build(deps): bump mongo in /docker/production/buildpath

Bumps mongo from 8.2.3 to 8.2.7. --- updated-dependencies: - dependency-name: mongo dependency-version: 8.2.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2026-05-08 17:47:24 +00:00 · 2026-04-22 00:46:19 +00:00
34 changed files with 106 additions and 578 deletions
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -51,8 +51,6 @@ updates:
      - "/kubernetes/personal/notesnook"
      - "/kubernetes/personal/photoprism"
      - "/kubernetes/production/umami"
-      - "/kubernetes/system/blocky"
-      - "/kubernetes/system/coredns"
      - "/kubernetes/system/csi-driver-nfs"
      - "/kubernetes/system/external-dns"
      - "/kubernetes/system/traefik"
--- a/README.md
+++ b/README.md
@@ -80,13 +80,3 @@ This setup allows running multiple applications, either self-hosted applications
 | <img width=32 src="https://avatars.githubusercontent.com/u/26692192"> | Navidrome | Personal music streaming service |
 | <img width=32 src="https://avatars.githubusercontent.com/u/102734415"> | TubeArchivist | YouTube archiver |
 | <img width=24 src="https://radicale.org/assets/logo.svg"> | Radicale | Calendar and contacts server |
-
-
-## Docs (internal, using this repository)
-
-This repository uses pre-commit hooks to automate tasks like file encryption and configuration generation.
-
-After cloning, install the pre-commit hooks:
-```bash
-pre-commit install
-```
--- a/docker/home/esphome/docker-compose.yml
+++ b/docker/home/esphome/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
  esphome:
-    image: ghcr.io/esphome/esphome:2026.4.4
+    image: ghcr.io/esphome/esphome:2026.3.3
    ports:
      - "6052"
    networks:
--- a/docker/home/n8n/docker-compose.yml
+++ b/docker/home/n8n/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
  n8n:
-    image: docker.n8n.io/n8nio/n8n:2.19.2
+    image: docker.n8n.io/n8nio/n8n:2.16.0
    environment:
      - TZ=Europe/Paris
      - N8N_SECURE_COOKIE=false
--- a/docker/infrastructure/mail/stalwart/docker-compose.yml
+++ b/docker/infrastructure/mail/stalwart/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
  stalwart:
-    image: stalwartlabs/stalwart:v0.16.4
+    image: stalwartlabs/stalwart:v0.15.5
    container_name: stalwart
    networks:
      - default
--- a/docker/infrastructure/network/traefik/docker-compose.yml
+++ b/docker/infrastructure/network/traefik/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
  traefik:
-    image: traefik:v3.7
+    image: traefik:3.6
    command: 
      - "--configFile=/etc/traefik/traefik.yml"
    ports:
--- a/docker/personal/gramps/docker-compose.yml
+++ b/docker/personal/gramps/docker-compose.yml
@@ -1,7 +1,7 @@
 services:
  grampsweb:
    container_name: grampsweb
-    image: ghcr.io/gramps-project/grampsweb:26.5.0
+    image: ghcr.io/gramps-project/grampsweb:26.4.1
    restart: always
    networks:
      - default
@@ -31,7 +31,7 @@ services:

  grampsweb_celery:
    container_name: grampsweb_celery
-    image: ghcr.io/gramps-project/grampsweb:26.5.0
+    image: ghcr.io/gramps-project/grampsweb:26.4.1
    restart: always
    environment:
      - GRAMPSWEB_TREE="Gramps Web"  # will create a new tree if not exists
@@ -52,7 +52,7 @@ services:
    command: celery -A gramps_webapi.celery worker --loglevel=INFO --concurrency=2

  grampsweb_redis:
-    image: docker.io/library/redis:8.6.3-alpine
+    image: docker.io/library/redis:8.6.2-alpine
    container_name: grampsweb_redis
    restart: always

--- a/docker/personal/media/films-series/jackett/docker-compose.yml
+++ b/docker/personal/media/films-series/jackett/docker-compose.yml
@@ -1,7 +1,7 @@
 services:
  jackett:
    container_name: jackett
-    image: ghcr.io/hotio/jackett:release-v0.24.1815
+    image: ghcr.io/hotio/jackett:release-v0.24.1591
    ports:
      - "9117"
    networks:
--- a/docker/personal/media/films-series/jellyfin/docker-compose.yml
+++ b/docker/personal/media/films-series/jellyfin/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
  jellyfin:
-    image: jellyfin/jellyfin:2026050514
+    image: jellyfin/jellyfin:2026041305
    container_name: jellyfin
    networks:
      - default
--- a/docker/personal/paperless/docker-compose.yml
+++ b/docker/personal/paperless/docker-compose.yml
@@ -16,7 +16,7 @@ services:
      POSTGRES_DB: paperless

  paperless-webserver:
-    image: ghcr.io/paperless-ngx/paperless-ngx:2.20.15
+    image: ghcr.io/paperless-ngx/paperless-ngx:2.20.14
    restart: unless-stopped
    networks:
      - default
--- a/docker/personal/radicale/docker-compose.yml
+++ b/docker/personal/radicale/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
  radicale:
-    image: tomsquest/docker-radicale:3.7.1.0
+    image: tomsquest/docker-radicale:3.6.1.0
    container_name: radicale
    ports:
      - 5232
--- a/docker/personal/tandoor/docker-compose.yml
+++ b/docker/personal/tandoor/docker-compose.yml
@@ -9,7 +9,7 @@ services:

  web_recipes:
    restart: always
-    image: vabene1111/recipes:2.6.9
+    image: vabene1111/recipes:2.6.7
    networks:
      - default
      - proxy
--- a/docker/production/buildpath/.env
+++ b/docker/production/buildpath/.env
@@ -1,18 +1,17 @@
