chore(deps): update renovatebot/github-action action to v40.3.6 (#36)

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs
from Renovate will soon appear from 'Mend'. Learn more
[here](https://redirect.github.com/renovatebot/renovate/discussions/37842).

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[renovatebot/github-action](https://redirect.github.com/renovatebot/github-action)
| action | minor | `v40.2.2` -> `v40.3.6` |

---

### Release Notes

<details>
<summary>renovatebot/github-action (renovatebot/github-action)</summary>

###
[`v40.3.6`](https://redirect.github.com/renovatebot/github-action/releases/tag/v40.3.6)

[Compare
Source](https://redirect.github.com/renovatebot/github-action/compare/v40.3.5...v40.3.6)

##### Bug Fixes

- **refactor:** use named imports
([#&#8203;879](https://redirect.github.com/renovatebot/github-action/issues/879))
([4d91b7f](4d91b7f286))

##### Documentation

- Fix permissions for Renovate 39
([#&#8203;873](https://redirect.github.com/renovatebot/github-action/issues/873))
([80524aa](80524aad74))
- update references to ghcr.io/renovatebot/renovate to v39
([fa742b7](fa742b743c))

##### Miscellaneous Chores

- **deps:** update dependency
[@&#8203;semantic-release/github](https://redirect.github.com/semantic-release/github)
to v11
([#&#8203;876](https://redirect.github.com/renovatebot/github-action/issues/876))
([03986b7](03986b7c6b))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to v20.17.2
([9b8168b](9b8168b978))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to v20.17.3
([62e9650](62e9650d02))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to v20.17.4
([b274faf](b274faf2e8))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to v20.17.5
([de0fb82](de0fb82dde))
- **deps:** update dependency eslint-plugin-json to v4
([#&#8203;874](https://redirect.github.com/renovatebot/github-action/issues/874))
([205c9ef](205c9ef954))
- **deps:** update dependency npm-run-all2 to v7
([#&#8203;877](https://redirect.github.com/renovatebot/github-action/issues/877))
([7b3e4ff](7b3e4ffc56))
- **deps:** update typescript-eslint monorepo to v8 (major)
([#&#8203;878](https://redirect.github.com/renovatebot/github-action/issues/878))
([5343762](5343762d53))
- husky migration
([#&#8203;875](https://redirect.github.com/renovatebot/github-action/issues/875))
([c884ed2](c884ed2ba3))

##### Continuous Integration

- **deps:** update renovate docker tag to v38.142.7
([5bf87b6](5bf87b6eb9))

###
[`v40.3.5`](https://redirect.github.com/renovatebot/github-action/releases/tag/v40.3.5)

[Compare
Source](https://redirect.github.com/renovatebot/github-action/compare/v40.3.4...v40.3.5)

##### Documentation

- update references to actions/checkout to v4.2.2
([2097f2d](2097f2d2e6))
- update references to ghcr.io/renovatebot/renovate to v38.128.6
([41edd45](41edd45fab))
- update references to ghcr.io/renovatebot/renovate to v38.133.0
([e3f297f](e3f297f860))
- update references to ghcr.io/renovatebot/renovate to v38.142.5
([f4c795d](f4c795df8f))
- update references to renovatebot/github-action to v40.3.4
([cf47d93](cf47d93d80))

##### Miscellaneous Chores

- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to
v20.16.12
([2e9cb53](2e9cb53c91))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to
v20.16.13
([8232b6e](8232b6e373))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to
v20.16.14
([2aef521](2aef5215dc))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to
v20.16.15
([7916c56](7916c564b5))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to v20.17.0
([a64d972](a64d972955))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to v20.17.1
([f5083d0](f5083d0ec5))
- **deps:** update dependency npm-run-all2 to v6.2.4
([e788798](e7887981ef))
- **deps:** update dependency npm-run-all2 to v6.2.6
([ccced66](ccced66fcc))
- **deps:** update dependency semantic-release to v24.1.3
([d6beebf](d6beebf82a))
- **deps:** update dependency semantic-release to v24.2.0
([2b5b8b0](2b5b8b0616))
- **deps:** update pnpm to v9.12.2
([4b80937](4b8093706f))
- **deps:** update pnpm to v9.12.3
([550e7b3](550e7b3d66))

##### Build System

- **deps:** lock file maintenance
([f9b29f3](f9b29f3fb2))

##### Continuous Integration

- **deps:** update actions/checkout action to v4.2.2
([2bf9026](2bf9026999))
- **deps:** update actions/setup-node action to v4.1.0
([86ad664](86ad6647ad))
- **deps:** update renovate docker tag to v38.124.2
([695299e](695299e61b))
- **deps:** update renovate docker tag to v38.124.3
([314da6d](314da6dc23))
- **deps:** update renovate docker tag to v38.126.0
([85ae1f5](85ae1f5dbd))
- **deps:** update renovate docker tag to v38.127.0
([85e7f44](85e7f446e5))
- **deps:** update renovate docker tag to v38.127.3
([3edbc0c](3edbc0c27e))
- **deps:** update renovate docker tag to v38.128.1
([f8211ef](f8211efac0))
- **deps:** update renovate docker tag to v38.128.2
([d7b8776](d7b8776e44))
- **deps:** update renovate docker tag to v38.128.3
([2e30721](2e30721a59))
- **deps:** update renovate docker tag to v38.128.6
([a4b62ce](a4b62ce113))
- **deps:** update renovate docker tag to v38.129.1
([2262e7a](2262e7a3fc))
- **deps:** update renovate docker tag to v38.129.2
([c86af21](c86af211de))
- **deps:** update renovate docker tag to v38.130.0
([54af751](54af751146))
- **deps:** update renovate docker tag to v38.130.2
([000660f](000660fc56))
- **deps:** update renovate docker tag to v38.130.3
([b9dda2c](b9dda2cbfc))
- **deps:** update renovate docker tag to v38.130.4
([908a901](908a90193c))
- **deps:** update renovate docker tag to v38.131.0
([dd7bd92](dd7bd92f44))
- **deps:** update renovate docker tag to v38.131.1
([6a73efe](6a73efe88c))
- **deps:** update renovate docker tag to v38.131.2
([93861f0](93861f054d))
- **deps:** update renovate docker tag to v38.132.1
([c3afe48](c3afe48dc5))
- **deps:** update renovate docker tag to v38.132.3
([1973fce](1973fcea3c))
- **deps:** update renovate docker tag to v38.133.0
([4a07c50](4a07c50b27))
- **deps:** update renovate docker tag to v38.133.1
([0e8b35d](0e8b35d9d2))
- **deps:** update renovate docker tag to v38.133.2
([0b061eb](0b061eb768))
- **deps:** update renovate docker tag to v38.134.0
([67a9577](67a957720f))
- **deps:** update renovate docker tag to v38.135.2
([14382a8](14382a8885))
- **deps:** update renovate docker tag to v38.138.3
([1a12b39](1a12b39c17))
- **deps:** update renovate docker tag to v38.138.5
([bb832ea](bb832eac70))
- **deps:** update renovate docker tag to v38.140.0
([1cefad4](1cefad4178))
- **deps:** update renovate docker tag to v38.140.2
([2d32293](2d32293bd1))
- **deps:** update renovate docker tag to v38.141.1
([9143751](9143751e1c))
- **deps:** update renovate docker tag to v38.142.1
([4ed28cd](4ed28cd226))
- **deps:** update renovate docker tag to v38.142.2
([513f3e3](513f3e3eba))
- **deps:** update renovate docker tag to v38.142.3
([02bea1c](02bea1c601))
- **deps:** update renovate docker tag to v38.142.4
([7574fcb](7574fcb291))
- **deps:** update renovate docker tag to v38.142.5
([76eb5e4](76eb5e4295))

###
[`v40.3.4`](https://redirect.github.com/renovatebot/github-action/releases/tag/v40.3.4)

[Compare
Source](https://redirect.github.com/renovatebot/github-action/compare/v40.3.3...v40.3.4)

##### Documentation

- update references to actions/checkout to v4.2.1
([11212af](11212aff7d))
- update references to renovatebot/github-action to v40.3.3
([7bdca51](7bdca51b4c))

##### Miscellaneous Chores

- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to
v20.16.11
([85652f0](85652f02f4))
- **deps:** update dependency prettier-plugin-packagejson to v2.5.3
([9347c05](9347c05b51))
- **deps:** update pnpm to v9.12.1
([49efd81](49efd814d8))

##### Build System

- **deps:** update dependency typescript to v5.6.3
([9c10032](9c100326f6))

##### Continuous Integration

- **deps:** update renovate docker tag to v38.120.0
([d1179fe](d1179feff5))
- **deps:** update renovate docker tag to v38.120.1
([7eaca7d](7eaca7dbe1))
- **deps:** update renovate docker tag to v38.122.0
([5ebe74f](5ebe74f625))
- **deps:** update renovate docker tag to v38.123.0
([398baed](398baed47b))
- **deps:** update renovate docker tag to v38.124.1
([76a4553](76a45533dc))

###
[`v40.3.3`](https://redirect.github.com/renovatebot/github-action/releases/tag/v40.3.3)

[Compare
Source](https://redirect.github.com/renovatebot/github-action/compare/v40.3.2...v40.3.3)

##### Bug Fixes

- **deps:** update dependency
[@&#8203;actions/core](https://redirect.github.com/actions/core) to
v1.11.1
([dd7f630](dd7f630a1d))

##### Continuous Integration

- **deps:** update renovate docker tag to v38.115.0
([0168adb](0168adb92f))
- **deps:** update renovate docker tag to v38.115.1
([221a713](221a713171))
- **deps:** update renovate docker tag to v38.116.0
([56e961b](56e961b1f8))
- **deps:** update renovate docker tag to v38.119.0
([13076db](13076dbca1))

###
[`v40.3.2`](https://redirect.github.com/renovatebot/github-action/releases/tag/v40.3.2)

[Compare
Source](https://redirect.github.com/renovatebot/github-action/compare/v40.3.1...v40.3.2)

##### Bug Fixes

- **deps:** update dependency
[@&#8203;actions/core](https://redirect.github.com/actions/core) to
v1.11.0
([6b22ac7](6b22ac7b23))

##### Documentation

- update references to ghcr.io/renovatebot/renovate to v38.110.2
([8fcdc6e](8fcdc6e116))
- update references to renovatebot/github-action to v40.3.1
([593a1c0](593a1c0739))

##### Miscellaneous Chores

- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to
v20.16.10
([659e9b1](659e9b1e70))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to v20.16.6
([43cf848](43cf8481c5))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to v20.16.7
([04140e8](04140e85d7))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to v20.16.8
([ffa56df](ffa56df1d0))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to v20.16.9
([04eaa9d](04eaa9dca6))
- **deps:** update dependency semantic-release to v24.1.2
([443c041](443c041d1b))
- **deps:** update pnpm to v9.12.0
([73c1f19](73c1f192f0))

##### Continuous Integration

- **deps:** update actions/checkout action to v4.2.1
([a89ddca](a89ddca451))
- **deps:** update renovate docker tag to v38.105.0
([6c8aefd](6c8aefd37f))
- **deps:** update renovate docker tag to v38.106.0
([c2fef14](c2fef14ab5))
- **deps:** update renovate docker tag to v38.106.2
([bdb5ad6](bdb5ad69d0))
- **deps:** update renovate docker tag to v38.106.3
([32149ad](32149adc64))
- **deps:** update renovate docker tag to v38.106.4
([8015943](8015943b52))
- **deps:** update renovate docker tag to v38.107.0
([6846c99](6846c99c9d))
- **deps:** update renovate docker tag to v38.107.1
([9da33e8](9da33e85bf))
- **deps:** update renovate docker tag to v38.109.0
([4c5ca41](4c5ca41499))
- **deps:** update renovate docker tag to v38.110.1
([59f331f](59f331fd5b))
- **deps:** update renovate docker tag to v38.110.2
([ccf2a06](ccf2a06a55))
- **deps:** update renovate docker tag to v38.110.4
([2fd7d6a](2fd7d6a4d9))
- **deps:** update renovate docker tag to v38.114.0
([1c16e18](1c16e18622))

###
[`v40.3.1`](https://redirect.github.com/renovatebot/github-action/releases/tag/v40.3.1)

[Compare
Source](https://redirect.github.com/renovatebot/github-action/compare/v40.3.0...v40.3.1)

##### Build System

- **deps:** update dependency
[@&#8203;vercel/ncc](https://redirect.github.com/vercel/ncc) to v0.38.2
([336c9d5](336c9d5027))

##### Continuous Integration

- **deps:** update renovate docker tag to v38.103.1
([2f7cf70](2f7cf7048f))

###
[`v40.3.0`](https://redirect.github.com/renovatebot/github-action/releases/tag/v40.3.0)

[Compare
Source](https://redirect.github.com/renovatebot/github-action/compare/v40.2.11...v40.3.0)

##### Features

- add `docker-socket-host-path` input
([#&#8203;862](https://redirect.github.com/renovatebot/github-action/issues/862))
([c0afe86](c0afe86658))

###
[`v40.2.11`](https://redirect.github.com/renovatebot/github-action/releases/tag/v40.2.11)

[Compare
Source](https://redirect.github.com/renovatebot/github-action/compare/v40.2.10...v40.2.11)

##### Documentation

- update references to actions/checkout to v4.2.0
([b0990c1](b0990c14ff))
- update references to ghcr.io/renovatebot/renovate to v38.101.1
([1ae1ac0](1ae1ac05cd))
- update references to renovatebot/github-action to v40.2.10
([86ff03b](86ff03bc78))

##### Miscellaneous Chores

- **deps:** update commitlint monorepo to v19.5.0
([7a0e06d](7a0e06dd88))
- **deps:** update dependency
[@&#8203;semantic-release/github](https://redirect.github.com/semantic-release/github)
to v10.3.4
([8b7ac01](8b7ac01658))
- **deps:** update dependency
[@&#8203;semantic-release/github](https://redirect.github.com/semantic-release/github)
to v10.3.5
([#&#8203;864](https://redirect.github.com/renovatebot/github-action/issues/864))
([f21eeef](f21eeef37c))
- **deps:** update dependency eslint to v8.57.1
([3a945ba](3a945ba488))
- **deps:** update dependency husky to v9.1.6
([d35a34a](d35a34a3cc))
- **deps:** update dependency npm-run-all2 to v6.2.3
([8aa7554](8aa7554cab))
- **deps:** update dependency semantic-release to v24.1.1
([f70fd7d](f70fd7d670))
- **deps:** update pnpm to v9.11.0
([871230b](871230b04d))

##### Build System

- **deps:** lock file maintenance
([669f02b](669f02b0b3))

##### Continuous Integration

- **deps:** update actions/checkout action to v4.2.0
([cea9e7c](cea9e7c1c3))
- **deps:** update actions/setup-node action to v4.0.4
([926bb29](926bb29469))
- **deps:** update renovate docker tag to v38.100.0
([00c426e](00c426e7fc))
- **deps:** update renovate docker tag to v38.100.1
([e9da8a6](e9da8a603f))
- **deps:** update renovate docker tag to v38.101.0
([af7815d](af7815d4cc))
- **deps:** update renovate docker tag to v38.101.1
([157d4d8](157d4d8218))
- **deps:** update renovate docker tag to v38.84.0
([6cc098a](6cc098a3ad))
- **deps:** update renovate docker tag to v38.84.1
([e1ef94d](e1ef94d00d))
- **deps:** update renovate docker tag to v38.85.1
([e89e3ea](e89e3ea559))
- **deps:** update renovate docker tag to v38.86.0
([9251f4a](9251f4a517))
- **deps:** update renovate docker tag to v38.88.1
([4d5a44a](4d5a44aba2))
- **deps:** update renovate docker tag to v38.88.2
([1caa178](1caa178a1d))
- **deps:** update renovate docker tag to v38.89.2
([7602472](7602472e18))
- **deps:** update renovate docker tag to v38.89.3
([f571b99](f571b99572))
- **deps:** update renovate docker tag to v38.91.0
([7b3db30](7b3db3074c))
- **deps:** update renovate docker tag to v38.91.2
([3607015](3607015834))
- **deps:** update renovate docker tag to v38.91.5
([063fac8](063fac841b))
- **deps:** update renovate docker tag to v38.92.0
([5663610](5663610ffc))
- **deps:** update renovate docker tag to v38.93.0
([2b64bb7](2b64bb799d))
- **deps:** update renovate docker tag to v38.93.1
([6e3d1f1](6e3d1f1901))
- **deps:** update renovate docker tag to v38.93.6
([bc2b6fa](bc2b6faabe))
- **deps:** update renovate docker tag to v38.94.2
([604f795](604f795024))
- **deps:** update renovate docker tag to v38.94.3
([92c7bc3](92c7bc3083))
- **deps:** update renovate docker tag to v38.95.4
([c939d62](c939d6211b))
- **deps:** update renovate docker tag to v38.97.0
([e16ec5f](e16ec5fc05))
- **deps:** update renovate docker tag to v38.97.1
([93190dc](93190dce09))
- **deps:** update renovate docker tag to v38.98.0
([d1ece14](d1ece14d2b))

###
[`v40.2.10`](https://redirect.github.com/renovatebot/github-action/releases/tag/v40.2.10)

[Compare
Source](https://redirect.github.com/renovatebot/github-action/compare/v40.2.9...v40.2.10)

##### Miscellaneous Chores

- **deps:** update pnpm to v9.10.0
([4ecccc8](4ecccc80bf))

##### Build System

- **deps:** update dependency typescript to v5.6.2
([ccb9633](ccb9633c2c))

###
[`v40.2.9`](https://redirect.github.com/renovatebot/github-action/releases/tag/v40.2.9)

[Compare
Source](https://redirect.github.com/renovatebot/github-action/compare/v40.2.8...v40.2.9)

##### Documentation

- update references to ghcr.io/renovatebot/renovate to v38.80.0
([54adf7f](54adf7f706))
- update references to renovatebot/github-action to v40.2.8
([f6f4de0](f6f4de0d1f))

##### Miscellaneous Chores

- **deps:** update dependency
[@&#8203;semantic-release/github](https://redirect.github.com/semantic-release/github)
to v10.3.0
([39c0ed3](39c0ed39be))
- **deps:** update dependency
[@&#8203;semantic-release/github](https://redirect.github.com/semantic-release/github)
to v10.3.1
([d237b41](d237b41568))
- **deps:** update dependency
[@&#8203;semantic-release/github](https://redirect.github.com/semantic-release/github)
to v10.3.2
([2533c44](2533c44a78))
- **deps:** update dependency
[@&#8203;semantic-release/github](https://redirect.github.com/semantic-release/github)
to v10.3.3
([0e39ae0](0e39ae0292))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to v20.16.4
([d9eb43e](d9eb43e3f8))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to v20.16.5
([6d5784a](6d5784adf2))

##### Build System

- **deps:** lock file maintenance
([32073a4](32073a4660))

##### Continuous Integration

- **deps:** update renovate docker tag to v38.73.3
([476a91f](476a91f280))
- **deps:** update renovate docker tag to v38.73.5
([1649e40](1649e40897))
- **deps:** update renovate docker tag to v38.74.1
([65f5c11](65f5c11989))
- **deps:** update renovate docker tag to v38.75.0
([fa73ff0](fa73ff0f99))
- **deps:** update renovate docker tag to v38.76.1
([438981f](438981f829))
- **deps:** update renovate docker tag to v38.77.0
([919ed13](919ed13ea2))
- **deps:** update renovate docker tag to v38.77.2
([2009e09](2009e0963c))
- **deps:** update renovate docker tag to v38.77.3
([8a0ce4d](8a0ce4d4cf))
- **deps:** update renovate docker tag to v38.77.5
([aeffa00](aeffa00d03))
- **deps:** update renovate docker tag to v38.77.8
([46076e2](46076e2b11))
- **deps:** update renovate docker tag to v38.79.0
([3f7fa1f](3f7fa1faeb))
- **deps:** update renovate docker tag to v38.80.0
([eb68a01](eb68a019af))

###
[`v40.2.8`](https://redirect.github.com/renovatebot/github-action/releases/tag/v40.2.8)

[Compare
Source](https://redirect.github.com/renovatebot/github-action/compare/v40.2.7...v40.2.8)

##### Documentation

- update references to ghcr.io/renovatebot/renovate to v38.61.1
([5993be6](5993be6af6))
- update references to ghcr.io/renovatebot/renovate to v38.72.1
([a4cf16d](a4cf16da54))
- update references to renovatebot/github-action to v40.2.7
([511a7a7](511a7a7705))

##### Miscellaneous Chores

- **deps:** update commitlint monorepo to v19.4.1
([fe52de6](fe52de6e1b))
- **deps:** update dependency
[@&#8203;semantic-release/github](https://redirect.github.com/semantic-release/github)
to v10.1.7
([8d1974e](8d1974e5f5))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to v20.16.1
([a5ef441](a5ef4418b4))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to v20.16.2
([e2f34af](e2f34af24c))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to v20.16.3
([edf82b7](edf82b7595))
- **deps:** update dependency husky to v9.1.5
([18b2dca](18b2dca0f2))
- **deps:** update dependency lint-staged to v15.2.10
([2089929](208992943a))
- **deps:** update dependency prettier-plugin-packagejson to v2.5.2
([e3c4817](e3c48178c2))
- **deps:** update pnpm to v9.8.0
([527df8e](527df8e80c))
- **deps:** update pnpm to v9.9.0
([8f53e8e](8f53e8e1f1))

##### Build System

- **deps:** lock file maintenance
([00a9d0f](00a9d0fb6b))

##### Continuous Integration

- **deps:** update renovate docker tag to v38.54.1
([9e15fe4](9e15fe4539))
- **deps:** update renovate docker tag to v38.55.1
([ebed852](ebed852c7d))
- **deps:** update renovate docker tag to v38.55.2
([ea137aa](ea137aa3de))
- **deps:** update renovate docker tag to v38.55.4
([47bb8fa](47bb8fa952))
- **deps:** update renovate docker tag to v38.55.5
([8721f4c](8721f4cdce))
- **deps:** update renovate docker tag to v38.57.0
([c8714d9](c8714d911d))
- **deps:** update renovate docker tag to v38.57.1
([3297675](3297675b87))
- **deps:** update renovate docker tag to v38.57.3
([7467495](7467495d42))
- **deps:** update renovate docker tag to v38.58.0
([44c8d6f](44c8d6f2b6))
- **deps:** update renovate docker tag to v38.58.1
([da00a9c](da00a9ca31))
- **deps:** update renovate docker tag to v38.58.2
([cda286d](cda286d20a))
- **deps:** update renovate docker tag to v38.59.1
([cf5432f](cf5432f6e0))
- **deps:** update renovate docker tag to v38.59.2
([282b8d8](282b8d81ba))
- **deps:** update renovate docker tag to v38.61.1
([749b819](749b8190af))
- **deps:** update renovate docker tag to v38.64.0
([71ee52a](71ee52a1c7))
- **deps:** update renovate docker tag to v38.64.1
([7337445](7337445827))
- **deps:** update renovate docker tag to v38.66.1
([5e5e62b](5e5e62bf1c))
- **deps:** update renovate docker tag to v38.67.1
([8639a3d](8639a3dc7c))
- **deps:** update renovate docker tag to v38.67.2
([e7fba3a](e7fba3a3fa))
- **deps:** update renovate docker tag to v38.67.4
([114ff35](114ff35888))
- **deps:** update renovate docker tag to v38.67.5
([a0ebccf](a0ebccfb1d))
- **deps:** update renovate docker tag to v38.68.0
([d76014f](d76014f2db))
- **deps:** update renovate docker tag to v38.68.1
([cd0419f](cd0419f33a))
- **deps:** update renovate docker tag to v38.70.0
([ab6e4ab](ab6e4ab3f7))
- **deps:** update renovate docker tag to v38.70.2
([3e30de3](3e30de3043))
- **deps:** update renovate docker tag to v38.71.0
([42c77e0](42c77e078b))
- **deps:** update renovate docker tag to v38.72.0
([46fcd07](46fcd07256))
- **deps:** update renovate docker tag to v38.72.1
([7e74a7b](7e74a7b8f9))
- **deps:** update wagoid/commitlint-github-action action to v6.1.2
([1c11596](1c1159609e))

###
[`v40.2.7`](https://redirect.github.com/renovatebot/github-action/releases/tag/v40.2.7)

[Compare
Source](https://redirect.github.com/renovatebot/github-action/compare/v40.2.6...v40.2.7)

##### Documentation

- update references to ghcr.io/renovatebot/renovate to v38.25.1
([1569e23](1569e23502))
- update references to ghcr.io/renovatebot/renovate to v38.39.6
([5432799](543279956c))
- update references to ghcr.io/renovatebot/renovate to v38.52.3
([44dfa9a](44dfa9a23d))
- update references to renovatebot/github-action to v40.2.6
([0a5e4b7](0a5e4b7d88))

##### Miscellaneous Chores

- **deps:** update dependency
[@&#8203;commitlint/cli](https://redirect.github.com/commitlint/cli) to
v19.4.0
([32ed440](32ed440e77))
- **deps:** update dependency
[@&#8203;semantic-release/github](https://redirect.github.com/semantic-release/github)
to v10.1.4
([47f396c](47f396ccf1))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to
v20.14.15
([0b458d7](0b458d7b4e))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to v20.16.0
([632cbd7](632cbd7442))
- **deps:** update dependency lint-staged to v15.2.9
([b90ad0d](b90ad0d5ef))
- **deps:** update pnpm to v9.7.0
([1f85a75](1f85a75eb2))
- **deps:** update pnpm to v9.7.1
([dd820f5](dd820f5e7b))
- **deps:** update semantic-release monorepo
([db01ed4](db01ed443d))

##### Build System

- **deps:** lock file maintenance
([9785636](9785636e49))

##### Continuous Integration

- **deps:** update renovate docker tag to v38.25.1
([1681b12](1681b12e4e))
- **deps:** update renovate docker tag to v38.25.3
([f10e03d](f10e03d089))
- **deps:** update renovate docker tag to v38.26.1
([4dfd846](4dfd846975))
- **deps:** update renovate docker tag to v38.27.0
([b7e33e5](b7e33e5f3b))
- **deps:** update renovate docker tag to v38.29.0
([f4f639b](f4f639bf16))
- **deps:** update renovate docker tag to v38.32.0
([c2e88b3](c2e88b3301))
- **deps:** update renovate docker tag to v38.37.0
([150a5cf](150a5cf116))
- **deps:** update renovate docker tag to v38.37.1
([e6366ba](e6366ba56f))
- **deps:** update renovate docker tag to v38.39.0
([54dd4af](54dd4af438))
- **deps:** update renovate docker tag to v38.39.3
([7dc04fb](7dc04fbb11))
- **deps:** update renovate docker tag to v38.39.4
([7c6d9b3](7c6d9b3640))
- **deps:** update renovate docker tag to v38.39.6
([3b91d9f](3b91d9f7d9))
- **deps:** update renovate docker tag to v38.42.0
([d166171](d1661716d1))
- **deps:** update renovate docker tag to v38.44.2
([0056692](0056692c69))
- **deps:** update renovate docker tag to v38.44.3
([6bee7db](6bee7db58d))
- **deps:** update renovate docker tag to v38.45.0
([70d287a](70d287a6ab))
- **deps:** update renovate docker tag to v38.46.0
([6c814d9](6c814d9450))
- **deps:** update renovate docker tag to v38.52.3
([cc16365](cc16365636))
- **deps:** update wagoid/commitlint-github-action action to v6.1.0
([05d52cc](05d52ccd5b))
- **deps:** update wagoid/commitlint-github-action action to v6.1.1
([cd7cbcc](cd7cbccb34))

###
[`v40.2.6`](https://redirect.github.com/renovatebot/github-action/releases/tag/v40.2.6)

[Compare
Source](https://redirect.github.com/renovatebot/github-action/compare/v40.2.5...v40.2.6)

##### Documentation

- update references to ghcr.io/renovatebot/renovate to v38
([fa0868b](fa0868b58a))
- update references to renovatebot/github-action to v40.2.5
([31bdd4f](31bdd4fd39))

##### Miscellaneous Chores

- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to
v20.14.14
([6cf8087](6cf80874d4))
- **deps:** update dependency husky to v9.1.4
([27e26f7](27e26f7ce2))
- **deps:** update dependency lint-staged to v15.2.8
([a83b429](a83b429180))

##### Build System

- **deps:** lock file maintenance
([c36563b](c36563b1cd))

##### Continuous Integration

- **deps:** update renovate docker tag to v38.18.14
([bb431e4](bb431e47f8))
- **deps:** update renovate docker tag to v38.18.17
([818eccd](818eccd0d5))
- **deps:** update renovate docker tag to v38.19.0
([5a5d5f9](5a5d5f922b))
- **deps:** update renovate docker tag to v38.20.1
([47e9fc8](47e9fc89d8))
- **deps:** update renovate docker tag to v38.21.2
([0094885](009488562f))
- **deps:** update renovate docker tag to v38.21.3
([ec4508c](ec4508ced1))
- **deps:** update renovate docker tag to v38.23.0
([e182cbd](e182cbdda2))
- **deps:** update renovate docker tag to v38.23.2
([d820e1a](d820e1ad5d))
- **deps:** update renovate docker tag to v38.24.0
([e8c5786](e8c5786a02))
- **deps:** update renovate docker tag to v38.24.1
([8c35547](8c35547471))
- **deps:** update renovate docker tag to v38.25.0
([b47958f](b47958fcca))
- **deps:** update wagoid/commitlint-github-action action to v6
([#&#8203;849](https://redirect.github.com/renovatebot/github-action/issues/849))
([a9144b2](a9144b27d1))

###
[`v40.2.5`](https://redirect.github.com/renovatebot/github-action/releases/tag/v40.2.5)

[Compare
Source](https://redirect.github.com/renovatebot/github-action/compare/v40.2.4...v40.2.5)

##### Documentation

- update references to renovatebot/github-action to v40.2.4
([dd6134d](dd6134d9c7))

##### Miscellaneous Chores

- **deps:** update dependency
[@&#8203;semantic-release/github](https://redirect.github.com/semantic-release/github)
to v10.1.2
([fd92454](fd92454e71))
- **deps:** update dependency
[@&#8203;semantic-release/github](https://redirect.github.com/semantic-release/github)
to v10.1.3
([f2b9a64](f2b9a648f1))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to
v20.14.12
([fe88a7e](fe88a7ed9f))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to
v20.14.13
([03ace83](03ace83f22))
- **deps:** update dependency husky to v9.1.2
([77e79d3](77e79d3ba3))
- **deps:** update dependency husky to v9.1.3
([0ff26fa](0ff26fa68c))

##### Build System

- **deps:** lock file maintenance
([8f47962](8f47962699))

##### Continuous Integration

- **deps:** update renovate docker tag to v38.11.0
([0736fb9](0736fb93c4))
- **deps:** update renovate docker tag to v38.12.0
([0cff0d5](0cff0d5c7f))
- **deps:** update renovate docker tag to v38.14.0
([83fcd08](83fcd0872d))
- **deps:** update renovate docker tag to v38.16.0
([6989153](6989153cea))
- **deps:** update renovate docker tag to v38.18.11
([f3071cd](f3071cd009))
- **deps:** update renovate docker tag to v38.18.12
([c87684f](c87684fc73))
- **deps:** update renovate docker tag to v38.18.4
([5384334](5384334d3f))
- **deps:** update renovate docker tag to v38.18.5
([f26f2f7](f26f2f7199))
- **deps:** update renovate docker tag to v38.18.8
([51f49c4](51f49c4125))
- **deps:** update renovate docker tag to v38.18.9
([e572ebd](e572ebdbb1))

###
[`v40.2.4`](https://redirect.github.com/renovatebot/github-action/releases/tag/v40.2.4)

[Compare
Source](https://redirect.github.com/renovatebot/github-action/compare/v40.2.3...v40.2.4)

##### Documentation

- update references to renovatebot/github-action to v40.2.3
([7aa35ac](7aa35ac950))

##### Miscellaneous Chores

- **deps:** update dependency
[@&#8203;semantic-release/github](https://redirect.github.com/semantic-release/github)
to v10.1.1
([9687ff3](9687ff3e60))
- **deps:** update dependency
[@&#8203;types/node](https://redirect.github.com/types/node) to
v20.14.11
([0e299f5](0e299f5c41))
- **deps:** update dependency husky to v9.1.0
([56cb71f](56cb71f9ae))
- **deps:** update dependency husky to v9.1.1
([63c9526](63c952649a))
- **deps:** update dependency prettier-plugin-packagejson to v2.5.1
([87e9376](87e93769b6))
- **deps:** update dependency rimraf to v6
([#&#8203;856](https://redirect.github.com/renovatebot/github-action/issues/856))
([de0b07a](de0b07a4cd))
- **deps:** update pnpm to v9.6.0
([5b79649](5b79649160))

##### Build System

- **deps:** update dependency typescript to v5.5.4
([1ab20c1](1ab20c16da))

##### Continuous Integration

- **deps:** update renovate docker tag to v37.440.0
([907d816](907d816b18))
- **deps:** update renovate docker tag to v37.440.4
([d2d60a0](https://redirect.github.com/renovatebot/github-action/commit/d2d60a00ab986c6757ff

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/morten-olsen/homelab-operator).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS45Ny4xMCIsInVwZGF0ZWRJblZlciI6IjQxLjk3LjEwIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/main.yml

@@ -29,7 +29,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: "${{ env.NODE_VERSION }}"
           registry-url: "${{ env.NODE_REGISTRY }}"

.github/workflows/publish-backup-tag.yml

@@ -36,7 +36,7 @@ jobs:
           fetch-depth: 0
 
       - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        uses: docker/login-action@5b7b28b1cc417bbd34cd8c225a957c9ce9adf7f2
         with:
           registry: ${{ env.DOCKER_REGISTRY }}
           username: ${{ github.actor }}
@@ -44,13 +44,13 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        uses: docker/metadata-action@032a4b3bda1b716928481836ac5bfe36e1feaad6
         with:
           images: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}
 
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        uses: docker/build-push-action@cb8fc7586f9ad9441b20c33e0f6e8b1b58d8b4c6
         with:
           context: ./images/backup
           push: true
@@ -58,7 +58,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
 
       - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v3
         with:
           subject-name: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME}}
           subject-digest: ${{ steps.push.outputs.digest }}

.github/workflows/publish-tag.yml

@@ -36,7 +36,7 @@ jobs:
           fetch-depth: 0
 
       - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        uses: docker/login-action@5b7b28b1cc417bbd34cd8c225a957c9ce9adf7f2
         with:
           registry: ${{ env.DOCKER_REGISTRY }}
           username: ${{ github.actor }}
@@ -44,13 +44,13 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        uses: docker/metadata-action@032a4b3bda1b716928481836ac5bfe36e1feaad6
         with:
           images: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}
 
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        uses: docker/build-push-action@cb8fc7586f9ad9441b20c33e0f6e8b1b58d8b4c6
         with:
           context: ./images/operator
           push: true
@@ -58,7 +58,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
 
       - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v3
         with:
           subject-name: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME}}
           subject-digest: ${{ steps.push.outputs.digest }}

.github/workflows/renovate.yml

@@ -0,0 +1,16 @@
+name: Renovate
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 */6 * * *"
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@v40.3.6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          configurationFile: ./renovate.json5

.gitignore

@@ -1,3 +1,4 @@
 /secret.*.yaml
 /data/
-*.DS_Store
+/.envrc
+*.DS_Store

charts/apps/apprise/values.yaml

@@ -4,6 +4,6 @@ globals:
   domain: olsen.cloud
 image:
   repository: docker.io/caronc/apprise
-  tag: latest
+  tag: latest@sha256:127b3834f0679502529397ead8ffeaadf5189019c4c863fa6652e9b942fdccf8
   pullPolicy: IfNotPresent
 subdomain: apprise

charts/apps/audiobookshelf/values.yaml

@@ -2,6 +2,6 @@ globals:
   environment: prod
 image:
   repository: ghcr.io/advplyr/audiobookshelf
-  tag: 2.26.1
+  tag: 2.26.1@sha256:5901162ccdf4b44f563ff2012484d5e315d9a1ecd6af86f7fe605ec96bbc5039
   pullPolicy: IfNotPresent
 subdomain: audiobookshelf

charts/apps/baikal/templates/external-http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/baikal/values.yaml

@@ -4,6 +4,6 @@ globals:
   domain: olsen.cloud
 image:
   repository: docker.io/ckulka/baikal
-  tag: nginx
+  tag: nginx@sha256:045918423df00a3f9ec793a819b9acdb055d338b75387926b7d93d753ac1e93a
   pullPolicy: IfNotPresent
 subdomain: baikal

charts/apps/calibre-web/values.yaml

@@ -4,6 +4,6 @@ globals:
   timezone: Europe/Amsterdam
 image:
   repository: lscr.io/linuxserver/calibre-web
-  tag: latest
+  tag: latest@sha256:98a20064168ab284bbb8e048af48c89a5e25650f35a4b217705241af94c1debe
   pullPolicy: IfNotPresent
 subdomain: calibre-web

charts/apps/coder/values.yaml

@@ -2,6 +2,6 @@ globals:
   environment: prod
 image:
   repository: ghcr.io/coder/coder
-  tag: latest
+  tag: latest@sha256:73714e0685addde01bbff905cf5b647d6b677d77977c8009b6293d40fdf0f562
   pullPolicy: IfNotPresent
 subdomain: coder

charts/apps/data/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: data

charts/apps/data/templates/database.yaml

@@ -0,0 +1,6 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: PostgresDatabase
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'

charts/apps/data/values.yaml

@@ -0,0 +1,2 @@
+globals:
+  environment: prod

charts/apps/esphome/values.yaml

@@ -4,6 +4,6 @@ globals:
   domain: olsen.cloud
 image:
   repository: ghcr.io/esphome/esphome
-  tag: latest
+  tag: latest@sha256:393775c4c02e0b09d086cd794815a723f90d4af7c3d871935e22be1a34c5d89a
   pullPolicy: IfNotPresent
 subdomain: esphome

charts/apps/gitea/values.yaml

@@ -3,6 +3,6 @@ globals:
   timezone: Europe/Amsterdam
 image:
   repository: docker.gitea.com/gitea
-  tag: latest
+  tag: latest@sha256:2edc102cbb636ae1ddac5fa0c715aa5b03079dee13ac6800b2cef6d4e912e718
   pullPolicy: IfNotPresent
 subdomain: gitea

charts/apps/headscale/values.yaml

@@ -2,6 +2,6 @@ globals:
   environment: prod
 image:
   repository: headscale/headscale
-  tag: latest
+  tag: latest@sha256:ea9b5ee06274d757a4d52103de56cd11a9c393acb19d9a35f4b9fe52ada410de
   pullPolicy: IfNotPresent
 subdomain: headscale

charts/apps/homarr/values.yaml

@@ -2,6 +2,6 @@ globals:
   environment: prod
 image:
   repository: ghcr.io/homarr-labs/homarr
-  tag: latest
+  tag: latest@sha256:7d58149aa544037d173a48f41fbde86706068d2b8933a33a911dce26457ecf16
   pullPolicy: IfNotPresent
 subdomain: homarr

charts/apps/home-assistant/templates/deployment.yaml

@@ -15,6 +15,7 @@ spec:
         app: "{{ .Release.Name }}"
     spec:
       hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
 
       containers:
         - name: "{{ .Release.Name }}"

charts/apps/home-assistant/templates/piper.yaml

@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}-piper"
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}-piper"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}-piper"
+    spec:
+      hostNetwork: true
+
+      containers:
+        - name: "{{ .Release.Name }}-piper"
+          image: "{{ .Values.piper.image.repository }}:{{ .Values.piper.image.tag }}"
+          imagePullPolicy: "{{ .Values.piper.image.pullPolicy }}"
+          args:
+            - --piper
+            - /usr/share/piper/piper
+            - --data-dir
+            - /usr/share/piper-voices
+            - --voice
+            - "{{ .Values.piper.model }}"
+          env:
+            - name: TZ
+              value: "{{ .Values.globals.timezone }}"
+          ports:
+            - name: http
+              containerPort: 10200
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}-piper"
+  labels:
+    app: "{{ .Release.Name }}-piper"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 10200
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}-piper"

charts/apps/home-assistant/templates/whisper.yaml

@@ -0,0 +1,57 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}-whisper"
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}-whisper"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}-whisper"
+    spec:
+      hostNetwork: true
+
+      containers:
+        - name: "{{ .Release.Name }}-whisper"
+          image: "{{ .Values.whisper.image.repository }}:{{ .Values.whisper.image.tag }}"
+          imagePullPolicy: "{{ .Values.whisper.image.pullPolicy }}"
+          args:
+            - --model
+            - "{{ .Values.whisper.model }}"
+            - --language
+            - "{{ .Values.whisper.language }}"
+          env:
+            - name: TZ
+              value: "{{ .Values.globals.timezone }}"
+          ports:
+            - name: http
+              containerPort: 10300
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}-whisper"
+  labels:
+    app: "{{ .Release.Name }}-whisper"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 10300
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}-whisper"

charts/apps/home-assistant/values.yaml

@@ -3,6 +3,19 @@ globals:
   timezone: Europe/Amsterdam
 image:
   repository: ghcr.io/home-assistant/home-assistant
-  tag: stable
+  tag: stable@sha256:89ec0583c7f47c8a150204f6b5ed48b5432026012bebe1226cf72775a795a5e1
   pullPolicy: IfNotPresent
 subdomain: home-assistant
+piper:
+  image:
+    repository: ghcr.io/morten-olsen/glados-voice
+    tag: main@sha256:8fcc19bd9e7e846bdfd9e9e569c8c944dcfb1d0b47e3f479cbaa7f5587c7206c
+    pullPolicy: Always
+  model: en_US-glados-medium
+whisper:
+  image:
+    repository: rhasspy/wyoming-whisper
+    tag: latest@sha256:f03456914affe8076fc7688c0890f4c708d93ebfac7340b0b2467f721412012d
+    pullPolicy: IfNotPresent
+  model: tiny-int8
+  language: us

charts/apps/install.sh

@@ -0,0 +1,12 @@
+set -euo pipefail
+
+find . -name "values.yaml" -type f -print0 | while IFS= read -r -d '' values_file; do
+  location=$(dirname "$values_file")
+  name=$(basename "$location")
+  name=$(echo "$name" | tr '[:upper:]' '[:lower:]' | tr -s '[:punct:][:space:]' '-' | sed -e 's/^-*//' -e 's/-*$//')
+
+  echo "✅ Chart found in: $location"
+  echo "   - Generated release name: $name"
+  HELM_COMMAND="helm install --namespace prod \"$name\" \"$location\""
+  helm upgrade -i --namespace prod "$name" "$location"
+done

charts/apps/jellyfin/templates/config-pvc.yaml

@@ -1,11 +1,11 @@
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
-  name: '{{ .Release.Name }}-config'
+  name: "{{ .Release.Name }}-config"
 spec:
   accessModes:
-    - 'ReadWriteOnce'
+    - "ReadWriteOnce"
   resources:
     requests:
-      storage: '1Gi'
-  storageClassName: '{{ .Values.environment }}'
+      storage: "1Gi"
+  storageClassName: "{{ .Values.globals.environment }}"

charts/apps/jellyfin/values.yaml

@@ -2,6 +2,6 @@ globals:
   environment: prod
 image:
   repository: docker.io/jellyfin/jellyfin
-  tag: latest
+  tag: latest@sha256:7ae36aab93ef9b6aaff02b37f8bb23df84bb2d7a3f6054ec8fc466072a648ce2
   pullPolicy: IfNotPresent
 subdomain: jellyfin

charts/apps/linkwarden/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: Linkwarden

charts/apps/linkwarden/templates/client.yaml

@@ -0,0 +1,10 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  redirectUris:
+    - path: /api/v1/auth/callback/authentik
+      subdomain: "{{ .Values.subdomain }}"
+      matchingMode: strict

charts/apps/linkwarden/templates/database.yaml

@@ -0,0 +1,6 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: PostgresDatabase
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'

charts/apps/linkwarden/templates/deployment.yaml

@@ -0,0 +1,75 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}"
+    spec:
+      containers:
+        - name: "{{ .Release.Name }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: "{{ .Values.image.pullPolicy }}"
+          ports:
+            - containerPort: 3000
+              name: http
+          env:
+            - name: TZ
+              value: "{{ .Values.globals.timezone }}"
+            - name: NEXTAUTH_URL
+              value: "https://{{ .Values.subdomain }}.{{ .Values.globals.domain }}/api/v1/auth"
+            - name: NEXT_PUBLIC_OLLAMA_ENDPOINT_URL
+              value: "http://ollama:80"
+            - name: OLLAMA_MODEL
+              value: phi3:mini-4k
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-pg-connection"
+                  key: url
+            - name: NEXTAUTH_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-secrets"
+                  key: nextauth
+            - name: NEXT_PUBLIC_DISABLE_REGISTRATION
+              value: "true"
+            - name: NEXT_PUBLIC_CREDENTIALS_ENABLED
+              value: "false"
+            - name: DISABLE_NEW_SSO_USERS
+              value: "false"
+            - name: NEXT_PUBLIC_AUTHENTIK_ENABLED
+              value: "true"
+            - name: AUTHENTIK_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientId
+            - name: AUTHENTIK_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientSecret
+            - name: AUTHENTIK_ISSUER
+              value: "https://authentik.{{ .Values.globals.domain }}/application/o/linkwarden"
+              # TODO:
+            # - name: AUTHENTIK_ISSUER
+            #   valueFrom:
+            #     secretKeyRef:
+            #       name: "{{ .Release.Name }}-client"
+            #       key: configurationIssuer
+          volumeMounts:
+            - mountPath: /data/data
+              name: data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: "{{ .Release.Name }}-data"

charts/apps/linkwarden/templates/external-http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/linkwarden/templates/http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}"
+    port:
+      number: 80

charts/apps/linkwarden/templates/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ .Release.Name }}-data'
+spec:
+  accessModes:
+    - 'ReadWriteOnce'
+  resources:
+    requests:
+      storage: '1Gi'
+  storageClassName: '{{ .Values.globals.environment }}'

