Update Helm release external-dns to v8

2025-02-21 00:00:56 +00:00
47 changed files with 202 additions and 242 deletions
--- a/apps-helm/code-server/values.yaml
+++ b/apps-helm/code-server/values.yaml
@ -6,7 +6,7 @@ replicaCount: 1

 image:
  repository: codercom/code-server
-  tag: '4.97.2'
+  tag: '4.93.1'
  pullPolicy: Always

 secret:
--- a/apps-kustomized/airsonic-advanced/ingress.yaml
+++ b/apps-kustomized/airsonic-advanced/ingress.yaml
@ -1,26 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    external-dns.alpha.kubernetes.io/target: armnleg.martyn.berlin
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
-  name: airsonic-advanced
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: airsonic.martyn.berlin
-    http:
-      paths:
-      - backend:
-          service:
-            name: airsonic-advanced
-            port:
-              number: 80
-        path: /
-        pathType: Prefix
-  tls:
-  - hosts:
-    - airsonic.martyn.berlin
--- a/apps-kustomized/argocd/kustomization.yaml
+++ b/apps-kustomized/argocd/kustomization.yaml
@ -24,11 +24,3 @@ patches:
      version: v1
      kind: ConfigMap
      name: argocd-cm
-
-  - patch: |-
-      - op: add
-        path: /spec/template/spec/containers/0/args/-
-        value: --insecure=true
-    target:
-      kind: Deployment
-      name: argocd-server
--- a/apps-kustomized/bazarr/deploy.yaml
+++ b/apps-kustomized/bazarr/deploy.yaml
@ -33,6 +33,8 @@ spec:
          mountPath: /config
        - name: series
          mountPath: /series
+        - name: oldseries
+          mountPath: /oldseries
        - name: films
          mountPath: /films
      volumes:
@ -42,6 +44,9 @@ spec:
      - name: series
        persistentVolumeClaim:
          claimName: smb-series
+      - name: oldseries
+        persistentVolumeClaim:
+          claimName: smb-oldseries
      - name: films
        persistentVolumeClaim:
          claimName: smb-films
--- a/apps-kustomized/bazarr/pvc-smb.yaml
+++ b/apps-kustomized/bazarr/pvc-smb.yaml
@ -12,6 +12,18 @@ spec:
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
+metadata:
+  name: smb-oldseries
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: smb-oldseries
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
  name: smb-films
 spec:
@ -20,4 +32,4 @@ spec:
  resources:
    requests:
      storage: 1Gi
-  storageClassName: smb-films
+  storageClassName: smb-films
--- a/apps-kustomized/bucket/ingress.yaml
+++ b/apps-kustomized/bucket/ingress.yaml
@ -34,5 +34,7 @@ spec:
  tls:
  - hosts:
    - files.martyn.berlin
+    secretName: files-tls
  - hosts:
    - files-a89a4194-3742-498e-8c6c-37128fdb9291.martyn.berlin
+    secretName: long-name-files-tls
--- a/apps-kustomized/cryptpad/ingress.yaml
+++ b/apps-kustomized/cryptpad/ingress.yaml
@ -28,6 +28,7 @@ spec:
  tls:
  - hosts:
    - cryptpad.martyn.berlin
+    secretName: cryptpad-tls
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@ -59,3 +60,4 @@ spec:
  tls:
  - hosts:
    - cryptpad-safe.martyn.berlin
+    secretName: cryptpad-safe-tls
--- a/apps-kustomized/esphome/deploy.yaml
+++ b/apps-kustomized/esphome/deploy.yaml
@ -17,7 +17,7 @@ spec:
      - env:
        - name: ESPHOME_DASHBOARD_USE_PING
          value: "true"
-        image: esphome/esphome:2022.12.8
+        image: esphome/esphome:2022.12.3
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
--- a/apps-kustomized/external-dns/kustomization.yaml
+++ b/apps-kustomized/external-dns/kustomization.yaml
@ -4,7 +4,7 @@ kind: Kustomization
 helmCharts:      
 - name: external-dns
  repo: https://charts.bitnami.com/bitnami
-  version: 8.7.6
+  version: 8.7.5
  releaseName: external-dns
  namespace: external-dns
  valuesInline:
--- a/apps-kustomized/external-mqtt/ing.yaml
+++ b/apps-kustomized/external-mqtt/ing.yaml
@ -10,6 +10,7 @@ spec:
  tls:
  - hosts:
    - iot.martyn.berlin
+    secretName: mosquitto-certs
  rules:
  - host: iot.martyn.berlin
    http:
--- a/apps-kustomized/forgejo/deploy.yaml
+++ b/apps-kustomized/forgejo/deploy.yaml
@ -19,7 +19,7 @@ spec:
        app: forgejo
    spec:
      containers:
-      - image: codeberg.org/forgejo/forgejo:10.0.1
+      - image: codeberg.org/forgejo/forgejo:1.21
        env:
        - name: FORGEJO__database__DB_TYPE
          value: postgres
--- a/apps-kustomized/forgejo/ingress.yaml
+++ b/apps-kustomized/forgejo/ingress.yaml
@ -26,3 +26,4 @@ spec:
  tls:
  - hosts:
    - git.martyn.berlin
+    secretName: forgejo-tls
--- a/apps-kustomized/jellyfin/deployment.yaml
+++ b/apps-kustomized/jellyfin/deployment.yaml
@ -31,7 +31,7 @@ spec:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
-        image: docker.io/jellyfin/jellyfin:10.10.6
+        image: docker.io/jellyfin/jellyfin:10.10.5
        imagePullPolicy: Always
        name: jellyfin
        ports:
@ -49,12 +49,16 @@ spec:
            cpu: 163m
 #            memory: 3861631195
        volumeMounts:
+        - mountPath: /data2/media
+          name: runningseries
        - mountPath: /films
          name: films
        - mountPath: /config
          name: jellyfin-config
        - mountPath: /music
          name: music
+        - mountPath: /oldbigseries
+          name: oldseries
        - mountPath: /config/transcodes
          name: transcodes
        - mountPath: /dev/dri
@ -66,9 +70,12 @@ spec:
      dnsPolicy: ClusterFirst
      nodeSelector:
        intel.feature.node.kubernetes.io/gpu: "true"
-        kubernetes.io/hostname: talos-llu-kx3
+        oldname: i9worker
      terminationGracePeriodSeconds: 30
      volumes:
+      - persistentVolumeClaim:
+          claimName: smb-series
+        name: runningseries
      - name: jellyfin-config
        persistentVolumeClaim:
          claimName: jellyfin-config
@ -81,6 +88,9 @@ spec:
      - persistentVolumeClaim:
          claimName: smb-films
        name: films
+      - persistentVolumeClaim:
+          claimName: smb-oldseries
+        name: oldseries
      - hostPath:
          path: /dev/dri
          type: Directory
--- a/apps-kustomized/jellyfin/pvc-smb.yaml
+++ b/apps-kustomized/jellyfin/pvc-smb.yaml
@ -1,5 +1,29 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
+metadata:
+  name: smb-series
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: smb-series
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: smb-oldseries
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: smb-oldseries
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
  name: smb-music
 spec:
--- a/apps-kustomized/jellyseerr/ingress.yaml
+++ b/apps-kustomized/jellyseerr/ingress.yaml
@ -23,3 +23,4 @@ spec:
  tls:
  - hosts:
    - requests.martyn.berlin
+    secretName: requests-tls
--- a/apps-kustomized/kube-prometheus/grafana-deployment.yaml
+++ b/apps-kustomized/kube-prometheus/grafana-deployment.yaml
@ -32,7 +32,7 @@ spec:
      automountServiceAccountToken: false
      containers:
        - env: []
-          image: grafana/grafana:9.5.21
+          image: grafana/grafana:9.5.3
          name: grafana
          ports:
            - containerPort: 3000
--- a/apps-kustomized/lidarr/deploy.yaml
+++ b/apps-kustomized/lidarr/deploy.yaml
@ -18,7 +18,7 @@ spec:
        app: lidarr
    spec:
      containers:
-      - image: hotio/lidarr:release-2.9.6.4552
+      - image: hotio/lidarr:release
        name: lidarr
        resources:
          requests:
--- a/apps-kustomized/lms/statefulset.yaml
+++ b/apps-kustomized/lms/statefulset.yaml
@ -19,7 +19,7 @@ spec:
        app.kubernetes.io/name: logitech-media-server
    spec:
      containers:
-      - image: lmscommunity/lyrionmusicserver:9.1.0
+      - image: doliana/logitech-media-server:2021_11_06-8.2.0
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 10
--- a/apps-kustomized/nextcloud/ingress.yaml
+++ b/apps-kustomized/nextcloud/ingress.yaml
@ -25,3 +25,4 @@ spec:
  tls:
  - hosts:
    - nextcloud.martyn.berlin
+    secretName: nextcloud-tls
--- a/apps-kustomized/node-feature-discovery/kustomization.yaml
+++ b/apps-kustomized/node-feature-discovery/kustomization.yaml
@ -10,7 +10,7 @@ helmCharts:
  includeCRDs: true
  namespace: node-feature-discovery
  releaseName: node-feature-discovery
-  version: 0.17.2
+  version: 0.16.6
  repo: https://kubernetes-sigs.github.io/node-feature-discovery/charts
  valuesInLine:
    master:
--- a/apps-kustomized/prowlarr/deploy.yaml
+++ b/apps-kustomized/prowlarr/deploy.yaml
@ -16,7 +16,7 @@ spec:
        app: prowlarr
    spec:
      containers:
-      - image: hotio/prowlarr:release-1.31.2.4975
+      - image: hotio/prowlarr:release-1.26.1.4844
        imagePullPolicy: Always
        name: prowlarr
        ports:
--- a/apps-kustomized/radarr/deploy.yaml
+++ b/apps-kustomized/radarr/deploy.yaml
@ -18,7 +18,7 @@ spec:
        app: radarr
    spec:
      containers:
-      - image: hotio/radarr:release-5.19.3.9730
+      - image: hotio/radarr:release
        imagePullPolicy: IfNotPresent
        name: radarr
        ports:
--- a/apps-kustomized/sabnzbd/deploy.yaml
+++ b/apps-kustomized/sabnzbd/deploy.yaml
@ -16,7 +16,7 @@ spec:
        app: sabnzbd
    spec:
      containers:
-      - image: lscr.io/linuxserver/sabnzbd:4.4.1
+      - image: lscr.io/linuxserver/sabnzbd:latest
        imagePullPolicy: Always
        name: sabnzbd
        terminationMessagePath: /dev/termination-log
--- a/apps-kustomized/ser2net/ser2net-zigbee.yaml
+++ b/apps-kustomized/ser2net/ser2net-zigbee.yaml
@ -38,7 +38,7 @@ metadata:
  annotations:
    configmap.reloader.stakater.com/reload: "ser2net"
 spec:
-  replicas: 0
+  replicas: 1
  strategy:
    type: Recreate
  selector:
--- a/apps-kustomized/smb-storageclasses/sc-films.yaml
+++ b/apps-kustomized/smb-storageclasses/sc-films.yaml
@ -4,7 +4,7 @@ metadata:
  name: smb-films
 provisioner: smb.csi.k8s.io
 parameters:
-  source: "//172.20.0.70/films"
+  source: "//172.20.0.125/films"
  csi.storage.k8s.io/node-stage-secret-name: smb-creds
  csi.storage.k8s.io/node-stage-secret-namespace: kube-system
 reclaimPolicy: Retain
--- a/apps-kustomized/smb-storageclasses/sc-oldseries.yaml
+++ b/apps-kustomized/smb-storageclasses/sc-oldseries.yaml
@ -0,0 +1,17 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: smb-oldseries
+provisioner: smb.csi.k8s.io
+parameters:
+  source: "//hp40l/disk2/oldseries"
+  csi.storage.k8s.io/node-stage-secret-name: smb-creds
+  csi.storage.k8s.io/node-stage-secret-namespace: kube-system
+reclaimPolicy: Retain
+volumeBindingMode: Immediate
+mountOptions:
+  - dir_mode=0777
+  - file_mode=0777
+  - uid=1001
+  - gid=1001
+  - noperm
--- a/apps-kustomized/smb-storageclasses/sc-series.yaml
+++ b/apps-kustomized/smb-storageclasses/sc-series.yaml
@ -4,7 +4,7 @@ metadata:
  name: smb-series
 provisioner: smb.csi.k8s.io
 parameters:
-  source: "//172.20.0.70/series"
+  source: "//hp40l/disk2/series"
  csi.storage.k8s.io/node-stage-secret-name: smb-creds
  csi.storage.k8s.io/node-stage-secret-namespace: kube-system
 reclaimPolicy: Retain
--- a/apps-kustomized/sonarr/deploy.yaml
+++ b/apps-kustomized/sonarr/deploy.yaml
@ -16,7 +16,7 @@ spec:
        app: sonarr
    spec:
      containers:
-      - image: hotio/sonarr:release-4.0.13.2932
+      - image: hotio/sonarr:release-4.0.1.929
        imagePullPolicy: Always
        name: sonarr
        ports:
@ -32,6 +32,8 @@ spec:
          name: config
        - mountPath: /data
          name: data
+        - mountPath: /series
+          name: series
        - mountPath: /combinedseries
          name: combinedseries
      dnsPolicy: ClusterFirst
@ -42,6 +44,9 @@ spec:
      - name: config
        persistentVolumeClaim:
          claimName: sonarr-config-data
+      - name: series
+        persistentVolumeClaim:
+          claimName: smb-series
      - name: combinedseries
        persistentVolumeClaim:
          claimName: smb-combinedseries
--- a/apps-kustomized/sonarr/pvc-smb.yaml
+++ b/apps-kustomized/sonarr/pvc-smb.yaml
@ -1,5 +1,17 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
+metadata:
+  name: smb-series
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: smb-series
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
  name: smb-combinedseries
 spec:
--- a/apps-kustomized/tailscale-proxy/configmap.yaml
+++ b/apps-kustomized/tailscale-proxy/configmap.yaml
@ -1,13 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: tailscale-script
-data:
-  script.sh: |
-    tailscaled --socks5-server=localhost:1055 --outbound-http-proxy-listen=localhost:1055 --tun=userspace-networking &
-    tailscale up --authkey=$TS_AUTHKEY --advertise-tags=tag:k8s --hostname k8s-tailscale-proxy &
-    sleep 3
-    echo "Waiting for $COUNTRY to do something"
-    while ! tailscale exit-node list 2>/dev/null | grep $COUNTRY >/dev/null; do echo -n . ;sleep 5; done
-    tailscale set --exit-node $(tailscale exit-node list | grep $COUNTRY | cut -f2 -d' ' | shuf | head -n1)
-    while true; do sleep 1; done
--- a/apps-kustomized/tailscale-proxy/deploy.yaml
+++ b/apps-kustomized/tailscale-proxy/deploy.yaml
@ -1,100 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: tailscale-proxy
-  name: tailscale-proxy
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: tailscale-proxy
-  strategy:
-    rollingUpdate:
-      maxSurge: 25%
-      maxUnavailable: 25%
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: tailscale-proxy
-    spec:
-      containers:
-      - command:
-        - /bin/sh
-        - -c
-        - 'sh /script/script.sh'
-        env:
-        - name: TS_KUBE_SECRET
-          value: tailscale
-        - name: COUNTRY
-          value: Switzerland
-        - name: TS_AUTHKEY
-          valueFrom:
-            secretKeyRef:
-              key: TS_AUTHKEY
-              name: tailscale-auth
-        image: ghcr.io/tailscale/tailscale:v1.80.3
-        imagePullPolicy: IfNotPresent
-        startupProbe:
-          exec:
-            command:
-              - /bin/sh
-              - -c
