chore(deps): update container image adminer to latest@0ce7583 (#15224)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| adminer | digest | `3b3012a` -> `0ce7583` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://togithub.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy42NC4zIiwidXBkYXRlZEluVmVyIjoiMzcuNjQuMyIsInRhcmdldEJyYW5jaCI6Im1hc3RlciJ9-->

.all-contributorsrc

@@ -2099,6 +2099,25 @@
       "contributions": [
         "doc"
       ]
+    },
+    {
+      "login": "Tanguille",
+      "name": "Tanguille",
+      "avatar_url": "https://avatars.githubusercontent.com/u/91473554?v=4",
+      "profile": "https://github.com/Tanguille",
+      "contributions": [
+        "doc"
+      ]
+    },
+    {
+      "login": "Plinsboorg",
+      "name": "Dennis",
+      "avatar_url": "https://avatars.githubusercontent.com/u/42300339?v=4",
+      "profile": "https://github.com/Plinsboorg",
+      "contributions": [
+        "bug",
+        "doc"
+      ]
     }
   ],
   "contributorsPerLine": 7,

.github/README.md

@@ -124,7 +124,7 @@ A lot of our work is based on the great effort of others. We would love to exten
 ## Contributors ✨
 
 <!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
-[![All Contributors](https://img.shields.io/badge/all_contributors-225-orange.svg?style=for-the-badge)](#contributors)
+[![All Contributors](https://img.shields.io/badge/all_contributors-227-orange.svg?style=for-the-badge)](#contributors)
 <!-- ALL-CONTRIBUTORS-BADGE:END -->
 
 Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
@@ -426,6 +426,8 @@ Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/d
     </tr>
     <tr>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/jon-stumpf"><img src="https://avatars.githubusercontent.com/u/7144996?v=4?s=100" width="100px;" alt="Jon S. Stumpf"/><br /><sub><b>Jon S. Stumpf</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=jon-stumpf" title="Documentation">📖</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/Tanguille"><img src="https://avatars.githubusercontent.com/u/91473554?v=4?s=100" width="100px;" alt="Tanguille"/><br /><sub><b>Tanguille</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=Tanguille" title="Documentation">📖</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/Plinsboorg"><img src="https://avatars.githubusercontent.com/u/42300339?v=4?s=100" width="100px;" alt="Dennis"/><br /><sub><b>Dennis</b></sub></a><br /><a href="https://github.com/truecharts/charts/issues?q=author%3APlinsboorg" title="Bug reports">🐛</a> <a href="https://github.com/truecharts/charts/commits?author=Plinsboorg" title="Documentation">📖</a></td>
     </tr>
   </tbody>
 </table>

.github/ct-install.yaml

@@ -50,3 +50,7 @@ chart-repos:
   - truecharts-library=https://library-charts.truecharts.org
   - truecharts-deps=https://deps.truecharts.org
   - jetstack=https://charts.jetstack.io
+  - vmwaretanzu=https://vmware-tanzu.github.io/helm-charts
+  - cnpg=https://cloudnative-pg.github.io/charts
+  - metallb=https://metallb.github.io/metallb
+  - prometheus-community=https://prometheus-community.github.io/helm-charts

.github/ct-lint.yaml

@@ -15,3 +15,7 @@ chart-repos:
   - truecharts-library=https://library-charts.truecharts.org
   - truecharts-deps=https://deps.truecharts.org
   - jetstack=https://charts.jetstack.io
+  - vmwaretanzu=https://vmware-tanzu.github.io/helm-charts
+  - cnpg=https://cloudnative-pg.github.io/charts
+  - metallb=https://metallb.github.io/metallb
+  - prometheus-community=https://prometheus-community.github.io/helm-charts

.github/renovate-config.js

@@ -1,23 +0,0 @@
-module.exports = {
-  dryRun: false,
-  username: "truecharts-admin",
-  gitAuthor: "truecharts-admin <bot@truecharts.org>",
-  onboarding: false,
-  platform: "github",
-  repositories: ["truecharts/charts"],
-  packageRules: [
-    {
-      description: "lockFileMaintenance",
-      matchUpdateTypes: [
-        "pin",
-        "digest",
-        "patch",
-        "minor",
-        "major",
-        "lockFileMaintenance",
-      ],
-      dependencyDashboardApproval: false,
-      stabilityDays: 0,
-    },
-  ],
-};

.github/renovate.json5

@@ -33,16 +33,6 @@
       "commitMessageTopic": "Helm chart {{depName}}"
     },
     // global docker datasource settings
-    {
-      "datasources": ["docker"],
-      "matchManagers": ["helm-values"],
-      "enabled": true,
-      "pinDigests": true,
-      "automerge": false,
-      "commitMessageTopic": "container image {{depName}}",
-      "commitMessageExtra": "to {{#if isSingleVersion}}v{{{newVersion}}}{{else}}{{{newValue}}}{{/if}}",
-      "matchUpdateTypes": ["major", "minor", "patch", "digest"],
-    },
     {
       "datasources": ["docker"],
       "enabled": true,
@@ -50,7 +40,7 @@
       "automerge": false,
       "separateMinorPatch": true,
       "commitMessageTopic": "container image {{depName}}",
-      "commitMessageExtra": "to {{#if isSingleVersion}}v{{{newVersion}}}{{else}}{{{newValue}}}{{/if}}",
+      "commitMessageExtra": "to {{#if isSingleVersion}}v{{{newVersion}}}{{else}}{{{newValue}}}{{/if}}@{{newDigestShort}}",
     },
     // Setup datasources for github actions
     {
@@ -101,8 +91,24 @@
       "matchDatasources": ["helm"],
       "automerge": false,
       "matchUpdateTypes": [
-        "minor",
-        "patch"
+        "minor"
+      ],
+      "enabled": true,
+      "bumpVersion": "patch",
+      "labels": ["update/helm/general/non-major", "automerge"],
+      "groupName": "helm general non-major",
+      "matchPaths": ["charts/enterprise/**", "charts/operators/**"],
+      "schedule": [
+        "before 10pm on tuesday"
+      ],
+    },
+    {
+      "matchDatasources": ["helm"],
+      "automerge": true,
+      "matchUpdateTypes": [
+        "digest",
+        "patch",
+        "pin"
       ],
       "enabled": true,
       "bumpVersion": "patch",
@@ -128,13 +134,30 @@
         "before 10pm on tuesday"
       ],
     },
+
     {
       "matchDatasources": ["helm"],
-      "automerge": false,
+      "automerge": true,
       "enabled": true,
       "matchUpdateTypes": [
-        "minor",
-        "patch"
+        "minor"
+      ],
+      "bumpVersion": "patch",
+      "labels": ["update/helm/general/non-major", "automerge"],
+      "groupName": "helm general non-major",
+      "matchPaths": ["charts/incubator/**", "charts/SCALE/**", "charts/dev/**", "charts/stable/**", "templates/app/**"],
+      "schedule": [
+        "before 10pm on tuesday"
+      ],
+    },
+    {
+      "matchDatasources": ["helm"],
+      "automerge": true,
+      "enabled": true,
+      "matchUpdateTypes": [
+        "digest",
+        "patch",
+        "pin"
       ],
       "bumpVersion": "patch",
       "labels": ["update/helm/general/non-major", "automerge"],
@@ -145,14 +168,14 @@
       ],
     },
     //
-    // Tag updates for semantic tags on enterprise and operatorApps
+    // Tag updates for semantic Docker tags on enterprise and operatorApps
     //
     {
       "matchDatasources": ["docker"],
       "updateTypes": ["major"],
       "enabled": true,
       "bumpVersion": "major",
-      "labels": ["update/docker/enterprise/major"],
+      "labels": ["update/docker/major"],
       "matchPaths": ["charts/enterprise/**", "charts/operators/**"],
     },
     {
@@ -162,13 +185,13 @@
         "minor",
       ],
       "enabled": true,
-      "bumpVersion": "patch",
-      "labels": ["update/docker/enterprise/minor"],
+      "bumpVersion": "minor",
+      "labels": ["update/docker/minor"],
       "matchPaths": ["charts/enterprise/**", "charts/operators/**"],
     },
     {
       "matchDatasources": ["docker"],
-      "automerge": false,
+      "automerge": true,
       "matchUpdateTypes": [
         "patch",
         "digest",
@@ -176,21 +199,8 @@
       ],
       "bumpVersion": "patch",
       "enabled": true,
-      "labels": ["update/docker/enterprise/patch", "automerge"],
-      "matchPaths": ["charts/enterprise/**"],
-    },
-    {
-      "matchDatasources": ["docker"],
-      "automerge": false,
-      "matchUpdateTypes": [
-        "patch",
-        "digest",
-        "pin",
-      ],
-      "bumpVersion": "patch",
-      "enabled": true,
-      "labels": ["update/docker/operator/patch"],
-      "matchPaths": ["charts/operator/**"],
+      "labels": ["update/docker/patch", "automerge"],
+      "matchPaths": ["charts/enterprise/**", "charts/operator/**"],
     },
     //
     // Tag updates for semantic tags on incubator and dev charts
@@ -223,7 +233,7 @@
         "pin",
       ],
       "bumpVersion": "patch",
-      "enabled": true,
+      "enabled": false,
       "labels": ["update/docker/incubator/non-major", "automerge"],
       "matchPaths": ["charts/incubator/**", "charts/dev/**"],
     },
@@ -240,9 +250,19 @@
     },
     {
       "matchDatasources": ["docker"],
-      "automerge": false,
+      "automerge": true,
       "matchUpdateTypes": [
         "minor",
+      ],
+      "bumpVersion": "minor",
+      "enabled": true,
+      "labels": ["update/docker/general/non-major", "automerge"],
+      "matchPaths": ["charts/dependency/**", "charts/SCALE/**", "charts/library/**", "charts/stable/**", "templates/app/**"],
+    },
+    {
+      "matchDatasources": ["docker"],
+      "automerge": true,
+      "matchUpdateTypes": [
         "patch",
         "digest",
         "pin",
@@ -284,7 +304,7 @@
     },
     {
       "matchDatasources": ["docker"],
-      "matchPackagePrefixes": ["tccr.io/truecharts/immich"],
+      "matchPackagePrefixes": ["altran1502/immich"],
       "groupName": "immich",
     },
     {
@@ -349,7 +369,7 @@
     },
     {
       "matchDatasources": ["docker"],
-      "matchPackagePrefixes": ["tccr.io/truecharts/authentik"],
+      "matchPackagePrefixes": ["ghcr.io/goauthentik/"],
       "groupName": "authentik",
     },
     {
@@ -391,6 +411,305 @@
       "matchDatasources": ["docker"],
       "matchPackagePrefixes": ["tccr.io/truecharts/ersatztv"],
       "groupName": "ersatztv",
-    }
+    },
+    // matchPackagePatterns
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>14)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      "matchPackagePatterns": ["^bitnami/postgresql$"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d{4})-(?<minor>\\d{2})-(?<patch>\\d{2})$",
+      "matchPackagePatterns": ["^.*oznu\\/homebridge$"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d+)-(?<minor>\\d+)-(?<patch>\\d+)$",
+      "matchPackagePatterns": ["^jupyter\\/.+$"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-ubuntu$",
+      "matchPackagePatterns": ["^zabbix\\/zabbix-.*$"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^stable-(?<major>\\d{1})(?<minor>\\d{1})(?<patch>\\d{2}).*$",
+      "matchPackagePatterns": ["^jitsi\\/.*$"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      "matchPackagePatterns": ["^penpot\\/.*$"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^\\d*-jammy-(?<variant>.+)-v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      "matchPackagePatterns": ["^.+\\/koush\\/scrypted$"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^version-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-.*$",
+      "matchPackagePatterns": ["^.*linuxserver\\/deluge$"],
+      "automerge": true,
+    },
+    // matchPackageNames
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-postgres-tomcat$",
+      "matchPackageNames": ["xwiki"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^version-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      "matchPackageNames": ["fireflyiii/core"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-\\d+\\.\\d+\\.\\d+$",
+      "matchPackageNames": ["netboxcommunity/netbox"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d{2})(?<minor>\\d{2})(?<patch>\\d{2})$",
+      "matchPackageNames": ["photoprism/photoprism"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      "matchPackageNames": ["cloudflare/cloudflared"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^version-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      "matchPackageNames": ["linuxserver/calibre-web"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^version-v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      "matchPackageNames": ["linuxserver/heimdall"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^postgresql-v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      "matchPackageNames": ["ghcr.io/umami-software/umami"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^version-v(?<major>\\d+)\\.(?<minor>\\d+)\\.?(?<patch>\\d*)$",
+      "matchPackageNames": ["linuxserver/mylar3"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^[a-z0-9]{9}-v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-go\\d+\\.\\d+\\.\\d+$",
+      "matchPackageNames": ["storjlabs/storagenode"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-php8\\.0-apache$",
+      "matchPackageNames": ["joyqi/typecho"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^v\\.(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      "matchPackageNames": ["difegue/lanraragi"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^RELEASE\\.(?<major>\\d+)-(?<minor>\\d+)-(?<patch>\\d+)T\\d+-\\d+-\\d+Z$",
+      "matchPackageNames": ["minio/minio"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^RELEASE\\.(?<major>\\d+)-(?<minor>\\d+)-(?<patch>\\d+)T\\d+-\\d+-\\d+Z$",
+      "matchPackageNames": ["minio/mc"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^apache-(?<major>\\d+)\\.(?<minor>\\d+)\\.?(?<patch>\\d*)-prod$",
+      "matchPackageNames": ["kimai/kimai2"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d+)-(?<minor>\\d+)-(?<patch>\\d+)$",
+      "matchPackageNames": ["rssbridge/rss-bridge"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d+)-(?<minor>\\d+)-(?<patch>\\d+)$",
+      "matchPackageNames": ["alexta69/metube"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^focal-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      "matchPackageNames": ["codeproject/senseai-server"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^latest-(?<major>\\d+)-(?<minor>\\d+)-(?<patch>\\d+)$",
+      "matchPackageNames": ["wangqiru/ttrss"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)(-\\d+)?$",
+      "matchPackageNames": ["kiwix/kiwix-serve"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-omnibus$",
+      "matchPackageNames": ["ghcr.io/analogj/scrutiny"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d+)-(?<minor>\\d+)-(?<patch>\\d+)$",
+      "matchPackageNames": ["diygod/rsshub"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-amd64(nvidia)?$",
+      "matchPackageNames": ["blakeblackshear/frigate"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d{1,4})\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      "matchPackageNames": ["kopia/kopia"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d{4})\\.(?<minor>\\d{1,2})\\.(?<patch>\\d{1,2).*$",
+      "matchPackageNames": ["alicevision/meshroom"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d{4})\\.(?<minor>\\d{1,2})\\.(?<patch>\\d{1,2})$",
+      "matchPackageNames": ["itzg/bungeecord"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^java8-(?<major>\\d{4})\\.(?<minor>\\d{1,2})\\.(?<patch>\\d{1,2})$",
+      "matchPackageNames": ["itzg/bungeecord"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^java11-(?<major>\\d{4})\\.(?<minor>\\d{1,2})\\.(?<patch>\\d{1,2})$",
+      "matchPackageNames": ["itzg/bungeecord"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^java17-(?<major>\\d{4})\\.(?<minor>\\d{1,2})\\.(?<patch>\\d{1,2})$",
+      "matchPackageNames": ["itzg/bungeecord"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d{4})\\.(?<minor>\d{1,2})\\.(?<patch>\\d{1,2})(-java\\d{1,2}.*)?$",
+      "matchPackageNames": ["itzg/minecraft-server"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d{4})(?<minor>\\d{2})(?<patch>\\d{2})$",
+      "matchPackageNames": ["ankicommunity/anki-sync-server"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)-jdk17$",
+      "matchPackageNames": ["jenkins/jenkins"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^x64-v(?<major>\\d*)\\.(?<minor>\\d*)\\.(?<patch>\\d*)$",
+      "matchPackageNames": ["housewrecker/gaps"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d*)\\.(?<minor>\\d*)\\.(?<patch>\\d*)-\\d*$",
+      "matchPackageNames": ["sameersbn/apt-cacher-ng"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^release-(?<major>\\d*)\\.(?<minor>\\d*)$",
+      "matchPackageNames": ["mattermost/mattermost-enterprise-edition"],
+      "automerge": true,
+    },
+    {
+      "matchDatasources": ["docker"],
+      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-.+$",
+      "matchPackageNames": ["corentinth/it-tools"],
+      "automerge": true,
+    },
+    //
+    // Version strategies
+    //
+    // Versioning for linuxserver two-three digit container versions
+    {
+      "packagePatterns": ["^linuxserver\\/","^deepquestai\\/"],
+      "versionScheme": "regex:^(?<compatibility>.*?(\\d+\\.)??)(?<major>\\d+)\\.(?<minor>\\d+)\\.?(?<patch>\\d+)?(-r?p?\\d)?$"
+    },
+    {
+      "matchDatasources": [
+        "docker"
+      ],
+      "versioning": "loose",
+      "matchPackageNames": [
+        "ghcr.io/onedr0p/plex",
+        "ghcr.io/onedr0p/qbittorrent",
+        "sirfragalot/hyperion.ng",
+      ],
+    },
+    {
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchPackageNames": [
+        "quay.io/helmpack/chart-releaser",
+        "jnorwood/helm-docs",
+        "quay.io/git-chglog/git-chglog"
+      ],
+      "automerge": false,
+      "matchUpdateTypes": ["major", "minor", "patch", "digest", "pin"],
+      "labels": ["renovate/image", "ci"],
+    },
+
   ]
 }

.github/scripts/fetch_helm_deps.sh

@@ -110,6 +110,18 @@ for idx in $(eval echo "{0..$length}"); do
               if [[ "$train_chart" =~ incubator\/.* ]]; then
                   helm dependency build "$charts_path/$train_chart/Chart.yaml" || \
                   helm dependency update "$charts_path/$train_chart/Chart.yaml"|| exit 1
+              elif [[ "$name" =~ "velero" ]]; then
+                  helm dependency build "$charts_path/$train_chart/Chart.yaml" || \
+                  helm dependency update "$charts_path/$train_chart/Chart.yaml"|| exit 1
+              elif [[ "$name" =~ "metallb" ]]; then
+                  helm dependency build "$charts_path/$train_chart/Chart.yaml" || \
+                  helm dependency update "$charts_path/$train_chart/Chart.yaml"|| exit 1
+              elif [[ "$name" =~ "cloudnative-pg" ]]; then
+                  helm dependency build "$charts_path/$train_chart/Chart.yaml" || \
+                  helm dependency update "$charts_path/$train_chart/Chart.yaml"|| exit 1
+              elif [[ "$name" =~ "kube-prometheus-stack" ]]; then
+                  helm dependency build "$charts_path/$train_chart/Chart.yaml" || \
+                  helm dependency update "$charts_path/$train_chart/Chart.yaml"|| exit 1
               elif [[ "$name" =~ "cert-manager" ]]; then
                   helm dependency build "$charts_path/$train_chart/Chart.yaml" --verify --keyring $gpg_dir/certman.gpg || \
                   helm dependency update "$charts_path/$train_chart/Chart.yaml" --verify --keyring $gpg_dir/certman.gpg || exit 1
@@ -124,6 +136,14 @@ for idx in $(eval echo "{0..$length}"); do
                 if [[ "$name" =~ "cert-manager" ]]; then
                   helm verify $cache_path/$repo_dir/$name-$version.tgz --keyring $gpg_dir/certman.gpg || \
                   helm verify $cache_path/$repo_dir/$name-$version.tgz --keyring $gpg_dir/certman.gpg || exit 1
+                elif [[ "$name" =~ "velero" ]]; then
+                   echo "Velero is not signed..."
+                elif [[ "$name" =~ "metallb" ]]; then
+                   echo "metallb is not signed..."
+                elif [[ "$name" =~ "cloudnative-pg" ]]; then
+                   echo "cloudnative-pg is not signed..."
+                elif [[ "$name" =~ "kube-prometheus-stack" ]]; then
+                   echo "kube-prometheus-stack is not signed..."
                 elif [[ ! "$train_chart" =~ incubator\/.* ]]; then
                   echo "Validating dependency signature..."
                   helm verify $cache_path/$repo_dir/$name-$version.tgz --keyring $gpg_dir/pubring.gpg || \
@@ -137,6 +157,18 @@ for idx in $(eval echo "{0..$length}"); do
               if [[ "$train_chart" =~ incubator\/.* ]]; then
                   helm dependency build "$charts_path/$train_chart/Chart.yaml" || \
                   helm dependency update "$charts_path/$train_chart/Chart.yaml"|| exit 1
+              elif [[ "$name" =~ "velero" ]]; then
+                  helm dependency build "$charts_path/$train_chart/Chart.yaml" || \
+                  helm dependency update "$charts_path/$train_chart/Chart.yaml"|| exit 1
+              elif [[ "$name" =~ "metallb" ]]; then
+                  helm dependency build "$charts_path/$train_chart/Chart.yaml" || \
+                  helm dependency update "$charts_path/$train_chart/Chart.yaml"|| exit 1
+              elif [[ "$name" =~ "cloudnative-pg" ]]; then
+                  helm dependency build "$charts_path/$train_chart/Chart.yaml" || \
+                  helm dependency update "$charts_path/$train_chart/Chart.yaml"|| exit 1
+              elif [[ "$name" =~ "kube-prometheus-stack" ]]; then
+                  helm dependency build "$charts_path/$train_chart/Chart.yaml" || \
+                  helm dependency update "$charts_path/$train_chart/Chart.yaml"|| exit 1
               elif [[ "$name" =~ "cert-manager" ]]; then
                   helm dependency build "$charts_path/$train_chart/Chart.yaml" --verify --keyring $gpg_dir/certman.gpg || \
                   helm dependency update "$charts_path/$train_chart/Chart.yaml" --verify --keyring $gpg_dir/certman.gpg || exit 1

.github/workflows/charts-lint.yaml

@@ -50,7 +50,7 @@ jobs:
       - name: Install Helm
         uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3
         with:
-          version: latest
+          version: v3.13.2
 
       - name: Prep Helm
         run: |
@@ -58,6 +58,10 @@ jobs:
           helm repo add truecharts-deps https://deps.truecharts.org
           helm repo add truecharts-library https://library-charts.truecharts.org
           helm repo add jetstack https://charts.jetstack.io
+          helm repo add vmwaretanzu https://vmware-tanzu.github.io/helm-charts
+          helm repo add cnpg https://cloudnative-pg.github.io/charts
+          helm repo add metallb https://metallb.github.io/metallb
+          helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
           helm repo update
 
       - name: Collect changes (branch-based)

.github/workflows/charts-release.yaml

@@ -66,7 +66,7 @@ jobs:
         with:
           setup-tools: |
             helmv3
-          helm: "3.8.0"
+          helm: "3.13.2"
 
       - name: Prep Helm
         run: |
@@ -74,6 +74,9 @@ jobs:
           helm repo add truecharts-library https://library-charts.truecharts.org
           helm repo add truecharts-deps https://deps.truecharts.org
           helm repo add jetstack https://charts.jetstack.io
+          helm repo add vmwaretanzu https://vmware-tanzu.github.io/helm-charts
+          helm repo add cnpg https://cloudnative-pg.github.io/charts
+          helm repo add metallb https://metallb.github.io/metallb
           helm repo update
 
       # Optional step if GPG signing is used

.github/workflows/charts-test.yaml

@@ -123,7 +123,7 @@ jobs:
       - name: Install Helm
         uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3
         with:
-          version: latest
+          version: v3.13.2
 
       - uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
         with:
@@ -150,6 +150,10 @@ jobs:
           helm repo add truecharts-deps https://deps.truecharts.org
           helm repo add truecharts-library https://library-charts.truecharts.org
           helm repo add jetstack https://charts.jetstack.io
+          helm repo add vmwaretanzu https://vmware-tanzu.github.io/helm-charts
+          helm repo add cnpg https://cloudnative-pg.github.io/charts
+          helm repo add metallb https://metallb.github.io/metallb
+          helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
           helm repo update
 
       - name: Add Dependencies
@@ -194,7 +198,7 @@ jobs:
       - name: Install Helm
         uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3
         with:
-          version: latest
+          version: v3.13.2
 
       - uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
         with:
@@ -257,7 +261,7 @@ jobs:
       - name: Install Helm
         uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3
         with:
-          version: latest
+          version: v3.13.2
 
       - uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
         with:
@@ -320,7 +324,7 @@ jobs:
       - name: Install Helm
         uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3
         with:
-          version: latest
+          version: v3.13.2
 
       - uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
         with:
@@ -383,7 +387,7 @@ jobs:
       - name: Install Helm
         uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3
         with:
-          version: latest
+          version: v3.13.2
 
       - uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
         with:
@@ -446,7 +450,7 @@ jobs:
       - name: Install Helm
         uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3
         with:
-          version: latest
+          version: v3.13.2
 
       - uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
         with:

.github/workflows/daily.yaml

@@ -124,7 +124,7 @@ jobs:
             # Add truechart source
             tcsource="https://github.com/truecharts/charts/tree/master/charts/$train/$chartname" go-yq -i '.sources += env(tcsource)' "${chart}/Chart.yaml"
             # Get the container image name that was parsed out of the Dockerfile for the website.
-            container=$(cat website/docs/charts/description_list.md | grep "\[${chartname}\]" | cut -f3 -d '|' | grep -v 'Not Found' || echo "")
+            container=$(cat website/docs/charts/description_list.md | grep "\[${chartname}\]" | cut -f3 -d '|' | grep -v 'Not Found' || echo "" || echo "failed-container-fetch") 
             # Convert the container image name to a URL.
             if [ ! -z "$container" ]; then
               prefix=""
@@ -200,7 +200,7 @@ jobs:
             echo "Correcting Chart.yaml for Train: ${train}..."
             for chart in $(ls "charts/${train}"); do
               echo "Correcting Chart.yaml for Chart: ${chart}..."
-              sync_tag "charts/${train}/${chart}" "${chart}" "${train}"
+              sync_tag "charts/${train}/${chart}" "${chart}" "${train}" || echo "failed"
             done
           done
 
@@ -245,6 +245,11 @@ jobs:
           helm repo add truecharts https://charts.truecharts.org
           helm repo add truecharts-library https://library-charts.truecharts.org
           helm repo add truecharts-deps https://deps.truecharts.org
+          helm repo add jetstack https://charts.jetstack.io
+          helm repo add vmwaretanzu https://vmware-tanzu.github.io/helm-charts
+          helm repo add cnpg https://cloudnative-pg.github.io/charts
+          helm repo add metallb https://metallb.github.io/metallb
+          helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
           helm repo update
 
       - name: Checkout
@@ -360,7 +365,7 @@ jobs:
   lock-threads:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@be8aa5be94131386884a6da4189effda9b14aa21 # v4
+      - uses: dessant/lock-threads@d42e5f49803f3c4e14ffee0378e31481265dda22 # v5
         with:
           github-token: ${{ secrets.BOT_TOKEN }}
           issue-inactive-days: "7"

.github/workflows/renovate-bump.yaml

@@ -1,149 +0,0 @@
-name: "Renovate: Bump on Push"
-
-on:
-  push:
-    branches:
-      - "renovate/**"
-    tags-ignore:
-      - "**"
-
-jobs:
-  renovate-bump:
-    name: Get changed Apps
-    runs-on: ubuntu-22.04
-    container:
-      image: ghcr.io/truecharts/devcontainer:3.1.10@sha256:c239addf725eb5cedf79517f8089fdafdc32b5270d1893ee87ae6e511b9bcae3
-    steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
-        name: Checkout
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.BOT_TOKEN }}
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
-        name: Checkout
-        with:
-          fetch-depth: 0
-          ref: master
-          path: master
-
-      - name: Setting repo parent dir as safe safe.directory
-        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
-
-      - uses: dorny/paths-filter@v2
-        id: filter
-        with:
-          list-files: json
-          filters: |
-            changed:
-            - 'charts/stable/**'
-            - 'charts/incubator/**'
-            - 'charts/SCALE/**'
-            - 'charts/library/**'
-            - 'charts/dependency/**'
-            - 'charts/core/**'
-            - 'charts/enterprise/**'
-            - 'charts/games/**'
-      - name: Filter filter-output
-        run: echo '${{ toJson(steps.filter.outputs) }}' > changes.json
-
-      - name: Bump and Sync
-        shell: bash
-        run: |
-          # Designed to ensure the appversion in Chart.yaml is in sync with the primary Chart tag if found
-          # Also makes sure that home link is pointing to the correct url
-          sync_tag() {
-              local chart="$1"
-              local chartname="$2"
-              local train="$3"
-              echo "Attempting to sync primary tag with appversion for: ${chartname}"
-              local tag="$(cat ${chart}/values.yaml | grep '^  tag: ' | awk -F" " '{ print $2 }' | head -1)"
-              tag="${tag%%@*}"
-              tag="${tag:-auto}"
-              tag=$(echo $tag | sed "s/release-//g")
-              tag=$(echo $tag | sed "s/release_//g")
-              tag=$(echo $tag | sed "s/version-//g")
-              tag=$(echo $tag | sed "s/version_//g")
-              tag="${tag#*V.}"
-              tag="${tag#*v-}"
-              tag="${tag#*v}"
-              tag="${tag%-*}"
-              tag="${tag:0:10}"
-              tag="${tag%-}"
-              tag="${tag%_}"
-              tag="${tag%.}"
-              echo "Updating tag of ${chartname} to ${tag}..."
-              sed -i -e "s|appVersion: .*|appVersion: \"${tag}\"|" "${chart}/Chart.yaml"
-              echo "Updating icon of ${chartname}..."
-              sed -i -e "s|icon: .*|icon: https:\/\/truecharts.org\/img\/hotlink-ok\/chart-icons\/${chartname}.png|" "${chart}/Chart.yaml"
-              echo "Updating home of ${chartname}..."
-              sed -i -e "s|home: .*|home: https:\/\/truecharts.org\/charts\/${train}\/${chartname}|" "${chart}/Chart.yaml"
-              echo "Attempting to update sources of ${chartname}..."
-              echo "Using go-yq verion: <$(go-yq -V)>"
-              # Get all sources (except truecharts)
-              curr_sources=$(go-yq '.sources[] | select(. != "https://github.com/truecharts*")' "${chart}/Chart.yaml")
-              # Empty sources list in-place
-              go-yq -i 'del(.sources.[])' "${chart}/Chart.yaml"
-              # Add truechart source
-              tcsource="https://github.com/truecharts/charts/tree/master/charts/$train/$chartname" go-yq -i '.sources += env(tcsource)' "${chart}/Chart.yaml"
-              # Add the rest of the sources
-              while IFS= read -r line; do
-                src="$line" go-yq -i '.sources += env(src)' "${chart}/Chart.yaml" || echo "src set error"
-              done <<< "$curr_sources"
-              echo "Sources of ${chartname} updated!"
-              }
-          export -f sync_tag
-
-          # The actual script
-          APPS=$(jq --raw-output '.changed_files | fromjson | .[] |= sub("(?<filepath>(?<first_directory>(?<root1>[\/]?)[^\/]+\/)(?<second_directory>(?<root2>[\/]?)[^\/]+\/)(?<third_directory>(?<root3>[\/]?)[^\/]+)(?<extra_paths>.+))"; "\(.third_directory)") | unique' changes.json  |  jq -r '.[]')
-          echo "changed apps: ${APPS[*]}"
-          for chart in ${APPS[*]}
-          do
-            if [[ "${chart}" == '.gitkeep' ]]; then
-              echo "Skipping..."
-              return
-            elif test -f "./charts/stable/${chart}/Chart.yaml"; then
-              train="stable"
-            elif test -f "./charts/incubator/${chart}/Chart.yaml"; then
-              train="incubator"
-            elif test -f "./charts/SCALE/${chart}/Chart.yaml"; then
-              train="SCALE"
-            elif test -f "./charts/library/${chart}/Chart.yaml"; then
-              train="library"
-            elif test -f "./charts/dependency/${chart}/Chart.yaml"; then
-              train="dependency"
-            elif test -f "./charts/core/${chart}/Chart.yaml"; then
-              train="core"
-            elif test -f "./charts/games/${chart}/Chart.yaml"; then
-              train="games"
-            elif test -f "./charts/enterprise/${chart}/Chart.yaml"; then
-              train="enterprise"
-            elif test -f "./charts/operators/${chart}/Chart.yaml"; then
-              train="operators"
-            else
-              train="incubator"
-            fi
-            echo "Comparing versions for ${train}/${chart}"
-            master=$(cat ./master/charts/${train}/${chart}/Chart.yaml | grep "^version")
-            current=$(cat ./charts/${train}/${chart}/Chart.yaml | grep "^version")
-            echo "master version: ${master}"
-            echo "current version: ${current}"
-            if [[ "${master}" != "${current}" ]]; then
-              echo "Version does not have to be bumped"
-            else
-              echo "Bumping patch version for ${train}/${chart}"
-              ./tools/bump.sh patch ./charts/${train}/${chart}
-            fi
-
-            sync_tag "charts/${train}/${chart}" "${chart}" "${train}"
-          done
-      - name: Cleanup
-        run: |
-          rm -rf changes.json
-          rm -rf master
-      - name: Commit and Push new version
-        run: |
-          git config user.name "TrueCharts-Bot"
-          git config user.email "bot@truecharts.org"
-          git add --all
-          git commit -sm "Commit bumped Chart Version" || exit 0
-          git push

.github/workflows/renovate.yml

@@ -1,18 +0,0 @@
-name: Renovate
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "0 */1 * * *"
-jobs:
-  renovate:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-        with:
-          token: ${{ secrets.BOT_TOKEN }}
-      - name: Self-hosted Renovate
-        uses: renovatebot/github-action@5c6c06aa0e3d7a6a9b6cba05c078c51631b5f11a # v39.1.1
-        with:
-          configurationFile: .github/renovate-config.js
-          token: ${{ secrets.BOT_TOKEN }}

Gemfile

@@ -1,12 +0,0 @@
-# frozen_string_literal: true
-
-source 'https://rubygems.org'
-
-group :test do
-  gem 'm'
-  gem 'minitest'
-  gem 'minitest-implicit-subject'
-  gem 'minitest-reporters'
-  gem 'pry'
-  gem 'ruby-jq'
-end

