chore(deps): update helm release alloy to v1.13.1

Add prod IngressRoutes for seerr.forust.xyz and jelly.forust.xyz with letsencrypt certificates.

.gitea/workflows/deploy-lib.sh

@@ -330,11 +330,11 @@ rollback_workloads() {
 # written straight into a `helm upgrade` command would never be updated: these
 # have to be declared as custom.regex managers in renovate/renovate.json.
 HELM_RELEASES=(
-  "prometheus-stack|prometheus-community/kube-prometheus-stack|prometheus|86.2.3|prometheus-stack/k8s/grafana-values.yaml|prometheus-stack/k8s/active"
+  "prometheus-stack|prometheus-community/kube-prometheus-stack|prometheus|86.3.2|prometheus-stack/k8s/grafana-values.yaml|prometheus-stack/k8s/active"
   "victoria-operator|victoriametrics/victoria-metrics-operator|prometheus|0.68.1|prometheus-stack/k8s/victoria-operator-values.yaml|prometheus-stack/k8s/active"
   "loki|grafana/loki|prometheus|7.3.0|loki/k8s/loki-values.yaml|loki/k8s/active"
-  "alloy|grafana/alloy|prometheus|1.12.1|loki/k8s/alloy-values.yaml|loki/k8s/active"
-  "reloader|stakater/reloader|reloader|2.2.17|reloader/k8s/reloader-values.yaml|reloader/k8s/active"
+  "alloy|grafana/alloy|prometheus|1.13.1|loki/k8s/alloy-values.yaml|loki/k8s/active"
+  "reloader|stakater/reloader|reloader|2.2.18|reloader/k8s/reloader-values.yaml|reloader/k8s/active"
 )
 
 # "name url" for the Helm repository hosting a chart, empty if unknown.

.gitea/workflows/tool-versions.env

@@ -14,7 +14,7 @@ ACTIONLINT_VERSION="1.7.7"
 SHELLCHECK_VERSION="0.11.0"
 KUBECONFORM_VERSION="0.8.0"
 PRETTIER_VERSION="3.8.1"
-RUFF_VERSION="0.16.8"
+RUFF_VERSION="0.16.10"
 YAMLLINT_VERSION="1.38.0"
 HADOLINT_VERSION="2.14.0"
 # pip-audit reads the advisory database over the network, so a floating version

kener/compose.yaml

@@ -1,6 +1,6 @@
 services:
   kener:
-    image: rajnandan1/kener:4.1.5
+    image: rajnandan1/kener:v4.1.7
     container_name: kener
     restart: unless-stopped
     # ports:

kener/k8s/kener.yaml

@@ -31,7 +31,7 @@ spec:
     spec:
       containers:
         - name: kener
-          image: rajnandan1/kener:4.1.5
+          image: rajnandan1/kener:v4.1.7
           envFrom:
             - configMapRef:
                 name: kener-config

n8n/compose.yaml

@@ -1,6 +1,6 @@
 services:
   n8n:
-    image: docker.n8n.io/n8nio/n8n:2.43.0
+    image: docker.n8n.io/n8nio/n8n:2.43.2
     container_name: n8n
     restart: unless-stopped
     environment:

n8n/k8s/n8n.yaml

@@ -31,7 +31,7 @@ spec:
     spec:
       containers:
         - name: n8n
-          image: docker.n8n.io/n8nio/n8n:2.43.0
+          image: docker.n8n.io/n8nio/n8n:2.43.2
           envFrom:
             - configMapRef:
                 name: n8n-config

portainer/compose.yaml

@@ -1,6 +1,6 @@
 services:
   portainer:
-    image: portainer/portainer-ce:2.45.1
+    image: portainer/portainer-ce:2.45.2
     container_name: portainer
     restart: always
     volumes:

portainer/k8s/portainer.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
         - name: portainer
-          image: portainer/portainer-ce:2.45.1
+          image: portainer/portainer-ce:2.45.2
           ports:
             - containerPort: 9000
           volumeMounts:

renovate/k8s/cronjob.yaml

@@ -19,7 +19,7 @@ spec:
           restartPolicy: Never
           containers:
             - name: renovate
-              image: renovate/renovate:44.140.0
+              image: renovate/renovate:44.147.0
               env:
                 - name: RENOVATE_PLATFORM
                   value: gitea

renovate/renovate-compose.yaml

@@ -2,7 +2,7 @@ services:
   renovate:
     # Kept in step with renovate/k8s/cronjob.yaml by the "renovate self-update"
     # package rule in renovate/renovate.json.
-    image: renovate/renovate:44.136.0
+    image: renovate/renovate:44.147.0
     container_name: renovate
     restart: "no"
     env_file:

streaming/k8s/routing/certificates.yaml

@@ -78,16 +78,29 @@ spec:
 #   issuerRef:
 #     name: letsencrypt-prod
 #     kind: ClusterIssuer
-# ---
-# apiVersion: cert-manager.io/v1
-# kind: Certificate
-# metadata:
-#   name: jellyseerr-prod-tls
-#   namespace: streaming
-# spec:
-#   secretName: jellyseerr-prod-tls
-#   dnsNames:
-#     - jellyseerr.forust.xyz
-#   issuerRef:
-#     name: letsencrypt-prod
-#     kind: ClusterIssuer
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: seerr-prod-tls
+  namespace: streaming
+spec:
+  secretName: seerr-prod-tls
+  dnsNames:
+    - seerr.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: jelly-prod-tls
+  namespace: streaming
+spec:
+  secretName: jelly-prod-tls
+  dnsNames:
+    - jelly.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer

streaming/k8s/routing/ingress.yaml

@@ -1,5 +1,39 @@
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
+metadata:
+  name: seerr-prod
+  namespace: streaming
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`seerr.forust.xyz`)
+      kind: Rule
+      services:
+        - name: jellyseerr
+          port: 15055
+  tls:
+    secretName: seerr-prod-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: jelly-prod
+  namespace: streaming
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`jelly.forust.xyz`)
+      kind: Rule
+      services:
+        - name: jellyfin
+          port: 18096
+  tls:
+    secretName: jelly-prod-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
 metadata:
   name: jellyfin-local
   namespace: streaming

traefik/compose.yaml

@@ -1,6 +1,6 @@
 services:
   traefik:
-    image: traefik:v3.7.13
+    image: traefik:v3.7.14
     container_name: traefik
     restart: unless-stopped
     command:

traefik/k8s/traefik-values.yaml

@@ -3,7 +3,7 @@ hostNetwork: false
 image:
   registry: docker.io/library
   repository: traefik
-  tag: v3.7.13
+  tag: v3.7.14
 
 securityContext:
   capabilities: