buildpath: downgrade mongo

umami: deploy umami
Merge pull request #261 from vhaudiquet/dependabot/docker_compose/docker/home/n8n/n8nio/n8n-2.1.4
2026-02-01 22:55:59 +00:00 · 2025-12-29 15:28:01 +01:00 · 2025-12-29 15:09:01 +01:00 · 2025-12-26 19:41:51 +01:00 · 2025-12-26 19:41:41 +01:00 · 2025-12-26 19:41:32 +01:00
30 changed files with 221 additions and 275 deletions
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -36,7 +36,6 @@ updates:
      - "/docker/production/semeryfr"
      - "/docker/production/vhaudiquetfr"
      - "/docker/tools/excalidraw"
-      - "/docker/tools/notesnook"
      - "/docker/tools/obsidian-livesync"
      - "/docker/tools/stirling-pdf"
  - package-ecosystem: "helm"
@@ -47,9 +46,12 @@ updates:
      - "/kubernetes/code/gitea"
      - "/kubernetes/code/harbor"
      - "/kubernetes/home/home-assisant"
+      - "/kubernetes/home/zigbee2mqtt"
      - "/kubernetes/infrastructure/authentik"
      - "/kubernetes/personal/linkwarden"
+      - "/kubernetes/personal/notesnook"
      - "/kubernetes/personal/photoprism"
+      - "/kubernetes/production/umami"
      - "/kubernetes/system/csi-driver-nfs"
      - "/kubernetes/system/external-dns"
      - "/kubernetes/system/traefik"
--- a/.swarmcd/stacks.yaml
+++ b/.swarmcd/stacks.yaml
@@ -163,13 +163,6 @@ excalidraw:
  branch: main
  compose_file: docker/tools/excalidraw/docker-compose.yml

-notesnook:
-  repo: homeprod
-  branch: main
-  compose_file: docker/tools/notesnook/docker-compose.yml
-  sops_files:
-    - docker/tools/notesnook/.env
-
 obsidian-livesync:
  repo: homeprod
  branch: main
--- a/docker/home/esphome/docker-compose.yml
+++ b/docker/home/esphome/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
  esphome:
-    image: ghcr.io/esphome/esphome:2025.11.3
+    image: ghcr.io/esphome/esphome:2025.12.2
    ports:
      - "6052"
    networks:
--- a/docker/home/n8n/docker-compose.yml
+++ b/docker/home/n8n/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
  n8n:
-    image: docker.n8n.io/n8nio/n8n:1.122.5
+    image: docker.n8n.io/n8nio/n8n:2.1.4
    environment:
      - TZ=Europe/Paris
      - N8N_SECURE_COOKIE=false
--- a/docker/home/zigbee2mqtt/docker-compose.yml
+++ b/docker/home/zigbee2mqtt/docker-compose.yml
@@ -2,7 +2,7 @@ services:
  zigbee2mqtt:
    container_name: zigbee2mqtt
    restart: unless-stopped
-    image: koenkk/zigbee2mqtt:2.7.0
+    image: koenkk/zigbee2mqtt:2.7.1
    networks:
      - default
      - proxy
--- a/docker/infrastructure/mail/roundcube/docker-compose.yml
+++ b/docker/infrastructure/mail/roundcube/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
  roundcube:
-    image: roundcube/roundcubemail:1.6.11-apache
+    image: roundcube/roundcubemail:1.6.12-apache
    container_name: roundcube
    networks:
      - default
--- a/docker/infrastructure/mail/stalwart/docker-compose.yml
+++ b/docker/infrastructure/mail/stalwart/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
  stalwart:
-    image: stalwartlabs/stalwart:v0.14.1
+    image: stalwartlabs/stalwart:v0.15.2
    container_name: stalwart
    networks:
      - default
--- a/docker/personal/gramps/docker-compose.yml
+++ b/docker/personal/gramps/docker-compose.yml
@@ -1,7 +1,7 @@
 services:
  grampsweb:
    container_name: grampsweb
-    image: ghcr.io/gramps-project/grampsweb:25.11.2
+    image: ghcr.io/gramps-project/grampsweb:25.12.0
    restart: always
    networks:
      - default
@@ -30,12 +30,12 @@ services:
      - "traefik.http.routers.grampsweb.rule=Host(`gramps.lan`)"
    healthcheck:
      test: curl -f http://127.0.0.1:5000 || exit 1
-      interval: 30s
-      retries: 6
+      interval: 1m
+      retries: 10

  grampsweb_celery:
    container_name: grampsweb_celery
-    image: ghcr.io/gramps-project/grampsweb:25.11.2
+    image: ghcr.io/gramps-project/grampsweb:25.12.0
    restart: always
    environment:
      - GRAMPSWEB_TREE="Gramps Web"  # will create a new tree if not exists
--- a/docker/personal/media/films-series/jackett/docker-compose.yml
+++ b/docker/personal/media/films-series/jackett/docker-compose.yml
@@ -1,7 +1,7 @@
 services:
  jackett:
    container_name: jackett
-    image: ghcr.io/hotio/jackett:release-0.24.402
+    image: ghcr.io/hotio/jackett:release-0.24.545
    ports:
      - "9117"
    networks:
--- a/docker/personal/media/films-series/jellyfin/docker-compose.yml
+++ b/docker/personal/media/films-series/jellyfin/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
  jellyfin:
-    image: jellyfin/jellyfin:2025120105
+    image: jellyfin/jellyfin:2025122205
    container_name: jellyfin
    networks:
      - default
--- a/docker/personal/media/films-series/wizarr/docker-compose.yml
+++ b/docker/personal/media/films-series/wizarr/docker-compose.yml
@@ -1,7 +1,7 @@
 services:
  wizarr:
    container_name: wizarr
-    image: ghcr.io/wizarrrr/wizarr:v2025.11.3
+    image: ghcr.io/wizarrrr/wizarr:v2025.12.0
    networks:
      - default
      - proxy
--- a/docker/personal/media/music/navidrome/docker-compose.yml
+++ b/docker/personal/media/music/navidrome/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
  navidrome:
-    image: deluan/navidrome:0.58.5
+    image: deluan/navidrome:0.59.0
    user: 1000:1000 # should be owner of volumes
    ports:
      - "4533"
--- a/docker/personal/paperless/docker-compose.yml
+++ b/docker/personal/paperless/docker-compose.yml
@@ -16,7 +16,7 @@ services:
      POSTGRES_DB: paperless

  paperless-webserver:
-    image: ghcr.io/paperless-ngx/paperless-ngx:2.20.1
+    image: ghcr.io/paperless-ngx/paperless-ngx:2.20.3
    restart: unless-stopped
    networks:
      - default
--- a/docker/personal/radicale/docker-compose.yml
+++ b/docker/personal/radicale/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
  radicale:
-    image: tomsquest/docker-radicale:3.5.8.2
+    image: tomsquest/docker-radicale:3.5.10.0
    container_name: radicale
    ports:
      - 5232
--- a/docker/production/buildpath/docker-compose.yml
+++ b/docker/production/buildpath/docker-compose.yml
@@ -1,12 +1,11 @@
 services:
  mongo:
    hostname: mongo
-    image: mongo:8.0.1
+    image: mongo:7.0.12
    restart: always
-    user: 2000:2000
    volumes:
-      - mongo_data:/data/db:Z
-      - mongo_data:/data/configdb:Z
+      - mongo_data:/data/db
+      - mongo_data:/data/configdb
    env_file: .env

  patch_detector:
--- a/docker/tools/notesnook/.env
+++ b/docker/tools/notesnook/.env
@@ -1,22 +0,0 @@
-WEBRISK_API_URI=
-INSTANCE_NAME=ENC[AES256_GCM,data:qEEZGdAX83nTP2isYB1sVSUlfLiv6Xw=,iv:vdLcvAbaCd2bEpHfQVv2CQEHO3cFdvLfgEGIMS/lA2w=,tag:uPUhfd/nuuxegH2RXkADSA==,type:str]
-NOTESNOOK_API_SECRET=ENC[AES256_GCM,data:o9/2+nDeoBAXFE8R,iv:8Lzz6Flltia+pr6CmdaGaba8x/+KnIjhKdwJOkgX3ys=,tag:hHI3VZj/uOrmSMmhh+T4yA==,type:str]
-DISABLE_SIGNUPS=ENC[AES256_GCM,data:w1MjyQ==,iv:NKjhnLyPeOakGSMwVmOft7WtK6ggDYx0OucmUZId4Dc=,tag:wk5GpTs5xOMQ2S6w1MLjQA==,type:str]
-SMTP_USERNAME=ENC[AES256_GCM,data:N6/huGyOvYbkb580YyZ+5u3chhA=,iv:pyglhbFMwyRxI1k9bmMS0sr/x+5RXn/I+fKavdNUSCc=,tag:/XgQDqYugazoFb0NQJGjSg==,type:str]
-SMTP_PASSWORD=ENC[AES256_GCM,data:L2FG6mz9BlhuFfLNDa0=,iv:1P6ABsBleUYAn+Yz6qC3MbD2bR85HTrxM0aH8eRLVNY=,tag:IAggPwIHY5hobYobIGm8Qw==,type:str]
-SMTP_HOST=ENC[AES256_GCM,data:3NSiYgn8jooDDZLTuTgj8Jah,iv:k0sz5H35fv9xzgfyV/NyE9CUVJySFvgbIoKuq7s+VF4=,tag:W7Ce8BUIz5bULaPOwIcv/Q==,type:str]
-SMTP_PORT=ENC[AES256_GCM,data:AxM/,iv:tsQ8RA8f6YhxACcgUaHE3RgADcXB0hAd3dIkEtch0Bc=,tag:fxInjB435fi9XzLqdoOJwg==,type:str]
-NOTESNOOK_APP_PUBLIC_URL=ENC[AES256_GCM,data:DCTjjJBUapunw5wZpQEWZscUtOZiAoWJFw==,iv:e192t2+LDSh6YokJso2I2hD3Z2yRJ4g0QwUyRSnACBo=,tag:ULInUTM5qbGJlCrVpkDxIg==,type:str]
-AUTH_SERVER_PUBLIC_URL=ENC[AES256_GCM,data:9Nt/sTzOZwQZoaErm7epTw+buoWXQXQ8jZtlVZzLoiGDh7mjx9x9jQ==,iv:d0MvX6CWvEyx7YwIgGo3SIXV3hmZA3KqU5255gRhVAo=,tag:doKLa1njr4bK0lTy2i53DA==,type:str]
-NOTESNOOK_APP_PUBLIC_URL=ENC[AES256_GCM,data:tzfOXeT0jBubJnvcx+EHmHQJhXXyJjkgMw==,iv:HM5ykxZ9E5BwLOU1+6pY9777Tz7CmPS+JyrBLbIj7BA=,tag:/1NhvVLkq4w+yWWWs338bA==,type:str]
-MONOGRAPH_PUBLIC_URL=ENC[AES256_GCM,data:nTvb9xckE3Dwb8e3ngQimwbbEqu37kUgEQVJ9dKDAIAPkU7HumXMn3Y=,iv:QDjvaxuLWR80VL05C/lL17EVUpMsb8TF/9WRLw6fAPk=,tag:rdrAZlpJ5kY1O9QgmErBDQ==,type:str]
-ATTACHMENTS_SERVER_PUBLIC_URL=ENC[AES256_GCM,data:SxJr4/nJRij39l6EACQz83dg8IPiSe9PjD7i6l9xAkpyvA==,iv:rrj951k7KQ8+FbU8cenkBv3ESBB7B6dpcX8aLeVjtNk=,tag:nVQyawlBhd69f+3MIk/Ftg==,type:str]
-NOTESNOOK_CORS_ORIGINS=ENC[AES256_GCM,data:DOUsLeX882mGUKz1NcMhBRPydhoBYlxoyoSTSe6NEIiF9YM1TZwOBaJqw9zbdjy45zxzuvXxZmAFt+CL91/8oVHUMX2kBi1cT88W2nZU5g==,iv:sPUEYWPfTTR5o8Dm4rtFyD1rjkTkV9GgGlbZJPMPZGM=,tag:qNxvouzH/lgRZXWQtAGxsA==,type:str]
-NOTESNOOK_CORS=ENC[AES256_GCM,data:H4pMn0DbumkeWxLjbKqvd//hTKav7Yucz9QT/Nnvu0sLLOiDMg3exKQy33VEWFuGs3F4CuqzcT2tKmi3viXbGQ9CnNsZp6EhBv1eWBQ21g==,iv:RI8hq0B/HJ98HTKg5y9TAZGzTulokqeqghXej/J6UHA=,tag:cvm+i+oNND7/340fV/VdsQ==,type:str]
-sops_lastmodified=2025-10-15T14:21:43Z
-sops_mac=ENC[AES256_GCM,data:+1PYCITFsGvfXDUAFAaDW6gBqfi/cE8Hrp9yw/wuS6E2Q1iw1GGEiFzeK/IL57MUvAZSdQkmv2bNrnboeDBYhHhADdqJdqht1SNui50aEYdLaHHUFADx54b157Op6HLYSccG1J6Hm7riBeurCDUxpC0hJ1whLva2V/T73LnzAf0=,iv:fsmU91jFjSDNjDfaki1c00cS2cya4jcVwd3pbSl/VBs=,tag:SOitwcXraXgrJVmfuLkDKg==,type:str]
-sops_pgp__list_0__map_created_at=2025-10-15T14:21:43Z
-sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA7uy4qQr71wiAQ//Rp9OH/H6e414f5jzczN4JgAUcJ7iWvP7CfvPN6gMZiFf\nAHlzejEGhfSxyx8/HNrdWK2BQn1wEqKCTAfB4LtHFNXEvUlMUdxjbzVaqGk8YUQF\nrRduMHpHNamsalk+4Kz7oHWpjw994qxpypHvsFxczAH2NLzYD+brEovaRDi+XTUy\n+e64wNnLhDJS1Xtm2urF1dvs/XQmCYxIpANqGvMezS+vHT8fDQze9Ka1KJh+E/rp\nCFCu3rSbs74E4QjttDoHF1FgMqB1HnbyRStBnq62BjsUMGuV560m/9R76Q++QUBa\nG78pg87ixBtJib24eApeLRMqiIGCdSNxIPn2+b069k5Chp+KCuFl9OAxFUYWIuLs\nmzrizfMKY2iWxBbkn14p24dgHDTkIEnwTOIHSzXHy02AZFcY/Z15R/Yj/nsvnMzO\nUwY931MMoWjME5R/lWrLzBz9FniYxxPwosDzYPdJH9+tJIs4C9EQmmDbKR48inLF\nkNP/ZzNmmhosOHzAEVNlmOo955YTSeGwGLxTsqtpJzNesGnA5q+ENq5Li2v26RTm\nijZJG+U2MyM55jWdETm3bkPwZooUOxpKmJy1gaXNl8/b1Pp0t3fQRWKGGwhsFWsI\nZ8j2++lW+1Gu5EcpjvFH6jdEfDh1R4UMlRO/pyBpWDdBrCwxrPlOv/j2/ogCdEfS\nXgFQwcLcFtZleLH537SZLgf8IJhrKQr6MM8jQf1tv1sLZC0LF3Ojhw9zs8YrX821\nwg3kw0Vd0gsKxxcQHaoLHqwTV/dY0kSHjkbCzG53XT2+p97PFNjhAEKBvNovov8=\n=qFED\n-----END PGP MESSAGE-----
-sops_pgp__list_0__map_fp=DC6910268E657FF70BA7EC289974494E76938DDC
-sops_unencrypted_suffix=_unencrypted
-sops_version=3.10.2
--- a/docker/tools/notesnook/docker-compose.yml
+++ b/docker/tools/notesnook/docker-compose.yml
@@ -1,224 +0,0 @@
-services:
-  notesnook-db:
-    image: mongo:8.0.15
-    hostname: notesnookdb
-    user: mongodb:mongodb
-    volumes:
-      - dbdata:/data/db
-      - dbdata:/data/configdb
-    networks:
-      - notesnook
-    command: --replSet rs0 --bind_ip_all
-    healthcheck:
-      test: echo 'db.runCommand("ping").ok' | mongosh mongodb://localhost:27017 --quiet
-      interval: 40s
-      timeout: 30s
-      retries: 3
-      start_period: 60s
-
-  notesnook-s3:
-    image: minio/minio:RELEASE.2024-07-29T22-14-52Z
-    # ports:
-      # - 9000:9000
-    networks:
-      - notesnook
-      - proxy
-    volumes:
-      - s3data:/data/s3
-    environment:
-      MINIO_BROWSER: "on"
-    env_file: .env
-    command: server /data/s3 --console-address :9090
-    healthcheck:
-      test: timeout 5s bash -c ':> /dev/tcp/127.0.0.1/9000' || exit 1
-      interval: 40s
-      timeout: 30s
-      retries: 3
-      start_period: 60s
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.notesnook-s3.rule=Host(`notesnook.vhaudiquet.fr`) && PathPrefix(`/s3`)"
-      - "traefik.http.routers.notesnook-s3.middlewares=notesnook-s3"
-      - "traefik.http.middlewares.notesnook-s3.stripprefix.prefixes=/s3"
-      - "traefik.docker.network=proxy"
-      - "traefik.http.routers.notesnook-s3.entrypoints=http"
-
-  identity-server:
-    image: streetwriters/identity:v1.0-beta.5
-    ports:
-      - 8264
-    networks:
-      - notesnook
-      - proxy
-    env_file: .env
-    depends_on:
-      - notesnook-db
-    healthcheck:
-      test: wget --tries=1 -nv -q  http://localhost:8264/health -O- || exit 1
-      interval: 40s
-      timeout: 30s
-      retries: 3
-      start_period: 60s
-    environment:
-      NOTESNOOK_SERVER_PORT: 5264
-      NOTESNOOK_SERVER_HOST: notesnook-server
-      IDENTITY_SERVER_PORT: 8264
-      IDENTITY_SERVER_HOST: identity-server
-      SSE_SERVER_PORT: 7264
-      SSE_SERVER_HOST: sse-server
-      SELF_HOSTED: 1
-      IDENTITY_SERVER_URL: https://notesnook.vhaudiquet.fr/identity
-      NOTESNOOK_APP_HOST: https://app.notesnook.com
-      MONGODB_CONNECTION_STRING: mongodb://notesnookdb:27017/identity?replSet=rs0
-      MONGODB_DATABASE_NAME: identity
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.identity-server.rule=Host(`notesnook.vhaudiquet.fr`) && PathPrefix(`/identity`)"
-      - "traefik.http.routers.identity-server.middlewares=identity-server,notesnook-server-cors"
-      - "traefik.http.middlewares.identity-server.stripprefix.prefixes=/identity"
-      - "traefik.docker.network=proxy"
-      - "traefik.http.routers.identity-server.entrypoints=http"
-      - "traefik.http.services.identity-server.loadbalancer.server.port=8264"
-
-  notesnook-server:
-    image: streetwriters/notesnook-sync:v1.0-beta.5
-    ports:
-      - 5264
-    networks:
-      - notesnook
-      - proxy
-    env_file: .env
-    depends_on:
-      - notesnook-s3
-      - identity-server
-    healthcheck:
-      test: wget --tries=1 -nv -q  http://localhost:5264/health -O- || exit 1
-      interval: 40s
-      timeout: 30s
-      retries: 3
-      start_period: 60s
-    environment:
-      NOTESNOOK_SERVER_PORT: 5264
-      NOTESNOOK_SERVER_HOST: notesnook-server
-      IDENTITY_SERVER_PORT: 8264
-      IDENTITY_SERVER_HOST: identity-server
-      SSE_SERVER_PORT: 7264
-      SSE_SERVER_HOST: sse-server
-      SELF_HOSTED: 1
-      IDENTITY_SERVER_URL: https://notesnook.vhaudiquet.fr/identity
-      NOTESNOOK_APP_HOST: https://app.notesnook.com
-      MONGODB_CONNECTION_STRING: mongodb://notesnookdb:27017/?replSet=rs0
-      MONGODB_DATABASE_NAME: notesnook
-      S3_INTERNAL_SERVICE_URL: "http://notesnook-s3:9000"
-      S3_INTERNAL_BUCKET_NAME: "attachments"
-      S3_ACCESS_KEY_ID: "${MINIO_ROOT_USER:-minioadmin}"
-      S3_ACCESS_KEY: "${MINIO_ROOT_PASSWORD:-minioadmin}"
-      S3_SERVICE_URL: "${ATTACHMENTS_SERVER_PUBLIC_URL}"
-      S3_REGION: "us-east-1"
-      S3_BUCKET_NAME: "attachments"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.notesnook-server.rule=Host(`notesnook.vhaudiquet.fr`)"
-      - "traefik.http.services.notesnook-server.loadbalancer.server.port=5264"
-      - "traefik.docker.network=proxy"
-      - "traefik.http.routers.notesnook-server.entrypoints=http"
-      - "traefik.http.routers.notesnook-server.middlewares=notesnook-server-cors"
-      - "traefik.http.middlewares.notesnook-server-cors.headers.accesscontrolalloworiginlist=*"
-      - "traefik.http.middlewares.notesnook-server-cors.headers.accesscontrolallowmethods=*"
-      - "traefik.http.middlewares.notesnook-server-cors.headers.accesscontrolallowheaders=*"
-      - "traefik.http.middlewares.notesnook-server-cors.headers.accesscontrolallowcredentials=true"
-  
-  sse-server:
-    image: streetwriters/sse:v1.0-beta.5
-    ports:
-      - 7264
-    env_file: .env
-    depends_on:
-      - identity-server
-      - notesnook-server
-    networks:
-      - notesnook
-      - proxy
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.sse-server.rule=Host(`notesnook.vhaudiquet.fr`) && PathPrefix(`/sse`)"
-      - "traefik.http.services.sse-server.loadbalancer.server.port=7264"
-      - "traefik.http.routers.sse-server.middlewares=sse-server,notesnook-server-cors"
-      - "traefik.http.middlewares.sse-server.stripprefix.prefixes=/sse"
-      - "traefik.docker.network=proxy"
-      - "traefik.http.routers.sse-server.entrypoints=http"
-    healthcheck:
-      test: wget --tries=1 -nv -q  http://localhost:7264/health -O- || exit 1
-      interval: 40s
-      timeout: 30s
-      retries: 3
-      start_period: 60s
-    environment:
-      NOTESNOOK_SERVER_PORT: 5264
-      NOTESNOOK_SERVER_HOST: notesnook-server
-      IDENTITY_SERVER_PORT: 8264
-      IDENTITY_SERVER_HOST: identity-server
-      SSE_SERVER_PORT: 7264
-      SSE_SERVER_HOST: sse-server
-      SELF_HOSTED: 1
-      IDENTITY_SERVER_URL: https://notesnook.vhaudiquet.fr/identity
-      NOTESNOOK_APP_HOST: https://app.notesnook.com
-
-  monograph-server:
-    image: streetwriters/monograph:1.2.4
-    # ports:
-      # - 6264:3000
-    env_file: .env
-    depends_on:
-      - notesnook-server
-    networks:
-      - notesnook
-      - proxy
-    healthcheck:
-      test: wget --tries=1 -nv -q  http://localhost:3000/api/health -O- || exit 1
-      interval: 40s
-      timeout: 30s
-      retries: 3
-      start_period: 60s
-    environment:
-      NOTESNOOK_SERVER_PORT: 5264
-      NOTESNOOK_SERVER_HOST: notesnook-server
-      IDENTITY_SERVER_PORT: 8264
-      IDENTITY_SERVER_HOST: identity-server
-      SSE_SERVER_PORT: 7264
-      SSE_SERVER_HOST: sse-server
-      SELF_HOSTED: 1
-      IDENTITY_SERVER_URL: https://notesnook.vhaudiquet.fr/identity
-      NOTESNOOK_APP_HOST: https://app.notesnook.com
-      API_HOST: http://notesnook-server:5264
-      MONOGRAPH_PUBLIC_URL: https://notesnook.vhaudiquet.fr/monograph
-      PUBLIC_URL: https://notesnook.vhaudiquet.fr/monograph
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.monograph-server.rule=Host(`notesnook.vhaudiquet.fr`) && PathPrefix(`/monograph`)"
-      - "traefik.http.routers.monograph-server.middlewares=monograph-server,notesnook-server-cors"
-      - "traefik.http.middlewares.monograph-server.stripprefix.prefixes=/monograph"
-      - "traefik.docker.network=proxy"
-      - "traefik.http.routers.monograph-server.entrypoints=http"
-      - "traefik.http.services.monograph-server.loadbalancer.server.port=3000"
-
-networks:
-  notesnook:
-
-  proxy:
-    name: proxy
-    external: true
-
-volumes:
-  dbdata:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/notesnook/dbdata/_data'
-  s3data:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/notesnook/s3data/_data'
--- a/kubernetes/infrastructure/authentik/values.yaml
+++ b/kubernetes/infrastructure/authentik/values.yaml
@@ -20,7 +20,7 @@ postgresql:
        password: ENC[AES256_GCM,data:NWk6kvOp1RRs4A==,iv:q0GoRFQ15LBXDxDnOiKWHX6/K8DwX+k2Myxk7iaBo2U=,tag:6qfY+5TF2oy4cRfeJKr7IA==,type:str]
    image:
        repository: bitnamilegacy/postgresql
-        tag: 17.5.0
+        tag: 15.9.0
    primary:
        args: []
 redis:
@@ -55,4 +55,4 @@ sops:
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2
+    version: 3.10.2
--- a/kubernetes/personal/notesnook/kustomization.yaml
+++ b/kubernetes/personal/notesnook/kustomization.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: notesnook
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: notesnook-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml
--- a/kubernetes/personal/notesnook/kustomizeconfig.yaml
+++ b/kubernetes/personal/notesnook/kustomizeconfig.yaml
@@ -0,0 +1,6 @@
+nameReference:
+- kind: Secret
+  version: v1
+  fieldSpecs:
+  - path: spec/valuesFrom/name
+    kind: HelmRelease
--- a/kubernetes/personal/notesnook/namespace.yaml
+++ b/kubernetes/personal/notesnook/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: notesnook
--- a/kubernetes/personal/notesnook/release.yaml
+++ b/kubernetes/personal/notesnook/release.yaml
@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: notesnook
+  namespace: notesnook
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: notesnook
+        namespace: notesnook
+      chart: notesnook
+      version: '1.0.5'
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: notesnook-values
--- a/kubernetes/personal/notesnook/repository.yaml
+++ b/kubernetes/personal/notesnook/repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: notesnook
+  namespace: notesnook
+spec:
+  interval: 1m
+  url: https://gitlab.ibaraki.app/api/v4/projects/130/packages/helm/stable
--- a/kubernetes/personal/notesnook/values.yaml
+++ b/kubernetes/personal/notesnook/values.yaml
@@ -0,0 +1,65 @@
+instance:
+    name: vhaudiquet-notesnook
+api:
+    secret: ENC[AES256_GCM,data:C3mpoEG6y6IShpX1+o9eNn8NACaKy8s1xw5tY1/ncBzqaKrK3YiE7K0rl4d6Bq6q,iv:rGWxSmV98ef8Qx1jkVbQEKPkFmGEaCOXXFFZ4I1US7s=,tag:VBDOhPRTRRhFu5cU024Sqg==,type:str]
+    knownProxies: 10.0.0.0/8
+    disableSignups: true
+publicUrls:
+    app: https://app.notesnook.com
+    auth: https://auth-nook.vhaudiquet.fr
+    monograph: https://n.vhaudiquet.fr
+    attachments: http://localhost:9000
+smtp:
+    username: ENC[AES256_GCM,data:C4dTnVaJCwxqTdevLJ+a9eJOWPk=,iv:9iHoQzZjHjmOuaoOWdedPHuv06MqtXZXJhWGiTdzhwE=,tag:xDL+WInm/Ms/LuZi53JuHA==,type:str]
+    password: ENC[AES256_GCM,data:tIkKqwVBy94oqFJH0V8=,iv:cOKiwDhngz6mnZlD+XSfWFg1KZa+UCkhXKBgjK7IdnE=,tag:91d/aUlfeHbJqtRWPmTskQ==,type:str]
+    host: mail.vhaudiquet.fr
+    port: 465
+ingress:
+    enabled: true
+    hosts:
+        identity:
+            - host: auth-nook.vhaudiquet.fr
+              paths:
+                - path: /
+                  pathType: ImplementationSpecific
+        notesnook:
+            - host: nook.vhaudiquet.fr
+              paths:
+                - path: /
+                  pathType: ImplementationSpecific
+        sse:
+            - host: sse-nook.vhaudiquet.fr
+              paths:
+                - path: /
+                  pathType: ImplementationSpecific
+        monograph:
+            - host: n.vhaudiquet.fr
+              paths:
+                - path: /
+                  pathType: ImplementationSpecific
+sops:
+    lastmodified: "2025-12-26T18:18:01Z"
+    mac: ENC[AES256_GCM,data:Xy9P+Ifuz18apN7GoYdehc2bzTjUKMJAT7f8HZNTnvV/wkZEt4EUGJL2WGex12nYQyj6Ut+I9pwFwwX5m0oLO82s1zS2DK3BiaxFa6LFJ2VDUthKt8h9ZTNeT+2P5S5cOvEMvS6tljX8y8/HCUwVMCXGMNCIl8RtWo1Q9CgLjrw=,iv:6MdJwJh3xVrXX6sKCQMAEIpdOD8E0V6+305xcaQnnMI=,tag:5JE9M09u6ukPoQBzT9g0sA==,type:str]
+    pgp:
+        - created_at: "2025-12-26T18:18:01Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/+KZ6WDFaDTZVt6n+pu1hwxhNC9ShCSSLkiHlZjtX9DW8O
+            eizwH6GAG8LQeKYr61aXXVwxsqDdM9gx/i0ynDO4fflqEQniEjlFzBeVhsqOf3CX
+            rL5WImv0LSe9KjFNAZvfBhtUVENfN/Tu6RGagNb98ChOoH10MvmrzQ5t754AKPVM
+            hB2f5kmOn0evFQQftYyXkQqzLvhlqdGGfBnCutXDoLz67RQwB37npzXx/c+GtlOX
+            Msmp4wiYqlX9v97vjLHUX/ZeBtzm38DzUw+OTcnDPbsdZpeUMqYnpkIl8GIgSd2D
+            2jZUJU4wYyOCYCnfw0+zXu3O5/1bzZ9fdc5FH6A+OlJUFbMLPXx7n9uhVOztxQ1g
+            5ajZKkszSWk58IvaTueDL2QjxhJLop1y4JITgzOhiSPserXrizGn765bVEAtY8kR
+            zgULAG5f41zeoJzzdMyuCFUlIJec4DFigbe7fRul4sJEjeeHtDdyINWuUXCnS4ZX
+            e8/ZZ0+z98IMm7Lstb75rUezTUdlIxfJ+EtAX3L1Bdb4yJZ3i3E1VTQKWxaZWrcc
+            zF5nOIZsHgD22Um8fA4mDlhX5/ygiKMHxZe2pdwps4F7H0rRzVLlM5n4g+71WeMe
+            0eT4atgKPICzMNkyRJ/KWrtk4c6Kq7sSqpQKlcFsRLMga1ZBt0LQwFW+G7PU30vS
+            XAFljxtoFrbdc8Yl37cQh9XCBqXMqUXSNd9t1hsgv+Vsrmv6ntPVStep8Fod/n16
+            nCACAKTOe//z0OmwUXxdUCIqT/N+XEA8tOrHS+HsbB5MCfnexLDul/yUfviZ
+            =yK0X
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    version: 3.10.2
--- a/kubernetes/production/umami/kustomization.yaml
+++ b/kubernetes/production/umami/kustomization.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: umami
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: umami-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml
--- a/kubernetes/production/umami/kustomizeconfig.yaml
+++ b/kubernetes/production/umami/kustomizeconfig.yaml
@@ -0,0 +1,6 @@
+nameReference:
+- kind: Secret
+  version: v1
+  fieldSpecs:
+  - path: spec/valuesFrom/name
+    kind: HelmRelease
--- a/kubernetes/production/umami/namespace.yaml
+++ b/kubernetes/production/umami/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: umami
--- a/kubernetes/production/umami/release.yaml
+++ b/kubernetes/production/umami/release.yaml
@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: umami
+  namespace: umami
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: umami
+        namespace: umami
+      chart: umami
+      version: '7.1.0'
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: umami-values
--- a/kubernetes/production/umami/repository.yaml
+++ b/kubernetes/production/umami/repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: umami
+  namespace: umami
+spec:
+  interval: 1m
+  url: https://charts.christianhuth.de
--- a/kubernetes/production/umami/values.yaml
+++ b/kubernetes/production/umami/values.yaml
@@ -0,0 +1,33 @@
+ingress:
+    enabled: true
+    hosts:
+        - host: umami.lan
+          paths:
+            - path: /
+              pathType: ImplementationSpecific
+sops:
+    lastmodified: "2025-12-29T14:08:28Z"
+    mac: ENC[AES256_GCM,data:efRSNqXGpsn9fJqX5exXiq3HRM4BDyEGogVpiZTVBp3P+QWh5QZSNtE2DMTXIkOFSG52lEKUmKlRhBjO2RnwqaFWeYvuNnpJiIPwZXW0bq7kT5y48C+tuSznj2Shrk1MegqklK4ccFc/zQG56gANOcPZ7/vz6tW2jLD86qFRVmo=,iv:djmPGeibwyEF17F4izA7sRIb5zLzTDkokQzu8VKbqnE=,tag:V/hxBPmMnrgOx+zYiMjiSw==,type:str]
+    pgp:
+        - created_at: "2025-12-29T14:08:28Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/+PhSbkqtutVp8cmBinvGyVxJTQVGeziuzgRRc67SsfZsh
+            TTbQ5SM3hNgK4lAKpdmdTaNk7pbtj8eTxCUe7F4kR4Rx0ReEI8o9B9v2KIe5SILW
+            n2fz0kEKRjKZW7uDojXNzSvQLEBV4RKejkAOyWalq0Wu1vG+wA2+Y5sN5OIK1eBT
+            z+F5nStfT7QPV5Jmb/lvZwTvTGDnvdFfwLBMraCrH3mvrnAHI4tRfz9UvbNQN/ip
+            KTMUdL8P2Ry3lHx99cDibVHs2e/BMVARVng4Lozc3KEBuF3/J2eURiGgQQw18dBe
+            tdMiaB1P2hlT0mtH9Z0IWgm3JDsduV3GgctE4UXtEk8b8SMrG5DRpmviWQ1IYJnR
+            EMOigatT/B2tr+5je02+F34KYl56WAZPZXrB4RZkxqtelhvo/GBxF/FdR54iDKvU
+            iPhXTx5Tkflk2NXTuAFRPSreAYSh4fjsI5ozkCmb5g1GX9FPbw5Sdz7wnD0z/nSn
+            obfkb5hfRdeUcXHQolwI5/5mhhpUH51cTF4pKExzgX5b6fHUgCo631/lFbI5fv1X
+            VmZ6sGi/pCv03fJ61TAg2xxwblJBVmoAF/+LYRBRqmcesHyiNGs/ko+GStR1DeBh
+            LVDoaTJAngEOrXIOu9zGonN6h9j09M5B7NWjs9+H1XkF6fEjfucrKCnvkRbMl0zS
+            XgFV4z7lrG/XI86xBUWULNPKkI/bD1bgQwHHkSslDTyfXgq5q5hlGqstJSC+Ga6l
+            MZkNV1Al0xlIGgveEamfnNN9jivgsISWIhts4GyYWTEypPJk2x1crLm5rqOFp2w=
+            =jgoW
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    version: 3.10.2