NOTICE

@@ -1,4 +0,0 @@
-This product includes software developed at
-The K8S-At-Home (https://k8s-at-home.com/).
-
-This Product Contains modified Apache2.0 Licensed software

charts/dependency/clickhouse/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "23.10.1.19"
+appVersion: "23.10.4.25"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.5.0
 deprecated: false
 description: ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP).
 home: https://truecharts.org/charts/dependency/clickhouse
@@ -22,7 +22,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/dependency/clickhouse
   - https://clickhouse.com/
 type: application
-version: 7.0.21
+version: 7.0.29
 annotations:
   truecharts.org/category: database
   truecharts.org/SCALE-support: "true"

charts/dependency/clickhouse/values.yaml

@@ -1,8 +1,7 @@
 image:
-  repository: tccr.io/truecharts/clickhouse
+  repository: clickhouse/clickhouse-server
   pullPolicy: IfNotPresent
-  tag: v23.10.1.1976@sha256:70a2209917d2dcfe33b09e60dda9012c4f6638e9335b3afefac2cb89ba0c670c
-
+  tag: 23.10.4.25@sha256:bf133a087d3d86d769058a55b9fc110a63f1a1654fd8d360df5a9b95453384a8
 workload:
   main:
     replicas: 1
@@ -28,7 +27,6 @@ workload:
             startup:
               type: http
               path: /ping
-
 securityContext:
   container:
     readOnlyRootFilesystem: false
@@ -41,7 +39,6 @@ securityContext:
     #     - IPC_LOCK
     #     - NET_ADMIN
     #     - SYS_NICE
-
 service:
   main:
     ports:
@@ -49,30 +46,24 @@ service:
         port: 8123
         protocol: http
         targetPort: 8123
-
 persistence:
   data:
     enabled: true
     mountPath: /var/lib/clickhouse
-
 clickhouseDatabase: "test"
 clickhouseUsername: "test"
 clickhouseDefaultAccessManagement: 0
-
 # -- Secret or password
 # One of these options is required, unless used as a dependency for another TrueCharts chart.
 clickhousePassword: ""
 existingSecret: ""
-
 secret:
   credentials:
     enabled: true
     data:
       clickhouse-password: '{{ ( .Values.clickhousePassword | default "empty" ) }}'
-
 portal:
   open:
     enabled: false
-
 manifestManager:
   enabled: false

charts/dependency/kube-state-metrics/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "2.10.0"
+appVersion: "2.10.1"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.5.0
 deprecated: false
 description: kube-state-metrics is a simple service that listens to the Kubernetes API server and generates metrics about the state of the objects.
 home: https://truecharts.org/charts/dependency/kube-state-metrics
@@ -21,7 +21,7 @@ name: kube-state-metrics
 sources:
   - https://github.com/truecharts/charts/tree/master/charts/dependency/kube-state-metrics
 type: application
-version: 3.0.34
+version: 3.0.41
 annotations:
   truecharts.org/category: metrics
   truecharts.org/SCALE-support: "true"

charts/dependency/kube-state-metrics/values.yaml

@@ -1,8 +1,7 @@
 image:
-  repository: tccr.io/truecharts/kube-state-metrics
+  repository: bitnami/kube-state-metrics
   pullPolicy: IfNotPresent
-  tag: v2.10.0@sha256:5dd17a0a28532d6dfba742e1ba39f894e653cd5ca13c313e21120ee4f9d81024
-
+  tag: 2.10.1@sha256:6819ee084fdb0ddee851ffcda90833d4e5b991987bdd1fbe4804ade61f47ccdb
 service:
   main:
     ports:
@@ -16,7 +15,6 @@ service:
         enabled: true
         protocol: http
         port: 8081
-
 workload:
   main:
     podSpec:
@@ -51,28 +49,22 @@ workload:
             # - --resources=verticalpodautoscalers
             - --resources=validatingwebhookconfigurations
             - --resources=volumeattachments
-
           probes:
             liveness:
               path: /healthz
               port: main
-
             readiness:
               path: /healthz
               port: main
-
             startup:
               type: tcp
               port: main
-
 podOptions:
   automountServiceAccountToken: true
-
 serviceAccount:
   main:
     enabled: true
     primary: true
-
 rbac:
   main:
     enabled: true
@@ -279,7 +271,10 @@ rbac:
         verbs:
           - list
           - watch
-
+      - apiGroups: ["discovery.k8s.io"]
+        resources:
+          - endpointslices
+        verbs: ["list", "watch"]
 metrics:
   main:
     # -- Enable and configure a Prometheus serviceMonitor for the chart under this key.
@@ -296,18 +291,16 @@ metrics:
       labels: {}
       # -- Configure additionial rules for the chart under this key.
       # @default -- See prometheusrules.yaml
-      rules:
-        []
-        # - alert: UnifiPollerAbsent
-        #   annotations:
-        #     description: Unifi Poller has disappeared from Prometheus service discovery.
-        #     summary: Unifi Poller is down.
-        #   expr: |
-        #     absent(up{job=~".*unifi-poller.*"} == 1)
-        #   for: 5m
-        #   labels:
-        #     severity: critical
-
+      rules: []
+      # - alert: UnifiPollerAbsent
+      #   annotations:
+      #     description: Unifi Poller has disappeared from Prometheus service discovery.
+      #     summary: Unifi Poller is down.
+      #   expr: |
+      #     absent(up{job=~".*unifi-poller.*"} == 1)
+      #   for: 5m
+      #   labels:
+      #     severity: critical
 portal:
   open:
     enabled: false

charts/dependency/mariadb/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "11.1.2"
+appVersion: "11.1.3"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.5.0
 deprecated: false
 description: Fast, reliable, scalable, and easy to use open-source relational database system.
 home: https://truecharts.org/charts/dependency/mariadb
@@ -25,7 +25,7 @@ sources:
   - https://github.com/prometheus/mysqld_exporter
   - https://mariadb.org
 type: application
-version: 9.0.37
+version: 9.0.43
 annotations:
   truecharts.org/category: database
   truecharts.org/SCALE-support: "true"

charts/dependency/mariadb/values.yaml

@@ -1,8 +1,7 @@
 image:
-  repository: tccr.io/truecharts/mariadb
+  repository: bitnami/mariadb
   pullPolicy: IfNotPresent
-  tag: v11.1.2@sha256:3ec39631c2e7c4a3564ccf0726a19078fd056601ee7a66761d62344b585e9289
-
+  tag: 11.1.3@sha256:ec252de855742584bb2dace25f5cd83ccfdde4f61961cca00fc29a1d5200c2aa
 workload:
   main:
     podSpec:
@@ -43,43 +42,35 @@ workload:
                 - /bin/bash
                 - -ec
                 - "until /opt/bitnami/scripts/mariadb/healthcheck.sh; do sleep 2; done"
-
 service:
   main:
     ports:
       main:
         port: 3306
         targetPort: 3306
-
 securityContext:
   container:
     readOnlyRootFilesystem: false
     runAsGroup: 0
-
 secret:
   credentials:
     enabled: true
     data:
       mariadb-password: '{{ ( .Values.mariadbPassword | default "empty" ) }}'
       mariadb-root-password: '{{ ( .Values.mariadbRootPassword | default "empty" ) }}'
-
 persistence:
   data:
     enabled: true
     mountPath: "/bitnami/mariadb"
-
 mariadbUsername: "test"
 mariadbDatabase: "test"
 mariadbRootPassword: "testroot"
-
 # -- Secret or password
 # One of these options is required, unless used as a dependency for another TrueCharts chart.
 mariadbPassword: ""
 existingSecret: ""
-
 portal:
   open:
     enabled: false
-
 manifestManager:
   enabled: false

charts/dependency/memcached/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "1.6.22"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.5.0
 deprecated: false
 description: Memcached is a memory-backed database caching solution
 home: https://truecharts.org/charts/dependency/memcached
@@ -23,7 +23,7 @@ sources:
   - https://github.com/bitnami/bitnami-docker-memcached
   - http://memcached.org/
 type: application
-version: 8.0.38
+version: 8.0.44
 annotations:
   truecharts.org/category: database
   truecharts.org/SCALE-support: "true"

charts/dependency/memcached/values.yaml

@@ -1,8 +1,7 @@
 image:
-  repository: tccr.io/truecharts/memcached
+  repository: bitnami/memcached
   pullPolicy: IfNotPresent
-  tag: v1.6.22@sha256:1d021040b76aceb199a879ff295f836a007ec64cabdba1482c511fd245b3b7ec
-
+  tag: 1.6.22@sha256:d4c4ba01c45b2fdbc58cbb94af8ed0690c46ce2c70b34de49751c8920042af02
 service:
   main:
     ports:
@@ -10,10 +9,8 @@ service:
         port: 11211
         protocol: tcp
         targetPort: 11211
-
 portal:
   open:
     enabled: false
-
 manifestManager:
   enabled: false

charts/dependency/mongodb/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "7.0.2"
+appVersion: "7.0.3"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.5.0
 deprecated: false
 description: Fast, reliable, scalable, and easy to use open-source no-sql database system.
 home: https://truecharts.org/charts/dependency/mongodb
@@ -23,7 +23,7 @@ sources:
   - https://github.com/bitnami/bitnami-docker-mongodb
   - https://www.mongodb.com
 type: application
-version: 8.0.35
+version: 8.0.46
 annotations:
   truecharts.org/category: database
   truecharts.org/SCALE-support: "true"

charts/dependency/mongodb/values.yaml

@@ -1,8 +1,7 @@
 image:
-  repository: tccr.io/truecharts/mongodb
+  repository: bitnami/mongodb
   pullPolicy: IfNotPresent
-  tag: v7.0.2@sha256:2ecf33de2273eb9da76e778d5cad92e55ccbb8ade8e2e0a997e7f40afc058631
-
+  tag: 7.0.3@sha256:5ff367bc2bd7435b15754ffcc1f3c90e13a5ebe0269f29a2332ae1d131ef82a4
 workload:
   main:
     replicas: 1
@@ -42,7 +41,6 @@ workload:
                     - /bin/bash
                     - -ec
                     - echo "db.runCommand(\"ping\")" | mongosh --host localhost --port 27017 ${MONGODB_DATABASE} --quiet
-
             # -- Redainess probe configuration
             # @default -- See below
             readiness:
@@ -59,7 +57,6 @@ workload:
                     - /bin/bash
                     - -ec
                     - echo "db.runCommand(\"ping\")" | mongosh --host localhost --port 27017 ${MONGODB_DATABASE} --quiet
-
             # -- Startup probe configuration
             # @default -- See below
             startup:
@@ -75,43 +72,35 @@ workload:
                     - /bin/bash
                     - -ec
                     - echo "db.runCommand(\"ping\")" | mongosh --host localhost --port 27017 ${MONGODB_DATABASE} --quiet
-
 service:
   main:
     ports:
       main:
         port: 27017
         targetPort: 27017
-
 securityContext:
   container:
     runAsGroup: 0
     readOnlyRootFilesystem: false
-
 persistence:
   data:
     enabled: true
     mountPath: "/bitnami/mongodb"
-
 mongodbUsername: "test"
 mongodbDatabase: "test"
 mongodbRootPassword: "testroot"
-
 # -- Secret or password
 # One of these options is required, unless used as a dependency for another TrueCharts chart.
 mongodbPassword: ""
 existingSecret: ""
-
 secret:
   credentials:
     enabled: true
     data:
       mongodb-password: '{{ ( .Values.mongodbPassword | default "empty" ) }}'
       mongodb-root-password: '{{ ( .Values.mongodbRootPassword | default "empty" ) }}'
-
 portal:
   open:
     enabled: false
-
 manifestManager:
   enabled: false

charts/dependency/node-exporter/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "1.6.1"
+appVersion: "1.7.0"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.5.0
 deprecated: false
 description: Prometheus exporter for hardware and OS metrics exposed by UNIX kernels, with pluggable metric collectors.
 home: https://truecharts.org/charts/dependency/node-exporter
@@ -21,7 +21,7 @@ name: node-exporter
 sources:
   - https://github.com/truecharts/charts/tree/master/charts/dependency/node-exporter
 type: application
-version: 3.0.36
+version: 3.0.43
 annotations:
   truecharts.org/category: metrics
   truecharts.org/SCALE-support: "true"

charts/dependency/node-exporter/values.yaml

@@ -1,15 +1,13 @@
 image:
-  repository: tccr.io/truecharts/node-exporter
+  repository: bitnami/node-exporter
   pullPolicy: IfNotPresent
-  tag: v1.6.1@sha256:c150064746d1155d557663650603ea428eacd22c40da62f2ec3078b4c2ade1ba
-
+  tag: 1.7.0@sha256:68d9e82bc1c876bdf78bc6a81965f1f32344087dd56bbec052acac8237d86cf8
 service:
   main:
     ports:
       main:
         protocol: http
         port: 9910
-
 workload:
   main:
     type: DaemonSet
@@ -29,19 +27,15 @@ workload:
             liveness:
               path: /
               port: main
-
             readiness:
               path: /
               port: main
-
             startup:
               type: tcp
               port: main
-
 podOptions:
   hostNetwork: true
   hostPID: true
-
 persistence:
   host:
     enabled: true
@@ -61,7 +55,6 @@ persistence:
     hostPath: /sys
     mountPath: /hostsys
     readOnly: true
-
 metrics:
   main:
     # -- Enable and configure a Prometheus serviceMonitor for the chart under this key.
@@ -78,18 +71,16 @@ metrics:
       labels: {}
       # -- Configure additionial rules for the chart under this key.
       # @default -- See prometheusrules.yaml
-      rules:
-        []
-        # - alert: UnifiPollerAbsent
-        #   annotations:
-        #     description: Unifi Poller has disappeared from Prometheus service discovery.
-        #     summary: Unifi Poller is down.
-        #   expr: |
-        #     absent(up{job=~".*unifi-poller.*"} == 1)
-        #   for: 5m
-        #   labels:
-        #     severity: critical
-
+      rules: []
+      # - alert: UnifiPollerAbsent
+      #   annotations:
+      #     description: Unifi Poller has disappeared from Prometheus service discovery.
+      #     summary: Unifi Poller is down.
+      #   expr: |
+      #     absent(up{job=~".*unifi-poller.*"} == 1)
+      #   for: 5m
+      #   labels:
+      #     severity: critical
 portal:
   open:
     enabled: false

charts/dependency/redis/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "7.2.3"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.5.0
 deprecated: false
 description: Open source, advanced key-value store.
 home: https://truecharts.org/charts/dependency/redis
@@ -23,7 +23,7 @@ sources:
   - https://github.com/bitnami/bitnami-docker-redis
   - http://redis.io/
 type: application
-version: 8.0.41
+version: 8.0.47
 annotations:
   truecharts.org/category: database
   truecharts.org/SCALE-support: "true"

charts/dependency/redis/values.yaml

@@ -1,8 +1,7 @@
 image:
-  repository: tccr.io/truecharts/redis
+  repository: bitnami/redis
   pullPolicy: IfNotPresent
-  tag: v7.2.3@sha256:9d51d05196beb255805741dbd3d843154de9a816f9f6a65e0fa0c8d43f48aa45
-
+  tag: 7.2.3@sha256:f7db3a51e2726109819b50004c3bbf8f1c792723af274f88532b8c3e64fcde0b
 workload:
   main:
     replicas: 1
@@ -45,12 +44,10 @@ workload:
                 - sh
                 - -c
                 - /health/ping_readiness_local.sh 2
-
 securityContext:
   container:
     readOnlyRootFilesystem: false
     runAsGroup: 0
-
 configmap:
   health:
     enabled: true
@@ -123,30 +120,25 @@ configmap:
         "$script_dir/ping_liveness_local.sh" $1 || exit_status=$?
         "$script_dir/ping_liveness_master.sh" $1 || exit_status=$?
         exit $exit_status
-
 secret:
   credentials:
     enabled: true
     data:
       redis-password: '{{ ( .Values.redisPassword | default "nothing" ) }}'
-
 # -- Secret or password
 # One of these options is required, unless used as a dependency for another TrueCharts chart.
 redisPassword: ""
 existingSecret: ""
-
 service:
   main:
     ports:
       main:
         port: 6379
         targetPort: 6379
-
 volumeClaimTemplates:
   data:
     enabled: true
     mountPath: "/bitnami/redis"
-
 persistence:
   redis-health:
     enabled: true
@@ -167,10 +159,8 @@ persistence:
         path: ping_liveness_local_and_master.sh
       - key: ping_readiness_local_and_master.sh
         path: ping_readiness_local_and_master.sh
-
 portal:
   open:
     enabled: false
-
 manifestManager:
   enabled: false

charts/dependency/solr/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "9.4.0"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.5.0
 deprecated: false
 description: Apache Solr
 home: https://truecharts.org/charts/dependency/solr
@@ -22,7 +22,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/dependency/solr
   - https://github.com/apache/solr
 type: application
-version: 6.0.38
+version: 6.0.45
 annotations:
   truecharts.org/category: search
   truecharts.org/SCALE-support: "true"

charts/dependency/solr/values.yaml

@@ -1,8 +1,7 @@
 image:
-  repository: tccr.io/truecharts/solr
+  repository: bitnami/solr
   pullPolicy: IfNotPresent
-  tag: v9.4.0@sha256:4f2620c0115b8d36471f3247fc319dce25404db1d361ce0195e9ce8dfbf5143f
-
+  tag: 9.4.0@sha256:2ed1a4738c016c0d5d6549b6ad7bc977d9690c36b59cb6c682677792c8a059da
 workload:
   main:
     replicas: 1
@@ -19,7 +18,6 @@ workload:
                 expandObjectName: "{{ if .Values.solrPassword }}true{{ else }}false{{ end }}"
                 name: '{{ if .Values.solrPassword }}credentials{{ else if .Values.existingSecret }}{{ .Values.existingSecret }}{{ else }}{{ printf "%s-%s" .Release.Name "solrcreds" }}{{ end }}'
                 key: "solr-password"
-
           # -- Probe configuration
           # -- [[ref]](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/)
           # @default -- See below
@@ -45,7 +43,6 @@ workload:
                       else
                         until curl --fail localhost:8983/solr/"${SOLR_CORES}"/admin/ping; do sleep 2; done
                       fi;
-
             # -- Redainess probe configuration
             # @default -- See below
             readiness:
@@ -87,47 +84,39 @@ workload:
                       else
                         until curl --fail localhost:8983/solr/"${SOLR_CORES}"/admin/ping; do sleep 2; done
                       fi;
-
 securityContext:
   container:
     runAsNonRoot: false
     readOnlyRootFilesystem: false
     runAsUser: 1001
     runAsGroup: 0
-
 service:
   main:
     ports:
       main:
         port: 8983
         targetPort: 8983
-
 persistence:
   db:
     enabled: true
     mountPath: "/bitnami/solr"
-
 # Currently only single core is supported, with multiple cores, probes will fail.
 solrCores: "testcore"
 solrEnableAuthentication: "yes"
 solrUsername: "test"
 # Used to pass a comma separated list of optional options like '-XX:G1HeapRegionSize=8m'
 solrOpts: ""
-
 # -- Secret or password
 # One of these options is required, unless used as a dependency for another TrueCharts chart.
 existingSecret: ""
 solrPassword: ""
-
 secret:
   credentials:
     enabled: true
     data:
       solr-password: '{{ ( .Values.solrPassword | default "empty" ) }}'
-
 portal:
   open:
     enabled: true
-
 manifestManager:
   enabled: false

charts/enterprise/authelia/Chart.yaml

@@ -3,11 +3,11 @@ appVersion: "4.37.5"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.3.5
   - condition: redis.enabled
     name: redis
     repository: https://deps.truecharts.org
-    version: 8.0.41
+    version: 8.0.44
 deprecated: false
 description: Authelia is a Single Sign-On Multi-Factor portal for web apps
 home: https://truecharts.org/charts/enterprise/authelia
@@ -35,7 +35,7 @@ sources:
   - https://github.com/authelia/chartrepo
   - https://github.com/authelia/authelia
 type: application
-version: 19.0.6
+version: 19.0.13
 annotations:
   truecharts.org/category: security
   truecharts.org/SCALE-support: "true"

charts/enterprise/authelia/docs/Setup-Guide.md

@@ -30,8 +30,8 @@ LLDAP is a `Stable` train chart and therefore isn't supported at the same level
 
