build(deps): bump ghcr.io/0xerr0r/blocky in /kubernetes/system/blocky

Bumps [ghcr.io/0xerr0r/blocky](https://github.com/0xERR0R/blocky) from v0.24 to 0.26. - [Release notes](https://github.com/0xERR0R/blocky/releases) - [Commits](https://github.com/0xERR0R/blocky/compare/v0.24...v0.26) --- updated-dependencies: - dependency-name: ghcr.io/0xerr0r/blocky dependency-version: '0.26' dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
2026-07-27 08:00:46 +00:00 · 2026-06-24 00:43:37 +00:00
26 changed files with 43 additions and 347 deletions
@@ -47,7 +47,6 @@ updates:
      - "/kubernetes/home/home-assisant"
      - "/kubernetes/home/zigbee2mqtt"
      - "/kubernetes/infrastructure/authentik"
-      - "/kubernetes/infrastructure/mail/stalwart"
      - "/kubernetes/personal/linkwarden"
      - "/kubernetes/personal/notesnook"
      - "/kubernetes/personal/photoprism"
@@ -1,6 +1,6 @@
 services:
  esphome:
-    image: ghcr.io/esphome/esphome:2026.6.3
+    image: ghcr.io/esphome/esphome:2026.5.3
    ports:
      - "6052"
    networks:
@@ -1,6 +1,6 @@
 services:
  stalwart:
-    image: stalwartlabs/stalwart:v0.15.5
+    image: stalwartlabs/stalwart:v0.16.9
    container_name: stalwart
    networks:
      - default
@@ -1,7 +1,7 @@
 services:
  fireshare:
    container_name: fireshare
-    image: shaneisrael/fireshare:1.7.3-lite
+    image: shaneisrael/fireshare:1.7.1-lite
    ports:
      - "80"
    volumes:
@@ -1,7 +1,7 @@
 services:
  grampsweb:
    container_name: grampsweb
-    image: ghcr.io/gramps-project/grampsweb:26.6.2
+    image: ghcr.io/gramps-project/grampsweb:26.6.1
    restart: always
    networks:
      - default
@@ -31,7 +31,7 @@ services:

  grampsweb_celery:
    container_name: grampsweb_celery
-    image: ghcr.io/gramps-project/grampsweb:26.6.2
+    image: ghcr.io/gramps-project/grampsweb:26.6.1
    restart: always
    environment:
      - GRAMPSWEB_TREE="Gramps Web"  # will create a new tree if not exists
@@ -1,7 +1,7 @@
 services:
  jackett:
    container_name: jackett
-    image: ghcr.io/hotio/jackett:release-v0.24.2142
+    image: ghcr.io/hotio/jackett:release-v0.24.2075
    ports:
      - "9117"
    networks:
@@ -1,6 +1,6 @@
 services:
  jellyfin:
-    image: jellyfin/jellyfin:2026062906
+    image: jellyfin/jellyfin:2026061506
    container_name: jellyfin
    networks:
      - default
@@ -1,7 +1,7 @@
 services:
  radarr:
    container_name: radarr
-    image: ghcr.io/hotio/radarr:release-6.2.1.10461
+    image: ghcr.io/hotio/radarr:release-6.1.1.10360
    ports:
      - "7878"
    networks:
@@ -1,7 +1,7 @@
 services:
  sonarr:
    container_name: sonarr
