Update .gitea/workflows/renovate.yml

Reviewed-on: #375

.gitea/workflows/renovate.yml

@@ -1,22 +1,25 @@
-name: Renovate
+name: renovate
 
 on:
   schedule:
-    - cron: '@daily'
+    - cron: "@daily"
   workflow_dispatch:
 
 jobs:
   renovate:
     runs-on: ubuntu-latest
+    container:
+      image: renovate/renovate:41.97.7
+      options: |-
+        --network=bridge
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
       - name: Run Renovate
-        uses: docker://renovate/renovate:41.97.7
         env:
-          LOG_LEVEL: info
           RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
           GITHUB_COM_TOKEN: ${{ secrets.PAT_TOKEN }}
-        with:
-          args: ''
+        run: |
+          renovate

cluster/apps/bazarr/bazarr-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: bazarr-ceph
+  name: bazarr-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 5Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

cluster/apps/bazarr/bazarr.yml

@@ -5,7 +5,7 @@ metadata:
   name: bazarr
   namespace: default
 spec:
-  stratergy:
+  strategy:
     type: Recreate
   replicas: 1
   selector:
@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: bazarr
-        image: linuxserver/bazarr:1.5.2
+        image: linuxserver/bazarr:1.5.3
         ports:
         - containerPort: 6767
         env:
@@ -38,7 +38,7 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: bazarr-ceph
+          claimName: bazarr-longhorn
       - name: tv
         nfs:
           server: 10.0.0.123

cluster/apps/code-server/code-server-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: code-server-ceph
+  name: code-server-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

cluster/apps/code-server/code-server-svc.yml

@@ -9,6 +9,6 @@ spec:
     app: code-server
   type: LoadBalancer
   ports:
-  - port: 8443
+  - port: 8448
     targetPort: 8443
     protocol: TCP

cluster/apps/code-server/code-server.yml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: code-server
-        image: lscr.io/linuxserver/code-server:4.103.2
+        image: lscr.io/linuxserver/code-server:4.104.3
         ports:
         - containerPort: 8443
         env:
@@ -46,4 +46,4 @@ spec:
       volumes:
       - name: code-server
         persistentVolumeClaim:
-          claimName: code-server-ceph
+          claimName: code-server-longhorn

cluster/apps/ersatztv/ersatztv-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: ersatztv-ceph
+  name: ersatztv-longhorn
   namespace: default
 spec:
   accessModes:
@@ -10,5 +10,5 @@ spec:
   volumeMode: Filesystem
   resources:
     requests:
-      storage: 1Gi
-  storageClassName: csi-rbd-sc
+      storage: 5Gi
+  storageClassName: longhorn

cluster/apps/ersatztv/ersatztv.yml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: ersatztv
-        image: jasongdove/ersatztv:v25.5.0
+        image: jasongdove/ersatztv:v25.7.1
         ports:
         - containerPort: 8409
         volumeMounts:
@@ -40,7 +40,7 @@ spec:
       volumes:
       - name: data
         persistentVolumeClaim:
-          claimName: ersatztv-ceph
+          claimName: ersatztv-longhorn
       - name: i915
         hostPath:
           path: /dev/dri

cluster/apps/ghostfolio/ghostfolio-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: ghostfolio-ceph
+  name: ghostfolio-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

cluster/apps/ghostfolio/ghostfolio.yml

@@ -78,7 +78,7 @@ spec:
               key: postgres-password
       containers:
       - name: ghostfolio
-        image: docker.io/ghostfolio/ghostfolio:2.196.0
+        image: docker.io/ghostfolio/ghostfolio:2.208.0
         securityContext:
           capabilities:
             drop:
@@ -123,4 +123,4 @@ spec:
       volumes:
       - name: ghostfolio-data
         persistentVolumeClaim:
-          claimName: ghostfolio-ceph
+          claimName: ghostfolio-longhorn

cluster/apps/gitea-act/gitea-act-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: gitea-act-runner-ceph
+  name: gitea-act-runner-longhorn
   namespace: default
 spec:
   accessModes:
@@ -10,5 +10,5 @@ spec:
   volumeMode: Filesystem
   resources:
     requests:
-      storage: 1Gi
-  storageClassName: csi-rbd-sc
+      storage: 100Mi
+  storageClassName: longhorn

cluster/apps/gitea-act/gitea-act.yml

@@ -18,14 +18,14 @@ spec:
       labels:
         app: gitea-act-runner
     spec:
-      hostNetwork: true
       restartPolicy: Always
+      hostNetwork: true
       volumes:
       - name: docker-certs
         emptyDir: {}
       - name: runner-data
         persistentVolumeClaim:
-          claimName: gitea-act-runner-ceph
+          claimName: gitea-act-runner-longhorn
       initContainers:
       - name: wait-for-gitea
         image: busybox
@@ -52,7 +52,7 @@ spec:
         - name: GITEA_INSTANCE_URL
           value: "https://gitea.akshun-lab.cc"
         - name: GITEA_RUNNER_REGISTRATION_TOKEN
-          value: "NvAHP4f1in4Fpe6VFaiwiN98IR0poOQoDv4dDKcN"
+          value: "uxvKmGvtraocJMCcfJ101XC9kUoY8OlCEN18CvgZ"
         - name: CONFIG_FILE
           value: "/data/config.yaml"
         volumeMounts:
@@ -61,7 +61,7 @@ spec:
         - name: runner-data
           mountPath: /data
       - name: daemon
-        image: docker:28.4.0-dind
+        image: docker:28.5.1-dind
         env:
         - name: DOCKER_TLS_CERTDIR
           value: /certs
@@ -70,4 +70,3 @@ spec:
         volumeMounts:
         - name: docker-certs
           mountPath: /certs
- 

cluster/apps/gitea/gitea-db.yml

@@ -43,4 +43,4 @@ spec:
       volumes:
       - name: db
         persistentVolumeClaim:
-          claimName: gitea-db-ceph
+          claimName: gitea-db-longhorn

cluster/apps/gitea/gitea-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: gitea-app-ceph
+  name: gitea-app-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,13 +11,13 @@ spec:
   resources:
     requests:
       storage: 5Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn
 
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: gitea-db-ceph
+  name: gitea-db-longhorn
   namespace: default
 spec:
   accessModes:
@@ -26,4 +26,4 @@ spec:
   resources:
     requests:
       storage: 5Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

cluster/apps/gitea/gitea.yml

@@ -29,7 +29,7 @@ spec:
           done
       containers:
       - name: gitea
-        image: gitea/gitea:1.24.5
+        image: gitea/gitea:1.24.6
         ports:
         - containerPort: 22
         - containerPort: 3000
@@ -69,4 +69,4 @@ spec:
           type: File
       - name: gitea-data
         persistentVolumeClaim:
-          claimName: gitea-app-ceph
+          claimName: gitea-app-longhorn

cluster/apps/gotenberg/gotenberg-svc.yml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gotenberg-service
+  namespace: default
+spec:
+  selector:
+    app: gotenberg
+  type: ClusterIP
+  ports:
+  - port: 3000
+    targetPort: 3000

