Merge pull request #69 from rubenhensen/renovate/towfiqi-serpbear-3.x

chore(deps): update towfiqi/serpbear docker tag to v3.1.2

apps/templates/authentik-helm.yaml

@@ -103,6 +103,8 @@ spec:
               requests:
                 cpu: 70m
                 memory: 560Mi
+              limits:
+                memory: 1536Mi
             volumes:
               - name: patched-ca-bundle
                 configMap:
@@ -192,6 +194,8 @@ spec:
               requests:
                 cpu: 100m
                 memory: 336Mi
+              limits:
+                memory: 1Gi
             volumes:
               - name: patched-ca-bundle
                 configMap:

apps/templates/cert-manager-helm.yaml

@@ -38,16 +38,22 @@ spec:
           requests:
             cpu: 10m
             memory: 48Mi
+          limits:
+            memory: 128Mi
         cainjector:
           resources:
             requests:
               cpu: 10m
               memory: 80Mi
+            limits:
+              memory: 256Mi
         webhook:
           resources:
             requests:
               cpu: 10m
               memory: 32Mi
+            limits:
+              memory: 128Mi
   syncPolicy:
     syncOptions:
     - CreateNamespace=true

apps/templates/cloudnativepg-helm.yaml

@@ -28,6 +28,8 @@ spec:
           requests:
             cpu: 10m
             memory: 48Mi
+          limits:
+            memory: 128Mi
   destination:
     server: https://kubernetes.default.svc
     namespace: cnpg-system

apps/templates/external-secrets-helm.yaml

@@ -24,16 +24,22 @@ spec:
             requests:
               cpu: 20m
               memory: 64Mi
+            limits:
+              memory: 128Mi
           certController:
             resources:
               requests:
                 cpu: 10m
                 memory: 64Mi
+              limits:
+                memory: 128Mi
           webhook:
             resources:
               requests:
                 cpu: 10m
                 memory: 32Mi
+              limits:
+                memory: 128Mi
   destination:
     server: https://kubernetes.default.svc
     namespace: external-secrets

apps/templates/mbgwp-official-helm.yaml

@@ -12,7 +12,7 @@ spec:
   project: default
   source:
     repoURL: https://groundhog2k.github.io/helm-charts/
-    targetRevision: 0.16.7
+    targetRevision: 0.16.8
     chart: wordpress
     helm:
       values: |

apps/templates/plugin-barman-cloud-helm.yaml

@@ -21,6 +21,8 @@ spec:
           requests:
             cpu: 10m
             memory: 64Mi
+          limits:
+            memory: 128Mi
   destination:
     server: https://kubernetes.default.svc
     namespace: cnpg-system

argocd/overlays/resources.patch.yaml

@@ -1,6 +1,6 @@
 # Requests from what the components used on 2026-10-25 (kubectl top every
-# 5 minutes; highest value plus 10%). No limits until there are daytime
-# numbers, see docs/roadmap.md.
+# 5 minutes; highest value plus 10%). Memory limits at about twice the
+# highest value seen then or on 2026-10-27, rounded up; no CPU limits.
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
@@ -14,6 +14,8 @@ spec:
             requests:
               cpu: 150m
               memory: 704Mi
+            limits:
+              memory: 2560Mi
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -28,6 +30,8 @@ spec:
             requests:
               cpu: 100m
               memory: 128Mi
+            limits:
+              memory: 512Mi
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -42,6 +46,8 @@ spec:
             requests:
               cpu: 10m
               memory: 64Mi
+            limits:
+              memory: 256Mi
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -56,6 +62,8 @@ spec:
             requests:
               cpu: 20m
               memory: 96Mi
+            limits:
+              memory: 256Mi
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -70,6 +78,8 @@ spec:
             requests:
               cpu: 10m
               memory: 48Mi
+            limits:
+              memory: 128Mi
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -84,6 +94,8 @@ spec:
             requests:
               cpu: 10m
               memory: 48Mi
+            limits:
+              memory: 128Mi
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -98,3 +110,5 @@ spec:
             requests:
               cpu: 10m
               memory: 32Mi
+            limits:
+              memory: 128Mi

authentik/postgresql-backup.yaml

@@ -67,6 +67,8 @@ spec:
       requests:
         cpu: 10m
         memory: 64Mi
+      limits:
+        memory: 512Mi
     env:
       # Newer boto3 adds checksums that S3-compatible stores can reject;
       # the plugin's docs suggest sending them only when required.

