chore(deps): update helm release authentik to v2026.5.6

Reviewed-on: #112

arr-stack/flaresolverr/deployment.yaml

@@ -14,7 +14,7 @@ spec:
     spec:
       containers:
       - name: flaresolverr
-        image: ghcr.io/flaresolverr/flaresolverr:v3.4.1
+        image: ghcr.io/flaresolverr/flaresolverr:v3.4.6
         resources:
           requests:
             memory: "2Gi"

arr-stack/prowlarr/deployment.yaml

@@ -16,7 +16,7 @@ spec:
     spec:
       containers:
       - name: prowlarr
-        image: linuxserver/prowlarr:version-2.0.5.5160
+        image: linuxserver/prowlarr:version-2.3.0.5236
         volumeMounts:
           - name: config
             mountPath: /config

arr-stack/radarr/deployment.yaml

@@ -16,7 +16,7 @@ spec:
     spec:
       containers:
       - name: radarr
-        image: linuxserver/radarr:version-5.27.5.10198
+        image: linuxserver/radarr:version-6.0.4.10291
         volumeMounts:
           - name: config
             mountPath: /config

arr-stack/sonarr/deployment.yaml

@@ -16,7 +16,7 @@ spec:
     spec:
       containers:
       - name: sonarr
-        image: linuxserver/sonarr:4.0.15
+        image: linuxserver/sonarr:version-4.0.16.2944
         volumeMounts:
           - name: config
             mountPath: /config

arr-stack/tunnel/deployment.yaml

@@ -14,7 +14,7 @@ spec:
       containers:
       - name: deluge-tunnel
         image: kroniak/ssh-client:3.21
-        command: ["/bin/sh", "-c", "ssh -o StrictHostKeyChecking=no weyma-talos@45.152.211.243 -p 2222 -L 0.0.0.0:58846:127.0.0.1:58846 -L 0.0.0.0:8112:127.0.0.1:8112 -N"]
+        command: ["/bin/sh", "-c", "ssh -o StrictHostKeyChecking=no weyma-talos@184.107.106.14 -L 0.0.0.0:58846:127.0.0.1:58846 -L 0.0.0.0:8112:127.0.0.1:8112 -N"]
         volumeMounts:
           - name: ssh-keys
             mountPath: /root/.ssh

attic/cert-dubyatp-xyz.yaml

@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cert-dubyatp-xyz
-  annotations:
-    replicator.v1.mittwald.de/replicate-from: "cert-manager/cert-dubyatp-xyz"
-    replicator.v1.mittwald.de/replicated-keys: "tls.crt,tls.key"
-data:
-  tls.crt: ""
-  tls.key: ""

attic/db_auth.yaml

@@ -0,0 +1,24 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: attic-db-auth
+spec:
+  data:
+  - remoteRef:
+      conversionStrategy: Default
+      decodingStrategy: None
+      key: cloudnativepg
+      metadataPolicy: None
+      property: attic_pw
+    secretKey: password
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: weyma-vault
+  target:
+    template:
+      data:
+        ATTIC_SERVER_DATABASE_URL: "postgres://attic:{{ .password }}@pooler-weyma-rw.cloudnativepg.svc.cluster.local/attic"
+    creationPolicy: Owner
+    deletionPolicy: Retain
+    name: attic-db-auth

attic/deployment.yaml

@@ -3,7 +3,7 @@ kind: Deployment
 metadata:
   name: attic
 spec:
-  replicas: 1
+  replicas: 3
   selector:
     matchLabels:
       app: attic
@@ -18,6 +18,8 @@ spec:
         envFrom:
         - secretRef:
             name: attic-secret
+        - secretRef:
+            name: attic-db-auth
         - secretRef:
             name: attic-bucket
         volumeMounts:

attic/gateway.yaml

@@ -0,0 +1,18 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: traefik
+spec:
+  gatewayClassName: traefik
+  listeners:
+    - name: https
+      protocol: HTTPS
+      port: 8443
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - name: cert-dubyatp-xyz
+            namespace: cert-manager
+      allowedRoutes:
+        namespaces:
+          from: Same

attic/httproute.yaml

@@ -0,0 +1,19 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: attic
+spec:
+  parentRefs:
+    - name: traefik
+      sectionName: https
+      kind: Gateway
+  hostnames:
+    - nix-cache.dubyatp.xyz
+  rules:
+     - matches:
+        - path:
+            type: PathPrefix
+            value: /
+       backendRefs:
+        - name: attic-svc
+          port: 8080

authentik/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: authentik
-  version: 2026.2.0
+  version: 2026.5.6
   repository: https://charts.goauthentik.io