cluster/apps/gotenberg/gotenberg.yml

@@ -0,0 +1,30 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gotenberg
+  namespace: default
+spec:
+  selector:
+    matchLabels:
+      app: gotenberg
+  template:
+    metadata:
+      labels:
+        app: gotenberg
+    spec:
+      securityContext:
+        runAsUser: 1001
+      containers:
+      - name: gotenberg
+        image: gotenberg/gotenberg:8.24
+        command:
+        - sh
+        - -c
+        - |
+          gotenberg --chromium-disable-javascript=true --chromium-allow-list=file:///tmp/.*
+        ports:
+        - containerPort: 3000
+        securityContext:
+          readOnlyRootFilesystem: false
+          allowPrivilegeEscalation: false
+          privileged: false

cluster/apps/homepage/homepage-config.yml

@@ -52,7 +52,7 @@ data:
         useEqualHeights: true
         hideErrors: true
         statusStyle: "dot"
-        background: /images/background.png
+        background: /images/sur.png
     services.yaml: |
         - Apps:
               - Sonarr:
@@ -259,13 +259,6 @@ data:
                     namespace: default
                     podSelector: app=paperless-ngx
                     app: paperless-ngx
-              - Open-WebUI:
-                    icon: ollama.png
-                    description: ollama Frontend
-                    href: https://ollama.akshun-lab.cc
-                    namespace: default
-                    podSelector: app=open-webui
-                    app: open-webui
               - Ghostfolio:
                     icon: ghostfolio.png
                     description: portfolio analyzer
@@ -273,12 +266,6 @@ data:
                     namespace: default
                     podSelector: app=ghostfolio
                     app: ghostfolio
-              - Drone:
-                    icon: drone.png
-                    description: CI/CD
-                    namespace: default
-                    app: drone
-                    href: https://drone.akshun-lab.cc
               - Searxng:
                     icon: searxng.png
                     description: search engine

cluster/apps/homepage/homepage-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: homepage-ceph
+  name: homepage-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 100Mi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

cluster/apps/homepage/homepage.yml

@@ -42,7 +42,7 @@ spec:
               subPath: services.yaml
       containers:
         - name: homepage
-          image: "ghcr.io/gethomepage/homepage:v1.4.6"
+          image: "ghcr.io/gethomepage/homepage:v1.5.0"
           imagePullPolicy: IfNotPresent
           env:
             - name: HOMEPAGE_ALLOWED_HOSTS
@@ -86,7 +86,7 @@ spec:
             name: homepage
         - name: images
           persistentVolumeClaim:
-            claimName: homepage-ceph
+            claimName: homepage-longhorn
         - name: logs
           emptyDir: {}
         - name: tmp

cluster/apps/immich/immich-ml.yml

@@ -16,10 +16,9 @@ spec:
       labels:
         app: immich-ml
     spec:
-      runtimeClassName: nvidia
       containers:
       - name: immich-machine-learning
-        image: ghcr.io/immich-app/immich-machine-learning:v1.140.1-cuda
+        image: ghcr.io/immich-app/immich-machine-learning:v2.0.1-openvino
         ports:
         - containerPort: 3003
         env:
@@ -34,10 +33,10 @@ spec:
           mountPath: /cache
         resources:
           requests:
-            nvidia.com/gpu: "1"
+            gpu.intel.com/i915: "1"
           limits:
-            nvidia.com/gpu: "1"
+            gpu.intel.com/i915: "1"
       volumes:
       - name: model-cache
         persistentVolumeClaim:
-          claimName: immich-cache-ceph
+          claimName: immich-cache-longhorn

cluster/apps/immich/immich-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: immich-cache-ceph
+  name: immich-cache-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,7 +11,7 @@ spec:
   resources:
     requests:
       storage: 10Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn
 
 ---
 apiVersion: v1

cluster/apps/immich/immich.yml

@@ -39,7 +39,7 @@ spec:
           done
       containers:
       - name: immich-server
-        image: ghcr.io/immich-app/immich-server:v1.140.1
+        image: ghcr.io/immich-app/immich-server:v2.0.1
         ports:
         - containerPort: 2283
         env:

cluster/apps/invidious/invidious-config.yml

@@ -13,8 +13,7 @@ data:
       host: localhost
       port: 5432
     check_tables: true
-    signature_server: localhost:12999
-    visitor_data: ${VISITOR_DATA}
-    po_token: ${PO_TOKEN}
-    port: 3000
+    invidious_companion:
+    - private_url: "http://localhost:8282/companion"
+    invidious_companion_key: ${INVIDIOUS_COMPANION_KEY}
     hmac_key: ${INVIDIOUS_HMAC_KEY}

cluster/apps/invidious/invidious-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: invidious-ceph
+  name: invidious-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

cluster/apps/invidious/invidious.yml

@@ -65,21 +65,22 @@ spec:
         volumeMounts:
         - name: postgres-data
           mountPath: /var/lib/postgresql/data
-      - name: inv-sig-helper
-        image: quay.io/invidious/inv-sig-helper@sha256:39fee87693ef3d71c212d9511f2adb3230783753342321489deab17caa87c42f
+      - name: inv-companion
+        image: quay.io/invidious/invidious-companion@sha256:a96f7a1eb88bf0d5882d519c9410f8c7b2d391cafc378b72f3bfd37dd5f0e587
         restartPolicy: Always
-        args: ["--tcp", "0.0.0.0:12999"]
         env:
-        - name: RUST_LOG
-          value: "info"
+        - name: SERVER_SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              name: invidious-secrets
+              key: INVIDIOUS_COMPANION_KEY
         securityContext:
-          readOnlyRootFilesystem: true
           capabilities:
             drop:
             - ALL
       containers:
       - name: invidious
-        image: quay.io/invidious/invidious@sha256:9ffa4f1ea5cf01abe3102777102bd7a13153c79f6ff6ac072b6a29dda6909a8b
+        image: quay.io/invidious/invidious@sha256:2836b5b8226a53a9cc2afdbd5f5fe6bccdd200f2e17cd92a828b4dc8d8b5cc06
         command:
         - sh
         - -c
@@ -107,4 +108,4 @@ spec:
           name: invidious-config
       - name: postgres-data
         persistentVolumeClaim:
-          claimName: invidious-ceph
+          claimName: invidious-longhorn

cluster/apps/jellyfin/jellyfin-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellyfin-ceph
+  name: jellyfin-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 20Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

cluster/apps/jellyfin/jellyfin.yml

@@ -24,8 +24,6 @@ spec:
         volumeMounts:
         - name: media
           mountPath: /media
-          readOnly: true
-          recursiveReadOnly: Enabled
         - name: config
           mountPath: /config
         - name: cache
@@ -42,7 +40,7 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: jellyfin-ceph
+          claimName: jellyfin-longhorn
       - name: cache
         hostPath:
           path: /tmp/

cluster/apps/jellyseerr/jellyseerr-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellyseerr-ceph
+  name: jellyseerr-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

cluster/apps/jellyseerr/jellyseerr.yml

@@ -54,4 +54,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: jellyseerr-ceph
+          claimName: jellyseerr-longhorn

cluster/apps/jellystat/jellystat-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellystat-ceph
+  name: jellystat-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,19 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellystat-backups-longhorn
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: longhorn

cluster/apps/jellystat/jellystat.yml

@@ -32,10 +32,11 @@ spec:
             secretKeyRef:
               name: jellystat-secret
               key: password
+        - name: PGDATA
+          value: /mnt/postgres/data
         volumeMounts:
-        - name: backup
-          mountPath: /var/lib/postgresql/data
-          subPath: db
+        - name: postgres-data
+          mountPath: /mnt/postgres
       containers:
       - name: jellystat
         image: cyfershepard/jellystat:1.1.6
@@ -59,10 +60,12 @@ spec:
               name: jellystat-secret
               key: jwt
         volumeMounts:
-        - name: backup
+        - name: backups
           mountPath: /app/backend/backup-data
-          subPath: backup
       volumes:
-      - name: backup
+      - name: postgres-data
         persistentVolumeClaim:
-          claimName: jellystat-ceph
+          claimName: jellystat-longhorn
+      - name: backups
+        persistentVolumeClaim:
+          claimName: jellystat-backups-longhorn