authentik/postgresql-cluster.yaml

@@ -18,6 +18,8 @@ spec:
     requests:
       cpu: 50m
       memory: 256Mi
+    limits:
+      memory: 1Gi
   bootstrap:
     initdb:
       database: authentik

dns/domains/rubenhensen.nl.yaml

@@ -18,7 +18,7 @@ records:
   - name: "ldap"
     expire: 300
     type: A
-    content: "62.41.86.27"
+    content: "62.41.86.53"
   - name: "argocd"
     expire: 300
     type: A
@@ -60,7 +60,7 @@ records:
   - name: "s2"
     expire: 300
     type: A
-    content: "62.41.86.27"
+    content: "62.41.86.53"
   # ntfy for Gatus alerts, one next to each Gatus. Same reasoning as s2.
   - name: "ntfy1"
     expire: 300
@@ -69,7 +69,7 @@ records:
   - name: "ntfy2"
     expire: 300
     type: A
-    content: "62.41.86.27"
+    content: "62.41.86.53"
   - name: "@"
     expire: 300
     type: MX

docs/roadmap.md

@@ -1,22 +1,27 @@
 # Roadmap
 
-Where the cluster stands and what is left, as of 2026-10-25. Takes over
+Where the cluster stands and what is left, as of 2026-10-28. Takes over
 from wishlist.txt (January 2026, removed); its items are sorted in at the
 bottom.
 
 ## State
 
 One node: opti1, an OptiPlex 5060 with an i5-8600T, 32 GB and one 1 TB
-SATA SSD that is 72% full. microk8s v1.36.5 from 1.36/edge, snap held.
-35 Argo CD apps (with metrics-server), all Synced/Healthy; every Longhorn
-volume has one replica. authentik 2026.8.5, Vault 2.2.1. Backups go to the
-NAS (192.168.1.99): Longhorn to NFS at 00:00 (7 kept), Velero to Garage
-(MinIO until 2026-10-26) at 01:00 (daily kept 30 days, weekly 90 days).
+SATA SSD that is 54% full. microk8s v1.36.5 from 1.36/edge, snap held.
+39 Argo CD apps (with metrics-server), all Synced/Healthy; every Longhorn
+volume has one replica. authentik 2026.8.5, Vault 2.2.1, immich 3.3.5 on
+PostgreSQL 17, MariaDB 11.4.13. Memory requests and limits on everything
+but Longhorn, the Vault servers, calico and the LDAP outpost. Backups go
+to the NAS (192.168.1.99): Longhorn to NFS at 00:00 (7 kept), Velero to
+Garage (MinIO until 2026-10-26) at 01:00 (daily kept 30 days, weekly 90
+days), and CNPG to Garage (a base backup at 03:00, the WAL every 5
+minutes, 30 days).
 Gatus on s1 (node001, Hetzner) and s2 (home) watch each other and alert
 through ntfy; s2 also gets an hourly report from inside the cluster on the
 backups, Vault's seal, the Argo CD apps and the CNPG clusters.
-Every app namespace has NetworkPolicies, and CI renders and validates all
-apps on every PR. node001 runs mail and tunnels the public hosts home.
+Every namespace with pods but kube-system has NetworkPolicies, and CI
+renders and validates all apps on every PR. node001 runs mail and tunnels
+the public hosts home.
 