authentik/values.yaml

@@ -32,8 +32,10 @@ authentik:
           secretKeyRef:
             name: authentik-credentials
             key: authentik-secret-key
+      - name: AUTHENTIK_POSTGRESQL__DISABLE_SERVER_SIDE_CURSORS
+        value: "true"
       - name: AUTHENTIK_POSTGRESQL__HOST
-        value: pooler-weyma-rw.cloudnativepg.svc.cluster.local
+        value: pooler-weyma-rw-authentik.cloudnativepg.svc.cluster.local
       - name: AUTHENTIK_POSTGRESQL__NAME
         value: authentik
       - name: AUTHENTIK_POSTGRESQL__USER
@@ -58,7 +60,41 @@ authentik:
             key: smtp-password
       - name: AUTHENTIK_EMAIL__TIMEOUT
         value: "30"
+      - name: AUTHENTIK_STORAGE__BACKEND
+        value: "s3"
+      - name: AUTHENTIK_STORAGE__S3__ENDPOINT
+        value: "https://weyma-s3.infra.dubyatp.xyz"
+      - name: AUTHENTIK_STORAGE__S3__BUCKET_NAME
+        value: "authentik-files"
+      - name: AUTHENTIK_STORAGE__S3__ACCESS_KEY
+        valueFrom:
+          secretKeyRef:
+            name: authentik-files
+            key: AWS_ACCESS_KEY_ID
+      - name: AUTHENTIK_STORAGE__S3__SECRET_KEY
+        valueFrom:
+          secretKeyRef:
+            name: authentik-files
+            key: AWS_SECRET_ACCESS_KEY      
   additionalObjects:
+    - apiVersion: gateway.networking.k8s.io/v1
+      kind: Gateway
+      metadata:
+        name: traefik
+      spec:
+        gatewayClassName: traefik
+        listeners:
+          - name: https
+            protocol: HTTPS
+            port: 8443
+            tls:
+              mode: Terminate
+              certificateRefs:
+                - name: cert-dubyatp-xyz
+                  namespace: cert-manager
+            allowedRoutes:
+              namespaces:
+                from: Same
     - apiVersion: networking.k8s.io/v1
       kind: Ingress
       metadata:
@@ -145,4 +181,13 @@ authentik:
         target:
           creationPolicy: Owner
           deletionPolicy: Retain
-          name: authentik-db-auth
+          name: authentik-db-auth
+    - apiVersion: objectbucket.io/v1alpha1
+      kind: ObjectBucketClaim
+      metadata:
+        name: authentik-files
+      spec:
+        additionalConfig:
+          maxSize: 20Gi
+        bucketName: authentik-files
+        storageClassName: weyma-s3-bucket

gitea-runner/config.yaml

@@ -28,7 +28,7 @@ data:
     container:
       network: "host"
       privileged: false
-      options:
+      options: ""
       workdir_parent: /scratch
       valid_volumes:
         - /scratch/**

gitea-runner/statefulset.yaml

@@ -41,6 +41,8 @@ spec:
         image: gitea/act_runner:nightly-dind-rootless
         imagePullPolicy: Always
         env:
+          - name: DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS
+            value: "--net=slirp4netns --copy-up=/etc"
           - name: CONFIG_FILE
             value: /config/config.yaml
           - name: DOCKER_HOST

gitea/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: gitea
-  version: 12.5.5
+  version: 12.7.0
   repository: https://weyma-s3.infra.dubyatp.xyz/helm-bucket-ea34bc44-ef19-480d-a16a-1e583991f123/charts/

gitea/values.yaml

@@ -1,15 +1,27 @@
 gitea:
   replicaCount: 3
-  ingress:
-    enabled: true
-    hosts:
-      - host: git.dubyatp.xyz
-        paths:
-          - path: /
-    tls:
-      - secretName: cert-dubyatp-xyz
-        hosts:
-          - git.dubyatp.xyz
+#  ingress:
+#    enabled: true
+#    hosts:
+#      - host: git.dubyatp.xyz
+#        paths:
+#          - path: /
+#    tls:
+#      - secretName: cert-dubyatp-xyz
+#        hosts:
+#          - git.dubyatp.xyz
+  gateway:
+    httpRoute:
+      enabled: true
+      hostnames:
+        - git.dubyatp.xyz
+      parentRefs:
+        - name: traefik
+          sectionName: https
+          kind: Gateway
+      pathType: PathPrefix
+      paths:
+        - path: /
   persistence:
     enabled: true
     create: true
@@ -105,16 +117,24 @@ gitea:
           services:
           - name: gitea-ssh
             port: 22
-    - apiVersion: v1
-      kind: Secret
+    - apiVersion: gateway.networking.k8s.io/v1
+      kind: Gateway
       metadata:
-        name: cert-dubyatp-xyz
-        annotations:
-          replicator.v1.mittwald.de/replicate-from: "cert-manager/cert-dubyatp-xyz"
-          replicator.v1.mittwald.de/replicated-keys: "tls.crt,tls.key"
-      data:
-        tls.crt: ""
-        tls.key: ""
+        name: traefik
+      spec:
+        gatewayClassName: traefik
+        listeners:
+          - name: https
+            protocol: HTTPS
+            port: 8443
+            tls:
+              mode: Terminate
+              certificateRefs:
+                - name: cert-dubyatp-xyz
+                  namespace: cert-manager
+            allowedRoutes:
+              namespaces:
+                from: Same
     - apiVersion: external-secrets.io/v1
       kind: ExternalSecret
       metadata:

jellyfin/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: jellyfin
-  version: 2.7.0
+  version: 3.2.0
   repository: https://jellyfin.github.io/jellyfin-helm

jellyfin/templates/gateway.yaml

@@ -0,0 +1,18 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: traefik
+spec:
+  gatewayClassName: traefik
+  listeners:
+    - name: https
+      protocol: HTTPS
+      port: 8443
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - name: cert-dubyatp-xyz
+            namespace: cert-manager
+      allowedRoutes:
+        namespaces:
+          from: Same

jellyfin/templates/metrics-block.yaml

@@ -1,4 +1,4 @@
-{{- if and (.Values.jellyfin.metrics.enabled) (.Values.jellyfin.ingress.enabled) -}}
+{{- if and (.Values.jellyfin.metrics.enabled) (.Values.jellyfin.httpRoute.enabled) -}}
 ---
 apiVersion: v1
 kind: Service
@@ -13,21 +13,22 @@ spec:
       port: 6767
       targetPort: 6767
 ---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
 metadata:
   name: block-metrics
   namespace: {{ .Release.Namespace }}
 spec:
+  parentRefs:
+    {{- toYaml .Values.jellyfin.httpRoute.parentRefs | nindent 4 }}
+  hostnames:
+    {{- toYaml .Values.jellyfin.httpRoute.hostnames | nindent 4 }}
   rules:
-  - host: {{ (index .Values.jellyfin.ingress.hosts 0).host }}
-    http:
-      paths:
-      - pathType: Prefix
-        path: "/metrics"
-        backend:
-          service:
-            name: dummy-svc
-            port: 
-              number: 6767
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /metrics
+      backendRefs:
+        - name: dummy-svc
+          port: 6767
 {{- end }}

jellyfin/templates/ssl-cert.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-data:
-  tls.crt:
-  tls.key:
-kind: Secret
-metadata:
-  annotations:
-    replicator.v1.mittwald.de/replicate-from: cert-manager/cert-dubyatp-xyz
-    replicator.v1.mittwald.de/replicated-keys: tls.crt,tls.key
-  name: cert-dubyatp-xyz
-type: Opaque

jellyfin/values.yaml

@@ -1,17 +1,14 @@
 jellyfin:
   deploymentStrategy:
     type: Recreate
-  ingress:
+  httpRoute:
     enabled: true
-    hosts:
-      - host: jellyfin.dubyatp.xyz
-        paths:
-          - path: /
-            pathType: ImplementationSpecific
-    tls:
-      - secretName: cert-dubyatp.xyz
-        hosts:
-          - jellyfin.dubyatp.xyz
+    parentRefs:
+      - name: traefik
+        sectionName: https
+        kind: Gateway
+    hostnames:
+      - jellyfin.dubyatp.xyz
   persistence:
     config:
       size: 25Gi
@@ -26,10 +23,6 @@ jellyfin:
       nfs:
         server: 10.105.15.20
         path: /mnt/hdd-pool/movies
-    - name: dvr
-      nfs:
-        server: 10.105.15.20
-        path: /mnt/hdd-pool/DVR
     - name: youtube-vids
       nfs:
         server: 10.105.15.20
@@ -50,8 +43,6 @@ jellyfin:
       mountPath: /mnt/tv-shows
     - name: movies
       mountPath: /mnt/movies
-    - name: dvr
-      mountPath: /mnt/dvr
     - name: youtube-vids
       mountPath: /mnt/youtube-vids
     - name: transcode-temp

netmaker/statefulset.yaml

@@ -54,7 +54,7 @@ spec:
         envFrom:
           - configMapRef:
               name: netmaker-config
-        image: gravitl/netmaker:v1.4.0
+        image: gravitl/netmaker:v1.6.0
         imagePullPolicy: Always
         name: netmaker
         ports:

netmaker/ui/deployment.yaml

@@ -14,7 +14,7 @@ spec:
     spec:
       containers:
       - name: netmaker-ui
-        image: gravitl/netmaker-ui:v1.1.0
+        image: gravitl/netmaker-ui:v1.6.0
         env:
         - name: BACKEND_URL
           value: 'https://api.netmaker.infra.dubyatp.xyz'

searxng/Chart.yaml

@@ -0,0 +1,28 @@
+apiVersion: v2
+name: searxng
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+appVersion: "1.0"
+
+dependencies:
+- name: searxng
+  version: 1.1.4
+  repository: https://charts.kubito.dev

yt-dlp-bot/deployment.yaml

@@ -14,12 +14,14 @@ spec:
     spec:
       containers:
         - name: yt-dlp-bot
-          image: 'git.dubyatp.xyz/williamp/yt-dlp-bot:f688ee0'
+          image: 'git.dubyatp.xyz/williamp/yt-dlp-bot:f48776c'
           env:
             - name: OUT_PATH
               value: /data/youtube-vids
             - name: TEMP_PATH
               value: /tmp/ytdlp-temp
+            - name: LOADING_EMOJI
+              value: "<a:loading:1479485735076761848>"
           envFrom:
             - secretRef:
                 name: yt-dlp-discord-token