chore(deps): update helm release grafana to v10.5.6

2026-01-13 21:00:55 +00:00
37 changed files with 750 additions and 329 deletions
--- a/README.md
+++ b/README.md
@@ -1,29 +0,0 @@
-# Core Apps
-**Production-grade application deployments for my Kubernetes homelab**  
-
-This repository contains the core applications deployed to my Kubernetes homelab. Applications are deployed using either Kubernetes manifests or Helm charts (with upstream subcharts and custom values).
-
-**Why Helm?** I prefer Helm charts when upstream versions exist because Renovate can automatically track new chart versions, whereas image tags in raw manifests aren't always semantically versioned.
-
-**GitOps Workflow:** This repository is monitored by ArgoCD and serves as the source of truth for deployments. Each top-level directory is its own ArgoCD Application, with subdirectories representing components within that application.
-
-**Automated Commits:** Apps that I wrote/maintain directly (such as yt-dlp-bot and zap2xml) get their manifests automatically updated via an Actions workflow in their respective repositories
-
- `arr-stack/` - Arr Stack (manifests)
-    - `flaresolverr/` - Flaresolverr (captcha processor)
-    - `prowlarr/` - Prowlarr (indexer manager)
-    - `radarr/` - Radarr (movie media manager)
-    - `sonarr/` - Sonarr (TV series media manager)
-    - `tunnel/` - Custom SSH tunnel to my seedbox to securely communicate with Deluge
- `attic/` - Attic NixOS cache server (manifests)
- `authentik/` - [Authentik](https://auth.dubyatp.xyz) SSO server (Helm chart)
- `gitea/` - [Gitea](https://git.dubyatp.xyz) Git Server (Helm chart)
- `gitea-runner/` - Gitea Runner (manifests)
-    - `buildkitd/` - Docker Buildkitd build environment
- `grafana/` - [Grafana](https://grafana.dubyatp.xyz) observability dashboard (Helm chart)
- `jellyfin/` - [Jellyfin](https://jellyfin.dubyatp.xyz) media server (Helm chart)
- `renovate/` - [Renovate](https://git.dubyatp.xyz/renovate-bot) automated dependency manager (manifests)
- `vaultwarden/` - [Vaultwarden](https://vaultwarden.dubyatp.xyz) password manager (manifests)
- `whatismyip/` - [Simple "what is my IP" HTTP service](https://whatismyip.dubyatp.xyz) (manifests)
- `yt-dlp-bot/` - [yt-dlp bot](https://git.dubyatp.xyz/williamp/yt-dlp-bot) (manifests); a custom Discord bot i created for downloading and storing YouTube videos ad-hoc
- `zap2xml/` - [kube-zap2xml](https://git.dubyatp.xyz/williamp/kube-zap2xml) (manifests); modified version of zap2xml (zap2it TV listings scraper) designed for use as Kubernetes jobs and sends the result XMLTV format to a Rook-Ceph S3 bucket
--- a/attic/bucket.yaml
+++ b/attic/bucket.yaml
@@ -1,10 +0,0 @@
-apiVersion: objectbucket.io/v1alpha1
-kind: ObjectBucketClaim
-metadata:
-  name: attic-bucket
-  namespace: attic
-spec:
-  additionalConfig:
-    maxSize: 100Gi
-  bucketName: attic-bucket
-  storageClassName: weyma-s3-bucket
--- a/attic/config.yaml
+++ b/attic/config.yaml
@@ -1,36 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: attic-config
-data:
-  server.toml: |
-    listen = "[::]:8080"
-    allowed-hosts = []
-
-    #api-endpoint = "https://nix-cache.dubyatp.xyz/"
-
-    [database]
-    url = "sqlite:///var/empty/.local/share/attic/server.db"
-
-    [storage]
-    path = "/data/.local/share/attic/storage"
-    type = "local"
-    #region = "us-east-1"
-    #bucket = "attic-bucket"
-    #endpoint = "https://weyma-s3.infra.dubyatp.xyz"
-
-    [chunking]
-    nar-size-threshold = 65536
-    min-size = 16384
-    avg-size = 65536
-    max-size = 262144
-
-    [compression]
-    type = "zstd"
-
-    [garbage-collection]
-    interval = "12 hours"
-
-    [jwt]
-
-    [jwt.signing]
--- a/attic/deployment.yaml
+++ b/attic/deployment.yaml
@@ -3,7 +3,6 @@ kind: Deployment
 metadata:
  name: attic
 spec:
-  replicas: 1
  selector:
    matchLabels:
      app: attic
@@ -14,24 +13,17 @@ spec:
    spec:
      containers:
      - name: attic
-        image: ghcr.io/zhaofengli/attic:c4ffb5e86e928572e867bd3f81545293313e0a08
+        image: ghcr.io/zhaofengli/attic:ff8a897d1f4408ebbf4d45fa9049c06b3e1e3f4e
        envFrom:
        - secretRef:
            name: attic-secret
-        - secretRef:
-            name: attic-bucket
        volumeMounts:
        - name: attic-pvc
-          mountPath: /var/empty/
+          mountPath: /var/empty
        resources:
          limits:
            memory: "2Gi"
            cpu: "500m"
-      - name: multitool
-        image: wbitt/network-multitool
-        volumeMounts:
-        - name: attic-pvc
-          mountPath: /var/empty/
      volumes:
      - name: attic-pvc
        persistentVolumeClaim:
--- a/authentik/Chart.yaml
+++ b/authentik/Chart.yaml
@@ -24,5 +24,5 @@ appVersion: "1.0"

 dependencies:
 - name: authentik
-  version: 2026.2.0
+  version: 2025.10.3
  repository: https://charts.goauthentik.io
--- a/authentik/values.yaml
+++ b/authentik/values.yaml
@@ -15,35 +15,6 @@ authentik:
      service:
        labels:
          metrics_enabled: "true"
-    livenessProbe:
-      failureThreshold: 3      
-      initialDelaySeconds: 5
-      periodSeconds: 10
-      successThreshold: 1
-      timeoutSeconds: 10       
-      httpGet:
-        path: "{{ .Values.authentik.web.path }}-/health/live/"
-        port: http
-
-    readinessProbe:
-      failureThreshold: 3      
-      initialDelaySeconds: 5
-      periodSeconds: 10
-      successThreshold: 1
-      timeoutSeconds: 10       
-      httpGet:
-        path: "{{ .Values.authentik.web.path }}-/health/ready/"
-        port: http
-
-    startupProbe:
-      failureThreshold: 60     
-      initialDelaySeconds: 5
-      periodSeconds: 10
-      successThreshold: 1
-      timeoutSeconds: 10       
-      httpGet:
-        path: "{{ .Values.authentik.web.path }}-/health/live/"
-        port: http
  worker:
    replicas: 3
    volumeMounts:
@@ -61,10 +32,8 @@ authentik:
          secretKeyRef:
            name: authentik-credentials
            key: authentik-secret-key
-      - name: AUTHENTIK_POSTGRESQL__DISABLE_SERVER_SIDE_CURSORS
-        value: "true"
      - name: AUTHENTIK_POSTGRESQL__HOST
-        value: pooler-weyma-rw-authentik.cloudnativepg.svc.cluster.local
+        value: pooler-weyma-rw.cloudnativepg.svc.cluster.local
      - name: AUTHENTIK_POSTGRESQL__NAME
        value: authentik
      - name: AUTHENTIK_POSTGRESQL__USER
@@ -89,22 +58,6 @@ authentik:
            key: smtp-password
      - name: AUTHENTIK_EMAIL__TIMEOUT
        value: "30"
-      - name: AUTHENTIK_STORAGE__BACKEND
-        value: "s3"
-      - name: AUTHENTIK_STORAGE__S3__ENDPOINT
-        value: "https://weyma-s3.infra.dubyatp.xyz"
-      - name: AUTHENTIK_STORAGE__S3__BUCKET_NAME
-        value: "authentik-files"
-      - name: AUTHENTIK_STORAGE__S3__ACCESS_KEY
-        valueFrom:
-          secretKeyRef:
-            name: authentik-files
-            key: AWS_ACCESS_KEY_ID
-      - name: AUTHENTIK_STORAGE__S3__SECRET_KEY
-        valueFrom:
-          secretKeyRef:
-            name: authentik-files
-            key: AWS_SECRET_ACCESS_KEY      
  additionalObjects:
    - apiVersion: networking.k8s.io/v1
      kind: Ingress
@@ -193,12 +146,3 @@ authentik:
          creationPolicy: Owner
          deletionPolicy: Retain
          name: authentik-db-auth
-    - apiVersion: objectbucket.io/v1alpha1
-      kind: ObjectBucketClaim
-      metadata:
-        name: authentik-files
-      spec:
-        additionalConfig:
-          maxSize: 20Gi
-        bucketName: authentik-files
-        storageClassName: weyma-s3-bucket
--- a/dispatcharr/deployment.yaml
+++ b/dispatcharr/deployment.yaml
@@ -0,0 +1,61 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dispatcharr
+spec:
+  selector:
+    matchLabels:
+      app: dispatcharr
+  template:
+    metadata:
+      labels:
+        app: dispatcharr
+      annotations:
+        backup.velero.io/backup-volumes: data
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: extensions.talos.dev/i915
+                operator: Exists
+      nodeSelector:
+        kubernetes.io/hostname: weyma-talos-testw04