 ## Follow-ups from this week
 
@@ -26,14 +31,22 @@ docs/longhorn-second-ssd.md:
 - [x] Read `~/iosample.log` on opti1: the worst stretch was not the
   backups but 8.5 hours of Longhorn merging immich-claim's deleted
   snapshots (2026-10-24 14:30-23:15), see docs/upgrade-k8s-1.33.md
-- [ ] From 2026-10-27, if immich runs without problems: delete
-  `immich/postgresql-cluster.yaml` (the PG14 cluster still runs, 20 GiB),
-  the Longhorn snapshots and backups `immich-pg14-pre-vchord` and
-  `immich-pg17-pre-v3`, and both dumps in `~` on opti1. PostgreSQL 14
-  reaches end of life on 2026-11-12
+- [x] From 2026-10-27, if immich runs without problems: delete
+  `immich/postgresql-cluster.yaml` (the PG14 cluster, 20 GiB), the
+  Longhorn snapshots and backups `immich-pg14-pre-vchord` and
+  `immich-pg17-pre-v3`, and both dumps in `~` on opti1. Done 2026-10-28
+  (PR #61), with the PG14 volume's other Longhorn backups.
+  `immich-pg17-pre-v3` only ever was a snapshot
 - [ ] The upgrade's dqlite and backend copies in `/root/` on opti1
   (`backend-*.tar`, `dqlite-pre-*`)
-- [ ] Log in to immich as a jeugdlid (quota 0)
+- [ ] Log in to immich as a jeugdlid (quota 0): no uploads, albums as
+  viewer, people searchable but not renamable
+- [x] Searching by face: people are per user in immich, and a partner's
+  library doesn't bring its people along, so since the personal accounts
+  only the group account could. share-sync now puts everyone in the
+  group account's cluster group and shares its people (immich 3.3's
+  person sharing; PR #59, 2026-10-28): 4430 people, 169 named, for each
+  of the 6 accounts, with write access for those who may upload
 - [ ] Back to 1.36/stable once it is at v1.36.5 or later (still v1.36.2 on
   2026-10-25). The snap is held, so microk8s gets no updates at all until
   someone refreshes it
@@ -215,7 +228,8 @@ Findings from 2026-10-25:
   22:48, since the old pod waited for its connections to close. The first
   base backups: 46 MB in 29 s and 776 MB in 3.5 minutes. immich's
   `immediate` backup ran before the plugin was up and failed; a manual one
-  (`immich-postgres-17-first`) went through
+  (`immich-postgres-17-first`) went through. The 03:00 base backups of
+  10-27 and 10-28 completed for both; the failed backup is deleted
 - [ ] Restore one of them into a new Cluster (`bootstrap.recovery` from
   the ObjectStore, to a point in time) to see that it works. After that,
   decide whether Velero still needs to copy the CNPG data directories
@@ -241,11 +255,13 @@ Findings from 2026-10-25:
   MinIO still has the kopia repositories of namespaces that are gone
   (~156 GB: nextcloud, ttrss, whisper-priv, whisper-webui, blog, ghost,
   mbg-wordpress, sogo, sogo-mail, outrun-game, owntracks); decide first
-  whether any of them is worth keeping
+  whether any of them is worth keeping. The dailies of 10-27 and 10-28
+  on Garage completed without errors
 - [ ] Garage's SQLite WAL (`meta/db.sqlite-wal`) was 1.7 GB on
   2026-10-26 next to a 270 MB database, and going by the folders in
   `meta/snapshots`, each 6-hourly metadata snapshot takes about 70
-  minutes. Not growing; check again after a week of normal use
+  minutes. Not growing; check again after a week of normal use. 1.8 GB
+  on 2026-10-28
 