charts/apps/linkwarden/templates/secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: GenerateSecret
+metadata:
+  name: "{{ .Release.Name }}-secrets"
+spec:
+  fields:
+    - name: nextauth
+      encoding: hex
+      length: 64

charts/apps/linkwarden/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 3000
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}"

charts/apps/linkwarden/values.yaml

@@ -0,0 +1,9 @@
+globals:
+  environment: prod
+  domain: olsen.cloud
+  timezone: Europe/Amsterdam
+image:
+  repository: ghcr.io/linkwarden/linkwarden
+  tag: latest
+  pullPolicy: IfNotPresent
+subdomain: linkwarden

charts/apps/mealie/values.yaml

@@ -5,4 +5,4 @@ globals:
 subdomain: mealie
 image:
   repository: ghcr.io/mealie-recipes/mealie
-  tag: latest
+  tag: latest@sha256:322369a5b748eddb091417e708f0667d21994e6119278d1b8c509900ba41e54b

charts/apps/metamcp/templates/client.yaml

@@ -0,0 +1,10 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  redirectUris:
+    - path: /api/auth/oidc/callback
+      subdomain: '{{ .Values.subdomain }}'
+      matchingMode: strict

charts/apps/metamcp/templates/deployment.yaml

@@ -1,23 +1,23 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: '{{ .Release.Name }}'
+  name: "{{ .Release.Name }}"
 spec:
   strategy:
     type: Recreate
   replicas: 1
   selector:
     matchLabels:
-      app: '{{ .Release.Name }}'
+      app: "{{ .Release.Name }}"
   template:
     metadata:
       labels:
-        app: '{{ .Release.Name }}'
+        app: "{{ .Release.Name }}"
     spec:
       containers:
-        - name: '{{ .Release.Name }}'
-          image: '{{ .Values.image.repository }}:{{ .Values.image.tag }}'
-          imagePullPolicy: '{{ .Values.image.pullPolicy }}'
+        - name: "{{ .Release.Name }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: "{{ .Values.image.pullPolicy }}"
           ports:
             - name: http
               containerPort: 12008
@@ -33,47 +33,68 @@ spec:
               name: data
           env:
             - name: TZ
-              value: '{{ .Values.globals.timezone }}'
+              value: "{{ .Values.globals.timezone }}"
             - name: APP_URL
-              value: https://metamcp.olsen.cloud # TODO: Change
+              value: "https://{{ .Values.subdomain }}.{{ .Values.globals.domain }}"
             - name: NEXT_PUBLIC_APP_URL
-              value: https://metamcp.olsen.cloud # TODO: Change
+              value: "https://{{ .Values.subdomain }}.{{ .Values.globals.domain }}"
             - name: BETTER_AUTH_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: '{{ .Release.Name }}-secrets'
+                  name: "{{ .Release.Name }}-secrets"
                   key: betterauth
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef:
-                  name: '{{ .Release.Name }}-pg-connection'
+                  name: "{{ .Release.Name }}-pg-connection"
                   key: url
             - name: POSTGRES_DB
               valueFrom:
                 secretKeyRef:
-                  name: '{{ .Release.Name }}-pg-connection'
+                  name: "{{ .Release.Name }}-pg-connection"
                   key: database
             - name: POSTGRES_HOST
               valueFrom:
                 secretKeyRef:
-                  name: '{{ .Release.Name }}-pg-connection'
+                  name: "{{ .Release.Name }}-pg-connection"
                   key: host
             - name: POSTGRES_PORT
               valueFrom:
                 secretKeyRef:
-                  name: '{{ .Release.Name }}-pg-connection'
+                  name: "{{ .Release.Name }}-pg-connection"
                   key: port
             - name: POSTGRES_USER
               valueFrom:
                 secretKeyRef:
-                  name: '{{ .Release.Name }}-pg-connection'
+                  name: "{{ .Release.Name }}-pg-connection"
                   key: user
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: '{{ .Release.Name }}-pg-connection'
+                  name: "{{ .Release.Name }}-pg-connection"
                   key: password
+            - name: OIDC_PROVIDER_ID
+              value: oidc
+            - name: OIDC_SCOPES
+              value: openid email profile
+            - name: OIDC_PKCE
+              value: "true"
+            - name: OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientId
+            - name: OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientSecret
+            - name: OIDC_DISCOVERY_URL
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: configuration
       volumes:
         - name: data
           persistentVolumeClaim:
-            claimName: '{{ .Release.Name }}-data'
+            claimName: "{{ .Release.Name }}-data"

charts/apps/metamcp/values.yaml

@@ -1,8 +1,9 @@
 globals:
   environment: prod
+  domain: olsen.cloud
   timezone: Europe/Amsterdam
 image:
   repository: ghcr.io/metatool-ai/metamcp
-  tag: latest
+  tag: latest@sha256:09e467e3ac40132f4ee11407e792ca5767894b0909d56c270223bdfe64dfcfd2
   pullPolicy: IfNotPresent
 subdomain: metamcp

charts/apps/miniflux/values.yaml

@@ -4,6 +4,6 @@ globals:
   domain: olsen.cloud
 image:
   repository: ghcr.io/miniflux/miniflux
-  tag: latest
+  tag: latest@sha256:b435a1ea2408f996c8d4c00c4f46523fa9203971ee1e85b1fe7ad3f0e7ae617f
   pullPolicy: IfNotPresent
 subdomain: miniflux

charts/apps/mqtt/templates/config.yaml

@@ -8,5 +8,5 @@ data:
   mosquitto.conf: |
     persistence true
     persistence_location /mosquitto/data/
-    listener 1884 0.0.0.0
+    listener 1883 0.0.0.0
     allow_anonymous true

charts/apps/mqtt/templates/deployment.yaml

@@ -27,7 +27,7 @@ spec:
               command:
                 - sh
                 - -c
-                - mosquitto_pub -h localhost -p 1884 -t health/ready -m "ready" -q 0 -i readiness_client -V 5
+                - mosquitto_pub -h localhost -p 1883 -t health/ready -m "ready" -q 0 -i readiness_client -V 5
             initialDelaySeconds: 10 # Give broker time to start
             periodSeconds: 20 # Check every 20 seconds
             timeoutSeconds: 5 # Fail if command takes longer than 5 seconds
@@ -37,7 +37,7 @@ spec:
               command:
                 - sh
                 - -c
-                - mosquitto_pub -h localhost -p 1884 -t health/ready -m "ready" -q 0 -i readiness_client -V 5
+                - mosquitto_pub -h localhost -p 1883 -t health/ready -m "ready" -q 0 -i readiness_client -V 5
             initialDelaySeconds: 15
             periodSeconds: 20
             timeoutSeconds: 5

charts/apps/mqtt/templates/http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}"
+    port:
+      number: 1883

charts/apps/mqtt/templates/service.yaml

@@ -5,7 +5,7 @@ metadata:
   labels:
     app: "{{ .Release.Name }}"
 spec:
-  type: ClusterIP
+  type: LoadBalancer
   ports:
     - port: 1883
       targetPort: 1883

charts/apps/mqtt/values.yaml

@@ -4,7 +4,7 @@ globals:
   domain: olsen.cloud
 image:
   repository: docker.io/eclipse-mosquitto
-  tag: latest
+  tag: latest@sha256:d219d3a72847f3aed6a1d66975972d3b17f86e39e8f6f6b86b4088b879c1a2d6
   pullPolicy: IfNotPresent
 subdomain: mqtt
 mode: json-rpc

charts/apps/music-assistant/values.yaml

@@ -2,6 +2,6 @@ globals:
   environment: prod
 image:
   repository: ghcr.io/music-assistant/server
-  tag: latest
+  tag: latest@sha256:f534116c53d49b3120961c908a5fa24f28684806bf222ccd74add9e16b105aa4
   pullPolicy: IfNotPresent
 subdomain: music-assistant

charts/apps/n8n/values.yaml

@@ -4,6 +4,6 @@ globals:
   domain: olsen.cloud
 image:
   repository: docker.n8n.io/n8nio/n8n
-  tag: latest
+  tag: latest@sha256:c5fe3ff0b79f7831dc21f9c709bdb7eee4fff4453a28ce84c8e9fa5b9f562686
   pullPolicy: IfNotPresent
 subdomain: n8n

charts/apps/nocodb/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: nocodb

charts/apps/nocodb/templates/deployment.yaml

@@ -0,0 +1,33 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}"
+    spec:
+      containers:
+        - name: "{{ .Release.Name }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: "{{ .Values.image.pullPolicy }}"
+          ports:
+            - containerPort: 8080
+              name: http
+          env:
+            - name: TZ
+              value: "{{ .Values.globals.timezone }}"
+            - name: PUID
+            - mountPath: /usr/app/data/
+              name: data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: "{{ .Release.Name }}-data"

charts/apps/nocodb/templates/external-http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/nocodb/templates/http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}"
+    port:
+      number: 80

charts/apps/nocodb/templates/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ .Release.Name }}-data'
+spec:
+  accessModes:
+    - 'ReadWriteOnce'
+  resources:
+    requests:
+      storage: '1Gi'
+  storageClassName: '{{ .Values.globals.environment }}'

charts/apps/nocodb/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 8080
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}"

charts/apps/nocodb/values.yaml

@@ -0,0 +1,9 @@
+globals:
+  environment: prod
+  domain: olsen.cloud
+  timezone: Europe/Amsterdam
+image:
+  repository: nocodb/nocodb
+  tag: latest
+  pullPolicy: IfNotPresent
+subdomain: nocodb

charts/apps/ollama/values.yaml

@@ -2,6 +2,6 @@ globals:
   environment: prod
 image:
   repository: ollama/ollama
-  tag: 0.11.8
+  tag: 0.12.0@sha256:14def4e0b9ac8c91b3ec6f7fa7684c924ffe244541d5fd827d9b89035cc33310
   pullPolicy: IfNotPresent
 subdomain: openwebui

charts/apps/openwebui/values.yaml

@@ -2,6 +2,6 @@ globals:
   environment: prod
 image:
   repository: ghcr.io/open-webui/open-webui
-  tag: main
+  tag: main@sha256:2e78a2f9f6f62173ae28d2203f3c9bcdadc614023380ebbe903ea9fab772535e
   pullPolicy: IfNotPresent
 subdomain: openwebui

charts/apps/photoprism/values.yaml

@@ -2,6 +2,6 @@ globals:
   environment: prod
 image:
   repository: photoprism/photoprism
-  tag: latest
+  tag: latest@sha256:2ba3a774ca1acc498096d7a5cb50df9cfecb7e3117a617d648093ff74eec2793
   pullPolicy: IfNotPresent
 subdomain: photoprism

charts/apps/readeck/values.yaml

@@ -4,6 +4,6 @@ globals:
   timezone: Europe/Amsterdam
 image:
   repository: codeberg.org/readeck/readeck
-  tag: latest
+  tag: latest@sha256:432cc2026f9dca3c33ce331f52c225287a2fa91a3c1dce8a4b0b7e9de4185c2f
   pullPolicy: IfNotPresent
 subdomain: readeck

charts/apps/signal/values.yaml

@@ -4,7 +4,7 @@ globals:
   domain: olsen.cloud
 image:
   repository: bbernhard/signal-cli-rest-api
-  tag: latest
+  tag: latest@sha256:e4bc92213b2a4da10fc429d16ed1754e90c2c169f186efbb9ce5f04da5322771
   pullPolicy: IfNotPresent
 subdomain: apprise
 mode: json-rpc

charts/apps/zot/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: zot

charts/apps/zot/templates/client.yaml

@@ -0,0 +1,10 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  redirectUris:
+    - path: /zot/auth/callback/oidc
+      subdomain: "{{ .Values.subdomain }}"
+      matchingMode: strict