+      containers:
+      - name: dispatcharr
+        image: ghcr.io/dispatcharr/dispatcharr:0.8.0-amd64
+        env:
+          - name: DISPATCHARR_ENV
+            value: aio
+          - name: REDIS_HOST
+            value: localhost
+          - name: CELERY_BROKER_URL
+            value: redis://localhost:6379/0
+          - name: DISPATCHARR_LOG_LEVEL
+            value: info
+          - name: UWSGI_NICE_LEVEL
+            value: "-5"
+          - name: CELERY_NICE_LEVEL
+            value: "-5"
+        volumeMounts:
+          - name: dispatcharr-data
+            mountPath: /data
+          - name: dev-dri
+            mountPath: /dev/dri
+        resources:
+          limits:
+            memory: "3Gi"
+            cpu: "1"
+          requests:
+            memory: "256Mi"
+            cpu: "500m"
+        securityContext:
+          privileged: true
+      volumes:
+        - name: dispatcharr-data
+          persistentVolumeClaim:
+            claimName: dispatcharr
+        - name: dev-dri
+          hostPath:
+            path: /dev/dri
--- a/dispatcharr/ingress.yaml
+++ b/dispatcharr/ingress.yaml
@@ -0,0 +1,18 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dispatcharr
+  labels:
+    app.kubernetes.io/name: dispatcharr
+spec:
+  rules:
+  - host: dispatcharr.dubyatp.xyz
+    http:
+      paths:
+      - pathType: Prefix
+        path: "/"
+        backend:
+          service:
+            name: dispatcharr-svc
+            port: 
+              number: 9191
--- a/dispatcharr/pvc.yaml
+++ b/dispatcharr/pvc.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: dispatcharr
+spec:
+  resources:
+    requests:
+      storage: 20Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
--- a/dispatcharr/svc.yaml
+++ b/dispatcharr/svc.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: dispatcharr-svc
+spec:
+  selector:
+    app: dispatcharr
+  ports:
+  - port: 9191
+    targetPort: 9191
--- a/gitea-runner/buildkitd/deployment.yaml
+++ b/gitea-runner/buildkitd/deployment.yaml
@@ -1,40 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: buildkitd
-  namespace: gitea-runner
-spec:
-  progressDeadlineSeconds: 600
-  replicas: 3
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      app: buildkitd
-  strategy:
-    rollingUpdate:
-      maxSurge: 25%
-      maxUnavailable: 25%
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: buildkitd
-    spec:
-      containers:
-      - args:
-        - --addr
-        - tcp://0.0.0.0:1234
-        image: moby/buildkit:v0.27.1
-        imagePullPolicy: Always
-        name: buildkitd
-        ports:
-        - containerPort: 1234
-          protocol: TCP
-        securityContext:
-          privileged: true
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      terminationGracePeriodSeconds: 30
--- a/gitea-runner/buildkitd/svc.yaml
+++ b/gitea-runner/buildkitd/svc.yaml
@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: buildkitd
-  namespace: gitea-runner
-spec:
-  internalTrafficPolicy: Cluster
-  ipFamilies:
-  - IPv4
-  ipFamilyPolicy: SingleStack
-  ports:
-  - port: 1234
-  selector:
-    app: buildkitd
--- a/gitea-runner/config.yaml
+++ b/gitea-runner/config.yaml
@@ -1,41 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: runner-config
-data:
-  config.yaml: |-
-    log:
-      level: info
-    runner:
-      file: /data/.runner
-      capacity: 1
-      env_file: .env
-      timeout: 3h
-      shutdown_timeout: 0s
-      insecure: false
-      fetch_timeout: 5s
-      fetch_interval: 2s
-      labels:
-        - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
-        - "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
-        - "ubuntu-20.04:docker://docker.gitea.com/runner-images:ubuntu-20.04"
-    cache:
-      enabled: true
-      dir: ""
-      host: ""
-      port: 0
-      external_server: ""
-    container:
-      network: "host"
-      privileged: false
-      options:
-      workdir_parent: /scratch
-      valid_volumes:
-        - /scratch/**