 ### 6. Monitoring
 
@@ -314,13 +330,14 @@ Counted 2026-10-25 over the 73 running containers:
   OIDC logins of Vault and FreshRSS reach authentik, all 24
   ExternalSecrets refresh, raft intact; Gitea no longer reaches the NAS
   or Vault, and a pod in `default` no longer reaches Vault or Gitea
-- [ ] Certificates couldn't renew in those 11 namespaces: Envoy may only
+- [x] Certificates couldn't renew in those 11 namespaces: Envoy may only
   reach each app's own port, and cert-manager's HTTP-01 solver listens on
   8089. ynab's renewal hung from 2026-10-26 17:35 UTC; a policy for the
   solver pods, applied by hand in actual-budget that evening, let it
   through within 20 seconds (now valid until 2027-01-24). PR #51 adds it
-  to all 11. Without it the next renewals hang too: gitea on 11-15,
-  bolletjestrui on 11-18, the rest from 12-03
+  to all 11 (merged 2026-10-26 22:27 UTC). Without it the next renewals
+  would hang too; the first real test is gitea's on 11-15, then
+  bolletjestrui on 11-18 and the rest from 12-03
 - [x] The infrastructure namespaces (cert-manager, cnpg-system,
   external-secrets, envoy-gateway-system, velero, mariadb-system, dns,
   default), merged 2026-10-26: PR #54 for envoy-gateway-system (22:31
@@ -341,8 +358,19 @@ Counted 2026-10-25 over the 73 running containers:
   requested. Still without requests: Longhorn (22 containers, its chart),
   the Vault servers, the LDAP outpost, immich's PG14 cluster and three in
   kube-system
-- [ ] Memory limits, once there are daytime numbers: the night ones miss
-  immich's machine learning at work (it idles at 234Mi)
+- [x] Memory limits: PR #58, for everything that got requests in #33.
+  About twice the highest memory from `kubectl top` every 5 minutes from
+  2026-10-26 22:29 to 2026-10-27 21:55 UTC or the night of #33, rounded
+  up; no CPU limits. No OOM kills that day. immich's machine learning
+  sat idle all day (240Mi), so on 2026-10-28 a test image went through
+  CLIP, face recognition and OCR inside the container: 884Mi with all
+  three loaded, limit 2Gi
+- [ ] authentik's server fails its liveness probe while its database is
+  away (`/-/health/live/` answers 500 when PostgreSQL is down), so each
+  database restart gets the server killed too, as on 2026-10-27 for
+  PostgreSQL 17.11. The login only comes back once the server has
+  started again. A liveness probe that doesn't touch the database would
+  leave it at not ready
 - [x] WordPress (scoutingmbg.nl) was OOMKilled at 08:27:59 UTC on
   2026-10-25, its third restart: a crawler asked for 88 pages and assets
   within a few seconds (normally ~6 a minute), Apache started a PHP worker
@@ -408,10 +436,15 @@ every PR.
   fail the run; tested with a planted Secret and an untagged image), plus
   PR annotations for containers without requests or probes. freshrss's
   `alpine/git` init container had no tag; now `v2.52.0`
-- [ ] Automerge patch versions of low-risk apps now that CI runs: PR #52
-  (ntfy, gatus, freshrss, serpbear, actual-budget and CI's own tools;
-  three days after the release, only on weekday evenings and at the
-  weekend, when the cluster can be reached)
+- [x] Automerge patch versions of low-risk apps now that CI runs: PR #52,
+  merged 2026-10-26 (ntfy, gatus, freshrss, serpbear, actual-budget and
+  CI's own tools; three days after the release, only on weekday evenings
+  and at the weekend, when the cluster can be reached). Nothing has
+  merged itself yet by 2026-10-28
+- [x] MariaDB stays on 11.4 (PR #60, 2026-10-28): Renovate offered 11.8.9
+  as a minor update (#42, closed), but 11.8 can't be rolled back and has
+  community support until June 2028, against May 2029 for 11.4. Renovate
+  now only offers 11.4 patches; the next LTS step, 12.3, is by hand
 - [x] Renovate listed external-snapshotter twice (#15 and #24): its
   `argocd` manager and a custom `github-tags` regex both matched. The
   regex is gone; Renovate should close #15 by itself
@@ -503,8 +536,8 @@ critical / high:
 
 | Image | Crit | High | What to do |
 |---|---|---|---|
-| tensorchord/cloudnative-pgvecto.rs:14-v0.2.1 | 38 | 342 | immich's old PG14 cluster; goes with the cleanup from 2026-10-27 |
-| cloudnative-pg/postgresql:17.4 | 27 | 260 | authentik's database, a Debian 11 image. Renovate now offers 17.7; a `17.x-standard-trixie` image is more current |
+| tensorchord/cloudnative-pgvecto.rs:14-v0.2.1 | 38 | 342 | immich's old PG14 cluster; deleted 2026-10-28 |
+| cloudnative-pg/postgresql:17.4 | 27 | 260 | authentik's database, a Debian 11 image. 17.11 since PR #40 (2026-10-27); not scanned again, a `17.x-standard-trixie` image is more current |
 | tensorchord/cloudnative-vectorchord:17.11-1.1.1 | 17 | 136 | immich's database; look for a newer tag |
 | longhornio/longhorn-instance-manager:v1.7.3 | 11 | 159 | still serves 16 volumes, see below |
 | actualbudget/actual-server:26.6.0 | 8 | 83 | chart 1.8.9; Renovate now covers it |
@@ -514,7 +547,7 @@ critical / high:
 | rubenhensen/bolletjestrui:main-10268f1 | 5 | 76 | rebuild on a current base image |
 | coredns/coredns:1.10.1 | 5 | 70 | see below |
 | dexidp/dex:v2.45.1, argocd v3.5.6, redis 8.2.3 | 4, 1, 2 | | come with Argo CD |
-| mariadb:11.4.5 | 4 | 65 | the newest 11.4 patch; Renovate now covers it |
+| mariadb:11.4.5 | 4 | 65 | 11.4.13 since PR #60; Renovate stays on 11.4 (it offered 11.8, PR #42) |
 | calico v3.29.3 | 2-3 | ~50 | comes with microk8s |
 | goauthentik ldap / server 2026.8.5 | 3, 1 | 74, 65 | the next authentik patch |
 

