chore(deps): update renovate/renovate docker tag to v43.76.2

2026-03-16 00:06:07 +00:00
36 changed files with 15 additions and 605 deletions
--- a/.woodpecker/my-first-workflow.yaml
+++ b/.woodpecker/my-first-workflow.yaml
@@ -1,15 +0,0 @@
-when:
-  - event: push
-    branch: fresh-start
-
-steps:
-  - name: build
-    image: debian
-    commands:
-      - echo "This is the build step"
-      - echo "echo hello world" > executable
-  - name: a-test-step
-    image: golang:1.16
-    commands:
-      - echo "Testing ..."
-      - sh executable
--- a/apps/crawl4ai-proxy/deployment.yaml
+++ b/apps/crawl4ai-proxy/deployment.yaml
@@ -1,48 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: crawl4ai-proxy
-  namespace: crawl4ai
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: crawl4ai-proxy
-  template:
-    metadata:
-      labels:
-        app: crawl4ai-proxy
-    spec:
-      containers:
-        - name: crawl4ai-proxy
-          image: gitea.lumpiasty.xyz/lumpiasty/crawl4ai-proxy-fit:latest
-          imagePullPolicy: Always
-          env:
-            - name: LISTEN_PORT
-              value: "8000"
-            - name: CRAWL4AI_ENDPOINT
-              value: http://crawl4ai.crawl4ai.svc.cluster.local:11235/crawl
-          ports:
-            - name: http
-              containerPort: 8000
-          readinessProbe:
-            tcpSocket:
-              port: http
-            initialDelaySeconds: 3
-            periodSeconds: 10
-            timeoutSeconds: 2
-            failureThreshold: 6
-          livenessProbe:
-            tcpSocket:
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 15
-            timeoutSeconds: 2
-            failureThreshold: 6
-          resources:
-            requests:
-              cpu: 25m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 128Mi
--- a/apps/crawl4ai-proxy/kustomization.yaml
+++ b/apps/crawl4ai-proxy/kustomization.yaml
@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - deployment.yaml
-  - service.yaml
--- a/apps/crawl4ai-proxy/service.yaml
+++ b/apps/crawl4ai-proxy/service.yaml
@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: crawl4ai-proxy
-  namespace: crawl4ai
-spec:
-  type: ClusterIP
-  selector:
-    app: crawl4ai-proxy
-  ports:
-    - name: http
-      port: 8000
-      targetPort: 8000
-      protocol: TCP
--- a/apps/crawl4ai/deployment.yaml
+++ b/apps/crawl4ai/deployment.yaml
@@ -1,62 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: crawl4ai
-  namespace: crawl4ai
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: crawl4ai
-  template:
-    metadata:
-      labels:
-        app: crawl4ai
-    spec:
-      containers:
-        - name: crawl4ai
-          image: unclecode/crawl4ai:latest
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: CRAWL4AI_API_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: crawl4ai-secret
-                  key: api_token
-                  optional: false
-            - name: MAX_CONCURRENT_TASKS
-              value: "5"
-          ports:
-            - name: http
-              containerPort: 11235
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 6
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 15
-            timeoutSeconds: 3
-            failureThreshold: 6
-          resources:
-            requests:
-              cpu: 500m
-              memory: 1Gi
-            limits:
-              cpu: "2"
-              memory: 4Gi
-          volumeMounts:
-            - name: dshm
-              mountPath: /dev/shm
-      volumes:
-        - name: dshm
-          emptyDir:
-            medium: Memory
-            sizeLimit: 1Gi
--- a/apps/crawl4ai/kustomization.yaml
+++ b/apps/crawl4ai/kustomization.yaml
@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - secret.yaml
-  - deployment.yaml
-  - service.yaml
--- a/apps/crawl4ai/namespace.yaml
+++ b/apps/crawl4ai/namespace.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: crawl4ai
--- a/apps/crawl4ai/secret.yaml
+++ b/apps/crawl4ai/secret.yaml
@@ -1,38 +0,0 @@
---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: crawl4ai-secret
-  namespace: crawl4ai
---
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: crawl4ai
-  namespace: crawl4ai
-spec:
-  method: kubernetes
-  mount: kubernetes
-  kubernetes:
-    role: crawl4ai
-    serviceAccount: crawl4ai-secret
---
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: crawl4ai-secret
-  namespace: crawl4ai
-spec:
-  type: kv-v2
-
-  mount: secret
-  path: crawl4ai
-
-  destination:
-    create: true
-    name: crawl4ai-secret
-    type: Opaque
-    transformation:
-      excludeRaw: true
-
-  vaultAuthRef: crawl4ai
--- a/apps/crawl4ai/service.yaml
+++ b/apps/crawl4ai/service.yaml
@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: crawl4ai
-  namespace: crawl4ai
-spec:
-  type: ClusterIP
-  selector:
-    app: crawl4ai
-  ports:
-    - name: http
-      port: 11235
-      targetPort: 11235
-      protocol: TCP
--- a/apps/gitea/release.yaml
+++ b/apps/gitea/release.yaml
@@ -73,7 +73,7 @@ spec:
          ISSUE_INDEXER_TYPE: bleve
          REPO_INDEXER_ENABLED: true
        webhook:
-          ALLOWED_HOST_LIST: garm.garm.svc.cluster.local,woodpecker.lumpiasty.xyz
+          ALLOWED_HOST_LIST: garm.garm.svc.cluster.local
      admin:
        username: GiteaAdmin
        email: gi@tea.com
--- a/apps/immich/release.yaml
+++ b/apps/immich/release.yaml
@@ -18,7 +18,7 @@ spec:
  chart:
    spec:
      chart: immich
-      version: 1.2.2
+      version: 1.1.1
      sourceRef:
        kind: HelmRepository
        name: secustor
--- a/apps/kustomization.yaml
+++ b/apps/kustomization.yaml
@@ -1,8 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - crawl4ai
-  - crawl4ai-proxy
  - authentik
  - gitea
  - renovate
@@ -15,4 +13,3 @@ resources:
  - ispeak3
  - openwebui
  - garm
-  - woodpecker
--- a/apps/llama/configs/config.yaml
+++ b/apps/llama/configs/config.yaml
@@ -4,16 +4,12 @@ logToStdout: "both" # proxy and upstream

 macros:
  base_args: "--no-warmup --port ${PORT}"
-  common_args: "--fit-target 1536 --no-warmup --port ${PORT}"
-  gemma3_ctx_128k: "--ctx-size 131072"
-  qwen35_ctx_128k: "--ctx-size 131072"
-  qwen35_ctx_256k: "--ctx-size 262144"
+  common_args: "--fit-target 1536 --fit-ctx 65536 --no-warmup --port ${PORT}"
  gemma_sampling: "--prio 2 --temp 1.0 --repeat-penalty 1.0 --min-p 0.00 --top-k 64 --top-p 0.95"
-  qwen35_sampling: "--temp 0.6 --top-p 0.95 --top-k 20 --min-p 0.00 -ctk q8_0 -ctv q8_0"
-  qwen35_35b_args: "--temp 1.0 --min-p 0.00 --top-p 0.95 --top-k 20 -ctk q8_0 -ctv q8_0"
+  qwen35_sampling: "--temp 0.6 --top-p 0.95 --top-k 20 --min-p 0.00 -ctk q4_0 -ctv q4_0"
+  qwen35_35b_args: "--temp 1.0 --min-p 0.00 --top-p 0.95 --top-k 20 -ctk q4_0 -ctv q4_0"
  qwen35_35b_heretic_mmproj: "--mmproj-url https://huggingface.co/unsloth/Qwen3.5-35B-A3B-GGUF/resolve/main/mmproj-F16.gguf --mmproj /root/.cache/llama.cpp/unsloth_Qwen3.5-35B-A3B-GGUF_mmproj-F16.gguf"
  qwen35_4b_heretic_mmproj: "--mmproj-url https://huggingface.co/unsloth/Qwen3.5-4B-GGUF/resolve/main/mmproj-F16.gguf --mmproj /root/.cache/llama.cpp/unsloth_Qwen3.5-4B-GGUF_mmproj-F16.gguf"
-  glm47_flash_args: "--temp 0.7 --top-p 1.0 --min-p 0.01 --repeat-penalty 1.0"
  thinking_on: "--chat-template-kwargs '{\"enable_thinking\": true}'"
  thinking_off: "--chat-template-kwargs '{\"enable_thinking\": false}'"

@@ -42,7 +38,6 @@ models:
    cmd: |
      /app/llama-server
        -hf unsloth/gemma-3-12b-it-GGUF:Q4_K_M
-        ${gemma3_ctx_128k}
        ${gemma_sampling}
        ${common_args}

@@ -50,7 +45,6 @@ models:
    cmd: |
      /app/llama-server
        -hf unsloth/gemma-3-12b-it-GGUF:Q4_K_M
-        ${gemma3_ctx_128k}
        ${gemma_sampling}
        --no-mmproj
        ${common_args}
@@ -59,7 +53,6 @@ models:
    cmd: |
      /app/llama-server
        -hf unsloth/gemma-3-4b-it-GGUF:Q4_K_M
-        ${gemma3_ctx_128k}
        ${gemma_sampling}
        ${common_args}

@@ -67,7 +60,6 @@ models:
    cmd: |
      /app/llama-server
        -hf unsloth/gemma-3-4b-it-GGUF:Q4_K_M
-        ${gemma3_ctx_128k}
        ${gemma_sampling}
        --no-mmproj
        ${common_args}
@@ -83,14 +75,13 @@ models:
        --top-p 0.95
        --top-k 40
        --repeat-penalty 1.0
-        -ctk q8_0 -ctv q8_0
+        -ctk q4_0 -ctv q4_0
        ${common_args}

  "Qwen3.5-35B-A3B-GGUF:Q4_K_M":
    cmd: |
      /app/llama-server
        -hf unsloth/Qwen3.5-35B-A3B-GGUF:Q4_K_M
-        ${qwen35_ctx_256k}
        ${qwen35_35b_args}
        ${common_args}

@@ -98,7 +89,6 @@ models:
    cmd: |
      /app/llama-server
        -hf unsloth/Qwen3.5-35B-A3B-GGUF:Q4_K_M
-        ${qwen35_ctx_256k}
        ${qwen35_35b_args}
        ${common_args}
        ${thinking_off}
@@ -110,7 +100,6 @@ models:
      /app/llama-server
        -hf mradermacher/Qwen3.5-35B-A3B-heretic-GGUF:Q4_K_M
        ${qwen35_35b_heretic_mmproj}
-        ${qwen35_ctx_256k}
        ${qwen35_35b_args}
        ${common_args}

@@ -119,7 +108,6 @@ models:
      /app/llama-server
        -hf mradermacher/Qwen3.5-35B-A3B-heretic-GGUF:Q4_K_M
        ${qwen35_35b_heretic_mmproj}
-        ${qwen35_ctx_256k}
        ${qwen35_35b_args}
        ${common_args}
        ${thinking_off}
@@ -128,7 +116,6 @@ models:
    cmd: |
      /app/llama-server
        -hf unsloth/Qwen3.5-0.8B-GGUF:Q4_K_XL
-        ${qwen35_ctx_256k}
        ${qwen35_sampling}
        ${base_args}
        ${thinking_on}
@@ -146,7 +133,6 @@ models:
    cmd: |
      /app/llama-server
        -hf unsloth/Qwen3.5-2B-GGUF:Q4_K_M
-        ${qwen35_ctx_256k}
        ${qwen35_sampling}
        ${common_args}
        ${thinking_on}
@@ -155,7 +141,6 @@ models:
    cmd: |
      /app/llama-server
        -hf unsloth/Qwen3.5-2B-GGUF:Q4_K_M
-        ${qwen35_ctx_256k}
        ${qwen35_sampling}
        ${common_args}
        ${thinking_off}
@@ -164,7 +149,6 @@ models:
    cmd: |
      /app/llama-server
        -hf unsloth/Qwen3.5-4B-GGUF:Q4_K_M
-        ${qwen35_ctx_128k}
        ${qwen35_sampling}
        ${common_args}
        ${thinking_on}
@@ -173,7 +157,6 @@ models:
    cmd: |
      /app/llama-server
        -hf unsloth/Qwen3.5-4B-GGUF:Q4_K_M
-        ${qwen35_ctx_128k}
        ${qwen35_sampling}
        ${common_args}
        ${thinking_off}
@@ -183,7 +166,6 @@ models:
      /app/llama-server
        -hf mradermacher/Qwen3.5-4B-heretic-GGUF:Q4_K_M
        ${qwen35_4b_heretic_mmproj}
-        ${qwen35_ctx_128k}
        ${qwen35_sampling}
        ${common_args}
        ${thinking_on}
@@ -193,7 +175,6 @@ models:
      /app/llama-server
        -hf mradermacher/Qwen3.5-4B-heretic-GGUF:Q4_K_M
        ${qwen35_4b_heretic_mmproj}
-        ${qwen35_ctx_128k}
        ${qwen35_sampling}
        ${common_args}
        ${thinking_off}
@@ -202,7 +183,6 @@ models:
    cmd: |
      /app/llama-server
        -hf unsloth/Qwen3.5-9B-GGUF:Q4_K_M
-        ${qwen35_ctx_256k}
        ${qwen35_sampling}
        ${common_args}
        ${thinking_on}
@@ -211,7 +191,6 @@ models:
    cmd: |
      /app/llama-server
        -hf unsloth/Qwen3.5-9B-GGUF:Q4_K_M
-        ${qwen35_ctx_256k}
        ${qwen35_sampling}
        ${common_args}
        ${thinking_off}
@@ -220,7 +199,6 @@ models:
    cmd: |
      /app/llama-server
        -hf unsloth/Qwen3.5-9B-GGUF:Q3_K_M
-        ${qwen35_ctx_256k}
        ${qwen35_sampling}
        ${common_args}
        ${thinking_on}
@@ -229,7 +207,6 @@ models:
    cmd: |
      /app/llama-server
        -hf unsloth/Qwen3.5-9B-GGUF:Q3_K_M
-        ${qwen35_ctx_256k}
        ${qwen35_sampling}
        ${common_args}
        ${thinking_off}
@@ -238,7 +215,6 @@ models:
    cmd: |
      /app/llama-server
        -hf unsloth/Qwen3.5-27B-GGUF:Q3_K_M
-        ${qwen35_ctx_256k}
        ${qwen35_sampling}
        ${common_args}
        ${thinking_on}
@@ -247,14 +223,6 @@ models:
    cmd: |
      /app/llama-server
        -hf unsloth/Qwen3.5-27B-GGUF:Q3_K_M
-        ${qwen35_ctx_256k}
        ${qwen35_sampling}
        ${common_args}
        ${thinking_off}
-
-  "GLM-4.7-Flash-GGUF:Q4_K_M":
-    cmd: |
-      /app/llama-server
-        -hf unsloth/GLM-4.7-Flash-GGUF:Q4_K_M
-        ${glm47_flash_args}
-        ${common_args}
--- a/apps/llama/deployment.yaml
+++ b/apps/llama/deployment.yaml
@@ -18,7 +18,7 @@ spec:
    spec:
      containers:
        - name: llama-swap
-          image: ghcr.io/mostlygeek/llama-swap:v199-vulkan-b8589
+          image: ghcr.io/mostlygeek/llama-swap:v198-vulkan-b8352
          imagePullPolicy: IfNotPresent
          command:
            - /app/llama-swap
--- a/apps/openwebui/kustomization.yaml
+++ b/apps/openwebui/kustomization.yaml
@@ -4,6 +4,5 @@ resources:
  - namespace.yaml
  - pvc.yaml
  - pvc-pipelines.yaml
-  - secret.yaml
  - release.yaml
  - ingress.yaml
--- a/apps/openwebui/release.yaml
+++ b/apps/openwebui/release.yaml
@@ -18,7 +18,7 @@ spec:
  chart:
    spec:
      chart: open-webui
-      version: 13.0.1
+      version: 12.10.0
      sourceRef:
        kind: HelmRepository
        name: open-webui
@@ -44,30 +44,3 @@ spec:
      persistence:
        enabled: true
        existingClaim: openwebui-pipelines-lvmhdd
-
-    # SSO with Authentik
-    extraEnvVars:
-      - name: WEBUI_URL
-        value: "https://openwebui.lumpiasty.xyz"
-      - name: OAUTH_CLIENT_ID
-        valueFrom:
-          secretKeyRef:
-            name: openwebui-authentik
-            key: client_id
-      - name: OAUTH_CLIENT_SECRET
-        valueFrom:
-          secretKeyRef:
-            name: openwebui-authentik
-            key: client_secret
-      - name: OAUTH_PROVIDER_NAME
-        value: "authentik"
-      - name: OPENID_PROVIDER_URL
-        value: "https://authentik.lumpiasty.xyz/application/o/open-web-ui/.well-known/openid-configuration"
-      - name: OPENID_REDIRECT_URI
-        value: "https://openwebui.lumpiasty.xyz/oauth/oidc/callback"
-      - name: ENABLE_OAUTH_SIGNUP
-        value: "true"
-      - name: ENABLE_LOGIN_FORM
-        value: "false"