cluster/apps/nextcloud/collabora.yml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
       - name: collabora
-        image: collabora/code:25.04.5.1.1
+        image: collabora/code:25.04.6.1.1
         ports:
         - containerPort: 9980
         env:

cluster/apps/nextcloud/nextcloud.yml

@@ -28,7 +28,7 @@ spec:
             done
       containers:
       - name: nextcloud
-        image: lscr.io/linuxserver/nextcloud:31.0.8
+        image: lscr.io/linuxserver/nextcloud:32.0.0
         ports:
         - containerPort: 443
         env:

cluster/apps/paperless-ngx/paperless-ngx.yml

@@ -27,7 +27,7 @@ spec:
           subPath: redis
       containers:
       - name: paperless-ngx
-        image: ghcr.io/paperless-ngx/paperless-ngx:2.18.3
+        image: ghcr.io/paperless-ngx/paperless-ngx:2.18.4
         ports:
         - containerPort: 8000
         env:
@@ -41,6 +41,12 @@ spec:
           value: "https://ngx.akshun-lab.cc"
         - name: PAPERLESS_TIME_ZONE
           value: "Asia/Kolkata"
+        - name: PAPERLESS_TIKA_ENABLED
+          value: "1"
+        - name: PAPERLESS_TIKA_ENDPOINT
+          value: "http://tika-service:9998"
+        - name: PAPERLESS_TIKA_GOTENBERG_ENDPOINT
+          value: "http://gotenberg-service:3000"
         volumeMounts:
         - name: data
           mountPath: /usr/src/paperless/data
@@ -57,4 +63,4 @@ spec:
       volumes:
       - name: data
         persistentVolumeClaim:
-          claimName: paperless-ceph
+          claimName: paperless-longhorn

cluster/apps/paperless-ngx/paperless-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: paperless-ceph
+  name: paperless-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

cluster/apps/pihole/pihole-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: pihole-ceph
+  name: pihole-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

cluster/apps/pihole/pihole.yml

@@ -16,6 +16,18 @@ spec:
         app: pihole
     spec:
       hostNetwork: true
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: In
+                values:
+                - kube-02
+                - kube-03
+                - kube-04
+                - kube-05
       containers:
       - name: pihole
         image: pihole/pihole@sha256:90a1412b3d3037d1c22131402bde19180d898255b584d685c84d943cf9c14821
@@ -39,4 +51,4 @@ spec:
       volumes:
       - name: pihole-data
         persistentVolumeClaim:
-          claimName: pihole-ceph
+          claimName: pihole-longhorn

cluster/apps/prowlarr/prowlarr-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: prowlarr-ceph
+  name: prowlarr-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

cluster/apps/prowlarr/prowlarr.yml

@@ -56,4 +56,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: prowlarr-ceph
+          claimName: prowlarr-longhorn

cluster/apps/pulse/pulse-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: pulse-ceph
+  name: pulse-longhorn
   namespace: default
 spec:
   accessModes:
@@ -10,5 +10,5 @@ spec:
   volumeMode: Filesystem
   resources:
     requests:
-      storage: 1Gi
-  storageClassName: csi-rbd-sc
+      storage: 100Mi
+  storageClassName: longhorn

cluster/apps/pulse/pulse.yml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
       - name: pulse
-        image: rcourtman/pulse:4.13.0
+        image: rcourtman/pulse:4.23.0
         volumeMounts:
         - name: pulse-data
           mountPath: /data
@@ -27,4 +27,4 @@ spec:
       volumes:
       - name: pulse-data
         persistentVolumeClaim:
-          claimName: pulse-ceph
+          claimName: pulse-longhorn

cluster/apps/qbittorrent/qbittorrent-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: qbittorrent-ceph
+  name: qbittorrent-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

cluster/apps/qbittorrent/qbittorrent.yml

@@ -58,7 +58,7 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: qbittorrent-ceph
+          claimName: qbittorrent-longhorn
       - name: downloads
         nfs:
           server: 10.0.0.123

cluster/apps/radarr/radarr-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: radarr-ceph
+  name: radarr-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 2Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

cluster/apps/radarr/radarr.yml

@@ -46,4 +46,4 @@ spec:
           path: /merge/downloads
       - name: config
         persistentVolumeClaim:
-          claimName: radarr-ceph
+          claimName: radarr-longhorn

cluster/apps/searxng/searxng-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: searxng-ceph
+  name: searxng-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 100Mi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

cluster/apps/searxng/searxng.yml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: searxng
-        image: searxng/searxng@sha256:4e9637874bcb714bb47c150256604273c16a2777b6bf7a14fb5a4e544731385d
+        image: searxng/searxng@sha256:0e0493d1bff9ed55f774709c9113185aa3da0db3aea84bf86b356e97a21d54c6
         ports:
         - containerPort: 8080
         env:
@@ -32,4 +32,4 @@ spec:
       volumes:
       - name: searxng
         persistentVolumeClaim:
-          claimName: searxng-ceph
+          claimName: searxng-longhorn

cluster/apps/semaphore/semaphore-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: semaphore-ceph
+  name: semaphore-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 2Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

cluster/apps/semaphore/semaphore.yml

@@ -40,7 +40,7 @@ spec:
           subPath: db
       containers:
       - name: semaphore
-        image: public.ecr.aws/semaphore/pro/server:v2.16.18
+        image: public.ecr.aws/semaphore/pro/server:v2.16.34
         ports:
         - containerPort: 3000
         envFrom:
@@ -65,4 +65,4 @@ spec:
       volumes:
       - name: db
         persistentVolumeClaim:
-          claimName: semaphore-ceph
+          claimName: semaphore-longhorn

cluster/apps/sonarr/sonarr-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: sonarr-ceph
+  name: sonarr-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 5Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

cluster/apps/sonarr/sonarr.yml

@@ -38,7 +38,7 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: sonarr-ceph
+          claimName: sonarr-longhorn
       - name: downloads
         nfs:
           server: 10.0.0.123

cluster/apps/speedtest/speedtest-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: speedtest-ceph
+  name: speedtest-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 100Mi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

cluster/apps/speedtest/speedtest.yml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: speedtest
-        image: lscr.io/linuxserver/speedtest-tracker:1.6.6
+        image: lscr.io/linuxserver/speedtest-tracker:1.6.8
         ports:
         - containerPort: 80
         env:
@@ -49,4 +49,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: speedtest-ceph
+          claimName: speedtest-longhorn

cluster/apps/tika/tika-service.yml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: tika-service
+  namespace: default
+spec:
+  type: ClusterIP
+  selector:
+    app: tika
+  ports:
+  - port: 9998
+    targetPort: 9998

cluster/apps/tika/tika.yml

@@ -0,0 +1,19 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tika
+  namespace: default
+spec:
+  selector:
+    matchLabels:
+      app: tika
+  template:
+    metadata:
+      labels:
+        app: tika
+    spec:
+      containers:
+      - name: tika
+        image: apache/tika:3.2.3.0
+        ports:
+        - containerPort: 9998

cluster/apps/vaultwarden/vaultwarden-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: vaultwarden-ceph
+  name: vaultwarden-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

cluster/apps/vaultwarden/vaultwarden.yml

@@ -30,4 +30,4 @@ spec:
       volumes:
       - name: data
         persistentVolumeClaim:
-          claimName: vaultwarden-ceph
+          claimName: vaultwarden-longhorn

cluster/config/ceph/csi-configmap.yml

@@ -1,17 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-data:
-  config.json: |-
-    [
-      {
-        "clusterID": "54ca2103-a505-46a7-a13e-0f72d6e3574a",
-        "monitors": [
-          "10.1.0.1:6789",
-          "10.1.0.2:6789",
-          "10.1.0.3:6789"
-        ]
-      }
-    ]
-metadata:
-  name: ceph-csi-config
-  namespace: ceph

cluster/config/ceph/csi-rbd-secret.yml

@@ -1,9 +0,0 @@
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: csi-rbd-secret
-  namespace: default
-stringData:
-  userID: ceph-vm
-  userKey: AQA00Y1olRhKFxAA2zejDLWbph/eeHz33XvCxA==

cluster/config/cluster-upgrade/cluster-upgrade.yml

@@ -5,7 +5,6 @@ metadata:
   name: server-plan
   namespace: system-upgrade
 spec:
-  channel: https://update.k3s.io/v1-release/channels/stable
   concurrency: 1
   cordon: true
   nodeSelector:
@@ -17,6 +16,7 @@ spec:
   serviceAccountName: system-upgrade
   upgrade:
     image: rancher/k3s-upgrade
+  channel: https://update.k3s.io/v1-release/channels/stable
 ---
 # Agent plan
 apiVersion: upgrade.cattle.io/v1
@@ -25,7 +25,6 @@ metadata:
   name: agent-plan
   namespace: system-upgrade
 spec:
-  channel: https://update.k3s.io/v1-release/channels/stable
   concurrency: 1
   cordon: true
   nodeSelector:
@@ -40,3 +39,4 @@ spec:
   serviceAccountName: system-upgrade
   upgrade:
     image: rancher/k3s-upgrade
+  channel: https://update.k3s.io/v1-release/channels/stable

cluster/config/cluster-upgrade/system-upgrade-controller.yaml

@@ -264,7 +264,7 @@ spec:
         envFrom:
         - configMapRef:
             name: default-controller-env
-        image: rancher/system-upgrade-controller:v0.15.2
+        image: rancher/system-upgrade-controller:v0.16.3
         imagePullPolicy: IfNotPresent
         name: system-upgrade-controller
         securityContext:

cluster/config/namespaces/namespaces.yml

@@ -26,14 +26,22 @@ metadata:
 kind: Namespace
 apiVersion: v1
 metadata:
-  name: ceph
+  name: goldilocks
   labels:
-    name: ceph
+    name: goldilocks
 
 ---
 kind: Namespace
 apiVersion: v1
 metadata:
-  name: goldilocks
+  name: newt-ns
   labels:
-    name: goldilocks
+    name: newt-ns
+
+---
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: longhorn-system
+  labels:
+    name: longhorn-system

cluster/config/secrets/invidious-app-secrets-sealed.yml

@@ -1,17 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: invidious-app-secrets
-  namespace: default
-spec:
-  encryptedData:
-    companion-key: AgAaS5Ktylm7uoZfPI6kUn/XrrmSL69EgT2SdJzMJ20Gh0ChbOrMQhyn10XhLpTCCLYdCtASwiZi5MoUnhbF5qFbJDM7/RQsfnzIZh52ej37ATckgRIe7/WoriAr7ZzFAQrKr80mcHp93DWdV20eBWkBLzZBSzYzl897NOxHsSrReAEPzkO/mfidjxhuov06J8cahPswzPrdeEJOUJDYrliZiduxpWIQH3cCFX9AU2u8rpS3Gl4Qf48VAaxWtDkgAibilnzOp+KFfW7h0Nmva6EkFGGcHK6FrLrtGPDwKAidg9G9szuOJwu1NgowSRq8gHhah6KC5lHJ3xPpmA5txfked2T2IWHVStssZw9Gx5utH4wkX0PZW58oaJp1lwsC42M3UpPPanB0gvDD1l8iC8Szzh5FY+GyshfcVstdxa4rJW5RZ2/kaDDotGWL021ogAzJmVDvLm8HisMwTrOsA1M9EpesW5sKGmiJc9Ce/wGrU+8kutkbyt8j6pFNl1RGRLUPEsoXaVTfKLdv1o/IWdmaZ/8HeBMkL7iDBqTJHLVOkhUYN+zgDmh2iAkINkYtEPRPTV64DsCLBdCRLZp2obtU2vxxw4J6sQF3FQOZYAhg4YywT+ENwWtorplHU0798RqJpId5b6ktp/bQ5H2innFkjrt7wihgYT4ZS8sSr+8EFQi9kY/A88i2cZ5PdBN6zj+28qHKuxb6CYr9DTm3Q5ZJ
-    hmac-key: AgAv23AhCeIkVAaPuih0yzUM7LY5GRpTrIccZDKgvKW36XLPLAkYnr7SV+S1ADyShyurVvJYl+nOg7hlRpsPldz4PPTas9ahQIrfJHf7JaPauIM1iqG/8UX4Ud2grWSuYz5XBheOIAxlCSFMzK1XgKdMK5Lm/er8ymb9K2KWN35BcnF8lyC/y02uHWhZFJm5CqB2pcJTct1VmNkRt20PHhKKOC/Ruw51CDOYKsrr9HzSNxCO0/d4zhO8F+Q+f3bKHXcQjZbkgkIEE5F0dYfUxpzga/0CqQT1XibYlgBA72GBe06PeIsD9HJIhe03ROsQEAVfLuqMF3vQRNbXdnW9kPVxEbQuXLiitymUPpLE4dRuv7SA3A6Q+bKRlA4+1cTUKquLKNJAerezZkN0e1NJhXQUAAIQbXMFi0c3nMWAr15YtzLmjhEBMmGZoGcMpHOuk/O8uS7opFVHHNrPNxgIsFzfrayTKRcoZJ1LNK8Qkp/5pqlXWNb263da5YS2gv9L90/mB3y1mazxvbFa+b4FjL9b+4dBB2ueiuM8ZbAiCU5o7as0wMJrhoVNq2n66irkIB7Atmv2fCuXiKk6tOrVfH2yNaLI3sOK397up19XJmmX+XHExHlIrEUqZYIx1YSesbNNCrSxfI9WkuRwTORp3JGHeclfbQNpckGGsOn8D/egcrphiqqHB4Rv/sFoscfgjGubv2mLFkVECZwXnhX4dV461bF9lK2nORxflvyRL5/X9nxTI5RLObCu/Vsid7zWXjiSdsxscWyl5rI8/V+7OFDYAJWs4s4yrHIwLgdVnGRWF81j5Z434EOHi8MiGdYOdLNrnQ6KhvsEhVnSAvwMEvdRgfcCmiNp4MyLrLTLkF8MPA==
-  template:
-    metadata:
-      creationTimestamp: null
-      name: invidious-app-secrets
-      namespace: default
-    type: Opaque

cluster/config/secrets/invidious-secrets-sealed.yml

@@ -7,10 +7,9 @@ metadata:
   namespace: default
 spec:
   encryptedData:
-    INVIDIOUS_DB_PASSWORD: AgDZXhcsP5wC5PKnJ0ICfQSx75WYeU+ai2VVAwXL9PSLBkb5b5BQGxFKmXSvuOyJC+VrzoqkTEAhbI8/maHsn3zrE1QFC/7+Yn7ZcvYDO8INzSS9uL6+0NZj0SsOOufgaBtXaniklvL3C/PZ57VYcPNv6lIX9K+WG+8qUnVdKRr0bputl9WHEwMoZXs+l/xYe3jBao62RZ/fVWoMT4dnjNCHCkFsRClsXTxQevfgzfa4xNCDpIWoSewDkX3VaV3AafDDY52t4A2kbsrSL6pVqbeC/VWCKnR0C0x1XuZkQP2fYIsBI//drbHNxTfFSN7mJVZvBJUGNpQsTXGkKLGNFrz/QNjo8kimJfkQPXHbAmAlSB88Z9uFalDIwm/Emh++PEdMA3RuBE6uK/Cmo4M4/UGI6JjLA2DBk1zC9rtVzH6MN6qHDElhlyoMZ6SbGRHtzDrvvmNXDVfJ0KKqhcshBrXyZOIVlCJCs1s91+XOYLG2S0msEk0DIiY6ZhYiPobTPhHSNP8SrFnlMz1nBG+m2+IS+vpquL2l7cOLYAl01q88i3cCobwKtFWmpNiucxLHIbM699Kw8SZ63/jIWpRuNIy6F91GIa0VQzdmAg/AOML4/85bLNXiBlHwO7LlOdDU0kceBLOC1u81CK8mcT8npKjDsHTpuQYpRMHEMFdd53t+qh9JHs/Jo2SU0ZDBwgtSeJYkh50IGzElAErjTA==
-    INVIDIOUS_HMAC_KEY: AgAI30IJiYq2a+idkc5YIf7VWAdb2cJ3IxkFP5f9vCxy1xzyxyj7fKY6LbaDOg8+NPO0hB2klFixh7KMGS+hFONDKzig82BWG+zqO7n0qnxvLtBNOI7c/zMTKuDtr7pT5tji8yDpazlmJbgrV03Gm2yvpsSNmKYixlHhN976W0OuavfPmQ8iomRnE999G/HOYpTELmPlsakf6rYVv9OVi9uCK8vd7oPrY6ep1aofuuB4olDxPr/rBuZdNMFXMcZzvG05KRAQZ3fwKi4EQBAG15TFHPTEtWIAVtfkzpBBOarDFHFFu+W//CI/1aHWHfUSaOp2IfBZ1csYwDkxtkX5lueh26jSAL54BqqvvfkcpRx/GHKQrM797XvN+uuYCq39kjnk0rAKeeEq1Lbm88Zyrcx9W9qBFGkMdKN1uKAvl3bcMQLF8E6ejub4AsMOwR5kfEmADJs10l2gYT7GPNneyIHkqx1bHAz0tlTPzTd2JPFhvaERc7BU2UhDFT57AxuG2qdwAxkhu1YWcNharcz6+LpUnH5adceJlToWqvIfZkgcYgSqxiHYTyhL/x6FDH4OBpiy1rTPUST+xGZCwyjTlYqM3yqkcUgdDePcFYv3tqORV8oH8riC0RD94FUkujLlWiVtCN7FXoba1ApdyCNmfIRHOO4Os9g8H7oxUeTDlUWERsWVgCXtv0H65Tb+EMjaRtIROFCCnrC3qFzybyW1OX06
-    PO_TOKEN: AgAbSZdJpITThH2TxcsvrbrGls8mWuADdRmoR3XP46nr4DWyujaOMsdWr1gV+YM8HgzRx/voZeNZqouh7rnY4dHoFLIJ4vxR7r7hIXyVY+GinUd8R73/NUNgnoI99zd4HqGD+y2HYmoKjKpriOvnYI+arOtcSuQyQB3R/vY9bcoM54oXIc3dQaXKku2+t/cEoZcyZRoeGgk+M73CIhoP9lBLgEq3VIKAcgfnKwgTxTJC4hLYukHa33TriVvVh/8QrNGXpMtclBgYkj5XVpbbh8YeTjS56VqDUO1LWS41UzPc1GjsHINjWMw29GDjLKnlWmpHwWXzXWzy07vgr73aHxE2tLEvQI06GW71HodG0MVG9jS7la4fISzB4r1+eRwYf7aBtw1x+GiB4oMW/3wp5U04iFUiySc+4M7dnfe02yy98MzNLtrbSYUjmKKcBkYWsPtqtQg8CR0RRHa8dGWFSwtFWeMycag18DEDbgwxD6ozFwTuYjCQGflilQahfHxCb3WuQeWeftUk/1N4Pg4aYoL6MMkls+DZyO3/0BtVqldHc2RUHtqnrNZ4mA4ymKbcvBPHe/njjIapfmV6Se/BHC6uYwflRXhXU08ovhiOVJBQM7azku5CCodTENd4cCZYpcQ2F4sJ0blwbt40b/2p1oX3b2lRW47TEWUCIu9RdGRLhyCjKigPGLcZ+Jx+66zp+/vas72pWG0iXYy4ppDP/R1FYz4kTC80VNlBHLcAcP9kd2nwBnowDPNUZLAQgC28mJRGvFFF5qgGCnRWn2oj7iOrBt5Bcv+/WgbIYWk9qzVetiElXS61Xu0lOfduid5fWVltn0Ys02j46Ewh71ojYIAbsVAatkbQwV45ikHIwkXOWq+t7M/nHQaFb25t7KWYVjT/FDZTql7BtRKYJX9OD/TQ
-    VISITOR_DATA: AgA+ERW9tbeo2/6DgV9RG3rOzqME6vz3UXS23TNwjra0dOr8W3gP6Atl7KR1vblwAFXozl6tCtqugBbq1hCdwKx79lwWIaI5DtpwEaGJQe32i+bGM/cDcI/PmqJK9FYDp9gX+G1ldKgAUi9F6MRQ73ze7gG0jFD3q3rwads+kjI0+UI+JwBsOD72YIkgm2a3j4ZRhJOPrd5XZPSNMgbRU5ZZ0I0VjztxpM4iRyeW+Caxo1ltOZijZbLy10fQAf2P/pM2kfXrfuPqlVgCOTuiU9FcuBuL5hSPZqw6QB+ZrQukM7I5KlzhMH7Zfw5DEj4tb+eT9f9/nr3CR3tDTzVJkXo9FVZ1qKvDu6tIZrWD7g5wYcZZWe2Ll/1DFpteDuKE1ry8wgTDdK52mNCVzC5/jYIhR54bfllzY9deZ33Ux75I/l9OHFvEzLrWuhCf9+iL8EW7/a7bTGSiYZXkyiXd+sSsyjmqK3xzqb9MkTE0VmNNKrG8PbdjlfrJQAs8PmX8S1yEcqexBjp7UWND50TwX5zANAqeQMnInaVlB6dXzQSCTeOGnGZOi0oKJ/eH3YbmbKErbqISm18wMbFzU/I3nDR0PFMt5ryRFhgMcIPnBv9kIc6TLY7DLcHHGEEYNjQYRLR3uWCTJeI0fSVnZqxvc+5iCqmPfgWA2TDKTck5FSCwSj3rxIPbEVTlujf+JEapiwAE/OVr08mZ725kvHoTkj43/JStqtZ3nLg5ZxO05Qv7cp96ToK7bS4wUP9ZdWh+pb4=
+    INVIDIOUS_COMPANION_KEY: AgCnfbrG/ji25f6RV/avt613WpOpZNlPsuTP/DU9HULXC1aMM3HzEJR3lIEfeqt9y7iHI7Z4WdD4EqYjdWeDkmLnBLkQB3V7RfPm8tNcfRmMad+Q7bm0viSSq2WhxPtVvtI1G5zoIWs4RGw7F+ee7JqDz8rCKWSHJ0XyuBJUsk3bBLXWNhWtxbaWJz/uxNQoO8ZHV+fa00kqijGcebj9IM6wq4Q7CI5n1NcQqJhJPg1ggOavAiOgcrV5z82PUXDx2tdVbXbynNJfzrTYrU4s0f08rYAT5qF3nXZFtRs4sWEEYCTXZ/E7OdOmWFTsA7af2S1DLE8pkNjzKlVQo/wBV6mvCJcQZtgtLiAKDwnYdoExp8gP9SgL89lyZEa56KtEBAbnU/YBpEQndaFDoLb3mKd1YHn5j4wJXvxinuMEHz9HCANEgDB1NvNGTy443nzzlUzbOiFmMudhBV5wzN9wQ7KNRwVSlU5OlmKO3gBw/gvCAZEKmsHMcDKvUpkKrcDvIMkEA6cCg3Wms8+Le/4EyvRr2VOu+rTXX01/rJ97bcsLGXddJuxc2xvKW6QZEWGtRiK90zkUCaY+PJH1djmjCEb8JIrdGhYy3CMrS3SEVxgPQl0rduAg+z3FtWR4GMttWA7lU1/bPtCIhM+OzgFd/Dy79DuNw4+tbjzEINJUgPpmpYL+1GbsjZ+R48B9pppM+rzKrdfxsOdSvEjTQewn0L14
+    INVIDIOUS_DB_PASSWORD: AgA3xb3XXIxHQVbjaZGb6xkWwrr5HSN8B/iF4Kl0EaQyivs7fYqoE3daylu/2x6D0btH/JYWK9+NeyFVNXPCy3holiteD5/9mJFqBCbtkAFxF0lKyLRjtw5BB6Wp5b/HuVJuLQG4sd+TB9XMGDeRyRkXjTRH0NbXYMlcVILAugb3vBNVCcLQqzlHbOngEMOUZxuUcMPL8crOGOmKosTKrWyt2weAFawlXkiz/cwlvdOmgMb8KWI1opEVAKv4OeUQeGRqa9+7fn0CcuM0PLzBvYPa2eoUb4dTFBzZfKpL5/mmZ9NUXEvV1dXN1oBHLHkIS8wBLhHAt8/Mh1rjhd5IGiIWIwlDT2iBuqKLRjwYbVbT7Co8OuTqs7OvxuYVYlmfOZna2o+kF39oeTH/RtYy3atHBsnW6j7GaUJ7nCZfDUZw4xYcHya5v+h2GI76SVnxKhjNpMGjHZMdDUD/cl3rBp+6gHICOYGCi+Wy4EYXCRJkZs0K84AFlLxoDkxARw6eBpFT+QEVnuMDXRrdNqC/Te9p5jzGWvPvXlfCCkQ9hi4hoNmZxw5P/nXdXg1rALiCVZbnM3O/Ud7KwgtYqNSCThPOj/BoExsQE4xSUJzAm35R0/AidOhOTVxztMba5co9Stavj772lRyV5PNbIieXDu6WNdOJNjjiRhuPzQTqbLzRbSa1I+KBDcbkmbOEBuyhXe1EoBp7anoHrKLYyw==
+    INVIDIOUS_HMAC_KEY: AgBqsFM5UcFmJQwCPG/xl6ZZus6u/uIlJtxsQGR1p+kWcI1DOfCqLCURxku7yuEi82HizZYDSrQ1X8rLtuBVJmCvCsgWclC+3N1zpUCBhbzzPSSa/U66D7LdDpYAgfMDpkiRMXFOZBGCZtYL7I5Wgp2vxYpjsWVXdk5GXFWbR8Dw5ndUROd2+LmrtJxaWeLiEY7OKHPZ8csEwGibIvQlyBsqPON0jKG70nes1oMFmy1TgmdYpRuW5ZwBCFu1ChpL+Ital1IR8TbSW6K2nXdpku+J+WE9CT4nFQLH/NhWsRw8MWPBp2IGnAr+/iIJJYqbfUGIzMnMpvKZW6Xna/mEBJ826WoCbs1CsUAtemmsIyDzO3tANvNEOr8UWpKm7a62HN8Y3HOiduOoonrRVCS9c8jjt1M20z8JQD06fY6ymsOXEYaYkWesO2WieJtT/6qbJlkwx9RJrdMz7mlWcN5edilkF8X3TSw4YpHP7LhofliGjBYx/w2cWWCkWN1QJhbXt2CmYKxhHnAJS/S5Lmmxs3nNpF1mVOCjTIDFXmR86wG5gJEYS7PHw1ZlMUaOeU/uG0E4caGWwJfn3/Z3upZkuuu5oFy/nDodHD+V6YKHQTQ3dWdjTXJ1kW8vLRb3Roii7dxhXW0dFhdBjyX3P6+58PAkdiZzF89naVLW8x7niFrqW5fQ5M06W/PTQQKIO37bM7L/oy/9a3XQmM8dQeTt9d9g
   template:
     metadata:
       creationTimestamp: null

cluster/helm/cert-manager/cert-manager-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: cert-manager
-      version: "v1.18.2"
+      version: "v1.19.0"
       sourceRef:
         kind: HelmRepository
         name: jetstack

cluster/helm/csi-driver-smb/csi-driver-smb-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: csi-driver-smb
-      version: "1.18.0"
+      version: "1.19.1"
       sourceRef:
         kind: HelmRepository
         name: csi-driver-smb

cluster/helm/intel-gpu/intel-device-operator.yml

@@ -0,0 +1,23 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: device-plugin-operator
+  namespace: gpu-operator
+spec:
+  interval: 24h
+  chart:
+    spec:
+      chart: intel-device-plugins-operator
+      version: "0.34.0"
+      sourceRef:
+        kind: HelmRepository
+        name: intel
+        namespace: flux-system
+      interval: 24h
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3

cluster/helm/intel-gpu/intel-plugin-operator.yml

@@ -0,0 +1,27 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gpu-device-plugin
+  namespace: gpu-operator
+spec:
+  interval: 24h
+  chart:
+    spec:
+      chart: intel-device-plugins-gpu
+      version: "0.34.0"
+      sourceRef:
+        kind: HelmRepository
+        name: intel
+        namespace: flux-system
+      interval: 24h
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    sharedDevNum: 4
+    nodeSelector:
+      intel.feature.node.kubernetes.io/gpu: 'true'

cluster/helm/intel-gpu/intel-repo.yml

@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: intel
+  namespace: flux-system
+spec:
+  interval: 24h
+  url: https://intel.github.io/helm-charts