docs/upgrade-k8s-1.33.md

@@ -169,8 +169,9 @@ pgvecto.rs. Done 2026-10-24, about an hour of immich downtime:
   v2.4.1 refused to start (it only accepts VectorChord <0.6); v2.5.0 and up
   accept <2, so immich went to v2.7.5, the last 2.x. It rebuilt both
   indexes as `vchordrq` in about 1.5 minutes
-- [ ] After a few days without problems: delete the old cluster
+- [x] After a few days without problems: delete the old cluster
   (`immich/postgresql-cluster.yaml`), the snapshot/backup and the dump.
+  Done 2026-10-28 (PR #61), with the PG14 volume's Longhorn backups.
   Rolling back means reverting the old volume to the snapshot, since its
   embeddings are now `real[]` without pgvecto.rs
 - [x] immich 3.x: v2.7.5 → v3.3.5 with chart 0.10.3 → 0.13.4 on
@@ -189,8 +190,8 @@ pgvecto.rs. Done 2026-10-24, about an hour of immich downtime:
   (v3.3.0), for faster ML with less memory; numerically the same models,
   so no jobs to rerun. The model cache is an emptyDir, so the one-off
   preparation repeats on every restart
-- [ ] After a few days without problems: delete the `immich-pg17-pre-v3`
-  snapshot and dump together with the PG14 leftovers above
+- [x] After a few days without problems: delete the `immich-pg17-pre-v3`
+  snapshot and dump together with the PG14 leftovers above (2026-10-28)
 
 ## k8s-dqlite write stalls (found 2026-10-22)
 

freshrss/freshrss-deployment.yaml

@@ -83,6 +83,8 @@ spec:
             requests:
               cpu: 50m
               memory: 176Mi
+            limits:
+              memory: 512Mi
           # TCP, because mod_auth_openidc answers 401 to anything that isn't a
           # browser.
           readinessProbe:

gatus/README.md

@@ -62,7 +62,7 @@ node, both PowerDNS Authoritative. PowerDNS LUA records health-check
 addresses and only return the healthy ones:
 
 ```
-@  30  IN  LUA  A  "ifurlup('https://status.rubenhensen.nl/health', {{'46.224.26.65'}, {'62.41.86.27'}})"
+@  30  IN  LUA  A  "ifurlup('https://status.rubenhensen.nl/health', {{'46.224.26.65'}, {'62.41.86.53'}})"
 ```
 
 The double braces make two groups. PowerDNS returns the first group that has
@@ -85,7 +85,7 @@ Steps:
 
 1. Parent zone (`dns/domains/rubenhensen.nl.yaml`, synced to TransIP): add
    `status NS ns-hetzner.rubenhensen.nl.` and `status NS ns-home.rubenhensen.nl.`,
-   plus A records for `ns-hetzner` (46.224.26.65) and `ns-home` (62.41.86.27).
+   plus A records for `ns-hetzner` (46.224.26.65) and `ns-home` (62.41.86.53).
    First check that TransIP accepts NS records for a subdomain.
 2. Hetzner: run PowerDNS from node001.nix with `enable-lua-records=yes` and
    the bind backend. Use the same zone file as home. Open 53/udp and 53/tcp.

gatus/backup-check.yaml

@@ -256,7 +256,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: check
-              image: python:3.15.1-alpine3.24
+              image: python:3.15.2-alpine3.24
               command: ["python", "/script/check.py"]
               env:
                 - name: PYTHONDONTWRITEBYTECODE

gatus/gatus-deployment.yaml

@@ -16,7 +16,7 @@ spec:
     spec:
       containers:
         - name: gatus
-          image: twinproduction/gatus:v5.37.0
+          image: twinproduction/gatus:v5.38.0
           env:
             - name: GATUS_CONFIG_PATH
               value: /config/config.yaml

