Update Helm release valkey to v0.12.0

Merge pull request 'Update Helm release authentik to v2026.8.1' (#418 ) from renovate/authentik-2026.x into fresh-start
Update Helm release authentik to v2026.8.1
2026-09-03 02:02:13 +00:00 · 2026-09-02 02:01:45 +00:00 · 2026-09-02 02:01:38 +00:00 · 2026-09-01 02:01:37 +00:00 · 2026-09-01 02:01:34 +00:00 · 2026-09-01 02:01:33 +00:00
32 changed files with 147 additions and 805 deletions
@@ -2,11 +2,12 @@ when:
  - event: push
    path:
      include:
-        - mikrotik/coredns/**
+        - docker/**
+        - .woodpecker/build-images.yaml

 steps:
  - name: Get registry creds from OpenBao
-    image: quay.io/openbao/openbao:2.5.5
+    image: quay.io/openbao/openbao:2.6.2
    environment:
      VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
      ROLE_ID:
@@ -21,8 +22,8 @@ steps:
      - 'printf "PLUGIN_USERNAME=%s\n" "$(bao kv get -mount secret -field REGISTRY_USERNAME container-registry)" > /woodpecker/registry.env'
      - 'printf "PLUGIN_PASSWORD=%s\n" "$(bao kv get -mount secret -field REGISTRY_PASSWORD container-registry)" >> /woodpecker/registry.env'

-  - name: Build and push
-    image: woodpeckerci/plugin-docker-buildx:6.1.0
+  - name: Build and push mikrotik coredns
+    image: woodpeckerci/plugin-docker-buildx:6.1.1
    privileged: true
    settings:
      registry: gitea.lumpiasty.xyz
@@ -31,12 +32,32 @@ steps:
      tags:
        - latest
        - ${CI_COMMIT_SHA:0:8}
-      dockerfile: mikrotik/coredns/Dockerfile
-      context: mikrotik/coredns/
+      dockerfile: docker/coredns/Dockerfile
+      context: docker/coredns/
      env_file: /woodpecker/registry.env
+      cache_images:
+        - gitea.lumpiasty.xyz/lumpiasty/coredns-mikrotik:buildcache
+    depends_on: ["Get registry creds from OpenBao"]
+
+  - name: Build and push supervisord
+    image: woodpeckerci/plugin-docker-buildx:6.1.1
+    privileged: true
+    settings:
+      registry: gitea.lumpiasty.xyz
+      repo: gitea.lumpiasty.xyz/lumpiasty/supervisord
+      platforms: linux/amd64
+      tags:
+        - latest
+        - ${CI_COMMIT_SHA:0:8}
+      dockerfile: docker/supervisord/Dockerfile
+      context: docker/supervisord/
+      env_file: /woodpecker/registry.env
+      cache_images:
+        - gitea.lumpiasty.xyz/lumpiasty/supervisord:buildcache
+    depends_on: ["Get registry creds from OpenBao"]

  - name: Invalidate OpenBao token
-    image: quay.io/openbao/openbao:2.5.5
+    image: quay.io/openbao/openbao:2.6.2
    environment:
      VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
    commands:
@@ -44,3 +65,6 @@ steps:
      - bao write -f auth/token/revoke-self
    when:
      - status: [success, failure]
+    depends_on:
+      - Build and push mikrotik coredns
+      - Build and push supervisord
@@ -6,7 +6,7 @@ skip_clone: true

 steps:
  - name: Get kubernetes access from OpenBao
-    image: quay.io/openbao/openbao:2.5.5
+    image: quay.io/openbao/openbao:2.6.2
    environment:
      VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
      ROLE_ID:
@@ -35,13 +35,13 @@ steps:
          --namespace flux-system
      - kubectl config use-context cluster
  - name: Reconcile git source
-    image: ghcr.io/fluxcd/flux-cli:v2.9.0
+    image: ghcr.io/fluxcd/flux-cli:v2.9.5
    environment:
      KUBECONFIG: /woodpecker/kubeconfig
    commands:
      - flux reconcile source git flux-system
  - name: Invalidate OpenBao token
-    image: quay.io/openbao/openbao:2.5.5
+    image: quay.io/openbao/openbao:2.6.2
    environment:
      VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
    commands:
@@ -6,7 +6,7 @@ skip_clone: true

 steps:
  - name: Get renovate token from OpenBao
-    image: quay.io/openbao/openbao:2.5.5
+    image: quay.io/openbao/openbao:2.6.2
    environment:
      VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
      ROLE_ID:
@@ -21,7 +21,7 @@ steps:
      - bao kv get -mount secret -field RENOVATE_TOKEN renovate > /woodpecker/renovate_token
      - bao kv get -mount secret -field GITHUB_COM_TOKEN renovate > /woodpecker/github_com_token
  - name: Run Renovate
-    image: renovate/renovate:43
+    image: renovate/renovate:44
    pull: true
    environment:
      RENOVATE_AUTODISCOVER: "true"
@@ -35,7 +35,7 @@ steps:
      - export GITHUB_COM_TOKEN=$(cat /woodpecker/github_com_token)
      - /usr/local/sbin/renovate-entrypoint.sh renovate
  - name: Invalidate OpenBao token
-    image: quay.io/openbao/openbao:2.5.5
+    image: quay.io/openbao/openbao:2.6.2
    environment:
      VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
    commands:
@@ -18,7 +18,7 @@ spec:
  chart:
    spec:
      chart: authentik
-      version: 2026.5.3
+      version: 2026.8.1
      sourceRef:
        kind: HelmRepository
        name: authentik
@@ -17,13 +17,15 @@ spec:
  chart:
    spec:
      chart: gitea
-      version: 12.6.0
+      version: 12.7.0
      sourceRef:
        kind: HelmRepository
        name: gitea-charts
        namespace: gitea
      interval: 12h
  values:
+    image:
+      tag: 1.27.2 # REMOVE ME after new helm chart version includes this update
    postgresql-ha:
      enabled: false

@@ -7,7 +7,7 @@ metadata:
  name: gitea-valkey-primary-lvmhdd-0
  namespace: openebs
 spec:
-  capacity: 1Gi
+  capacity: "4294967296"
  ownerNodeID: anapistula-delrosalae
  shared: "yes"
  thinProvision: "no"
@@ -20,7 +20,7 @@ metadata:
  name: gitea-valkey-primary-lvmhdd-0
 spec:
  capacity:
-    storage: 1Gi
+    storage: 4Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
@@ -41,6 +41,6 @@ spec:
    - ReadWriteOnce
  resources:
    requests:
-      storage: 1Gi
+      storage: 4Gi
  storageClassName: hdd-lvmpv
  volumeName: gitea-valkey-primary-lvmhdd-0
@@ -18,7 +18,7 @@ spec:
  chart:
    spec:
      chart: valkey
-      version: 0.10.0
+      version: 0.12.0
      sourceRef:
        kind: HelmRepository
        name: valkey
@@ -18,7 +18,7 @@ spec:
  chart:
    spec:
      chart: immich
-      version: 2.0.0
+      version: 2.0.3
      sourceRef:
        kind: HelmRepository
        name: secustor
@@ -8,7 +8,7 @@ spec:
  interval: 24h
  url: https://github.com/usekaneo/kaneo.git
  ref:
-    tag: v2.9.0
+    tag: v2.22.0
  ignore: |
    # exclude all
    /*
@@ -53,8 +53,6 @@ spec:
      enabled: false
    
    kaneo:
-      image:
-        tag: "2.9.0"  # renovate: depName=ghcr.io/usekaneo/kaneo registryUrl=https://ghcr.io
      env:
        clientUrl: "https://kaneo.lumpiasty.xyz"
        disablePasswordRegistration: true
@@ -1,444 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/mostlygeek/llama-swap/refs/heads/main/config-schema.json
-healthCheckTimeout: 600
-logToStdout: "both" # proxy and upstream
-
-macros:
-  base_args: "--no-warmup --port ${PORT} --mlock --no-mmap"
-  common_args: "--fit-target 256 --no-warmup --port ${PORT} --no-mmap -tb 12 -t 6"
-  cpu_args: "--no-warmup --port ${PORT} -ngl 0"
-  ctx_64k: "--ctx-size 65536"
-  ctx_128k: "--ctx-size 131072"
-  ctx_256k: "--ctx-size 131072"
-  qwen35_think_args:   "--temp 1.0 --top-p 0.95 --top-k 20 --min-p 0.00 -ctk q4_0 -ctv q4_0 --presence_penalty 1.5 --reasoning on"
-  qwen35_nothink_args: "--temp 0.7 --top-p 0.80 --top-k 20 --min-p 0.00 -ctk q4_0 -ctv q4_0 --presence_penalty 1.5 --reasoning off"
-  qwen35_35b_heretic_mmproj: "--mmproj-url https://huggingface.co/unsloth/Qwen3.5-35B-A3B-GGUF/resolve/main/mmproj-F16.gguf --mmproj /root/.cache/llama.cpp/unsloth_Qwen3.5-35B-A3B-GGUF_mmproj-F16.gguf"
-  qwen35_4b_heretic_mmproj: "--mmproj-url https://huggingface.co/unsloth/Qwen3.5-4B-GGUF/resolve/main/mmproj-F16.gguf --mmproj /root/.cache/llama.cpp/unsloth_Qwen3.5-4B-GGUF_mmproj-F16.gguf"
-  gemma4_sampling: "--temp 1.0 --top-p 0.95 --top-k 64 -ctk q4_0 -ctv q4_0"
-  gemma4_nothink_sampling: "--temp 1.0 --top-p 0.95 --top-k 64 -ctk q4_0 -ctv q4_0 --reasoning off"
-
-hooks:
-  on_startup:
-    preload:
-      - "Qwen3.5-0.8B-GGUF-nothink:Q4_K_XL"
-      - "parakeet-tdt_ctc-1.1b"
-
-# matrix replaces groups (they are mutually exclusive).
-# The small 0.8B model runs alongside any LLM.
-# FLUX runs alone — it needs all available VRAM and will evict the 0.8B first.
-matrix:
-  vars:
-    q8: "Qwen3.5-0.8B-GGUF-nothink:Q4_K_XL"
-    stt: "parakeet-tdt_ctc-1.1b"
-    flux: "flux2-klein-4b:Q4_K_M"
-    coder: "Qwen3-Coder-Next-GGUF:Q4_K_M"
-    q35t: "Qwen3.5-35B-A3B-GGUF:Q4_K_M"
-    q35nt: "Qwen3.5-35B-A3B-GGUF-nothink:Q4_K_M"
-    q35ht: "Qwen3.5-35B-A3B-heretic-GGUF:Q4_K_M"
-    q35hnt: "Qwen3.5-35B-A3B-heretic-GGUF-nothink:Q4_K_M"
-    q4t: "Qwen3.5-4B-GGUF:Q4_K_M"
-    q4nt: "Qwen3.5-4B-GGUF-nothink:Q4_K_M"
-    q4ht: "Qwen3.5-4B-heretic-GGUF:Q4_K_M"
-    q4hnt: "Qwen3.5-4B-heretic-GGUF-nothink:Q4_K_M"
-    g26xl: "gemma-4-26B-A4B-it-qat:UD-Q4_K_XL"
-    g26xlnt: "gemma-4-26B-A4B-it-qat-nothink:UD-Q4_K_XL"
-    g26mtp: "gemma-4-26B-A4B-it-qat-mtp:UD-Q4_K_XL"
-    g26mtpnt: "gemma-4-26B-A4B-it-qat-mtp-nothink:UD-Q4_K_XL"
-    g26ht: "SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF:UD-Q4_K_XL"
-    g26hnt: "SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF-nothink:UD-Q4_K_XL"
-    g26hmtp: "SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF-mtp:UD-Q4_K_XL"
-    g26hmnt: "SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF-mtp-nothink:UD-Q4_K_XL"
-    ge4qat: "unsloth/gemma-4-E4B-it-qat-GGUF:UD-Q4_K_XL"
-    ge4qatnt: "unsloth/gemma-4-E4B-it-qat-GGUF-nothink:UD-Q4_K_XL"
-    ge2qat: "unsloth/gemma-4-E2B-it-qat-GGUF:UD-Q4_K_XL"
-    ge2qatnt: "unsloth/gemma-4-E2B-it-qat-GGUF-nothink:UD-Q4_K_XL"
-    ge4mtp: "unsloth/gemma-4-E4B-it-qat-GGUF-mtp:UD-Q4_K_XL"
-    ge4mtpnt: "unsloth/gemma-4-E4B-it-qat-GGUF-mtp-nothink:UD-Q4_K_XL"
-    ge4ht: "llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF:Q4_K_M"
-    ge4hnt: "llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF-nothink:Q4_K_M"
-    ge4hmtp: "llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF-mtp:Q4_K_M"
-    ge4hmnt: "llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF-mtp-nothink:Q4_K_M"
-    q36t: "unsloth/Qwen3.6-35B-A3B-GGUF:UD-Q4_K_XL"
-    q36nt: "unsloth/Qwen3.6-35B-A3B-GGUF-nothink:UD-Q4_K_XL"
-    haut: "HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive:Q4_K_M"
-    haunt: "HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive-nothink:Q4_K_M"
-    mtpt: "unsloth/Qwen3.6-35B-A3B-MTP-GGUF:Q4_K_M"
-    mtpnt: "unsloth/Qwen3.6-35B-A3B-MTP-GGUF-nothink:Q4_K_M"
-
-  evict_costs:
-    flux: 10  # large files, slow to reload
-
-  sets:
-    # any LLM can run alongside the small always-on model + STT + TTS (all CPU, no VRAM cost)
-    with_q8: "(coder | q35t | q35nt | q35ht | q35hnt | q4t | q4nt | q4ht | q4hnt | g26xl | g26xlnt | g26mtp | g26mtpnt | g26ht | g26hnt | g26hmtp | g26hmnt | ge4qat | ge4qatnt | ge2qat | ge2qatnt | ge4mtp | ge4mtpnt | ge4ht | ge4hnt | ge4hmtp | ge4hmnt | q36t | q36nt | haut | haunt | mtpt | mtpnt) & q8 & stt"
-    # FLUX runs alone — evicts everything including q8, but keeps STT for voice during image gen
-    image_gen: "flux & stt"
-
-
-models:
-  "Qwen3-Coder-Next-GGUF:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf unsloth/Qwen3-Coder-Next-GGUF:Q4_K_M
-        --ctx-size 65536
-        --predict 8192
-        --temp 1.0
-        --min-p 0.01
-        --top-p 0.95
-        --top-k 40
-        --repeat-penalty 1.0
-        -ctk q4_0 -ctv q4_0
-        ${common_args}
-
-  "Qwen3.5-35B-A3B-GGUF:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf unsloth/Qwen3.5-35B-A3B-GGUF:Q4_K_M
-        ${ctx_256k}
-        ${qwen35_think_args}
-        ${common_args}
-
-  "Qwen3.5-35B-A3B-GGUF-nothink:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf unsloth/Qwen3.5-35B-A3B-GGUF:Q4_K_M
-        ${ctx_256k}
-        ${qwen35_nothink_args}
-        ${common_args}
-
-  # The "heretic" version does not provide the mmproj
-  # so providing url to the one from the non-heretic version.
-  "Qwen3.5-35B-A3B-heretic-GGUF:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf mradermacher/Qwen3.5-35B-A3B-heretic-GGUF:Q4_K_M
-        ${qwen35_35b_heretic_mmproj}
-        ${ctx_256k}
-        ${qwen35_think_args}
-        ${common_args}
-
-  "Qwen3.5-35B-A3B-heretic-GGUF-nothink:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf mradermacher/Qwen3.5-35B-A3B-heretic-GGUF:Q4_K_M
-        ${qwen35_35b_heretic_mmproj}
-        ${ctx_256k}
-        ${qwen35_nothink_args}
-        ${common_args}
-
-  "Qwen3.5-0.8B-GGUF-nothink:Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/Qwen3.5-0.8B-GGUF:Q4_K_XL
-        --ctx-size 4096
-        ${qwen35_nothink_args}
-        ${base_args}
-
-  "Qwen3.5-4B-GGUF:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf unsloth/Qwen3.5-4B-GGUF:Q4_K_M
-        ${ctx_128k}
-        ${qwen35_think_args}
-        ${common_args}
-
-  "Qwen3.5-4B-GGUF-nothink:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf unsloth/Qwen3.5-4B-GGUF:Q4_K_M
-        ${ctx_128k}
-        ${qwen35_nothink_args}
-        ${common_args}
-
-  "Qwen3.5-4B-heretic-GGUF:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf mradermacher/Qwen3.5-4B-heretic-GGUF:Q4_K_M
-        ${qwen35_4b_heretic_mmproj}
-        ${ctx_128k}
-        ${qwen35_think_args}
-        ${common_args}
-
-  "Qwen3.5-4B-heretic-GGUF-nothink:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf mradermacher/Qwen3.5-4B-heretic-GGUF:Q4_K_M
-        ${qwen35_4b_heretic_mmproj}
-        ${ctx_128k}
-        ${qwen35_nothink_args}
-        ${common_args}
-
-  "gemma-4-26B-A4B-it-qat:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-26B-A4B-it-qat-GGUF:UD-Q4_K_XL \
-        ${ctx_256k}
-        ${gemma4_sampling}
-        ${common_args}
-
-  "gemma-4-26B-A4B-it-qat-nothink:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-26B-A4B-it-qat-GGUF:UD-Q4_K_XL \
-        ${ctx_256k}
-        ${gemma4_nothink_sampling}
-        ${common_args}
-
-  "gemma-4-26B-A4B-it-qat-mtp:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-26B-A4B-it-qat-GGUF:UD-Q4_K_XL \
-        --spec-draft-hf unsloth/gemma-4-26B-A4B-it-qat-GGUF:Q8_0-MTP \
-        --spec-type draft-mtp
-        --spec-draft-n-max 1
-        --swa-full
-        --kv-unified
-        --parallel 1
-        ${ctx_256k}
-        ${gemma4_sampling}
-        ${common_args}
-
-  "gemma-4-26B-A4B-it-qat-mtp-nothink:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-26B-A4B-it-qat-GGUF:UD-Q4_K_XL \
-        --spec-draft-hf unsloth/gemma-4-26B-A4B-it-qat-GGUF:Q8_0-MTP \
-        --spec-type draft-mtp
-        --spec-draft-n-max 1
-        --swa-full
-        --kv-unified
-        --parallel 1
-        ${ctx_256k}
-        ${gemma4_nothink_sampling}
-        ${common_args}
-
-  "SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF:UD-Q4_K_XL \
-        ${ctx_256k}
-        ${gemma4_sampling}
-        ${common_args}
-
-  "SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF-nothink:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF:UD-Q4_K_XL \
-        ${ctx_256k}
-        ${gemma4_nothink_sampling}
-        ${common_args}
-
-  # The heretic QAT repo does not ship an MTP drafter,
-  # so borrow the one from the non-heretic unsloth QAT repo.
-  "SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF-mtp:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF:UD-Q4_K_XL \
-        --spec-draft-hf unsloth/gemma-4-26B-A4B-it-qat-GGUF:Q8_0-MTP \
-        --spec-type draft-mtp
-        --spec-draft-n-max 1
-        --swa-full
-        --kv-unified
-        --parallel 1
-        ${ctx_256k}
-        ${gemma4_sampling}
-        ${common_args}
-
-  "SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF-mtp-nothink:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF:UD-Q4_K_XL \
-        --spec-draft-hf unsloth/gemma-4-26B-A4B-it-qat-GGUF:Q8_0-MTP \
-        --spec-type draft-mtp
-        --spec-draft-n-max 1
-        --swa-full
-        --kv-unified
-        --parallel 1
-        ${ctx_256k}
-        ${gemma4_nothink_sampling}
-        ${common_args}
-
-  "unsloth/gemma-4-E4B-it-qat-GGUF:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-E4B-it-qat-GGUF:UD-Q4_K_XL \
-        ${ctx_128k}
-        ${gemma4_sampling}
-        ${common_args}
-
-  "unsloth/gemma-4-E4B-it-qat-GGUF-nothink:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-E4B-it-qat-GGUF:UD-Q4_K_XL \
-        ${ctx_128k}
-        ${gemma4_nothink_sampling}
-        ${common_args}
-
-  "unsloth/gemma-4-E2B-it-qat-GGUF:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-E2B-it-qat-GGUF:UD-Q4_K_XL \
-        ${ctx_128k}
-        ${gemma4_sampling}
-        ${common_args}
-
-  "unsloth/gemma-4-E2B-it-qat-GGUF-nothink:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-E2B-it-qat-GGUF:UD-Q4_K_XL \
-        ${ctx_128k}
-        ${gemma4_nothink_sampling}
-        ${common_args}
-
-  "unsloth/gemma-4-E4B-it-qat-GGUF-mtp:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-E4B-it-qat-GGUF:UD-Q4_K_XL \
-        --spec-draft-hf unsloth/gemma-4-E4B-it-qat-GGUF:Q8_0-MTP \
-        --spec-type draft-mtp
-        --spec-draft-n-max 1
-        --swa-full
-        --kv-unified
-        --parallel 1
-        ${ctx_128k}
-        ${gemma4_sampling}
-        ${common_args}
-
-  "unsloth/gemma-4-E4B-it-qat-GGUF-mtp-nothink:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-E4B-it-qat-GGUF:UD-Q4_K_XL \
-        --spec-draft-hf unsloth/gemma-4-E4B-it-qat-GGUF:Q8_0-MTP \
-        --spec-type draft-mtp
-        --spec-draft-n-max 1
-        --swa-full
-        --kv-unified
-        --parallel 1
-        ${ctx_128k}
-        ${gemma4_nothink_sampling}
-        ${common_args}
-
-  "llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF:Q4_K_M \
-        ${ctx_128k}
-        ${gemma4_sampling}
-        ${common_args}
-
-  "llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF-nothink:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF:Q4_K_M \
-        ${ctx_128k}
-        ${gemma4_nothink_sampling}
-        ${common_args}
-
-  "llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF-mtp:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF:Q4_K_M \
-        --spec-draft-hf unsloth/gemma-4-E4B-it-qat-GGUF:Q8_0-MTP \
-        --spec-type draft-mtp
-        --spec-draft-n-max 1
-        --swa-full
-        --kv-unified
-        --parallel 1
-        ${ctx_128k}
-        ${gemma4_sampling}
-        ${common_args}
-
-  "llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF-mtp-nothink:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF:Q4_K_M \
-        --spec-draft-hf unsloth/gemma-4-E4B-it-qat-GGUF:Q8_0-MTP \
-        --spec-type draft-mtp
-        --spec-draft-n-max 1
-        --swa-full
-        --kv-unified
-        --parallel 1
-        ${ctx_128k}
-        ${gemma4_nothink_sampling}
-        ${common_args}
-
-  "unsloth/Qwen3.6-35B-A3B-GGUF:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-      -hf unsloth/Qwen3.6-35B-A3B-GGUF:UD-Q4_K_XL
-      ${ctx_256k}
-      ${qwen35_think_args}
-      ${common_args}
-
-  "unsloth/Qwen3.6-35B-A3B-GGUF-nothink:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-      -hf unsloth/Qwen3.6-35B-A3B-GGUF:UD-Q4_K_XL
-      ${ctx_256k}
-      ${qwen35_nothink_args}
-      ${common_args}
-
-  "HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive:Q4_K_M":
-    cmd: |
-      llama-server
-      -hf HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive:Q4_K_M
-      ${ctx_256k}
-      ${qwen35_think_args}
-      ${common_args}
-
-  "HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive-nothink:Q4_K_M":
-    cmd: |
-      llama-server
-      -hf HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive:Q4_K_M
-      ${ctx_256k}
-      ${qwen35_nothink_args}
-      ${common_args}
-
-  "unsloth/Qwen3.6-35B-A3B-MTP-GGUF:Q4_K_M":
-    cmd: |
-      llama-server
-      -hf unsloth/Qwen3.6-35B-A3B-MTP-GGUF:Q4_K_M
-      ${ctx_256k}
-      ${qwen35_think_args}
-      --spec-type draft-mtp --spec-draft-n-max 1
-      --parallel 1
-      ${common_args}
-
-  "unsloth/Qwen3.6-35B-A3B-MTP-GGUF-nothink:Q4_K_M":
-    cmd: |
-      llama-server
-      -hf unsloth/Qwen3.6-35B-A3B-MTP-GGUF:Q4_K_M
-      ${ctx_256k}
-      ${qwen35_nothink_args}
-      --spec-type draft-mtp --spec-draft-n-max 1
-      --parallel 1
-      ${common_args}
-
-  # STT via parakeet-server (parakeet.cpp OpenAI-compatible server, CPU, always loaded)
-  # Model downloaded on first start and cached under /root/.cache/parakeet.cpp/models
-  # parakeet-proxy.py sits in front to convert any audio format to WAV via ffmpeg,
-  # since parakeet-server only accepts real WAV but browsers send Ogg/Opus.
-  "parakeet-tdt_ctc-1.1b":
-    checkEndpoint: none
-    cmd: |
-      env PROXY_PORT=${PORT} FFMPEG_BIN=/root/.cache/ffmpeg/ffmpeg python3 /config/parakeet-proxy.py
-
-
-  # Image generation via stable-diffusion.cpp (sd-server)
-  # Models must be pre-downloaded to /root/.cache/sd/
-  # FLUX.2-klein-4B: fast unified text-to-image and image editing model (Apache 2.0)
-  # Download: uv run --with huggingface_hub hf download unsloth/FLUX.2-klein-4B-GGUF flux-2-klein-4b-Q4_K_M.gguf --local-dir /root/.cache/sd
-  # Download VAE: uv run --with huggingface_hub hf download Comfy-Org/flux2-klein-4B split_files/vae/flux2-vae.safetensors --local-dir /root/.cache/sd/flux2-klein && cp /root/.cache/sd/flux2-klein/split_files/vae/flux2-vae.safetensors /root/.cache/sd/
-  # Download LLM: uv run --with huggingface_hub hf download ponpoke/flux2-klein-4b-uncensored-text-encoder flux2-klein-4b-uncensored-q4_k_m.gguf --local-dir /root/.cache/sd
-  "flux2-klein-4b:Q4_K_M":
-    checkEndpoint: "/"
-    cmd: |
-      sd-server
-        --listen-port ${PORT}
-        --diffusion-model /root/.cache/sd/flux-2-klein-4b-Q4_K_M.gguf
-        --vae /root/.cache/sd/flux2-vae.safetensors
-        --llm /root/.cache/sd/flux2-klein-4b-uncensored-q4_k_m.gguf
-        --cfg-scale 1.0
-        --sampling-method euler
-        --steps 4
-        --diffusion-fa
-        --offload-to-cpu
@@ -1,227 +0,0 @@
-#!/usr/bin/env python3
-"""
-Thin reverse proxy for parakeet-server.
-
-Accepts POST /v1/audio/transcriptions with any audio format,
-converts the audio to 16 kHz mono WAV via ffmpeg, then forwards
-the converted file to the real parakeet-server running on PARAKEET_PORT.
-
-Also proxies GET /health straight through.
-
-Usage:
-    PROXY_PORT=<port>  PARAKEET_PORT=<upstream>  python3 parakeet-proxy.py
-"""
-
-import http.server
-import io
-import os
-import subprocess
-import sys
-import tempfile
-import urllib.request
-import urllib.error
-
-PROXY_PORT    = int(os.environ.get("PROXY_PORT", "8080"))
-PARAKEET_PORT = PROXY_PORT + 1
-FFMPEG        = os.environ.get("FFMPEG_BIN", "ffmpeg")
-MODEL         = os.environ.get("PARAKEET_MODEL", "tdt_ctc-1.1b-q4_k.gguf")
-CACHE_DIR     = os.environ.get("PARAKEET_CACHE_DIR", "/root/.cache/parakeet.cpp/models")
-
-
-def convert_to_wav(data: bytes) -> bytes:
-    """Convert any audio bytes to 16 kHz mono PCM WAV via ffmpeg."""
-    with tempfile.NamedTemporaryFile(suffix=".input", delete=False) as inf:
-        inf.write(data)
-        inf_path = inf.name
-    out_path = inf_path + ".wav"
-    try:
-        subprocess.run(
-            [
-                FFMPEG, "-y",
-                "-i", inf_path,
-                "-ar", "16000",
-                "-ac", "1",
-                "-f", "wav",
-                out_path,
-            ],
-            check=True,
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-        )
-        with open(out_path, "rb") as f:
-            return f.read()
-    finally:
-        os.unlink(inf_path)
-        if os.path.exists(out_path):
-            os.unlink(out_path)
-
-
-def parse_multipart(content_type: str, body: bytes):
-    """
-    Parse a multipart/form-data body.
-    Returns a dict of field_name -> (filename_or_None, content_type, data).
-    """
-    import email
-    from email import policy as email_policy
-
-    # email.parser needs the full MIME headers to parse multipart
-    raw = b"Content-Type: " + content_type.encode() + b"\r\n\r\n" + body
-    msg = email.message_from_bytes(raw, policy=email_policy.compat32)
-    parts = {}
-    for part in msg.get_payload():
-        cd = part.get("Content-Disposition", "")
-        name = None
-        filename = None
-        for item in cd.split(";"):
-            item = item.strip()
-            if item.startswith('name='):
-                name = item[5:].strip('"')
-            elif item.startswith('filename='):
-                filename = item[9:].strip('"')
-        if name is not None:
-            parts[name] = (filename, part.get_content_type(), part.get_payload(decode=True))
-    return parts
-
-
-def build_multipart(fields: dict) -> tuple[bytes, str]:
-    """
-    Build a multipart/form-data body from fields dict:
-      field_name -> (filename_or_None, content_type, data_bytes)
-    Returns (body_bytes, content_type_header_value).
-    """
-    boundary = b"----ParakeetProxyBoundary0xDEADBEEF"
-    body = b""
-    for name, (filename, ct, data) in fields.items():
-        body += b"--" + boundary + b"\r\n"
-        if filename:
-            body += (
-                f'Content-Disposition: form-data; name="{name}"; filename="{filename}"\r\n'
-            ).encode()
-        else:
-            body += f'Content-Disposition: form-data; name="{name}"\r\n'.encode()
-        body += f"Content-Type: {ct}\r\n\r\n".encode()
-        body += data + b"\r\n"
-    body += b"--" + boundary + b"--\r\n"
-    return body, f"multipart/form-data; boundary={boundary.decode()}"
-
-
-class ProxyHandler(http.server.BaseHTTPRequestHandler):
-    def log_message(self, fmt, *args):
-        print(f"[parakeet-proxy] {self.address_string()} - {fmt % args}", flush=True)
-
-    def do_GET(self):
-        if self.path == "/health":
-            self._forward_get("/health")
-        else:
-            self.send_response(404)
-            self.end_headers()
-
-    def do_POST(self):
-        if self.path.rstrip("/") == "/v1/audio/transcriptions":
-            self._handle_transcription()
-        else:
-            self.send_response(404)
-            self.end_headers()
-
-    def _forward_get(self, path):
-        try:
-            url = f"http://127.0.0.1:{PARAKEET_PORT}{path}"
-            with urllib.request.urlopen(url, timeout=5) as resp:
-                body = resp.read()
-                self.send_response(resp.status)
-                self.send_header("Content-Type", resp.headers.get("Content-Type", "application/json"))
-                self.end_headers()
-                self.wfile.write(body)
-        except Exception as e:
-            self.send_response(502)
-            self.end_headers()
-            self.wfile.write(str(e).encode())
-
-    def _handle_transcription(self):
-        length = int(self.headers.get("Content-Length", 0))
-        body = self.rfile.read(length)
-        ct = self.headers.get("Content-Type", "")
-
-        try:
-            fields = parse_multipart(ct, body)
-        except Exception as e:
-            self._error(400, f"failed to parse multipart: {e}")
-            return
-
-        if "file" not in fields:
-            self._error(400, "missing required field 'file'")
-            return
-
-        filename, file_ct, audio_data = fields["file"]
-
-        # Convert to WAV regardless of what we received
-        try:
-            wav_data = convert_to_wav(audio_data)
-        except subprocess.CalledProcessError:
-            self._error(400, "ffmpeg could not decode audio")
-            return
-        except Exception as e:
-            self._error(500, f"conversion error: {e}")
-            return
-
-        # Rebuild multipart with converted WAV, preserve other fields
-        new_fields = {}
-        for name, (fn, fct, data) in fields.items():
-            if name == "file":
-                new_fields[name] = ("recording.wav", "audio/wav", wav_data)
-            else:
-                new_fields[name] = (fn, fct, data)
-
-        new_body, new_ct = build_multipart(new_fields)
-
-        # Forward to parakeet-server
-        try:
-            url = f"http://127.0.0.1:{PARAKEET_PORT}/v1/audio/transcriptions"
-            req = urllib.request.Request(
-                url,
-                data=new_body,
-                headers={"Content-Type": new_ct},
-                method="POST",
-            )
-            with urllib.request.urlopen(req, timeout=300) as resp:
-                resp_body = resp.read()
-                self.send_response(resp.status)
-                self.send_header("Content-Type", resp.headers.get("Content-Type", "application/json"))
-                self.end_headers()
-                self.wfile.write(resp_body)
-        except urllib.error.HTTPError as e:
-            resp_body = e.read()
-            self.send_response(e.code)
-            self.send_header("Content-Type", e.headers.get("Content-Type", "application/json"))
-            self.end_headers()
-            self.wfile.write(resp_body)
-        except Exception as e:
-            self._error(502, f"upstream error: {e}")
-
-    def _error(self, code: int, msg: str):
-        body = f'{{"error":{{"message":"{msg}","type":"proxy_error"}}}}'.encode()
-        self.send_response(code)
-        self.send_header("Content-Type", "application/json")
-        self.end_headers()
-        self.wfile.write(body)
-
-
-if __name__ == "__main__":
-    proc = subprocess.Popen([
-        "parakeet-server",
-        "--host", "127.0.0.1",
-        "--port", str(PARAKEET_PORT),
-        "--model", MODEL,
-        "--cache-dir", CACHE_DIR,
-    ])
-    print(f"[parakeet-proxy] started parakeet-server pid={proc.pid} on :{PARAKEET_PORT}", flush=True)
-
-    server = http.server.HTTPServer(("0.0.0.0", PROXY_PORT), ProxyHandler)
-    print(f"[parakeet-proxy] listening on :{PROXY_PORT}", flush=True)
-    try:
-        server.serve_forever()
-    except KeyboardInterrupt:
-        pass
-    finally:
-        proc.terminate()
-        proc.wait()
@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: llama-swap
+  name: supervisord
  namespace: llama
 spec:
  replicas: 1
@@ -16,64 +16,24 @@ spec:
      labels:
        app: llama-swap
    spec:
-      initContainers:
-        - name: download-whisper
-          image: gitea.lumpiasty.xyz/lumpiasty/llama-swap:unified-vulkan-parakeet-2026-06-12
-          command:
-            - sh
-            - -c
-            - |
-              mkdir -p /root/.cache/whisper
-              if [ ! -f /root/.cache/whisper/ggml-small.bin ]; then
-                echo "Downloading whisper-small model..."
-                curl -L -o /root/.cache/whisper/ggml-small.bin \
-                  https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-small.bin
-              else
-                echo "whisper-small model already present, skipping download"
-              fi
-              if [ ! -f /root/.cache/ffmpeg/ffmpeg ]; then
-                echo "Downloading static ffmpeg..."
-                mkdir -p /root/.cache/ffmpeg
-                apt-get update -qq && apt-get install -y --no-install-recommends xz-utils
-                curl -L -o /root/.cache/ffmpeg/ffmpeg.tar.xz \
-                  https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-master-latest-linux64-gpl.tar.xz
-                tar -xJf /root/.cache/ffmpeg/ffmpeg.tar.xz -C /root/.cache/ffmpeg --wildcards '*/ffmpeg' --strip-components=2
-                rm /root/.cache/ffmpeg/ffmpeg.tar.xz
-                chmod +x /root/.cache/ffmpeg/ffmpeg
-              else
-                echo "ffmpeg already present, skipping download"
-              fi
-          volumeMounts:
-            - name: models
-              mountPath: /root/.cache
      containers:
-        - name: llama-swap
-          image: gitea.lumpiasty.xyz/lumpiasty/llama-swap:unified-vulkan-parakeet-2026-06-12
+        - name: supervisord
+          image: gitea.lumpiasty.xyz/lumpiasty/supervisord:latest@sha256:2676d13df2a0833b27ab8ec441da78c6c43d3f7bf75837d35723eefb40a82ce1
          imagePullPolicy: IfNotPresent
-          command:
-            - llama-swap
-          args:
-            - --config=/config/config.yaml
-            - --watch-config
-          env:
-            - name: RADV_EXPERIMENTAL
-              value: transfer_queue
          ports:
            - containerPort: 8080
              name: http
              protocol: TCP
+          env:
+            - name: WORKSPACE
+              value: /root
          volumeMounts:
            - name: models
-              mountPath: /root/.cache
-            - name: models
-              mountPath: /usr/local/bin/ffmpeg
-              subPath: ffmpeg/ffmpeg
+              mountPath: /root
            - mountPath: /dev/kfd
              name: kfd
            - mountPath: /dev/dri
              name: dri
-            - mountPath: /config
-              name: config
          securityContext:
            privileged: true
      volumes:
@@ -88,9 +48,6 @@ spec:
          hostPath:
            path: /dev/dri
            type: Directory
-        - name: config
-          configMap:
-            name: llama-swap
 ---
 apiVersion: v1
 kind: Service
@@ -21,7 +21,7 @@ spec:
          # OpenAI-compatible Kokoro-FastAPI TTS server, CPU PyTorch backend.
          # Models baked into the image (no PVC needed).
          # v0.3.0 includes fix for per-request voice tensor memory leak (#459).
-          image: ghcr.io/remsky/kokoro-fastapi-cpu:v0.5.0
+          image: ghcr.io/remsky/kokoro-fastapi-cpu:v0.8.1
          ports:
            - containerPort: 8880
              name: http
@@ -8,9 +8,3 @@ resources:
  - pvc-ssd.yaml
  - deployment.yaml
  - kokoro.yaml
-configMapGenerator:
-  - name: llama-swap
-    namespace: llama
-    files:
-      - config.yaml=configs/config.yaml
-      - parakeet-proxy.py=configs/parakeet-proxy.py
@@ -18,7 +18,7 @@ spec:
  chart:
    spec:
      chart: open-webui
-      version: 15.2.0
+      version: 16.1.0
      sourceRef:
        kind: HelmRepository
        name: open-webui
@@ -18,7 +18,7 @@ spec:
  chart:
    spec:
      chart: woodpecker
-      version: 3.6.5
+      version: 3.7.3
      sourceRef:
        kind: HelmRepository
        name: woodpecker
@@ -1,6 +1,6 @@
 ---
 # This manifest was generated by flux. DO NOT EDIT.
-# Flux Version: v2.9.0
+# Flux Version: v2.9.5
 # Components: source-controller,kustomize-controller,helm-controller,notification-controller
 apiVersion: v1
 kind: Namespace
@@ -8,7 +8,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
  name: flux-system
@@ -19,7 +19,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: allow-egress
  namespace: flux-system
 spec:
@@ -39,7 +39,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: allow-scraping
  namespace: flux-system
 spec:
@@ -59,13 +59,16 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: allow-webhooks
  namespace: flux-system
 spec:
  ingress:
  - from:
    - namespaceSelector: {}
+    ports:
+    - port: 9292
+      protocol: TCP
  podSelector:
    matchLabels:
      app: notification-controller
@@ -78,7 +81,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: critical-pods-flux-system
  namespace: flux-system
 spec:
@@ -98,7 +101,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: crd-controller-flux-system
 rules:
 - apiGroups:
@@ -204,7 +207,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
  name: flux-edit-flux-system
@@ -231,7 +234,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-view: "true"
@@ -257,7 +260,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: cluster-reconciler-flux-system
 roleRef:
  apiGroup: rbac.authorization.k8s.io
@@ -277,7 +280,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: crd-controller-flux-system
 roleRef:
  apiGroup: rbac.authorization.k8s.io
@@ -311,11 +314,12 @@ kind: CustomResourceDefinition
 metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.21.0
+    kustomize.toolkit.fluxcd.io/substitute: disabled
  labels:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: buckets.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -702,11 +706,12 @@ kind: CustomResourceDefinition
 metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.21.0
+    kustomize.toolkit.fluxcd.io/substitute: disabled
  labels:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: externalartifacts.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -904,11 +909,12 @@ kind: CustomResourceDefinition
 metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.21.0
+    kustomize.toolkit.fluxcd.io/substitute: disabled
  labels:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: gitrepositories.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -1398,11 +1404,12 @@ kind: CustomResourceDefinition
 metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.21.0
+    kustomize.toolkit.fluxcd.io/substitute: disabled
  labels:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: helmcharts.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -1747,7 +1754,7 @@ spec:
                description: |-
                  URL is the dynamic fetch link for the latest Artifact.
                  It is provided on a "best effort" basis, and using the precise
-                  BucketStatus.Artifact data is recommended.
+                  HelmChartStatus.Artifact data is recommended.