cluster/helm/longhorn/longhorn-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: longhorn
-      version: "1.9.1"
+      version: "1.10.0"
       sourceRef:
         kind: HelmRepository
         name: longhorn
@@ -22,11 +22,10 @@ spec:
       remediateLastFailure: true
   values:
     persistence:
-      defaultClass: true
+      defaultClass: false
       reclaimPolicy: Retain
     ingress:
       enabled: false
     service:
       ui:
-        type: LoadBalancer
-        nodePort: 85
+        type: ClusterIP

cluster/helm/newt/newt-cred-sealed.yml

@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: newt-cred
+  namespace: newt-ns
+spec:
+  encryptedData:
+    NEWT_ID: AgANlHH+ezjEX2Vlu5VgJF0XVqQopfthSt1J1lRSIrB6gHooRKa/Nx55ZZwwJiOzgLz5Rm1XLL2AO9lP+r9gxkPp0QO6gBOciIT5JjF7KPYGd8Mz7JM3YvQmrmQVe5gwltoLcpNgNkOcqf2i4BvLKrsEfLzfYci6nH3paWaopi5pWdzSKmyfJfSL1LtftBBbWMZ4GYq54KiQM8+vrxH8QqnhKrASnd+zQ1Yb1NA0RiraSom8OZiStyvNo4F82bRyZWIBgp7O23gUXH4+Zf5ZbiH1hMiZZOwQfc+sRp3E9b3x5AZAMeWv6RSuRbfX/yODY2mwptAM5sAAaKAwnf53pUA9pqYN0/taAUrEQLd6TNw1nRAuxdZwsKCt/FnWkEo0WtVkiUeciNQMVrlCvQ6YvKU3+1fYYYSMuwpP4gBbjgLmeY+gQVcBwKi8eRHAxaRuhqBP22wdVozlKcA9UysRNu0VcnB5sAsxxpHwWMQgwJ7DvayMgX10tdnXDtBCYGNOeKuDnJWbkAEHAOLguYW8VsZSXB1a+1SQe/MVnTAPKTgqKwbD8Tf2pDOg11z/WwpRXLgRyahmxJt+li2vEE7PVjyVFF1ZN81TYlnlOiGkMSYB5bHT2zcQZ2hxa4J1QBzl3J1kAydyrCQZNvkzQ0vrtKSt6k8cAlsr61b4zPhX7IrSGjQw3zRjnAMAJc2zvDu2FB53641hZknoO2HsAZbqDXw=
+    NEWT_SECRET: AgAffzmD9CZCn4P3GNC0sT3h86iPpzvMvmELZpqUOfWsMgPq6cY/HSfd927ShxPEDZXrd1FLDu+tH9Ealk2duhkq0YEanaMu5j5x8/GiSctRdhtD6H8t4uONRXQjKWG2HaySz7oR+GcO8/EM6rEcki17HhI7px+dzLm7HowcBMvw2ne+RqthmdOlVvxeIzLejnWIrzY2wcuieK7r3zq+d3unZi9T7GbevmzCA5V3wQrWqvsNezHHj0BIJlIYn3Vzx5ZZN6pgUT8x0y8TteC+FtHDKgODHgtT2ZYkK+LR3wtCXgO1Y6NILr2Ijg96aeL8/TYY3e5T8q4cKr1HabYjfenCjigzuqS27m9u2wCI8Zv6ffWjEYUED4GQ8oXqMyE44pYrzzb+Do3V3Ezj6PMDEvtQaWJ78JvQaOdHnszXMXpAsIsKhgeo7WdiIJWBnFW9lYhC3OdxuW2yNi5lv9z/oJEB+13pmVHkTzYHqhollz1AAY5nna5+JHNNFbRfbj8pj7I07qjOj291e2jZ+p9LBkip5xNfVOeSoX8YOwn8aZTaZPKvPgSZFvFS54JlcO8KWIeqGOc2CKO0r+6GaysO+6LxHH8WGdxxh9JLlNZdcnunQ9Cxlh1vPTuxG7zhEu4KiWwL/5KAQf9Ksyd33WdgR4qNQGnfXccomGRD4fxral6K8jDJjDJlCUQcbYAl2n+eMu377YWkhW0ecMLgYiLzkyNdZO5HnuoNqHr+HsUD+4g7UNtb8cwFhj6uaX+6RXlBS/U=
+    PANGOLIN_ENDPOINT: AgCkSy8lFTJZJT0luEKhfSOMO9aeSsUvmxaLXc9+nDHmlDoWBv15q7uEsutXDr8OPuM9sl7g6KLfYFTlaPO502Wrw/FV6ncX6es/KfguEydAebdl3uZ096FcwaTGtcpd/mdo4W8z2348EnttoxeJ23tZWabZcYfyVu/UA4Sor05hpnYdTxK3mYra89dhb/u4Pz5BdQUKlseCIWiLqk7HON0nI775ANq8OJ6MZeMSZoAdjOdy24hw3SSwwpX1Y1p6Ior5UV9tiCXpbL5UVj6Wo4LIGkqBRomPQ3V6Furim5bhfLDNDYTFVqWo0UEa6eYwP6NgPZ+oxfI1pFdio1g39+iY9AHlJoYRDkYF0wJLjfGdnju4L+KXsdWiyQVXS7lX+GAohna3p3xSaOrFzYt3SxEQ9lGvUFrXIXB5UrBrN1iODpbRyJb6KdXNZM9SklKKycZ9WCfLzhWV1ppwReQrICR4JljngSMWuBGxjr90BlkvMSQVOFGrHSs9AeY/ymf6P1TQ8WwecivTZ3oK8x+NIqdJSXRr2HEZkNOfJH4hDcD9NLO/7Wt/bkp4sX8Bvs2MrZ466hHovm2ENC9Cz/LHZLpHHtidmBn4hgrT39Cjgbq6bPR2SBSQnoXB/FVA9zuqJ6E+Z69O3pdXtxTEIZAvtJ4BaEiOkzQzonScowNwklnkEaru/TSx50rNjfW2k2CNx/Tz7XZf4vEudRbxc1nzXxzkMnQyldheczPjnWvcTgI=
+  template:
+    metadata:
+      name: newt-cred
+      namespace: newt-ns
+    type: Opaque

cluster/helm/newt/newt-release.yml

@@ -0,0 +1,29 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: newt
+  namespace: newt-ns
+spec:
+  interval: 24h
+  chart:
+    spec:
+      chart: newt
+      version: "1.1.0"
+      sourceRef:
+        kind: HelmRepository
+        name: newt
+        namespace: flux-system
+      interval: 24h
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    newtInstances:
+      - name: main
+        enabled: true
+        auth:
+          existingSecretName: newt-cred

cluster/helm/newt/newt-repo.yml

@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: newt
+  namespace: flux-system
+spec:
+  interval: 24h
+  url: https://charts.fossorial.io

cluster/helm/prometheus/prometheus-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: prometheus
-      version: "27.35.0"
+      version: "27.40.1"
       sourceRef:
         kind: HelmRepository
         name: prometheus-community

disabled/apps/drone/drone-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: drone-ceph
+  name: drone-longhorn
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: csi-rbd-sc
+  storageClassName: longhorn

disabled/apps/drone/drone.yml

@@ -32,10 +32,10 @@ spec:
             echo "Gitea is ready!"
       containers:
       - name: drone-server
-        image: drone/drone:2
+        image: drone/drone:2.26.0
         env:
         - name: DRONE_GITEA_SERVER
-          value: "https://gitea.akshun-lab.uk"
+          value: "https://gitea.akshun-lab.cc"
         - name: DRONE_GITEA_CLIENT_ID
           valueFrom:
             secretKeyRef:
@@ -52,16 +52,16 @@ spec:
               name: drone-gitea-secrets
               key: rpc_secret
         - name: DRONE_SERVER_HOST
-          value: "drone.akshun-lab.uk"
+          value: "drone.akshun-lab.cc"
         - name: DRONE_SERVER_PROTO
           value: "https"
         - name: DRONE_USER_CREATE
-          value: "username:akshun,admin:true"
+          value: "username:aggarwalakshun,admin:true"
         volumeMounts:
         - name: drone-data
           mountPath: /data
       - name: drone-runner
-        image: drone/drone-runner-kube:latest
+        image: drone/drone-runner-kube@sha256:a515ca817bb61be2801e5c70245ca7c2be0fce7b28b91bd7a6d0dd2f1d22eb23
         env:
         - name: DRONE_RPC_PROTO
           value: "http"
@@ -80,4 +80,4 @@ spec:
       volumes:
       - name: drone-data
         persistentVolumeClaim:
-          claimName: drone-ceph
+          claimName: drone-longhorn

disabled/apps/open-webui/open-webui-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: open-webui-ceph
+  name: open-webui-longhorn
   namespace: default
 spec:
   accessModes:
@@ -10,5 +10,5 @@ spec:
   volumeMode: Filesystem
   resources:
     requests:
-      storage: 5Gi
-  storageClassName: csi-rbd-sc
+      storage: 2Gi
+  storageClassName: longhorn

disabled/apps/open-webui/open-webui.yml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
       - name: open-webui
-        image: ghcr.io/open-webui/open-webui:v0.6.26
+        image: ghcr.io/open-webui/open-webui:0.6.33
         ports:
         - containerPort: 8080
         env:
@@ -29,4 +29,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: open-webui-ceph
+          claimName: open-webui-longhorn

disabled/config/ceph/csi-configmap.yml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: ConfigMap
+data:
+  config.json: |-
+    [
+      {
+        "clusterID": "8bb08316-8b5c-11f0-a772-bc24114124ba",
+        "monitors": [
+          "10.1.0.11:6789",
+          "10.1.0.12:6789",
+          "10.1.0.13:6789",
+          "10.1.0.14:6789",
+          "10.1.0.15:6789"
+        ]
+      }
+    ]
+metadata:
+  name: ceph-csi-config
+  namespace: ceph

disabled/config/ceph/csi-rbd-sc.yml

@@ -5,8 +5,8 @@ metadata:
    name: csi-rbd-sc
 provisioner: rbd.csi.ceph.com
 parameters:
-   clusterID: 54ca2103-a505-46a7-a13e-0f72d6e3574a
-   pool: ceph-vm
+   clusterID: 8bb08316-8b5c-11f0-a772-bc24114124ba
+   pool: kubernetes
    imageFeatures: layering
    csi.storage.k8s.io/provisioner-secret-name: csi-rbd-secret
    csi.storage.k8s.io/provisioner-secret-namespace: default
@@ -14,7 +14,7 @@ parameters:
    csi.storage.k8s.io/controller-expand-secret-namespace: default
    csi.storage.k8s.io/node-stage-secret-name: csi-rbd-secret
    csi.storage.k8s.io/node-stage-secret-namespace: default
-reclaimPolicy: Retain
+reclaimPolicy: Delete
 allowVolumeExpansion: true
 mountOptions:
    - discard

disabled/config/ceph/csi-rbd-secret.yml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: csi-rbd-secret
+  namespace: default
+type: kubernetes.io/rbd
+data:
+  userID: a3ViZXJuZXRlcw==
+  userKey: QVFEQm43eG9xU3VhQmhBQThHRDBoZ2tkK3pNUWlITFpaUjl6T0E9PQ==

disabled/config/ceph/csi-rbdplugin-provisioner.yml

@@ -48,7 +48,7 @@ spec:
       containers:
         - name: csi-rbdplugin
           # for stable functionality replace canary with latest release version
-          image: quay.io/cephcsi/cephcsi:canary
+          image: quay.io/cephcsi/cephcsi:v3.15.0-amd64
           args:
             - "--nodeid=$(NODE_ID)"
             - "--type=rbd"
@@ -159,7 +159,7 @@ spec:
             - name: socket-dir
               mountPath: /csi
         - name: csi-attacher
-          image: registry.k8s.io/sig-storage/csi-attacher:v4.9.0
+          image: registry.k8s.io/sig-storage/csi-attacher:v4.10.0
           args:
             - "--v=1"
             - "--csi-address=$(ADDRESS)"
@@ -210,7 +210,7 @@ spec:
               mountPath: /csi
         - name: csi-rbdplugin-controller
           # for stable functionality replace canary with latest release version
-          image: quay.io/cephcsi/cephcsi:canary
+          image: quay.io/cephcsi/cephcsi:v3.15.0-amd64
           args:
             - "--type=controller"
             - "--v=5"
@@ -231,7 +231,7 @@ spec:
             - name: ceph-config
               mountPath: /etc/ceph/
         - name: liveness-prometheus
-          image: quay.io/cephcsi/cephcsi:canary
+          image: quay.io/cephcsi/cephcsi:v3.15-canary-amd64
           args:
             - "--type=liveness"
             - "--endpoint=$(CSI_ENDPOINT)"

disabled/config/ceph/csi-rbdplugin.yml

@@ -29,7 +29,7 @@ spec:
               add: ["SYS_ADMIN"]
             allowPrivilegeEscalation: true
           # for stable functionality replace canary with latest release version
-          image: quay.io/cephcsi/cephcsi:canary
+          image: quay.io/cephcsi/cephcsi:v3.15-canary-amd64
           args:
             - "--nodeid=$(NODE_ID)"
             - "--pluginpath=/var/lib/kubelet/plugins"
@@ -116,7 +116,7 @@ spec:
           securityContext:
             privileged: true
             allowPrivilegeEscalation: true
-          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.14.0
+          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.15.0
           args:
             - "--v=1"
             - "--csi-address=/csi/csi.sock"
@@ -135,7 +135,7 @@ spec:
           securityContext:
             privileged: true
             allowPrivilegeEscalation: true
-          image: quay.io/cephcsi/cephcsi:canary
+          image: quay.io/cephcsi/cephcsi:v3.15-canary-amd64
           args:
             - "--type=liveness"
             - "--endpoint=$(CSI_ENDPOINT)"

disabled/helm/gpu-operator/gpu-operator-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: gpu-operator
-      version: "v25.3.2"
+      version: "v25.3.4"
       sourceRef:
         kind: HelmRepository
         name: nvidia

disabled/helm/ollama/ollama-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: ollama-ceph
+  name: ollama-longhorn
   namespace: default
 spec:
   accessModes:
@@ -10,5 +10,5 @@ spec:
   volumeMode: Filesystem
   resources:
     requests:
-      storage: 20Gi
-  storageClassName: csi-rbd-sc
+      storage: 6Gi
+  storageClassName: longhorn

disabled/helm/ollama/ollama-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: ollama
-      version: "1.28.0"
+      version: "1.31.0"
       sourceRef:
         kind: HelmRepository
         name: ollama
@@ -37,4 +37,4 @@ spec:
     runtimeClassName: nvidia
     persistentVolume:
       enabled: true
-      existingClaim: ollama-ceph
+      existingClaim: ollama-longhorn