 ### App Configuration
 
-- Domain: `mydomain.com` <- Your domain without https://
-- Default Redirection URL: `https://auth.mydomain.com` <- Can be anything, but we'll stick to auth.mydomain.com. As well, this will be the ingress URL for `Authelia`
+- Domain: `mydomain.com` - Your domain without https://
+- Default Redirection URL: `https://auth.mydomain.com` - Can be anything, but we'll stick to auth.mydomain.com. As well, this will be the ingress URL for `Authelia`
 
 ### LDAP Backend Configuration
 
@@ -54,7 +54,7 @@ LLDAP is a `Stable` train chart and therefore isn't supported at the same level
 - Group name Attribute:`cn`
 - Mail Attribute:`mail`
 - Display Name Attribute:`displayName`
-- Admin User: `uid=Steven,ou=people,dc=mydomain,dc=com` <- Notice the uid=Steven, most of the time people use admin and a generated password
+- Admin User: `uid=Steven,ou=people,dc=mydomain,dc=com` - Notice the uid=Steven, most of the time people use admin and a generated password
 - Password: `RANDOMPASSWORD`
 
 #### SMTP Configuration

charts/enterprise/authelia/docs/authelia-rules.md

@@ -0,0 +1,107 @@
+# Authelia Rules
+
+This is a collection of some common Authelia Rules.
+
+:::note[RULE ORDER]
+
+It is important that rules are created in the correct order in Authelia. Rules are processed from top to bottom with the first matching rule being applied. The most narrow rules should be applied first with the most broad rules last.
+
+:::
+
+All rules requiring Authelia authentication were configured with `two_factor` (2FA). If you do not want 2FA on some or all rules replace the Policy with `one_factor` 
+
+## API Rule
+
+This rule will bypass Authelia for API level access in most apps. This should always be your first rule.
+
+Domain: `*.domain.tld`
+
+Policy: `bypass`
+
+Subject: `Not Used (Do Not Add)`
+
+Networks: `Not Used (Do Not Add)`
+
+Resources:
+
+- `^/api([/?].*)?$`
+- `^/identity.*$`
+- `^/triggers.*$`
+- `^/meshagents.*$`
+- `^/meshsettings.*$`
+- `^/agent.*$`
+- `^/control.*$`
+- `^/meshrelay.*$`
+- `^/wl.*$`
+
+![authelia-api](./img/authelia-api.png)
+
+## Vaultwarden
+
+These rules will protect the Vaultwarden admin page with Authelia but bypass when accessing the web vault. The order of these rules is critical or the admin page will not be protected.
+
+### Rule 1
+
+Domain: `vaultwarden.domain.tld`
+
+Policy: `two_factor`
+
+Subject: `Not Used (Do Not Add)`
+
+Networks: `Not Used (Do Not Add)`
+
+Resources: `^*/admin.*$`
+
+![authelia-vw1](./img/authelia-vw1.png)
+
+### Rule 2
+
+Domain: `vaultwarden.domain.tld`
+
+Policy: `bypass`
+
+Subject: `Not Used (Do Not Add)`
+
+Networks: `Not Used (Do Not Add)`
+
+Resources: `Not Used (Do Not Add)`
+
+![authelia-vw2](./img/authelia-vw2.png)
+
+## User Rule
+
+This rule will allow users in the `lldap_user` group access to only the specified applications.
+
+Domain:
+
+- `radarr.domain.tld`
+- `sonarr.domain.tld`
+
+Policy: `two_factor`
+
+Subject: `group:lldap_user`
+
+Networks: `Not Used (Do Not Add)`
+
+Resources: `Not Used (Do Not Add)`
+
+![authelia-user](./img/authelia-user.png)
+
+## Catch All Rule
+
+This rule will catch any access requests not covered by other rules.
+
+Domain:
+
+- `domain.tld`
+- `*.domain.tld`
+
+Policy: `two_factor`
+
+Subject: `group:lldap_admin`
+
+Networks: `Not Used (Do Not Add)`
+
+Resources: `Not Used (Do Not Add)`
+
+![authelia-catch](./img/authelia-catch.png)

charts/enterprise/authelia/questions.yaml

@@ -230,14 +230,20 @@ questions:
       attrs:
         - variable: name
           label: "Cookie Name"
-          description: "The name of the session cookie."
+          description: |
+            The name of the session cookie. By default this is set to authelia_session. 
+            It’s mostly useful to change this if you are doing development or running multiple instances of Authelia.
           schema:
             type: string
             required: true
             default: "authelia_session"
         - variable: same_site
           label: "SameSite Value"
-          description: "Sets the Cookie SameSite value"
+          description: |
+            You can read about the SameSite cookie in detail on the MDN. In short setting SameSite to Lax is generally 
+            the most desirable option for Authelia. None is not recommended unless you absolutely know what you’re doing 
+            and trust all the protected apps. Strict is not going to work in many use cases and we have not tested it in 
+            this state but it’s available as an option anyway.
           schema:
             type: string
             default: "lax"
@@ -248,21 +254,27 @@ questions:
                 description: "strict"
         - variable: expiration
           label: "Expiration Time"
-          description: "The time in seconds before the cookie expires and session is reset."
+          description: |
+            The period of time before the cookie expires and the session is destroyed. This is overriden by 
+            remember_me_duration when the remember me box is checked.
           schema:
             type: string
             default: "1h"
             required: true
         - variable: inactivity
           label: "Inactivity Time"
-          description: "The inactivity time in seconds before the session is reset."
+          description: |
+            The period of time the user can be inactive for until the session is destroyed when the remember me box is 
+            not checked or is otherwise disabled. Useful if you want long session timers but don’t want unused devices to be vulnerable.
           schema:
             type: string
             default: "5m"
             required: true
         - variable: remember_me_duration
           label: "Remember-Me duration"
-          description: "The remember me duration"
+          description: |
+            The period of time before the cookie expires and the session is destroyed when the remember me box is checked, a user 
+            selecting this option negates the inactivity timeout. Setting this to -1 disables this feature entirely.
           schema:
             type: string
             default: "5M"
@@ -283,14 +295,18 @@ questions:
             default: 3
         - variable: find_time
           label: "Find Time"
-          description: "The time range during which the user can attempt login before being banned."
+          description: |
+            The period of time analyzed for failed attempts. For example if you set max_retries to 3 and find_time to 
+            2m this means the user must have 3 failed logins in 2 minutes.
           schema:
             type: string
             default: "2m"
             required: true
         - variable: ban_time
           label: "Ban Duration"
-          description: "The length of time before a banned user can login again"
+          description: |
+            The period of time the user is banned for after meeting the max_retries and find_time configuration. 
+            After this duration the account will be able to login again.
           schema:
             type: string
             default: "5m"
@@ -298,7 +314,9 @@ questions:
   - variable: authentication_backend
     group: "App Configuration"
     label: "Authentication Backend Provider"
-    description: "sed for verifying user passwords and retrieve information such as email address and groups users belong to."
+    description: | 
+      Used for verifying user passwords and retrieve information such as email 
+      address and groups users belong to.
     schema:
       additional_attrs: true
       type: dict
@@ -405,14 +423,14 @@ questions:
                       description: "The attribute holding the username of the user"
                       schema:
                         type: string
-                        default: ""
+                        default: "uid"
                         required: true
                     - variable: additional_users_dn
                       label: "Additional Users DN"
                       description: "An additional dn to define the scope to all users."
                       schema:
                         type: string
-                        default: "OU=Users"
+                        default: "OU=people"
                         required: true
                     - variable: users_filter
                       label: "Users Filter"
@@ -440,27 +458,27 @@ questions:
                       description: "The attribute holding the name of the group"
                       schema:
                         type: string
-                        default: ""
+                        default: "cn"
                         required: true
                     - variable: mail_attribute
                       label: "Mail Attribute"
                       description: "The attribute holding the primary mail address of the user"
                       schema:
                         type: string
-                        default: ""
+                        default: "mail"
                         required: true
                     - variable: display_name_attribute
                       label: "Display Name Attribute"
                       description: "he attribute holding the display name of the user. This will be used to greet an authenticated user."
                       schema:
                         type: string
-                        default: ""
+                        default: "displayName"
                     - variable: user
                       label: "Admin User"
                       description: "The username of the admin user used to connect to LDAP."
                       schema:
                         type: string
-                        default: "CN=Authelia,DC=example,DC=com"
+                        default: "CN=admin,ou=people,DC=example,DC=com"
                         required: true
                     - variable: plain_password
                       label: "Password"
@@ -688,10 +706,13 @@ questions:
       attrs:
         - variable: default_policy
           label: "Default Policy"
-          description: "Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'."
+          description: |
+            The default policy defines the policy applied if no rules section apply to the information known about the request. 
+            It is recommended that this is configured to deny for security reasons. Sites which you do not wish to secure at all 
+            with Authelia should not be configured in your reverse proxy to perform authentication with Authelia at all for performance reasons.
           schema:
             type: string
-            default: "two_factor"
+            default: "deny"
             enum:
               - value: "bypass"
                 description: "bypass"
@@ -745,7 +766,7 @@ questions:
                   attrs:
                     - variable: domain
                       label: "Domains"
-                      description: "defines which domain or set of domains the rule applies to."
+                      description: "Defines which domain or set of domains the rule applies to."
                       schema:
                         type: list
                         default: []
@@ -758,7 +779,9 @@ questions:
                               required: true
                     - variable: policy
                       label: "Policy"
-                      description: "The policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'."
+                      description: |
+                        The specific policy to apply to the selected rule. This is not criteria for a match, this is the 
+                        action to take when a match is made.
                       schema:
                         type: string
                         default: "two_factor"
@@ -773,7 +796,11 @@ questions:
                             description: "deny"
                     - variable: subject
                       label: "Subject"
-                      description: "defines the subject to apply authorizations to. This parameter is optional and matching any user if not provided"
+                      description: |
+                        This criteria matches identifying characteristics about the subject. Currently this is either 
+                        user or groups the user belongs to. This allows you to effectively control exactly what each user is 
+                        authorized to access or to specifically require two-factor authentication to specific users. Subjects 
+                        are prefixed with either user: or group: to identify which part of the identity to check.
                       schema:
                         type: list
                         default: []
@@ -982,7 +1009,9 @@ questions:
                                         description: "two_factor"
                                 - variable: consent_mode
                                   label: "Consent Mode"
-                                  description: "Configures the consent mode. This can be set to auto (default), explicit (consent required every time) or implicit (automatically assumes consent for every authorization, never asking the user if they wish to give consent.)"
+                                  description: |
+                                    Configures the consent mode. This can be set to auto (default), explicit (consent required every time) or 
+                                    implicit (automatically assumes consent for every authorization, never asking the user if they wish to give consent.)
                                   schema:
                                     type: string
                                     default: "auto"

charts/enterprise/authelia/values.yaml

@@ -1,7 +1,7 @@
 image:
-  repository: tccr.io/truecharts/authelia
+  repository: ghcr.io/authelia/authelia
   pullPolicy: IfNotPresent
-  tag: 4.37.5@sha256:76a4617539534cec140fd98a12f721b878524f2df3a3653f3df8ff2b7eaab586
+  tag: 4.37.5@sha256:25fc5423238b6f3a1fc967fda3f6a9212846aeb4a720327ef61c8ccff52dbbe2
 manifestManager:
   enabled: true
 workload:
@@ -22,40 +22,32 @@ workload:
             liveness:
               type: http
               path: "/api/health"
-
             readiness:
               type: http
               path: "/api/health"
-
             startup:
               type: http
               path: "/api/health"
-
 service:
   main:
     ports:
       main:
         port: 9091
         targetPort: 9091
-
 persistence:
   config:
     enabled: true
     mountPath: "/config"
-
 cnpg:
   main:
     enabled: true
     user: authelia
     database: authelia
-
 # Enabled redis
 # ... for more options see https://github.com/tccr.io/truecharts/charts/tree/master/tccr.io/truecharts/redis
 redis:
   enabled: true
-
 domain: example.com
-
 ##
 ## Server Configuration
 ##
@@ -65,7 +57,6 @@ server:
   ## Default is 9091 and should not need to be changed.
   ##
   port: 9091
-
   ## Buffers usually should be configured to be the same value.
   ## Explanation at https://www.authelia.com/docs/configuration/server.html
   ## Read buffer size adjusts the server's max incoming request size in bytes.
@@ -75,18 +66,14 @@ server:
   ## Set the single level path Authelia listens on.
   ## Must be alphanumeric chars and should not contain any slashes.
   path: ""
-
 log:
   ## Level of verbosity for logs: info, debug, trace.
   level: trace
-
   ## Format the logs are written as: json, text.
   format: text
-
   ## TODO: Statefulness check should check if this is set, and the configMap should enable it.
   ## File path where the logs will be written. If not set logs are written to stdout.
   # file_path: /config/authelia.log
-
 ## Default redirection URL
 ##
 ## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
@@ -99,7 +86,6 @@ default_redirection_url: ""
 # default_redirection_url: https://example.com
 
 theme: light
-
 ##
 ## TOTP Configuration
 ##
@@ -116,7 +102,6 @@ totp:
   ## Warning: before changing skew read the docs link below.
   ## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation.
   skew: 1
-
 ##
 ## Password Policy Config
 ##
@@ -135,7 +120,6 @@ password_policy:
     ## See https://www.authelia.com/configuration/security/password-policy/#zxcvbn for more info
     enabled: false
     min_score: 3
-
 ##
 ## Duo Push API Configuration
 ##
@@ -146,16 +130,13 @@ duo_api:
   hostname: api-123456789.example.com
   integration_key: ABCDEF
   plain_api_key: ""
-
 ## NTP settings
-
 ntp:
   address: "time.cloudflare.com:123"
   version: 4
   max_desync: 3s
   disable_startup_check: false
   disable_failure: true
-
 ##
 ## Authentication Backend Provider Configuration
 ##
@@ -165,7 +146,6 @@ ntp:
 authentication_backend:
   ## Disable both the HTML element and the API for reset password functionality
   disable_reset_password: false
-
   ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
   ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
   ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
@@ -174,7 +154,6 @@ authentication_backend:
   ## Duration Notation docs:  https://www.authelia.com/docs/configuration/index.html#duration-notation-format
   ## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval
   refresh_interval: 5m
-
   ## LDAP backend configuration.
   ##
   ## This backend allows Authelia to be scaled to more
@@ -183,7 +162,6 @@ authentication_backend:
   ldap:
     ## Enable LDAP Backend.
     enabled: false
-
     ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
     ## Acceptable options are as follows:
     ## - 'activedirectory' - For Microsoft Active Directory.
@@ -194,32 +172,24 @@ authentication_backend:
     ## attribute mappings have a default value that this config overrides, you can read more about these default values
     ## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults
     implementation: activedirectory
-
     ## The url to the ldap server. Format: <scheme>://<address>[:<port>].
     ## Scheme can be ldap or ldaps in the format (port optional).
     url: ldap://openldap.default.svc.cluster.local
-
     ## Connection Timeout.
     timeout: 5s
-
     ## Use StartTLS with the LDAP connection.
     start_tls: false
-
     tls:
       ## Server Name for certificate validation (in case it's not set correctly in the URL).
       server_name: ""
-
       ## Skip verifying the server certificate (to allow a self-signed certificate).
       ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
       ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
       skip_verify: false
-
       ## Minimum TLS version for either Secure LDAP or LDAP StartTLS.
       minimum_version: TLS1.2
-
     ## The base dn for every LDAP query.
     base_dn: DC=example,DC=com
-
     ## The attribute holding the username of the user. This attribute is used to populate the username in the session
     ## information. It was introduced due to #561 to handle case insensitive search queries. For you information,
     ## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this
@@ -228,11 +198,9 @@ authentication_backend:
     ## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
     ## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
     ## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
-    username_attribute: ""
-
+    username_attribute: "uid"
     ## An additional dn to define the scope to all users.
     additional_users_dn: OU=Users
-
     ## The users filter used in search queries to find the user profile based on input filled in login form.
     ## Various placeholders are available in the user filter:
     ## - {input} is a placeholder replaced by what the user inputs in the login form.
@@ -250,10 +218,8 @@ authentication_backend:
     ## To allow sign in both with username and email, one can use a filter like
     ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
     users_filter: ""
-
     ## An additional dn to define the scope of groups.
     additional_groups_dn: OU=Groups
-
     ## The groups filter used in search queries to find the groups of the user.
     ## - {input} is a placeholder replaced by what the user inputs in the login form.
     ## - {username} is a placeholder replace by the username stored in LDAP (based on `username_attribute`).
@@ -268,21 +234,16 @@ authentication_backend:
     ## If your groups use the `groupOfUniqueNames` structure use this instead:
     ##    (&(uniquemember={dn})(objectclass=groupOfUniqueNames))
     groups_filter: ""
-
     ## The attribute holding the name of the group
-    group_name_attribute: ""
-
+    group_name_attribute: "cn"
     ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
     ## first one returned by the LDAP server is used.
-    mail_attribute: ""
-
+    mail_attribute: "mail"
     ## The attribute holding the display name of the user. This will be used to greet an authenticated user.
-    display_name_attribute: ""
-
+    display_name_attribute: "displayname"
     ## The username of the admin user.
-    user: CN=Authelia,DC=example,DC=com
+    user: CN=admin,DC=example,DC=com
     plain_password: ""
-
   ##
   ## File (Authentication Provider)
   ##
@@ -305,7 +266,6 @@ authentication_backend:
       salt_length: 16
       memory: 1024
       parallelism: 8
-
 ##
 ## Access Control Configuration
 ##
@@ -337,7 +297,6 @@ access_control:
   ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
   ## resource if there is no policy to be applied to the user.
   default_policy: deny
-
   networks: []
   # networks:
   # - name: private
@@ -392,7 +351,6 @@ access_control:
   #   policy: two_factor
   # - domain: "{user}.example.com"
   #   policy: bypass
-
 ##
 ## Session Provider Configuration
 ##
@@ -401,24 +359,19 @@ access_control:
 session:
   ## The name of the session cookie. (default: authelia_session).
   name: authelia_session
-
   ## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
   ## Please read https://www.authelia.com/docs/configuration/session.html#same_site
   same_site: lax
-
   ## The time in seconds before the cookie expires and session is reset.
   expiration: 1h
-
   ## The inactivity time in seconds before the session is reset.
   inactivity: 5m
-
   ## The remember me duration.
   ## Value is in seconds, or duration notation. Value of 0 disables remember me.
   ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
   ## Longer periods are considered less secure because a stolen cookie will last longer giving attackers more time to
   ## spy or attack. Currently the default is 1M or 1 month.
   remember_me_duration: 1M
-
 ##
 ## Redis Provider
 ##
@@ -427,35 +380,26 @@ session:
 ## The redis connection details
 redisProvider:
   port: 6379
-
   ## Optional username to be used with authentication.
   # username: authelia
   username: ""
-
   ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
   database_index: 0
-
   ## The maximum number of concurrent active connections to Redis.
   maximum_active_connections: 8
-
   ## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
   minimum_idle_connections: 0
-
   ## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
   tls:
     enabled: false
-
     ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
     server_name: ""
-
     ## Skip verifying the server certificate (to allow a self-signed certificate).
     ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
     ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
     skip_verify: false
-
     ## Minimum TLS version for the connection.
     minimum_version: TLS1.2
-
   ## The Redis HA configuration options.
   ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
   high_availability:
@@ -463,7 +407,6 @@ redisProvider:
     enabledSecret: false
     ## Sentinel Name / Master Name
     sentinel_name: mysentinel
-
     ## The additional nodes to pre-seed the redis provider with (for sentinel).
     ## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
     ## For high availability to be used you must have either defined; the host above or at least one node below.
@@ -476,10 +419,8 @@ redisProvider:
 
     ## Choose the host with the lowest latency.
     route_by_latency: false
-
     ## Choose the host randomly.
     route_randomly: false
-
 ##
 ## Regulation Configuration
 ##
@@ -488,16 +429,13 @@ redisProvider:
 regulation:
   ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
   max_retries: 3
-
   ## The time range during which the user can attempt login before being banned. The user is banned if the
   ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
   ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
   find_time: 2m
-
   ## The length of time before a banned user can login again. Ban Time accepts duration notation.
   ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
   ban_time: 5m
-
 ##
 ## Storage Provider Configuration
 ##
@@ -512,7 +450,6 @@ storage:
     username: authelia
     sslmode: disable
     timeout: 5s
-
 ##
 ## Notification Provider
 ##
@@ -522,7 +459,6 @@ storage:
 notifier:
   ## You can disable the notifier startup check by setting this to true.
   disable_startup_check: false
-
   ##
   ## File System (Notification Provider)
   ##
@@ -531,7 +467,6 @@ notifier:
   filesystem:
     enabled: true
     filename: /config/notification.txt
-
   ##
   ## SMTP (Notification Provider)
   ##
@@ -561,91 +496,82 @@ notifier:
     startup_check_address: test@authelia.com
     disable_require_tls: false
     disable_html_emails: false
-
     tls:
       ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
       server_name: ""
-
       ## Skip verifying the server certificate (to allow a self-signed certificate).
       ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
       ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
       skip_verify: false
-
       ## Minimum TLS version for either StartTLS or SMTPS.
       minimum_version: TLS1.2
-
 identity_providers:
   oidc:
     ## Enables this in the config map. Currently in beta stage.
     ## See https://www.authelia.com/docs/configuration/identity-providers/oidc.html#roadmap
     enabled: false
-
     access_token_lifespan: 1h
     authorize_code_lifespan: 1m
     id_token_lifespan: 1h
     refresh_token_lifespan: 90m
-
     enable_client_debug_messages: false
-
     ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for
     ## security reasons.
     minimum_parameter_entropy: 8
-
     clients: []
     # clients:
     # -
     ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
     # id: myapp
+## The description to show to users when they end up on the consent screen. Defaults to the ID above.
+# description: My Application
 
-    ## The description to show to users when they end up on the consent screen. Defaults to the ID above.
-    # description: My Application
+## The client secret is a shared secret between Authelia and the consumer of this client.
+# secret: apple123
 
-    ## The client secret is a shared secret between Authelia and the consumer of this client.
-    # secret: apple123
+## Sets the client to public. This should typically not be set, please see the documentation for usage.
+# public: false
 
-    ## Sets the client to public. This should typically not be set, please see the documentation for usage.
-    # public: false
+## The policy to require for this client; one_factor or two_factor.
+# authorization_policy: two_factor
 
-    ## The policy to require for this client; one_factor or two_factor.
-    # authorization_policy: two_factor
+## Configures the consent mode; auto, explicit or implicit
+# consent_mode: auto
 
-    ## Configures the consent mode; auto, explicit or implicit
-    # consent_mode: auto
+## Audience this client is allowed to request.
+# audience: []
 
-    ## Audience this client is allowed to request.
-    # audience: []
+## Scopes this client is allowed to request.
+# scopes:
+#   - openid
+#   - profile
+#   - email
+#   - groups
 
-    ## Scopes this client is allowed to request.
-    # scopes:
-    #   - openid
-    #   - profile
-    #   - email
-    #   - groups
+## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
+# redirect_uris:
+#   - https://oidc.example.com/oauth2/callback
 
-    ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
-    # redirect_uris:
-    #   - https://oidc.example.com/oauth2/callback
+## Grant Types configures which grants this client can obtain.
+## It's not recommended to configure this unless you know what you're doing.
+# grant_types:
+#   - refresh_token
+#   - authorization_code
 
-    ## Grant Types configures which grants this client can obtain.
-    ## It's not recommended to configure this unless you know what you're doing.
-    # grant_types:
-    #   - refresh_token
-    #   - authorization_code
+## Response Types configures which responses this client can be sent.
+## It's not recommended to configure this unless you know what you're doing.
+# response_types:
+#   - code
 
-    ## Response Types configures which responses this client can be sent.
-    ## It's not recommended to configure this unless you know what you're doing.
-    # response_types:
-    #   - code
+## Response Modes configures which response modes this client supports.
+## It's not recommended to configure this unless you know what you're doing.
+# response_modes:
+#   - form_post
+#   - query
+#   - fragment
 
-    ## Response Modes configures which response modes this client supports.
-    ## It's not recommended to configure this unless you know what you're doing.
-    # response_modes:
-    #   - form_post
-    #   - query
-    #   - fragment
-
-    ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
-    # userinfo_signing_algorithm: none
+## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
+# userinfo_signing_algorithm: none
 
 portal:
   open:

charts/enterprise/blocky/Chart.yaml

@@ -1,13 +1,13 @@
 apiVersion: v2
-appVersion: "0.22.0"
+appVersion: "0.22"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.3.5
   - condition: redis.enabled
     name: redis
     repository: https://deps.truecharts.org
-    version: 8.0.41
+    version: 8.0.44
 description: Blocky is a DNS proxy, DNS enhancer and ad-blocker for the local network written in Go
 home: https://truecharts.org/charts/enterprise/blocky
 icon: https://truecharts.org/img/hotlink-ok/chart-icons/blocky.png
@@ -25,7 +25,7 @@ sources:
   - https://0xerr0r.github.io/blocky/
   - https://github.com/0xERR0R/blocky
   - https://github.com/Mozart409/blocky-frontend
-version: 9.0.4
+version: 9.0.11
 annotations:
   truecharts.org/category: network
   truecharts.org/SCALE-support: "true"

charts/enterprise/blocky/values.yaml

@@ -1,12 +1,11 @@
 image:
-  repository: tccr.io/truecharts/blocky
-  tag: v0.22.0@sha256:385055de8ad0b9074d2057d054768d649b8289c5dd566367e0b6289ba5d661a4
+  repository: spx01/blocky
+  tag: v0.22@sha256:7def473b1b553b730dd38ba0bc436fc732193c15d35681aa0b0eb962dd6350aa
   pullPolicy: IfNotPresent
-
 k8sgatewayImage:
-  repository: tccr.io/truecharts/k8s_gateway
+  repository: quay.io/oriedge/k8s_gateway
   pullPolicy: IfNotPresent
-  tag: 0.3.4@sha256:c49645e7b263e5cfc8fc269db2aef7d90149cecc7a50e2c2fe77ef935dd35742
+  tag: v0.3.4@sha256:21571315aa3939d708dcf040a7cb78328fd957bf60887299ffdd417e7240387b
 manifestManager:
   enabled: true
 workload:
@@ -35,7 +34,6 @@ workload:
               command:
                 - /app/blocky
                 - healthcheck
-
 # -- Blocky Config File content
 blockyConfig: {}
 # upstream:
@@ -46,7 +44,6 @@ blockyConfig: {}
 blocky:
   # -- Enable prometheus annotations
   enablePrometheus: true
-
 service:
   main:
     enabled: true
@@ -95,7 +92,6 @@ service:
         port: 5353
         protocol: udp
         targetPort: 5353
-
 ## TODO Add support for SCALE certificates and certificates secrets here
 certFile: ""
 keyFile: ""
@@ -105,7 +101,6 @@ logTimestamp: true
 logPrivacy: false
 dohUserAgent: ""
 minTlsServeVersion: 1.2
-
 # -- set the default DNS upstream servers
 # Primarily designed for inclusion in the TrueNAS SCALE GUI
 defaultUpstreams:
@@ -125,13 +120,12 @@ defaultUpstreams:
   - 76.223.122.150
   - 76.76.2.0
   - 76.76.10.0
-
 # -- set additional upstreams
 # Primarily designed for inclusion in the TrueNAS SCALE GUI
 upstreams:
-  #  - name: group2
-  #    dnsservers:
-  #      - 1.1.1.1
+#  - name: group2
+#    dnsservers:
+#      - 1.1.1.1
 
 # -- set bootstrap dns (not needed)
 # Ensures bootstrap encryption and ensure it doesn't use k8s dns
@@ -140,18 +134,15 @@ bootstrapDns:
   upstream: ""
   # -- IP's linked to upstream DoT/DoH DNS name
   ips: []
-
 # -- set additional bootstrap dns (not needed, only used if bootstrapDns is set)
-additionalBootstrapDns:
-  []
-  # - upstream: ""
-  #   ips: []
+additionalBootstrapDns: []
+# - upstream: ""
+#   ips: []
 
 # -- Return empty answer for these queries
 filtering:
   # -- Ensures filtering by query type
   queryTypes: []
-
 # -- Set manual custom DNS resolution
 customDNS:
   customTTL: 1h
@@ -162,7 +153,6 @@ customDNS:
   mapping: []
   # - domain: something.com
   #   dnsserver: 192.168.178.1
-
 # -- Setup client-name lookup
 clientLookup:
   # -- upstream used for client-name lookup
@@ -171,7 +161,6 @@ clientLookup:
   clients:
   # - domain: laptop
   #   ips: []
-
 # -- Setup caching
 caching:
   minTime: 5m
@@ -182,7 +171,6 @@ caching:
   prefetchThreshold: 5
   prefetchMaxItemsCount: 0
   cacheTimeNegative: 30m
-
 # -- set conditional settings
 # Primarily designed for inclusion in the TrueNAS SCALE GUI
 conditional:
@@ -192,7 +180,6 @@ conditional:
   mapping: []
   # - domain: something.com
   #   dnsserver: 192.168.178.1
-
 # -- set blocking settings using Lists
 # Primarily designed for inclusion in the TrueNAS SCALE GUI
 blocking:
@@ -231,7 +218,6 @@ blocking:
   # - name: default
   #   groups:
   #     - ads
-
 # -- configure using hostsfile for lookups
 # Allows for using the hosts configured in kubernetes and such
 hostsFile:
@@ -239,7 +225,6 @@ hostsFile:
   filePath: /etc/hosts
   hostsTTL: 60m
   refreshPeriod: 30m
-
 ## TODO: add this with postgresql support as well
 # queryLog:
 #   type: csv
@@ -247,20 +232,16 @@ hostsFile:
 #   logRetentionDays: 0
 #   creationAttempts: 3
 #   CreationCooldown: 2
-
 podOptions:
   automountServiceAccountToken: true
-
 portal:
   open:
     enabled: false
-
 serviceAccount:
   main:
     # -- Specifies whether a service account should be created
     enabled: true
     primary: true
-
 # -- Create a ClusterRole and ClusterRoleBinding
 # @default -- See below
 rbac:
@@ -287,21 +268,16 @@ rbac:
         verbs:
           - list
           - watch
-
 k8sgateway:
   enabled: true
   # -- TTL for non-apex responses (in seconds)
   ttl: 300
-
   # -- Limit what kind of resources to watch, e.g. watchedResources: ["Ingress"]
   watchedResources: []
-
   # -- Service name of a secondary DNS server (should be `serviceName.namespace`)
   secondary: ""
-
   # -- Override the default `serviceName.namespace` domain apex
   apex: ""
-
   # -- list of processed domains
   domains: []
   # -- Delegated domain
@@ -320,7 +296,6 @@ k8sgateway:
     options:
       - name: tls_servername
         value: cloudflare-dns.com
-
 metrics:
   main:
     # -- Enable and configure a Prometheus serviceMonitor for the chart under this key.
@@ -330,7 +305,6 @@ metrics:
     endpoints:
       - port: main
         path: /metrics
-
     # -- Enable and configure Prometheus Rules for the chart under this key.
     # @default -- See values.yaml
     prometheusRule:
@@ -338,21 +312,18 @@ metrics:
       labels: {}
       # -- Configure additionial rules for the chart under this key.
       # @default -- See prometheusrules.yaml
-      rules:
-        []
-        # - alert: UnifiPollerAbsent
-        #   annotations:
-        #     description: Unifi Poller has disappeared from Prometheus service discovery.
-        #     summary: Unifi Poller is down.
-        #   expr: |
-        #     absent(up{job=~".*unifi-poller.*"} == 1)
-        #   for: 5m
-        #   labels:
-        #     severity: critical
-
+      rules: []
+      # - alert: UnifiPollerAbsent
+      #   annotations:
+      #     description: Unifi Poller has disappeared from Prometheus service discovery.
+      #     summary: Unifi Poller is down.
+      #   expr: |
+      #     absent(up{job=~".*unifi-poller.*"} == 1)
+      #   for: 5m
+      #   labels:
+      #     severity: critical
 redis:
   enabled: true
-
 # CANNOT be defined in above yaml section
 queryLog:
   # optional one of: mysql, postgresql, csv, csv-client. If empty, log to console
@@ -366,9 +337,9 @@ queryLog:
   creationAttempts: 3
   # optional: Time between the creation attempts, default: 2s
   creationCooldown: 2s
-
 cnpg:
   main:
     enabled: false
     user: blocky
     database: blocky
+updated: true

charts/enterprise/clusterissuer/Chart.yaml

@@ -10,7 +10,7 @@ keywords:
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.3.5
 kubeVersion: ">=1.16.0-0"
 maintainers:
   - email: info@truecharts.org
@@ -21,7 +21,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/enterprise/clusterissuer
   - https://cert-manager.io/
 type: application
-version: 4.2.5
+version: 4.2.10
 annotations:
   truecharts.org/category: core
   truecharts.org/SCALE-support: "true"

charts/enterprise/clusterissuer/docs/cluster-certificates.md

@@ -0,0 +1,42 @@
+# Cluster Certificates Setup Guide
+
+This guide will walk you through setting up and using `cluster certificates`.
+
+:::note
+
+Since this is an advanced feature, it is not covered by Truecharts support.
+
+:::
+
+## Prerequisites
+
+- Ensure you have completed the [clusterissuer Setup Guide](how-to)
+- Install the `kubernetes-reflector` app from the `enterprise` train
+
+## Creating a cluster certificate
+
+In the clusterissuer app settings create a new "Cluster-Wide certificate". As with a [single domain certificate](how-to#configure-ingress-using-clusterissuer), input a cert-manager issuer (for example an ACME issuer you configured previously), a list of hosts for which the certificate is valid (you can use wildcards), and a name you will use to reference it.
+
+:::note
+
+In order for an ACME issuer to issue a wildcard certificate, you need to have a DNS01 challenge solver configured.
+
+:::
+
+![clusterissuer6](img/clusterissuer6.png)
+
+After creating the cluster certificate, verify it is working by checking the `Application Events` created in the `clusterissuer` app (see [how to verify a single app certificate is working](how-to#verifying-clusterissuer-is-working) for more information).
+
+## Using a cluster certificate
+
+After you have verified the certificate was created successfully, edit the settings of the app you wish to use it for and go to the _Ingress_ section.
+
+If you have previously used a single domain certificate from clusterissuer, remove the specified issuer name. Then, click on _Show Advanced Settings_  and add a _TLS_ entry. Enter the name of your cluster certificate, and the certificate host(s) which it will be used for. These are usually the same as your app host(s), unless you wish to use more than one certificate. Save the chart.
+
+:::note
+
+In order for your cluster certificate to show up as valid, the certificate hosts it is used for must match the ones specified when creating it in the clusterissuer app settings. For example, in this case we configure the certificate host `jellyfin.example.com`, which matches the configured wildcard certificate host (`*.example.com`).
+
+:::
+
+![clusterissuer7](img/clusterissuer7.png)

charts/enterprise/clusterissuer/questions.yaml

@@ -331,7 +331,7 @@ questions:
 
   - variable: clusterCertificates
     group: App Configuration
-    label: Cluster Wide Certificates (Experimental)
+    label: Cluster Wide Certificates (Advanced)
     description: "Creates certificates for use within the entire cluster. Can be used to create wildcard certificates."
     schema:
       additional_attrs: true

charts/enterprise/clusterissuer/values.yaml

@@ -1,6 +1,6 @@
 image:
-  repository: tccr.io/truecharts/scratch
-  tag: latest@sha256:7f821eeb99d04ac248c47f79cfbcc2482651fea48aff9ec5d2ba0ba34f1f5531
+  repository: hello-world
+  tag: latest@sha256:88ec0acaa3ec199d3b7eaf73588f4518c25f9d34f58ce9a0df68429c5af48e8d
   pullPolicy: IfNotPresent
 manifestManager:
   enabled: true
@@ -18,7 +18,6 @@ workload:
               enabled: false
             startup:
               enabled: false
-
 service:
   main:
     enabled: false
@@ -26,18 +25,15 @@ service:
       main:
         enabled: false
         port: 9999
-
 portal:
   open:
     enabled: false
-
 operator:
   verify:
     additionalOperators:
       - cert-manager
     enabled: true
     failOnError: false
-
 clusterIssuer:
   selfSigned:
     enabled: true

charts/enterprise/external-dns/Chart.yaml

@@ -0,0 +1,28 @@
+apiVersion: v2
+appVersion: "0.14.0"
+dependencies:
+  - name: common
+    repository: https://library-charts.truecharts.org
+    version: 14.3.5
+deprecated: false
+description: ExternalDNS synchronizes exposed Kubernetes Services and Ingresses with DNS providers.
+home: https://truecharts.org/charts/enterprise/external-dns
+icon: https://truecharts.org/img/hotlink-ok/chart-icons/external-dns.png
+keywords:
+  - external-dns
+  - k8s
+  - kubernetes
+kubeVersion: ">=1.16.0-0"
+maintainers:
+  - email: info@truecharts.org
+    name: TrueCharts
+    url: https://truecharts.org
+name: external-dns
+sources:
+  - https://github.com/truecharts/charts/tree/master/charts/enterprise/external-dns
+  - https://github.com/kubernetes-sigs/external-dns
+type: application
+version: 1.0.5
+annotations:
+  truecharts.org/category: networking
+  truecharts.org/SCALE-support: "true"

charts/enterprise/external-dns/README.md

@@ -0,0 +1,27 @@
+# README
+
+## General Info
+
+TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE.
+However only installations using the TrueNAS SCALE Apps system are supported.
+
+For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/enterprise/)
+
+**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
+
+
+## Support
+
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
+- See the [Website](https://truecharts.org)
+- Check our [Discord](https://discord.gg/tVsPTHWTtr)
+- Open a [issue](https://github.com/truecharts/charts/issues/new/choose)
+
+---
+
+## Sponsor TrueCharts
+
+TrueCharts can only exist due to the incredible effort of our staff.
+Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
+
+*All Rights Reserved - The TrueCharts Project*

charts/enterprise/external-dns/docs/setup-guide.md

@@ -0,0 +1,80 @@
+# External-DNS Setup Guide
+
+ExternalDNS synchronizes exposed Kubernetes Services and Ingresses with DNS providers.
+
+## What it does?
+
+Inspired by Kubernetes DNS, Kubernetes' cluster-internal DNS server, ExternalDNS makes Kubernetes resources discoverable via public DNS servers. Like KubeDNS, it retrieves a list of resources (Services, Ingresses, etc.) from the Kubernetes API to determine a desired list of DNS records. Unlike KubeDNS, however, it's not a DNS server itself, but merely configures other DNS providers accordingly—e.g. AWS Route 53 or Google Cloud DNS.
+
+### Prerequisites (required for Support on TrueCharts Discord)
+
+ - Traefik
+ - Clusterissuer / Cert-manager installed (vital if exposed externally)
+
+Please follow the [Getting Started](https://truecharts.org/manual/SCALE/guides/getting-started) guide on the [Truecharts](https://truecharts.org) website.
+
+## Installation instructions
+
+This guide will cover 2 scenarios, `Cloudflare` and `Pi-Hole` / `Pihole`, for more external DNS record providers, see [External-DNS Docs](https://github.com/kubernetes-sigs/external-dns/tree/master/docs/tutorials).
+
+### Cloudflare
+
+These instructions taken from [external-dns cloudflare tutorial](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/cloudflare.md)
+
+#### Step 1: 
+
+Enter `CF_API_TOKEN` (preferred) or `CF_API_EMAIL`/`CF_API_KEY`
+
+![Cloudflare API Token](img/Cloudflare-API-token.png)
+
+#### Step 2:
+
+Enter preferences for Logs and DNS updates (I suggest >5m to prevent log spam) and select `cloudflare` as provider and select sources. I find  `ingress` and `service` covers everything. If you want to filter by multiple domains add your `Domain Filter Entry`
+
+![Cloudflare App Config 1](img/Cloudflare-App-Config-1.png)
+
+I recommend using `noop` for `Registry Type` and leaving the rest as default, can add DNS Zone filters as necessary as well (see upstream/cloudflare docs).
+
+![Cloudflare App Config 2](img/Cloudflare-App-Config-2.png)
+
+#### Step 3:
+
+Verify it works, check the logs for updates to DNS records
+
+```2023-11-07 09:36:07.165596-05:00time="2023-11-07T09:36:07-05:00" level=info msg="Instantiating new Kubernetes client"
+2023-11-07 09:36:07.165633-05:00time="2023-11-07T09:36:07-05:00" level=info msg="Using inCluster-config based on serviceaccount-token"
+2023-11-07 09:36:07.165850-05:00time="2023-11-07T09:36:07-05:00" level=info msg="Created Kubernetes client https://172.17.0.1:443"
+2023-11-07 09:36:08.958946-05:00time="2023-11-07T09:36:08-05:00" level=info msg="Changing record." action=CREATE record=seafile.DOMAIN.com ttl=1 type=A zone=d959ce24eb85d78a7f527b6150446335
+```
+
+If this works, you'll see DNS entries inside Cloudflare's DNS page.
+
+### PiHole
+
+#### Step 1
+
+Ignore Provider Credentials, and skip straight to `App Configuration` and select `pihole`, add domain filters as necessary
+
+![PiHole App Config 1](img/PiHole-Config-1.png)
+
+Change to `noop` for `Registry Type` and add `PiHole Server Address` (default is `http://pihole.ix-pihole.svc.cluster.local:9089`) and `PiHole Server Password`
+
+![PiHole App Config 2](img/PiHole-Config-2.png)
+
+#### Step 2
+
+Verify logs from `External-DNS` to see if it connects and updates `PiHole`
+
+```d:false IBMCloudConfigFile:/etc/kubernetes/ibmcloud.json TencentCloudConfigFile:/etc/kubernetes/tencent-cloud.json TencentCloudZoneType: PiholeServer:http://pihole.ix-pihole.svc.cluster.local:9089 PiholePassword:****** PiholeTLSInsecureSkipVerify:false PluralCluster: PluralProvider:}"
+2023-11-07 10:29:07.801555-05:00time="2023-11-07T10:29:07-05:00" level=info msg="Instantiating new Kubernetes client"
+2023-11-07 10:29:07.801568-05:00time="2023-11-07T10:29:07-05:00" level=info msg="Using inCluster-config based on serviceaccount-token"
+2023-11-07 10:29:07.801861-05:00time="2023-11-07T10:29:07-05:00" level=info msg="Created Kubernetes client https://172.17.0.1:443"
+2023-11-07 10:29:08.008741-05:00time="2023-11-07T10:29:08-05:00" level=info msg="add firezone.DOMAIN.com IN A -> 192.168.88.105"
+2023-11-07 10:29:10.048171-05:00time="2023-11-07T10:29:10-05:00" level=info msg="add scrutiny.DOMAN.com IN A -> 192.168.88.105"
+```
+
+Check `PiHole` GUI for A records under `Local DNS`
+
+![PiHole-GUI](img/PiHole-GUI.png)
+
+Enjoy!

charts/enterprise/external-dns/questions.yaml

@@ -0,0 +1,350 @@
+# Include{groups}
+portals:
+  open:
+# Include{portalLink}
+questions:
+# Include{global}
+# Include{workload}
+# Include{workloadDeployment}
+# Include{replicas1}
+# Include{podSpec}
+# Include{containerMain}
+                                - variable: env
+                                  label: "Provider Specific Credentials - Main Config Below"
+                                  schema:
+                                    additional_attrs: true
+                                    type: dict
+                                    attrs:
+                                      - variable: CF_API_TOKEN
+                                        label: Cloudflare API Token (preferred)
+                                        description: Cloudflare API Token, optimal when using with Cloudflare
+                                        schema:
+                                          type: string
+                                          default: ""
+                                      - variable: CF_API_KEY
+                                        label: Cloudflare API Key
+                                        description: Cloudflare API Key if not using the preferred API Token
+                                        schema:
+                                          type: string
+                                          default: ""
+                                      - variable: CF_API_EMAIL
+                                        label: Cloudflare API Email
+                                        description: Cloudflare API email if not using the preferred API Token
+                                        schema:
+                                          type: string
+                                          default: ""
+                                      - variable: DO_TOKEN
+                                        label: Digitalocean API Key
+                                        description: Needed for read / write access on Digitalocean
+                                        schema:
+                                          type: string
+                                          default: ""
+                                      - variable: DNSSIMPLE_OAUTH
+                                        label: DNS Simple OAUTH Key
+                                        description:
+                                        schema:
+                                          type: string
+                                          default: ""
+                                      - variable: LINODE_TOKEN
+                                        label: Linode PI Key
+                                        description: Needed for read / write access on Linode
+                                        schema:
+                                          type: string
+                                          default: ""
+                                      - variable: OVH_APPLICATION_KEY
+                                        label: OVH Application Key
+                                        description: OVH Application Key
+                                        schema:
+                                          type: string
+                                          default: ""
+                                      - variable: OVH_APPLICATION_SECRET
+                                        label: OVH Application Secret
+                                        description: OVH Application Secret
+                                        schema:
+                                          type: string
+                                          default: ""
+                                      - variable: OVH_CONSUMER_KEY
+                                        label: OVH Consumer Key
+                                        description: Your OVH Consumer key after validated link
+                                        schema:
+                                          type: string
+                                          default: ""
+                                      - variable: SCW_ACCESS_KEY
+                                        label: Scaleway Access Key
+                                        description: Your Scaleway Access Key
+                                        schema:
+                                          type: string
+                                          default: ""
+                                      - variable: SCW_SECRET_KEY
+                                        label: Scaleway Secret Key
+                                        description: Your Scaleway Secret Key
+                                        schema:
+                                          type: string
+                                          default: ""
+# Include{containerBasic}
+# Include{containerAdvanced}
+# Include{containerConfig}
+  - variable: externaldns
+    group: App Configuration
+    label: External-DNS Configuration
+    schema:
+      additional_attrs: true
+      type: dict
+      attrs:
+        - variable: logLevel
+          label: Log Verbosity Level
+          description: How description the logs are, from info to debug.
+          schema:
+            type: string
+            required: true
+            default: info
+            enum:
+              - value: info
+                description: info
+              - value: warning
+                description: warning
+              - value: error
+                description: error
+              - value: panic
+                description: panic
+              - value: debug
+                description: debug
+              - value: fatal
+                description: fatal
+        - variable: logFormat
+          label: Log Format
+          description: Output logs in either text or Json
+          schema:
+            type: string
+            default: text
+            enum:
+              - value: text
+                description: text
+              - value: json
+                description: json
+        - variable: interval
+          label: The interval for DNS updates.
+          description: How often the DNS will you update your DNS records
+          schema:
+            type: string
+            default: 5m
+        - variable: provider
+          label: Provider
+          description: Provider where the upstream DNS records will be created, eg Cloudflare, Digitalocean or things such as pihole. Some providers need additional args set when using them, please refer to upstream documentation for their usage.
+          schema:
+            type: string
+            required: true
+            default: cloudflare
+            enum:
+              - value: akamai
+                description: akamai
+              - value: alibabacloud
+                description: alibabacloud
+              - value: aws
+                description: aws
+              - value: aws-sd
+                description: aws-sd
+              - value: azure
+                description: azure
+              - value: azure-dns
+                description: azure-dns
+              - value: azure-private-dns
+                description: azure-private-dns
+              - value: bluecat
+                description: bluecat
+              - value: civo
+                description: civo
+              - value: cloudflare
+                description: cloudflare
+              - value: coredns
+                description: coredns
+              - value: designate
+                description: designate
+              - value: digitalocean
+                description: digitalocean
+              - value: dnsimple
+                description: dnsimple
+              - value: dyn
+                description: dyn
+              - value: exoscale
+                description: exoscale
+              - value: gandi
+                description: gandi
+              - value: godaddy
+                description: godaddy
+              - value: google
+                description: google
+              - value: ibmcloud
+                description: ibmcloud
+              - value: infoblox
+                description: infoblox
+              - value: inmemory
+                description: inmemory
+              - value: linode
+                description: linode
+              - value: ns1
+                description: ns1
+              - value: oci
+                description: oci
+              - value: pdns
+                description: pdns
+              - value: pihole
+                description: pihole
+              - value: plural
+                description: plural
+              - value: rcodezero
+                description: rcodezero
+              - value: rdns
+                description: rdns
+              - value: rfc2136
+                description: rfc2136
+              - value: safedns
+                description: safedns
+              - value: scaleway
+                description: scaleway
+              - value: skydns
+                description: skydns
+              - value: tencentcloud
+                description: tencentcloud
+              - value: transip
+                description: transip
+              - value: ultradns
+                description: ultradns
+              - value: vinyldns
+                description: vinyldns
+              - value: vultr
+                description: vultr
+        - variable: sources
+          label: "Sources"
+          schema:
+            type: list
+            default: ["ingress"]
+            items:
+            - variable: source
+              label: source
+              schema:
+                type: string
+                required: true
+                default: ingress
+                enum:
+                  - value: ingress
+                    description: ingress
+                  - value: service
+                    description: service
+        - variable: domainFilters
+          label: Domain Filters
+          description: Limit possible target zones by domain suffixes.
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: domainFilterEntry
+                label: Domain Filter Entry
+                schema:
+                  type: string
+                  default: ""
+                  required: true
+        - variable: zoneidFilters
+          label: Cloudflare DNS Zone Filter (optional)
+          description: Limit possible target zones by zone IDs. (Optional)
+          schema:
+            type: list
+            show_if: [["provider", "=", "cloudflare"]]
+            default: []
+            items:
+              - variable: zoneidFilterEntry
+                label: Zone ID Filter Entry
+                schema:
+                  type: string
+                  default: ""
+                  required: true
+        - variable: registry
+          label: Registry Type
+          description: Available registry types are txt, noop
+          schema:
+            type: string
+            default: noop
+            enum:
+              - value: txt
+                description: text
+              - value: noop
+                description: noop
+        - variable: policy
+          label: DNS Synchronization Policy
+          description: How DNS records are synchronized between sources and providers
+          schema:
+            type: string
+            default: upsert-only
+            enum:
+              - value: upsert-only
+                description: upsert-only
+              - value: sync
+                description: sync
+        - variable: txtOwnerId
+          label: txt Owner Id
+          description: TXT registry identifier.
+          schema:
+            type: string
+            default: ""
+        - variable: txtPrefix
+          label: txtPrefix
+          description: Prefix to create a TXT record with a name following the pattern prefix.<CNAME record>
+          schema:
+            type: string
+            default: ""
+        - variable: txtSuffix
+          label: txtSuffix
+          description: TXT Suffix to attach
+          schema:
+            type: string
+            default: ""
+        - variable: piholeServer
+          label: Pi-Hole Server Address
+          description: Actual adresss/FQDN of your Pi-Hole install, such as pihole-web.pihole.svc.cluster.local,
+          schema:
+            type: string
+            show_if: [["provider", "=", "pihole"]]
+            default: ""
+        - variable: piholePassword
+          label: Pi-Hole Server Passowrd
+          description: Password for Pi-Hole
+          schema:
+            type: string
+            show_if: [["provider", "=", "pihole"]]
+            private: true
+            default: ""
+# Include{podOptions}
+# Include{serviceExpertRoot}
+# Include{serviceExpert}
+# Include{serviceList}
+# Include{persistenceList}
+# Include{ingressList}
+# Include{securityContextRoot}
+              - variable: runAsUser
+                label: "runAsUser"
+                description: "The UserID of the user running the application"
+                schema:
+                  type: int
+                  default: 568
+              - variable: runAsGroup
+                label: "runAsGroup"
+                description: "The groupID of the user running the application"
+                schema:
+                  type: int
+                  default: 568
+# Include{securityContextContainer}
+# Include{securityContextAdvanced}
+# Include{securityContextPod}
+              - variable: fsGroup
+                label: "fsGroup"
+                description: "The group that should own ALL storage."
+                schema:
+                  type: int
+                  default: 568
+# Include{resources}
+# Include{advanced}
+# Include{addons}
+# Include{codeserver}
+# Include{netshoot}
+# Include{vpn}
+# Include{documentation}

charts/enterprise/external-dns/templates/_args.tpl

@@ -0,0 +1,48 @@
+{{- define "externaldns.args" -}}
+args:
+  {{- with .Values.externaldns.provider }}
+  - --provider={{ . }}
+  {{- end -}}
+  {{- range .Values.externaldns.zoneidFilters }}
+  - --zone-id-filter={{ . }}
+  {{- end -}}
+  {{- with .Values.externaldns.cloudflareProxied }}
+  - --cloudflare-proxied={{ . }}
+  {{- end }}
+  - --log-level={{ .Values.externaldns.logLevel }}
+  - --log-format={{ .Values.externaldns.logFormat }}
+  - --interval={{ .Values.externaldns.interval }}
+  {{- if .Values.externaldns.triggerLoopOnEvent }}
+  - --events
+  {{- end -}}
+  {{- range .Values.externaldns.sources }}
+  - --source={{ . }}
+  {{- end -}}
+  {{- with .Values.externaldns.policy }}
+  - --policy={{ . }}
+  {{- end -}}
+  {{- with .Values.externaldns.registry }}
+  - --registry={{ . }}
+  {{- end -}}
+  {{- with .Values.externaldns.txtOwnerId }}
+  - --txt-owner-id={{ . }}
+  {{- end -}}
+  {{- with .Values.externaldns.txtPrefix }}
+  - --txt-prefix={{ . }}
+  {{- end -}}
+  {{- if and (eq .Values.externaldns.txtPrefix "") (ne .Values.externaldns.txtSuffix "") }}
+  - --txt-suffix={{ .Values.externaldns.txtSuffix }}
+  {{- end -}}
+  {{- if .Values.externaldns.namespaced }}
+  - --namespace={{ include "tc.v1.common.lib.metadata.namespace" (dict "caller" "External-DNS" "rootCtx" $ "objectData" .Values) }}
+  {{- end -}}
+  {{- range .Values.externaldns.domainFilters }}
+  - --domain-filter={{ . }}
+  {{- end -}}
+  {{- with .Values.externaldns.piholeServer }}
+  - --pihole-server={{ . }}
+  {{- end -}}
+  {{- with .Values.externaldns.piholePassword }}
+  - --pihole-password={{ . }}
+  {{- end -}}
+{{- end -}}

charts/enterprise/external-dns/templates/common.yaml

@@ -0,0 +1,9 @@
+{{/* Make sure all variables are set properly */}}
+{{- include "tc.v1.common.loader.init" . }}
+
+{{- $newArgs := (include "externaldns.args" . | fromYaml) }}
+{{- $args := concat ((get .Values.workload.main.podSpec.containers.main "args") | default list)  $newArgs.args }}
+{{- $_ := set .Values.workload.main.podSpec.containers.main "args" $args -}}
+
+{{/* Render the templates */}}
+{{ include "tc.v1.common.loader.apply" . }}

charts/enterprise/external-dns/values.yaml

@@ -0,0 +1,143 @@
+image:
+  repository: registry.k8s.io/external-dns/external-dns
+  pullPolicy: IfNotPresent
+  tag: v0.14.0@sha256:474077b3dfccb3021db0a6638274967d0f64ce60dd9730a6f464bee2f78b046f
+externaldns:
+  logLevel: "info"
+  logFormat: "text"
+  interval: "1m"
+  provider: "inmemory"
+  sources:
+    - "service"
+    - "ingress"
+  domainFilters: []
+  zoneidFilters: []
+  cloudflareProxied: ""
+  registry: "txt"
+  policy: ""
+  piholeServer: ""
+  piholePassword: ""
+  triggerLoopOnEvent: "false"
+  txtOwnerId: ""
+  txtPrefix: ""
+  txtSuffix: ""
+service:
+  main:
+    ports:
+      main:
+        protocol: http
+        targetPort: 7979
+        port: 7979
+workload:
+  main:
+    podSpec:
+      containers:
+        main:
+          probes:
+            liveness:
+              path: "/healthz"
+            readiness:
+              path: "/healthz"
+            startup:
+              path: "/healthz"
+          env:
+            CF_API_TOKEN: ""
+            CF_API_KEY: ""
+            CF_API_EMAIL: ""
+            DO_TOKEN: ""
+            DNSIMPLE_OAUTH: ""
+            LINODE_TOKEN: ""
+            OVH_APPLICATION_KEY: ""
+            OVH_APPLICATION_SECRET: ""
+            OVH_CONSUMER_KEY: ""
+            SCW_ACCESS_KEY: ""
+            SCW_SECRET_KEY: ""
+# -- Whether Role Based Access Control objects like roles and rolebindings should be created
+rbac:
+  main:
+    enabled: true
+    primary: true
+    clusterWide: true
+    rules:
+      - apiGroups: [""]
+        resources: ["nodes"]
+        verbs: ["list", "watch"]
+      - apiGroups: [""]
+        resources: ["pods"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: [""]
+        resources: ["services", "endpoints"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: ["extensions", "networking.k8s.io"]
+        resources: ["ingresses"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: ["networking.istio.io"]
+        resources: ["gateways"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: ["networking.istio.io"]
+        resources: ["virtualservices"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: ["getambassador.io"]
+        resources: ["hosts", "ingresses"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: ["projectcontour.io"]
+        resources: ["httpproxies"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: ["externaldns.k8s.io"]
+        resources: ["dnsendpoints"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: ["externaldns.k8s.io"]
+        resources: ["dnsendpoints/status"]
+        verbs: ["*"]
+      - apiGroups: ["gateway.networking.k8s.io"]
+        resources: ["gateways"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: ["gateway.networking.k8s.io"]
+        resources: ["httproutes"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: [""]
+        resources: ["namespaces"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: ["gateway.networking.k8s.io"]
+        resources: ["grpcroutes"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: ["gateway.networking.k8s.io"]
+        resources: ["tlsroutes"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: ["gateway.networking.k8s.io"]
+        resources: ["tcproutes"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: ["gateway.networking.k8s.io"]
+        resources: ["udproutes"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: ["gloo.solo.io", "gateway.solo.io"]
+        resources: ["proxies", "virtualservices"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: ["configuration.konghq.com"]
+        resources: ["tcpingresses"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: ["traefik.containo.us", "traefik.io"]
+        resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: ["route.openshift.io"]
+        resources: ["routes"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: ["zalando.org"]
+        resources: ["routegroups"]
+        verbs: ["get", "watch", "list"]
+      - apiGroups: ["zalando.org"]
+        resources: ["routegroups/status"]
+        verbs: ["patch", "update"]
+      - apiGroups: ["cis.f5.com"]
+        resources: ["virtualservers"]
+        verbs: ["get", "watch", "list"]
+# -- The service account the pods will use to interact with the Kubernetes API
+serviceAccount:
+  main:
+    enabled: true
+    primary: true
+podOptions:
+  automountServiceAccountToken: true
+portal:
+  open:
+    enabled: false

charts/enterprise/grafana/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "10.2.0"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.3.5
 deprecated: false
 description: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, Elasticsearch, OpenTSDB, Prometheus and InfluxDB.
 home: https://truecharts.org/charts/enterprise/grafana
@@ -24,7 +24,7 @@ sources:
   - https://github.com/bitnami/bitnami-docker-grafana
   - https://grafana.com/
 type: application
-version: 9.0.32
+version: 9.0.39
 annotations:
   truecharts.org/category: metrics
   truecharts.org/SCALE-support: "true"

charts/enterprise/grafana/values.yaml

@@ -1,13 +1,12 @@
 image:
-  repository: tccr.io/truecharts/grafana
+  repository: bitnami/grafana
   pullPolicy: IfNotPresent
-  tag: v10.2.0@sha256:37149a3ed475cc9f0cedb4e6561f2566a782d5063cb0ff3f5a15d5e8f79ec33f
+  tag: 10.2.0@sha256:c488457595e458d4718c3748f106d9b331ca637a84b3f5ff07fdcc1dacaab646
 manifestManager:
   enabled: true
 securityContext:
   container:
     readOnlyRootFilesystem: false
-
 service:
   main:
     ports:
@@ -15,7 +14,6 @@ service:
         protocol: http
         targetPort: 3000
         port: 10038
-
 workload:
   main:
     replicas: 2
@@ -38,13 +36,10 @@ workload:
           probes:
             liveness:
               path: "/api/health"
-
             readiness:
               path: "/api/health"
-
             startup:
               path: "/api/health"
-
 persistence:
   config:
     enabled: true
@@ -53,7 +48,6 @@ persistence:
     enabled: true
     type: emptyDir
     mountPath: /opt/bitnami/grafana/tmp
-
 metrics:
   main:
     # -- Enable and configure a Prometheus serviceMonitor for the chart under this key.
@@ -70,18 +64,16 @@ metrics:
       labels: {}
       # -- Configure additionial rules for the chart under this key.
       # @default -- See prometheusrules.yaml
-      rules:
-        []
-        # - alert: UnifiPollerAbsent
-        #   annotations:
-        #     description: Unifi Poller has disappeared from Prometheus service discovery.
-        #     summary: Unifi Poller is down.
-        #   expr: |
-        #     absent(up{job=~".*unifi-poller.*"} == 1)
-        #   for: 5m
-        #   labels:
-        #     severity: critical
-
+      rules: []
+      # - alert: UnifiPollerAbsent
+      #   annotations:
+      #     description: Unifi Poller has disappeared from Prometheus service discovery.
+      #     summary: Unifi Poller is down.
+      #   expr: |
+      #     absent(up{job=~".*unifi-poller.*"} == 1)
+      #   for: 5m
+      #   labels:
+      #     severity: critical
 portal:
   open:
     enabled: true

charts/enterprise/kubernetes-reflector/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: "7.1.217"
+appVersion: "build"
 deprecated: false
 description: Kubernetes-Reflector is a Kubernetes addon designed to monitor and reflect changes to secrets and configmaps across namespaces
 home: https://truecharts.org/charts/enterprise/kubernetes-reflector
@@ -13,7 +13,7 @@ keywords:
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.3.5
 kubeVersion: ">=1.16.0-0"
 maintainers:
   - email: info@truecharts.org
@@ -24,7 +24,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/enterprise/kubernetes-reflector
   - https://github.com/emberstack/kubernetes-reflector
 type: application
-version: 1.0.2
+version: 1.0.6
 annotations:
   truecharts.org/category: operators
   truecharts.org/SCALE-support: "true"

charts/enterprise/kubernetes-reflector/values.yaml

@@ -1,15 +1,12 @@
 image:
-  repository: tccr.io/truecharts/kubernetes-reflector
+  repository: docker.io/emberstack/kubernetes-reflector
   pullPolicy: IfNotPresent
-  tag: v7.1.217@sha256:4ca9ce8c04441786ba0d343b3e5bfe9c638ac8efcc25aba0aaff3c6fb2363b5f
-
+  tag: build-7.1.217@sha256:982b8fc714349abe480a6864f3c3fce8e8801fd5068fac6add5b22ed32efc033
 operator:
   register: true
-
 portal:
   open:
     enabled: false
-
 rbac:
   main:
     enabled: true
@@ -36,16 +33,12 @@ rbac:
         verbs:
           - "watch"
           - "list"
-
 serviceAccount:
   main:
     enabled: true
     primary: true
-
-
 kubernetesReflector:
   logLevel: Information
-
 workload:
   main:
     podSpec:
@@ -72,7 +65,6 @@ workload:
               type: http
               path: /healthz
               port: 25080
-
 service:
   main:
     enabled: false

charts/enterprise/metallb-config/Chart.yaml

@@ -10,7 +10,7 @@ keywords:
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.3.5
 kubeVersion: ">=1.16.0-0"
 maintainers:
   - email: info@truecharts.org
@@ -22,7 +22,7 @@ sources:
   - https://github.com/metallb/metallb
   - https://metallb.universe.tf
 type: application
-version: 3.0.7
+version: 3.0.11
 annotations:
   truecharts.org/category: core
   truecharts.org/SCALE-support: "true"

charts/enterprise/metallb-config/values.yaml

@@ -1,6 +1,6 @@
 image:
-  repository: tccr.io/truecharts/scratch
-  tag: latest@sha256:7f821eeb99d04ac248c47f79cfbcc2482651fea48aff9ec5d2ba0ba34f1f5531
+  repository: hello-world
+  tag: latest@sha256:88ec0acaa3ec199d3b7eaf73588f4518c25f9d34f58ce9a0df68429c5af48e8d
   pullPolicy: IfNotPresent
 manifestManager:
   enabled: false
@@ -18,7 +18,6 @@ workload:
               enabled: false
             startup:
               enabled: false
-
 service:
   main:
     enabled: false
@@ -26,16 +25,13 @@ service:
       main:
         enabled: false
         port: 9999
-
 operator:
   verify:
     enabled: true
     additionalOperators: ["metallb"]
-
 portal:
   open:
     enabled: false
-
 ipAddressPools: []
 #   - name: example
 #     autoAssign: true

charts/enterprise/prometheus/Chart.yaml

@@ -1,17 +1,17 @@
 apiVersion: v2
-appVersion: "2.47.2"
+appVersion: "2.48.0"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.3.5
   - condition: exporters.enabled,exporters.node-exporter.enabled
     name: node-exporter
     repository: https://deps.truecharts.org
-    version: 3.0.36
+    version: 3.0.40
   - condition: exporters.enabled,exporters.kube-state-metrics.enabled
     name: kube-state-metrics
     repository: https://deps.truecharts.org
-    version: 3.0.34
+    version: 3.0.38
 deprecated: false
 description: kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.
 icon: https://truecharts.org/img/hotlink-ok/chart-icons/prometheus.png
@@ -29,7 +29,7 @@ sources:
   - https://github.com/prometheus-community/helm-charts
   - https://github.com/prometheus-operator/kube-prometheus
 type: application
-version: 13.0.12
+version: 13.0.22
 annotations:
   truecharts.org/category: metrics
   truecharts.org/SCALE-support: "true"

charts/enterprise/prometheus/values.yaml

@@ -1,15 +1,12 @@
 image:
-  repository: tccr.io/truecharts/prometheus
-  tag: v2.47.2@sha256:609ae6b1d62ee388d8dd552430985bbb332984b6aaa5df5dc62605dfe1f2e035
-
+  repository: bitnami/prometheus
+  tag: 2.48.0@sha256:43de9da8d70cff6b862daedd3afd323465bee5ab87ef2f67a1811bf15a39019a
 thanosImage:
-  repository: tccr.io/truecharts/thanos
-  tag: v0.32.5@sha256:4cea5ca36f1567993344c3375b9a80d8073dbc8d530656644d36c90683f96464
-
+  repository: quay.io/thanos/thanos
+  tag: v0.32.5@sha256:3e5c47dd3a0bfc6c595036c1c49c7ca95979a89c1fb93ee4cdee3bf5d296f944
 alertmanagerImage:
-  repository: tccr.io/truecharts/alertmanager
-  tag: v0.26.0@sha256:75279c577a514e90854126ba950cf7afaeac43eda85405fba394658b17ca0a6f
-
+  repository: bitnami/alertmanager
+  tag: 0.26.0@sha256:3da5256271a71100d822125dc4af6466f7f2d0a4a1680ba6c01087207be95192
 global:
   labels: {}
 workload:
@@ -26,7 +23,6 @@ workload:
               enabled: false
             startup:
               enabled: false
-
 service:
   main:
     selectorLabels:
@@ -59,7 +55,6 @@ service:
         port: 10901
         targetPort: 10901
         protocol: http
-
 ingress:
   main:
     enabled: false
@@ -67,20 +62,16 @@ ingress:
     enabled: false
   thanos:
     enabled: false
-
 ####
 ## Operator Config
 ####
-
 env:
   PROMETHEUS_CONFIG_RELOADER:
     configMapKeyRef:
       name: prometheus-operator-config
       key: prometheus-config-reloader
-
 podOptions:
   automountServiceAccountToken: true
-
 rbac:
   main:
     enabled: true
@@ -178,16 +169,13 @@ rbac:
           - get
           - list
           - watch
-
 # -- The service account the pods will use to interact with the Kubernetes API
 serviceAccount:
   main:
     enabled: true
     primary: true
-
 securityContext:
   readOnlyRootFilesystem: false
-
 probes:
   # -- Liveness probe configuration
   # @default -- See below
@@ -198,7 +186,6 @@ probes:
         path: "/metrics"
         port: promop
         scheme: HTTP
-
   # -- Redainess probe configuration
   # @default -- See below
   readiness:
@@ -208,7 +195,6 @@ probes:
         path: "/metrics"
         port: promop
         scheme: HTTP
-
   # -- Startup probe configuration
   # @default -- See below
   startup:
@@ -218,7 +204,6 @@ probes:
         path: "/metrics"
         port: promop
         scheme: HTTP
-
 operator:
   ## Create a servicemonitor for the operator
   ##
@@ -238,7 +223,6 @@ operator:
     ## ref: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config
     ##
     relabelings: []
-
   ## Prometheus Configmap-reload image to use for reloading configmaps
   ## defaults to Bitnami Prometheus Operator (ref: https://hub.docker.com/r/tccr.io/truecharts/prometheus-operator/tags/)
   ##
@@ -251,7 +235,6 @@ operator:
       capabilities:
         drop:
           - ALL
-
     livenessProbe:
       enabled: true
       initialDelaySeconds: 10
@@ -259,7 +242,6 @@ operator:
       timeoutSeconds: 5
       failureThreshold: 6
       successThreshold: 1
-
     readinessProbe:
       enabled: true
       initialDelaySeconds: 15
@@ -267,7 +249,6 @@ operator:
       timeoutSeconds: 5
       failureThreshold: 6
       successThreshold: 1
-
 ####
 ## Prometheus Config (Spawned by Operator)
 ####
@@ -326,7 +307,6 @@ prometheus:
     capabilities:
       drop:
         - ALL
-
   serviceMonitor:
     ## @param prometheus.serviceMonitor.enabled Creates a ServiceMonitor to monitor Prometheus itself
     ##
@@ -842,7 +822,6 @@ prometheus:
   ## @param prometheus.portName Port name used for the pods and governing service. This defaults to web
   ##
   portName: main
-
 ####
 ## Alert Manager Config
 ####
@@ -1120,7 +1099,6 @@ alertmanager:
   ## @param alertmanager.configSelector Namespaces to be selected for AlertmanagerConfig discovery. If nil, only check own namespace. This defaults to {}
   ##
   configSelector: {}
-
 ####
 ## Exporters
 ####
@@ -1138,14 +1116,12 @@ exporters:
     ## @param exporters.kube-state-metrics.enabled Enable kube-state-metrics
     ##
     enabled: true
-
 ## @param kube-state-metrics [object] Node Exporter deployment configuration
 ##
 kube-state-metrics:
   serviceMonitor:
     enabled: true
     honorLabels: true
-
 ## Component scraping for kubelet and kubelet hosted cAdvisor
 ##
 kubelet:
@@ -1361,7 +1337,7 @@ kubeProxy:
   ## @param kubeProxy.enabled Create a ServiceMonitor to scrape the kube-proxy Service
   ##
   enabled: false
-
 portal:
   open:
     enabled: true
+updated: true

charts/enterprise/traefik/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "2.10.5"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.3.5
 deprecated: false
 description: Traefik is a flexible reverse proxy and Ingress Provider.
 home: https://truecharts.org/charts/enterprise/traefik
@@ -23,7 +23,7 @@ sources:
   - https://github.com/traefik/traefik-helm-chart
   - https://traefik.io/
 type: application
-version: 21.1.4
+version: 21.1.9
 annotations:
   truecharts.org/category: network
   truecharts.org/SCALE-support: "true"

charts/enterprise/traefik/values.yaml

@@ -22,7 +22,6 @@ workload:
               # -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
               # @default -- "/"
               # path: "/ping"
-
             # -- Readiness probe configuration
             # @default -- See below
             readiness:
@@ -32,7 +31,6 @@ workload:
               # -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
               # @default -- "/"
               # path: "/ping"
-
             # -- Startup probe configuration
             # @default -- See below
             startup:
@@ -42,15 +40,12 @@ workload:
               # -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
               # @default -- "/"
               # path: "/ping"
-
 # -- Options for all pods
 # Can be overruled per pod
 podOptions:
   automountServiceAccountToken: true
-
 operator:
   register: true
-
 # -- Use ingressClass. Ignored if Traefik version < 2.3 / kubernetes < 1.18.x
 ingressClass:
   # true is not unit-testable yet, pending https://github.com/rancher/helm-unittest/pull/12
@@ -58,7 +53,6 @@ ingressClass:
   isDefaultClass: false
   # Use to force a networking.k8s.io API Version for certain CI/CD applications. E.g. "v1beta1"
   fallbackApiVersion: ""
-
 # -- Create an IngressRoute for the dashboard
 ingressRoute:
   dashboard:
@@ -72,22 +66,19 @@ ingressRoute:
 providers:
   kubernetesCRD:
     enabled: true
-    namespaces:
-      []
-      # - "default"
+    namespaces: []
+    # - "default"
   kubernetesIngress:
     enabled: true
     # labelSelector: environment=production,method=traefik
-    namespaces:
-      []
-      # - "default"
+    namespaces: []
+    # - "default"
     # IP used for Kubernetes Ingress endpoints
     publishedService:
       enabled: true
       # Published Kubernetes Service to copy status from. Format: namespace/servicename
       # By default this Traefik service
       # pathOverride: ""
-
 # -- Logs
 # https://docs.traefik.io/observability/logs/
 logs:
@@ -105,31 +96,27 @@ logs:
     # them to the selected output. In some cases, this option can greatly help performances.
     # bufferingSize: 100
     # Filtering https://docs.traefik.io/observability/access-logs/#filtering
-    filters:
-      {}
-      # statuscodes: "200,300-302"
-      # retryattempts: true
-      # minduration: 10ms
+    filters: {}
+    # statuscodes: "200,300-302"
+    # retryattempts: true
+    # minduration: 10ms
     # Fields
     # https://docs.traefik.io/observability/access-logs/#limiting-the-fieldsincluding-headers
     fields:
       general:
         defaultmode: keep
-        names:
-          {}
-          # Examples:
-          # ClientUsername: drop
+        names: {}
+        # Examples:
+        # ClientUsername: drop
       headers:
         defaultmode: drop
-        names:
-          {}
-          # Examples:
-          # User-Agent: redact
-          # Authorization: drop
-          # Content-Type: keep
+        names: {}
+        # Examples:
+        # User-Agent: redact
+        # Authorization: drop
+        # Content-Type: keep
     # -- Set the format of Access Logs to be either Common Log Format or JSON. For more information: https://doc.traefik.io/traefik/observability/access-logs/#format
     format: common
-
 metrics:
   main:
     enabled: false
@@ -138,10 +125,8 @@ metrics:
       - port: metrics
         path: /metrics
     targetSelector: metrics
-
 globalArguments:
   - "--global.checknewversion"
-
 ##
 # -- Additional arguments to be passed at Traefik's binary
 # All available options available on https://docs.traefik.io/reference/static-configuration/cli/
@@ -149,7 +134,6 @@ globalArguments:
 additionalArguments:
   - "--serverstransport.insecureskipverify=true"
   - "--providers.kubernetesingress.allowexternalnameservices=true"
-
 # -- TLS Options to be created as TLSOption CRDs
 # https://doc.traefik.io/tccr.io/truecharts/https/tls/#tls-options
 # Example:
@@ -167,7 +151,6 @@ tlsOptions:
       - TLS_AES_128_GCM_SHA256
       - TLS_AES_256_GCM_SHA384
       - TLS_CHACHA20_POLY1305_SHA256
-
 # -- Options for the main traefik service, where the entrypoints traffic comes from
 # from.
 service:
@@ -258,7 +241,6 @@ service:
           enabled: false
   # udp:
   #   enabled: false
-
 # -- Whether Role Based Access Control objects like roles and rolebindings should be created
 rbac:
   main:
@@ -310,13 +292,11 @@ rbac:
           - get
           - list
           - watch
-
 # -- The service account the pods will use to interact with the Kubernetes API
 serviceAccount:
   main:
     enabled: true
     primary: true
-
 # -- SCALE Middleware Handlers
 middlewares:
   basicAuth: []
@@ -441,16 +421,13 @@ middlewares:
   ## Note: body of every request will be buffered in memory while the request is in-flight
   ## (i.e.: during the security check and during the request processing by traefik and the backend),
   ## so you may want to tune maxBodySize depending on how much RAM you have.
-
 portalhook:
   enabled: true
-
 persistence:
   plugins:
     enabled: true
     mountPath: "/plugins-storage"
     type: emptyDir
-
 portal:
   open:
     enabled: true

charts/enterprise/vaultwarden/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "1.29.2"
+appVersion: "1.30.1"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.3.5
 deprecated: false
 description: Unofficial Bitwarden compatible server written in Rust
 home: https://truecharts.org/charts/enterprise/vaultwarden
@@ -25,7 +25,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/enterprise/vaultwarden
   - https://github.com/dani-garcia/vaultwarden
 type: application
-version: 23.0.5
+version: 23.0.11
 annotations:
   truecharts.org/category: security
   truecharts.org/SCALE-support: "true"

charts/enterprise/vaultwarden/values.yaml

@@ -1,7 +1,7 @@
 image:
-  repository: tccr.io/truecharts/vaultwarden
+  repository: docker.io/vaultwarden/server
   pullPolicy: IfNotPresent
-  tag: v1.29.2@sha256:f5761cdd99e267221623b7a91d123153885afd0980b31c863de039245b73aad3
+  tag: 1.30.1@sha256:ab9fe547277245533a28d8e0a0c4a1e1120daf469f983fd683fc13556927d4fe
 manifestManager:
   enabled: true
 service:
@@ -10,7 +10,6 @@ service:
       main:
         port: 10102
         targetPort: 8080
-
 workload:
   main:
     podSpec:
@@ -22,13 +21,11 @@ workload:
               secretKeyRef:
                 name: cnpg-main-urls
                 key: std
-
           envFrom:
             - configMapRef:
                 name: vaultwardenconfig
             - secretRef:
                 name: vaultwardensecret
-
 database:
   # -- Database type,
   # must be one of: 'sqlite', 'mysql' or 'postgresql'.
@@ -42,7 +39,6 @@ database:
   # maxConnections: 10
   ## Connection retries during startup, 0 for infinite. 1 second between retries.
   # retries: 15
-
 # Set Bitwarden_rs application variables
 vaultwarden:
   # -- Allow any user to sign-up
@@ -84,7 +80,6 @@ vaultwarden:
     disableAdminToken: false
     ## Token for admin login, will be generated if not defined. https://github.com/dani-garcia/bitwarden_rs/wiki/Enabling-admin-page
     # token:
-
   # Enable SMTP. https://github.com/dani-garcia/bitwarden_rs/wiki/SMTP-configuration
   smtp:
     enabled: false
@@ -112,7 +107,6 @@ vaultwarden:
     # user: ""
     ## SMTP password. Required is user is specified, ignored if no user provided.
     # password: ""
-
   ## Enable Yubico OTP authentication. https://github.com/dani-garcia/bitwarden_rs/wiki/Enabling-Yubikey-OTP-authentication
   yubico:
     enabled: false
@@ -121,13 +115,11 @@ vaultwarden:
     ## Yubico ID and Secret Key.
     # clientId:
     # secretKey:
-
   ## Enable Mobile Push Notifications. You must obtain and ID and Key here: https://bitwarden.com/host
   push:
     enabled: false
     # installationId:
     # installationKey:
-
   ## Logging options. https://github.com/dani-garcia/bitwarden_rs/wiki/Logging
   log:
     # Log to file.
@@ -136,7 +128,6 @@ vaultwarden:
     level: "trace"
     ## Log timestamp format. See https://docs.rs/chrono/0.4.15/chrono/format/strftime/index.html. Defaults to time in milliseconds.
     # timeFormat: ""
-
   icons:
     # Disables download of external icons. Setting to true will still serve icons from cache (/data/icon_cache). TTL will default to zero.
     disableDownload: false
@@ -144,18 +135,15 @@ vaultwarden:
     # cache: 2592000
     ## Cache time-to-live for icons that were not available. 0 means no purging.
     # cacheFailed: 259200
-
 persistence:
   data:
     enabled: true
     mountPath: "/data"
-
 cnpg:
   main:
     enabled: true
     user: vaultwarden
     database: vaultwarden
-
 portal:
   open:
     enabled: true

charts/incubator/americasarmy-pg/Chart.yaml

@@ -24,4 +24,4 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/incubator/americasarmy-pg
   - https://www.americasarmy.com/
 type: application
-version: 2.0.9
+version: 2.0.10

charts/incubator/americasarmy-pg/values.yaml

@@ -1,7 +1,7 @@
 image:
   pullPolicy: IfNotPresent
   repository: tccr.io/truecharts/americasarmy-pg
-  tag: latest@sha256:8475bc1cf676555fa5567c833667e9015c4d0d2c35c76f225064026fabe96b9e
+  tag: latest@sha256:04dadfa0f52e8a445a63a152328ff93a3cf856d296e4de095e431807ba071828
 
 podSecurityContext:
   runAsGroup: 0

charts/incubator/anki-sync-server/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "1.1.14"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.3.5
 description: A cross-platform Anki sync server.
 home: https://truecharts.org/charts/incubator/anki-sync-server
 icon: https://truecharts.org/img/hotlink-ok/chart-icons/anki-sync-server.png
@@ -18,7 +18,7 @@ name: anki-sync-server
 sources:
   - https://github.com/truecharts/charts/tree/master/charts/incubator/anki-sync-server
   - https://github.com/ankicommunity/anki-devops-services
-version: 3.0.3
+version: 3.0.5
 annotations:
   truecharts.org/category: media
   truecharts.org/SCALE-support: "true"

charts/incubator/anope/Chart.yaml

@@ -26,4 +26,4 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/incubator/anope
   - https://thelounge.chat/
 type: application
-version: 2.0.9
+version: 2.0.10

charts/incubator/anope/values.yaml

@@ -12,7 +12,7 @@ env:
 image:
   pullPolicy: IfNotPresent
   repository: tccr.io/truecharts/anope
-  tag: latest@sha256:db7fe61af11aa50ec63ed50b7718081aca3e8e1176a7b122ddd5f33089d62866
+  tag: latest@sha256:36ee4711a8a5e1376ab1d7e9eb1726aa918eaacbbb13c65452455b674d5d80da
 persistence:
   datapath:
     enabled: true

charts/incubator/answer/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "1.2.0"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.3.5
 deprecated: false
 description: A Q&A platform software for teams at any scales.
 home: https://truecharts.org/charts/incubator/answer
@@ -21,7 +21,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/incubator/answer
   - https://github.com/answerdev/answer
 type: application
-version: 0.0.8
+version: 0.0.10
 annotations:
   truecharts.org/category: forum
   truecharts.org/SCALE-support: "true"

charts/incubator/archiveteam-warrior/Chart.yaml

@@ -26,4 +26,4 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/incubator/archiveteam-warrior
   - https://wiki.archiveteam.org/index.php/ArchiveTeam_Warrior
 type: application
-version: 2.0.12
+version: 2.0.13

charts/incubator/archiveteam-warrior/values.yaml

@@ -2,7 +2,7 @@ env: {}
 image:
   pullPolicy: IfNotPresent
   repository: tccr.io/truecharts/archiveteam-warrior
-  tag: latest@sha256:2f9df36357450bf06fdb2347cdf655b9877b0f6cd69400dcd823693166c65588
+  tag: latest@sha256:aeb117796563b08f2dc4c41cbecda891b605240f5f55fbf816f86e0ea103f3e8
 
 podSecurityContext:
   runAsGroup: 0

charts/incubator/aurora-files/Chart.yaml

@@ -26,4 +26,4 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/incubator/aurora-files
   - https://github.com/afterlogic/docker-aurora-files
 type: application
-version: 2.0.10
+version: 2.0.11

charts/incubator/aurora-files/values.yaml

@@ -2,7 +2,7 @@ env: {}
 image:
   pullPolicy: IfNotPresent
   repository: tccr.io/truecharts/aurora-files
-  tag: latest@sha256:9b7866d47062c7b5ccb988c5f710942d583a4f2666d90235b347c124b26e7fb2
+  tag: latest@sha256:d5343b6713295318ef8e2abef16a1a047d7fe1bfdd0a78a1f50fe28212e9cbac
 persistence: {}
 podSecurityContext:
   runAsGroup: 0

charts/incubator/auto-yt-dl/Chart.yaml

@@ -24,4 +24,4 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/incubator/auto-yt-dl
   - https://github.com/xXGuhuXx/auto-yt-dl
 type: application
-version: 2.0.13
+version: 2.0.14

charts/incubator/auto-yt-dl/values.yaml

@@ -2,7 +2,7 @@ env: {}
 image:
   pullPolicy: IfNotPresent
   repository: tccr.io/truecharts/auto-yt-dl
-  tag: latest@sha256:bbd39e37f4456c5a5153a993acdddf8e55c4d42137d08fb977574526cc8fc139
+  tag: latest@sha256:3e52d0a449ee17c6399619e14bf390de074ae915371d7537e7cd1487b3342693
 persistence:
   data:
     enabled: true

charts/incubator/automatic-ripping-machine/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "2.6.60"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.3.5
 deprecated: false
 description: Automatic Ripping Machine (ARM) Scripts.
 home: https://truecharts.org/charts/incubator/automatic-ripping-machine
@@ -21,7 +21,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/incubator/automatic-ripping-machine
   - https://github.com/automatic-ripping-machine/automatic-ripping-machine
 type: application
-version: 0.0.5
+version: 0.0.8
 annotations:
   truecharts.org/category: media
   truecharts.org/SCALE-support: "true"

charts/incubator/automatic-ripping-machine/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: tccr.io/truecharts/automatic-ripping-machine
   pullPolicy: IfNotPresent
-  tag: v2.6.60@sha256:80794ea2bcf0372856f83c980ee65f26eacd3253b9c97215e686fb85e2df969b
+  tag: v2.6.60@sha256:bf79fee03b4ef8867ccbee6448748bf58b86a59c2400dd9beb5a4b926c6e7c10
 
 securityContext:
   container:

charts/incubator/avorion/Chart.yaml

@@ -24,4 +24,4 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/incubator/avorion
   - https://www.steampowered.com/
 type: application
-version: 2.0.9
+version: 2.0.10

charts/incubator/avorion/values.yaml

@@ -1,7 +1,7 @@
 image:
   pullPolicy: IfNotPresent
   repository: tccr.io/truecharts/avorion
-  tag: latest@sha256:d9e30669f6e5ed8bd890d158043bab0c3569265ca0952125a939a625d1ae0123
+  tag: latest@sha256:75a60c3eee403000a2a5ffd2476e3d86a983f07ee2de29f21ff5b176ccffa168
 
 stdin: true
 tty: true

charts/incubator/backuppc/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "6.0.2"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.2.3
+    version: 14.3.5
 deprecated: false
 description: A high-performance, enterprise-grade system for backing up Linux, Windows and macOS PCs and laptops to a server's disk.
 home: https://truecharts.org/charts/incubator/backuppc
@@ -23,7 +23,7 @@ sources:
   - https://github.com/tiredofit/docker-backuppc
   - https://backuppc.github.io/backuppc/index.html
 type: application
-version: 3.0.4
+version: 3.0.6
 annotations:
   truecharts.org/category: Backup
   truecharts.org/SCALE-support: "true"

charts/incubator/barotrauma/Chart.yaml

@@ -24,4 +24,4 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/incubator/barotrauma
   - https://www.steampowered.com/
 type: application
-version: 2.0.9
+version: 2.0.10

charts/incubator/barotrauma/values.yaml

@@ -1,7 +1,7 @@
 image:
   pullPolicy: IfNotPresent
   repository: tccr.io/truecharts/barotrauma
-  tag: latest@sha256:29c3e533bff810305d61fd7bce5b20782c5224241d4993878334fba5ee355e82
+  tag: latest@sha256:e29393c1f7ee311121369c62592c91a29647560008e7d4e3b4ca775ece3e6598
 
 podSecurityContext:
   runAsGroup: 0

charts/incubator/bitcoin-node/Chart.yaml

@@ -24,4 +24,4 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/incubator/bitcoin-node
   - https://github.com/kylemanna/docker-bitcoind
 type: application
-version: 2.0.11
+version: 2.0.12

charts/incubator/bitcoin-node/values.yaml

@@ -2,7 +2,7 @@ env: {}
 image:
   pullPolicy: IfNotPresent
   repository: tccr.io/truecharts/bitcoin-node
-  tag: latest@sha256:ef1d0c639cded75166c2141c198d68a2cff5a40af1d0bb875b56dbb66ac426c1
+  tag: latest@sha256:0297be53b97d6c9d55b7bd0de496217e5477220b7102633714632e4ace84e45a
 persistence:
   blockhainstorage:
     enabled: true

charts/incubator/bitcoind/Chart.yaml

@@ -26,4 +26,4 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/incubator/bitcoind
   - https://bitcoin.org/
 type: application
-version: 2.0.8
+version: 2.0.9