+2 -2

k8s/charts/audiobookshelf/templates/deployment.yaml

Reviewed

··· 23 23 - key: node.kubernetes.io/not-ready 24 24 operator: Exists 25 25 effect: NoExecute 26 26 - tolerationSeconds: 60 26 26 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 27 27 - key: node.kubernetes.io/unreachable 28 28 operator: Exists 29 29 effect: NoExecute 30 30 - tolerationSeconds: 60 30 30 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 31 31 containers: 32 32 - name: {{ .Chart.Name }} 33 33 image: ghcr.io/advplyr/audiobookshelf:2.35.1@sha256:1eef6716183c52abafe5405e7d6be8390248ecd59c7488c44af871757ac8fc4d

+2 -2

k8s/charts/bluesky-pds/templates/deployment.yaml

Reviewed

··· 26 26 - key: node.kubernetes.io/not-ready 27 27 operator: Exists 28 28 effect: NoExecute 29 29 - tolerationSeconds: 60 29 29 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 30 30 - key: node.kubernetes.io/unreachable 31 31 operator: Exists 32 32 effect: NoExecute 33 33 - tolerationSeconds: 60 33 33 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 34 34 containers: 35 35 - name: {{ .Chart.Name }} 36 36 image: ghcr.io/bluesky-social/pds:latest@sha256:1fa8bbceabb65d8e1710749b1ea92c1c20a7489ca38da4a0a5f64c0c10a70c29

+2 -2

k8s/charts/collabora/templates/deployment.yaml

Reviewed

··· 23 23 - key: node.kubernetes.io/not-ready 24 24 operator: Exists 25 25 effect: NoExecute 26 26 - tolerationSeconds: 60 26 26 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 27 27 - key: node.kubernetes.io/unreachable 28 28 operator: Exists 29 29 effect: NoExecute 30 30 - tolerationSeconds: 60 30 30 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 31 31 containers: 32 32 - name: {{ .Chart.Name }} 33 33 image: docker.io/collabora/code:latest@sha256:75859dc9f9084d1877ce36cf96ec86600f495bade33289c9cbc27e0a0ee23b81

+2 -2

k8s/charts/forgejo/templates/deployment.yaml

Reviewed

··· 27 27 - key: node.kubernetes.io/not-ready 28 28 operator: Exists 29 29 effect: NoExecute 30 30 - tolerationSeconds: 60 30 30 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 31 31 - key: node.kubernetes.io/unreachable 32 32 operator: Exists 33 33 effect: NoExecute 34 34 - tolerationSeconds: 60 34 34 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 35 35 containers: 36 36 - name: {{ .Chart.Name }} 37 37 image: codeberg.org/forgejo/forgejo:15@sha256:55bb42bec9abef5223744804f164e37d37b20df7e8b8b4807ba213ad4f071d6d

+2 -4

k8s/charts/forward-auth/templates/deployment.yaml

Reviewed

··· 24 24 securityContext: 25 25 seccompProfile: 26 26 type: RuntimeDefault 27 27 - {{- with $.Values.failover }} 28 27 tolerations: 29 28 - key: node.kubernetes.io/not-ready 30 29 operator: Exists 31 30 effect: NoExecute 32 32 - tolerationSeconds: {{ .fastTolerationSeconds }} 31 31 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 33 32 - key: node.kubernetes.io/unreachable 34 33 operator: Exists 35 34 effect: NoExecute 36 36 - tolerationSeconds: {{ .fastTolerationSeconds }} 37 37 - {{- end }} 35 35 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 38 36 containers: 39 37 - name: forward-auth 40 38 image: "{{ $.Values.image.repository }}:{{ $.Values.image.tag }}"

+2 -8

k8s/charts/forward-auth/values.yaml

Reviewed

··· 1 1 - # traefik-forward-auth, one TFA pod per protected app. Each app entry 2 2 - # becomes a Deployment, Service, Ingress, Middleware and Secret (all 3 3 - # named forward-auth-<key>), plus an auth-<key>.cute.haus callback host. 4 4 - # The OIDC client creds live in a separate Secret that ansible writes — 5 5 - # see ansible/playbooks/tasks/integrations/forward-auth.yml. 1 1 + # Per-app traefik-forward-auth deployments. Each entry renders a 2 2 + # Deployment + Service + Ingress + Middleware + Secret pair. 6 3 7 4 image: 8 5 repository: thomseddon/traefik-forward-auth ··· 16 13 limits: 17 14 cpu: 500m 18 15 memory: 128Mi 19 19 - 20 20 - failover: 21 21 - fastTolerationSeconds: 60 22 16 23 17 ingressClassName: traefik 24 18 tlsSecret: cute-haus-tls

+2 -2

k8s/charts/immich/templates/deployment-ml.yaml

Reviewed

··· 26 26 - key: node.kubernetes.io/not-ready 27 27 operator: Exists 28 28 effect: NoExecute 29 29 - tolerationSeconds: 60 29 29 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 30 30 - key: node.kubernetes.io/unreachable 31 31 operator: Exists 32 32 effect: NoExecute 33 33 - tolerationSeconds: 60 33 33 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 34 34 nodeSelector: 35 35 kubernetes.io/hostname: jubilife 36 36 containers:

+2 -2

k8s/charts/immich/templates/deployment.yaml

Reviewed

··· 26 26 - key: node.kubernetes.io/not-ready 27 27 operator: Exists 28 28 effect: NoExecute 29 29 - tolerationSeconds: 60 29 29 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 30 30 - key: node.kubernetes.io/unreachable 31 31 operator: Exists 32 32 effect: NoExecute 33 33 - tolerationSeconds: 60 33 33 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 34 34 nodeSelector: 35 35 kubernetes.io/hostname: jubilife 36 36 containers:

+2 -2

k8s/charts/immich/templates/statefulset-postgres.yaml

Reviewed

··· 25 25 - key: node.kubernetes.io/not-ready 26 26 operator: Exists 27 27 effect: NoExecute 28 28 - tolerationSeconds: 60 28 28 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 29 29 - key: node.kubernetes.io/unreachable 30 30 operator: Exists 31 31 effect: NoExecute 32 32 - tolerationSeconds: 60 32 32 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 33 33 nodeSelector: 34 34 kubernetes.io/hostname: jubilife 35 35 containers:

+2 -2

k8s/charts/jellyfin/templates/deployment.yaml

Reviewed

··· 26 26 - key: node.kubernetes.io/not-ready 27 27 operator: Exists 28 28 effect: NoExecute 29 29 - tolerationSeconds: 60 29 29 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 30 30 - key: node.kubernetes.io/unreachable 31 31 operator: Exists 32 32 effect: NoExecute 33 33 - tolerationSeconds: 60 33 33 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 34 34 nodeSelector: 35 35 kubernetes.io/hostname: jubilife 36 36 containers:

+2 -2

k8s/charts/morsels/templates/deployment.yaml

Reviewed

··· 26 26 - key: node.kubernetes.io/not-ready 27 27 operator: Exists 28 28 effect: NoExecute 29 29 - tolerationSeconds: 60 29 29 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 30 30 - key: node.kubernetes.io/unreachable 31 31 operator: Exists 32 32 effect: NoExecute 33 33 - tolerationSeconds: 60 33 33 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 34 34 containers: 35 35 - name: {{ .Chart.Name }} 36 36 image: ghcr.io/alyraffauf/morsels:latest@sha256:e58cd4de9fa605ce945ef184d729f288e5b2d4dafc7a7f4b495ddb12dd3610bf

+2 -2

k8s/charts/navidrome/templates/deployment.yaml

Reviewed

··· 27 27 - key: node.kubernetes.io/not-ready 28 28 operator: Exists 29 29 effect: NoExecute 30 30 - tolerationSeconds: 60 30 30 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 31 31 - key: node.kubernetes.io/unreachable 32 32 operator: Exists 33 33 effect: NoExecute 34 34 - tolerationSeconds: 60 34 34 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 35 35 nodeSelector: 36 36 kubernetes.io/hostname: jubilife 37 37 containers:

+2 -2

k8s/charts/nextcloud/templates/deployment.yaml

Reviewed

··· 27 27 - key: node.kubernetes.io/not-ready 28 28 operator: Exists 29 29 effect: NoExecute 30 30 - tolerationSeconds: 60 30 30 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 31 31 - key: node.kubernetes.io/unreachable 32 32 operator: Exists 33 33 effect: NoExecute 34 34 - tolerationSeconds: 60 34 34 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 35 35 containers: 36 36 - name: {{ .Chart.Name }} 37 37 image: docker.io/library/nextcloud:34-apache@sha256:4d4a6b5ed15a7eb4537538c848eb78833f53bed62f93e7d5af144f360cd53ff2

+2 -2

k8s/charts/ombi/templates/deployment.yaml

Reviewed

··· 27 27 - key: node.kubernetes.io/not-ready 28 28 operator: Exists 29 29 effect: NoExecute 30 30 - tolerationSeconds: 60 30 30 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 31 31 - key: node.kubernetes.io/unreachable 32 32 operator: Exists 33 33 effect: NoExecute 34 34 - tolerationSeconds: 60 34 34 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 35 35 containers: 36 36 - name: {{ .Chart.Name }} 37 37 image: lscr.io/linuxserver/ombi:latest@sha256:aa44c36e0c79a8c53dcf6c7f03559c8fcead701cece03a2ee1d08a3e6f13b4d5

+2 -2

k8s/charts/paperless/templates/deployment.yaml

Reviewed

··· 25 25 - key: node.kubernetes.io/not-ready 26 26 operator: Exists 27 27 effect: NoExecute 28 28 - tolerationSeconds: 60 28 28 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 29 29 - key: node.kubernetes.io/unreachable 30 30 operator: Exists 31 31 effect: NoExecute 32 32 - tolerationSeconds: 60 32 32 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 33 33 initContainers: 34 34 - name: wait-deps 35 35 image: {{ .Values.global.images.alpine }}

+3 -14

k8s/charts/pg-shared/templates/cluster.yaml

Reviewed

··· 32 32 - key: topology.kubernetes.io/zone 33 33 operator: In 34 34 values: [home] 35 35 - {{- with .Values.failover }} 36 36 - {{- if .fastTolerationSeconds }} 37 35 tolerations: 38 36 - key: node.kubernetes.io/not-ready 39 37 operator: Exists 40 38 effect: NoExecute 41 41 - tolerationSeconds: {{ .fastTolerationSeconds }} 39 39 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 42 40 - key: node.kubernetes.io/unreachable 43 41 operator: Exists 44 42 effect: NoExecute 45 45 - tolerationSeconds: {{ .fastTolerationSeconds }} 46 46 - {{- end }} 47 47 - {{- end }} 43 43 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 48 44 49 45 topologySpreadConstraints: 50 46 - maxSkew: 1 ··· 55 51 cnpg.io/cluster: {{ .Values.cluster.name }} 56 52 57 53 postgresql: 58 58 - parameters: 59 59 - max_connections: "200" 60 60 - shared_buffers: 1GB 61 61 - effective_cache_size: 2GB 62 62 - work_mem: 16MB 63 63 - maintenance_work_mem: 128MB 64 64 - random_page_cost: "1.1" 65 65 - effective_io_concurrency: "200" 54 54 + {{- toYaml .Values.postgresql | nindent 4 }} 66 55 67 56 monitoring: 68 57 enablePodMonitor: false

+14 -17

k8s/charts/pg-shared/values.yaml

Reviewed

··· 22 22 # Spread instances across control-plane nodes 23 23 topologyKey: kubernetes.io/hostname 24 24 25 25 - # Shorten the per-pod toleration for not-ready/unreachable taints so CNPG 26 26 - # fails over to a healthy replica sooner when a node dies. Default would be 27 27 - # 300s; mirroring the 60s we use for app pods cuts forgejo etc. recovery 28 28 - # time from ~6min to ~2min. 29 29 - failover: 30 30 - fastTolerationSeconds: 60 25 25 + # Tuned for a small shared cluster; bump if individual apps need more 26 26 + # connections or heavier analytical workloads. 27 27 + postgresql: 28 28 + parameters: 29 29 + max_connections: "200" 30 30 + shared_buffers: 1GB 31 31 + effective_cache_size: 2GB 32 32 + work_mem: 16MB 33 33 + maintenance_work_mem: 128MB 34 34 + random_page_cost: "1.1" 35 35 + effective_io_concurrency: "200" 31 36 32 32 - # Declarative role + database management. Each entry produces: 33 33 - # - kubernetes.io/basic-auth Secret (<name>-pg-creds) consumed by CNPG 34 34 - # - entry under Cluster.spec.managed.roles[] (CNPG creates/maintains role) 35 35 - # - Database CRD owned by the role (defaults to role name; override via 36 36 - # `database: <name>`). 37 37 - # Passwords come from values/secrets/pg-shared.yaml via vals + sops. 38 38 - # Apps consume their connection string via DATABASE_URL refs into 39 39 - # secrets/pg-roles.yaml. 37 37 + # Declarative CNPG roles + databases. Passwords come from 38 38 + # values/secrets/pg-shared.yaml via vals + sops. 40 39 roles: {} 41 40 42 42 - # B2 (S3-compatible) backup of the cnpg cluster. WAL archiving is continuous; 43 43 - # base backup runs on the schedule below. WAL retention is implicit — CNPG 44 44 - # keeps enough WAL to PITR from the oldest base backup within retentionPolicy. 41 41 + # B2 backup target for CNPG base backups + WAL archiving. 45 42 # Filled by values/secrets/pg-shared.yaml. 46 43 backup: 47 44 enabled: false

+2 -2

k8s/charts/plex/templates/deployment.yaml

Reviewed

··· 32 32 - key: node.kubernetes.io/not-ready 33 33 operator: Exists 34 34 effect: NoExecute 35 35 - tolerationSeconds: 60 35 35 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 36 36 - key: node.kubernetes.io/unreachable 37 37 operator: Exists 38 38 effect: NoExecute 39 39 - tolerationSeconds: 60 39 39 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 40 40 initContainers: 41 41 # Add custom plugins/scanners 42 42 - name: plugins

+1 -3

k8s/charts/plex/values.yaml

Reviewed

··· 1 1 - # Plex plugins/scanners are provisioned into the config volume by an initContainer 2 2 - # on every pod start, pinned to exact commits via GitHub archive tarballs. 3 3 - # initContainer image comes from values/global.yaml → .Values.global.images.alpine 1 1 + # Plugins and scanners provisioned by initContainer on every pod start. 4 2 plugins: 5 3 # Cloned wholesale into "Plug-ins/<name>". 6 4 bundles:

+2 -2

k8s/charts/pocket-id/templates/deployment.yaml

Reviewed

··· 27 27 - key: node.kubernetes.io/not-ready 28 28 operator: Exists 29 29 effect: NoExecute 30 30 - tolerationSeconds: 60 30 30 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 31 31 - key: node.kubernetes.io/unreachable 32 32 operator: Exists 33 33 effect: NoExecute 34 34 - tolerationSeconds: 60 34 34 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 35 35 containers: 36 36 - name: {{ .Chart.Name }} 37 37 image: ghcr.io/pocket-id/pocket-id:v2@sha256:a2a38a96699d7483d65b5849b015d954f294938306a03a9c0699bc5b79554e86

+2 -2

k8s/charts/tranquil-pds/templates/deployment.yaml

Reviewed

··· 24 24 - key: node.kubernetes.io/not-ready 25 25 operator: Exists 26 26 effect: NoExecute 27 27 - tolerationSeconds: 60 27 27 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 28 28 - key: node.kubernetes.io/unreachable 29 29 operator: Exists 30 30 effect: NoExecute 31 31 - tolerationSeconds: 60 31 31 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 32 32 imagePullSecrets: 33 33 - name: atcr-pull 34 34 topologySpreadConstraints:

+2 -2

k8s/charts/uptime-kuma/templates/deployment.yaml

Reviewed

··· 26 26 - key: node.kubernetes.io/not-ready 27 27 operator: Exists 28 28 effect: NoExecute 29 29 - tolerationSeconds: 60 29 29 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 30 30 - key: node.kubernetes.io/unreachable 31 31 operator: Exists 32 32 effect: NoExecute 33 33 - tolerationSeconds: 60 33 33 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 34 34 containers: 35 35 - name: {{ .Chart.Name }} 36 36 image: louislam/uptime-kuma:2@sha256:91e963bfda569ba115206e843febb446f473ab525add4e08b2b9e3beffa16985

+3 -7

k8s/charts/valkey/templates/deployment.yaml

Reviewed

··· 26 26 - key: node.kubernetes.io/not-ready 27 27 operator: Exists 28 28 effect: NoExecute 29 29 - tolerationSeconds: 60 29 29 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 30 30 - key: node.kubernetes.io/unreachable 31 31 operator: Exists 32 32 effect: NoExecute 33 33 - tolerationSeconds: 60 33 33 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 34 34 containers: 35 35 - name: {{ .Chart.Name }} 36 36 image: valkey/valkey:9-alpine@sha256:a35428eba9043cc0b79dbe54100f0c92784f2de00ad09b01182bfb1c5c83d1bd 37 37 imagePullPolicy: IfNotPresent 38 38 args: 39 39 - - valkey-server 40 40 - - --maxmemory 41 41 - - 1gb 42 42 - - --maxmemory-policy 43 43 - - volatile-lru 39 39 + {{- toYaml .Values.args | nindent 12 }} 44 40 ports: 45 41 - name: valkey 46 42 containerPort: 6379

+6

k8s/charts/valkey/values.yaml

Reviewed

··· 1 1 + args: 2 2 + - valkey-server 3 3 + - --maxmemory 4 4 + - 1gb 5 5 + - --maxmemory-policy 6 6 + - volatile-lru

+2 -2

k8s/charts/vaultwarden/templates/deployment.yaml

Reviewed

··· 26 26 - key: node.kubernetes.io/not-ready 27 27 operator: Exists 28 28 effect: NoExecute 29 29 - tolerationSeconds: 60 29 29 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 30 30 - key: node.kubernetes.io/unreachable 31 31 operator: Exists 32 32 effect: NoExecute 33 33 - tolerationSeconds: 60 33 33 + tolerationSeconds: {{ $.Values.global.failover.fastTolerationSeconds | default 60 }} 34 34 containers: 35 35 - name: {{ .Chart.Name }} 36 36 image: vaultwarden/server:latest@sha256:d626d04934cd1192ad8ced1adb975099fca78cec33ab467d2d3c923cde7f3b0c

+38

k8s/helmfile.yaml

Reviewed

··· 86 86 createNamespace: true 87 87 chart: ./charts/longhorn-creds 88 88 values: 89 89 + - values/global.yaml 89 90 - values/secrets/longhorn-creds.yaml 90 91 91 92 - name: longhorn ··· 144 145 needs: 145 146 - cert-manager/cert-manager 146 147 values: 148 148 + - values/global.yaml 147 149 - values/secrets/cert-manager.yaml 148 150 149 151 - name: tailscale-operator ··· 291 293 needs: 292 294 - cnpg-system/cnpg 293 295 values: 296 296 + - values/global.yaml 294 297 - values/secrets/pg-shared.yaml 295 298 296 299 # Shared cache/queue/broker backend; apps pick their own logical DB number. 297 300 - name: valkey 298 301 namespace: default 299 302 chart: ./charts/valkey 303 303 + values: 304 304 + - values/global.yaml 300 305 301 306 # Apache Tika (document parsing + OCR) and Gotenberg (doc-to-PDF). 302 307 # Paperless offloads OCR and conversion to these. 303 308 - name: tika 304 309 namespace: default 305 310 chart: ./charts/tika 311 311 + values: 312 312 + - values/global.yaml 306 313 307 314 - name: gotenberg 308 315 namespace: default 309 316 chart: ./charts/gotenberg 317 317 + values: 318 318 + - values/global.yaml 310 319 311 320 # Cloudflare Origin TLS Secrets per domain (morsels-blue). Apps reference 312 321 # these by name in ingress.routes. ··· 314 323 namespace: default 315 324 chart: ./charts/cluster-tls 316 325 values: 326 326 + - values/global.yaml 317 327 - values/secrets/cluster-tls.yaml 318 328 319 329 # ─── Apps ─────────────────────────────────────────────────────────────── ··· 323 333 chart: ./charts/error-pages 324 334 needs: 325 335 - default/cluster-tls 336 336 + values: 337 337 + - values/global.yaml 326 338 327 339 - name: aly-codes 328 340 namespace: default 329 341 chart: ./charts/aly-codes 330 342 needs: 331 343 - default/cluster-tls 344 344 + values: 345 345 + - values/global.yaml 332 346 333 347 - name: switchyard 334 348 namespace: default 335 349 chart: ./charts/switchyard 336 350 needs: 337 351 - default/cluster-tls 352 352 + values: 353 353 + - values/global.yaml 338 354 339 355 - name: audiobookshelf 340 356 namespace: default ··· 350 366 chart: ./charts/watsup 351 367 needs: 352 368 - default/cluster-tls 369 369 + values: 370 370 + - values/global.yaml 353 371 354 372 - name: morsels 355 373 namespace: default 356 374 chart: ./charts/morsels 357 375 needs: 358 376 - default/cluster-tls 377 377 + values: 378 378 + - values/global.yaml 359 379 360 380 - name: ombi 361 381 namespace: default 362 382 chart: ./charts/ombi 363 383 needs: 364 384 - default/cluster-tls 385 385 + values: 386 386 + - values/global.yaml 365 387 366 388 - name: pocket-id 367 389 namespace: default ··· 370 392 - default/cluster-tls 371 393 - cnpg-system/pg-shared 372 394 values: 395 395 + - values/global.yaml 373 396 - values/secrets/pocket-id.yaml 374 397 375 398 - name: forward-auth ··· 378 401 needs: 379 402 - default/cluster-tls 380 403 values: 404 404 + - values/global.yaml 381 405 - values/secrets/forward-auth.yaml 382 406 383 407 - name: immich ··· 387 411 - default/cluster-tls 388 412 - default/valkey 389 413 values: 414 414 + - values/global.yaml 390 415 - values/secrets/immich.yaml 391 416 392 417 - name: jellyfin ··· 394 419 chart: ./charts/jellyfin 395 420 needs: 396 421 - default/cluster-tls 422 422 + values: 423 423 + - values/global.yaml 397 424 398 425 - name: plex 399 426 namespace: default ··· 410 437 - default/cluster-tls 411 438 - default/forward-auth 412 439 values: 440 440 + - values/global.yaml 413 441 - values/secrets/navidrome.yaml 414 442 415 443 - name: paperless ··· 433 461 - cnpg-system/pg-shared 434 462 - default/valkey 435 463 values: 464 464 + - values/global.yaml 436 465 - values/secrets/nextcloud.yaml 437 466 438 467 - name: collabora ··· 440 469 chart: ./charts/collabora 441 470 needs: 442 471 - default/cluster-tls 472 472 + values: 473 473 + - values/global.yaml 443 474 444 475 - name: uptime-kuma 445 476 namespace: default 446 477 chart: ./charts/uptime-kuma 447 478 needs: 448 479 - default/cluster-tls 480 480 + values: 481 481 + - values/global.yaml 449 482 450 483 - name: vaultwarden 451 484 namespace: default ··· 453 486 needs: 454 487 - default/cluster-tls 455 488 values: 489 489 + - values/global.yaml 456 490 - values/secrets/vaultwarden.yaml 457 491 458 492 # Postgres role + database managed declaratively by pg-shared. ··· 464 498 - cnpg-system/pg-shared 465 499 - default/valkey 466 500 values: 501 501 + - values/global.yaml 467 502 - values/secrets/forgejo.yaml 468 503 469 504 - name: tranquil-pds ··· 473 508 - default/cluster-tls 474 509 - cnpg-system/pg-shared 475 510 values: 511 511 + - values/global.yaml 476 512 - values/secrets/tranquil-pds.yaml 477 513 478 514 # Ingress + Service + EndpointSlice for services that live OUTSIDE the ··· 484 520 needs: 485 521 - default/cluster-tls 486 522 - tailscale/tailscale-operator 523 523 + values: 524 524 + - values/global.yaml

+7 -3

k8s/values/global.yaml

Reviewed

··· 1 1 - # Shared OCI image pins used across charts. Bump a digest here once and 2 2 - # every initContainer / sidecar that references these values picks it up. 3 3 - # Goal: prevent pull churn by reusing the same pinned images everywhere. 1 1 + # Shared operational constants and OCI image pins. Bump once and every 2 2 + # chart that references these values picks it up automatically. 4 3 global: 5 4 images: 6 5 alpine: docker.io/library/alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b 7 6 rclone: rclone/rclone:1.74@sha256:623378ad0ff3ebd5cebf77720843c0e02edfe46e2d5b5ac6bed54c6371780dfb 7 7 + 8 8 + failover: 9 9 + # Fast eviction when a node goes NotReady/Unreachable. Mirrors the 10 10 + # app-pod toleration so CNPG and stateful workloads fail over quickly. 11 11 + fastTolerationSeconds: 60