build(deps): bump caddy in /kubernetes/system/caddy

Bumps caddy from 2.11.2 to 2.11.3.

---
updated-dependencies:
- dependency-name: caddy
  dependency-version: 2.11.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yml

@@ -34,7 +34,6 @@ updates:
       - "/docker/production/alexscript"
       - "/docker/production/buildpath"
       - "/docker/production/semeryfr"
-      - "/docker/production/vhaudiquetfr"
       - "/docker/tools/excalidraw"
       - "/docker/tools/obsidian-livesync"
       - "/docker/tools/stirling-pdf"
@@ -52,6 +51,7 @@ updates:
       - "/kubernetes/personal/notesnook"
       - "/kubernetes/personal/photoprism"
       - "/kubernetes/production/umami"
+      - "/kubernetes/production/vhaudiquet-fr"
       - "/kubernetes/system/blocky"
       - "/kubernetes/system/caddy"
       - "/kubernetes/system/coredns"

.swarmcd/stacks.yaml

@@ -153,11 +153,6 @@ semeryfr:
   branch: main
   compose_file: docker/production/semeryfr/docker-compose.yml
 
-vhaudiquetfr:
-  repo: homeprod
-  branch: main
-  compose_file: docker/production/vhaudiquetfr/docker-compose.yml
-
 excalidraw:
   repo: homeprod
   branch: main

dns/production/buildpath.win.yaml

@@ -3,7 +3,7 @@
 : - octodns:
       cloudflare:
         auto-ttl: true
-        proxied: true
+        proxied: false
     ttl: 300
     type: A
     value: 83.113.30.49
@@ -22,7 +22,7 @@ www:
   octodns:
     cloudflare:
       auto-ttl: true
-      proxied: true
+      proxied: false
   ttl: 300
   type: A
   value: 83.113.30.49

docker/home/n8n/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   n8n:
-    image: docker.n8n.io/n8nio/n8n:2.19.5
+    image: docker.n8n.io/n8nio/n8n:2.21.2
     environment:
       - TZ=Europe/Paris
       - N8N_SECURE_COOKIE=false

docker/infrastructure/mail/stalwart/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   stalwart:
-    image: stalwartlabs/stalwart:v0.16.4
+    image: stalwartlabs/stalwart:v0.16.5
     container_name: stalwart
     networks:
       - default

docker/infrastructure/network/traefik/traefik.yml

@@ -8,6 +8,7 @@ entryPoints:
       trustedIPs:
         - "127.0.0.1/32"
         - "10.1.2.11/32" # nginxproxymanager
+        - "10.1.2.152/32" # caddy
 
 providers:
   docker:

docker/personal/gramps/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   grampsweb:
     container_name: grampsweb
-    image: ghcr.io/gramps-project/grampsweb:26.5.0
+    image: ghcr.io/gramps-project/grampsweb:26.5.1
     restart: always
     networks:
       - default
@@ -31,7 +31,7 @@ services:
 
   grampsweb_celery:
     container_name: grampsweb_celery
-    image: ghcr.io/gramps-project/grampsweb:26.5.0
+    image: ghcr.io/gramps-project/grampsweb:26.5.1
     restart: always
     environment:
       - GRAMPSWEB_TREE="Gramps Web"  # will create a new tree if not exists

docker/personal/media/films-series/jackett/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   jackett:
     container_name: jackett
-    image: ghcr.io/hotio/jackett:release-v0.24.1822
+    image: ghcr.io/hotio/jackett:release-v0.24.1846
     ports:
       - "9117"
     networks:

docker/personal/media/films-series/jellyfin/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   jellyfin:
-    image: jellyfin/jellyfin:2026050514
+    image: jellyfin/jellyfin:2026051106
     container_name: jellyfin
     networks:
       - default

docker/personal/media/music/navidrome/docker-compose.yml

@@ -14,7 +14,7 @@ services:
       ND_SESSIONTIMEOUT: 24h
       ND_BASEURL: "http://navidrome.lan"
       ND_PORT: 4533
-      ND_REVERSEPROXYWHITELIST: "172.20.0.0/16,10.1.2.11/32"
+      ND_REVERSEPROXYWHITELIST: "172.20.0.0/16,10.1.2.11/32,10.1.2.152/32"
     volumes:
       - data:/data
       - "music:/music:ro"