-ME_CONFIG_MONGODB_ADMINUSERNAME=ENC[AES256_GCM,data:AHXIMA==,iv:trofFagJGNq5OyWDaN57vPpKwwG3SouiV5xLl5sJIBA=,tag:c1NUlmBouEb0Milri85QNw==,type:str]
-ME_CONFIG_MONGODB_ADMINPASSWORD=ENC[AES256_GCM,data:8X6+SphUNus=,iv:zwofVw03pToXHR6weckniT/fymFYeHZw6lVmrGUsnLc=,tag:lEWtnnqpwamNsCnkStsRfQ==,type:str]
-ME_CONFIG_MONGODB_URL=ENC[AES256_GCM,data:3xLFWhRYU/EfhRw+rOs9pOb+nzsbV9IvQydB4VGZGw/WLkQd,iv:T9T6ewB+05qzFDL7z2WESs6fIc9lTFdjVxy/71YzhXo=,tag:S3YsOokO4jzhJVWep/QTsQ==,type:str]
-ME_CONFIG_BASICAUTH=ENC[AES256_GCM,data:FnUichsnpQ==,iv:Ayw1Vqg5rj6P79vtERX2hRCttnol/4aNUG5Y0OhFVTo=,tag:JkTxro0kyYJLr9gdkY8A1Q==,type:str]
-MONGO_USER=ENC[AES256_GCM,data:2KFDcg==,iv:wdDxrQd07+hC5GEq1DS0DLVASiL9L4ds1V3TG1NA9EQ=,tag:gieiOLmOfLtUQjfjwZg6qQ==,type:str]
-MONGO_PASS=ENC[AES256_GCM,data:W80YLzp8G50=,iv:eFts3fhrB9PGEfC69d8btt4ko3gcOGrFZUy95hx2rCE=,tag:+1JFEiclNnjei8+2I42j6w==,type:str]
-MONGO_HOST=ENC[AES256_GCM,data:0RknYUM=,iv:8QyL4KHrSr9pv1kX+FD09N2ltVSZkEKqtFCS30ik1v0=,tag:bTXBMHqp5JU9VTD3soXEyQ==,type:str]
-MONGO_INITDB_ROOT_USERNAME=ENC[AES256_GCM,data:G6wekw==,iv:AH5qqxXOeEBVI2mXXPPrC1X8X/Vq5MHZBWdfNRNeK1c=,tag:nMkWql/aVHi2FGnJ5NGFBQ==,type:str]
-MONGO_INITDB_ROOT_PASSWORD=ENC[AES256_GCM,data:jzVSUjGSjOY=,iv:S/Ar0oYN2vSE7pK+/tfp9RyCThtDbk0gOUYDyzNYjVE=,tag:whWyBFHuXBcmF+WixjafOw==,type:str]
-RIOT_API_KEY=ENC[AES256_GCM,data:EzqWk1Y73htAXaUJhzByV6Aru/hxUNjHGK90ac1NGaz92Cwk9YEdmrb9,iv:KorIppEflVX2aDC8K3ndRzK1q6scNjdQfl38p/8fLGM=,tag:Ei2zLoiGOlOX8ocrO2wNMw==,type:str]
-CDRAGON_CACHE_DIR=ENC[AES256_GCM,data:uMogP1/K/pc=,iv:/0A8fs9HEuksSiKV1SZDoslHHGlJe+vFw0BQ5zQ9BBA=,tag:grwWPwMQarpmSAUIgKDZ5Q==,type:str]
-sops_lastmodified=2026-04-30T18:20:37Z
-sops_mac=ENC[AES256_GCM,data:7teYIGLLHBH8TJ/gr3lcbtfo4CVl0Gj2RWPSLgx4AyTvM+pZaSvUDaVUhWuprSCVqZcDWI2tNHUOHE4aYlJzyt9JfQrooKLPkKUq3WX3bucg3Rv5GpiP1tNHiPDE7UZCBp5bkHhYvwn+dPjhObEUdMUuwMBDA9JSpPlr3YQCg/E=,iv:6knBO6QNe33E2bJw5WZMzcDzeTW9mwgjQtftv0FZq8s=,tag:xuIKZl7szrUyX8/D9xxAmA==,type:str]
-sops_pgp__list_0__map_created_at=2026-04-30T18:20:33Z
-sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA7uy4qQr71wiARAAufkTVdCq2ARwMFuec9+0N1BzTo7WgGQhzKIJehe+uQ5I\nuPS5bafo5vrvxlCuxVmhup45CS3gm3X46hgHh/d3htaYzDnbyh/awbVGIhU9sa9T\n74i4jZAabzWjWAU8lAvxS6dJ6hf5U3MHOc1zYoCUfCJjgw+QRzR5PxZKFhpVklQU\nQJycdfRAl5oAqF7N6B7oCNTs7w1hbx2CJXBVGM8YoJySkThpXEY3dECxZ5nTSPmp\nXo3hmidO09uYsjWzcqynJHnh9RkMd1VAe6ULzhVIOv5KLXQLQV/paNAPdsxA5UmY\nE1imIFrqS25BVU9xbsGaPj6AHX6+Ux8bpO8TOVbpULe56Aq2c5GOjIZXb3p20K7N\nEk5rJ/K+8FxvytK3jDkhJI49wiDs9UDim02DSZmsWirIy/c02Ojy2d/Cxors1Lw/\nBCc4S6/ESH9u/LGlWs8WDqcDQqhHgeCvGOLAvOXs9eOCXNW2ROtNdfW808APbu1A\nzgYJwPtdfBhUv4KhZcEVMldWgX1OiYhcWMWYgJUXcfOwaRbzntZ/MczPNJ/a+57T\nPvH9GuTiwCXn0fOgcETTp9RPvXflL+4LPgh9drCOo4zwMvlqZs2+0Os2m8GDdDcL\nD45VMTsnNUXWuO7YUdtYX47bON2W6Z7NwzvkSr5odogzq1xw38SgRN7g3Jbl6+fS\nXAH/Rw8jWjpYztZ5HgDXisTxLEXqn5UNYKZBjzsLV5tE9GQp8ppck21igBiDCqoT\nsziZwFyRy/nKq076lZlRgSFr0pm4168u7Vn5x1TLQBHl+i0eKficgUQpwCFx\n=XUsx\n-----END PGP MESSAGE-----
+ME_CONFIG_MONGODB_ADMINUSERNAME=ENC[AES256_GCM,data:FdAhZA==,iv:YXd83wy5lKSybwYdmhXA2DwbVnffX/6R7gn3doDnI1E=,tag:BLYvP9IFNky37COZOgyJvw==,type:str]
+ME_CONFIG_MONGODB_ADMINPASSWORD=ENC[AES256_GCM,data:uvZn2q5dpbc=,iv:4ExRNf2gYK1W/VMKrcXNO5kPKjJmxml1uj44j643mvw=,tag:Xf2wKugbuOU3GlPYlLttIg==,type:str]
+ME_CONFIG_MONGODB_URL=ENC[AES256_GCM,data:porEOpLQZF2J5pvRaktvnoh76MhfjBZ3PN8dNwhNAfKs8ipO,iv:7kl+7+C1MaOGM0Gu0jzJEp1Wvl/xz0i5oW5U8EACMKs=,tag:3+xIM62x+2HMA1AggM4mww==,type:str]
+ME_CONFIG_BASICAUTH=ENC[AES256_GCM,data:lxxYUfK5cA==,iv:hbw6UUCxTZ9h+XJd0Wesz5T3L5MkBc+JA0SNUogtsOE=,tag:gCyyA6hOIcIvs+HyeqKs/A==,type:str]
+MONGO_USER=ENC[AES256_GCM,data:osGR9w==,iv:648Yv0sPTvq95q0jcRWSD14HZr6tN2I4ffw/STe38xY=,tag:rVK7sBlAuhsisPPyfnIPMg==,type:str]
+MONGO_PASS=ENC[AES256_GCM,data:2SloANMJ1mQ=,iv:PK2LyBfivEH1EjtRk76BPlnLXfAykC/F40skCeoK7NQ=,tag:JEZXKe4gNj36yLX5wlW5tQ==,type:str]
+MONGO_HOST=ENC[AES256_GCM,data:fwvt86U=,iv:YJam2joeQkaVCFUPpc7sPw6ucHpTauiJzC754VsgLPY=,tag:nUQVmxsYbmhlWwz01kHpsw==,type:str]
+MONGO_INITDB_ROOT_USERNAME=ENC[AES256_GCM,data:dSNu/Q==,iv:jJYxTZw06/npxgw5zaS5SSC4LyGzr/TLdu5JdDUtqFQ=,tag:d+q5DLS6AHakPnk9089XpQ==,type:str]
+MONGO_INITDB_ROOT_PASSWORD=ENC[AES256_GCM,data:uD3YRK4xCx8=,iv:jJVjuUBfDuiWa23UGa/n2z0uAkbr4N6Zo9Ee45R1tTs=,tag:RBn0jse9u795RHNc09cBqA==,type:str]
+RIOT_API_KEY=ENC[AES256_GCM,data:E+w0JQlYW7Bjn2wwnkb0hlYmq3ZteS2LB4NWo2l/o+30+uOTAYzpeDgy,iv:xPZmat+pexxgYxqlkBLlD6sorxRpPlBcwMbo8QDFwjg=,tag:5Loj4AGmr13HGKyVbDozqg==,type:str]
+sops_lastmodified=2025-12-31T13:08:07Z
+sops_mac=ENC[AES256_GCM,data:h+aeLcXC3s8gcIlwrU7fHwGIkp1caqMqJcQLdQmFnrtlP9gmx1iOZlZo8yRC8m+imIezhLfjI0yfHdPjyfxw9KTeNoCjNRKyDGfDhbHr0vfPQsrifjeaZj477634WA8MVcL8HrfVwZIHjh+I3fcgVI0kFbcI8/3lkEws/T4oD70=,iv:lc8ltcjngeHueLgXee539iIpIMjvcJpUAec1TGmJuY0=,tag:FkwHdQ0C4QxObEQFL6aefg==,type:str]
+sops_pgp__list_0__map_created_at=2025-12-31T13:08:07Z
+sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA7uy4qQr71wiAQ/+LVciLRpDVh/AlYawgSfwVs8ltal1+3MCHYhdwjFAggJ8\ng6twtj4szAVR7UbT0Qh2hP+my7KLLN1K+Rv/jnsXPhOFo0o8AB0Un+hCFB1i+KLd\ni6cWbv+jCqxRALf98TYe0xDMIfoPKXaIYjV2qlYmGWe3/Sd2+7KbwAKZCehZD1jV\nh21YVeVn7dlv3zPAp5mpH+6yPMp3ZSTAYa8MkUnnS3cUWlWSMHsGwlA9CUvJtKaz\ndkW6n90zEGJrfb6ATH2dPJawWNOp0q/Gcx2uci4Ro09U1jOK7ugSDWxjGOuV9TAL\nYsRYz7LH5yOLpz9HlrZH882SJWZS9xoEV8jOZN1I3NmtJY1KsgAW3BFEsbCA58Q5\nTZFKhH7XK9FW4NbRzHYxHCCZSfGtBCQyUpusGALXnQmkKHJ4MlnrxH9yBX7Go8ph\nCqQ7gvBmNjUZrgp+VWb8+ziDCfYbZDADV4cva4STcjnmFxRiFO1xvYEJpEo2H1gK\nQcMsOruazL3UGkZxWh2Od7bi1K+2Io/TNSKMTboTqgJAOcMO4Ssxn59yYhfDdS2i\n8/mlv4ADPOL4be1400/Tp33QpPnRojyJAM9b8IdJ6ahevVGjGuKPuvrzDs8lYwht\n6eKrbV3mHBv5ZUvSmeTOIwxE8moePDEkUrr3HCfxaaJcMrcjgSkGhCCN4KHbj8TS\nXgFGOX7/BZNOR1SyfBY1gc30Vdy3d7513Gpfcuwsd7Rc+0Ue+p4ysA3dBp+KWhVO\nPkfwdiVFOOvEPoUoanyUqMlvj3ENabNNmHc8jZ23FRxtlfbcyecTT+uckRXgvpU=\n=5/Ac\n-----END PGP MESSAGE-----
 sops_pgp__list_0__map_fp=DC6910268E657FF70BA7EC289974494E76938DDC
 sops_unencrypted_suffix=_unencrypted
 sops_version=3.10.2
--- a/docker/production/buildpath/docker-compose.yml
+++ b/docker/production/buildpath/docker-compose.yml
@@ -1,7 +1,7 @@
 services:
  mongo:
    hostname: mongo
-    image: mongo:8.2.3
+    image: mongo:8.2.7
    restart: always
    user: root:root
    volumes:
@@ -9,11 +9,21 @@ services:
      - bpmongo_config:/data/configdb:Z
    env_file: .env

+  patch_detector:
+    image: git.vhaudiquet.fr/vhaudiquet/lolstats-patch_detector:a5728a147fd8503ab1036cf0d9e7a5a18b73c765
+    build: ./patch_detector
+    restart: "no"
+    deploy:
+      restart_policy:
+        condition: any
+        delay: '0'
+        window: 10s
+    env_file: .env
+
+
  match_collector:
-    image: git.vhaudiquet.fr/vhaudiquet/lolstats-match_collector:b2178fec85027348157a5442a81d00479154e581
+    image: git.vhaudiquet.fr/vhaudiquet/lolstats-match_collector:a5728a147fd8503ab1036cf0d9e7a5a18b73c765
    build: ./match_collector
-    volumes:
-      - bpcdragon_cache:/cdragon
    restart: "no"
    deploy:
      restart_policy:
@@ -23,11 +33,9 @@ services:
    env_file: .env

  frontend:
-    image: git.vhaudiquet.fr/vhaudiquet/lolstats-frontend:b2178fec85027348157a5442a81d00479154e581
+    image: git.vhaudiquet.fr/vhaudiquet/lolstats-frontend:a5728a147fd8503ab1036cf0d9e7a5a18b73c765
    build: ./frontend
    restart: always
-    volumes:
-      - bpcdragon_cache:/cdragon
    networks:
      - default
      - proxy
@@ -42,7 +50,6 @@ services:
 volumes:
  bpmongo_data:
  bpmongo_config:
-  bpcdragon_cache:

 networks:
  proxy:
--- a/infra/r740/proxmox/docker.tf
+++ b/infra/r740/proxmox/docker.tf
@@ -61,7 +61,7 @@ resource "proxmox_virtual_environment_vm" "docker-machine" {
  }

  memory {
-    floating = 22222
+    floating = 16192
    dedicated = 38768
  }

--- a/infra/r740/proxmox/kube.tf
+++ b/infra/r740/proxmox/kube.tf
@@ -83,12 +83,6 @@ resource "proxmox_virtual_environment_vm" "kube" {
    vlan_id = 2
  }

-  network_device {
-    bridge = "vmbr0"
-    model = "virtio"
-    vlan_id = 2
-  }
-
  operating_system {
    type = "l26"
  }
--- a/kubernetes/home/zigbee2mqtt/values.yaml
+++ b/kubernetes/home/zigbee2mqtt/values.yaml
@@ -6,8 +6,6 @@ ingress:
          paths:
            - path: /
              pathType: Prefix
-service:
-    type: ClusterIP
 statefulset:
    securityContext:
        privileged: false
@@ -35,36 +33,35 @@ zigbee2mqtt:
    external_converters: []
    mqtt:
        server: mqtt://mqtt.lan:1883
-        user: ENC[AES256_GCM,data:8chGUA==,iv:SOAuBYShpWbza3idtyqFoVIFstZFM34OPDN4uhAer0Y=,tag:WPoH80VcUGLy5Uq/z8EtaQ==,type:str]
-        password: ENC[AES256_GCM,data:XVcTzQ3pDvPKbw==,iv:TK5qHq2yMTWgzcOPvj0GO7tOOD4PHvKMWfd3p4T8LuM=,tag:GJpKQWpVhwrewX4+9NITfQ==,type:str]
-        base_topic: z2m
+        user: ENC[AES256_GCM,data:y38nWA==,iv:j0eEQfRb8EFjFgQtAUDnC+SFG5GntgcY9DoI+pQATFE=,tag:i+QSvlWadDq4pLJGLo9mGg==,type:str]
+        password: ENC[AES256_GCM,data:kOJPLKGkuPMlcA==,iv:ecOCgqScF7StVOgb1+khzZDgpAM/WRbSn0iJDMcSnoc=,tag:T39fKp/eDMeMb5XEm+/j3w==,type:str]
    serial:
        port: tcp://10.1.1.159:6638
        baudrate: 115200
        rtscts: false
        adapter: ember
 sops:
-    lastmodified: "2026-05-02T10:26:20Z"
-    mac: ENC[AES256_GCM,data:32zZ0bYrgn+zTz8DEOU1N8MgDrihzWyMsV9q2m5RhFHRvXFuq3Z2GTORlUTeuK5qZIUrZt22VskigGAQiKC2CdzsJTcO3cGPshu5E6gWGBRNob02bXXsMu3TfCKxic/Ek7jE2p9R++a5AKczFZY8SxL7Sv1BZDxozkginDdYR4Q=,iv:VcDKwoPgYxZc8KXYv9oEH2GBqDRAJJxphj6MFLLI8ok=,tag:vPWqcEHoBVvfCoKoN5UiLA==,type:str]
+    lastmodified: "2026-04-04T23:00:45Z"
+    mac: ENC[AES256_GCM,data:a095DCVFoM6HPGbZSZjysbVhhUBcQtNh1sZYPLHKqhjI65TEAZbPqXUJeB1raqqBTmXr/0hZysx7/O7tqN/h+Gv0/pJTP3yAbXEArp9Soc9tmRBwJeaYMmm9+9s9QSvsCsiFnmVmp0ihYRbag35aXVcl2INDV7ilqVZnXOsThi0=,iv:y3ASd047iwdbJ0F9bLkSpV8uDRvzUFZIa7FV6AbLDH4=,tag:1wBNjiPukFK4xon0FHYkhw==,type:str]
    pgp:
-        - created_at: "2026-05-02T10:26:20Z"
+        - created_at: "2026-04-04T23:00:45Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ//fl1m3T6TnQvQ+yG0plOZaRXIGRI/YHiyP9KsK6I6l4c9
-            Y7lUjVcgADbjZYAMv08LFOEyN0/dtTFx2kV1vC5sF4CjxXKfddazKrQFjZQygc56
-            Yn3wiYX2ZMTsc3AnOoUF/evXyDHYMu0l8FwZEupi0cjmgKjVZZsLYScMjLi6h9oO
-            agDUxqZX8d3ikj3LPF1dk/XGP75fHBg7Jfim1RMMrOcpAbRi0H3XU82cr2s9fTS8
-            UtylTk1x3F253YTC0JdvU0UskvzCvVl0Sf8TlkVb2tTJgwf/XnXMTmMeCvbhIj5u
-            bgqIs0y6F0xm8NjhPGV2CtsQuQtLMLb5SxVFj7P4ad/Ekf9TizAJlcPt2u1/25zu
-            x9v/kFnI5XMDIr3eWBJlFUwtImQJ+bO3GTauqwpULIHSa+y3Ux2XMNarKfN1jH3Y
-            RG86rLQSioSA+HdZuZdEvo2ACc5DotC835cnMGMeIuO1Ad/RjvUaptN/p5hvTFMf
-            5t6SoE8gLXH7FZF7IomY0Xs/feztPOvPK76zpKV1Tqqgb7i0GaTFcKKBUxMPklZw
-            XwqOQl36HWz1BSvtYtYYX6/HyuknH4T6tk//J6MrNttnTQ/ZqjrBvl4FEVxTgf1h
-            pFc8fTzNak+VB4MSdALg6Eo5xR57eGHhKgdUMgDAv1JMEP9ikk4/p8/1WHKhpTvS
-            XAG3QSahHWoc9L5A73xFmD66TRUhm8CVKRCAQebB7rXjsxaqgEOl70taQpucrckD
-            624SYxJwG9Uuk4odCQJ6g7T2KCKxsS/NKy6jOqgprkerR6pCfuXg8LDxBkHP
-            =cZ3t
+            hQIMA7uy4qQr71wiARAAn1+iFDYCRrqXbgrAJXdw4KfvqEsX8i6ReCeq4+68YhFQ
+            e6rv3yMBoDLNbMRr6AZaTN9XOLqd7jK0H6zobCdkUK89Fxp5fqxvAaaPloebRKu9
+            YnjG28UCbuqcW7P77GaoO+6t53Y3Ya4s/f1OLZ0zAkJDCV3NiADgBB112fG+HtnT
+            WqkH6dENu5X9YP+PbMJ9qHWOqc88gBE4CpwH5R3F2UWRhfKnErdD8MpjNhDsJBuZ
+            +c7K5mTRaYHqe96pEhOg+rPWa+YDpZb/ztpHeEPcWNdepHnSk4N9pw1bDKKORlQU
+            Tuz80ZVz4SOUet+rYUzH0a4f9ktwxCy3m3D1YHW3rbaLUmu4tIPjsbSLU/ZNnkWv
+            RFMZCUXDKqF0NxYyWgF232kXkrYURUHWd9PZLHjyWgp1k+OW0P9TViwYgC4Bq5NO
+            +uQPpWqfYQWqIZwJA3PGmpQ18ngytAkQKaUw8mXH2dUQYXLwa8RT1EYaTEoN8KQd
+            2gtmyxnhmohZgClvXzGq1ByVj4hkFUC6TqI6t8ZI6AQWpHsEKIsP39z9Ci6ipfpb
+            0ySguqykofTTVVqxzkZ2nviyuw7fNQQHtTAw5JyghotsHgBBMeP4TJm+CkrggYAV
+            e9NnrRJpV0R+gPrAyhAOhIzqaPBB/ZbAJrv0yHn1QQsgCzWqCy3ruAFNtP5BK1DS
+            XAG3zRbI+AfVs6pe50306g5tze71efLlH/7Bd17Rqx45rFsiiQyXJHRwQiLtYuQP
+            RJMrImgAdIgKkm8rA5LTDlnFAm2AhJ/LGLUV9Q9eS+JYSJqKMPX+I4iLq9u6
+            =KhGS
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
--- a/kubernetes/personal/photoprism/values.yaml
+++ b/kubernetes/personal/photoprism/values.yaml
@@ -1,6 +1,6 @@
 image:
    repository: photoprism/photoprism
-    tag: "260305"
+    tag: "251130"
    pullPolicy: IfNotPresent
 ingress:
    main:
@@ -36,27 +36,27 @@ mariadb:
        repository: bitnamilegacy/mariadb
        tag: 12.0.2-debian-12-r0
 sops:
-    lastmodified: "2026-05-01T22:39:49Z"
-    mac: ENC[AES256_GCM,data:YGVQb50DrFv/ehU+dxsoP/e8ARKVPfr/6c2x1pQbZ7cNiNu7k1Zgt+bEHkkKm+FT44bltL374Jf2HqT/0gvmgMGp/8ukjZ5hRLwbqS1fOKR8SVQ8fp2EId0P7HcRl7Qqr6lF15hKXQ+SPl6KDPvDWKh0pq192W8dP76D7h5aKDw=,iv:c1xytratCfO8V4nkdvxeKT2kWOYHBkwoTc5Ic+yjpWQ=,tag:kdxAidCO1VLPxiwq3eCRxQ==,type:str]
+    lastmodified: "2025-12-04T23:21:48Z"
+    mac: ENC[AES256_GCM,data:UbrmZVQ9Jcy7/+N9agnQI201d5kp8lIeJ3bBymKpU7ORyYouA+AyllVts3sqWFQhFnbK2Be1IkOY+F9iEvKrjJn6frtd7b1Qz1q8j1COdpQ+h/Ok11yCsaqkVfDr32to7zlf7fHW3YdcEEmYFt/CbbzMM4C4fbxHcgFOlyzrcDk=,iv:iYggVr703vYaZ/bPXZywYOeP6ePTxyGyoLI1jfsbSFE=,tag:Ic8e2mnZD69JAlwiQmeV6A==,type:str]
    pgp:
-        - created_at: "2026-05-01T22:39:48Z"
+        - created_at: "2025-12-04T23:21:48Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ/9F+u/hWM4smi4yqnU7vzRfWwjCuvdtWAR6N4MqiBLFfqr
-            tpzY8UCfaTlfEtwDZWUSN/gzZG56YcMTR6OOrCQ8rkiKYGwuj92Z8LgpcDRBAHeG
-            gYaNG9vRmmzyZpD6K6pSoG8lk7mzB1Tp80me9E7LJTDhAn70cDATLp1wADkD0KF1
-            pq44qPcRaem42kEx6Um1sAy5NiBBxvYqdKPRXLs0q1EyZByxKjlhZi0qasCfe4lJ
-            fsdduUgRi3Td7KvfhQ1e6jjNNMpyZIHbME3Hn18h5PxVd1B3FzzBzSHlaDKBQsYT
-            2cx6VMGVqM4dy+CHkpE+QlAA0EOhS0b/7FwppCgEhlEvbH7uCjq/13vZdKoUIwqt
-            AaHPaf/HX7PipQjoQf7vjfaMjPwCFwqoeK2cVNmgK0j0b2CyjLDDs5xh0SuFt/Ia
-            DviSBGNeIv9Vhm7jhlJH0odFzBmBOkiUyUFV1h/6u2qpjz+H+qAX+5xx/++cGkW6
-            4G69+7NP6JUksSbcvAl6Nk1sRsvTrcRdpmBO42/aUq7nlgOAxk9e0y7INYHe3Ycv
-            N7ZTm7VOuIVopQfl8F2/tOIdJIm6hJfmJ/hdhxbDZKSRiejenU7vgdQgTM+PQ0l7
-            0QVRP1mahh1EqsyqFrrVpv+o7XQsyldb8KCefWMEMGHrot944YTxzfwY3riaPXfS
-            XgESSHvPYIgLIj+6bvvopB5v2q+NwfBciOrZekmWYTkN6cFOizp36JKIOA4Dq6z5
-            0hwGgiPvYsu9WgbWYUY21qO9jvDmjT5Yym5ktbNogckXw3/TusVqPeAkdNIjZNU=
-            =PSUH
+            hQIMA7uy4qQr71wiAQ//XxIcDxmC0y3KzKw6OxM/9Z5HPcdJvfyXaQ7nOIqob4OH
+            1ST3R2R5liDI2XOE0Eb2cLs0LACAih0PycWfju8fLkDeB9ztenxKnCW1DFbUYmpw
+            DXrW/opbGXMLBdPcsoq6GPeWjlNypXepIXGWwgT/+gdxZPKsqxHglauCnVHub/Ki
+            inoFimxvkVaAefFTOazJvFfSfWI04KPSl0PgnwzWna/7rycFDYkidVKjBkmHAGad
+            BFwhXFWi4taKPdNH3/7WBYlOyB+fs7xNPENQP8Fj7/oqF8Vb9pYTpPIGvgXNC/pB
+            0DbtvprxAxKYGODHn5WJIjnUBkYVkq+B8q7ZsjxeFdUfNXU+89f24PSGDe0VKMFf
+            7mJ3cio0uhizslbwtUQvFOC5I7HEjWIFGoulQqDjXXE2ocGlsS8vvW1NYtJGpJx0
+            aYRIRdM5+CM2tSLbZVik3IGqEmnLKNhMtObxFt0UXeoUwzBFNMQLO8zw+Fxy9VEq
+            gzrmNYnnFfx5oiwg7OWmsq7NoXTkhB+VktCb3Bcl3JjJgqalquqmmodThFhU52Ac
+            yRhGhjrBcsXx12BCy6r3Hq6nn9PFjZsBRJvXw2WSsevBghOTWSuXRmaT05aMoiD7
+            y5ia09N4xKvms8/e4qhwpNV/X2Ee4rS3diQFNunxk5aZTPO5kpy704KthDFODnvS
+            XgGcE+XcinmUFJ1RasziSK6RoYMpSK+JaNgpJMyuaz1iQu9Wc9ptnXgEees5qH2g
+            2rA2AzfdcBhZIHWAak2LZuuC9i5O0YGP89idZOjuEaUyGdOHzgB+jQnJ97c4pPE=
+            =wfLM
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
--- a/kubernetes/system/blocky/kustomization.yaml
+++ b/kubernetes/system/blocky/kustomization.yaml
@@ -1,13 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: blocky
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: blocky-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml
--- a/kubernetes/system/blocky/kustomizeconfig.yaml
+++ b/kubernetes/system/blocky/kustomizeconfig.yaml
@@ -1,6 +0,0 @@
-nameReference:
-  - kind: HelmRepository
-    version: v1
-    fieldSpecs:
-      - path: spec/chart/spec/sourceRef/name
-        kind: HelmRelease
--- a/kubernetes/system/blocky/namespace.yaml
+++ b/kubernetes/system/blocky/namespace.yaml
@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: blocky
-  labels:
-    app.kubernetes.io/name: blocky
-    app.kubernetes.io/component: dns
--- a/kubernetes/system/blocky/release.yaml
+++ b/kubernetes/system/blocky/release.yaml
@@ -1,19 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: blocky
-  namespace: blocky
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: blocky
-        namespace: blocky
-      chart: blocky
-      version: "11.2.1"
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: blocky-values
--- a/kubernetes/system/blocky/repository.yaml
+++ b/kubernetes/system/blocky/repository.yaml
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: blocky
-  namespace: blocky
-spec:
-  interval: 1h
-  url: https://k8s-home-lab.github.io/helm-charts/
--- a/kubernetes/system/blocky/values.yaml
+++ b/kubernetes/system/blocky/values.yaml
@@ -1,93 +0,0 @@
-# Default values for blocky (k8s-home-lab chart)
-image:
-    repository: ghcr.io/0xerr0r/blocky
-    tag: v0.24
-    pullPolicy: IfNotPresent
-controller:
-    replicas: 2
-    dnsPolicy: ClusterFirst
-    strategy: RollingUpdate
-    rollingUpdate:
-        maxUnavailable: 0
-        maxSurge: 1
-env:
-    TZ: Europe/Paris
-service:
-    main:
-        enabled: false
-    dns-tcp:
-        enabled: false
-    dns-udp:
-        enabled: true
-        type: LoadBalancer
-        loadBalancerIP: 10.1.2.148
-        ports:
-            dns:
-                port: 53
-                protocol: UDP
-probes:
-    liveness:
-        enabled: true
-        custom: true
-        spec:
-            tcpSocket:
-                port: 53
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-    readiness:
-        enabled: true
-        custom: true
-        spec:
-            tcpSocket:
-                port: 53
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            timeoutSeconds: 3
-            failureThreshold: 3
-    startup:
-        enabled: true
-        custom: true
-        spec:
-            tcpSocket:
-                port: 53
-            initialDelaySeconds: 5
-            periodSeconds: 2
-            timeoutSeconds: 3
-            failureThreshold: 30
-resources:
-    limits:
-        cpu: 200m
-        memory: 256Mi
-    requests:
-        cpu: 50m
-        memory: 64Mi
-# Full list of options https://github.com/0xERR0R/blocky/blob/main/docs/config.yml
-config: "upstreams:\n    groups:\n        default:\n            - 1.1.1.1\n            - 1.0.0.1\n        lan:\n            - 10.101.207.1\n\nconditional:\n    mapping:\n        lan: 10.101.207.1\n        cluster.local: 10.96.0.10\n        in-addr.arpa: 10.96.0.10\n\nblocking:\n    allowlists:\n        ads:\n            - |\n                dealabs.digidip.net\n                s.click.aliexpress.com\n                fonts.googleapis.com\n                fonts.gstatic.com\n                wl.spotify.com\n                www.googleadservices.com\n    \n    denylists:\n        ads:\n            - https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts\n            - https://adaway.org/hosts.txt\n    \n    clientGroupsBlock:\n        default:\n            - ads\n    \n    blockType: zeroIp\n    blockTTL: 1m\n    loading:\n        refreshPeriod: 4h\n        downloads:\n            timeout: 60s\n\ncaching:\n    minTime: 5m\n    maxTime: 30m\n    # Disable negative caching (NXDOMAIN responses) for dynamic DNS\n    cacheTimeNegative: 0\n    prefetching: true\n    prefetchExpires: 2h\n    prefetchThreshold: 5\n\nprometheus:\n    enable: true\n    path: /metrics\n\nports:\n    dns: 53\n    http: 4000\n\nbootstrapDns: tcp+udp:1.1.1.1\n\nlog:\n    level: info\n    format: text\n    timestamp: true\n"
-sops:
-    lastmodified: "2026-05-02T17:51:26Z"
-    mac: ENC[AES256_GCM,data:J7EovwsXi2L9XocZoi5ann71DQ+wWZk2aCUbjvaGpv0yZC5g2HNccPVRvAj3y9SyMttLT8QlESXzHpEV2A6bOfmJf5v0ACYuWn5wKNlkaBdmTs1xwXp/RcpeOb+FCL9D+9hzjBO9XF6iXZLSj4pO/n1C0IhfeqYKdDC4tHkxOHA=,iv:Qm3Uh+UUSDWCxh7gWJ9x597aWXdMHxtpixE2BVlb6c8=,tag:aHbK26P4f9YV2uGLhpT6OA==,type:str]
-    pgp:
-        - created_at: "2026-05-02T17:51:25Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/+Po8UdkiFGt0LmcvCeSE23aoWwY4qi2FsGKdik+7sL3RN
-            gOt/VQ6geefhd4YDhH0jfd7TDXs7UTtYvKQ+IaKcRUyOrZzhrfTpNeT/lXuaTkHf
-            LAUiqyprq1RDzxxIPvgMh4DynfehgN8B81iMJox2/fD0oV7B6dIIABvAl87gzANw
-            7snQLJwdhNXFylKfrdC9A4AfYz7ycXBzEyYlY5BMZENw9yBGgZ1dZITU2KxeYCo/
-            gdVTCevybSBQ/Cq0+hI25ZF+nEIGjrVCN2AxPEUO98ljp4OZEu0p6KsMB4xgCD2j
-            l5LN6YPAu95TRx/bZinoHMMzth6WhFdUG0Anj2cIIYXOcreyzPxYGj+vwRlZFrkZ
-            gTU2vfpt/1Wx8ORRqocCkxZ3dMtm4KsGqe3xpd1y84ezL/bMLxSApn5e7Zzn1cEg
-            DoLwJGnZzSY4nRzfoGXOv6mjyTUVkqNexRlL2wIsgDP9VP/ohS9K2fFZzzJ/fXa1
-            G9DUg64SwfYIFzAgsyWwdE3kCJ/GSIAgrgNwBfZlLGdfB/PB2BkHNpzX4LROUEcD
-            HqqHtVlUIikiFdDQWwB5tS+APBCO6VuzKl1z3ROgV6xhvr4ZYkd9CHYu1S1r1XAs
-            JRCyow0zTLRYGQnDD8+RPQ4MsbzJsugA8Ac4bE4sVJpP8hloZBqHb38AkoUruDTS
-            XgE+Nxcy0/aznBgEscE/VuY/GTH1vwYl5/dAcV8GDYcNmd1tE9E1QwWsSurHt39u
-            +QdGZYoUbHPtsk/zODgEVqn0iTsqO7Y4Qmu93bYlYFQwCygAPKKpCaqmmu2U+rI=
-            =hq5F
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2
--- a/kubernetes/system/cilium/pool.yaml
+++ b/kubernetes/system/cilium/pool.yaml
@@ -5,4 +5,3 @@ metadata:
 spec:
  blocks:
  - cidr: "10.1.2.171/32"
-  - cidr: "10.1.2.148/32"
--- a/kubernetes/system/coredns/etcd.yaml
+++ b/kubernetes/system/coredns/etcd.yaml
@@ -1,79 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: etcd
-  namespace: coredns
-  labels:
-    app.kubernetes.io/name: etcd
-    app.kubernetes.io/component: dns-backend
-spec:
-  serviceName: etcd
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: etcd
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: etcd
-    spec:
-      containers:
-        - name: etcd
-          image: quay.io/coreos/etcd:v3.5.17
-          ports:
-            - containerPort: 2379
-              name: client
-            - containerPort: 2380
-              name: peer
-          env:
-            - name: ETCD_DATA_DIR
-              value: /etcd-data
-            - name: ETCD_LISTEN_CLIENT_URLS
-              value: http://0.0.0.0:2379
-            - name: ETCD_ADVERTISE_CLIENT_URLS
-              value: http://etcd.coredns.svc.cluster.local:2379
-            - name: ETCD_LISTEN_PEER_URLS
-              value: http://0.0.0.0:2380
-            - name: ETCD_INITIAL_ADVERTISE_PEER_URLS
-              value: http://etcd-0.etcd.coredns.svc.cluster.local:2380
-            - name: ETCD_INITIAL_CLUSTER
-              value: etcd-0=http://etcd-0.etcd.coredns.svc.cluster.local:2380
-            - name: ETCD_NAME
-              value: etcd-0
-          resources:
-            limits:
-              cpu: 100m
-              memory: 128Mi
-            requests:
-              cpu: 50m
-              memory: 64Mi
-          volumeMounts:
-            - name: etcd-data
-              mountPath: /etcd-data
-  volumeClaimTemplates:
-    - metadata:
-        name: etcd-data
-      spec:
-        accessModes: ["ReadWriteOnce"]
-        resources:
-          requests:
-            storage: 1Gi
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: etcd
-  namespace: coredns
-  labels:
-    app.kubernetes.io/name: etcd
-spec:
-  type: ClusterIP
-  ports:
-    - port: 2379
-      targetPort: 2379
-      name: client
-    - port: 2380
-      targetPort: 2380
-      name: peer
-  selector:
-    app.kubernetes.io/name: etcd
--- a/kubernetes/system/coredns/kustomization.yaml
+++ b/kubernetes/system/coredns/kustomization.yaml
@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: coredns
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - release.yaml
-  - zone-configmap.yaml
-  - etcd.yaml
-secretGenerator:
-  - name: coredns-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml
--- a/kubernetes/system/coredns/kustomizeconfig.yaml
+++ b/kubernetes/system/coredns/kustomizeconfig.yaml
@@ -1,6 +0,0 @@
-nameReference:
-  - kind: HelmRepository
-    version: v1
-    fieldSpecs:
-      - path: spec/chart/spec/sourceRef/name
-        kind: HelmRelease
--- a/kubernetes/system/coredns/namespace.yaml
+++ b/kubernetes/system/coredns/namespace.yaml
@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: coredns
-  labels:
-    app.kubernetes.io/name: coredns
-    app.kubernetes.io/component: dns
--- a/kubernetes/system/coredns/release.yaml
+++ b/kubernetes/system/coredns/release.yaml
@@ -1,19 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: coredns
-  namespace: coredns
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: coredns
-        namespace: coredns
-      chart: coredns
-      version: "1.45.2"
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: coredns-values
--- a/kubernetes/system/coredns/repository.yaml
+++ b/kubernetes/system/coredns/repository.yaml
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: coredns
-  namespace: coredns
-spec:
-  interval: 1h
-  url: https://coredns.github.io/helm
--- a/kubernetes/system/coredns/values.yaml
+++ b/kubernetes/system/coredns/values.yaml
@@ -1,108 +0,0 @@
-replicaCount: 2
-image:
-    repository: coredns/coredns
-    tag: 1.14.3
-    pullPolicy: IfNotPresent
-deployment:
-    dnsPolicy: ClusterFirst
-    strategy:
-        type: RollingUpdate
-        rollingUpdate:
-            maxUnavailable: 0
-            maxSurge: 1
-livenessProbe:
-    httpGet:
-        path: /health
-        port: 8080
-    initialDelaySeconds: 10
-    periodSeconds: 10
-    timeoutSeconds: 5
-    failureThreshold: 3
-readinessProbe:
-    httpGet:
-        path: /ready
-        port: 8181
-    initialDelaySeconds: 5
-    periodSeconds: 5
-    timeoutSeconds: 3
-    failureThreshold: 3
-resources:
-    limits:
-        cpu: 100m
-        memory: 128Mi
-    requests:
-        cpu: 50m
-        memory: 64Mi
-serviceType: ClusterIP
-service:
-    annotations:
-        io.cilium/lb-ipam-ips: ""
-servers:
-    - zones:
-        - zone: cluster.local
-      port: 53
-      plugins:
-        - name: kubernetes
-          parameters: cluster.local in-addr.arpa ip6.arpa
-          configBlock: |-
-            pods insecure
-            fallthrough in-addr.arpa ip6.arpa
-            ttl 30
-    - zones:
-        - zone: .
-      port: 53
-      plugins:
-        - name: errors
-        - name: health
-          configBlock: lameduck 5s
-        - name: ready
-        - name: debug
-        - name: file
-          parameters: /etc/coredns/zones/lan.zone lan
-          configBlock: |-
-            reload 10s
-            fallthrough
-        - name: etcd
-          parameters: lan
-          configBlock: |-
-            path /skydns
-            endpoint http://etcd.coredns.svc.cluster.local:2379
-            fallthrough
-        - name: cache
-          parameters: 30
-        - name: loadbalance
-        - name: log
-extraVolumeMounts:
-    - name: zone-config
-      mountPath: /etc/coredns/zones
-      readOnly: true
-extraVolumes:
-    - name: zone-config
-      configMap:
-        name: coredns-lan-zone
-sops:
-    lastmodified: "2026-05-02T16:59:44Z"
-    mac: ENC[AES256_GCM,data:H4uRid1Fqx4JzsF43TSGa7QcGjpXLAHiM0N3Kf4z7ab4eMlTy1+RXMV7xVT9BinjZzH6P+ENxo0yVOsdt0Yu467KJhGznNWlb2MC2TElPxZ9/yItJ+hdVGHGWbVGFWUL5NOUQ9fY2NPGw0CGr8qyftLr5Qkx0LO/VUgKWkq6RWM=,iv:9+V/sCBhfWAsIvr4DsWQgkeqQZQyT4Ti3Y+qCEZqU5c=,tag:JCRONb54BpXQzYhhPs7VGA==,type:str]
-    pgp:
-        - created_at: "2026-05-02T16:59:43Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/9HzeTVqelbvPtluYa5xGvoYNeEEXg43CwrwZ1/z5yFWvx
-            DoOCeyro5wFsNC6td7n2HVhtK0ULkfrMHH8OC+7L3bXbnlEnQzITmDggAUvfegCv
-            b/7ohPkOdLvi6qXbr8bgqCZYFnPq+gUs3UOPh5Tl6wgzRSFXw2Hsb4YmQkvZJUNb
-            PhPpLIUe/ECE4hmEjO5v9o3X0o7qZ3bahf9mZZlnJnvXT7R/DM8eeWTis/q0WSHE
-            XnclhOX4GlMwXxa65sRrShuPcsV3qqX3VWOSWJFBhGx/FDtZTkhlHGQ9YhF2TzbB
-            xxCrn87mH2W13NH6jQOQYPh1JTTJbgZZMZXgyPNmPDSYZE1kxTdrz4l4mcmCDND0
-            hY3T8iR8ap2b3HhSNCqC1C0QN/bK217hTs8cJHWRRfa6jfh12imwk2XhJkB3zZxV
-            O1oSb6eiP0ba0CgXu31shmfXuTAeVbTm6E50heYorjQKR5djjnOVwQUdmis1Awae
-            AQTiWtBBbOgfX5WA5b6wInFr0WEsshG+YuqfB7FhJpo2SHyeFhgk47ssHWSeBpPv
-            wa4OAGaMkdGoePQhApZFrBCZHslEhPE+XQlDdyOtXCmxBOcLwe59ikWLV75j0DzS
-            NRUNOBYQ8Q1Y6Su/sJWW7TykQkmDirU+oIYxAngZyIyJSWvARPd6fJJvkqqg013S
-            XgH1+LQJWNEJzIaLKCWbkZXnMstsOYrs4ynV4f/QZKU+Md5CgVbjy9KIC/trfNhj
-            1t9kkyVVOEO7UmRhMyl8pK2gQDiOBrkhUJ5tSNFEfxM1llZ4GZRV+SUuMC3UzVA=
-            =l7Wo
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2
--- a/kubernetes/system/coredns/zone-configmap.yaml
+++ b/kubernetes/system/coredns/zone-configmap.yaml
@@ -1,67 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: coredns-lan-zone
-  namespace: coredns
-  labels:
-    app.kubernetes.io/name: coredns
-    app.kubernetes.io/component: dns-zone
-data:
-  lan.zone: |
-    $ORIGIN lan.
-    @       IN  SOA ns.lan. admin.lan. (
-                    2024010101 ; serial
-                    3600       ; refresh
-                    1800       ; retry
-                    604800     ; expire
-                    86400 )    ; minimum
-            IN  NS  ns.lan.
-    
-    ; Nameserver record
-    ns            IN  A   10.1.2.172
-    
-    ; Static hosts
-    openwrt         IN  A   10.1.1.1
-
-    ; R740 and virtual machines
-    r740            IN  A   10.1.1.223
-    bw-r740         IN  A   10.1.2.233
-    kube-r740       IN  A   10.1.2.171
-    docker-r740     IN  A   10.1.2.212
-    truenas         IN  A   10.1.2.139
-
-    ; PVE
-    pve             IN  A   10.1.2.10
-    docker-homeprod IN  A   10.1.2.12
-
-    ; Ligory
-    pve-ligory      IN  A   10.2.2.10
-    docker-ligory   IN  A   10.2.2.232
-
-    ; IoT
-    c210            IN  A   10.1.1.106
-    elegoo-neptune-4pro IN  A  10.1.1.155
-
-    ; docker-r740 services
-    esphome         IN  A   10.1.2.212
-    excalidraw      IN  A   10.1.2.212
-    gramps          IN  A   10.1.2.212
-    jackett         IN  A   10.1.2.212
-    jellyseerr      IN  A   10.1.2.212
-    mqtt            IN  A   10.1.2.212
-    n8n             IN  A   10.1.2.212
-    obsidian-livesync IN  A   10.1.2.212
-    paperless       IN  A   10.1.2.212
-    proxy           IN  A   10.1.2.212
-    radarr          IN  A   10.1.2.212
-    radicale        IN  A   10.1.2.212
-    sonarr          IN  A   10.1.2.212
-    stirling-pdf    IN  A   10.1.2.212
-    syncthing-valentin IN  A   10.1.2.212
-    tandoor         IN  A   10.1.2.212
-    traefik         IN  A   10.1.2.212
-    transmission    IN  A   10.1.2.212
-    tubearchivist   IN  A   10.1.2.212
-    webmail         IN  A   10.1.2.212
-    wizarr          IN  A   10.1.2.212
-    zigbee2mqtt     IN  A   10.1.2.212
--- a/kubernetes/system/external-dns/values.yaml
+++ b/kubernetes/system/external-dns/values.yaml
@@ -1,39 +1,38 @@
 provider:
-    name: coredns
-    registry: noop
-    policy: upsert-only
-    sources:
-        - ingress
-        - service
+    name: pihole
+registry: noop
+policy: upsert-only
+sources:
+    - ingress
 domainFilters:
-    - lan
+    - .lan
 extraArgs:
-    - ENC[AES256_GCM,data:pWoRZNy0bqOOC/KNOy5u6yVpqJv29cJIgQ==,iv:gWQc3vdCwT7V67D0tyrPASAUNhVKjc2SIBLcQutIWG8=,tag:q6C1CLTMiGv0ZJ4jrPYOGg==,type:str]
-env:
-    - name: ETCD_URLS
-      value: ENC[AES256_GCM,data:w4cTglu/bE5AkzdHdXhC8B0IazuxfQECVdPB3S2kUSJ8L4Q21oUQOs8I,iv:p560+9a3EqNcnA83Ahx/91w0PfzqWlAY8KRhbaCO5t4=,tag:ajc0Al6wZTOVrkLDXG90+w==,type:str]
+    - ENC[AES256_GCM,data:ym7grahK+0f0ydcdbWjamJdu/fOBUdH186xaQVaXZWEb,iv:PYGTuE/0z23pXVmitjDRcESs6dwuZA89VUhC1Dw/YlI=,tag:eIFd/J0gk8AWkaBmkHXoxg==,type:str]
+    - ENC[AES256_GCM,data:ah50AImpMpFgRmu7IFsOKUO8WK+dcFSQakw=,iv:WyrXKk0WxD86A3nDu2kvjZD185LZhDwTx28g9tPvgFA=,tag:B/7Kv4FT9l3SjIuGboIkaQ==,type:str]
+    - ENC[AES256_GCM,data:5eFuaAUaRwrscxSSEOKpLxUrfgo+jfim,iv:6MQ10olVkkRzOaOf02vWKOrvmwgmEr1HedHpraprEaY=,tag:Kc2F03NjLMWmzHaByYHR9A==,type:str]
 sops:
-    lastmodified: "2026-05-02T14:07:20Z"
-    mac: ENC[AES256_GCM,data:unn1TyPyIJZZZl3rB07iCjBJLP5dACsEowaHG2kPD7ItcLeZhz8gjy0Mz0lPgZXizBLtxdPxlH9W4DPZM6tIudghKovOg7ivoUlA78We87wOxACzAlLwG02vw4f5CKwopqEpdcl9aprLbg815IzcDdsKqSLHIw+Xdm0nW4rP+T0=,iv:YCoJhgO4hlcCcvVx/dxrIBR1677U9UREX26QPB8G/WY=,tag:PguKaLKr6wm93OgYgzEENQ==,type:str]
+    lastmodified: "2025-08-27T10:07:50Z"
+    mac: ENC[AES256_GCM,data:wb+0NBxUIqQUbCVsEZUTE7fAvFy+pxaxaD+zb76BploLk0qzB66Ui+xvArNW1RV8qOVTr/fLLxAcIfDlmN+HvJRFeUZLUhZroZXWIIElDN6O8IgzFRy3B+ps5bhVtkgUGACdmML9NJ7wCKEX67AqbuqquR/JagN55cDSTzhUvwk=,iv:qIu3X8SD5H/iKkJvwfK1aI0Rd4/fpt9ApIT5cpEDwVs=,tag:9nvr+LnN1RA8WQgtUg+GTA==,type:str]
    pgp:
-        - created_at: "2026-05-02T14:07:18Z"
+        - created_at: "2025-08-27T10:07:49Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ/+OD3xMKWh/zrmSAzeha7eBUQqxV4Md+Sk5ZaZZpJwXm0F
-            Icb4N7rMRZiUL/BXaH7dDyLNKFbqTGTtLhBtp8IbW6Y6pijQDa3lgX2aC2LjZYP2
-            GTILWOVYMo18h/idESrj9RBpODDCLUwDUipmNNDrNmeq+aotWEBGZgum2mE/lIdY
-            Xx+gK9y6vE4IRnDp0AMBahYenO1QrzmzEJphBocw9H9RBwrXx3a4Ke4NY56/0cn+
-            Q0+pBZdN4T+tmsplwT55I/2UIyyuLWLzfiXqgzP9PHj2qasP/0txDr3cL1bdMnLU
-            U3ubRFbWHwstjKvsc7sHEZscaSE6CXzpxMCQs98q0I119+l5K4cm/n7ch3b7JDFB
-            vRuYVdNXBllKMbSdvl++zhh9eYD/gofkZhx9cpJTrku8u6IlKuZkuTjNPp4QtkY6
-            pPbC42znQ1xhEw5y4YtCxCfynhjCIko31P0uraMu5Ni8nPwt+nWANKLXn6T0VzlM
-            lFuU2FiPm9/p/4vNd3WlN73ShEf+QCUR6fZqJDEWY82lbdxMX5+p3JKbWtiY+rbH
-            scKh6hH1PAEYxNQosOabQWnt095niHXseWRAAYaRkm86jB500noYZw9sASmARFT6
-            ojrl+hKzUqZa7Y5QIG3VFEiLJKIMDDoT8ojeKkuq5jCznInMdqQ/LlRX68IPI53S
-            XgGNlbkKDLJx2r8ImRTXDkXIJT0d7iBnWksUHYgNnMnFgd8cR5Kud2NU2Hfh5zbQ
-            2q3dcJiO58H3CK6fZQhLkyTbodvD8+4z6E9rblWeAZR03qf8UPW2UmmWPlRgUPc=
-            =SbhF
+            hQIMA7uy4qQr71wiAQ/+IMnGLNPR17dXFL/tT/Jzm2SbZnRQJVk8pEikESBazMHy
+            qcXjwI4ZXOVKC9Azc1jwigWx1wsRzksqHWI7YihkJKSTWgDkr/WbRZUkkndMyC6o
+            1rUghPTMnw3ykrLOHw0dP5KrQyeTqj3EakJKzPLl1M5AqOlRIEQzJhpcGACy9teR
+            RZ4Z0WQL4lxl1bVQ/Yq+o7iEWDqAwlLxllBnvAz/nIfMQgaTfa9UyEz5Up71nXtz
+            f98txsSmB0kEYqEJNeNSQa6+MFT1OXJX8XijlfcEYVIyX7XO8+vKu99Neae026Ki
+            o+yXgVB8UIV/8tfhhRYofYFEUP9SPNeIrlJlXPopv1axnhhxCJeUUMDfQtrQFR1Q
+            8AUNbWluEU5q3/YLtk1HsLIDHGLG4o2WIS67Do3Feik3oZc5jP4b2sLrsSYc/2Rn
+            DkjDrnYKqXojr2jD4B9fMiKen1/MxqZwP78CFNNIjqDf44fvmHPK1BlCUbMmBmyV
+            yti3wTZEWUa3P9a1EApt3/ez+51o4R1q5En6bkZWqrzDtjd1qhs8ygP1pyU5eRJZ
+            dn0FzzDn4UuecCjXx6rZLw8ugSPIw+z3BMvB/JRx6OY3Dm6NKHBwfdIELoWwpWoY
+            28cH5X8hfVhr3uDIXmXVkJhrri3q35mRQnBIw+Gw7hgeMfWdLLmMSgwhCVvWNwDU
+            aAEJAhBlX9Uiqb+tS5fNYsnGVwS4XNIUozxtkdy3t+ZHK/rqCJ0qVr6m2rTO8QCg
+            jfNwgjOfpFC5YSsHjEuPaISBTfEMJea/1fqeUoPSXIMtgnceOT5xeqR5d7K1cOKR
+            sRirvHEkhbG3
+            =uej8
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$