fix: renovate token (#7)

Co-authored-by: Renovate Bot <renovate@whitesourcesoftware.com>

.github/workflows/renovate.yml

@@ -0,0 +1,15 @@
+name: Renovate
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 */6 * * *"
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@v40.2.2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -1,3 +1,4 @@
 /secret.*.yaml
 /data/
-*.DS_Store
+/.envrc
+*.DS_Store

charts/apps/apprise/values.yaml

@@ -4,6 +4,6 @@ globals:
   domain: olsen.cloud
 image:
   repository: docker.io/caronc/apprise
-  tag: latest
+  tag: latest@sha256:127b3834f0679502529397ead8ffeaadf5189019c4c863fa6652e9b942fdccf8
   pullPolicy: IfNotPresent
 subdomain: apprise

charts/apps/audiobookshelf/values.yaml

@@ -2,6 +2,6 @@ globals:
   environment: prod
 image:
   repository: ghcr.io/advplyr/audiobookshelf
-  tag: 2.26.1
+  tag: 2.26.1@sha256:5901162ccdf4b44f563ff2012484d5e315d9a1ecd6af86f7fe605ec96bbc5039
   pullPolicy: IfNotPresent
 subdomain: audiobookshelf

charts/apps/baikal/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: esphome

charts/apps/baikal/templates/database.yaml

@@ -0,0 +1,6 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: PostgresDatabase
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'

charts/apps/baikal/templates/deployment.yaml

@@ -0,0 +1,46 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}"
+    spec:
+      containers:
+        - name: "{{ .Release.Name }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: "{{ .Values.image.pullPolicy }}"
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+          env:
+            - name: TZ
+              value: "{{ .Values.globals.timezone }}"
+          volumeMounts:
+            - mountPath: /var/www/baikal/Specific
+              name: data
+            - mountPath: /var/www/baikal/config
+              name: config
+
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: "{{ .Release.Name }}-data"
+        - name: config
+          persistentVolumeClaim:
+            claimName: "{{ .Release.Name }}-config"

charts/apps/baikal/templates/external-http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/baikal/templates/http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}"
+    port:
+      number: 80

charts/apps/baikal/templates/pvc.yaml

@@ -0,0 +1,24 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: "{{ .Release.Name }}-data"
+spec:
+  accessModes:
+    - "ReadWriteOnce"
+  resources:
+    requests:
+      storage: "1Gi"
+  storageClassName: "{{ .Values.globals.environment }}"
+
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: "{{ .Release.Name }}-config"
+spec:
+  accessModes:
+    - "ReadWriteOnce"
+  resources:
+    requests:
+      storage: "1Gi"
+  storageClassName: "{{ .Values.globals.environment }}"

charts/apps/baikal/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 80
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}"

charts/apps/baikal/values.yaml

@@ -0,0 +1,9 @@
+globals:
+  environment: prod
+  timezone: Europe/Amsterdam
+  domain: olsen.cloud
+image:
+  repository: docker.io/ckulka/baikal
+  tag: nginx@sha256:27bd9afbb8142c2143b6959c023074b05c86356ded0f589fcb1424ab5fbe0a70
+  pullPolicy: IfNotPresent
+subdomain: baikal

charts/apps/calibre-web/values.yaml

@@ -4,6 +4,6 @@ globals:
   timezone: Europe/Amsterdam
 image:
   repository: lscr.io/linuxserver/calibre-web
-  tag: latest
+  tag: latest@sha256:a833d4cf90333f167871fe6ab1f034c7be7bc3d2061a1563fdb6a8fa27af346e
   pullPolicy: IfNotPresent
 subdomain: calibre-web

charts/apps/coder/values.yaml

@@ -2,6 +2,6 @@ globals:
   environment: prod
 image:
   repository: ghcr.io/coder/coder
-  tag: latest
+  tag: latest@sha256:73714e0685addde01bbff905cf5b647d6b677d77977c8009b6293d40fdf0f562
   pullPolicy: IfNotPresent
 subdomain: coder

charts/apps/esphome/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: esphome

charts/apps/esphome/templates/deployment.yaml

@@ -0,0 +1,42 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}"
+    spec:
+      hostNetwork: true
+      containers:
+        - name: "{{ .Release.Name }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: "{{ .Values.image.pullPolicy }}"
+          ports:
+            - name: http
+              containerPort: 6052
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+          env:
+            - name: TZ
+              value: "{{ .Values.globals.timezone }}"
+          volumeMounts:
+            - mountPath: /config
+              name: data
+
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: "{{ .Release.Name }}-data"

charts/apps/esphome/templates/http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}"
+    port:
+      number: 80

charts/apps/esphome/templates/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ .Release.Name }}-data'
+spec:
+  accessModes:
+    - 'ReadWriteOnce'
+  resources:
+    requests:
+      storage: '1Gi'
+  storageClassName: '{{ .Values.globals.environment }}'

charts/apps/esphome/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 6052
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}"

charts/apps/esphome/values.yaml

@@ -0,0 +1,9 @@
+globals:
+  environment: prod
+  timezone: Europe/Amsterdam
+  domain: olsen.cloud
+image:
+  repository: ghcr.io/esphome/esphome
+  tag: latest@sha256:393775c4c02e0b09d086cd794815a723f90d4af7c3d871935e22be1a34c5d89a
+  pullPolicy: IfNotPresent
+subdomain: esphome

charts/apps/gitea/values.yaml

@@ -3,6 +3,6 @@ globals:
   timezone: Europe/Amsterdam
 image:
   repository: docker.gitea.com/gitea
-  tag: latest
+  tag: latest@sha256:2edc102cbb636ae1ddac5fa0c715aa5b03079dee13ac6800b2cef6d4e912e718
   pullPolicy: IfNotPresent
 subdomain: gitea

charts/apps/headscale/values.yaml

@@ -2,6 +2,6 @@ globals:
   environment: prod
 image:
   repository: headscale/headscale
-  tag: latest
+  tag: latest@sha256:ea9b5ee06274d757a4d52103de56cd11a9c393acb19d9a35f4b9fe52ada410de
   pullPolicy: IfNotPresent
 subdomain: headscale

charts/apps/homarr/values.yaml

@@ -2,6 +2,6 @@ globals:
   environment: prod
 image:
   repository: ghcr.io/homarr-labs/homarr
-  tag: latest
+  tag: latest@sha256:7d58149aa544037d173a48f41fbde86706068d2b8933a33a911dce26457ecf16
   pullPolicy: IfNotPresent
 subdomain: homarr

charts/apps/home-assistant/templates/deployment.yaml

@@ -15,6 +15,7 @@ spec:
         app: "{{ .Release.Name }}"
     spec:
       hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
 
       containers:
         - name: "{{ .Release.Name }}"

charts/apps/home-assistant/templates/piper.yaml

@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}-piper"
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}-piper"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}-piper"
+    spec:
+      hostNetwork: true
+
+      containers:
+        - name: "{{ .Release.Name }}-piper"
+          image: "{{ .Values.piper.image.repository }}:{{ .Values.piper.image.tag }}"
+          imagePullPolicy: "{{ .Values.piper.image.pullPolicy }}"
+          args:
+            - --piper
+            - /usr/share/piper/piper
+            - --data-dir
+            - /usr/share/piper-voices
+            - --voice
+            - "{{ .Values.piper.model }}"
+          env:
+            - name: TZ
+              value: "{{ .Values.globals.timezone }}"
+          ports:
+            - name: http
+              containerPort: 10200
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}-piper"
+  labels:
+    app: "{{ .Release.Name }}-piper"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 10200
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}-piper"

charts/apps/home-assistant/templates/whisper.yaml

@@ -0,0 +1,57 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}-whisper"
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}-whisper"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}-whisper"
+    spec:
+      hostNetwork: true
+
+      containers:
+        - name: "{{ .Release.Name }}-whisper"
+          image: "{{ .Values.whisper.image.repository }}:{{ .Values.whisper.image.tag }}"
+          imagePullPolicy: "{{ .Values.whisper.image.pullPolicy }}"
+          args:
+            - --model
+            - "{{ .Values.whisper.model }}"
+            - --language
+            - "{{ .Values.whisper.language }}"
+          env:
+            - name: TZ
+              value: "{{ .Values.globals.timezone }}"
+          ports:
+            - name: http
+              containerPort: 10300
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}-whisper"
+  labels:
+    app: "{{ .Release.Name }}-whisper"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 10300
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}-whisper"

charts/apps/home-assistant/values.yaml

@@ -3,6 +3,19 @@ globals:
   timezone: Europe/Amsterdam
 image:
   repository: ghcr.io/home-assistant/home-assistant
-  tag: stable
+  tag: stable@sha256:37af5e84627dc6cc4f8ce2de631cca7ee1fc76c908b429b3a8c1ec46f246a5fe
   pullPolicy: IfNotPresent
 subdomain: home-assistant
+piper:
+  image:
+    repository: ghcr.io/morten-olsen/glados-voice
+    tag: main@sha256:8fcc19bd9e7e846bdfd9e9e569c8c944dcfb1d0b47e3f479cbaa7f5587c7206c
+    pullPolicy: Always
+  model: en_US-glados-medium
+whisper:
+  image:
+    repository: rhasspy/wyoming-whisper
+    tag: latest@sha256:f03456914affe8076fc7688c0890f4c708d93ebfac7340b0b2467f721412012d
+    pullPolicy: IfNotPresent
+  model: tiny-int8
+  language: us

charts/apps/install.sh

@@ -0,0 +1,12 @@
+set -euo pipefail
+
+find . -name "values.yaml" -type f -print0 | while IFS= read -r -d '' values_file; do
+  location=$(dirname "$values_file")
+  name=$(basename "$location")
+  name=$(echo "$name" | tr '[:upper:]' '[:lower:]' | tr -s '[:punct:][:space:]' '-' | sed -e 's/^-*//' -e 's/-*$//')
+
+  echo "✅ Chart found in: $location"
+  echo "   - Generated release name: $name"
+  HELM_COMMAND="helm install --namespace prod \"$name\" \"$location\""
+  helm upgrade -i --namespace prod "$name" "$location"
+done

charts/apps/jellyfin/templates/config-pvc.yaml

@@ -1,11 +1,11 @@
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
-  name: '{{ .Release.Name }}-config'
+  name: "{{ .Release.Name }}-config"
 spec:
   accessModes:
-    - 'ReadWriteOnce'
+    - "ReadWriteOnce"
   resources:
     requests:
-      storage: '1Gi'
+      storage: "1Gi"
-  storageClassName: '{{ .Values.environment }}'
+  storageClassName: "{{ .Values.globals.environment }}"

charts/apps/jellyfin/values.yaml

@@ -2,6 +2,6 @@ globals:
   environment: prod
 image:
   repository: docker.io/jellyfin/jellyfin
-  tag: latest
+  tag: latest@sha256:7ae36aab93ef9b6aaff02b37f8bb23df84bb2d7a3f6054ec8fc466072a648ce2
   pullPolicy: IfNotPresent
 subdomain: jellyfin

charts/apps/mealie/values.yaml

@@ -5,4 +5,4 @@ globals:
 subdomain: mealie
 image:
   repository: ghcr.io/mealie-recipes/mealie
-  tag: latest
+  tag: latest@sha256:d872fb529097df2d77b3c6f5e469b047f99d0d1c9f793a84ae27aa106e1f5d7e

charts/apps/metamcp/values.yaml

@@ -3,6 +3,6 @@ globals:
   timezone: Europe/Amsterdam
 image:
   repository: ghcr.io/metatool-ai/metamcp
-  tag: latest
+  tag: latest@sha256:09e467e3ac40132f4ee11407e792ca5767894b0909d56c270223bdfe64dfcfd2
   pullPolicy: IfNotPresent
 subdomain: metamcp

charts/apps/miniflux/values.yaml

@@ -4,6 +4,6 @@ globals:
   domain: olsen.cloud
 image:
   repository: ghcr.io/miniflux/miniflux
-  tag: latest
+  tag: latest@sha256:b435a1ea2408f996c8d4c00c4f46523fa9203971ee1e85b1fe7ad3f0e7ae617f
   pullPolicy: IfNotPresent
 subdomain: miniflux

charts/apps/mqtt/values.yaml

@@ -4,7 +4,7 @@ globals:
   domain: olsen.cloud
 image:
   repository: docker.io/eclipse-mosquitto
-  tag: latest
+  tag: latest@sha256:d219d3a72847f3aed6a1d66975972d3b17f86e39e8f6f6b86b4088b879c1a2d6
   pullPolicy: IfNotPresent
 subdomain: mqtt
 mode: json-rpc

charts/apps/music-assistant/values.yaml

@@ -2,6 +2,6 @@ globals:
   environment: prod
 image:
   repository: ghcr.io/music-assistant/server
-  tag: latest
+  tag: latest@sha256:f534116c53d49b3120961c908a5fa24f28684806bf222ccd74add9e16b105aa4
   pullPolicy: IfNotPresent
 subdomain: music-assistant

charts/apps/n8n/values.yaml

@@ -4,6 +4,6 @@ globals:
   domain: olsen.cloud
 image:
   repository: docker.n8n.io/n8nio/n8n
-  tag: latest
+  tag: latest@sha256:6c0c7650150a3fb0fd30d13160a87b5227963c36c9297b5bda618bcadfcee932
   pullPolicy: IfNotPresent
 subdomain: n8n

charts/apps/ollama/values.yaml

@@ -2,6 +2,6 @@ globals:
   environment: prod
 image:
   repository: ollama/ollama
-  tag: 0.11.8
+  tag: 0.11.8@sha256:03eaa1581455ba16e7c954d799e4f44996b60ae668261acd00a0e80a241ed720
   pullPolicy: IfNotPresent
 subdomain: openwebui

charts/apps/openwebui/values.yaml

@@ -2,6 +2,6 @@ globals:
   environment: prod
 image:
   repository: ghcr.io/open-webui/open-webui
-  tag: main
+  tag: main@sha256:2e78a2f9f6f62173ae28d2203f3c9bcdadc614023380ebbe903ea9fab772535e
   pullPolicy: IfNotPresent
 subdomain: openwebui

charts/apps/photoprism/values.yaml

@@ -2,6 +2,6 @@ globals:
   environment: prod
 image:
   repository: photoprism/photoprism
-  tag: latest
+  tag: latest@sha256:2ba3a774ca1acc498096d7a5cb50df9cfecb7e3117a617d648093ff74eec2793
   pullPolicy: IfNotPresent
 subdomain: photoprism

charts/apps/readeck/values.yaml

@@ -4,6 +4,6 @@ globals:
   timezone: Europe/Amsterdam
 image:
   repository: codeberg.org/readeck/readeck
-  tag: latest
+  tag: latest@sha256:2fc8c3ce875db68fbfdc6cdd517a9315b14be65867116ffac26997e800def0ca
   pullPolicy: IfNotPresent
 subdomain: readeck

charts/apps/signal/values.yaml

@@ -4,7 +4,7 @@ globals:
   domain: olsen.cloud
 image:
   repository: bbernhard/signal-cli-rest-api
-  tag: latest
+  tag: latest@sha256:e4bc92213b2a4da10fc429d16ed1754e90c2c169f186efbb9ce5f04da5322771
   pullPolicy: IfNotPresent
 subdomain: apprise
 mode: json-rpc

charts/apps/zot/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: zot

charts/apps/zot/templates/client.yaml

@@ -0,0 +1,10 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  redirectUris:
+    - path: /zot/auth/callback/oidc
+      subdomain: "{{ .Values.subdomain }}"
+      matchingMode: strict

charts/apps/zot/templates/config-map.yaml

@@ -0,0 +1,96 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-config-template
+data:
+  secrets.tpl.json: |
+    {
+      "clientid": "${CLIENT_ID}",
+      "clientsecret": "${CLIENT_SECRET}"
+    }
+  config.tpl.json: |
+    {
+      "storage": {
+        "rootDirectory": "/var/lib/registry",
+        "commit": false,
+        "dedupe": true,
+        "gc": true,
+        "gcDelay": "1h",
+        "gcInterval": "24h"
+      },
+      "log": {
+        "level": "info"
+      },
+      "http": {
+        "address": "0.0.0.0",
+        "port": "5000",
+        "externalUrl": "https://{{ .Values.subdomain }}.{{ .Values.globals.domain }}",
+        "ratelimit": {
+          "rate": 10,
+          "methods": [
+              {
+                  "method": "GET",
+                  "rate": 20
+              }
+          ]
+        },
+        "auth": {
+          "failDelay": 5,
+          "htpasswd": {
+            "path": "/etc/zot/htpasswd"
+          },
+          "openid": {
+            "providers": {
+              "oidc": {
+                "name": "main",
+                "credentialsFile": "/etc/zot/secrets.json",
+                "issuer": "${ISSUER}",
+                "scopes": ["openid", "profile", "email"]
+              }
+            }
+          }
+        },
+        "accessControl": {
+          "adminPolicy": {
+            "groups": ["admin"],
+            "actions": ["read", "create", "update", "delete"]
+          },
+          "repositories": {
+            "public/**": {
+              "anonymousPolicy": ["read"],
+              "defaultPolicy": ["read"],
+              "policies": [
+                {
+                  "users": ["*"],
+                  "actions": ["create", "update", "delete"]
+                }
+              ]
+            },
+            "**": {
+              "defaultPolicy": ["read"],
+              "policies": [
+                {
+                  "users": ["*"],
+                  "actions": ["create", "update", "delete"]
+                }
+              ]
+            }
+          }
+        }
+      },
+      "extensions": {
+        "ui": { "enable": true },
+        "metrics": { "enable": true },
+        "search": { "enable": true },
+        "scrub": {
+          "enable": true,
+          "interval": "24h"
+        },
+        "trust": {
+          "enable": true,
+          "cosign": true,
+          "notation": true
+        }
+        
+      }
+    }

charts/apps/zot/templates/deployment.yaml

@@ -0,0 +1,104 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}"
+    spec:
+      initContainers:
+        - name: render-config
+          image: alpine:3.20
+          command: ["/bin/sh", "-c"]
+          env:
+            - name: ISSUER
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: configurationIssuer
+            - name: CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientId
+            - name: CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientSecret
+            - name: PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-cluster"
+                  key: password
+          args:
+            - |
+              apk add --no-cache gettext apache2-utils >/dev/null
+              envsubst < /config-tpl/config.tpl.json > /config-out/config.json
+              echo "Rendered /etc/zot/config.json"
+              echo "---------------------------------------"
+              cat /config-out/config.json
+              echo "---------------------------------------"
+              envsubst < /config-tpl/secrets.tpl.json > /config-out/secrets.json
+              echo "Rendered /etc/zot/secrets.json"
+              echo "---------------------------------------"
+              cat /config-out/secrets.json
+              echo "---------------------------------------"
+              htpasswd -nbB cluster "$PASSWORD" > /config-out/htpasswd
+          volumeMounts:
+            - name: config-tpl
+              mountPath: /config-tpl
+            - name: config
+              mountPath: /config-out
+      containers:
+        - name: "{{ .Release.Name }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          ports:
+            - containerPort: 5000
+              name: http
+          env:
+            - name: TZ
+              value: "{{ .Values.globals.timezone }}"
+            - name: BASE_URL
+              value: https://{{ .Values.subdomain }}.{{ .Values.globals.domain }}
+          volumeMounts:
+            - mountPath: /var/lib/registry
+              name: data
+            - mountPath: /etc/zot
+              name: config
+          # readinessProbe:
+          #   httpGet:
+          #     path: /v2/
+          #     port: http
+          #   initialDelaySeconds: 3
+          #   periodSeconds: 10
+          # livenessProbe:
+          #   httpGet:
+          #     path: /v2/
+          #     port: http
+          #   initialDelaySeconds: 10
+          #   periodSeconds: 20
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: "{{ .Release.Name }}-data"
+        - name: config-tpl
+          configMap:
+            name: {{ .Release.Name }}-config-template
+            items:
+              - key: config.tpl.json
+                path: config.tpl.json
+              - key: secrets.tpl.json
+                path: secrets.tpl.json
+        - name: config
+          emptyDir: {}

charts/apps/zot/templates/external-http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/zot/templates/http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}"
+    port:
+      number: 80

charts/apps/zot/templates/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ .Release.Name }}-data'
+spec:
+  accessModes:
+    - 'ReadWriteOnce'
+  resources:
+    requests:
+      storage: '1Gi'
+  storageClassName: '{{ .Values.globals.environment }}'