                type: string
            type: object
        type: object
@@ -1761,11 +1768,12 @@ kind: CustomResourceDefinition
 metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.21.0
+    kustomize.toolkit.fluxcd.io/substitute: disabled
  labels:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: helmrepositories.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -2091,11 +2099,12 @@ kind: CustomResourceDefinition
 metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.21.0
+    kustomize.toolkit.fluxcd.io/substitute: disabled
  labels:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: ocirepositories.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -2526,7 +2535,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: source-controller
  namespace: flux-system
 ---
@@ -2537,7 +2546,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
    control-plane: controller
  name: source-controller
  namespace: flux-system
@@ -2558,7 +2567,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
    control-plane: controller
  name: source-controller
  namespace: flux-system
@@ -2579,7 +2588,7 @@ spec:
        app.kubernetes.io/component: source-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.9.0
+        app.kubernetes.io/version: v2.9.5
    spec:
      containers:
      - args:
@@ -2602,7 +2611,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/source-controller:v1.9.1
+        image: ghcr.io/fluxcd/source-controller:v1.9.5
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -2662,11 +2671,12 @@ kind: CustomResourceDefinition
 metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.21.0
+    kustomize.toolkit.fluxcd.io/substitute: disabled
  labels:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: kustomizations.kustomize.toolkit.fluxcd.io
 spec:
  group: kustomize.toolkit.fluxcd.io
@@ -3478,7 +3488,7 @@ metadata:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: kustomize-controller
  namespace: flux-system
 ---
@@ -3489,7 +3499,7 @@ metadata:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
    control-plane: controller
  name: kustomize-controller
  namespace: flux-system
@@ -3508,7 +3518,7 @@ spec:
        app.kubernetes.io/component: kustomize-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.9.0
+        app.kubernetes.io/version: v2.9.5
    spec:
      containers:
      - args:
@@ -3527,7 +3537,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/kustomize-controller:v1.9.1
+        image: ghcr.io/fluxcd/kustomize-controller:v1.9.5
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -3580,11 +3590,12 @@ kind: CustomResourceDefinition
 metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.21.0
+    kustomize.toolkit.fluxcd.io/substitute: disabled
  labels:
    app.kubernetes.io/component: helm-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: helmreleases.helm.toolkit.fluxcd.io
 spec:
  group: helm.toolkit.fluxcd.io
@@ -5073,7 +5084,7 @@ metadata:
    app.kubernetes.io/component: helm-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: helm-controller
  namespace: flux-system
 ---
@@ -5084,7 +5095,7 @@ metadata:
    app.kubernetes.io/component: helm-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
    control-plane: controller
  name: helm-controller
  namespace: flux-system
@@ -5103,7 +5114,7 @@ spec:
        app.kubernetes.io/component: helm-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.9.0
+        app.kubernetes.io/version: v2.9.5
    spec:
      containers:
      - args:
@@ -5122,7 +5133,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/helm-controller:v1.6.1
+        image: ghcr.io/fluxcd/helm-controller:v1.6.4
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -5175,11 +5186,12 @@ kind: CustomResourceDefinition
 metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.21.0
+    kustomize.toolkit.fluxcd.io/substitute: disabled
  labels:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: alerts.notification.toolkit.fluxcd.io
 spec:
  group: notification.toolkit.fluxcd.io
@@ -5346,11 +5358,12 @@ kind: CustomResourceDefinition
 metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.21.0
+    kustomize.toolkit.fluxcd.io/substitute: disabled
  labels:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: providers.notification.toolkit.fluxcd.io
 spec:
  group: notification.toolkit.fluxcd.io
@@ -5556,11 +5569,12 @@ kind: CustomResourceDefinition
 metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.21.0
+    kustomize.toolkit.fluxcd.io/substitute: disabled
  labels:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: receivers.notification.toolkit.fluxcd.io
 spec:
  group: notification.toolkit.fluxcd.io
@@ -5934,7 +5948,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
  name: notification-controller
  namespace: flux-system
 ---
@@ -5945,7 +5959,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
    control-plane: controller
  name: notification-controller
  namespace: flux-system
@@ -5966,7 +5980,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
    control-plane: controller
  name: webhook-receiver
  namespace: flux-system
@@ -5987,7 +6001,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.0
+    app.kubernetes.io/version: v2.9.5
    control-plane: controller
  name: notification-controller
  namespace: flux-system
@@ -6006,7 +6020,7 @@ spec:
        app.kubernetes.io/component: notification-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.9.0
+        app.kubernetes.io/version: v2.9.5
    spec:
      containers:
      - args:
@@ -6024,7 +6038,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/notification-controller:v1.9.1
+        image: ghcr.io/fluxcd/notification-controller:v1.9.4
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -1,5 +1,5 @@
 # Stage 1: build CoreDNS with minimal plugin set
-FROM golang:1.26-alpine AS build
+FROM golang:1.27-alpine AS build

 RUN apk add --no-cache git make bash

@@ -0,0 +1,15 @@
+FROM debian:13.6
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt update && apt install -y --no-install-recommends\
+    curl wget vim \
+    ca-certificates \
+    build-essential cmake libvulkan-dev glslc spirv-headers libssl-dev git \
+    mesa-utils mesa-vulkan-drivers \
+    supervisor \
+    && rm -rf /var/lib/apt/lists/*
+
+ADD --chmod=755 entrypoint.sh /
+
+ENTRYPOINT ["/entrypoint.sh"]
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+WORKSPACE="${WORKSPACE:-/workspace}"
+CONF=$WORKSPACE/supervisord.conf
+
+[[ -f "$CONF" ]] || (echo_supervisord_conf > $CONF )
+
+exec supervisord -n -c $CONF "$@"
@@ -18,7 +18,7 @@ spec:
  chart:
    spec:
      chart: cert-manager-webhook-ovh
-      version: 0.9.13
+      version: 0.9.16
      sourceRef:
        kind: HelmRepository
        name: cert-manager-webhook-ovh
@@ -23,7 +23,7 @@ spec:
  chart:
    spec:
      chart: cert-manager
-      version: v1.20.3
+      version: v1.21.1
      sourceRef:
        kind: HelmRepository
        name: cert-manager
@@ -23,7 +23,7 @@ spec:
  chart:
    spec:
      chart: cilium
-      version: 1.19.5
+      version: 1.20.1
      sourceRef:
        kind: HelmRepository
        name: cilium
@@ -110,7 +110,7 @@ spec:
        kubernetes.io/os: linux
      containers:
        - name: coredns
-          image: registry.k8s.io/coredns/coredns:v1.14.4
+          image: registry.k8s.io/coredns/coredns:v1.14.7
          imagePullPolicy: IfNotPresent
          args: ["-conf", "/etc/coredns/Corefile"]
          ports:
@@ -97,7 +97,7 @@ spec:
          env:
            - name: GOMEMLIMIT
              value: 161MiB
-          image: registry.k8s.io/coredns/coredns:v1.14.4
+          image: registry.k8s.io/coredns/coredns:v1.14.7
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 5
@@ -23,7 +23,7 @@ spec:
  chart:
    spec:
      chart: k8up
-      version: 4.9.0
+      version: 4.10.0
      sourceRef:
        kind: HelmRepository
        name: k8up-io
@@ -23,7 +23,7 @@ spec:
  chart:
    spec:
      chart: openbao
-      version: 0.28.4
+      version: 0.29.3
      sourceRef:
        kind: HelmRepository
        name: openbao
@@ -23,7 +23,7 @@ spec:
  chart:
    spec:
      chart: vault-secrets-operator
-      version: 1.4.1
+      version: 1.5.1
      sourceRef:
        kind: HelmRepository
        name: hashicorp
@@ -37,7 +37,7 @@
      "platformAutomerge": true
    },
    {
-      "matchUpdateTypes": ["patch"],
+      "matchUpdateTypes": ["patch", "digest"],
      "automerge": true,
      "automergeType": "pr",
      "platformAutomerge": true
@@ -28,3 +28,4 @@ machine:
    # arrives too late. Work around using kernel args:
    extraKernelArgs:
      - amdgpu.runpm=1
+      - amdgpu.lockup_timeout=0,120000,0,0