renovate: deploy renovate on kube

2026-09-21 16:36:05 +00:00 · 2026-08-26 21:35:02 +02:00
parent 45f8f84cbc
commit a80b45618c
51 changed files with 1074 additions and 864 deletions
@@ -6,29 +6,29 @@ metadata:
    namespace: gitea
 type: Opaque
 stringData:
-    token: ENC[AES256_GCM,data:rw08OD2BsIUgZ7eWoYPN4S7LPdbjnE2bPatGrmH2LovCghV8T06OEw==,iv:EDEO3BUMJ3I9ApHYgqtWp91PSzW0tkhVmgSLkeYJ3mk=,tag:jpxIEYFWTrUnZWECFr4Oqw==,type:str]
+    token: ENC[AES256_GCM,data:IOVPnopbQKY7HBT9tlnfuwvakgegLuK+PdTTwg+eRWdMz+dAoIxhug==,iv:QhfgyXNuZnYTXV1X16bdR+Axhfbe7buoRjXV8IdSbZU=,tag:r5By6+E45B04vgZrBoPSsw==,type:str]
 sops:
-    lastmodified: "2026-08-22T10:07:49Z"
-    mac: ENC[AES256_GCM,data:wXXd9sVPoDz8kNPiYnbaAG0f52e3DfSdTPSw8qYmf4C9PVLf4DJ8/xr2tPfoK9hJK+99jt3fqLfKv/PqM673Udn9X5EHiVSBG7o6N9OC6Brq7KfkO0d7bVg3n596xE4VOYi2v1RC+IzR1VNp8nqwTt9sG9hRqwhkYx5awGlzML8=,iv:GB4/aUbajc4qXuZZbT+fAH0HIx+yaADGWKewcPePC5M=,tag:/bfQ0ROsUQ1mO2R/kd9ilA==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:o3gyJNXJIBE1zSV4vWKFQWfmwZvz5Ek8ie/SjU6cF6kOqaLae2y9WBqYCQphCpasgN32qP0RM/bzzV3AZlIYqGEzI6lf0ha7aDPdVJKMy3ieie0F/UW6fJcTfidEFZYFKereRQwCWTzOESIZmsc+fqisyVxW3wL2yyYuh1a1HPs=,iv:RsG3AoqpMqR19DPQdqzfjbKNV5FZPxEsTbIZzzJtXq8=,tag:XzsmRc58Q+cNmBZXtygV3Q==,type:str]
    pgp:
-        - created_at: "2026-08-22T09:53:39Z"
+        - created_at: "2026-08-26T19:28:03Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ//SMQVc2JU4VOzEfHh1PhI/oWOTKiZipezvGm3g8F1wik8
-            VU9Miu0zgMpa6o2OqEg4kzsUyrYY1Zl7lO5ALM74i2Wd4ln/ABA7/sc+rfw73c0b
-            PFRVoWqXDdhQMXVrUmY48/sUuv0HRtlVpkMjVwKIWdOU17cG8ueMFrM2GRHM8jTC
-            bxyE2pXMuV04RnQCdXxUkrD2uWxnzqrm6JYa3C7cktU3KGqNgl/m1XBOdm/UBlwW
-            XqYtpCJrCbpagEB5miSVxpWtqtF7Sq1Plabst+xajVdHhBDFD5Uw6F6EkKsNZbJu
-            WbaBENV8mkKNC0UwztECd1yw0JdHaejeOib67g6b4rX8l6W5TRLKfkM/Gev0FjOD
-            uenYUOq+VqlaVhG6lxsAodZ2078kj71JD0tn+DmXYH0le7+IlsqpNmWZyceGtmUJ
-            5iKoRRyjyeKjoLLkZ/vQwBmp9cbAGCt3O5uV9LiatXEfpHU1QBi8ulXo34uAXAu/
-            YqWZxkSry+myV31hALTq6iOAb33VY9ha+X+HOHo11XhLae4fImIpFzBNAFtc2kh7
-            Mbycef0i1C9WsfOIWHzZW6/bkgE8RtpjJmWUhNzvj/pHLbOzUhESC1LjjqbhutTj
-            ydDTkkXunWu1MEfiqJM1vsZ/c/YQH4MG94ZEfOC+iFay+We6Wd5884EIPP/EC4LS
-            XAFkt2IABG1C3D86tbBLKvody2+xGnmquUhYqmOhVCmz2jpt5bm/qnLTQw3nKdBe
-            Y5LyaiJ8wAcRrD5qSK1gzqlCRDPeMSj4+kYFrcInWA24ToBvyYAtBKCzs3Mb
-            =lonh
+            hQIMA7uy4qQr71wiARAAwpBrBeb3ywJTc54HNC7s/3+tqCvlozNym8E13jqHREOY
+            e6bfDO2hN2/JvbdGfMaWspLa8mU9ten6yFfUtoPADfccmbWwRAgS2mJuLyh5tksV
+            p+9m5vjyRQBH35pfTJ4F6Ksf7/2V8M4b2PxzBzTVQseqhOC2notYdvQeWED0gH1S
+            6cQvPClv/X214I9FfaHNig8SB7DV8uJ6ttj+IG9RL+NZ8lkT5GObSrphR6QH25Ne
+            65VMJmjcQLIWfZxR+zYVAxTsSeeDMFUY28WBUfjRei+WZ3ggmFRVERZzG6oSXfoA
+            nlqSQU16TyqadubPV2LcapqR/IwoSKdWO1/RmxH1NAFNvMg9nYLHzffAwPGL5wzT
+            GQZci20IlRQ5CLsaREyI1SNqYfjZ6esjUw8iKr5/bsr9XuI3FnWgqnKoAMs8O7d0
+            ZSGAohsUNrRki+ohhXtZFTelzufM1Hrt3Yz1TYQWtvoD7j87hq45BEZOU1ifiwre
+            Re0IhzcOdiBbCd3Lm9WSNmZzKHZoy9PJR/zaaitzZasIzsCH/7KjLBO0h1Bz+Osf
+            9Yxl5BMrUDFLlCIT0ORKZFtugwvS7Ez0IISMuRnSGjcutVsZGP1a6fN5K7oaSeAv
+            J9+9u5BuqRUs6ZYkC6TVqX7S8tAJkCOFIOFqxzb/oI2SBdRQmPP6Ix3FmN8NFu7S
+            XgGr3gKAnEDyuXwdZY7guYdVIteiLKUpvqk6F0yQD7b/rDGQoBD/g1twbx21ZDcI
+            UJ9aijLLe4JDcP02LNb64y8LaDb8VdFqlAIzV+MsYTwHAY3dB7LQtMGSmVlSZNI=
+            =lc7+
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(data|stringData|.*key|.*crt)$
@@ -56,11 +56,11 @@ statefulset:
    # Same failover tolerations/affinity as the gitea release, so runners can
    # be scheduled wherever Gitea itself runs (p330 during r740 outage).
    tolerations:
-        - key: ENC[AES256_GCM,data:jC1B3zH0XQ1O,iv:nGWUUNvIB+WBDG4MatKdzXKwWuXjkK2IsaDC8LCakC4=,tag:lp6Uv/aJaUt8XTXXhXQuXA==,type:str]
+        - key: ENC[AES256_GCM,data:wLfr0r+e9KYm,iv:BGZnWKQUlOje9RhAs7tBDzNcDt5LcfTnqRSqrdFc/A4=,tag:bb1f7NwEwmEzrf5k9ivFPg==,type:str]
          operator: Equal
          value: failover
          effect: NoSchedule
-        - key: ENC[AES256_GCM,data:pmPj2H2dChGATTl5oUJCt6Fq0A64zt/VFxRG6yy0XFKXlUkpgA==,iv:pmNCnZqu4j9TleelYDrtV7u9pjjgDO806lyKXeL3V38=,tag:+MKVAYraGF29PPQlJhQmxg==,type:str]
+        - key: ENC[AES256_GCM,data:1kBsMuUlpluDmpVddyZCI/ylRbluHmQ62F88Q9LEoiZkgdpm5g==,iv:IlggVbY7s/xaSM2ljMkiTDwvIjf12g3SQzfL2fWWf78=,tag:2aNlCFumidKSbnoUV1IBzw==,type:str]
          operator: Exists
          effect: NoSchedule
    affinity:
@@ -69,32 +69,32 @@ statefulset:
                - weight: 100
                  preference:
                    matchExpressions:
-                        - key: ENC[AES256_GCM,data:zTvzBWPLKcDoRMcNlOB0injDajw=,iv:x4yI3vUBThzKTNHEaxelPmMV1fvArLu/avAAeeBP30c=,tag:uJqnx5qIFVYDONvp7Lu31Q==,type:str]
+                        - key: ENC[AES256_GCM,data:JuejrbDWeF+d/+d2Hq+q4V9vihk=,iv:VPgkBuv2hqJbTNFXpv3SzRGtFA6iVq1kFR8hfANg0cQ=,tag:D/wrkytnO8oZ3/+4yicq7Q==,type:str]
                          operator: NotIn
                          values:
                            - "true"
 sops:
-    lastmodified: "2026-08-22T09:53:39Z"
-    mac: ENC[AES256_GCM,data:dSUMCCs5iobsQtiktm0YepMqHCjXwPpq35jimoS+IUIeBUO6lLuzt4gS6emVJUBUbNB4rptyqyCxX1GMXj+9iBUwKx2SR+FqXa+AzIJ4JMegF60GBIpBc2rSA7I/jSrv+6DC/7Kq1w5EQ9hhTOXAhhzDxkQjgBJF3jMmMrqU2lw=,iv:pu929/yRvhuMZGY6Yt75RpWCcg4Xr2beZZT2NZVPrOI=,tag:6OavMlfiKjH0w4F47ZJXHg==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:srIJjIgWx1OGgGwz71wQgT8c1gg64iV2VHrrb11SYXpaYg0VMp9d0maJHCaKt5rDVtWw/+Ft4WbR0z2FJBLEmr64/cFX8/SgrOR7pAc/vAgPKfxiSHg6iJoVCGHssGHm4NzvSUC2fkMqc8WUiZDR5hztUKSlp9oNPO2bKZmw7Zo=,iv:tgSmO28JZiGK9xO4uIH35zlRzJcW8lKxaggtqXlFq/w=,tag:+mIagmS+Z5RSFdSo/yDhjg==,type:str]
    pgp:
-        - created_at: "2026-08-22T09:53:39Z"
+        - created_at: "2026-08-26T19:28:03Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ/+OgDT+QcY0FWtbrwMhUKn9Up6fn5yDy6dUnzr/Uvd+u/G
-            +5fBBh2oDsLQXyBNIX/OXj6YLq2dBHlrnxGAPVXyoXQtel3OuPWYVVp3bbxR4hOw
-            XZlqnVU+BYemRHHh/wy1FY/17z2QemKXDieVb51cxYxWXiXc02XVOOH2alglf3M6
-            X4cTz0iDu+tbLw1rBo9zwuCDJBQ6pCiyvTUdQrJOH8QwSpjd/kXS9BewJLv511LU
-            9sv0jWkd3O0JPp5SJ2GsmWLZLDE0QHoKmxmSCVWVQVsq85rod6/Ab2oGMeWNaTRn
-            X96XKyveBRKEbi/d7kCPeTLpKB0qxgAHgxCdQ9yVFucBEibGzHoC8qv0hH68pj46
-            XInzUjMseTnNNm5xvxrosMA3BMOs0ByYiRY85+x6pO4y9KxehhFTdNnq3XPYFD8x
-            y7yrmcgDrNXvj6btMt2QvX33idmi73QMQIDghjq3Sejjvg7dGJZgY1k4wZYqyXCD
-            UMQQ6512utS/RhZ44MUxdD2mhQ9RsCZhmeTXACyYiGW+cBTWkNu6negUIzjA7b4+
-            H0GOmaiZHlv/oDhM6+IHkV7B8kh/pkQ4em8Qhb6F38lohYyu7V3VBvQzK2egCoE3
-            7F6XfHa73DPr6/BWepRUcMr9M1YqyQOigx1RaxkIr+7CZwAO3acEbtEzgMY3GBbS
-            XgHcPOjXwU5N9XZRCzrpLD4iwYbQSSxZdxwKkpME+YRyNJ1edHW4HPNbY+2XC/he
-            Z55AJsoEPLFyoJQn47BMl8x5RzViSliEtIvwGJDYiO4W1QV+R54j9wm7zelJVMQ=
-            =Otyl
+            hQIMA7uy4qQr71wiAQ//X9NxtKUDFkdKDmWQh3wRSriiq25U7gkL0Q7SE45Tz5V6
+            03i6QmzCyBpI81TQQBRRzfdkuuqocBgplTRRRvFsNQNcwc5KCq1zHIDVYE+XlcmI
+            /bwA0GpBZwDN6Mv+G8+6UwhSp+YgsiGFTVAIctfz90cRYPpABX4wRcDYInTlifHk
+            weBq30iS6Nl9TajpgyyAUct6EBQ8u1YmxsII9RYWjdoTS/SAuAxNM2px7fwOPAoL
+            fq6/AxXj1n+uKjxl1calL95768RmLUerdxDmac53/73Pj271hmbwrWqe+JzkSriu
+            YMHYNOVLglf7nS3AQSqAa9PljBv7xHw9jOUqkJH14W7/NpSRvc4PICyIWA3Yfpfq
+            ymMI/OOYosyl3ZYhfLGUIAIYLkA1StgGVfpmeOmUCPEn2FIInBmguzDRMrdnUkoz
+            KYh/06Ug6YsgCTsy8Ffhzy724ITRADzqYlTU060tTwFN7cgFVHiIfZdYIFxDxNSL
+            NELw8Nl7+9jkWjlnmPvtxfrN90L7nBm4s3mZrYeyZ1/ElcxDkJKb4r+PJuc6rCpM
+            tuD9BXxjl5qa/trl/1+fVToDMMm5vws0MLl4DBkbNUNkD7wWko0I4rDSZ+X4SihM
+            /V7XgzeQ41KMnDdZYwTKdIVhCpZOIBwZlLuZSYCn8uhqO0YMkkpB1x1EOb2fy3zS
+            XgFdP2zpsUHWsy/iENHCgnMkQ+l2XwZZ2bgZGqwpRbLO0fDNX0kRZ45NzKl2+t79
+            npggZ12JFTPPbQG+o0hY0p7LjnjbfBsp7m9ykvymizZXlzP9efoOq6kjD/CRBu0=
+            =WgiB
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(data|stringData|.*key|.*crt)$
@@ -26,11 +26,11 @@ valkey:
                cpu: 500m
                memory: 256Mi
        tolerations:
-            - key: ENC[AES256_GCM,data:hYAE1TiCvNmu,iv:1UbfY6+dmo8ZBTA4HmrePwsSlI0ZAXnxxTxPSFmXeJ8=,tag:I3TojzEvwF7+VpIteoLPgA==,type:str]
+            - key: ENC[AES256_GCM,data:fXEKv6sROAEz,iv:ausWhm1zJdx+Mu26pauhi5G+ODZqLZ27SmfkAuMUtYY=,tag:cNYyeG09Hk++uED5M0TBKw==,type:str]
              operator: Equal
-              value: ENC[AES256_GCM,data:NvnKWi5ILYo=,iv:ZOqbGIaM3K/fFeuLSYDmTyYlAN4SJqDEifLQvvJfBMk=,tag:WdUrzaF+sK/4FglVlBWu2Q==,type:str]
+              value: ENC[AES256_GCM,data:7CfH8Lrr7S0=,iv:dv5f/cN1VI2NLQsAYqF2hGEjVjxTnHGXFfNQyCL1KIc=,tag:HTiQN/wZU/mXSHvaz2KqRg==,type:str]
              effect: NoSchedule
-            - key: ENC[AES256_GCM,data:HRboGXp+i1OelfWw6dMe1p4kxGyu66p9kJ1kiX7nCtL84Nc2YA==,iv:gRqCAhIOKAp1JxsC+n1V4B0bpUr6I38tjElfxiUc+T4=,tag:IveoeEyKxRUQM8uTWXa8wA==,type:str]
+            - key: ENC[AES256_GCM,data:2l4bXqCigZWkqfm6zvba/aOwC6zXYd0lufMUrrHA3YZm1/0IXw==,iv:70oryMEsl0nnZz1q4OHHHgjRswmyvLZI9Y6tk0elM5Q=,tag:2/EHDIcaDTSGWl3qRVW8oQ==,type:str]
              operator: Exists
              effect: NoSchedule
        affinity:
@@ -39,7 +39,7 @@ valkey:
                    - weight: 100
                      preference:
                        matchExpressions:
-                            - key: ENC[AES256_GCM,data:sVMARKa7p6m731vY2XqLTQgq5J0=,iv:zKofi+M+NiARpWDhCT1gP8nWg8IfnPgX/gSwy0mtvzw=,tag:saYzCUrICeHmQBblCLOGxg==,type:str]
+                            - key: ENC[AES256_GCM,data:dc00KQOBXn587h22VlooFY5ZjbE=,iv:kX5utMKu8uoUSeameD2R0iH+DU/3YXuwP8DaZs9mGYs=,tag:PM5xBnYaP84zMZ2SWTYV+A==,type:str]
                              operator: NotIn
                              values:
                                - "true"
@@ -48,10 +48,10 @@ postgresql:
    global:
        postgresql:
            auth:
-                postgressPassword: ENC[AES256_GCM,data:F3StYRw2tfW9Sg==,iv:q4cFSPNwbYywzVoqyICtD6BjbVys2vgIJBKBQqcCVpI=,tag:+bNefltDFPSmXSDxWk0MuQ==,type:str]
-                password: ENC[AES256_GCM,data:XZBcmfCL80rc8A==,iv:uuQQCC7Yoi/W29WkOBMLQBR7dGxSNVo0mLcvQ14WPPM=,tag:GgWmz1xNtMGWc8WxdH1GdA==,type:str]
+                postgressPassword: ENC[AES256_GCM,data:3aHXAFDqpYsWeg==,iv:qbrm+izSr+PaAa4fHMVw3Yz0qMuisRMpDxVKdeFSvls=,tag:zVUVALdIUTMhxavsSxlUCw==,type:str]
+                password: ENC[AES256_GCM,data:LCfnttYbxS34WA==,iv:rqU044P/gUmqjhmu+A9B7A64ujnkIhMpKQlYpcmi8MY=,tag:XJws85qfKI+y0BV6S4L1Ig==,type:str]
                database: gitea
-                username: ENC[AES256_GCM,data:JbRRD4A=,iv:N97mlSjqPKMlY7HKS7OPlSZ2lzAXrawu/XRwolt8CjY=,tag:WYpR5bSkOuaVZtPp9nfxDA==,type:str]
+                username: ENC[AES256_GCM,data:QDo83dk=,iv:RvuuDiiY1XLZbrjcJ/ANxb/wHrSdf1gaBSck+cMaWhY=,tag:UCEAkWZ2Dmr93oBATQdf8g==,type:str]
    volumePermissions:
        enabled: true
    primary:
@@ -63,11 +63,11 @@ postgresql:
                cpu: 1000m
                memory: 1Gi
        tolerations:
-            - key: ENC[AES256_GCM,data:9y7Rp0dAIqqY,iv:cEjVNUnuOEiLWAKHagGhLOfTdkMQUbLSAhSEMe3D1t8=,tag:GlORte/m/74L4h4oyta/wg==,type:str]
+            - key: ENC[AES256_GCM,data:NplaOmBekcB+,iv:qzQ+QasVZ2JMG87PgdVDJ/7XHDiDXTp+ogxB1w4tws4=,tag:aPyaqwdxVEjct7D3SuKFqw==,type:str]
              operator: Equal
-              value: ENC[AES256_GCM,data:1Llp+6Z3pw4=,iv:OdsjhjHAF/sRj3JHKbcFVJzWv4N6cQH9mQZsh03GdB8=,tag:9h6lt1CpIkVWxsS1Tw1dDA==,type:str]
+              value: ENC[AES256_GCM,data:vjsM3Li0p/8=,iv:Y+sjLHWpqwsOJV+vygG2f/3ZXQs2ZQRloPrlcOuzoeM=,tag:t+uR2/uM4NiIq6alJjio9g==,type:str]
              effect: NoSchedule
-            - key: ENC[AES256_GCM,data:WGEsa/uJmOx8jvz4QuQWr9IoQLKrs8ic9Mo5c4K8xZTSrP5vdg==,iv:0c0IK7ihVkUWe6S2bPIX8rHbZUvcNl1FKwd0RaZFlPU=,tag:EFRpAgOQnwtm8s0qu5IVdA==,type:str]
+            - key: ENC[AES256_GCM,data:LQvczGKAK2x1BbFr7S8jo0G7YUaX4DJvc+1Z2E+bCjys4PsBHg==,iv:m4Ses50zYxTF7jXTgbf9nY0kT1hrtgVEEQruLZFN8cU=,tag:UidEMRbb0IPb5V31FjWzYg==,type:str]
              operator: Exists
              effect: NoSchedule
        affinity:
@@ -76,7 +76,7 @@ postgresql:
                    - weight: 100
                      preference:
                        matchExpressions:
-                            - key: ENC[AES256_GCM,data:xD1XHWuo6myo8cV4hN4/G3mYWng=,iv:PT+xk8REvOlmmyNjMD59ot3Z1TBAHHXgKh6aYCJhn4U=,tag:kitAObeN3Xw7cwUOSnIj5A==,type:str]
+                            - key: ENC[AES256_GCM,data:D9N+Fd/g24bKikLdx4WE57WvqE4=,iv:+1oYCzAl6kBJliw0woWhhWT7aWcx4rXkGDn7Anho2Pg=,tag:R+cLK75QCIfWeGL8/eqeFA==,type:str]
                              operator: NotIn
                              values:
                                - "true"
@@ -112,8 +112,8 @@ gitea:
    oauth:
        - name: Authentik
          provider: openidConnect
-          key: ENC[AES256_GCM,data:+U+sp9wg3RoLkJTwSQMYtDaokMl/lP33Pw0cot4Wblqcbe0P51a54w==,iv:X3ggp3GYWV1KPp67i4qhRee0GS+9Gjwg5v5APQllT+A=,tag:kUUhFgQgor8TyRnu5klwAg==,type:str]
-          secret: ENC[AES256_GCM,data:0lvc197OX1Y6vn7/klG2yUAeFXsd8VjWmboOjUZFMbHYw+uetFzPuLWBQefjKBZZdtpdsYLqtIEctZ38uZikTpCKIZjYnitnYpKermcgr9vNpzugVrkW4kuo01saWrhDlbzHlk7t1dqMoVmMgzkDjArD/3RlH/mqRxHDSVP9RY8=,iv:7y9sdpuSQy01Hmk0kZ6pGoAM+3Vj1iC+PB9ZWjuls70=,tag:KxfDrDDfV5ULxbYepPqn9A==,type:str]
+          key: ENC[AES256_GCM,data:cYaRMEtrziMJWIRj3dg1fuMpp6F3t5ZDO/H2ONOQCg/fZ8s0ZsLb6Q==,iv:VskJ+5Rwpnys0nH531FYZIj253lJqDz1l6sgwKWhE1s=,tag:F3Wj1ruwSwlC5XbVKt1aCQ==,type:str]
+          secret: ENC[AES256_GCM,data:Cro9iaXKcv+uP4G6jEX0tPBW9cjxaZUmnLEVyE72j34aeAAmDFgPiTE/VWSbD3WWK8tuErl0RFHMvHiN63f4W5hq38W9VMP31JDCUYcUbkFBmQg2hrt6ePajZZICR1gHB3D7t5av4pl13O490VByGWfr8OxAK8Z/cGojp/Pt4mo=,iv:nRvFSVRSKFvpNjGmJq6uh/JV3acLsipV0nUHAlt+t80=,tag:BZ7eJiSVCM8J+MY+I5Z48g==,type:str]
          autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
    config:
        APP_NAME: Gitea
@@ -151,11 +151,11 @@ resources:
 replicaCount: 1
 # Failover tolerations + affinity — allow scheduling on p330 during r740 outage
 tolerations:
-    - key: ENC[AES256_GCM,data:D69ZlIyO46sb,iv:q5OSkzj4ZwQTdMWhZX0N+EJ4QEBaxVRO+J5/m7yt3cE=,tag:GhxKaHiqliw9pedhefEM5A==,type:str]
+    - key: ENC[AES256_GCM,data:1O2rrNCMxkGV,iv:dLwAP4NFVRZ0IUNzARm7hPq+ruIshtpXfUVtuuRP3/o=,tag:EmKs8LItQFLoPov8MMjfgw==,type:str]
      operator: Equal
-      value: ENC[AES256_GCM,data:gxtr284O2oU=,iv:wu1SU1I4IfbyyZXDM38CxJDDg78tGNxnz+TyIQWfUVo=,tag:GjJn1DZb0ffXeatTs0/tLQ==,type:str]
+      value: ENC[AES256_GCM,data:l0WXlDcRWaY=,iv:F3AxSbB9t/q3L6yOI4NcHlNzZrDwJqiJ/jjfLrQlNAE=,tag:6s/WqyWjNLHHmExGmgl65g==,type:str]
      effect: NoSchedule
-    - key: ENC[AES256_GCM,data:qqmHg21c6p3+xv5TpwhFfAU7d9won10uFZssLur8NEyKTOgHxQ==,iv:TMB+zh/2wNqirXdt3PB6HjTw96iCdWml4oUz8p36zLE=,tag:GpBXiN7efwdQYL+x21j4TQ==,type:str]
+    - key: ENC[AES256_GCM,data:RtKkkyNv0zO/IezcKaBBp5Ir9mCBacgVqjFIGyq13U68sU4z5g==,iv:sFr2v6kFKOm2ID73GpxACTvQttvt7fYwg437N7D2Scg=,tag:aPCpFti/jY/0a1FEWF/g4w==,type:str]
      operator: Exists
      effect: NoSchedule
 affinity:
@@ -164,34 +164,35 @@ affinity:
            - weight: 100
              preference:
                matchExpressions:
-                    - key: ENC[AES256_GCM,data:UIhojeyYAP4BU0b2/kcL7cJeH1w=,iv:58g0oa3Hljy8Pay1lAD3gMfKRv0cwnWqZ5Mjt1N2BPY=,tag:Eclfpi9f1qn8W/+veeoVwg==,type:str]