docker/personal/syncthing/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   syncthing-valentin:
-    image: syncthing/syncthing:2.0
+    image: syncthing/syncthing:2.1
     container_name: syncthing-valentin
     hostname: syncthing-valentin
     environment:

docker/production/buildpath/docker-compose.yml

@@ -10,7 +10,7 @@ services:
     env_file: .env
 
   match_collector:
-    image: git.vhaudiquet.fr/vhaudiquet/lolstats-match_collector:e76cb3ea8ee0ce83295d470aa527e484924e773f
+    image: git.vhaudiquet.fr/vhaudiquet/lolstats-match_collector:0224b7812c8631bde3e9513adace64341152fc20
     build: ./match_collector
     volumes:
       - bpcdragon_cache:/cdragon
@@ -23,7 +23,7 @@ services:
     env_file: .env
 
   frontend:
-    image: git.vhaudiquet.fr/vhaudiquet/lolstats-frontend:e76cb3ea8ee0ce83295d470aa527e484924e773f
+    image: git.vhaudiquet.fr/vhaudiquet/lolstats-frontend:0224b7812c8631bde3e9513adace64341152fc20
     build: ./frontend
     restart: always
     volumes:

docker/production/vhaudiquetfr/docker-compose.yml

@@ -1,36 +0,0 @@
-services:
-  vhaudiquetfr:
-    container_name: vhaudiquetfr
-    image: git.vhaudiquet.fr/vhaudiquet/vhaudiquet.fr:259ad574d15c1b50e0766602b6b0b5ee39afd657
-    networks:
-      - default
-      - proxy
-    ports:
-      - 80
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.vhaudiquetfr.rule=Host(`vhaudiquet.fr`)"
-    environment:
-      - NGINX_HOST=vhaudiquet.fr
-      - NGINX_PORT=80
-    volumes:
-      - files:/usr/share/nginx/html/files
-      - public:/usr/share/nginx/html/public
-
-networks:
-  proxy:
-    external: true
-    name: proxy
-
-volumes:
-  files:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/vhaudiquetfr/files'
-  public:
-    driver_opts:
-      type: 'nfs'
-      o: 'addr=truenas.lan'
-      device: ':/mnt/main_storage/public'

generate-dependabot.sh

@@ -52,6 +52,7 @@ find kubernetes -name 'release.yaml' -print0 \
 if ! [ -f .github/dependabot.yml ] || ! cmp -s "$tmpfile" .github/dependabot.yml; then
   mv "$tmpfile" .github/dependabot.yml
   echo "Updated .github/dependabot.yml!"
+  git add ".github/dependabot.yml"
 else
   echo "No changes to .github/dependabot.yml."
 fi

generate-docker-swarmcd.sh

@@ -33,6 +33,7 @@ find docker -name 'docker-compose.yml' -print0 \
 if ! [ -f .swarmcd/stacks.yaml ] || ! cmp -s "$tmpfile" .swarmcd/stacks.yaml; then
   mv "$tmpfile" .swarmcd/stacks.yaml
   echo "Updated .swarmcd/stacks.yaml!"
+  git add ".swarmcd/stacks.yaml"
 else
   echo "No changes to .swarmcd/stacks.yaml."
 fi

kubernetes/production/vhaudiquet-fr/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: vhaudiquet-fr
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: vhaudiquet-fr-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/production/vhaudiquet-fr/kustomizeconfig.yaml

@@ -0,0 +1,6 @@
+nameReference:
+- kind: Secret
+  version: v1
+  fieldSpecs:
+  - path: spec/valuesFrom/name
+    kind: HelmRelease

kubernetes/production/vhaudiquet-fr/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vhaudiquet-fr

kubernetes/production/vhaudiquet-fr/release.yaml

@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vhaudiquet-fr
+  namespace: vhaudiquet-fr
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: vhaudiquet-fr
+        namespace: vhaudiquet-fr
+      chart: vhaudiquet-fr
+      version: '>=0.1.0-0'
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: vhaudiquet-fr-values

kubernetes/production/vhaudiquet-fr/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: vhaudiquet-fr
+  namespace: vhaudiquet-fr
+spec:
+  interval: 1m
+  url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm

kubernetes/production/vhaudiquet-fr/values.yaml

@@ -0,0 +1,67 @@
+# Number of replicas
+replicaCount: 1
+# Container image configuration
+image:
+    repository: git.vhaudiquet.fr/vhaudiquet/vhaudiquet.fr
+    pullPolicy: IfNotPresent
+    # The image tag defaults to the chart appVersion (which is set to git SHA by CI).
+    # Override this only if you need a specific version.
+    tag: ""
+# Image pull secrets for private registries
+imagePullSecrets: []
+# Ingress configuration
+ingress:
+    enabled: true
+    className: ""
+    annotations: {}
+    # kubernetes.io/ingress.class: nginx
+    # kubernetes.io/tls-acme: "true"
+    hosts:
+        - host: vhaudiquet.fr
+          paths:
+            - path: /
+              pathType: Prefix
+    tls: []
+# Environment variables
+env:
+    NGINX_HOST: vhaudiquet.fr
+    NGINX_PORT: "80"
+# NFS Storage configuration for public files
+nfs:
+    enabled: true
+    # NFS server IP address
+    server: truenas.lan
+    # NFS export path
+    path: /mnt/main_storage/public
+    # Mount path inside the container
+    mountPath: /usr/share/nginx/html/public
+    # Storage size for PVC
+    storageSize: 10Gi
+    # Storage class name (leave empty for default)
+    storageClassName: ""
+sops:
+    lastmodified: "2026-05-14T09:33:46Z"
+    mac: ENC[AES256_GCM,data:R5ular4bAyV0cFPGUGYg4NWCGI64rWTax6ObBnCadORwSTh5/VQN3bsDDPFC3dep/7nKzY71d2X4qAcVU3RkWa9eMP+e9dhaGV9/8gvY/qDXZiNEuAXsmpaSATgUo6mUwqrwl5tn4ono4ID8gr7FRVpneTbYX/HpiWDbBa9l1Xk=,iv:wQ552gswkX5aOy/Cht1zY56camnb8EhEwy711osyf4c=,tag:t+U/1wRD7/z39KY9zjNcMQ==,type:str]
+    pgp:
+        - created_at: "2026-05-14T09:33:46Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/+JAzu9u2Dgn+lA58pIhRbM1064juEOvebtBK0FdJCi7AG
+            /Up2oooBmLMxybk16q0800kZHgOAcqTWkRcDq3QhC7nK+xcs03plTLLAlqfnh2x0
+            XyqQVk4du9caRdgvgN96tG+oWUJcuUJ/uFunXAzRvPnNysS5sGXVKJmbVVKfTjqk
+            UPyA5sBbCIxW10kPZJjprR1HaRl2dkgz7jZI/q2RXhFjCOhthMErBFr4f6xD3LnN
+            H5XVtixNcVmIinsGUIgvPW+qknjrf17ammgEtOqjtuu4PUevQFt4zkVyjU0Y/ASj
+            HAyYgSNIAXanb3u9ulL6CCg/CXJSofTrexw5RPM9eTQQ7S1KqHm/Ns6jjl/jXtEW
+            cIQZ5bQJPTJu7W9gxGpgaLmWwGfoDWvmT2rIFYC9tf+61F4EbRvY6KepKET9NYTJ
+            EnyDoxRsfVgxwQjyqpIpmNewWpgWwcLbD8INoJUVx/Yr284F9pBCgKqKRmeNH/Sy
+            kEt3QD1ElohuwTx7XLkYf6LuDFy8kA5wFUPKUgxmoFsGZhMhmi8ysUkUxtYPPMD8
+            YLVOK8UX3sYUDdY7tQjlgz6nhMqGL7ekqxyA5PSCGlhg5siKIhltz1CzadNOrsqF
+            jHkiUCrDNu1ToRPllOw4WMwSzII/sf2oP3FJyE+/Rsl49rVjELLfC8eWPhG0yhXS
+            XgGHbmvrm1QPl70dF+896QE/XtSydiqLUynCeIAvh61//ipS9lSZXpdDKEP5Q7ZD
+            /lTbPRH7Y7EZUgarjBtc2wYg3iaBkELtS5lnQeJawHQ8/M3TxdWmgEeBim/qr+A=
+            =K+50
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    version: 3.10.2

