some tries to get a functioning setup

Reviewed-on: #700

apps/audiobookshelf/ingress.yaml

@@ -9,9 +9,20 @@ spec:
   routes:
   - match: Host(`audiobookshelf.kluster.moll.re`)
     kind: Rule
+    middlewares:
+    - name: buffering
     services:
     - name: audiobookshelf-web
       port: 80
 
   tls:
-    certResolver: default-tls 
+    certResolver: default-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: buffering
+spec:
+  buffering:
+    maxRequestBodyBytes: 10000000000 # approx 10gb
+    memRequestBodyBytes: 1048576

apps/avahi-reflector/daemonset.yaml

@@ -0,0 +1,25 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: avahi-reflector
+spec:
+  selector:
+    matchLabels:
+      app: avahi-reflector
+  template:
+    metadata:
+      labels:
+        app: avahi-reflector
+    spec:
+      hostNetwork: true
+      containers:
+        - name: avahi-reflector
+          image: avahi-reflector
+          securityContext:
+            privileged: true   # required for raw sockets
+          env:
+            - name: REFLECTOR_ENABLE_REFLECTOR
+              value: "yes"
+            - name: SERVER_ALLOW_INTERFACES
+              # use all interfaces
+              value: ""

apps/avahi-reflector/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: avahi
+
+resources:
+  - namespace.yaml
+  - daemonset.yaml
+  # - configmap.yaml
+
+images:
+  - name: avahi-reflector
+    newName: flungo/avahi
+    newTag: latest

apps/avahi-reflector/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder
+  labels:
+    pod-security.kubernetes.io/enforce: privileged

apps/files/kustomization.yaml

@@ -13,4 +13,4 @@ namespace: files
 images:
   - name: ocis
     newName: owncloud/ocis
-    newTag: "7.3.0"
+    newTag: "7.3.1"

apps/grafana/kustomization.yaml

@@ -17,5 +17,5 @@ helmCharts:
   - releaseName: grafana
     name: grafana
     repo: https://grafana.github.io/helm-charts
-    version: 10.1.4
+    version: 10.2.0
     valuesFile: grafana.values.yaml

apps/homeassistant/base/kustomization.yaml

@@ -13,7 +13,7 @@ resources:
 images:
   - name: homeassistant
     newName: homeassistant/home-assistant
-    newTag: "2025.10"
+    newTag: "2025.11"
 
 configurations:
   # allow nameReference to work with different mentions of the same resource as well

apps/immich/kustomization.yaml

@@ -15,13 +15,13 @@ namespace: immich
 helmCharts:
   - name: immich
     releaseName: immich
-    version: 0.10.1
+    version: 0.10.3
     valuesFile: values.yaml
     repo: https://immich-app.github.io/immich-charts
 
 
 images:
   - name: ghcr.io/immich-app/immich-machine-learning
-    newTag: v2.1.0
+    newTag: v2.3.1
   - name: ghcr.io/immich-app/immich-server
-    newTag: v2.1.0
+    newTag: v2.3.1

apps/immich/servicemonitor.yaml

@@ -6,6 +6,7 @@ spec:
   endpoints:
   - port: metrics-api
     scheme: http
+    path: /metrics
   selector:
     matchLabels:
       # app.kubernetes.io/name: server

apps/kitchenowl/ingress.yaml

@@ -8,10 +8,22 @@ spec:
     - websecure
   routes:
   - match: Host(`kitchen.kluster.moll.re`)
+    middlewares:
+      - name: kitchenowl
     kind: Rule
     services:
     - name: kitchenowl-web
       port: 8080
 
   tls:
-    certResolver: default-tls 
+    certResolver: default-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: kitchenowl
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+      Upgrade: "websocket"

apps/media/kustomization.yaml

@@ -12,4 +12,4 @@ resources:
 images:
   - name: jellyfin/jellyfin
     newName: jellyfin/jellyfin
-    newTag: 10.11.2
+    newTag: 10.11.3

apps/musicassistant/deployment.yaml

@@ -0,0 +1,43 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: musicassistant
+spec:
+  selector:
+    matchLabels:
+      app: musicassistant
+  template:
+    metadata:
+      labels:
+        app: musicassistant
+    spec:
+      containers:
+      - name: musicassistant
+        image: musicassistant
+        resources:
+          limits:
+            memory: "2Gi"
+            cpu: "2"
+          requests:
+            memory: "128Mi"
+            cpu: "250m"
+        ports:
+        # ports required for musicassistant
+        - containerPort: 80
+        - containerPort: 443
+        - containerPort: 8097
+        - containerPort: 8095
+          # name: musicassistant-web
+        - containerPort: 1704
+        - containerPort: 1705
+
+        env:
+        - name: TZ
+          value: Europe/Berlin
+        volumeMounts:
+        - name: data
+          mountPath: /data
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: data