charts/apps/zot/templates/config-map.yaml

@@ -0,0 +1,96 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-config-template
+data:
+  secrets.tpl.json: |
+    {
+      "clientid": "${CLIENT_ID}",
+      "clientsecret": "${CLIENT_SECRET}"
+    }
+  config.tpl.json: |
+    {
+      "storage": {
+        "rootDirectory": "/var/lib/registry",
+        "commit": false,
+        "dedupe": true,
+        "gc": true,
+        "gcDelay": "1h",
+        "gcInterval": "24h"
+      },
+      "log": {
+        "level": "info"
+      },
+      "http": {
+        "address": "0.0.0.0",
+        "port": "5000",
+        "externalUrl": "https://{{ .Values.subdomain }}.{{ .Values.globals.domain }}",
+        "ratelimit": {
+          "rate": 10,
+          "methods": [
+              {
+                  "method": "GET",
+                  "rate": 20
+              }
+          ]
+        },
+        "auth": {
+          "failDelay": 5,
+          "htpasswd": {
+            "path": "/etc/zot/htpasswd"
+          },
+          "openid": {
+            "providers": {
+              "oidc": {
+                "name": "main",
+                "credentialsFile": "/etc/zot/secrets.json",
+                "issuer": "${ISSUER}",
+                "scopes": ["openid", "profile", "email"]
+              }
+            }
+          }
+        },
+        "accessControl": {
+          "adminPolicy": {
+            "groups": ["admin"],
+            "actions": ["read", "create", "update", "delete"]
+          },
+          "repositories": {
+            "public/**": {
+              "anonymousPolicy": ["read"],
+              "defaultPolicy": ["read"],
+              "policies": [
+                {
+                  "users": ["*"],
+                  "actions": ["create", "update", "delete"]
+                }
+              ]
+            },
+            "**": {
+              "defaultPolicy": ["read"],
+              "policies": [
+                {
+                  "users": ["*"],
+                  "actions": ["create", "update", "delete"]
+                }
+              ]
+            }
+          }
+        }
+      },
+      "extensions": {
+        "ui": { "enable": true },
+        "metrics": { "enable": true },
+        "search": { "enable": true },
+        "scrub": {
+          "enable": true,
+          "interval": "24h"
+        },
+        "trust": {
+          "enable": true,
+          "cosign": true,
+          "notation": true
+        }
+        
+      }
+    }

charts/apps/zot/templates/deployment.yaml

@@ -0,0 +1,104 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}"
+    spec:
+      initContainers:
+        - name: render-config
+          image: alpine:3.20
+          command: ["/bin/sh", "-c"]
+          env:
+            - name: ISSUER
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: configurationIssuer
+            - name: CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientId
+            - name: CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientSecret
+            - name: PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-cluster"
+                  key: password
+          args:
+            - |
+              apk add --no-cache gettext apache2-utils >/dev/null
+              envsubst < /config-tpl/config.tpl.json > /config-out/config.json
+              echo "Rendered /etc/zot/config.json"
+              echo "---------------------------------------"
+              cat /config-out/config.json
+              echo "---------------------------------------"
+              envsubst < /config-tpl/secrets.tpl.json > /config-out/secrets.json
+              echo "Rendered /etc/zot/secrets.json"
+              echo "---------------------------------------"
+              cat /config-out/secrets.json
+              echo "---------------------------------------"
+              htpasswd -nbB cluster "$PASSWORD" > /config-out/htpasswd
+          volumeMounts:
+            - name: config-tpl
+              mountPath: /config-tpl
+            - name: config
+              mountPath: /config-out
+      containers:
+        - name: "{{ .Release.Name }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          ports:
+            - containerPort: 5000
+              name: http
+          env:
+            - name: TZ
+              value: "{{ .Values.globals.timezone }}"
+            - name: BASE_URL
+              value: https://{{ .Values.subdomain }}.{{ .Values.globals.domain }}
+          volumeMounts:
+            - mountPath: /var/lib/registry
+              name: data
+            - mountPath: /etc/zot
+              name: config
+          # readinessProbe:
+          #   httpGet:
+          #     path: /v2/
+          #     port: http
+          #   initialDelaySeconds: 3
+          #   periodSeconds: 10
+          # livenessProbe:
+          #   httpGet:
+          #     path: /v2/
+          #     port: http
+          #   initialDelaySeconds: 10
+          #   periodSeconds: 20
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: "{{ .Release.Name }}-data"
+        - name: config-tpl
+          configMap:
+            name: {{ .Release.Name }}-config-template
+            items:
+              - key: config.tpl.json
+                path: config.tpl.json
+              - key: secrets.tpl.json
+                path: secrets.tpl.json
+        - name: config
+          emptyDir: {}

charts/apps/zot/templates/external-http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/zot/templates/http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}"
+    port:
+      number: 80

charts/apps/zot/templates/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ .Release.Name }}-data'
+spec:
+  accessModes:
+    - 'ReadWriteOnce'
+  resources:
+    requests:
+      storage: '1Gi'
+  storageClassName: '{{ .Values.globals.environment }}'

charts/apps/zot/templates/secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: GenerateSecret
+metadata:
+  name: "{{ .Release.Name }}-cluster"
+spec:
+  fields:
+    - name: password
+      encoding: hex
+      length: 64

charts/apps/zot/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 5000
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}"

charts/apps/zot/values.yaml

@@ -0,0 +1,8 @@
+globals:
+  environment: prod
+  domain: olsen.cloud
+  timezone: Europe/Amsterdam
+subdomain: zot
+image:
+  repository: ghcr.io/project-zot/zot
+  tag: latest@sha256:cd2aea942f428630bcb4190542be6abd35e14177aab84fc7ccad0dca8ecb363d

charts/backup/values.yaml

@@ -4,7 +4,7 @@ globals:
   domain: olsen.cloud
 image:
   repository: garethgeorge/backrest
-  tag: latest
+  tag: latest@sha256:f8306faef0a3cbedc7daa55756f1d4c105d8c104aa773656bdad4fa8553dab5a
   pullPolicy: IfNotPresent
 subdomain: restic
 password:

charts/operator/values.yaml

@@ -6,7 +6,7 @@ image:
   repository: ghcr.io/morten-olsen/homelab-operator
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: main
+  tag: main@sha256:d6f0884b6e3044e39b61eb752496ddafee808e85ae54af2d40a6793fb026c261
 
 imagePullSecrets: []
 nameOverride: ''

helmfile.yaml.gotmpl

@@ -0,0 +1,83 @@
+environments:
+  default: {}
+---
+
+releases:
+  - name: volumes
+    chart: charts/apps/volumes
+    namespace: prod
+  - name: audiobookshelf
+    chart: charts/apps/audiobookshelf
+    namespace: prod
+  - name: baikal
+    chart: charts/apps/baikal
+    namespace: prod
+  - name: bytestash
+    chart: charts/apps/bytestash
+    namespace: prod
+  - name: calibre-web
+    chart: charts/apps/calibre-web
+    namespace: prod
+  - name: coder
+    chart: charts/apps/coder
+    namespace: prod
+  - name: data
+    chart: charts/apps/data
+    namespace: prod
+  - name: esphome
+    chart: charts/apps/esphome
+    namespace: prod
+  - name: gitea
+    chart: charts/apps/gitea
+    namespace: prod
+  - name: homarr
+    chart: charts/apps/homarr
+    namespace: prod
+  - name: home-assistant
+    chart: charts/apps/home-assistant
+    namespace: prod
+  - name: jellyfin
+    chart: charts/apps/jellyfin
+    namespace: prod
+  - name: linkwarden
+    chart: charts/apps/linkwarden
+    namespace: prod
+  - name: mealie
+    chart: charts/apps/mealie
+    namespace: prod
+  - name: metamcp
+    chart: charts/apps/metamcp
+    namespace: prod
+  - name: miniflux
+    chart: charts/apps/miniflux
+    namespace: prod
+  - name: mqtt
+    chart: charts/apps/mqtt
+    namespace: prod
+  - name: music-assistant
+    chart: charts/apps/music-assistant
+    namespace: prod
+  - name: n8n
+    chart: charts/apps/n8n
+    namespace: prod
+  - name: nocodb
+    chart: charts/apps/nocodb
+    namespace: prod
+  - name: ollama
+    chart: charts/apps/ollama
+    namespace: prod
+  - name: openwebui
+    chart: charts/apps/openwebui
+    namespace: prod
+  - name: photoprism
+    chart: charts/apps/photoprism
+    namespace: prod
+  - name: readeck
+    chart: charts/apps/readeck
+    namespace: prod
+  - name: signal
+    chart: charts/apps/signal
+    namespace: prod
+  - name: zot
+    chart: charts/apps/zot
+    namespace: prod

images/backup/Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine/git:latest
+FROM alpine/git:latest@sha256:bd54f921f6d803dfa3a4fe14b7defe36df1b71349a3e416547e333aa960f86e3
 # or a more specific image like a Debian slim or Ubuntu base image.
 RUN apk add --no-cache restic fuse-overlayfs
 WORKDIR /app

images/operator/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:23-slim
+FROM node:23-slim@sha256:86191b94d2a163be41f3dc7fe5e5fcaca8ba2f1be7275d98a06343483c17414a
 RUN corepack enable
 COPY package.json pnpm-lock.yaml ./
 RUN pnpm install --frozen-lockfile --prod

images/operator/package.json

@@ -10,10 +10,10 @@
     "eslint": "9.32.0",
     "eslint-config-prettier": "10.1.8",
     "eslint-plugin-import": "2.32.0",
-    "eslint-plugin-prettier": "5.5.3",
+    "eslint-plugin-prettier": "5.5.4",
     "json-schema-to-typescript": "^15.0.4",
     "prettier": "3.6.2",
-    "typescript": "5.8.3",
+    "typescript": "5.9.2",
     "typescript-eslint": "8.38.0"
   },
   "peerDependencies": {
@@ -31,7 +31,7 @@
     "execa": "^9.6.0",
     "knex": "^3.1.0",
     "p-queue": "^8.1.0",
-    "p-retry": "^6.2.1",
+    "p-retry": "^7.0.0",
     "pg": "^8.16.3",
     "sqlite3": "^5.1.7",
     "yaml": "^2.8.0",
@@ -43,7 +43,7 @@
     "#bootstrap/*": "./src/bootstrap/*",
     "#utils/*": "./src/utils/*"
   },
-  "packageManager": "pnpm@10.6.0",
+  "packageManager": "pnpm@10.17.1",
   "pnpm": {
     "onlyBuiltDependencies": [
       "sqlite3"

images/operator/pnpm-lock.yaml

@@ -4,6 +4,11 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
+patchedDependencies:
+  '@kubernetes/client-node':
+    hash: 0b0e5d32aa2930107c8c9b45df2639faf53fa12a389a551885d6e42d71f9429d
+    path: patches/@kubernetes__client-node.patch
+
 importers:
 