-      - name: OAUTH_MERGE_ACCOUNTS_BY_EMAIL
-        value: "true"
--- a/apps/openwebui/secret.yaml
+++ b/apps/openwebui/secret.yaml
@@ -1,43 +0,0 @@
---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: openwebui-secret
-  namespace: openwebui
---
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: openwebui
-  namespace: openwebui
-spec:
-  method: kubernetes
-  mount: kubernetes
-  kubernetes:
-    role: openwebui
-    serviceAccount: openwebui-secret
---
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: openwebui-authentik
-  namespace: openwebui
-spec:
-  type: kv-v2
-
-  mount: secret
-  path: authentik/openwebui
-
-  destination:
-    create: true
-    name: openwebui-authentik
-    type: Opaque
-    transformation:
-      excludeRaw: true
-      templates:
-        client_id:
-          text: '{{ get .Secrets "client_id" }}'
-        client_secret:
-          text: '{{ get .Secrets "client_secret" }}'
-
-  vaultAuthRef: openwebui
--- a/apps/renovate/cronjob.yaml
+++ b/apps/renovate/cronjob.yaml
@@ -15,7 +15,7 @@ spec:
            - name: renovate
              # Update this to the latest available and then enable Renovate on
              # the manifest
-              image: renovate/renovate:43.95.0-full
+              image: renovate/renovate:43.76.2-full
              envFrom:
                - secretRef:
                    name: renovate-gitea-token
--- a/apps/woodpecker/kustomization.yaml
+++ b/apps/woodpecker/kustomization.yaml
@@ -1,8 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - postgres-volume.yaml
-  - postgres-cluster.yaml
-  - release.yaml
-  - secret.yaml
--- a/apps/woodpecker/namespace.yaml
+++ b/apps/woodpecker/namespace.yaml
@@ -1,5 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: woodpecker
--- a/apps/woodpecker/postgres-cluster.yaml
+++ b/apps/woodpecker/postgres-cluster.yaml
@@ -1,23 +0,0 @@
---
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: woodpecker-postgresql-cluster
-  namespace: woodpecker
-spec:
-  instances: 1
-
-  imageName: ghcr.io/cloudnative-pg/postgresql:17.4
-
-  bootstrap:
-    initdb:
-      database: woodpecker
-      owner: woodpecker
-
-  storage:
-    pvcTemplate:
-      storageClassName: ssd-lvmpv
-      resources:
-        requests:
-          storage: 10Gi
-      volumeName: woodpecker-postgresql-cluster-lvmssd
--- a/apps/woodpecker/postgres-volume.yaml
+++ b/apps/woodpecker/postgres-volume.yaml
@@ -1,33 +0,0 @@
-apiVersion: local.openebs.io/v1alpha1
-kind: LVMVolume
-metadata:
-  labels:
-    kubernetes.io/nodename: anapistula-delrosalae
-  name: woodpecker-postgresql-cluster-lvmssd
-  namespace: openebs
-spec:
-  capacity: 10Gi
-  ownerNodeID: anapistula-delrosalae
-  shared: "yes"
-  thinProvision: "no"
-  vgPattern: ^openebs-ssd$
-  volGroup: openebs-ssd
---
-kind: PersistentVolume
-apiVersion: v1
-metadata:
-  name: woodpecker-postgresql-cluster-lvmssd
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: ssd-lvmpv
-  volumeMode: Filesystem
-  csi:
-    driver: local.csi.openebs.io
-    fsType: btrfs
-    volumeHandle: woodpecker-postgresql-cluster-lvmssd
---
-# PVC is dynamically created by the Postgres operator
--- a/apps/woodpecker/release.yaml
+++ b/apps/woodpecker/release.yaml
@@ -1,115 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: woodpecker
-  namespace: woodpecker
-spec:
-  interval: 24h
-  url: https://woodpecker-ci.org/
---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: woodpecker
-  namespace: woodpecker
