chore(deps): update helm chart velero to v12.2.2

apps/templates/mbgwp-official-helm.yaml

@@ -12,7 +12,7 @@ spec:
   project: default
   source:
     repoURL: https://groundhog2k.github.io/helm-charts/
-    targetRevision: 0.16.8
+    targetRevision: 0.16.7
     chart: wordpress
     helm:
       values: |

dns/domains/rubenhensen.nl.yaml

@@ -18,7 +18,7 @@ records:
   - name: "ldap"
     expire: 300
     type: A
-    content: "62.41.86.53"
+    content: "62.41.86.27"
   - name: "argocd"
     expire: 300
     type: A
@@ -60,7 +60,7 @@ records:
   - name: "s2"
     expire: 300
     type: A
-    content: "62.41.86.53"
+    content: "62.41.86.27"
   # ntfy for Gatus alerts, one next to each Gatus. Same reasoning as s2.
   - name: "ntfy1"
     expire: 300
@@ -69,7 +69,7 @@ records:
   - name: "ntfy2"
     expire: 300
     type: A
-    content: "62.41.86.53"
+    content: "62.41.86.27"
   - name: "@"
     expire: 300
     type: MX

gatus/README.md

@@ -62,7 +62,7 @@ node, both PowerDNS Authoritative. PowerDNS LUA records health-check
 addresses and only return the healthy ones:
 
 ```
-@  30  IN  LUA  A  "ifurlup('https://status.rubenhensen.nl/health', {{'46.224.26.65'}, {'62.41.86.53'}})"
+@  30  IN  LUA  A  "ifurlup('https://status.rubenhensen.nl/health', {{'46.224.26.65'}, {'62.41.86.27'}})"
 ```
 
 The double braces make two groups. PowerDNS returns the first group that has
@@ -85,7 +85,7 @@ Steps:
 
 1. Parent zone (`dns/domains/rubenhensen.nl.yaml`, synced to TransIP): add
    `status NS ns-hetzner.rubenhensen.nl.` and `status NS ns-home.rubenhensen.nl.`,
-   plus A records for `ns-hetzner` (46.224.26.65) and `ns-home` (62.41.86.53).
+   plus A records for `ns-hetzner` (46.224.26.65) and `ns-home` (62.41.86.27).
    First check that TransIP accepts NS records for a subdomain.
 2. Hetzner: run PowerDNS from node001.nix with `enable-lua-records=yes` and
    the bind backend. Use the same zone file as home. Open 53/udp and 53/tcp.

gatus/backup-check.yaml

@@ -256,7 +256,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: check
-              image: python:3.15.2-alpine3.24
+              image: python:3.15.1-alpine3.24
               command: ["python", "/script/check.py"]
               env:
                 - name: PYTHONDONTWRITEBYTECODE

gitea/gitea-deployment.yaml

@@ -20,7 +20,7 @@ spec:
         fsGroup: 1000
       containers:
         - name: gitea
-          image: gitea/gitea:28.3.0
+          image: gitea/gitea:28.2.0
           env:
             - name: USER_UID
               value: "1000"

nix-infra-machine/nodes/node001.nix

@@ -2,7 +2,7 @@
 let
   # Public IP of the home network where the k8s cluster ingress lives.
   # Keep in sync with dns/domains/rubenhensen.nl.yaml.
-  homeIP = "62.41.86.53";
+  homeIP = "62.41.86.27";
 
   # Hosts tunneled to the home k8s cluster. Each entry gets:
   #   * an SNI map entry for TCP passthrough on :443

ntfy/ntfy-deployment.yaml

@@ -16,7 +16,7 @@ spec:
     spec:
       containers:
         - name: ntfy
-          image: binwiederhier/ntfy:v2.37.2
+          image: binwiederhier/ntfy:v2.34.0
           args: ["serve"]
           env:
             - name: NTFY_BASE_URL

serpbear/serpbear-deployment.yaml

@@ -51,7 +51,7 @@ spec:
               value: --use-openssl-ca
             - name: SSL_CERT_FILE
               value: /etc/ssl/certs/ca-certificates.crt
-          image: towfiqi/serpbear:3.1.2
+          image: towfiqi/serpbear:3.1.0
           name: serpbear
           ports:
             - containerPort: 3000

velero/velero-helm.yaml

@@ -8,7 +8,7 @@ spec:
   source:
     chart: velero
     repoURL: https://vmware-tanzu.github.io/helm-charts
-    targetRevision: 12.2.3
+    targetRevision: 12.2.2
     helm:
       values: |
         # Velero builds its repository maintenance jobs from a Deployment