   .:
@@ -13,7 +18,7 @@ importers:
         version: 2025.6.3-1751754396
       '@kubernetes/client-node':
         specifier: ^1.3.0
-        version: 1.3.0(encoding@0.1.13)
+        version: 1.3.0(patch_hash=0b0e5d32aa2930107c8c9b45df2639faf53fa12a389a551885d6e42d71f9429d)(encoding@0.1.13)
       cloudflare:
         specifier: ^4.5.0
         version: 4.5.0(encoding@0.1.13)
@@ -28,7 +33,7 @@ importers:
         version: 2.2.3
       dotenv:
         specifier: ^17.2.1
-        version: 17.2.1
+        version: 17.2.2
       eventemitter3:
         specifier: ^5.0.1
         version: 5.0.1
@@ -40,10 +45,10 @@ importers:
         version: 3.1.0(pg@8.16.3)(sqlite3@5.1.7)
       p-queue:
         specifier: ^8.1.0
-        version: 8.1.0
+        version: 8.1.1
       p-retry:
-        specifier: ^6.2.1
-        version: 6.2.1
+        specifier: ^7.0.0
+        version: 7.0.0
       pg:
         specifier: ^8.16.3
         version: 8.16.3
@@ -52,10 +57,10 @@ importers:
         version: 5.1.7
       yaml:
         specifier: ^2.8.0
-        version: 2.8.0
+        version: 2.8.1
       zod:
         specifier: ^4.0.14
-        version: 4.0.14
+        version: 4.1.11
     devDependencies:
       '@eslint/eslintrc':
         specifier: 3.3.1
@@ -74,10 +79,10 @@ importers:
         version: 10.1.8(eslint@9.32.0)
       eslint-plugin-import:
         specifier: 2.32.0
-        version: 2.32.0(@typescript-eslint/parser@8.38.0(eslint@9.32.0)(typescript@5.8.3))(eslint@9.32.0)
+        version: 2.32.0(@typescript-eslint/parser@8.38.0(eslint@9.32.0)(typescript@5.9.2))(eslint@9.32.0)
       eslint-plugin-prettier:
-        specifier: 5.5.3
-        version: 5.5.3(eslint-config-prettier@10.1.8(eslint@9.32.0))(eslint@9.32.0)(prettier@3.6.2)
+        specifier: 5.5.4
+        version: 5.5.4(eslint-config-prettier@10.1.8(eslint@9.32.0))(eslint@9.32.0)(prettier@3.6.2)
       json-schema-to-typescript:
         specifier: ^15.0.4
         version: 15.0.4
@@ -85,11 +90,11 @@ importers:
         specifier: 3.6.2
         version: 3.6.2
       typescript:
-        specifier: 5.8.3
-        version: 5.8.3
+        specifier: 5.9.2
+        version: 5.9.2
       typescript-eslint:
         specifier: 8.38.0
-        version: 8.38.0(eslint@9.32.0)(typescript@5.8.3)
+        version: 8.38.0(eslint@9.32.0)(typescript@5.9.2)
 
 packages:
 
@@ -247,9 +252,6 @@ packages:
   '@types/node@22.16.5':
     resolution: {integrity: sha512-bJFoMATwIGaxxx8VJPeM8TonI8t579oRvgAuT8zFugJsJZgzqv0Fu8Mhp68iecjzG7cnN3mO2dJQ5uUM2EFrgQ==}
 
-  '@types/retry@0.12.2':
-    resolution: {integrity: sha512-XISRgDJ2Tc5q4TRqvgJtzsRkFYNJzZrhTdtMoGVBttwzzQJkPnS3WWTFc7kuDRoPtPakl+T+OfdEUjYJj7Jbow==}
-
   '@types/stream-buffers@3.0.7':
     resolution: {integrity: sha512-azOCy05sXVXrO+qklf0c/B07H/oHaIuDDAiHPVwlk3A9Ek+ksHyTeMajLZl3r76FxpPpxem//4Te61G1iW3Giw==}
 
@@ -614,8 +616,8 @@ packages:
     resolution: {integrity: sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw==}
     engines: {node: '>=0.10.0'}
 
-  dotenv@17.2.1:
-    resolution: {integrity: sha512-kQhDYKZecqnM0fCnzI5eIv5L4cAe/iRI+HqMbO/hbRdTAeXDG+M9FjipUxNfbARuEg4iHIbhnhs78BCHNbSxEQ==}
+  dotenv@17.2.2:
+    resolution: {integrity: sha512-Sf2LSQP+bOlhKWWyhFsn0UsfdK/kCWRv1iuA2gXAwt3dyNabr6QSj00I2V10pidqz69soatm9ZwZvpQMTIOd5Q==}
     engines: {node: '>=12'}
 
   dunder-proto@1.0.1:
@@ -717,8 +719,8 @@ packages:
       '@typescript-eslint/parser':
         optional: true
 
-  eslint-plugin-prettier@5.5.3:
-    resolution: {integrity: sha512-NAdMYww51ehKfDyDhv59/eIItUVzU0Io9H2E8nHNGKEeeqlnci+1gCvrHib6EmZdf6GxF+LCV5K7UC65Ezvw7w==}
+  eslint-plugin-prettier@5.5.4:
+    resolution: {integrity: sha512-swNtI95SToIz05YINMA6Ox5R057IMAmWZ26GqPxusAp1TZzj+IdY9tXNWWD3vkF/wEqydCONcwjTFpxybBqZsg==}
     engines: {node: ^14.18.0 || >=16.0.0}
     peerDependencies:
       '@types/eslint': '>=8.0.0'
@@ -1467,13 +1469,13 @@ packages:
     resolution: {integrity: sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==}
     engines: {node: '>=10'}
 
-  p-queue@8.1.0:
-    resolution: {integrity: sha512-mxLDbbGIBEXTJL0zEx8JIylaj3xQ7Z/7eEVjcF9fJX4DBiH9oqe+oahYnlKKxm0Ci9TlWTyhSHgygxMxjIB2jw==}
+  p-queue@8.1.1:
+    resolution: {integrity: sha512-aNZ+VfjobsWryoiPnEApGGmf5WmNsCo9xu8dfaYamG5qaLP7ClhLN6NgsFe6SwJ2UbLEBK5dv9x8Mn5+RVhMWQ==}
     engines: {node: '>=18'}
 
-  p-retry@6.2.1:
-    resolution: {integrity: sha512-hEt02O4hUct5wtwg4H4KcWgDdm+l1bOaEy/hWzd8xtXB9BqxTWBBhb+2ImAtH4Cv4rPjV76xN3Zumqk3k3AhhQ==}
-    engines: {node: '>=16.17'}
+  p-retry@7.0.0:
+    resolution: {integrity: sha512-3BgO9rjULJYyr0Y0pcsG7FZ+7JB/hfOODO8kx9ppumiO5jprUF92WK/Y7Q0xppZtq4VhTcPiVq7qWLQfIV5aKQ==}
+    engines: {node: '>=20'}
 
   p-timeout@6.1.4:
     resolution: {integrity: sha512-MyIV3ZA/PmyBN/ud8vV9XzwTrNtR4jFrObymZYnZqMmW0zA8Z17vnT0rBgFE/TlohB+YCHqXMgZzb3Csp49vqg==}
@@ -1652,10 +1654,6 @@ packages:
     resolution: {integrity: sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==}
     engines: {node: '>= 4'}
 
-  retry@0.13.1:
-    resolution: {integrity: sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==}
-    engines: {node: '>= 4'}
-
   reusify@1.1.0:
     resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
     engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
@@ -1920,8 +1918,8 @@ packages:
       eslint: ^8.57.0 || ^9.0.0
       typescript: '>=4.8.4 <5.9.0'
 
-  typescript@5.8.3:
-    resolution: {integrity: sha512-p1diW6TqL9L07nNxvRMM7hMMw4c5XOo/1ibL4aAIGmSAt9slTE1Xgw5KWuof2uTOvCg9BY7ZRi+GaF+7sfgPeQ==}
+  typescript@5.9.2:
+    resolution: {integrity: sha512-CWBzXQrc/qOkhidw1OzBTQuYRbfyxDXJMVJ1XNwUHGROVmuaeiEm3OslpZ1RV96d7SKKjZKrSJu3+t/xlw3R9A==}
     engines: {node: '>=14.17'}
     hasBin: true
 
@@ -2011,8 +2009,8 @@ packages:
   yallist@4.0.0:
     resolution: {integrity: sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==}
 
-  yaml@2.8.0:
-    resolution: {integrity: sha512-4lLa/EcQCB0cJkyts+FpIRx5G/llPxfP6VQU5KByHEhLxY3IJCH0f0Hy1MHI8sClTvsIb8qwRJ6R/ZdlDJ/leQ==}
+  yaml@2.8.1:
+    resolution: {integrity: sha512-lcYcMxX2PO9XMGvAJkJ3OsNMw+/7FKes7/hgerGUYWIoWu5j/+YQqcZr5JnPZWzOsEBgMbSbiSTn/dv/69Mkpw==}
     engines: {node: '>= 14.6'}
     hasBin: true
 
@@ -2024,8 +2022,8 @@ packages:
     resolution: {integrity: sha512-GQHQqAopRhwU8Kt1DDM8NjibDXHC8eoh1erhGAJPEyveY9qqVeXvVikNKrDz69sHowPMorbPUrH/mx8c50eiBQ==}
     engines: {node: '>=18'}
 
-  zod@4.0.14:
-    resolution: {integrity: sha512-nGFJTnJN6cM2v9kXL+SOBq3AtjQby3Mv5ySGFof5UGRHrRioSJ5iG680cYNjE/yWk671nROcpPj4hAS8nyLhSw==}
+  zod@4.1.11:
+    resolution: {integrity: sha512-WPsqwxITS2tzx1bzhIKsEs19ABD5vmCVa4xBo2tq/SrV4RNZtfws1EnCWQXM6yh8bD08a1idvkB5MZSBiZsjwg==}
 
 snapshots:
 
@@ -2107,7 +2105,7 @@ snapshots:
     dependencies:
       jsep: 1.4.0
 
-  '@kubernetes/client-node@1.3.0(encoding@0.1.13)':
+  '@kubernetes/client-node@1.3.0(patch_hash=0b0e5d32aa2930107c8c9b45df2639faf53fa12a389a551885d6e42d71f9429d)(encoding@0.1.13)':
     dependencies:
       '@types/js-yaml': 4.0.9
       '@types/node': 22.16.5
@@ -2194,47 +2192,45 @@ snapshots:
     dependencies:
       undici-types: 6.21.0
 
-  '@types/retry@0.12.2': {}
-
   '@types/stream-buffers@3.0.7':
     dependencies:
       '@types/node': 22.16.5
 
-  '@typescript-eslint/eslint-plugin@8.38.0(@typescript-eslint/parser@8.38.0(eslint@9.32.0)(typescript@5.8.3))(eslint@9.32.0)(typescript@5.8.3)':
+  '@typescript-eslint/eslint-plugin@8.38.0(@typescript-eslint/parser@8.38.0(eslint@9.32.0)(typescript@5.9.2))(eslint@9.32.0)(typescript@5.9.2)':
     dependencies:
       '@eslint-community/regexpp': 4.12.1
-      '@typescript-eslint/parser': 8.38.0(eslint@9.32.0)(typescript@5.8.3)
+      '@typescript-eslint/parser': 8.38.0(eslint@9.32.0)(typescript@5.9.2)
       '@typescript-eslint/scope-manager': 8.38.0
-      '@typescript-eslint/type-utils': 8.38.0(eslint@9.32.0)(typescript@5.8.3)
-      '@typescript-eslint/utils': 8.38.0(eslint@9.32.0)(typescript@5.8.3)
+      '@typescript-eslint/type-utils': 8.38.0(eslint@9.32.0)(typescript@5.9.2)
+      '@typescript-eslint/utils': 8.38.0(eslint@9.32.0)(typescript@5.9.2)
       '@typescript-eslint/visitor-keys': 8.38.0
       eslint: 9.32.0
       graphemer: 1.4.0
       ignore: 7.0.5
       natural-compare: 1.4.0
-      ts-api-utils: 2.1.0(typescript@5.8.3)
-      typescript: 5.8.3
+      ts-api-utils: 2.1.0(typescript@5.9.2)
+      typescript: 5.9.2
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/parser@8.38.0(eslint@9.32.0)(typescript@5.8.3)':
+  '@typescript-eslint/parser@8.38.0(eslint@9.32.0)(typescript@5.9.2)':
     dependencies:
       '@typescript-eslint/scope-manager': 8.38.0
       '@typescript-eslint/types': 8.38.0
-      '@typescript-eslint/typescript-estree': 8.38.0(typescript@5.8.3)
+      '@typescript-eslint/typescript-estree': 8.38.0(typescript@5.9.2)
       '@typescript-eslint/visitor-keys': 8.38.0
       debug: 4.4.1
       eslint: 9.32.0
-      typescript: 5.8.3
+      typescript: 5.9.2
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/project-service@8.38.0(typescript@5.8.3)':
+  '@typescript-eslint/project-service@8.38.0(typescript@5.9.2)':
     dependencies:
-      '@typescript-eslint/tsconfig-utils': 8.38.0(typescript@5.8.3)
+      '@typescript-eslint/tsconfig-utils': 8.38.0(typescript@5.9.2)
       '@typescript-eslint/types': 8.38.0
       debug: 4.4.1
-      typescript: 5.8.3
+      typescript: 5.9.2
     transitivePeerDependencies:
       - supports-color
 