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: woodpecker
-      version: 3.5.1
-      sourceRef:
-        kind: HelmRepository
-        name: woodpecker
-        namespace: woodpecker
-      interval: 12h
-  values:
-    server:
-      enabled: true
-      statefulSet:
-        replicaCount: 1
-      
-      persistentVolume:
-        enabled: false # Using Postgresql database
-
-      env:
-        WOODPECKER_HOST: "https://woodpecker.lumpiasty.xyz"
-        # Gitea integration
-        WOODPECKER_GITEA: "true"
-        WOODPECKER_GITEA_URL: "https://gitea.lumpiasty.xyz"
-        # PostgreSQL database configuration
-        WOODPECKER_DATABASE_DRIVER: postgres
-        # Password is loaded from woodpecker-postgresql-cluster-app secret (created by CNPG)
-        WOODPECKER_DATABASE_DATASOURCE:
-          valueFrom:
-            secretKeyRef:
-              name: woodpecker-postgresql-cluster-app
-              key: fqdn-uri
-        # Allow logging in from all accounts on Gitea
-        WOODPECKER_OPEN: "true"
-        # Make lumpiasty admin
-        WOODPECKER_ADMIN: GiteaAdmin
-
-      createAgentSecret: true
-
-      extraSecretNamesForEnvFrom:
-        - woodpecker-secrets
-
-      ingress:
-        enabled: true
-        ingressClassName: nginx-ingress
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt
-          acme.cert-manager.io/http01-edit-in-place: "true"
-        hosts:
-          - host: woodpecker.lumpiasty.xyz
-            paths:
-              - path: /
-                backend:
-                  serviceName: woodpecker-server
-                  servicePort: 80
-        tls:
-          - hosts:
-              - woodpecker.lumpiasty.xyz
-            secretName: woodpecker-ingress
-
-      resources:
-        requests:
-          cpu: 100m
-          memory: 256Mi
-
-      service:
-        type: ClusterIP
-        port: 80
-
-    agent:
-      enabled: true
-      replicaCount: 2
-
-      env:
-        WOODPECKER_SERVER: "woodpecker-server:9000"
-        WOODPECKER_BACKEND: kubernetes
-        WOODPECKER_BACKEND_K8S_NAMESPACE: woodpecker
-        WOODPECKER_BACKEND_K8S_STORAGE_CLASS: ssd-lvmpv
-        WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 10G
-        WOODPECKER_BACKEND_K8S_STORAGE_RWX: false
-        WOODPECKER_CONNECT_RETRY_COUNT: "5"
-
-      mapAgentSecret: true
-
-      extraSecretNamesForEnvFrom:
-        - woodpecker-secrets
-
-      persistence:
-        enabled: false
-
-      serviceAccount:
-        create: true
-        rbac:
-          create: true
-
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
--- a/apps/woodpecker/secret.yaml
+++ b/apps/woodpecker/secret.yaml
@@ -1,62 +0,0 @@
---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: woodpecker-secret
-  namespace: woodpecker
---
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: woodpecker
-  namespace: woodpecker
-spec:
-  method: kubernetes
-  mount: kubernetes
-  kubernetes:
-    role: woodpecker
-    serviceAccount: woodpecker-secret
---
-# Main woodpecker secrets from Vault
-# Requires vault kv put secret/woodpecker \
-#   WOODPECKER_AGENT_SECRET="$(openssl rand -hex 32)" \
-#   WOODPECKER_GITEA_CLIENT="<gitea-oauth-client>" \
-#   WOODPECKER_GITEA_SECRET="<gitea-oauth-secret>"
-# Note: Database password comes from CNPG secret (woodpecker-postgresql-cluster-app)
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: woodpecker-secrets
-  namespace: woodpecker
-spec:
-  type: kv-v2
-  mount: secret
-  path: woodpecker