kubernetes/system/caddy/caddyfile.yaml

@@ -17,7 +17,7 @@ data:
   Caddyfile: |
     vhaudiquet.fr {
       tls /etc/caddy/certs/vhaudiquet-fr.crt /etc/caddy/certs/vhaudiquet-fr.key
-      reverse_proxy 10.1.2.212:80
+      reverse_proxy 10.1.2.171:80
     }
 
     *.vhaudiquet.fr {
@@ -38,7 +38,10 @@ data:
         @umami       host umami.vhaudiquet.fr
 
         handle @authentik {
-            reverse_proxy traefik.traefik.svc.cluster.local:80
+            reverse_proxy traefik.traefik.svc.cluster.local:80 {
+                header_up Connection {>Connection}
+                header_up Upgrade {>Upgrade}
+            }
         }
         handle @auth-nook {
             reverse_proxy traefik.traefik.svc.cluster.local:80

kubernetes/system/coredns/zone-configmap.yaml

@@ -65,3 +65,4 @@ data:
     webmail         IN  A   10.1.2.212
     wizarr          IN  A   10.1.2.212
     zigbee2mqtt     IN  A   10.1.2.212
+    nodered         IN  A   10.1.2.212

kubernetes/system/traefik/values.yaml

@@ -8,35 +8,31 @@ ports:
                 - 127.0.0.1/32
                 # nginx-proxy
                 - 10.1.2.11/32
+                # caddy
+                - 10.1.2.152/32
 sops:
-    kms: []
+    lastmodified: "2026-05-26T10:06:12Z"
-    gcp_kms: []
+    mac: ENC[AES256_GCM,data:6pqJOa+WstEuKpP4WPEjUslZX1pGkdFxrfXQEYTNO2sU2MXgIXK0tyx/Q1vTJWnMh5fK17LOdch9ddHPhRr2Q8UXAkLC/9FPEtSwcXfLIp4pZV0C3bYZyOOjHGBJp2tU6ghimJ4SPAdhOHEV0pkhKdsG3/uZxWV0KdyfC+TugRE=,iv:hLCFrIpz22X6hE0pGOAqqcrpzoFu8HujwEtb9nvVtjQ=,tag:7FW3zHoxrW2NeKSnnO9gyQ==,type:str]
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2025-03-22T13:26:30Z"
-    mac: ENC[AES256_GCM,data:PMUHyPCnIhmUo5N1mdoMhDLXaFN6Cl0IGuq8EG3MGtY5X1g1QboL5nI5o25evFbuXdZn9KB2AqgzPZBxykhVpz8W+mj987g4VeDJ7sU/OnJibHSo+ibqoo0NvQaAMukWevqI7fAQZoyI3PZi07mMGYw23h2cmaJmsuAuDnQ0CvA=,iv:RRV/BF7OXFmBJX5lXZjrG4+4jjbjzMrR8BByMo5hfwA=,tag:+lVLSfdjHeJjA3dKMiRIGA==,type:str]
     pgp:
-        - created_at: "2025-03-22T13:26:30Z"
+        - created_at: "2026-05-26T10:06:12Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/8DGnKyC/pNGEAuuxcZjoLQhK8TJ3NgNQ3HBVLGpbVBb3S
+            hQIMA7uy4qQr71wiARAAkuFrI1AQDcLWUWGeGLwpN44bo451TZdADcrk7pea2Rvb