gitea/gitea-deployment.yaml

@@ -20,7 +20,7 @@ spec:
         fsGroup: 1000
       containers:
         - name: gitea
-          image: gitea/gitea:28.2.0
+          image: gitea/gitea:28.3.0
           env:
             - name: USER_UID
               value: "1000"
@@ -54,6 +54,8 @@ spec:
             requests:
               cpu: 20m
               memory: 336Mi
+            limits:
+              memory: 1Gi
           # /api/healthz checks the database and the cache.
           readinessProbe:
             httpGet:

immich/helm-immich.yaml

@@ -67,6 +67,8 @@ spec:
                       requests:
                         cpu: 10m
                         memory: 64Mi
+                      limits:
+                        memory: 256Mi
                     image:
                       repository: docker.io/valkey/valkey
                       tag: 9.1.2-alpine@sha256:48332870af354a799964c0012ae1194a0bf2bf894eb508f945810596dc2d8d11
@@ -93,6 +95,8 @@ spec:
                       requests:
                         cpu: 100m
                         memory: 1280Mi
+                      limits:
+                        memory: 3Gi
                     # Node trusts its built-in roots, which still include the
                     # ones above the compromised eMudhra intermediates. Use
                     # patched-ca-bundle through OpenSSL until Node ships a fix.
@@ -117,12 +121,14 @@ spec:
                     image:
                       repository: ghcr.io/immich-app/immich-machine-learning
                       pullPolicy: IfNotPresent
-                    # Idle at night (234Mi); the models take over a GiB when
-                    # it works.
+                    # Idle at 240Mi; 884Mi with CLIP, face recognition and
+                    # OCR loaded (2026-10-28, a test image through each).
                     resources:
                       requests:
                         cpu: 50m
                         memory: 1Gi
+                      limits:
+                        memory: 2Gi
                     env:
                       TRANSFORMERS_CACHE: /cache
                       HF_XET_CACHE: /cache/huggingface-xet

immich/postgresql-backup.yaml

@@ -71,6 +71,8 @@ spec:
       requests:
         cpu: 10m
         memory: 64Mi
+      limits:
+        memory: 512Mi
     env:
       # Newer boto3 adds checksums that S3-compatible stores can reject;
       # the plugin's docs suggest sending them only when required.

immich/postgresql-cluster-17.yaml

@@ -13,6 +13,8 @@ spec:
     requests:
       cpu: 20m
       memory: 320Mi
+    limits:
+      memory: 1Gi
 
   postgresql:
     shared_preload_libraries:
@@ -27,7 +29,10 @@ spec:
 
   # Filled once from the PostgreSQL 14 cluster (immich-postgres) after its
   # embedding columns were turned into real[] and pgvecto.rs was dropped,
-  # see docs/upgrade-k8s-1.33.md.
+  # see docs/upgrade-k8s-1.33.md. That cluster is gone since 2026-10-28, so
+  # creating this Cluster again fails here, on purpose: an empty database
+  # would start immich with an empty library. Restore from Garage instead
+  # (bootstrap.recovery, see postgresql-backup.yaml).
   bootstrap:
     initdb:
       database: immich

immich/postgresql-cluster.yaml

@@ -1,28 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: immich-postgres
-  namespace: immich
-spec:
-  instances: 1
-
-  # Use TensorChord's CNPG-compatible image with pgvecto.rs v0.2.1
-  imageName: ghcr.io/tensorchord/cloudnative-pgvecto.rs:14-v0.2.1
-
-  postgresql:
-    shared_preload_libraries:
-      - "vectors.so"
-
-  bootstrap:
-    initdb:
-      database: immich
-      owner: immich
-      postInitSQL:
-        - CREATE EXTENSION IF NOT EXISTS vectors;
-        - CREATE EXTENSION IF NOT EXISTS cube;
-        - CREATE EXTENSION IF NOT EXISTS earthdistance CASCADE;
-        - ALTER USER immich WITH SUPERUSER;
-
-  storage:
-    size: 20Gi
-    storageClass: longhorn

mariadb-operator/operator-helm.yaml

@@ -20,6 +20,8 @@ spec:
           requests:
             cpu: 10m
             memory: 48Mi
+          limits:
+            memory: 128Mi
         metrics:
           enabled: true
           serviceMonitor:
@@ -29,6 +31,8 @@ spec:
             requests:
               cpu: 10m
               memory: 32Mi
+            limits:
+              memory: 128Mi
           serviceMonitor:
             enabled: false
         certController:
@@ -36,6 +40,8 @@ spec:
             requests:
               cpu: 10m
               memory: 32Mi
+            limits:
+              memory: 128Mi
           serviceMonitor:
             enabled: false
   syncPolicy:

mbgwp/mariadb-cluster.yaml

@@ -8,7 +8,7 @@ spec:
     name: mbgwp-mariadb-credentials
     key: root-password
 