charts/apps/zot/templates/secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: GenerateSecret
+metadata:
+  name: "{{ .Release.Name }}-cluster"
+spec:
+  fields:
+    - name: password
+      encoding: hex
+      length: 64

charts/apps/zot/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 5000
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}"

charts/apps/zot/values.yaml

@@ -0,0 +1,8 @@
+globals:
+  environment: prod
+  domain: olsen.cloud
+  timezone: Europe/Amsterdam
+subdomain: zot
+image:
+  repository: ghcr.io/project-zot/zot
+  tag: latest@sha256:cd2aea942f428630bcb4190542be6abd35e14177aab84fc7ccad0dca8ecb363d

charts/backup/values.yaml

@@ -4,7 +4,7 @@ globals:
   domain: olsen.cloud
 image:
   repository: garethgeorge/backrest
-  tag: latest
+  tag: latest@sha256:f8306faef0a3cbedc7daa55756f1d4c105d8c104aa773656bdad4fa8553dab5a
   pullPolicy: IfNotPresent
 subdomain: restic
 password:

charts/operator/values.yaml

@@ -6,7 +6,7 @@ image:
   repository: ghcr.io/morten-olsen/homelab-operator
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: main
+  tag: main@sha256:752b25d3ef9711e72d63e936244dac03c6caa2dd1e00f49fb98238f2702f07a5
 
 imagePullSecrets: []
 nameOverride: ''

images/backup/Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine/git:latest
+FROM alpine/git:latest@sha256:9c9c6debba3eac25c9230db4bbd1e17d0c27efffdb93e502a47f6f447ab90ac4
 # or a more specific image like a Debian slim or Ubuntu base image.
 RUN apk add --no-cache restic fuse-overlayfs
 WORKDIR /app

images/operator/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:23-slim
+FROM node:23-slim@sha256:86191b94d2a163be41f3dc7fe5e5fcaca8ba2f1be7275d98a06343483c17414a
 RUN corepack enable
 COPY package.json pnpm-lock.yaml ./
 RUN pnpm install --frozen-lockfile --prod

images/operator/pnpm-lock.yaml

@@ -28,7 +28,7 @@ importers:
         version: 2.2.3
       dotenv:
         specifier: ^17.2.1
-        version: 17.2.1
+        version: 17.2.2
       eventemitter3:
         specifier: ^5.0.1
         version: 5.0.1
@@ -614,8 +614,8 @@ packages:
     resolution: {integrity: sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw==}
     engines: {node: '>=0.10.0'}
 
-  dotenv@17.2.1:
+  dotenv@17.2.2:
-    resolution: {integrity: sha512-kQhDYKZecqnM0fCnzI5eIv5L4cAe/iRI+HqMbO/hbRdTAeXDG+M9FjipUxNfbARuEg4iHIbhnhs78BCHNbSxEQ==}
+    resolution: {integrity: sha512-Sf2LSQP+bOlhKWWyhFsn0UsfdK/kCWRv1iuA2gXAwt3dyNabr6QSj00I2V10pidqz69soatm9ZwZvpQMTIOd5Q==}
     engines: {node: '>=12'}
 
   dunder-proto@1.0.1:
@@ -2651,7 +2651,7 @@ snapshots:
     dependencies:
       esutils: 2.0.3
 
-  dotenv@17.2.1: {}
+  dotenv@17.2.2: {}
 
   dunder-proto@1.0.1:
     dependencies:

renovate.json5

@@ -0,0 +1,26 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:base"
+  ],
+  "packageRules": [
+    {
+      "matchDatasources": ["docker"],
+      "pinDigests": true
+    }
+  ],
+  "helm-values": {
+    "fileMatch": ["^charts/.*/values\\.yaml$"]
+  },
+  "regexManagers": [
+    {
+      "fileMatch": ["^charts/.*/values\\.yaml$"],
+      "matchStrings": [
+        "repository:\s*'(?<depName>.*?)'\n\s*tag:\s*'(?<currentValue>.*?)'",
+        "repository:\s*\"(?<depName>.*?)\"\n\s*tag:\s*\"(?<currentValue>.*?)\"",
+        "repository:\s*(?<depName>.*?)\n\s*tag:\s*(?<currentValue>.*)"
+      ],
+      "datasourceTemplate": "docker"
+    }
+  ]
+}