-  destination:
-    create: true
-    name: woodpecker-secrets
-    type: Opaque
-    transformation:
-      excludeRaw: true
-  vaultAuthRef: woodpecker
---
-# Container registry credentials for Kaniko
-# Requires vault kv put secret/container-registry \
-#   REGISTRY_USERNAME="<username>" \
-#   REGISTRY_PASSWORD="<token>"
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: container-registry
-  namespace: woodpecker
-spec:
-  type: kv-v2
-  mount: secret
-  path: container-registry
-  destination:
-    create: true
-    name: container-registry
-    type: Opaque
-    transformation:
-      excludeRaw: true
-  vaultAuthRef: woodpecker
--- a/infra/controllers/cert-manager-webhook-ovh.yaml
+++ b/infra/controllers/cert-manager-webhook-ovh.yaml
@@ -18,7 +18,7 @@ spec:
  chart:
    spec:
      chart: cert-manager-webhook-ovh
-      version: 0.9.5
+      version: 0.9.4
      sourceRef:
        kind: HelmRepository
        name: cert-manager-webhook-ovh
--- a/infra/controllers/cert-manager.yaml
+++ b/infra/controllers/cert-manager.yaml
@@ -23,7 +23,7 @@ spec:
  chart:
    spec:
      chart: cert-manager
-      version: v1.20.1
+      version: v1.20.0
      sourceRef:
        kind: HelmRepository
        name: cert-manager
--- a/infra/controllers/cilium.yaml
+++ b/infra/controllers/cilium.yaml
@@ -23,7 +23,7 @@ spec:
  chart:
    spec:
      chart: cilium
-      version: 1.19.2
+      version: 1.19.1
      sourceRef:
        kind: HelmRepository
        name: cilium
--- a/infra/controllers/k8up.yaml
+++ b/infra/controllers/k8up.yaml
@@ -23,7 +23,7 @@ spec:
  chart:
    spec:
      chart: k8up
-      version: 4.9.0
+      version: 4.8.6
      sourceRef:
        kind: HelmRepository
        name: k8up-io
--- a/infra/controllers/nginx-ingress.yaml
+++ b/infra/controllers/nginx-ingress.yaml
@@ -23,7 +23,7 @@ spec:
  chart:
    spec:
      chart: ingress-nginx
-      version: 4.15.1
+      version: 4.15.0
      sourceRef:
        kind: HelmRepository
        name: ingress-nginx
--- a/infra/controllers/openbao.yaml
+++ b/infra/controllers/openbao.yaml
@@ -23,7 +23,7 @@ spec:
  chart:
    spec:
      chart: openbao
-      version: 0.26.2
+      version: 0.26.0
      sourceRef:
        kind: HelmRepository
        name: openbao
--- a/vault/kubernetes-roles/crawl4ai.yaml
+++ b/vault/kubernetes-roles/crawl4ai.yaml
@@ -1,6 +0,0 @@
-bound_service_account_names:
-  - crawl4ai-secret
-bound_service_account_namespaces:
-  - crawl4ai
-token_policies:
-  - crawl4ai
--- a/vault/kubernetes-roles/openwebui.yaml
+++ b/vault/kubernetes-roles/openwebui.yaml
@@ -1,6 +0,0 @@
-bound_service_account_names:
-  - openwebui-secret
-bound_service_account_namespaces:
-  - openwebui
-token_policies:
-  - openwebui
--- a/vault/kubernetes-roles/woodpecker.yaml
+++ b/vault/kubernetes-roles/woodpecker.yaml
@@ -1,6 +0,0 @@
-bound_service_account_names:
-  - woodpecker-secret
-bound_service_account_namespaces:
-  - woodpecker
-token_policies:
-  - woodpecker
--- a/vault/policy/crawl4ai.hcl
+++ b/vault/policy/crawl4ai.hcl
@@ -1,3 +0,0 @@
-path "secret/data/crawl4ai" {
-    capabilities = ["read"]
-}
--- a/vault/policy/openwebui.hcl
+++ b/vault/policy/openwebui.hcl
@@ -1,3 +0,0 @@
-path "secret/data/authentik/openwebui" {
-    capabilities = ["read"]
-}
--- a/vault/policy/woodpecker.hcl
+++ b/vault/policy/woodpecker.hcl
@@ -1,7 +0,0 @@
-path "secret/data/woodpecker" {
-    capabilities = ["read"]
-}
-
-path "secret/data/container-registry" {
-    capabilities = ["read"]
-}