Update quay.io/openbao/openbao Docker tag to v2.6.0

.woodpecker/build-images.yaml

@@ -7,7 +7,7 @@ when:
 
 steps:
   - name: Get registry creds from OpenBao
-    image: quay.io/openbao/openbao:2.6.1
+    image: quay.io/openbao/openbao:2.6.0
     environment:
       VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
       ROLE_ID:
@@ -57,7 +57,7 @@ steps:
     depends_on: ["Get registry creds from OpenBao"]
 
   - name: Invalidate OpenBao token
-    image: quay.io/openbao/openbao:2.6.1
+    image: quay.io/openbao/openbao:2.6.0
     environment:
       VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
     commands:

.woodpecker/flux-reconcile-source.yaml

@@ -6,7 +6,7 @@ skip_clone: true
 
 steps:
   - name: Get kubernetes access from OpenBao
-    image: quay.io/openbao/openbao:2.6.1
+    image: quay.io/openbao/openbao:2.6.0
     environment:
       VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
       ROLE_ID:
@@ -41,7 +41,7 @@ steps:
     commands:
       - flux reconcile source git flux-system
   - name: Invalidate OpenBao token
-    image: quay.io/openbao/openbao:2.6.1
+    image: quay.io/openbao/openbao:2.6.0
     environment:
       VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
     commands:

.woodpecker/renovate.yaml

@@ -6,7 +6,7 @@ skip_clone: true
 
 steps:
   - name: Get renovate token from OpenBao
-    image: quay.io/openbao/openbao:2.6.1
+    image: quay.io/openbao/openbao:2.6.0
     environment:
       VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
       ROLE_ID:
@@ -35,7 +35,7 @@ steps:
       - export GITHUB_COM_TOKEN=$(cat /woodpecker/github_com_token)
       - /usr/local/sbin/renovate-entrypoint.sh renovate
   - name: Invalidate OpenBao token
-    image: quay.io/openbao/openbao:2.6.1
+    image: quay.io/openbao/openbao:2.6.0
     environment:
       VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
     commands:

apps/authentik/release.yaml

@@ -18,7 +18,7 @@ spec:
   chart:
     spec:
       chart: authentik
-      version: 2026.5.5
+      version: 2026.5.4
       sourceRef:
         kind: HelmRepository
         name: authentik

apps/immich/release.yaml

@@ -18,7 +18,7 @@ spec:
   chart:
     spec:
       chart: immich
-      version: 2.0.2
+      version: 2.0.1
       sourceRef:
         kind: HelmRepository
         name: secustor

apps/kaneo/release.yaml

@@ -8,7 +8,7 @@ spec:
   interval: 24h
   url: https://github.com/usekaneo/kaneo.git
   ref:
-    tag: v2.9.8
+    tag: v2.9.0
   ignore: |
     # exclude all
     /*
@@ -54,7 +54,7 @@ spec:
     
     kaneo:
       image:
-        tag: "2.9.8"  # renovate: depName=ghcr.io/usekaneo/kaneo registryUrl=https://ghcr.io
+        tag: "2.9.0"  # renovate: depName=ghcr.io/usekaneo/kaneo registryUrl=https://ghcr.io
       env:
         clientUrl: "https://kaneo.lumpiasty.xyz"
         disablePasswordRegistration: true

apps/llama/deployment.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: supervisord
-          image: gitea.lumpiasty.xyz/lumpiasty/supervisord:latest@sha256:c7adeeac86ee39b1ce9cd68ff2487c586c4f469569d1aa08cdddae693248751c
+          image: gitea.lumpiasty.xyz/lumpiasty/supervisord:latest@sha256:f88d173bb455bb759400c3ef541c194583427693b91d17688fe6f2cb79adc3a9
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

docker/supervisord/Dockerfile

@@ -1,10 +1,9 @@
-FROM debian:13.6
+FROM debian:13.5
 
 ENV DEBIAN_FRONTEND=noninteractive
 
 RUN apt update && apt install -y --no-install-recommends\
     curl wget vim \
-    ca-certificates \
     build-essential cmake libvulkan-dev glslc spirv-headers libssl-dev git \
     mesa-utils mesa-vulkan-drivers \
     supervisor \

infra/controllers/cilium.yaml

@@ -23,7 +23,7 @@ spec:
   chart:
     spec:
       chart: cilium
-      version: 1.19.6
+      version: 1.19.5
       sourceRef:
         kind: HelmRepository
         name: cilium

infra/controllers/coredns.yaml

@@ -110,7 +110,7 @@ spec:
         kubernetes.io/os: linux
       containers:
         - name: coredns
-          image: registry.k8s.io/coredns/coredns:v1.14.6
+          image: registry.k8s.io/coredns/coredns:v1.14.4
           imagePullPolicy: IfNotPresent
           args: ["-conf", "/etc/coredns/Corefile"]
           ports:

infra/controllers/dns-public.yaml

@@ -97,7 +97,7 @@ spec:
           env:
             - name: GOMEMLIMIT
               value: 161MiB
-          image: registry.k8s.io/coredns/coredns:v1.14.6
+          image: registry.k8s.io/coredns/coredns:v1.14.4
           imagePullPolicy: IfNotPresent
           livenessProbe:
             failureThreshold: 5

infra/controllers/openbao.yaml

@@ -23,7 +23,7 @@ spec:
   chart:
     spec:
       chart: openbao
-      version: 0.28.5
+      version: 0.28.4
       sourceRef:
         kind: HelmRepository
         name: openbao

talos/patches/anapistula-delrosalae.patch

@@ -28,4 +28,3 @@ machine:
     # arrives too late. Work around using kernel args:
     extraKernelArgs:
       - amdgpu.runpm=1
-      - amdgpu.lockup_timeout=0,120000,0,0