-    image: ghcr.io/hotio/sonarr:release-4.0.19.2979
+    image: ghcr.io/hotio/sonarr:release-4.0.17.2952
    ports:
      - "8989"
    networks:
@@ -1,6 +1,6 @@
 services:
  radicale:
-    image: tomsquest/docker-radicale:3.7.5.0
+    image: tomsquest/docker-radicale:3.7.3.0
    container_name: radicale
    ports:
      - 5232
@@ -9,7 +9,7 @@ services:

  web_recipes:
    restart: always
-    image: vabene1111/recipes:2.6.12
+    image: vabene1111/recipes:2.6.9
    networks:
      - default
      - proxy
@@ -4,20 +4,13 @@ services:
    image: mongo:8.2.11
    restart: always
    user: root:root
-    command: mongod --wiredTigerCacheSizeGB 2
-    deploy:
-      resources:
-        limits:
-          memory: 6G
-        reservations:
-          memory: 3G
    volumes:
      - bpmongo_data:/data/db:Z
      - bpmongo_config:/data/configdb:Z
    env_file: .env

  match_collector:
-    image: git.vhaudiquet.fr/vhaudiquet/lolstats-match_collector:d878af6d1a5cb633175515259e27a12c76c4609b
+    image: git.vhaudiquet.fr/vhaudiquet/lolstats-match_collector:f2827f85eb71942bbe905b5d83fefaddc3df8e7d
    build: ./match_collector
    volumes:
      - bpcdragon_cache:/cdragon
@@ -30,7 +23,7 @@ services:
    env_file: .env

  frontend:
-    image: git.vhaudiquet.fr/vhaudiquet/lolstats-frontend:d878af6d1a5cb633175515259e27a12c76c4609b
+    image: git.vhaudiquet.fr/vhaudiquet/lolstats-frontend:f2827f85eb71942bbe905b5d83fefaddc3df8e7d
    build: ./frontend
    restart: always
    volumes:
@@ -10,39 +10,20 @@ ingress:
 # Disable HA, we are on a 1-node cluster
 redis-cluster:
    enabled: false
-# Valkey cluster is the new default in chart 12.x - must be explicitly disabled
-valkey-cluster:
-    enabled: false
-# Use standalone Valkey (replaces 'redis' in chart 12.x)
-valkey:
+redis:
    enabled: true
-    master:
-        resources:
-            requests:
-                cpu: 100m
-                memory: 128Mi
-            limits:
-                cpu: 500m
-                memory: 256Mi
 postgresql:
    enabled: true
    global:
        postgresql:
            auth:
-                postgressPassword: ENC[AES256_GCM,data:5SoftEfh4w8hmA==,iv:QbbOmVM3Jp3gxAxL1OvnB6WKFX+OTHFENz1roMnPqyc=,tag:Gtn7H7d3O7Hweg5q6P6xUg==,type:str]
-                password: ENC[AES256_GCM,data:0BMgFdvPvhB9oQ==,iv:Z0mkQBfhpc7y1nSLY6MOucxwuKZ8TfOk6NlQE9RwVQw=,tag:yGDAOH6TCJDCfhxNlC/eCg==,type:str]
+                postgressPassword: ENC[AES256_GCM,data:iS1hZgegYcjUYA==,iv:sQopZNgQvktuVPTcSHGIXe8Vcx0QRrkOBmvCU+lXeYo=,tag:EzQXgSj6Mw8Sj342P6qoKQ==,type:str]
+                password: ENC[AES256_GCM,data:D9ajgAcbx6XJwQ==,iv:JXipoz3yEj85jvyfgTkt8UmACO1R94vrpTCUdQPhS/s=,tag:nJrhXFdtdlrE7CrgrsFHUQ==,type:str]