-              - tailscale ip | grep ^100 > /dev/null
-          periodSeconds: 30
-          failureThreshold: 30
-        livenessProbe:
-          exec:
-            command:
-              - /bin/sh
-              - -c
-              - tailscale ip | grep ^100 > /dev/null
-          periodSeconds: 30
-          failureThreshold: 2
-        readinessProbe:
-          exec:
-            command:
-              - /bin/sh
-              - -c
-              - http_proxy=127.0.0.1:1055 wget -O- ifconfig.co/country 2>&1 | grep $COUNTRY > /dev/null
-          initialDelaySeconds: 60
-          periodSeconds: 60
-          failureThreshold: 3
-        name: tailscale
-        securityContext:
-          privileged: true
-          runAsGroup: 0
-          runAsUser: 0
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-        volumeMounts:
-        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
-          name: kube-api-access-t4rzn
-          readOnly: true
-        - mountPath: /script
-          name: script
-      serviceAccount: tailscale
-      serviceAccountName: tailscale
-      volumes:
-      - name: script
-        configMap:
-          name: tailscale-script
-      - name: kube-api-access-t4rzn
-        projected:
-          defaultMode: 420
-          sources:
-          - serviceAccountToken:
-              expirationSeconds: 3607
-              path: token
-          - configMap:
-              items:
-              - key: ca.crt
-                path: ca.crt
-              name: kube-root-ca.crt
-          - downwardAPI:
-              items:
-              - fieldRef:
-                  apiVersion: v1
-                  fieldPath: metadata.namespace
-                path: namespace
--- a/apps-kustomized/tailscale-proxy/sa.yaml
+++ b/apps-kustomized/tailscale-proxy/sa.yaml
@ -1,4 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: tailscale
--- a/apps-kustomized/tailscale-proxy/svc.yaml
+++ b/apps-kustomized/tailscale-proxy/svc.yaml
@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: tailscale-proxy
-    app.kubernetes.io/instance: tailscale-proxy
-  name: tailscale-proxy
-spec:
-  ports:
-  - port: 1055
-    protocol: TCP
-    targetPort: 1055
-  selector:
-    app: tailscale-proxy
-  type: LoadBalancer
--- a/apps-kustomized/torrents/deploy.yaml
+++ b/apps-kustomized/torrents/deploy.yaml
@ -14,7 +14,6 @@ spec:
      labels:
        app: qbittorrent
    spec:
-      initContainers:
      containers:
      - image: qbittorrentofficial/qbittorrent-nox:latest
        name: qbittorrent
@ -35,6 +34,40 @@ spec:
          value: "/config"
        - name: QBT_DOWNLOADS
          value: "/downloads"
+      - env:
+        - name: TS_KUBE_SECRET
+          value: tailscale
+        - name: TS_USERSPACE
+          value: "false"
+        - name: TS_OUTBOUND_HTTP_PROXY_LISTEN
+          value: "localhost:1055"
+        - name: TS_SOCKS5_SERVER
+          value: "localhost:1055"
+        - name: TS_EXTRA_ARGS
+          value: "--exit-node=100.90.55.121"
+        - name: TS_AUTHKEY
+          valueFrom:
+            secretKeyRef:
+              key: TS_AUTHKEY
+              name: tailscale-auth
+              optional: true
+        livenessProbe:
+          exec:
+            command:
+            - ping
+            - -c1
+            - 100.100.100.100
+          initialDelaySeconds: 120
+          periodSeconds: 5
+        image: ghcr.io/tailscale/tailscale:latest
+        name: ts-sidecar
+        securityContext:
+          runAsGroup: 1000
+          runAsUser: 1000
+        volumeMounts:
+        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+          name: kube-api-access-t4rzn
+          readOnly: true
      preemptionPolicy: PreemptLowerPriority
      priority: 0
      serviceAccountName: tailscale
--- a/apps-kustomized/whoogle/deploy.yaml
+++ b/apps-kustomized/whoogle/deploy.yaml
@ -24,7 +24,7 @@ spec:
          value: en
        - name: WHOOGLE_CONFIG_SEARCH_LANGUAGE
          value: en
-        image: benbusby/whoogle-search@sha256:5bbb30fc4cf67563b48529c5291813b3d49c290e1e8b9e3aaa5081e9cb6e40c0
+        image: benbusby/whoogle-search@sha256:ecccdb598f890140bf5564ea0307d3a72871ab3d14fbf22e308b904846e5c590
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
--- a/apps-kustomized/writefreely/ingress.yaml
+++ b/apps-kustomized/writefreely/ingress.yaml
@ -23,3 +23,4 @@ spec:
  tls:
  - hosts:
    - musings.martyn.berlin
+    secretName: musings-tls
--- a/apps-kustomized/zigbee2mqtt2/pvc.yaml
+++ b/apps-kustomized/zigbee2mqtt2/pvc.yaml
@ -8,4 +8,4 @@ spec:
  storageClassName: longhorn-fast
  resources:
    requests:
-      storage: 1280Mi
+      storage: 128Mi
--- a/everything-app/app-ingress-nginx.yaml
+++ b/everything-app/app-ingress-nginx.yaml
@ -11,13 +11,9 @@ spec:
  source:
    chart: ingress-nginx
    repoURL: https://kubernetes.github.io/ingress-nginx
-    targetRevision: 4.12.0
+    targetRevision: 4.8.3
    helm:
      parameters:
-      - name: controller.ingressClassResource.default
-        value: "true"
-      - name: controller.config.annotations-risk-level
-        value: "Critical"
      - name: controller.service.type
        value: LoadBalancer
      - name: controller.allowSnippetAnnotations
@ -28,15 +24,6 @@ spec:
        value: "351198544"
      - name: controller.extraArgs.default-ssl-certificate
        value: "cluster-ingress/cluster-ingress-wildcard"
-      - name: controller.config.http-snippet
-        value: |-
-          more_set_headers -a "X-Robots-Tag: noai";
-          more_set_headers -a "X-Robots-Tag: Google-Extended: none";
-          more_set_headers -a "X-Robots-Tag: GPTBot: none";
-          more_set_headers -a "X-Robots-Tag: ChatGPT-User: none";
-          more_set_headers -a "X-Robots-Tag: anthropic-ai: none";
-          more_set_headers -a "X-Robots-Tag: CCBot: none";
-          more_set_headers -a "X-Robots-Tag: semrushbot: none";
  syncPolicy:
    automated:
      selfHeal: true
--- a/everything-app/app-letsencrypt.yaml
+++ b/everything-app/app-letsencrypt.yaml
@ -11,7 +11,7 @@ spec:
  source:
    chart: cert-manager
    repoURL: https://charts.jetstack.io
-    targetRevision: v1.17.1
+    targetRevision: v1.13.1
    helm:
      parameters:
      - name: installCRDs
--- a/everything-app/bikerwitch.yaml
+++ b/everything-app/bikerwitch.yaml
@ -0,0 +1,45 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: bikerwitch
+  namespace: argocd
+spec:
+  destination:
+    namespace: bikerwitch
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    helm:
+      parameters:
+      - name: service.type
+        value: LoadBalancer
+      - name: persistence.enabled
+        value: "true"
+      - name: persistence.storageClass
+        value: "longhorn-fast"
+      - name: image.repository
+        value: drupal
+      - name: image.tag
+        value: 9.4-php8.0-apache
+      values: |-
+        ingress:
+          enabled: true
+          annotations:
+            cert-manager.io/cluster-issuer: letsencrypt
+            kubernetes.io/ingress.class: nginx
+            external-dns.alpha.kubernetes.io/target: armnleg.martyn.berlin
+          hosts:
+          - host: bikerwitch.martyn.berlin
+            paths:
+            - /
+          - host: www.bikerwitch.org.uk
+            paths:
+            - /
+          tls:
+          - secretName: bikerwitch-tls
+            hosts:
+            - bikerwitch.martyn.berlin
+            - www.bikerwitch.org.uk
+    path: apps-helm/drupal
+    repoURL: https://git.martyn.berlin/martyn/infra4talos.git
+    targetRevision: HEAD
--- a/everything-app/csi4samba.yaml
+++ b/everything-app/csi4samba.yaml
@ -11,7 +11,7 @@ spec:
  source:
    chart: csi-driver-smb
    repoURL: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/charts
-    targetRevision: v1.17.0
+    targetRevision: v1.13.0
  syncPolicy:
    automated:
      selfHeal: true
--- a/everything-app/garage.yaml
+++ b/everything-app/garage.yaml
@ -41,6 +41,7 @@ spec:
              tls:
              - hosts:
                - "s3.files.martyn.berlin"
+                secretName: s3-le-secret
              hosts:
              - host: s3.files.martyn.berlin
                paths:
@ -55,6 +56,7 @@ spec:
              tls:
              - hosts:
                - "files.martyn.berlin"
+                secretName: files-le-secret
              hosts:
              - host: files.martyn.berlin
                paths:
--- a/everything-app/longhorn.yaml
+++ b/everything-app/longhorn.yaml
@ -25,7 +25,7 @@ spec:
        value: "false"
    chart: longhorn
    repoURL: https://charts.longhorn.io
-    targetRevision: 1.6.4
+    targetRevision: 1.6.0
  syncPolicy:
    automated:
      selfHeal: true
--- a/everything-app/ntfy.yaml
+++ b/everything-app/ntfy.yaml
@ -46,7 +46,8 @@ spec:
            - path: /
              pathType: Prefix
          tls:
-          - hosts:
+          - secretName: ntfy-tls
+            hosts:
            - ntfy.martyn.berlin

        ntfy:
--- a/everything-app/samba-slow-big.yaml
+++ b/everything-app/samba-slow-big.yaml
@ -24,16 +24,6 @@ spec:
          users:
          - username: martyn
            password: "564628"
-        affinity:
-          nodeAffinity:
-            preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 1
-              preference:
-                matchExpressions:
-                - key: kubernetes.io/hostname
-                  operator: In
-                  values:
-                  - talos-llu-kx3
        persistence:
          combineShares: true
          sharesToCombine:
--- a/everything-app/tailscale-proxy.yaml
+++ b/everything-app/tailscale-proxy.yaml
@ -1,17 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: tailscale-proxy
-  namespace: argocd
-spec:
-  destination:
-    namespace: tailscale-proxy
-    server: https://kubernetes.default.svc
-  project: apps
-  source:
-    path: apps-kustomized/tailscale-proxy
-    repoURL: https://git.martyn.berlin/martyn/infra4talos
-    targetRevision: HEAD
-  syncPolicy:
-    automated:
-      selfHeal: true
--- a/renovate.json
+++ b/renovate.json
@ -1,12 +1,3 @@
 {
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "argocd": {
-	  "fileMatch": ["everything-app/.+\\.yaml$"]
-  },
-  "kubernetes": {
-	  "fileMatch": [
-		  "apps-kustomized/.+\\.yaml$",
-		  "apps-helm/.+/tempates/.+\\.yaml"
-	  ]
-  }
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
 }