-  image: mariadb:11.4.5
+  image: mariadb:11.4.13
   imagePullPolicy: IfNotPresent
 
   port: 3306

nix-infra-machine/nodes/node001.nix

@@ -2,7 +2,7 @@
 let
   # Public IP of the home network where the k8s cluster ingress lives.
   # Keep in sync with dns/domains/rubenhensen.nl.yaml.
-  homeIP = "62.41.86.27";
+  homeIP = "62.41.86.53";
 
   # Hosts tunneled to the home k8s cluster. Each entry gets:
   #   * an SNI map entry for TCP passthrough on :443

ntfy/ntfy-deployment.yaml

@@ -16,7 +16,7 @@ spec:
     spec:
       containers:
         - name: ntfy
-          image: binwiederhier/ntfy:v2.34.0
+          image: binwiederhier/ntfy:v2.37.2
           args: ["serve"]
           env:
             - name: NTFY_BASE_URL

renovate.json

@@ -82,14 +82,20 @@
       "description": "A PostgreSQL major upgrade needs pg_upgrade or a dump, not a tag bump",
       "matchDepNames": [
         "ghcr.io/cloudnative-pg/postgresql",
-        "ghcr.io/tensorchord/cloudnative-vectorchord",
-        "ghcr.io/tensorchord/cloudnative-pgvecto.rs"
+        "ghcr.io/tensorchord/cloudnative-vectorchord"
       ],
       "matchUpdateTypes": [
         "major"
       ],
       "enabled": false
     },
+    {
+      "description": "MariaDB goes from one LTS to the next by hand, after a dump: there is no way back. 11.4 has community support until May 2029, longer than 11.8 (June 2028); the next step is 12.3 (June 2029). Within 11.4 the patches come through",
+      "matchDepNames": [
+        "mariadb"
+      ],
+      "allowedVersions": "<11.5"
+    },
     {
       "description": "Patch updates of apps that hold little state and are easy to roll back, and of CI's tools, merge themselves once CI passes: three days after the release, in the evening or at the weekend, when the cluster can be reached. Not the databases, operators, Vault, authentik, Longhorn, Velero, immich, Gitea or WordPress. Renovate merges itself; the repo has no branch protection for GitHub's auto-merge to wait on",
       "matchFileNames": [

serpbear/serpbear-deployment.yaml

@@ -51,7 +51,7 @@ spec:
               value: --use-openssl-ca
             - name: SSL_CERT_FILE
               value: /etc/ssl/certs/ca-certificates.crt
-          image: towfiqi/serpbear:3.1.0
+          image: towfiqi/serpbear:3.1.2
           name: serpbear
           ports:
             - containerPort: 3000
@@ -60,6 +60,8 @@ spec:
             requests:
               cpu: 10m
               memory: 160Mi
+            limits:
+              memory: 512Mi
           readinessProbe:
             httpGet:
               path: /login

vault/overrides.yaml

@@ -7,6 +7,8 @@ injector:
       requests:
          cpu: 10m
          memory: 32Mi
+      limits:
+         memory: 128Mi
    # The chart's default anti-affinity forbids two injector pods on one
    # node, so on this single node a rolling update can never start the new
    # pod while the old one runs. Recreate removes the old pod first, which

velero/velero-helm.yaml

@@ -8,7 +8,7 @@ spec:
   source:
     chart: velero
     repoURL: https://vmware-tanzu.github.io/helm-charts
-    targetRevision: 12.2.1
+    targetRevision: 12.2.3
     helm:
       values: |
         # Velero builds its repository maintenance jobs from a Deployment
@@ -71,6 +71,8 @@ spec:
             requests:
               cpu: 10m
               memory: 64Mi
+            limits:
+              memory: 128Mi
         # 512Mi got the server OOMKilled 314 times, including halfway
         # through a backup of ~14.7k items.
         resources: