zwavejs2mqtt: Update to 11.2.1

piper: Update to 1.6.3
home-assistant: Update to 2025.8.3
2025-08-30 11:32:08 +00:00 · 2025-08-30 11:32:08 +00:00 · 2025-08-30 11:32:07 +00:00 · 2025-08-16 19:20:11 +00:00 · 2025-08-16 19:17:48 +00:00 · 2025-08-16 19:17:18 +00:00
22 changed files with 186 additions and 206 deletions
--- a/authelia/kustomization.yaml
+++ b/authelia/kustomization.yaml
@@ -58,4 +58,4 @@ patches:
              name: dch-root-ca
 images:
 - name: ghcr.io/authelia/authelia
-  newTag: 4.39.4
+  newTag: 4.39.6
--- a/calico/kustomization.yaml
+++ b/calico/kustomization.yaml
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+labels:
+- pairs:
+    app.kubernetes.io/instance: calico
+
+resources:
+- https://raw.githubusercontent.com/projectcalico/calico/v3.30.2/manifests/operator-crds.yaml
+- https://raw.githubusercontent.com/projectcalico/calico/v3.30.2/manifests/tigera-operator.yaml
--- a/cert-manager/cert-exporter.config.yml
+++ b/cert-manager/cert-exporter.config.yml
@@ -5,10 +5,6 @@ certs:
  key: certificates/_.pyrocufflink.net.key
  cert: certificates/_.pyrocufflink.net.crt
  bundle: certificates/_.pyrocufflink.net.pem
- name: dustinhatchname-cert
-  namespace: default
-  key: acme.sh/dustin.hatch.name/dustin.hatch.name.key
-  cert: acme.sh/dustin.hatch.name/fullchain.cer
 - name: dustinandtabitha-cert
  namespace: default
  key: certificates/dustinandtabitha.com.key
--- a/cert-manager/cert-exporter.yaml
+++ b/cert-manager/cert-exporter.yaml
@@ -18,7 +18,6 @@ rules:
  - get
  resourceNames:
  - pyrocufflink-cert
-  - dustinhatchname-cert
  - dustinandtabitha-cert
  - hlc-cert

--- a/cert-manager/certificates.yaml
+++ b/cert-manager/certificates.yaml
@@ -17,24 +17,6 @@ spec:
    algorithm: ECDSA
    rotationPolicy: Always

---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: dustinhatchname-cert
-spec:
-  secretName: dustinhatchname-cert
-  dnsNames:
-  - dustin.hatch.name
-  - '*.dustin.hatch.name'
-  issuerRef:
-    group: cert-manager.io
-    kind: ClusterIssuer
-    name: zerossl
-  privateKey:
-    algorithm: ECDSA
-    rotationPolicy: Always
-
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
--- a/cert-manager/jenkins.yaml
+++ b/cert-manager/jenkins.yaml
@@ -11,7 +11,6 @@ rules:
  - get
  resourceNames:
  - pyrocufflink-cert
-  - dustinhatchname-cert
  - dustinandtabitha-cert
  - hlc-cert

--- a/dch-webhooks/jenkins.yaml
+++ b/dch-webhooks/jenkins.yaml
@@ -0,0 +1,28 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: jenkins.dch-webhooks
+rules:
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    resourceNames:
+    - dch-webhooks
+    verbs:
+    - get
+    - patch
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: jenkins.dch-webhooks
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: jenkins.dch-webhooks
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: jenkins-jobs
--- a/firefly-iii/kustomization.yaml
+++ b/firefly-iii/kustomization.yaml
@@ -55,4 +55,4 @@ patches:
              defaultMode: 0640
 images:
 - name: docker.io/fireflyiii/core
-  newTag: version-6.2.20
+  newTag: version-6.2.21
--- a/home-assistant/kustomization.yaml
+++ b/home-assistant/kustomization.yaml
@@ -152,11 +152,11 @@ patches:

 images:
 - name: ghcr.io/home-assistant/home-assistant
-  newTag: 2025.7.1
+  newTag: 2025.8.3
 - name: docker.io/rhasspy/wyoming-whisper
  newTag: 2.5.0
 - name: docker.io/rhasspy/wyoming-piper
-  newTag: 1.6.2
+  newTag: 1.6.3
 - name: ghcr.io/koenkk/zigbee2mqtt
  newTag: 2.4.0
 - name: ghcr.io/zwave-js/zwave-js-ui
@@ -164,6 +164,6 @@ images:
 - name: docker.io/library/eclipse-mosquitto
  newTag: 2.0.22
 - name: docker.io/koenkk/zigbee2mqtt
-  newTag: 2.5.1
+  newTag: 2.6.0
 - name: docker.io/zwavejs/zwave-js-ui
-  newTag: 10.9.0
+  newTag: 11.2.1
--- a/home-assistant/mosquitto.yaml
+++ b/home-assistant/mosquitto.yaml
@@ -55,18 +55,6 @@ spec:
        app.kubernetes.io/name: mosquitto
        app.kubernetes.io/part-of: home-assistant
    spec:
-      affinity:
-        podAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 100
-            podAffinityTerm:
-              labelSelector:
-                matchExpressions:
-                - key: app.kubernetes.io/name
-                  operator: In
-                  values:
-                  - home-assistant
-              topologyKey: kubernetes.io/hostname
      containers:
      - name: mosquitto
        image: docker.io/library/eclipse-mosquitto:2.0.15
--- a/home-assistant/piper.yaml
+++ b/home-assistant/piper.yaml
@@ -37,17 +37,15 @@ spec:
        app.kubernetes.io/part-of: home-assistant
    spec:
      affinity:
-        podAffinity:
+        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
-            podAffinityTerm:
-              labelSelector:
-                matchExpressions:
-                - key: app.kubernetes.io/name
-                  operator: In
-                  values:
-                  - home-assistant
-              topologyKey: kubernetes.io/hostname
+            preference:
+              matchExpressions:
+              - key: kubernetes.io/arch
+                operator: In
+                values:
+                - amd64
      containers:
      - name: piper
        image: docker.io/rhasspy/wyoming-piper:1.3.2
--- a/home-assistant/whisper.yaml
+++ b/home-assistant/whisper.yaml
@@ -37,17 +37,15 @@ spec:
        app.kubernetes.io/part-of: home-assistant
    spec:
      affinity:
-        podAffinity:
+        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
-            podAffinityTerm:
-              labelSelector:
-                matchExpressions:
-                - key: app.kubernetes.io/name
-                  operator: In
-                  values:
-                  - home-assistant
-              topologyKey: kubernetes.io/hostname
+            preference:
+              matchExpressions:
+              - key: kubernetes.io/arch
+                operator: In
+                values:
+                - amd64
      containers:
      - name: whisper
        image: docker.io/rhasspy/wyoming-whisper:1.0.0
--- a/jenkins/buildroot-iscsi.yaml
+++ b/jenkins/buildroot-iscsi.yaml
@@ -1,98 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: buildroot-hudpi
-  namespace: jenkins-jobs
-  labels:
-    app.kubernetes.io/name: buildroot-hudpi
-    app.kubernetes.io/component: hudpi
-spec:
-  accessModes:
-  - ReadWriteOnce
-  storageClassName: ''
-  capacity:
-    storage: 64G
-  iscsi:
-    targetPortal: '[fd68:c2d2:500e:3ea3:8d42:e33e:264b:7c30]:3260'
-    iqn: iqn.2000-01.com.synology:storage0.Buildroot-hudpi.8181625090
-    lun: 1
-    chapAuthDiscovery: false
-    chapAuthSession: true
-    fsType: ext4
-    secretRef:
-      name: buildroot-hudpi-iscsi
-  nodeAffinity:
-    required:
-      nodeSelectorTerms:
-      - matchExpressions:
-        - key: network.du5t1n.me/storage
-          operator: In
-          values:
-          - 'true'
-
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: buildroot-hudpi
-  namespace: jenkins-jobs
-  labels:
-    app.kubernetes.io/name: buildroot-hudpi
-    app.kubernetes.io/component: hudpi
-spec:
-  accessModes:
-  - ReadWriteOnce
-  storageClassName: ''
-  resources:
-    requests:
-      storage: 64Gi
-
---
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: buildroot-airplaypi
-  namespace: jenkins-jobs
-  labels:
-    app.kubernetes.io/name: buildroot-airplaypi
-    app.kubernetes.io/component: airplaypi
-spec:
-  accessModes:
-  - ReadWriteOnce
-  storageClassName: ''
-  capacity:
-    storage: 32Gi
-  iscsi:
-    targetPortal: '[fd68:c2d2:500e:3ea3:8d42:e33e:264b:7c30]:3260'
-    iqn: iqn.2000-01.com.synology:storage0.Buildroot-airplaypi.8181625090
-    lun: 1
-    chapAuthDiscovery: false
-    chapAuthSession: true
-    fsType: ext4
-    secretRef:
-      name: buildroot-airplaypi-iscsi
-  nodeAffinity:
-    required:
-      nodeSelectorTerms:
-      - matchExpressions:
-        - key: network.du5t1n.me/storage
-          operator: In
-          values:
-          - 'true'
-
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: buildroot-airplaypi
-  namespace: jenkins-jobs
-  labels:
-    app.kubernetes.io/name: buildroot-airplaypi
-    app.kubernetes.io/component: airplaypi
-spec:
-  accessModes:
-  - ReadWriteOnce
-  storageClassName: ''
-  resources:
-    requests:
-      storage: 32Gi
--- a/jenkins/kustomization.yaml
+++ b/jenkins/kustomization.yaml
@@ -11,7 +11,6 @@ resources:
 - iscsi.yaml
 - gentoo-storage.yaml
 - ssh-host-keys
- buildroot-iscsi.yaml

 patches:
 - patch: |
--- a/jenkins/secrets.yaml
+++ b/jenkins/secrets.yaml
@@ -73,47 +73,3 @@ spec:
      name: rpm-gpg-key-passphrase
      namespace: jenkins
    type: Opaque
-
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: buildroot-hudpi-iscsi
-  namespace: jenkins-jobs
-  labels: &labels
-    app.kubernetes.io/component: hudpi
-    app.kubernetes.io/name: buildroot-hudpi
-    app.kubernetes.io/part-of: buildroot
-spec:
-  encryptedData:
-    node.session.auth.password: AgB+7YE9JAI907M4S78W5ANGlEAj5/x9YMNvdd6KXPFAJAO3sKl1UrKVPKofQFiVHwLHpjqwjs1+g118jBO0wVQMomALuX8S5M9OziUkMwqjSraYRDnQiBk5Bs6P/RAa5UBCvDc28PDeFCdCYvZW8ZJx41rS1COkuZOcez5o1yMxjlEJcBJAZhFaAgmEfLSLOeMScwOxYIXnZIPL5hKrCKaGBdUZ5d2S5HmUjbdcXdS3AEznXu9RG5CSXKKYgBHU7mi6Z5DF3VuWwj+dwXpP0KBhjdJWBptdwWeWJ5Yhs02EWUVqMj9g6sZbK+R9QtWAflx3QqY89UJRaXHNT4Bs+uhIOxns/ptL9TAttZylzu5P8mTBXFPFSIlp3DJ8TORxKE3oRAk8gr9jIXfTzYuPyEb2trZIVXERVe5+k7w7QA4o3vt8SlJXyHKpRSQOBzYUZ0PTud/rF0gm9cFo29mA71MbR5OgRs9N59mrA6iejGHfXE+cpVs06AbPCkvdykHdB9mUqKQpYkdenRQLnOidxaAk9xgc744I4CvKxJ6gp1ub1xZNy7O4dg341Gsd/RBO49SVG+tlEwm6a9Fz3c8+9Gny8eayvBg287IRvYv5dEfm8JCkQ4dq4cqipPGhWjtTulsuN3mFw8hx0dLbzPI/3VDTc73si3flZ5QAkAXZp8shxcWxyYcuX04vjB+R72J8JvIHqlHcVK6nDN/7BSQ=
-    node.session.auth.password_in: AgBRLg+0Jm4XqBYlxNncpDT/7yJz0VJutAKwVposN1bNe3mPDGlTYScGq1u13qNG4xC7Yv41quM4vBrgPESRb+fF4h4iRBkURutW+BiHAg/p5BZKyyJlLe/9GU8WnFFCerQN7kFu8q7Nd78TgqdO5vo9/w1T5nPk87w7VD40JBAgkyihRk9L1ClXUC3gtqm3lm/r4+UutF2s3jRpCdZ8eZbr7Xuccbk6u/a+2DqQav5pNFdJLu3P5D5RrPO2GdwrLZDwQjZmTeDVwVD1lbTB0Jsbj77mE98PEN2DzY74EX+DuHvcprN8Tu9QAf1efe32xBnjJKt1r1n4OibVIivqVpnfO/x20G/gj1P5K8eHStAvnAYTHYfutOJsy/S9qrqMrX3J+kS4/OP9O+Hyb3JOXpRdXcwWGPaJl4C3MuHnwunjFlbjNJ9oeLYs7iqPtdHrEY09UWSj/VcNXwq0kTex5yWiqjj4pgZ0iUxB5RnbmJaEH1xpGhwkc1gvftCyA4CY/+iUIC0j2hV2WxcbOJGzZ+EKGq+mzXdWsTJGJvVdF7NFXYPADeJCQeG3MA3drjVZIu8fK8wOBqXlxvlRAHDUU7EkAoqaT51ezSl0x3wy6SeNFnengFGP0qcbLpgKF7oa/pa2mK++/VkfOi45NAi5LmP18kLlrJnQg9d6kzrHRThoQF5KOjt/WhgR0w8HKo5743NXlWT6YR4oZUFSSDk=
-    node.session.auth.username: AgCnSm21dt1x4kQWdEhLF4pV0Oz8lTpVZJoViF8T+KXbmhvgWIm6VkrD+A/C2e1/H1HXM9pSf3hkQerMl9DLSTTkV4FyLU3W6lrXxT/DoAVAl/Ji1uXtkdoANsq/jspj46QpqfIc6wlGQjSzMk1fysYBFQED3a8cqLFl6NA98VQT/EArpzu2Cmpi39Ras94wiiAxYKfoNs4oQ6ivaXjx+rbYa75cumRczFoanKALlAF/OZHQJ81AW7etlCcGPJKKz7EG1UZL43j4srrUoZK3r6b3fSXfPxpzJipRPisDyDhuvqS95elJLNnVVONsxCh5yVAw4LskCjaFEF8+lgHWkIAUN7fxMTTubF4deK1ihEoECYGaNvnasZIpgxCtX6LRtkEkXY53pcdOevEs+3G+LlYcq352G/gStkqdBkQV5fBa4w5y2jeruIfS+2FMmsk8G0GsV7XgceSL75Uh/wM6uQTBfqzNecdlNF5sfRzsWljVZWbWCp+f7MFut1kEwdsgwzWbX1cdkhASvSQwiZm9aS1yREYttM/xeNHpcxqgdEAirXAB8rRO3m3SJMQPJA9L7nm/NXgEVJ7S+oOz0tUPz4bUZVlKEY8Z3zQjHtLw13yqaxqHNB4gjrCJBCHA2+SDRQ3dHr27eQGUOlTqQZVa79S+qHy9Dy6EiLjSZYnNLWFZgZL9zUAeVGPviVm3Hei3JWONKGyE6uh5
-    node.session.auth.username_in: AgC0Bc3wzAeoK8hyglns7fpn7LAwkNrNuo6RjSdbteKVePbUJclqS+BaDTjMyU/Rq/iNsUZQgI4DRJkiQCZTC33wBbHhHU67nAtYART7rPcSBHA8EaWkADFLQiaflcLx0IK673agmVO84210BDvCkZMf/dSj6Kl2hiwqnGkx5ZQWvO+BbEQeOsD3Mia3DM3fnVcB7QHIsEJI+2QodIm6LVNIMJOGb/5+Ia8M38EVyys+QEEEFsLuGzDqruu0PeMz/hlHSMbjU+c7dieD2UPIttbmIdB8YK7MQV+IwhuOOgqucwYwK+aNpWFwK9+7kOVJRv/bkVIjwv80VuHC8/j87RjyoW51yMYKvovTrNnVJTgf1pHYutKctlJafKRYleEQ+ms6X+hptefxDsStzDDLeuB0ipVpu7R1b/KelgNySH0Z7CRZX7lWE7OMFdAquMKSBmyT4MGtiNYGPWzVC1SE1eI/nB7tpDUz+V77ai+zy3e1Hr3lyWzw+lhc/kJwN498+tPMzMeGqH2AGqA0QvtPo+8CDGz/rDbubNT8ZYrgfU7WrlR/LCyAy0B14wOAJ5IhnXN8TYgi2LKq6yJ1RnOyktOQPrwIKfgH8fGvx9Jne5StThbGRMc0QMKh9qhdhI5kvfnMuoLNQtsgii9EuXOBVKgI9+echEg+2N134HluTyFQV1gaUciT2kJ237az60jCFpgn9vX3E7GgHQ==
-  template:
-    metadata:
-      labels: *labels
-      name: buildroot-hudpi-iscsi
-      namespace: jenkins-jobs
-
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: buildroot-airplaypi-iscsi
-  namespace: jenkins-jobs
-  labels: &labels
-    app.kubernetes.io/component: airplaypi
-    app.kubernetes.io/name: buildroot-airplaypi
-    app.kubernetes.io/part-of: buildroot
-spec:
-  encryptedData:
-    node.session.auth.password: AgAAAH0omRLHXikdZ6mGXPxfQJv59KAgcDpGREhmT2EG3oNrt9Ow3kDQua3oiPdZcxwG5mimJ6nBPEOFRLPYaj46BUWlZWfvDGOVPwaIXOuO6oRvkwXHu7zcu8qIgh2hNcJNNjrRhwxMVa/IYJpQSZDotv0FIw+RQCY58SvuB/viyVjG5EcZYm69dDn9SQD8lIJvtHXRaezKOvSwQmnPsEYbqCnobsTKTciVbRXBkODOAzayZug4UdyeVrexgyqE9Uym/dPLRdnIIuW3mf3z3QVvKfYC89ETa9Rr4q34pb/2b1cuaHjmK40i2HOnLAgkdmnUdsm+0ulqxMTjhlXsAjZcR5qH5TqHnB/lFJxlJfoQsMFV3lcqq909xO4a70/AnTHF+unxzlrQXBQZ0ojO2iEPU2LNniSv12Mq2S6hx2riGD0PvfxmzkdbH6q2tXCn+7Tgwkx10QsSGk01Q/OCvrPKtCuSABfh+ODGJ4kcRFhF9nIi0AaYQytPNeRLgKpcgN64zqbsP1zolhimh/U6RHDEQabufl32Nn7GblaO+eiu9+jK2QpTE5mNg05rA8IFACb+jNdiWViaEIUXSvUjmPj5BhNwqe3AknqdrPOsVq+RYlmRkbiOyJxlVYfjUS/Ps8LGySUtb6tMYhFXqffbmxFY9dVTIhN6U2z6WSgxVzxEIFp5BHpoYOzTdLowOfleFFelmFCMDA6Ovsua3jI=
-    node.session.auth.password_in: AgCZ/LD9ejCea/udtBKSi1rm5RODKd92RE/m2Im9qJNwUlXgBDFFqKXMNf8FperHzZLJYqTzvBZEJcOgI6FdvY5oi+T2cJa10R+V7RM7YFR0Z6ey/JOsUJkf10CdMOWK1UTH8URhcKkaQhKqA956Ew/JZJoWvEnj967hzIkkqrz9SmbaJ1k8Pm0p4SpL9Jmz9rp6KT4bZUZmqHek7HrcFmO+LKtGLDKLIQEMvClZ6xFYG2bTxWhr/tjA2MolZdDZOsqrtSwSrge6e9Ptvk1ZxaO56O7VM2H3MC+s4DwvP7ibFk6/GFGg2P1QTwe1on/KOqZjXsYx4xTzbn+YY9gT0exNgAHtek1h42wOp98oLia3WWaVX0diHnMitXNEuBeK81aJcSjJg/MaHGVDc8yNa5UYBVTO/tYtTiN8FlXLob6moshKxblsSy4DB5RAqhYpZ2NnwHch9E41W1lHbWyGmbUanCP0F5C5CO7TQ9FMUwnFAfJ1NSLT9HzWIG5DPvgBOeUd9BtTuQGxc9qQBmqSPRklQrHycVgpB1KzBZ8qvDzS2+zKOXeuxG+xegR7CEBmLWkCh9WoLXpCp+GYUdY7oC5t+qS0tYaop1Vz70hlyHb9KVVGTwtkqZEyr/Y/Yk5ZWPk0TdgXe/F6awjhTcC54MAJjBaTHbkOSBLtBfvE7ixwMFnqX0HsYTz+nsfWE17GZRW5P+eMWUhysrTSTrw=
-    node.session.auth.username: AgAQhzmnkbpMVTzIKXs/NqoBl3BGCTJNbAcu/nXNkACNbA4oxe5OS8uErOMI4vGeqPGAdgSPsANugu0FTbprVC+7+K499mxddzUFE6JyV/spbA13eMo7at0d9Gwpv3i4hmxBFslED9B2/DPscXK4TOsgvidd+9K/n0RNWz9tRRsl8+vjTM4Hpkh1TrfqCtJvUSnHvhl+j+YVYMTfJrkCfjkxNSNYx1f8ipx3blwvqceZvht8iq0pVLQoj3lA06DdeQii+AGSpGBl9QXsUdxgsoQ93uYh5rZSfDPxNyNr7NADBumkNO5JlJMDgqHNP/vwF54jrE1MnPB0kfDtvRyXpl2GckpqK0CuHhqaLS0+iqymcxcCE0OKpU2Wd+tq3t0CB7IuJ3d+800NtRhAb7qwhrTME5J9yEpWp1ifu/piIaAQRmGm2MUHeDA+pCzY2Xx0S5rW3uC6/2/gvNIVyiaUzTos53PdfdYJKWffbSeBJhkhSMsIpkGASQ1wyGgX5gAzKDWDUyeBK/qwnEdS0EasDA39mGiem5w8t1gi2021SMpH8M81oZ7YeSV2Wu6aZCsJuWYcdRqrM+PGuhgkKNYnelRt1FjAREcCthPFNGquGbPHBzv7wynD4u/En5IzsdsAzec/EJfBxvbGCcRmVaQcxO0DXmk0S7Tl+a+3/E9Dckev1Xd+SV3EOii/1S7Ij4HymJcIMSFO3CGG
-    node.session.auth.username_in: AgAfO2gNFWu82gIk6E0J4rMeRBOTE025fwxwoNx6nMiLvIsyH6FEAqhYAWRgJv68X+u3fYIqfsQ2M2i31G/qvoKhp81hgGNTmOfbfdj3UAafCEotAug7EYjkZWPtr+rHLXaqKheR1FpRQD4Ukbet+JbT9mG3WzVAqPEtQ5xHCXZn6bgBkNdRQgNHnCK/EYjekHNs7qDa7ez4pNPzpOeRR3gffWD5E3q5x/PYBNL+/S8q1n3k+JUVnVdnWhju9BmncnOR5j+1v8IEhvMyZJAlXtl0i3tL/IfOVF2co5i3vffiC607AyhbD/B0SsNThlF63qFm4qmaUbjAMLZfveL52gGjiOXRHOVTiirzWDxqBFm5sz2hOpakK4qgtlahseN7eUfi7hrO3s/DkSYlj2Zd/X2tNUnugLXjl3FONxOp8HLi7muz1Dzyi6iLiHapyIlQZbAhkPbHTUbxaPXWlheDkAfCXBI54G2DZcI5xGgQq3Du2nVurKPk52ro3FO8VXAh0SUr6VhN9MuOcWzUWn/AHztTb6C6ABMBpkAw/mYmo5VBKUiUo+c6RpcD0a7kIKx8iELdp/fgsCaCWiQfIl0HV1Dx08FmTvA/h0/idW6SCGsBD5h7O8t/y2QUbhytln0L+TUOimseeCtu+N0TzYKU4+tmWPITWGojmw6panOkI5MwM4CbWLHI9K57l+v24pRS2XyQepaM6iTYzg==
-  template:
-    metadata:
-      name: buildroot-airplaypi-iscsi
-      namespace: jenkins-jobs
-      labels: *labels
--- a/music-assistant/ingress.yaml
+++ b/music-assistant/ingress.yaml
@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: music-assistant
+  labels:
+    app.kubernetes.io/name: music-assistant
+    app.kubernetes.io/component: music-assistant
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: music.pyrocufflink.blue
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: music-assistant
+            port:
+              name: http
--- a/music-assistant/kustomization.yaml
+++ b/music-assistant/kustomization.yaml
@@ -0,0 +1,21 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: music-assistant
+
+labels:
+- pairs:
+    app.kubernetes.io/instance: music-assistant
+  includeSelectors: true
+- pairs:
+    app.kubernetes.io/part-of: music-assistant
+  includeTemplates: true
+
+resources:
+- namespace.yaml
+- music-assistant.yaml
+- ingress.yaml
+
+images:
+- name: ghcr.io/music-assistant/server
+  newTag: 2.6.0b18
--- a/music-assistant/music-assistant.yaml
+++ b/music-assistant/music-assistant.yaml
@@ -0,0 +1,78 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: music-assistant
+  labels: &labels
+    app.kubernetes.io/name: music-assistant
+    app.kubernetes.io/component: music-assistant
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: music-assistant
+  labels: &labels
+    app.kubernetes.io/name: music-assistant
+    app.kubernetes.io/component: music-assistant
+spec:
+  ports:
+  - port: 8095
+    name: http
+  selector: *labels
+
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: music-assistant
+  labels: &labels
+    app.kubernetes.io/name: music-assistant
+    app.kubernetes.io/component: music-assistant
+spec:
+  serviceName: music-assistant
+  selector:
+    matchLabels: *labels
+  template:
+    metadata:
+      labels: *labels
+    spec:
+      containers:
+      - name: music-assistant
+        image: ghcr.io/music-assistant/server
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 8095
+          name: http
+        readinessProbe: &probe
+          httpGet:
+            port: http
+            path: /
+          failureThreshold: 3
+          periodSeconds: 60
+          successThreshold: 1
+          timeoutSeconds: 1
+        startupProbe:
+          <<: *probe
+          failureThreshold: 90
+          periodSeconds: 1
+        volumeMounts:
+          - mountPath: /data
+            name: music-assistant-data
+            subPath: data
+      dnsPolicy: ClusterFirstWithHostNet
+      hostNetwork: true
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 8095
+        runAsGroup: 8095
+        fsGroup: 8095
+      volumes:
+      - name: music-assistant-data
+        persistentVolumeClaim:
+          claimName: music-assistant
--- a/music-assistant/namespace.yaml
+++ b/music-assistant/namespace.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: music-assistant
+  labels:
+    app.kubernetes.io/name: music-assistant
--- a/ntfy/kustomization.yaml
+++ b/ntfy/kustomization.yaml
@@ -20,4 +20,4 @@ configMapGenerator:

 images:
 - name: docker.io/binwiederhier/ntfy
-  newTag: v2.13.0
+  newTag: v2.14.0
--- a/paperless-ngx/kustomization.yaml
+++ b/paperless-ngx/kustomization.yaml
@@ -49,4 +49,4 @@ images:
 - name: docker.io/gotenberg/gotenberg
  newTag: 8.21.1
 - name: docker.io/apache/tika
-  newTag: 3.2.1.0
+  newTag: 3.2.2.0
--- a/vaultwarden/kustomization.yaml
+++ b/vaultwarden/kustomization.yaml
@@ -27,4 +27,4 @@ configMapGenerator:

 images:
 - name: ghcr.io/dani-garcia/vaultwarden
-  newTag: 1.34.1-alpine
+  newTag: 1.34.3-alpine
Author	SHA1	Message	Date
bot	9fac946183	zwavejs2mqtt: Update to 11.2.1	2025-08-30 11:32:08 +00:00
bot	04b03a61e5	piper: Update to 1.6.3	2025-08-30 11:32:08 +00:00
bot	3a6b96a5da	home-assistant: Update to 2025.8.3	2025-08-30 11:32:07 +00:00
Dustin	e4f3e8254e	Merge pull request 'ntfy: Update to 2.14.0' (#79 ) from updatebot/ntfy into master Reviewed-on: #79	2025-08-16 19:20:11 +00:00
Dustin	8e968703b3	Merge pull request 'authelia: Update to 4.39.6' (#80 ) from updatebot/authelia into master Reviewed-on: #80	2025-08-16 19:17:48 +00:00
Dustin	a5fdaff145	Merge pull request 'tika: Update to 3.2.2.0' (#78 ) from updatebot/paperless-ngx into master Reviewed-on: #78	2025-08-16 19:17:18 +00:00
bot	6f3919fe06	authelia: Update to 4.39.6	2025-08-16 11:32:12 +00:00
bot	e140e9d49d	ntfy: Update to 2.14.0	2025-08-16 11:32:10 +00:00
bot	f24285d761	tika: Update to 3.2.2.0	2025-08-16 11:32:09 +00:00
Dustin C. Hatch	8a6b41bacc	Revert "music-assistant: Tell players to restart on startup" This hacky work-around is no longer necessary, as I've figured out why the players don't (always) get rediscovered when the server restarts. It turns out, Avahi on the firewall was caching responses to the mDNS PTR requests Music Assistant makes. Rather than forward the requests to the other VLANs, it would respond with its cached information, but in a way that Music Assistant didn't understand. Setting `cache-entries-max` to `0` in `avahi-daemon.conf` on the firewall resolved the issue. This reverts commit `42a7964991`.	2025-08-12 20:17:52 -05:00
Dustin C. Hatch	e0e3eab8b6	Merge branch 'music-assistant'	2025-08-11 21:00:02 -05:00
Dustin C. Hatch	42a7964991	music-assistant: Tell players to restart on startup I haven't fully determined why, but when the Music Assistant server restarts, it marks the _shairport-sync_ players as offline and will not allow playing to them. The only way I have found to work around this is to restart the players after the server restarts. As that's pretty cumbersome and annoying, I naturally want to automate it, so I've created this rudimentary synchronization technique using _ntfy_: each player listens for notifications on a specific topic, and upon receiving one, tells _shairport-sync_ to exit. With the `Restart=` property configured on the _shairport-sync.service_ unit, _systemd_ will restart the service, which causes Music Assistant to discover the player again.	2025-08-11 20:59:54 -05:00
Dustin C. Hatch	ae1d952297	music-assistant: Initial deployment _Music Assistant_ is pretty straightforward to deploy, despite upstream's apparent opinion otherwise. It just needs a small persistent volume for its media index and customization. It does need to use the host network namespace, though, in order to receive multicast announcements from e.g. AirPlay players, as it doesn't have any way of statically configuring them.	2025-08-11 20:43:28 -05:00
Dustin C. Hatch	4977f513c5	dch-webhooks: Add role for Jenkins to deploy Jenkins needs to be able to patch the Deployment to trigger a restart after it builds a new container image for _dch-webhooks_. Note that this manifest must be applied on its own without Kustomize. Kustomize seems to think the `dch-webhooks` in `resourceNames` refers to the ConfigMap it manages and "helpfully" renames it with the name suffix hash. It's _not_ the ConfigMap, though, but there's not really any way to tell it this.	2025-08-10 17:43:02 -05:00
Dustin C. Hatch	3960552f99	calico: Update to v3.30.2	2025-08-08 11:00:27 -05:00
Dustin C. Hatch	aa27579582	cert-manager: Drop dustin.hatch.name certificate This site now obtains its own certificate using Apache _mod_md_.	2025-08-07 11:26:23 -05:00
Dustin C. Hatch	2b109589c2	h-a/{piper,whisper}: Prefer x86_64 nodes Without a node affinity rule, Kubernetes applies equal weight to the "big" x86_64 nodes and the "small" aarch64 ones. Since we would really rather Piper and Whisper _not_ run on a Raspberry Pi, we need the rule to express this.	2025-08-07 10:31:10 -05:00
Dustin C. Hatch	ea4e45e479	Revert "h-a: Schedule Piper, Whisper, Mosquitto with HA" As it turns out, although Home Assistant itself works perfectly fine on a Raspberry Pi, Piper and Whisper do not. They are _much_ too slow to respond to voice commands. This reverts commit `32666aa628`.	2025-08-07 10:26:37 -05:00
Dustin	3896dd67eb	Merge pull request 'home-assistant: Update to 2025.7.2' (#73 ) from updatebot/home-assistant into master Reviewed-on: #73	2025-08-05 14:17:24 +00:00
Dustin	c5545445b6	Merge pull request 'firefly-iii: Update to 6.2.21' (#74 ) from updatebot/firefly-iii into master Reviewed-on: #74	2025-08-03 16:41:17 +00:00
Dustin	2a7d531aa3	Merge pull request 'authelia: Update to 4.39.5' (#75 ) from updatebot/authelia into master Reviewed-on: #75	2025-08-03 16:35:18 +00:00
Dustin	1998abefbd	Merge pull request 'vaultwarden: Update to 1.34.3' (#76 ) from updatebot/vaultwarden into master Reviewed-on: #76	2025-08-03 16:34:09 +00:00
bot	b2aa70dff0	vaultwarden: Update to 1.34.3	2025-08-02 11:32:29 +00:00
bot	28c7f98cb5	authelia: Update to 4.39.5	2025-08-02 11:32:19 +00:00
bot	14d6af7886	firefly-iii: Update to 6.2.21	2025-08-02 11:32:11 +00:00
bot	a4d05c7288	zwavejs2mqtt: Update to 11.0.1	2025-08-02 11:32:07 +00:00
bot	c10aef5d65	zigbee2mqtt: Update to 2.6.0	2025-08-02 11:32:07 +00:00
bot	474b068708	home-assistant: Update to 2025.7.4	2025-08-02 11:32:06 +00:00