+                    - key: ENC[AES256_GCM,data:jW8/VevqdIAXrBAMj58udice6HM=,iv:+6nTdgB2io+H6S/jyO4Fc/+VfoyGIY+dqphi6ZNIn3c=,tag:JKJveLWX8pjMN3cnO94UwQ==,type:str]
                      operator: NotIn
                      values:
                        - "true"
 # (postgresql and valkey tolerations are set in their respective blocks above)
 sops:
-    lastmodified: "2026-08-12T22:43:19Z"
-    mac: ENC[AES256_GCM,data:ENuTFAfom5iFNpYNMwBGNmPAbWaQunLQ6IBQMbpGm/uo6Gef6ahJsn8J7nVF/IxaTsdJHl/Lq/Ql7fzj1JRystKqtibJtmHXC9b/wWMGT8xtuLdzLav58tAyxuBcitAIX2t96fyf+x/DkWbiTj1xkTYtKKrviLpxncJIVT0BXN8=,iv:+84jAHZHy4hMg2LCMk9MkH8PIrvteB4eqScUHVtmfF0=,tag:9wtBD36Y6SqrnKmIKPvzZg==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:hb8HlzvsAU+6A2C4MARpF2j+Mv55mQ25SOjJIo6inV822IskVV+0Ml9I6WS8RK6ZNZAdnVcDtQ07JlGx9QRiIwxAE0xxwuhukhSBBjeHGAc39RPhLXhDvwUF5ZeouGixkVrA5lhAvHiu9ILv241G1st0J9qK/ZaIsTazQN4X3iY=,iv:1ehf3avfeV4Ro8rw0rsFQ0qnFXrvF66tUKqqCY+NXSc=,tag:5kXUpLrLGPbwNSBC+aVIwA==,type:str]
    pgp:
-        - created_at: "2026-08-12T22:43:19Z"
+        - created_at: "2026-08-26T19:28:03Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ//VE97o+IKlovKEABfrA+z9qDySKAzb2eFvBe+vFgrCdyb
-            MIQaGvWYzYqeBT9V4AIDK32+emf36zDfhTyVT5k5bxVnft4ceXQ6biXdvt7+FVmt
-            k2/2UCD8PvqvxD1fsRsTJSvX73yXi1MsEyGK2HPKoyXky1xxzCsv9isvPvF2nlBG
-            HHqpuF2NzPVFs2gu+sZhGOSagYcxz0VZw0nyZ7n3twQnGLXVl5p/79ffqoJz9CGG
-            6kTcmxQo0v0BYRdtC/6LKuZlkYysVVg43eNluAodIPrPqbvwL51L3Nfwdjo4pNwE
-            P/B8lR6KbRS4DnI0cc9lLv1WPtDhB7WvoTbqcJWfhcK+HzzU8toh00zcYTmhhaf/
-            uckqr+bkDInbH6Fwdtng7HS8d0vfY8WGzPfnUiH0ulE6+iHeHSOC5kID/Gc57Hc3
-            4wO+wciZqPAkXChYCpUVtcjZCMNGPoJhb92Vf+8B7Zp8VatIMDY3jUCaKayjQEZL
-            25LuBLOxtqAiLhmMlFourNmIV2YiDv+6K1d6D1RRfiQhsnpnfJWygjcwy433bwph
-            1Cvx/a6k3C0wMrhociwzYP/gNWLLCxqWBvvNgFf7sWiR23swg4lO/qEjcz+HxD8d
-            U1DeF6nD2dQ629qstg1KJ5zoRKqS/JegXmbMGV6rjPkzhTqodVgaUpnmgvlstXzS
-            XgF5a+gUhNHDwL8ymKTsRejffJO/GV42vOZ66B7X3dkcXO37PuoJRCbNKbBnZAgs
-            O2wWOahTsF1bO7xZTzg0BZx68Ty/HE0ya305/C7gyKUsuOZesrOadpGF8E68xZA=
-            =/gIl
+            hQIMA7uy4qQr71wiAQ/9FF5SJAVg0dLi/+xQreE2yrxMH4GTfdBMHd3GWEVLYger
+            6XwXQ7+Qx3mxf+VprmNGOW7NdKSsC5Re/JHJAjs7p+eWohtieOgKtg7DWEcrTwZA
+            56Rnhtnh0vv2jqmv/pm/Cj49GCLTjQFY+w5azU7g/7eQZpdPezIdrs1ueiSm6LaU
+            T9bMdUzm1pb7/JKQMvzYyPcuw0AfKLlg+x7HHRNI3O434yKuTLC5emVxJEmwQvV4
+            FD6oUAt4gKLqUHvAUuCVo8O5G36MGHO/roHxlWaLbHqjaDPyWh2TGdX0ICKKq1yc
+            fJzw9dYgcwIMXpXilbnsL4gQpv6bKj6VniyCoye6ieMZ2HIoZghd+wL0NoPkS7Nj
+            D+vTcPR8HOEWoZkZ4B01+bFyTmJ5NA8Z0V3peHkuTy+HCTgwxA0Y8PCrHl3YHsCQ
+            C3nANhh+cMqtcJdvqdGrM09X8n3edNc4lf+qg2tk0NbcdVSqcFl9y/MeJOWhOOg3
+            T/bwBrI5O7aRO6gqaCebKuGIrD1PDNURW3LLiKBSU4OTYbMWWXGpdEMCkoSQS56B
+            6Uo9N8KcWhBChCMJG8hbzYRVwYgWGsHsQbfbujkcIiSaoHGy8fklflxBjtLiitLO
+            voawf0zSqyBKbf1YFAmYnrdR0jiasKC5iqtK7c8uc/HyCSvxjK0ygPloWFI8aSPS
+            XgFJiWHT/5gOG64XmDm0VoKdflpojJeTGIC5JU8RAlJgD/oq+uWt23ayJxkjbkMd
+            H7UsqcuzWfbp44MYtmEWbxvI/+Iaui5/7hW7kEzWI60Mh4tVZGIJ64A3WNRL/Xw=
+            =U5nI
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
    version: 3.10.2
@@ -6,32 +6,32 @@ expose:
            core: harbor.lan
 core:
    extraEnvVars:
-        - name: ENC[AES256_GCM,data:Y1D+lAT57F4HpiwnKJuhN3cqr/17,iv:ZARBNcGuiD5U7TnlBuQJLaWCMkQIELpj195aeKaBGZU=,tag:exBNWO/o2CXyNMLr2Y6bTw==,type:str]
-          value: ENC[AES256_GCM,data:EDMjB9DVCG3FiXdWrQmE4LhXTtTPLebKkBaQZ05tooakENXWQ2jm4YNRgBKWibHSM2gAL/z9POEi5BkiD0zK+NQV8DJKFLa8sxg9HR2OfeCqk3gMbq1uwurqrl6+OVX75E0Vqd9xN2CUtvfNVvPktMYn8UBU1nKuiRaHm3Tbt4QpcSQ6Oh1q2t7uqLDxt6DcAVb71gjpUXCZ96gg8/XsWlZXyzwJsfOEi33KlkBQhXYPFPEqq4wkXGqE1G+rT9MNOWc+WUdyY8FbP5zko+4F0Fcprj6iKlw8UB8PCtF7yAwFnxO7Bb0QGXxDGdKx93SbmGwxsYKe9muQZFfdp9rNW4R4L7K/O/ymiV+KEmwuwWoIBKZTHEwgOpD/B94MfEsPOlrmD438Ae3aifBQEOo3Ln6qu7I9md8tv2co4rmY4Wt3bBI8xXIPC1dzKI2YyQ540QtN5L22UZpabLLez0wNiVuDtCG2vg0ncI0flouQ1KjQp8DJ0Wz5i2WABwNg5X4sLU66nquD5hlf2YoNPw8EuY+E5lM0T0xBiv9AJHtQK5rN4AUopQWsi1FTSdFtCOlykBxnoYsLDyEa/73LA8e7m5Hi82IUl/5xR6LOEblEm+6jgcxY5UGaB7hsgh4K2qizmC+TWg0ua8YD4SIJZxqsNk4yz1l9DQAhZBnt/j2/I8K8PObD/7+6ObOfLM8A9UiwyIGUeQ/SCaN5DNMAHwFyELuXgTzdbdTgguJcJDgypCLUgvuVfx8dAOoj6cvHm7c=,iv:PEenzkk4lUyFBPx6e8Ah9LW7M5N7o93aueSE+pQozuU=,tag:rUeeXqEtHUQ3RYn1Pt4rBA==,type:str]
+        - name: ENC[AES256_GCM,data:lr90LLYoAKXh8PqT0QEmELOWBxKm,iv:y9mIMG3ND6l4rBnhW6f5FoU5BX5m4vi4WW87bv1XOB8=,tag:gtoyqreaGqG50Of69Pfqlg==,type:str]
+          value: ENC[AES256_GCM,data:qSCBq39+RSf1KGLyZ9TUKgVXtrXhvOhtR791n1hWKSUWho3YxM2LfTRJwcmAcLyIu8numioNlKEWQKDvOEefURzFy05RXkUYWa+ZebRp9c2y0d5ZrSiRDHM2cuxHRjeg/g4QKoX6IVhIcAEIqfHIs1NGxoqeaopAZcB6lGqspZZhzduUYJUWZGULylYdTpyF41F3RKv3xMnNBAQX2FCP3wOeb0DM8s4JMcgJ2eZwRDYecjotTC0pWL7LAZiZaLJR97O8/4cjofc9cGKEcyy0Yf05kSMxeZDWqrEplXNu2y30szafzC0SqkRwDPlifRUanNU2FaT/TIz4Ixklws7iaY0Db9yW+a+SvaWpNTY3pecbo01+4RG0eIDW4sRJFBp3/70vZ2FjCDDzaw6OEJYxrDf1fJ/UGGur2/rzDwLMhQgiRzIKoqq4n87hg1zwZ9ki63tKc+2Mp9oZ8GlvaCuNLMoG8QjXrxCkz/rcEL5Gkb11XwVAnsFdCCZVNfLstqQKpdnO8d4vvLHyRlw7lkf3ggX/b2l7Va/EkpHYONrwIdigd9ambMlHDRRhox3onZsgVaNqDdf5E8oeZJABqKV/1BT7oQn5Jx06kQhN7KvI07y21bQM2Gtvbv8LyhJHPdU3gZwtKEglp9+bU1UvFbQv9lEFm+1crQKBcgySCD8iLS+D2Tp4Y45qWjwD9Nsa2U9eGiHA1o3JZ5s3ltc2ZZVUvTpswRAfok66YqmL+XdbUkk6OtkSLS8FZVARHYbZ4bU=,iv:uxPwCWlMTEgtfGB93ywnMZLEBdNan+K7Bm0xuprYsPk=,tag:oLVwtUcrbERt9GExKo3tLg==,type:str]
 sops:
-    lastmodified: "2025-08-27T10:07:49Z"
-    mac: ENC[AES256_GCM,data:tp6aHDIfLuBDRBYPmNDn1ZWEq0ZT/WH7GYCJNp52tO1tNldi+kK2avluY0QBbC6/5V8LfxpokN3Je6uBveRVzleituxlK7dvsZ4piITTmR0T79PtUqxa4Jh+7PYp0uTofjme1M2L2MU1sOWrCdRdiKWEpDVIJCCCsZ2oDCCoMTs=,iv:O65a/alrwX4cNJH1tYh4kQPaprmulyAitg9jFhOJqnE=,tag:ewAqx7h1e12bMYGrFC9PTQ==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:UVtitK0Ct6M7scvv1qsP+QeQL7S89+856IozBcQgnLZJzeZ5cquzKvrYZ+q7DeL1rk6EWvsxxFAFnSUDLfqCItEAMs4QQhORqplv6ot6BeW0LYUf5i1646Kl7x7Mg0RkJJ4OLsfqCwNPDT0opBQBhbYwTl3HCta8McCjSg96xNs=,iv:ebt36qndBjaThOJfAVJ7ACN06NrRSJnFlFmXIH2l4gM=,tag:TArRCiiM0xdMvOcZDqBrCQ==,type:str]
    pgp:
-        - created_at: "2025-08-27T10:07:49Z"
+        - created_at: "2026-08-26T19:28:03Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ//VDjjaWIsqY0nUFINvzxnt+dullI/+lHYQTfWvZ7LqH4d
-            TN2p2VZRGRkupYUYxt4iucYl6qViGey4iaQopsYrV19kJ+eEJuI+depXYsKBAccs
-            24rNJuTLHYi7r353u48qUVoQcE6uK0mYB8/4+w5J6uANvwmjXUtDMEHUoiBCh56+
-            F7olPPSPUjXv7BpTNq5EC8YjGRjUjQNf1NOyHHz1eTsyDbPszIs6eT1q98AMo3GZ
-            boh7T6Z2yLI7Bj5guEn5OfwyFtB9DzcpaHajDgF309CsUsxfvhoVH85rx58vce3h
-            QW2zy7KPvNEr84ZsTBQwLqi318JiSD1egx4m+CPvbFvV1s7DFDgQQifLRzlqR9/d
-            PZc3DAZ81QzXhZV9Wh4nxG26SQtsbVxAjdfLrpvpDLV3l0wIU8bzP/UsskjGa8zR
-            VBriJ6qGeeDeXVVuxcLMlAhd8R8ipEvLrId3TzvAPRClk4+fU7wzTfqR8Cl9hu29
-            csLtPW4Fu6iZshf3UJJ8KEhjYo6060TlfEZX9hzypJFf+kwJopSrS7KCPFheNBkN
-            P2cuyBgpG8OANQ0vYx68mgkDqqWVWNXAjUHxcp98IjZxwcSfMR+HwZi6xbK97GKS
-            ltqUSxYixLQUelHJX9YHkheXDwfH+q+CaG76IznvMrFi+bB4laU+DmmVnfPZT1LU
-            aAEJAhDJ8KQkP2yRHCV2qycNpY0qBHN6pk6FXQq7O7dl3Z1oQXkS88KopCwan36k
-            Hf4vvXRGLR4fm0uFYhN9aApnDFQuWm4NjEGiNyg6p6WN0XMBNARWfmTyDNc8xceA
-            Q5I2AHdBk7Nu
-            =+11i
+            hQIMA7uy4qQr71wiAQ/+JkaqlVRJtypgMHl1jg9Dv1XqgeEW/5tv52YgxvNYk5kS
+            MJBeuku6/tVGb7i3eArj19My4hQLTXPWv/SK2cBiq3dKnjEs77Nfc1ffRJF/J03W
+            Ur/zy3o9lhVaWOTYVPTH1QIOehJS749ApadN7zB30g4RiOwJfTWiivEx67TzalDv
+            nvRMaotbAWxyD0PNpWV27i93FK8SIUy9HufpZucoN0BQ0moAj9BhbneumB+dUwRe
+            gh+C6LzbRuehFvegIh8DlWIKeMH1L0xW100cwuXyf6FOK/FM/pSsWX1IdlXD5Hfv
+            OSt4QHJESepTmEukfEgyywBMxk1iKdhW9/xa5lkEGxfGv6LnomzFWuKKOqiOF8GG