-      docker_host: ""
-      force_pull: true
-      force_rebuild: false
-      require_docker: false
-      docker_timeout: 0s
-    host:
-      workdir_parent:
--- a/gitea-runner/deployment.yaml
+++ b/gitea-runner/deployment.yaml
@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    deployment.kubernetes.io/revision: "4"
+  labels:
+    app: act-runner
+  name: act-runner
+  namespace: gitea-runner
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: act-runner
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: act-runner
+    spec:
+      containers:
+      - command:
+        - sh
+        - -c
+        - while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...';
+          sleep 5; done; /sbin/tini -- run.sh
+        env:
+        - name: DOCKER_HOST
+          value: tcp://localhost:2376
+        - name: DOCKER_CERT_PATH
+          value: /certs/client
+        - name: DOCKER_TLS_VERIFY
+          value: "1"
+        - name: GITEA_INSTANCE_URL
+          value: https://git.dubyatp.xyz
+        - name: GITEA_RUNNER_REGISTRATION_TOKEN
+          valueFrom:
+            secretKeyRef:
+              key: token
+              name: runner-secret
+        image: gitea/act_runner:nightly
+        imagePullPolicy: Always
+        name: runner
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: docker-certs
+        - mountPath: /data
+          name: runner-data
+      - env:
+        - name: DOCKER_TLS_CERTDIR
+          value: /certs
+        image: docker:23.0.6-dind
+        imagePullPolicy: IfNotPresent
+        name: daemon
+        securityContext:
+          privileged: true
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: docker-certs
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - name: docker-certs
+      - name: runner-data
+        persistentVolumeClaim:
+          claimName: act-runner-vol
--- a/gitea-runner/pvc.yaml
+++ b/gitea-runner/pvc.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: gitea-runner-pvc
+spec:
+  resources:
+    requests:
+      storage: 1Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: weyma-shared
--- a/gitea-runner/statefulset.yaml
+++ b/gitea-runner/statefulset.yaml
@@ -1,86 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: act-runner
-  namespace: gitea-runner
-  labels:
-    app: act-runner
-spec:
-  serviceName: ""
-  selector:
-    matchLabels:
-      app: act-runner
-  replicas: 3
-  template:
-    metadata:
-      labels:
-        app: act-runner
-    spec:
-      initContainers:
-      - name: sysctl
-        image: busybox
-        securityContext:
-          privileged: true
-        command:
-          - sh
-          - -c
-          - echo 28633 > /proc/sys/user/max_user_namespaces
-      - name: chown-data
-        image: busybox
-        securityContext:
-          runAsUser: 0
-        command:
-          - sh
-          - -c
-          - chown -R 1000:1000 /data
-        volumeMounts:
-        - name: runner-data
-          mountPath: /data
-      containers:
-      - name: runner
-        image: gitea/act_runner:nightly-dind-rootless
-        imagePullPolicy: Always
-        env:
-          - name: CONFIG_FILE
-            value: /config/config.yaml
-          - name: DOCKER_HOST
-            value: unix:///run/user/1000/docker.sock
-          - name: GITEA_INSTANCE_URL
-            value: https://git.dubyatp.xyz
-          - name: GITEA_RUNNER_REGISTRATION_TOKEN
-            valueFrom:
-              secretKeyRef:
-                key: registration-token
-                name: gitea-runner-token
-        securityContext:
-          privileged: true
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-        volumeMounts:
-        - name: runner-config
-          mountPath: /config
-        - name: runner-data
-          mountPath: /data
-        - name: runner-scratch
-          mountPath: /scratch
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      terminationGracePeriodSeconds: 30
-      volumes:
-        - name: runner-scratch
-          emptyDir:
-            medium: Memory