@@ -2243,28 +2239,28 @@ snapshots:
       '@typescript-eslint/types': 8.38.0
       '@typescript-eslint/visitor-keys': 8.38.0
 
-  '@typescript-eslint/tsconfig-utils@8.38.0(typescript@5.8.3)':
+  '@typescript-eslint/tsconfig-utils@8.38.0(typescript@5.9.2)':
     dependencies:
-      typescript: 5.8.3
+      typescript: 5.9.2
 
-  '@typescript-eslint/type-utils@8.38.0(eslint@9.32.0)(typescript@5.8.3)':
+  '@typescript-eslint/type-utils@8.38.0(eslint@9.32.0)(typescript@5.9.2)':
     dependencies:
       '@typescript-eslint/types': 8.38.0
-      '@typescript-eslint/typescript-estree': 8.38.0(typescript@5.8.3)
-      '@typescript-eslint/utils': 8.38.0(eslint@9.32.0)(typescript@5.8.3)
+      '@typescript-eslint/typescript-estree': 8.38.0(typescript@5.9.2)
+      '@typescript-eslint/utils': 8.38.0(eslint@9.32.0)(typescript@5.9.2)
       debug: 4.4.1
       eslint: 9.32.0
-      ts-api-utils: 2.1.0(typescript@5.8.3)
-      typescript: 5.8.3
+      ts-api-utils: 2.1.0(typescript@5.9.2)
+      typescript: 5.9.2
     transitivePeerDependencies:
       - supports-color
 
   '@typescript-eslint/types@8.38.0': {}
 
-  '@typescript-eslint/typescript-estree@8.38.0(typescript@5.8.3)':
+  '@typescript-eslint/typescript-estree@8.38.0(typescript@5.9.2)':
     dependencies:
-      '@typescript-eslint/project-service': 8.38.0(typescript@5.8.3)
-      '@typescript-eslint/tsconfig-utils': 8.38.0(typescript@5.8.3)
+      '@typescript-eslint/project-service': 8.38.0(typescript@5.9.2)
+      '@typescript-eslint/tsconfig-utils': 8.38.0(typescript@5.9.2)
       '@typescript-eslint/types': 8.38.0
       '@typescript-eslint/visitor-keys': 8.38.0
       debug: 4.4.1
@@ -2272,19 +2268,19 @@ snapshots:
       is-glob: 4.0.3
       minimatch: 9.0.5
       semver: 7.7.2
-      ts-api-utils: 2.1.0(typescript@5.8.3)
-      typescript: 5.8.3
+      ts-api-utils: 2.1.0(typescript@5.9.2)
+      typescript: 5.9.2
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/utils@8.38.0(eslint@9.32.0)(typescript@5.8.3)':
+  '@typescript-eslint/utils@8.38.0(eslint@9.32.0)(typescript@5.9.2)':
     dependencies:
       '@eslint-community/eslint-utils': 4.7.0(eslint@9.32.0)
       '@typescript-eslint/scope-manager': 8.38.0
       '@typescript-eslint/types': 8.38.0
-      '@typescript-eslint/typescript-estree': 8.38.0(typescript@5.8.3)
+      '@typescript-eslint/typescript-estree': 8.38.0(typescript@5.9.2)
       eslint: 9.32.0
-      typescript: 5.8.3
+      typescript: 5.9.2
     transitivePeerDependencies:
       - supports-color
 
@@ -2651,7 +2647,7 @@ snapshots:
     dependencies:
       esutils: 2.0.3
 
-  dotenv@17.2.1: {}
+  dotenv@17.2.2: {}
 
   dunder-proto@1.0.1:
     dependencies:
@@ -2787,17 +2783,17 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-module-utils@2.12.1(@typescript-eslint/parser@8.38.0(eslint@9.32.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint@9.32.0):
+  eslint-module-utils@2.12.1(@typescript-eslint/parser@8.38.0(eslint@9.32.0)(typescript@5.9.2))(eslint-import-resolver-node@0.3.9)(eslint@9.32.0):
     dependencies:
       debug: 3.2.7
     optionalDependencies:
-      '@typescript-eslint/parser': 8.38.0(eslint@9.32.0)(typescript@5.8.3)
+      '@typescript-eslint/parser': 8.38.0(eslint@9.32.0)(typescript@5.9.2)
       eslint: 9.32.0
       eslint-import-resolver-node: 0.3.9
     transitivePeerDependencies:
       - supports-color
 
-  eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.38.0(eslint@9.32.0)(typescript@5.8.3))(eslint@9.32.0):
+  eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.38.0(eslint@9.32.0)(typescript@5.9.2))(eslint@9.32.0):
     dependencies:
       '@rtsao/scc': 1.1.0
       array-includes: 3.1.9
@@ -2808,7 +2804,7 @@ snapshots:
       doctrine: 2.1.0
       eslint: 9.32.0
       eslint-import-resolver-node: 0.3.9
-      eslint-module-utils: 2.12.1(@typescript-eslint/parser@8.38.0(eslint@9.32.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint@9.32.0)
+      eslint-module-utils: 2.12.1(@typescript-eslint/parser@8.38.0(eslint@9.32.0)(typescript@5.9.2))(eslint-import-resolver-node@0.3.9)(eslint@9.32.0)
       hasown: 2.0.2
       is-core-module: 2.16.1
       is-glob: 4.0.3
@@ -2820,13 +2816,13 @@ snapshots:
       string.prototype.trimend: 1.0.9
       tsconfig-paths: 3.15.0
     optionalDependencies:
-      '@typescript-eslint/parser': 8.38.0(eslint@9.32.0)(typescript@5.8.3)
+      '@typescript-eslint/parser': 8.38.0(eslint@9.32.0)(typescript@5.9.2)
     transitivePeerDependencies:
       - eslint-import-resolver-typescript
       - eslint-import-resolver-webpack
       - supports-color
 
-  eslint-plugin-prettier@5.5.3(eslint-config-prettier@10.1.8(eslint@9.32.0))(eslint@9.32.0)(prettier@3.6.2):
+  eslint-plugin-prettier@5.5.4(eslint-config-prettier@10.1.8(eslint@9.32.0))(eslint@9.32.0)(prettier@3.6.2):
     dependencies:
       eslint: 9.32.0
       prettier: 3.6.2
@@ -3646,16 +3642,14 @@ snapshots:
       aggregate-error: 3.1.0
     optional: true
 
-  p-queue@8.1.0:
+  p-queue@8.1.1:
     dependencies:
       eventemitter3: 5.0.1
       p-timeout: 6.1.4
 
-  p-retry@6.2.1:
+  p-retry@7.0.0:
     dependencies:
-      '@types/retry': 0.12.2
       is-network-error: 1.1.0
-      retry: 0.13.1
 
   p-timeout@6.1.4: {}
 
@@ -3824,8 +3818,6 @@ snapshots:
   retry@0.12.0:
     optional: true
 
-  retry@0.13.1: {}
-
   reusify@1.1.0: {}
 
   rfc4648@1.5.4: {}
@@ -4114,9 +4106,9 @@ snapshots:
 
   tr46@0.0.3: {}
 
-  ts-api-utils@2.1.0(typescript@5.8.3):
+  ts-api-utils@2.1.0(typescript@5.9.2):
     dependencies:
-      typescript: 5.8.3
+      typescript: 5.9.2
 
   tsconfig-paths@3.15.0:
     dependencies:
@@ -4166,18 +4158,18 @@ snapshots:
       possible-typed-array-names: 1.1.0
       reflect.getprototypeof: 1.0.10
 
-  typescript-eslint@8.38.0(eslint@9.32.0)(typescript@5.8.3):
+  typescript-eslint@8.38.0(eslint@9.32.0)(typescript@5.9.2):
     dependencies:
-      '@typescript-eslint/eslint-plugin': 8.38.0(@typescript-eslint/parser@8.38.0(eslint@9.32.0)(typescript@5.8.3))(eslint@9.32.0)(typescript@5.8.3)
-      '@typescript-eslint/parser': 8.38.0(eslint@9.32.0)(typescript@5.8.3)
-      '@typescript-eslint/typescript-estree': 8.38.0(typescript@5.8.3)
-      '@typescript-eslint/utils': 8.38.0(eslint@9.32.0)(typescript@5.8.3)
+      '@typescript-eslint/eslint-plugin': 8.38.0(@typescript-eslint/parser@8.38.0(eslint@9.32.0)(typescript@5.9.2))(eslint@9.32.0)(typescript@5.9.2)
+      '@typescript-eslint/parser': 8.38.0(eslint@9.32.0)(typescript@5.9.2)
+      '@typescript-eslint/typescript-estree': 8.38.0(typescript@5.9.2)
+      '@typescript-eslint/utils': 8.38.0(eslint@9.32.0)(typescript@5.9.2)
       eslint: 9.32.0
-      typescript: 5.8.3
+      typescript: 5.9.2
     transitivePeerDependencies:
       - supports-color
 
-  typescript@5.8.3: {}
+  typescript@5.9.2: {}
 
   unbox-primitive@1.1.0:
     dependencies:
@@ -4277,10 +4269,10 @@ snapshots:
 
   yallist@4.0.0: {}
 
-  yaml@2.8.0: {}
+  yaml@2.8.1: {}
 
   yocto-queue@0.1.0: {}
 
   yoctocolors@2.1.1: {}
 
-  zod@4.0.14: {}
+  zod@4.1.11: {}

notes.md

@@ -0,0 +1 @@
+![authentik bg](/static/dist/assets/images/flow_background.jpg)

renovate.json5

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:base"
+  ],
+  "packageRules": [
+    {
+      "groupName": "Docker images",
+      "groupSlug": "dockerimages",
+      "matchDatasources": ["docker"],
+      "pinDigests": true
+    }
+  ],
+  "helm-values": {
+    "fileMatch": ["^charts/.*/values\\.yaml$"]
+  },
+  "regexManagers": [
+    {
+      "fileMatch": ["^charts/.*/values\\.yaml$"],
+      "matchStrings": [
+        "repository:\s*'(?<depName>.*?)'\n\s*tag:\s*'(?<currentValue>.*?)'",
+        "repository:\s*\"(?<depName>.*?)\"\n\s*tag:\s*\"(?<currentValue>.*?)\"",
+        "repository:\s*(?<depName>.*?)\n\s*tag:\s*(?<currentValue>.*)"
+      ],
+      "datasourceTemplate": "docker"
+    }
+  ]
+}

values.yaml

@@ -0,0 +1,4 @@
+globals:
+  environment: prod
+  domain: olsen.cloud
+  timezone: Europe/Amsterdam