+            ZTt3NIj3Hr0S0USehbyQwQNOB/EvWTSWcoeaEVUmdphil8rZySZ6B2kkHWaj60YQ
+            cxb+vv9wgrjJitAhwds/xI5HYk0VSXdwtxZPTB4wqzNak5jHFKEY6/s0meQHk3Y4
+            UF9JIZsxLgPGGpAxzYka+Rlibv1FlPpyWQJZet6NGD/VbinhosIVv9vSZA3PqbyB
+            1x31PxGbKac/b7yeo2AfncpKPm0A33VENv1btRbbBGc2LRkYyLnlTDGmHbBrFE0s
+            HNnh4Gfc5EU6+GQo9UO7WIex5AQLvje91js895StVeh52ziyCBdjUwy6hhlSERPS
+            XAHgjHq0JXu8+cZrgjWyPlLcDYbMelW8RWsiGvvyZqUJn5YfVLBkMpSYVRanC0ib
+            3jBdLOaHKZvi9na0Tuf6QcWHep8J4hj1u80yUmIIzk0Xyv5WFYcypJ+g7KqC
+            =MmP5
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
    version: 3.10.2
@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: renovate
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+  - token-secret.yaml
+secretGenerator:
+  - name: renovate-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml
@@ -0,0 +1,6 @@
+nameReference:
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: renovate
@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: renovate
+  namespace: renovate
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: renovate
+        namespace: renovate
+      chart: renovate
+      version: "46.260.4"
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: renovate-values
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: renovate
+  namespace: renovate
+spec:
+  interval: 1h
+  url: https://docs.renovatebot.com/helm-charts
@@ -0,0 +1,43 @@
+# GitHub Personal Access Token used by the Renovate CronJob.
+# The chart injects this Secret's keys as container env vars (envFrom), and
+# Renovate picks up RENOVATE_TOKEN automatically.
+#
+# Required scopes (fine-grained PAT, restricted to vhaudiquet/homeprod):
+#   - Contents: Read & write   (push update branches)
+#   - Pull requests: Read & write
+#   - Workflows: Read & write  (repo has .github/, lets Renovate manage
+#                               action-related files if configured later)
+apiVersion: v1
+kind: Secret
+metadata:
+    name: renovate-token
+    namespace: renovate
+type: Opaque
+stringData:
+    RENOVATE_TOKEN: ENC[AES256_GCM,data:XgCD6ppqguo6MMv0OScXUkqhn07Mo31F8o4yf9Hd51wHjpmh/DHBSREqBzYpETrB4vDjec9AVyylOTz5qEITFdme+K8qg4L6Ti/JPIm5WOPNsXD84k3ZFIr6PWvQ,iv:ovQhFt2XlyHYzadYlQnQQ/X/NFV+9CeacZ40B1WYjqw=,tag:NTWOBN0ceJ7evKGq+y+cFg==,type:str]
+sops:
+    lastmodified: "2026-08-26T19:31:53Z"
+    mac: ENC[AES256_GCM,data:1EsEQ1JmB0pTgoA062k48hKAa4IUNKm55E/9bbmHPRcI5CUC7IBC2npT2yn0+6eQ7gTSqdrbqZw+xu0LAF5IrEjIIscKE7yZizkFAIy5VuCdZdAOBlvLtc1GXg7PE6ACXn8wHDcWBcAoq12HEAtpdXS1dNhdZBFxkB27RD7UvYw=,iv:hPeTFZlrqXyVNuy3D00VeLqecKDEKKGe/AhuFwSxPYs=,tag:O6+OYfJU3QeL58f5/tUQkg==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:31:53Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAvkrhQ3QLbfF4xTCjmLnY4BzudBMrx4j1+zjG7S8MZ/oL
+            Vx4ji8gAxRIvv6DZ/eSwybeTijtY4ROUQRAm+2Ut5r2yKVGZiokTUE3js/SgQ4Nx
+            uSMcEdn5GOilgM/c30GXsWzCo3yiGWWCNISwxOLvdRC2FEw0OYxTRSEvtBnck22q
+            FExVE6fvH/ks7nak3ry9Bo4OEVZZrLmr8MR/RL/l6Z8AyOLCp7yss+a0OvTb+NRq
+            PVQXmoLlRYqEdbkW8lbyt32oJ451ukMH3l6yscC0ZxHIC6XvKUwUa9uhcUPLZq97
+            o73fmYqCSKmfLc8CMTDX97d9yuApOepZZtVaJGxLhxd/pNIZNwbojoo6pCKh8bdY
+            2CdSf/FA+EqjG1B6CtzHCE35FgiYuDxFsOM7WbPROvT8n7QYVnZGI/QoFawWAFsw
+            heFi9sDGBcqM+bZDo7NTV0Nd25Q/+GfCHpK1BAug4n3K61OuJhJfHw1kadbH81y0
+            vWN9AAQTYfu5FjqMjSbyASbTYNX28a776ojYrR6HGgD2A5PyC1vBAR+VZwSernfm
+            N+wJ8YAK/2hPKVReEhYFcJiSm/MuNW9QD49/gbj7Y/NFs5NEJlV33cAEo6hyduR+
+            Z+Aw2M9xOsz+qFop86oRGSXNCZh/TG/G5/7rjS2zNG0vQAsgQ+xVXmDJPsmZnPnS
+            XgFuPLMkIN+DFl3PaX9LwkqgROXA3KGG4jZsZ4qzQ0+fZOCAvoU7FNXKnyQ/i2qv
+            NPSRW2WLDAAbqwjj3jNxdd3JFRbDq6XQ+V175fYN8sTFuOYLq59d8YD7Z8e9+aU=
+            =xVRA
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2
@@ -0,0 +1,70 @@
+# Official Renovate chart (https://github.com/renovatebot/helm-charts).
+# Runs Renovate as a CronJob against github.com/vhaudiquet/homeprod.
+#
+# The GitHub token is NOT stored here: it lives in token-secret.yaml and is
+# injected as env (top-level existingSecret -> envFrom), picked up by Renovate
+# as RENOVATE_TOKEN.
+cronjob:
+    # Aligns with the "every weekend" schedule in the repo's renovate.json:
+    # one run every Saturday morning is enough to open the weekly PRs.
+    schedule: 0 6 * * 6
+    timeZone: Europe/Paris
+    concurrencyPolicy: Forbid
+    successfulJobsHistoryLimit: 1
+    failedJobsHistoryLimit: 2
+# Top-level chart key: wires the `renovate-token` Secret's keys as container
+# env vars via envFrom.
+existingSecret: ENC[AES256_GCM,data:tt9OJ41wHayCWgQYd+Y=,iv:jBqe+K1hL36ViFntV4cU3qh9jdnG6W8e4LiE99rIFIA=,tag:Kj8/qKd689iIatQgUc+9iA==,type:str]
+renovate:
+    # Self-hosted config (https://docs.renovatebot.com/self-hosted-configuration).
+    # Repo-level update policy lives in renovate.json at the repo root; this only
+    # tells the bot WHERE to run and WHO to authenticate as.
+    config: |
+        {
+          "platform": "github",
+          "repositories": ["vhaudiquet/homeprod"],
+          "gitAuthor": "renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
+          "onboarding": false,
+          "persistRepoData": true
+        }
+    persistence:
+        cache:
+            # Persist the repo cache + SQLite between runs: much faster clones and
+            # fewer GitHub API calls on a weekly schedule.
+            enabled: true
+            storageClass: longhorn
+            storageSize: 1Gi
+resources:
+    requests:
+        cpu: 50m
+        memory: 256Mi
+    limits:
+        cpu: "1"
+        memory: 1Gi
+sops:
+    lastmodified: "2026-08-26T19:31:53Z"
+    mac: ENC[AES256_GCM,data:fA2nukiGOWK5UVQRbBagOLdqSBjYYG2VysxXfQ3TuRtFYhN8bd16j5xIfy2aDrlLEVw19uhInggQMu2vJg7xT6V6Z9w5YsHwcSQWSGCMjTk764/ChT3QGA0nhVG2ktgsZgaiU/MrCAPN/XQP3dG6Y25vkcptFcXnn7Ig5D+V2eQ=,iv:3fKfVaDJ7RjjAI0n4I+6na9pKLB07yGgjvRXjh7I3Iw=,tag:cyclZ/i2rfKeAof15J4ufA==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:31:53Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAi9efDDL8A1RFxx50RBFjLi3G2OG8XQfo/UF3O7gd65vH
+            tu+3b9KtiRvWurOVqapAxUwapiiwx4Gsem5F1Q9FoX+5HfQ3APQ91kxfGjQTjx00
+            2lt+pl4JyeKj0+ilGMP5xaUyOvZGNB33v4ls14Uljzg3tqQQPGUvYMJ6f5svXXOo
+            ugagStCSx9jh0j++Y9gCFZXYSn3C1IblGeUxkh7fUJQjveqp8R5Ofntdg7sbV5Au
+            Xeah95zdQxdJ/zb6GW7t0dWY5KEYi4Tg1gNybvMIKDdWZ8NND7kaFOSx5Bg8aGJa
+            +6nh21MHs7oNmzpxLXNa9rTk1ncE2HcLcTIXl+NHf10dPcR6R32w8Bc5e1UtBKI9
+            mUeHgH2zphG4Xihcchbeeb6RAxBvl2EWLglxB/HKKw8ouC3EmlOj63QS7o8ES8CZ
+            z+/uq4uOP65Q9k0xa9YHl4nGVXlOYqxFkiB71UYIqwUxyw/Th0IEZhBrd2GFf2wl
+            CUj9DDDejWBvGyIwp1MIRLhQkMrL4KczHLAdMEC/OcvylZHxESOpMEIq+CUXi0wr
+            GyjnwLS3F1ZPB0+Xbpy8OfTKAT1jI6Z65G6138p6c8xJsh+lBwBd4QFTJ0VfR+fd
+            /edCwMKalySDK0Li9OIphj1or90l/ZURdlZpIrgnYrYeBg7HibuN2E0u0cMur/DS
+            XgExhwYtGznQThvIySwqAa2YMLm5tz5PJ1mUGkJ2AUaJuQX9SfhFYJSCGjpv8Fbf
+            04FCKZ7B8eG9j9ae0Wfn07SeN9xSZEMuCtE0KLjAR0v5ACAF5Lb6Ee5tc+5K2sk=
+            =zZdk
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2