                database: gitea
-                username: ENC[AES256_GCM,data:F7+91aE=,iv:tEGgJ6GoXVkNoD6D4ZnyClrOQLGlqzFIUqqwDrVjd9U=,tag:H1+f/EKf/KptooRf8g0qcQ==,type:str]
+                username: ENC[AES256_GCM,data:ynRejXA=,iv:XxPBPLUywl4rDKo6RMJT1rOzAeK9lkUsYT5DlL+vqyY=,tag:lJFJGebHtj7nC+PFL1f6jw==,type:str]
    volumePermissions:
        enabled: true
    primary:
-        resources:
-            requests:
-                cpu: 250m
-                memory: 256Mi
-            limits:
-                cpu: 1000m
-                memory: 1Gi
        livenessProbe:
            enabled: true
            initialDelaySeconds: 30
@@ -75,8 +56,8 @@ gitea:
    oauth:
        - name: Authentik
          provider: openidConnect
-          key: ENC[AES256_GCM,data:oq+UsuiNEGWphxXbwtbBs3d27bB2cVPoR617TWhcPOk67D7XWUPkmg==,iv:hODOA45FFex/b5ghHScnDoc5osu1d8bzD969oFVH3wE=,tag:67TMl55I6zgJWNGMqco6fg==,type:str]
-          secret: ENC[AES256_GCM,data:o9BZSzy61ouycNgtgRg/Jn8Wz+hLBBqgX46iHbaYtPbUVPVFc9tpdCsTdHCpfSGfiS1B8kWcoSzIDIAIIofRSCS/QqEQeuTwsyakkXhgn/LtLn+TH7bdLLS8qqusy5MZ9U18IJ/UBPGZ5+16Y/glbhpfHu9NNv0AI07nPciTq1w=,iv:7dn7eW2oEK/EU4xIETwVSekZUmktrs7U9KTJC486nHs=,tag:Otl2KuySu9bI/cZfCyjiKA==,type:str]
+          key: ENC[AES256_GCM,data:aU+rNnGTT4pji75ZJtBDmAkE0bX1alWTzUG0+DywCjQ66nSCqCa8DQ==,iv:DUxx8EFFBgnIivyf9CPpFx3sDeiu2NkIFDcoj6lVDeo=,tag:Zm6rEsXaCBuFmChgzdb2zA==,type:str]
+          secret: ENC[AES256_GCM,data:mkh0p931YVQ/kqpHdeZHEndQpxNYk+t4LqTkZFLyEFVOuy5ZdxyT/PbhiW4Uw2L9XGO6JyAaJaO89K77HdEjpLU9TntkuU4ETBW3V3vzM+42EysMqmeud8hQSUdtGa4UsRd3dDb354CM7S7i7Gr22CT5/a8ujO9HIXDTuf+UXkU=,iv:QnPOyVft4vvtaOrrhoXQXXXbH1DbdSA0mAu2IextLxs=,tag:0dxGssjnv4DoXylPZsvYrw==,type:str]
          autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
    config:
        APP_NAME: Gitea
@@ -102,38 +83,28 @@ gitea:
        indexer:
            ISSUE_INDEXER_TYPE: bleve
            REPO_INDEXER_ENABLED: true
-# Resource limits for Gitea container
-resources:
-    requests:
-        cpu: 250m
-        memory: 512Mi
-    limits:
-        cpu: 1000m
-        memory: 1Gi
-# Increase replica count is not useful for 1-node cluster
-replicaCount: 1
 sops:
-    lastmodified: "2026-06-27T10:20:08Z"
-    mac: ENC[AES256_GCM,data:VZY4oK2PCMBJd4VozL5qS7jlZtOu1JNsOn7aqJgPZ8uQR7kG939By7oVELMH9us0Sb8AZIYmzx7nLwnlp6IUNnacOffhKNl4stTFrb5Vry/5zem0CNp08eEDEt9VoxNudfQYC2axuGSwbAIahMzZsOYVRqOGgF1gEG17+hgd7ww=,iv:MiHKGUfzaSAppXLLxJSQD5loGkToFLzVQetWoRHq074=,tag:FduCPbHmy6A0mYdCrnRxDw==,type:str]
+    lastmodified: "2026-06-05T20:21:53Z"
+    mac: ENC[AES256_GCM,data:CySJzul7ciMGGQqt33RUG7sVp0xOt1ylK/uV0hibYDYk/s8JudcAO5bEDRfkeEaQuiURALAgCpg0ooA4wFlhklcfNYP5g2JqEtcwfR1e7DUW3KHmUTA3ViaLo3M7EtP9ALvZlE/L6cPqolIae4tjawIXnUSlZQ3d7O4m50VFHC0=,iv:DxvxcAE1N/J14S+j9N6YkF0885hi1CZoFB6dk1IqNxM=,tag:tbqHPJocfGlRJFDIuoW8VQ==,type:str]
    pgp:
-        - created_at: "2026-06-27T10:20:08Z"
+        - created_at: "2026-06-05T20:21:52Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ//VDYGwZupOfefdEtJkD9SPOW3tHcOy2XR6ULhVQjXTGGh
-            APuONtgUZKFCViUqYZB7l6fazM8U/fv3cHsIpZfALFGE9wSZ+4So6D5dmBj13egh
-            yznV55xjinoaKPzaYYZoVmlt1ZO22SxmC0vld3yfAs89KD1Aow5wNZGTBELzyAWF
-            gMYGMkCsLlH3gqBaJTV1m5LKHHQAtoyzvJbKcpiynNRySfN/ogNX67GmgEMH9+u8
-            UexPwUHL6skIzHLmugYcrs4FAABot4WzoJsR794wOq/DEqHBE4SfQg48y/DROu2O
-            mgo6KqiXXe8qPGCIvjLiudb7MdSLpoLqgZ0vpExzdS/wMXAXczodrRRJmzEQyeDE
-            j08pquhfUzQ1SA/9VRQkgl4r0dj0CTuc+EhvHD4M9nj3JIjvuJ0AdyKye5S8rdNM
-            rm9eyX8V+o6X811qUM8bobKEi36tdnSMiB1yVHTtdW7hKctQwRMNQ8A9QEtOxS2F
-            +9Owub4LXZwBejSLgh9jaKEnilJQKVYN5Aw2lNAmZZZKtJ+iGHHkq9H6k+k5oEoG
-            xkQ/IYIEGLhfjH0PDZ9m2G3Ren3EkEkNjYvhwENhuUcyuW5Abl62v9FMY8c9NYyK
-            +uf5VS1ceHOBcelQcdSx9Kuox5UuyUtbwUcv+HbTmymZtmYdw+dnOTtRHR5CNY7S
-            XgEvPWAEagJpsmqC2n7Vc9d7b7TVp+SLSiL/w0v9JD6ko54Rwj0x21Odx3FLe7P6
-            obKU6XNNX9PPThJw2W0E295i2+DmOTH0AFio3rsg5wM3JFUokY/t8590sWnFR8g=
-            =Gypa
+            hQIMA7uy4qQr71wiAQ//VC/fnusp5oupWvPbCJCRl46OfetfXIsY/J8JP3Npp2XB
+            Yz2u3gxwPLDZxLnBsR/jafym1/1wi42SV3eka16j8dKjm4cICA27ycAmU4zSC2/O
+            Os3s5wo4e7ajNHnRZ+SyXzBPeg6LEbv9O/mx2tiQZBHIs5bhQ1ZxQ7lTwiKYP8Es
+            kFf8oVO5rEEpMAd0RpiSlzsTWVWuOEfw0uQXjQOP+ZFAqcf9lPnQp273MbxUe0jL
+            e58OLp3wO+LWRlRnixrx9vLuUsFou+JcSfKoTFbcBXzDs0SSUiAOwz5nELNtlENT
+            dHGzaplWMnHFWPd3Ef7AUGwUlb23mxJNv/yuM6CNgkTec6qYdr3Arc84kGT9qdz3
+            pktw94Wiw3uPLpiGVkFMdBynzVUBbbiWPGByVF0NBRnp8+NABsiekAjFrV2I1wdr
+            rGmNtTS66jf2yEBMP5w64BbVH8zQ/FA4wSEQxFGm02Cp0dv/HSy07aPDUBWZZzr/
+            b9j6EUBZ7DKDLDY4uC05GJqeZFWf3M9disXnUbHQifMNIaRveoKPvBOg58ZpyUrA
+            rffDkBJmy5Cvwll3+8uomsYrU9sWVCs1dHOG3xfbHNmh4XB0J3G59S1+PRBgsQi9
+            zHTDuh9tF+ehCdMQjje+Cq9f6Aajv/S9HDaKxLfVkAVgdzP/Tu5ARZPIoYxyhR3S
+            XgGfZASrRdk9XjmjrBRt5wBl0MjVr9vXEVxNqEGcpcDM5Q9MznRRhGKtAQ4BcC84
+            bajKkGp9+6vas0tKR+Mp2wq4T+GMqLQVa3KedBuwXVdk3gE3jxhzd7rdT8chZbQ=
+            =kMPK
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
@@ -1,24 +0,0 @@
-# TLS certificate for the Stalwart mail listeners (SMTP/IMAP/POP3 STARTTLS + implicit TLS)
-# and the management WebUI hostname.
-#
-# Issued by cert-manager via the letsencrypt-production ClusterIssuer (Cloudflare DNS-01).
-# The resulting Secret (mail-vhaudiquet-fr-tls) is consumed in two places:
-#   1. The Stalwart HelmRelease mailTls block -> mounted into the pod + pushed to
-#      Stalwart by the tls-sync sidecar (JMAP) so SMTP/IMAP/POP3 present this cert.
-#   2. The chart ingress (TLS termination is handled by Caddy in this cluster, so the
-#      ingress is TLS-less and only routes HTTP to the mgmt port).
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: mail-vhaudiquet-fr
-  namespace: stalwart
-spec:
-  secretName: mail-vhaudiquet-fr-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: mail.vhaudiquet.fr
-  dnsNames:
-    - mail.vhaudiquet.fr
-  duration: 2160h      # 90 days
-  renewBefore: 360h    # 15 days before expiry
@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: stalwart
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - certificate.yaml
-  - recovery-admin-secret.yaml
-  - release.yaml
-secretGenerator:
-  - name: stalwart-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml
@@ -1,6 +0,0 @@
-nameReference:
- kind: Secret
-  version: v1
-  fieldSpecs:
-  - path: spec/valuesFrom/name
-    kind: HelmRelease
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: stalwart
@@ -1,47 +0,0 @@
-# Recovery / bootstrap administrator credential for Stalwart.
-#
-# This Secret is referenced by:
-#   - recoveryAdmin.existingSecret in the HelmRelease, which injects it into the
-#     Stalwart pod (and the tls-sync sidecar) so the cert-manager certificate can
-#     be pushed to Stalwart via JMAP. Keep it present for the lifetime of the
-#     deployment; the tls-sync sidecar needs it on every cert renewal.
-#
-# The username/password here are ONLY the recovery account.
-apiVersion: v1
-kind: Secret
-metadata:
-    name: stalwart-recovery-admin
-    namespace: stalwart
-    labels:
-        app.kubernetes.io/name: stalwart
-        app.kubernetes.io/component: recovery-admin
-type: Opaque
-stringData:
-    username: ENC[AES256_GCM,data:CYm0+Kw=,iv:UdgReqdb8GdoOfv1ZEW/7BAvY3vV88httj3W976eV0Y=,tag:PPrDQY/mo0RcJiz/cmxFSA==,type:str]
-    password: ENC[AES256_GCM,data:r0mPJ4qKIhAWDw==,iv:L5+OKTznQgDUgqttHwdW0X66vz+JPTqWdwYPGklCuj0=,tag:WNOj7ZjC6Lx76UlPsgSDhg==,type:str]
-sops:
-    lastmodified: "2026-07-02T20:57:39Z"
-    mac: ENC[AES256_GCM,data:lIVOaMsFV9F1/yLvykA3LH5ukn9PIba6N8cE9RGdcFepM56tBYlY6fbkcKTtojyAkoYov6OCjgTsOkMtUzRdGES4Zti6zHB3cTPal8bJCf5cAfYnGFRcQaASIkVjNZkQSJ2pDRP4rZqioCHuj2/a6uJZ4hhtSpxrECYbpzD2Gk8=,iv:31fXHsWH1ZP00Od5DSxgYPuw87NqQNfWl4vFtoouIHk=,tag:u5cJn231VT2ZTmlcdpBz0g==,type:str]
-    pgp:
-        - created_at: "2026-07-02T20:57:39Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ//fYBIypexVfQJn5BxVCRgZKRBcYw78XSoPjFYWFyk5F7I
-            UFRQKtdZOVVhgNHtFJOVyBvl1sAmmzAt3xq3L+Z5bvtrUfZ33tTp7ty+MmSmuutS
-            wquSh4NOHUYENGvo5pWsgVwQDj5bI2qUq4L92aedpB2XJycb7/Df7BWFKNMNgWdt
-            l+Hj9HEJWxmFjrz1MQJEL2r5WOx9/hK7uatbDTXVFPqyyW1aCM5XOkKErTuc3Avn
-            8tNNlvP1aqhI/2dHfOSZ1l0/PHhdi3RBmGa3BfAZUXEseBEesIK/EaJZXMjQYhF2
-            5tAPQ1irqg8LLv9mhrUD2mWaUigcuZ1EeyfZFvNtY/noF8fyZny1jra0sDe4CmQP
-            7uyP6CNRWPCikutUw45oxtw+/Us5Ld8xzJxhDEm0e+8FFiAK/SFSOx57JbjNzoCj
-            dqHU3UIzyp9VVZohqW7xdHOW64fgDI41BDKBsEiKraLnZUoXL2Lx0lnjxayJqVsD
-            2pX9D5YXzmtwFvUU5ZpcCzUWFu9MVxSfp6HdKvocGdtpSz7J23PQvHtkv20GxJYd
-            J45RYGgekuJ2EXc9kPaCuSex/0BKtYybOk5ANRv2yGeUZlc6EoW8/GZ4sHXPY6um
-            tt1DdIsMNMjAU68EgRkhmQnFAkZixJVdDR3u4MNXFUr0WdVIqzjFBavyrkcK6HjS
-            XAGhFNWdk5DNZ1ChGrMKEnYCZEB6XNkofa7S2xAomEoxyuCq7X2vbfBfqDQ/Rtcf
-            kSx0TpIOSHxefSFMduPz90rDqdZgUW0D3GND0PD5XRFFiJxxdrRYPux9MDMd
-            =Ef8e
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*.key|.*.crt)$
-    version: 3.10.2
@@ -1,21 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: stalwart
-  namespace: stalwart
-  annotations:
-    homeprod.io/essential: "true"
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: stalwart-helm
-        namespace: stalwart
-      chart: stalwart
-      version: "0.7.5"
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: stalwart-values
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: stalwart-helm
-  namespace: stalwart
-spec:
-  interval: 1m
-  url: https://kgrubb.github.io/stalwart-helm-chart
@@ -1,138 +0,0 @@
-# Stalwart Mail Server - Helm values
-#
-# TLS for the mail listeners is sourced from cert-manager: the
-# mail-vhaudiquet-fr-tls Secret (see certificate.yaml) is mounted into the pod
-# and pushed to Stalwart by the chart's tls-sync sidecar over JMAP, which also
-# calls ReloadTlsCertificates on every cert-manager renewal.
-# Container image
-image:
-    repository: stalwartlabs/stalwart
-    tag: v0.16.11
-    pullPolicy: IfNotPresent
-# Single-node RocksDB deployment.
-replicaCount: 1
-role: ""
-pushShard: ""
-# Recovery / bootstrap administrator.
-# The Secret (stalwart-recovery-admin) is required for the lifetime of the
-# deployment because the tls-sync sidecar authenticates to Stalwart's JMAP API
-# with these credentials on every cert-manager renewal.
-recoveryAdmin:
-    enabled: true
-    username: ENC[AES256_GCM,data:N8MwV7g=,iv:ipHgAWJ6J1C7TrugLLeJrV/IVk9xfC8DvCMBfIDyJMk=,tag:OwbcThuQhS/aBLH0tyewnA==,type:str]
-    password: ""
-    existingSecret: ENC[AES256_GCM,data:tGvczUq1+EDNR8CAFgLTMd+/N3v7Vig=,iv:XYrfBXYGexxUXskRJDSYx02D+nIYUmNtSCScplBenZM=,tag:/MZ5H6yuJlD7D6TN8CwVuQ==,type:str]
-    usernameKey: username
-    passwordKey: password
-# Recovery mode suspends mail services and exposes only the management listener.
-# Ship production values with this OFF.
-recoveryMode:
-    enabled: true
-    port: 8080
-    logLevel: info
-extraEnv: {}
-extraSecretEnv: {}
-# The bootstrap hook Job provisions a *fresh* domain/accounts/OIDC directory.
-bootstrap:
-    enabled: false
-# cert-manager TLS integration for the mail (SMTP/IMAP/POP3 STARTTLS + implicit
-# TLS) listeners. The Secret below is produced by the Certificate in
-# certificate.yaml (letsencrypt-production, Cloudflare DNS-01).
-mailTls:
-    enabled: true
-    existingSecret: ENC[AES256_GCM,data:HkvfPP3KuHm5O81LrSA6Slq0iH88rg==,iv:nHnYsJ9uaRa+rKE20bVuxyruM7kepPX21Hhbl2uvuwo=,tag:YUxgSPhFyecT3ls2sEqEVA==,type:str]
-    certKey: tls.crt
-    privateKeyKey: tls.key
-    mountPath: /etc/stalwart/tls/ingress
-    hostname: mail.vhaudiquet.fr
-    domain: vhaudiquet.fr
-    # How often the sidecar re-checks the mounted cert for changes.
-    reloadIntervalSeconds: 300
-# config.json contents - ONLY the DataStore object. All other settings
-# (listeners, storage backends, domains, accounts, certs) live in the database
-# and are managed via JMAP/WebUI.
-config:
-    '@type': RocksDb
-    path: /var/lib/stalwart
-# Main Service: ClusterIP. Used by the Ingress for the management WebUI (mgmt)
-# and for in-cluster access. Mail L4 ports are exposed separately via mailService.
-service:
-    type: ClusterIP
-    ports:
-        smtp: 25
-        smtps: 465
-        submission: 587
-        imap: 143
-        imaps: 993
-        pop3: 110
-        pop3s: 995
-        sieve: 4190
-        http: 80
-        https: 443
-        mgmt: 8080
-# Dedicated LoadBalancer for SMTP/IMAP/POP3/Sieve (L4). HTTP/HTTPS/mgmt are NOT
-# exposed here - the WebUI is reached via the Ingress (Traefik) below.
-# The WAN router NAT for 25/465/587/993/995/4190 must be repointed to this IP.
-mailService:
-    enabled: true
-    name: stalwart-mail
-    type: LoadBalancer
-    loadBalancerIP: 10.1.2.143
-    annotations: {}
-# WebUI ingress. TLS is terminated by Caddy at the edge (wildcard cert), so the
-# path is: public -> Caddy (TLS) -> Traefik (HTTP) -> this Ingress -> mgmt:8080.
-# No TLS block here.
-ingress:
-    enabled: true
-    className: traefik
-    annotations: {}
-    hosts:
-        - host: mail.vhaudiquet.fr
-          paths:
-            - path: /
-              pathType: Prefix
-              portName: mgmt
-    tls: []
-# Persistent volume for the RocksDB data directory.
-persistence:
-    enabled: true
-    accessMode: ReadWriteOnce
-    storageClass: ""
-    size: 50Gi
-resources:
-    requests:
-        cpu: 250m
-        memory: 256Mi
-    limits:
-        cpu: "1"
-        memory: 1Gi
-# Inherit the chart's secure defaults (UID/GID 2000, non-root, RuntimeDefault
-# seccomp, drop ALL caps + add NET_BIND_SERVICE for privileged mail ports).
-podSecurityContext: {}
-containerSecurityContext: {}
-sops:
-    lastmodified: "2026-07-02T20:57:39Z"
-    mac: ENC[AES256_GCM,data:8xnZW0A6hsysCDpfhfXnQ+NMc+VTSRwkMj4u2p2ERG8lj132dg5ErYG106jkQLXB3IkzxiAY9uyoquTpssVCOMemLRP9HgZmzqadI6kfpE2HZBHktgeY6MysF14RE4ep3naci0wVvpFiKv+sgr9QIbBmMnnN0pYwx5tASVFSgJc=,iv:KccW9I3LmxEmVfAnXjKz66FO1LgIO86zCFqp2/ulp4Q=,tag:xCNcgbHlttioSCvoZamwWw==,type:str]
-    pgp:
-        - created_at: "2026-07-02T20:57:39Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ//fdCucpqT55/e76AABnVcBvwM3s34HK33n+6bvEwE2jTr
-            IPU6UXEZZzMCuGnSWSSy07hSX/0rhw6ETLIJmEPQkqOnxk6T3rcz9+8fLPapfLjI
-            sxFayU+Dw/s2rycErhrPTxgwLp3FBlnyEf/Zk22emUYiXnxZPoh4oXA8bjrMzSXj
-            tD5SVhvbHAT4WqTgG1cYgZ6XaDJ1eODqPXExJf6EekPlLAC/ohzgtPV44WTFj2YU
-            nVKouOGsc6ZUXkEwOm0HZcfJ5PuEOtCQsvD7BSKuTMbP5CUA9iuuBIhC8PmbCqxa
-            630fP2rDyVyaRucrjUgO7/N0AfaymYysSoRlqGPR/fgt0iJ/jeOu8POQMvK51IQL
-            Gtvp663bJpooCh3ALfvQsGmkpsdQX6QttNYUFyO8yRNDhbYKfT5Ha27a/xUdOEFA
-            Z/imx8fjjH/Anj1n30cy5w/9sZY4lmmxmf/zQMhJMGsTy5efWxbg8DYVOan/bgP3
-            1ZMLYNwLxg0CPRPrJuZbI2Iz2d7GertI22acyAF7OCGljwg4lL/SYPIs02cKYuKO
-            x2M0fpTo7kWlb5CWwDkEfwU14ZmLw8buAvYeG7KblG11kZtgvbWB1LqoXU5TMv4y
-            gZA82VdTEUepOYavRMOaPScnyhCImdC/1xLH6gQCrk5qWZYVAy7GEvLRM19pWtHS
-            XgHxDIdiNeTVD5OuVsxpke02osFrfT8q4ybGJF8KH0ykebuegGtKZuCdncTc5Hnk
-            wnJjZaHHqWGei7pGHWeN6FPQ0jSj8nMosQEpxs1X1UZhUG03t141nCgduTiQZhE=
-            =63dW
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2
@@ -22,7 +22,6 @@ resources:
  - home/zigbee2mqtt
  # Infrastructure
  - infrastructure/authentik
-  - infrastructure/mail/stalwart
  # Personal
  - personal/linkwarden
  - personal/notesnook
@@ -1,7 +1,7 @@
 # Default values for blocky (k8s-home-lab chart)
 image:
    repository: ghcr.io/0xerr0r/blocky
-    tag: v0.24
+    tag: 0.26
    pullPolicy: IfNotPresent
 controller:
    replicas: 2
@@ -90,4 +90,4 @@ sops:
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2
+    version: 3.10.2
@@ -62,10 +62,11 @@ data:
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }

-        # Docker VM services (via Docker Traefik)
+        # Docker VM services (via Traefik)
        @alexscript     host alexscript.vhaudiquet.fr
        @clips          host clips.vhaudiquet.fr
        @jellyfin       host flix.vhaudiquet.fr
+        @mail           host mail.vhaudiquet.fr

        handle @alexscript {
            reverse_proxy 10.1.2.212:80
@@ -76,11 +77,8 @@ data:
        handle @jellyfin {
            reverse_proxy 10.1.2.212:80
        }
-
-        # Stalwart WebUI (now in Kubernetes, via k8s Traefik)
-        @mail           host mail.vhaudiquet.fr
        handle @mail {
-            reverse_proxy traefik.traefik.svc.cluster.local.:80
+            reverse_proxy 10.1.2.212:80
        }
    }

@@ -10,7 +10,7 @@ image:
    repository: caddy
    pullPolicy: IfNotPresent
    tagSuffix: ""
-    tag: 2.11.4
+    tag: 2.11.2
 service:
    type: LoadBalancer
    externalTrafficPolicy: Local
@@ -135,4 +135,4 @@ sops:
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2
+    version: 3.10.2
@@ -7,4 +7,3 @@ spec:
  - cidr: "10.1.2.171/32"
  - cidr: "10.1.2.148/32"
  - cidr: "10.1.2.152/32"
-  - cidr: "10.1.2.143/32"