
     spec:
       containers:
         - name: yt-dlp-bot
-          image: 'git.dubyatp.xyz/williamp/yt-dlp-bot:d7ad90a'
+          image: 'git.dubyatp.xyz/williamp/yt-dlp-bot:f48776c'
           env:
             - name: OUT_PATH
               value: /data/youtube-vids
             - name: TEMP_PATH
               value: /tmp/ytdlp-temp
+            - name: LOADING_EMOJI
+              value: "<a:loading:1479485735076761848>"
           envFrom:
             - secretRef:
                 name: yt-dlp-discord-token