-            P/n94oPwwEbWXpdq1/MapFgaiAP3kXyv308c0CeIICQvg9xFeXK7/o/X3ucJu/YV
+            L+vgroTr+U/DtS3ZgzDYfb4RO/RGli8GID0z+hVDRqdAp5xuvlWE7bLYahmdeyJr
-            TiMsBUCAIWKrN4lmNr3wgnMDQiRs9myzgmzJv3KOpbQr5cYnrT51spWCD2Nnt6Xm
+            YHvHfcxm0lQkHpKo8gQKeQCOHFAFS5jIC/0Uck3yAxbECCIVWXTO6VWYPAcxTZQL
-            HfLyZrxGscW0lrRi6jeg/7lts3HYEs75i8xUS95pj5/a+7i83sfpaAFdkGcxV6Vq
+            rzR3rwD3XPJqydbwjmbta3WhHvON/NFbTt6kHBryLDo25zMSOyvdMPc40xetc6z8
-            285Ys7S86Hrp2T0QkADHMJMXmbeTV18Psfy2v9SXgqeRMq1XHQDn+nPPkYY0kmhs
+            tcH1DF8zgxGssEsdYcBLzNQ7CNXtNBLJxrPsQ8wABSrxtBtO43A67JdhIoOk4VYC
-            7xVEwGHYLkKuyNmTm+ygsQAVGd/kCeqO+hsdKRtmJ5f4vh0w1ePftScqbfEwNuDl
+            koOqeAzbXTIfElTEKguEE+bUY+UpPd8jYQUp5A/F7mkp0qjNTyHJ2dC2v7brVfYY
-            ygEVUIoVhDYdUKnjwqjgiOxsx3Y6+RS4g3vg6gNWk1HunM24bzkFRP4w1lVYB07n
+            3gLZYzEjCnIe54L6/EeszLr9cp4g5J3jUG4sBEeYTsZd+zb3dLKF4imOGqRxTUrs
-            hDcQeP0bqo7hopJjvM0VtXbSJq81duBup9DyyPaXOf30p0c+l9it4XdoeR7JaZ/y
+            EMMfIRlXNG0CSykdGcYUAfRDOMcrewy7jhzJOczcB48Niwrmq2n5MDALAxR3vOjo
-            nJ22POfQYCoJyKpgdB/eReLd/2MqLhdnsCUTd+CNTS1+nCz1M4JziagXU9CspnqP
+            YRChO74RuKqUGdOnJorGWNpVo1Khy2rCC3V+KmcRXMdYN1HPe2II6nijLHDmj/jN
-            sCYylw6aC9XfzScZldpysdqes1/1ZC9F2QeL6ZO66IRV3xBk/5eSsyZ275DRZYAj
+            W83NovJv6FOIV2g0TKIFTJSaDtl3KTN4+7DJw2MnsjkiDv0W9hY02fc4QbEtuW2+
-            P4jf1UhA4U0LQoVPAjh9cA8SLm29MgfEwoFSLGx6wsJ//ibxMIlxku9gkiRRTkPU
+            7FKZi1B8qbZU6iQV/PMO3Pv460qQ39M+1OEhkDmpMf/hk//6GSec2CUg4Ivn8P3S
-            aAEJAhCQKhc7EsDKh7GgrlPh0763p+CuZR7yMp2W1kY9nU/w/802SgYEyLdPW1aY
+            XgGYqg1j6D0AU/Y69kcmoWdZN7SIcJ/VfOpfosBkk4oi3UhWqAkjs/F929xPBNtL
-            gG3zMpt1roTOQI7D0jM7NjcYOLeOHWR0ac00wqv3S7I9+4tXOxuHyTX6Og19Z3GV
+            BjvNOG2TBlxlDAlx2A2OE7Mx1gcH6hppxqY4xCY1T1vz+K5cBgBvSEK6GSFV/F0=
-            OUgA2wzhUFtj
+            =DkrO
-            =2DEs
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|ssh-key|api-key|user|username|privateKey|apiKey|extraArgs.*|extraEnvVars|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.9.4
+    version: 3.10.2