-            sizeLimit: 5Gi
-        - name: runner-config
-          configMap:
-            name: runner-config
-  volumeClaimTemplates:
-  - metadata:
-      name: runner-data
-    spec:
-      accessModes: [ "ReadWriteOnce" ]
-      storageClassName: weyma-shared
-      resources:
-        requests:
-          storage: 32Gi
--- a/gitea/Chart.yaml
+++ b/gitea/Chart.yaml
@@ -24,5 +24,5 @@ appVersion: "1.0"

 dependencies:
 - name: gitea
-  version: 12.5.6
+  version: 12.5.1
  repository: https://weyma-s3.infra.dubyatp.xyz/helm-bucket-ea34bc44-ef19-480d-a16a-1e583991f123/charts/
--- a/grafana/Chart.yaml
+++ b/grafana/Chart.yaml
@@ -24,5 +24,5 @@ appVersion: "1.0"

 dependencies:
 - name: grafana
-  version: 10.5.15
+  version: 10.5.6
  repository: https://grafana.github.io/helm-charts
--- a/immich/immich-config.yaml
+++ b/immich/immich-config.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: immich-config
+data:
+  immich-config.yaml: |
+    trash:
+      enabled: true
+      days: 30    
--- a/immich/immich-ingress.yaml
+++ b/immich/immich-ingress.yaml
@@ -0,0 +1,22 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: immich
+  labels:
+    name: immich
+spec:
+  rules:
+  - host: immich.dubyatp.xyz
+    http:
+      paths:
+      - pathType: Prefix
+        path: "/"
+        backend:
+          service:
+            name: immich
+            port: 
+              number: 2283
+  tls:
+    - secretName: cert-dubyatp-xyz
+      hosts:
+        - immich.dubyatp.xyz
--- a/immich/immich-library-pvc.yaml
+++ b/immich/immich-library-pvc.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: immich-library
+spec:
+  resources:
+    requests:
+      storage: 50Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
--- a/immich/immich-ml-deployment.yaml
+++ b/immich/immich-ml-deployment.yaml
@@ -0,0 +1,94 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: immich-ml
+spec:
+  selector:
+    matchLabels:
+      app: immich-ml
+  template:
+    metadata:
+      labels:
+        app: immich-ml
+    spec:
+      containers:
+      - name: immich-ml
+        image: ghcr.io/immich-app/immich-machine-learning:v1.134.0
+        volumeMounts:
+          - name: model-cache
+            mountPath: /cache
+          - name: config
+            mountPath: /config/immich-config.yaml
+          - name: dev-dri
+            mountPath: /dev/dri
+        env:
+          - name: DB_HOSTNAME
+            value: "immich-rw.cloudnativepg.svc.cluster.local"
+          - name: DB_DATABASE_NAME
+            value: "immich"
+          - name: DB_USERNAME
+            valueFrom:
+              secretKeyRef:
+                key: username
+                name: postgres-credentials
+          - name: DB_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                key: password
+                name: postgres-credentials
+          - name: REDIS_HOSTNAME
+            value: redis
+          - name: REDIS_PORT
+            value: "6379"
+          - name: IMMICH_PORT
+            value: "3003"
+        livenessProbe:
+          httpGet:
+            path: /ping
+            port: 3003
+          initialDelaySeconds: 0
+          periodSeconds: 10
+          timeoutSeconds: 1
+          failureThreshold: 3
+        readinessProbe:
+          httpGet:
+            path: /ping
+            port: 3003
+          initialDelaySeconds: 0
+          periodSeconds: 10
+          timeoutSeconds: 1
+          failureThreshold: 3
+        startupProbe:
+          httpGet:
+            path: /ping
+            port: 3003
+          initialDelaySeconds: 0
+          periodSeconds: 10
+          timeoutSeconds: 1
+          failureThreshold: 30
+        securityContext:
+          privileged: true
+        resources:
+          limits:
+            memory: "8Gi"
+            cpu: "2"
+          requests:
+            memory: "2Gi"
+            cpu: "500m"
+      volumes:
+        - name: model-cache
+          emptyDir:
+            sizeLimit: 10Gi
+        - name: config
+          configMap:
+            name: immich-config
+        - name: dev-dri
+          hostPath:
+            path: /dev/dri
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: extensions.talos.dev/i915
+                operator: Exists
--- a/immich/immich-postgres-credentials.yaml
+++ b/immich/immich-postgres-credentials.yaml
@@ -0,0 +1,25 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: postgres-credentials
+spec:
+  data:
+  - remoteRef:
+      conversionStrategy: Default
+      decodingStrategy: None
+      key: cloudnativepg
+      metadataPolicy: None
+      property: immich_pw
+    secretKey: password
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: weyma-vault
+  target:
+    template:
+      data:
+        username: immich
+        password: "{{ .password }}"
+    creationPolicy: Owner
+    deletionPolicy: Retain
+    name: postgres-credentials
--- a/immich/immich-server_deployment.yaml
+++ b/immich/immich-server_deployment.yaml
@@ -0,0 +1,94 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: immich-server
+spec:
+  selector:
+    matchLabels:
+      app: immich-server
+  template:
+    metadata:
+      labels:
+        app: immich-server
+    spec:
+      containers:
+      - name: immich-server
+        image: ghcr.io/immich-app/immich-server:v1.134.0
+        volumeMounts:
+          - name: library
+            mountPath: /usr/src/app/upload
+          - name: config
+            mountPath: /config/immich-config.yaml
+          - name: dev-dri
+            mountPath: /dev/dri
+        env:
+          - name: DB_HOSTNAME
+            value: "immich-rw.cloudnativepg.svc.cluster.local"
+          - name: DB_DATABASE_NAME
+            value: "immich"
+          - name: DB_USERNAME
+            valueFrom:
+              secretKeyRef:
+                key: username
+                name: postgres-credentials
+          - name: DB_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                key: password
+                name: postgres-credentials
+          - name: REDIS_HOSTNAME
+            value: redis
+          - name: REDIS_PORT
+            value: "6379"
+          - name: IMMICH_PORT
+            value: "2283"
+        livenessProbe:
+          httpGet:
+            path: /api/server/ping
+            port: 2283
+          initialDelaySeconds: 0
+          periodSeconds: 10
+          timeoutSeconds: 1
+          failureThreshold: 3
+        readinessProbe:
+          httpGet:
+            path: /api/server/ping
+            port: 2283
+          initialDelaySeconds: 0
+          periodSeconds: 10
+          timeoutSeconds: 1
+          failureThreshold: 3
+        startupProbe:
+          httpGet:
+            path: /api/server/ping
+            port: 2283
+          initialDelaySeconds: 0
+          periodSeconds: 10
+          timeoutSeconds: 1
+          failureThreshold: 30
+        securityContext:
+          privileged: true
+        resources:
+          limits:
+            memory: "8Gi"
+            cpu: "2"
+          requests:
+            memory: "2Gi"
+            cpu: "500m"
+      volumes:
+        - name: library
+          persistentVolumeClaim:
+            claimName: immich-library
+        - name: config
+          configMap:
+            name: immich-config
+        - name: dev-dri
+          hostPath:
+            path: /dev/dri
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: extensions.talos.dev/i915
+                operator: Exists
--- a/immich/immich-svc.yaml
+++ b/immich/immich-svc.yaml
@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: immich
+spec:
+  selector:
+    app: immich-server
+  ports:
+  - port: 2283
+    targetPort: 2283
+    name: http
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: immich-ml
+spec:
+  selector:
+    app: immich-ml
+  ports:
+  - port: 3003
+    targetPort: 3003
+    name: http
--- a/immich/redis/redis-statefulset.yaml
+++ b/immich/redis/redis-statefulset.yaml
@@ -0,0 +1,38 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: redis
+spec:
+  selector:
+    matchLabels:
+      app: redis
+  serviceName: redis
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+      - name: redis
+        image: redis:latest
+        command: ["redis-server"]
+        args:
+          - "--port"
+          - "6379"
+          - "--dir"
+          - "/data"
+          - "--appendonly"
+          - "yes"
+        volumeMounts:
+        - name: data
+          mountPath: /data
+  volumeClaimTemplates:
+  - spec:
+      accessModes: [ "ReadWriteOnce" ]
+      storageClassName: rook-ceph-block
+      resources:
+        requests:
+          storage: 10Gi
+    metadata:
+      name: data
--- a/immich/redis/redis-svc.yaml
+++ b/immich/redis/redis-svc.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+spec:
+  selector:
+    app: redis
+  ports:
+  - port: 6379
+    targetPort: 6379
--- a/peertube/bucket.yaml
+++ b/peertube/bucket.yaml
@@ -0,0 +1,10 @@
+apiVersion: objectbucket.io/v1alpha1
+kind: ObjectBucketClaim
+metadata:
+  name: peertube-bucket
+  namespace: peertube
+spec:
+  generateBucketName: peertube
+  storageClassName: weyma-s3-bucket
+  additionalConfig:
+    maxSize: "100Gi"
--- a/peertube/config.yaml
+++ b/peertube/config.yaml
@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: peertube-config
+data:
+  PEERTUBE_INSTANCE_NAME: "dubyatp peertube"
+  PEERTUBE_INSTANCE_DESCRIPTION: "duby's peertube instance"
+  POSTGRES_USER: peertube
+  POSTGRES_DB: peertube
+  PEERTUBE_DB_USERNAME: peertube
+  PEERTUBE_DB_HOSTNAME: pooler-weyma-rw.cloudnativepg.svc.cluster.local
+  PEERTUBE_DB_PORT: "5432"
+  PEERTUBE_WEBSERVER_HOSTNAME: "tube.dubyatp.xyz"
+  PEERTUBE_TRUST_PROXY: '["127.0.0.1", "loopback", "172.18.0.0/16"]'
+  PEERTUBE_SMTP_USERNAME: "peertube_dubyatp"
+  PEERTUBE_SMTP_HOSTNAME: "mail.smtp2go.com"
+  PEERTUBE_SMTP_PORT: "465"
+  PEERTUBE_SMTP_TLS: "true"
+  PEERTUBE_SMTP_FROM: "peertube@em924671.dubyatp.xyz"
+  PEERTUBE_ADMIN_EMAIL: "me@williamtpeebles.com"
+  #PEERTUBE_OBJECT_STORAGE_ENABLED: "true"
+  #PEERTUBE_OBJECT_STORAGE_ENDPOINT: "https://weyma-s3.infra.dubyatp.xyz"
+  #PEERTUBE_OBJECT_STORAGE_REGION: ""
+  #PEERTUBE_OBJECT_STORAGE_STREAMING_PLAYLISTS_BUCKET_NAME: "peertube-953221d2-7649-48b2-b79f-5a9e59daedbb"
+  #PEERTUBE_OBJECT_STORAGE_STREAMING_PLAYLISTS_PREFIX: "streaming/"
+  #PEERTUBE_OBJECT_STORAGE_WEB_VIDEOS_BUCKET_NAME: "peertube-953221d2-7649-48b2-b79f-5a9e59daedbb"
+  #PEERTUBE_OBJECT_STORAGE_WEB_VIDEOS_PREFIX: "videos/"
+  #PEERTUBE_OBJECT_STORAGE_USER_EXPORTS_BUCKET_NAME: "peertube-953221d2-7649-48b2-b79f-5a9e59daedbb"
+  #PEERTUBE_OBJECT_STORAGE_USER_EXPORTS_PREFIX: "exports/"
+  #PEERTUBE_OBJECT_STORAGE_ORIGINAL_VIDEO_FILES_BUCKET_NAME: "peertube-953221d2-7649-48b2-b79f-5a9e59daedbb"
+  #PEERTUBE_OBJECT_STORAGE_ORIGINAL_VIDEO_FILES_PREFIX: "original-videos/"
+  #PEERTUBE_OBJECT_STORAGE_CAPTIONS_BUCKET_NAME: "peertube-953221d2-7649-48b2-b79f-5a9e59daedbb"
+  #PEERTUBE_OBJECT_STORAGE_CAPTIONS_PREFIX: "captions/"
+  #PEERTUBE_OBJECT_STORAGE_UPLOAD_ACL_PUBLIC: "public-read"
+  #PEERTUBE_OBJECT_STORAGE_UPLOAD_ACL_PRIVATE: "private"
--- a/peertube/deployment.yaml
+++ b/peertube/deployment.yaml
@@ -0,0 +1,69 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: peertube
+  labels:
+    app: peertube
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: peertube
+  template:
+    metadata:
+      labels:
+        app: peertube
+    spec:
+      containers:
+        - name: peertube
+          image: chocobozzz/peertube:v7.2.3-bookworm
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 80
+              name: http
+            - containerPort: 443
+              name: https
+            - containerPort: 9000
+              name: peertube
+            - containerPort: 1935
+              name: rtmp
+          envFrom:
+            - secretRef:
+                name: peertube-secret
+            - secretRef:
+                name: peertube-bucket
+            - configMapRef:
+                name: peertube-config
+          env:
+            - name: PEERTUBE_REDIS_HOSTNAME
+              value: "localhost"
+            - name: PEERTUBE_REDIS_AUTH
+              value: ""
+          volumeMounts:
+            - name: peertube-data
+              mountPath: /data
+          resources:
+            requests:
+              cpu: "0.5"
+              memory: 1Gi
+            limits:
+              cpu: "1"
+              memory: 2Gi
+        - name: redis
+          image: redis:8.2.1-alpine
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 6379
+              name: redis
+          resources:
+            requests:
+              cpu: "0.2"
+              memory: 256Mi
+            limits:
+              cpu: "0.5"
+              memory: 1Gi
+      volumes:
+        - name: peertube-data
+          persistentVolumeClaim:
+            claimName: peertube-data
+
--- a/peertube/ingress.yaml
+++ b/peertube/ingress.yaml
@@ -0,0 +1,18 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: peertube
+  labels:
+    app.kubernetes.io/name: peertube
+spec:
+  rules:
+  - host: tube.dubyatp.xyz
+    http:
+      paths:
+      - pathType: Prefix
+        path: "/"
+        backend:
+          service:
+            name: peertube
+            port: 
+              number: 9000
--- a/peertube/pvc.yaml
+++ b/peertube/pvc.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: peertube-data
+spec:
+  accessModes: 
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 50Gi
--- a/peertube/secret.yaml
+++ b/peertube/secret.yaml
@@ -0,0 +1,42 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: peertube-secret
+spec:
+  data:
+  - remoteRef:
+      conversionStrategy: Default
+      decodingStrategy: None
+      key: peertube
+      metadataPolicy: None
+      property: PEERTUBE_SECRET
+    secretKey: PEERTUBE_SECRET
+  - remoteRef:
+      conversionStrategy: Default
+      decodingStrategy: None
+      key: peertube
+      metadataPolicy: None
+      property: PEERTUBE_DB_PASSWORD
+    secretKey: PEERTUBE_DB_PASSWORD
+  - remoteRef:
+      conversionStrategy: Default
+      decodingStrategy: None
+      key: peertube
+      metadataPolicy: None
+      property: PEERTUBE_SMTP_PASSWORD
+    secretKey: PEERTUBE_SMTP_PASSWORD
+  - remoteRef:
+      conversionStrategy: Default
+      decodingStrategy: None
+      key: peertube
+      metadataPolicy: None
+      property: POSTGRES_PASSWORD
+    secretKey: POSTGRES_PASSWORD
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: weyma-vault
+  target:
+    creationPolicy: Owner
+    deletionPolicy: Retain
+    name: peertube-secret
--- a/peertube/service.yaml
+++ b/peertube/service.yaml
@@ -0,0 +1,24 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: peertube
+spec:
+  selector:
+    app: peertube
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 80
+      name: http
+    - protocol: TCP
+      port: 25
+      targetPort: 25
+      name: smtp
+    - protocol: TCP
+      port: 9000
+      targetPort: 9000
+      name: peertube
+    - protocol: TCP
+      name: rtmp
+      port: 1935
+      targetPort: 1935
--- a/peertube/valkey.yaml
+++ b/peertube/valkey.yaml
@@ -0,0 +1,16 @@
+apiVersion: hyperspike.io/v1
+kind: Valkey
+metadata:
+  name: peertube-kv
+  labels:
+    app.kubernetes.io/instance: peertube
+spec:
+  anonymousAuth: true
+  certIssuerType: ClusterIssuer
+  clusterDomain: cluster.local
+  clusterPreferredEndpointType: ip
+  nodes: 1
+  prometheus: false
+  replicas: 3
+  tls: false
+  volumePermissions: true
--- a/vaultwarden/deployment.yaml
+++ b/vaultwarden/deployment.yaml
@@ -17,7 +17,7 @@ spec:
    spec:
      containers:
      - name: vaultwarden
-        image: vaultwarden/server:1.35.2-alpine
+        image: vaultwarden/server:1.33.2-alpine
        livenessProbe:
          exec:
            command:
--- a/yt-dlp-bot/deployment.yaml
+++ b/yt-dlp-bot/deployment.yaml
@@ -14,7 +14,7 @@ spec:
    spec:
      containers:
        - name: yt-dlp-bot
-          image: 'git.dubyatp.xyz/williamp/yt-dlp-bot:b9088d9'
+          image: 'git.dubyatp.xyz/williamp/yt-dlp-bot:174ce12'
          env:
            - name: OUT_PATH
              value: /data/youtube-vids