apps/musicassistant/ingress.yaml

@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: musicassistant-ingressroute
+
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`musicassistant.kluster.moll.re`)
+    kind: Rule
+    services:
+    - name: musicassistant-web
+      port: musicassistant-web
+
+  tls:
+    certResolver: default-tls

apps/musicassistant/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: musicassistant
+
+resources:
+  - namespace.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  # - ingress.yaml
+
+
+images:
+  - name: musicassistant
+    newName: ghcr.io/music-assistant/server
+    newTag: 2.6.0

apps/musicassistant/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder

apps/musicassistant/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: data
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

apps/musicassistant/service.yaml

@@ -0,0 +1,41 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: musicassistant
+spec:
+  selector:
+    app: musicassistant
+  ports:
+  - port: 80
+    targetPort: 80
+    name: required-first
+  - port: 443
+    targetPort: 443
+    name: required-second
+  - port: 8097
+    targetPort: 8097
+    name: required-third
+  - port: 8095
+    targetPort: 8095
+    name: required-fourth
+  - port: 1704
+    targetPort: 1704
+    name: required-fifth
+  - port: 1705
+    targetPort: 1705
+    name: required-sixth
+  type: LoadBalancer
+  loadBalancerIP: 192.168.3.5
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: musicassistant-web
+spec:
+  selector:
+    app: musicassistant
+  ports:
+  - port: 8095
+    targetPort: 8095
+    name: musicassistant-web
+  type: ClusterIP

apps/ntfy/kustomization.yaml

@@ -13,4 +13,4 @@ resources:
 images:
   - name: binwiederhier/ntfy
     newName: binwiederhier/ntfy
-    newTag: v2.14.0
+    newTag: v2.15.0

apps/paperless/kustomization.yaml

@@ -14,14 +14,14 @@ namespace: paperless
 images:
   - name: paperless
     newName: ghcr.io/paperless-ngx/paperless-ngx
-    newTag: "2.19.4"
+    newTag: "2.20.0"
 
 
 helmCharts:
   - name: redis
     releaseName: redis
     repo: https://charts.bitnami.com/bitnami
-    version: 23.2.5
+    version: 24.0.0
     valuesInline:
       auth:
         enabled: false

apps/recipes/kustomization.yaml

@@ -13,5 +13,5 @@ resources:
 
 images:
   - name: mealie
-    newTag: v3.4.0
+    newTag: v3.5.0
     newName: ghcr.io/mealie-recipes/mealie

apps/snapcast/deployment.yaml

@@ -0,0 +1,101 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: snapcast
+spec:
+  selector:
+    matchLabels:
+      app: snapcast
+  template:
+    metadata:
+      labels:
+        app: snapcast
+    spec:
+      containers:
+      - name: snapcast
+        image: snapcast
+        resources:
+          limits:
+            memory: "2Gi"
+            cpu: "2"
+          requests:
+            memory: "128Mi"
+            cpu: "250m"
+        ports:
+        # snapcast ports
+        - containerPort: 1704
+        - containerPort: 1705
+        # web interface
+        - containerPort: 1780
+        - containerPort: 1788
+        # avahi
+        - containerPort: 5353
+        # airplay
+        - containerPort: 3689
+        - containerPort: 5000
+        - containerPort: 6000
+        - containerPort: 6001
+        - containerPort: 6002
+        - containerPort: 6003
+        - containerPort: 6004
+        - containerPort: 6005
+        - containerPort: 6006
+        - containerPort: 6007
+        - containerPort: 6008
+        - containerPort: 6009
+        - containerPort: 7000
+        - containerPort: 319
+        - containerPort: 320
+
+        env:
+        - name: TZ
+          value: Europe/Berlin
+        - name: AIRPLAY_CONFIG_ENABLED
+          value: "0"
+        - name: SPOTIFY_CONFIG_ENABLED
+          value: "0"
+        volumeMounts:
+        - name: pipe
+          mountPath: /mnt/pipe
+
+
+      - name: librespot
+        image: librespot
+        resources:
+          limits:
+            memory: "2Gi"
+            cpu: "2"
+          requests:
+            memory: "128Mi"
+            cpu: "250m"
+        # ports:
+        env:
+        - name: BACKEND
+          value: pipe
+        - name: DEVICE
+          value: /mnt/pipe/spotipipe
+        volumeMounts:
+        - name: pipe
+          mountPath: /mnt/pipe
+      volumes:
+      - name: pipe
+        emptyDir: {}
+
+
+        # - name: SPOTIFY_ACCESS_TOKEN
+        #   value: BQBxGPPPXZTXF7WTBzJItu3KNkeoZu2j2-Rlk1RmtnmXvzPh1fWFpOT2VeXwWxMJXlBYwxSOTo1ZKk3hAr08OhDhbQChi6KDl6qEmK-Y8Wq8g3EoP7M-oRnHt4WFMg1zC1C37t90nQUKZ-F9UdSuL9A6Ny6V6pYsai1bUspOU0q5UHn6-Dv9E8gwEKXOPMlBKEXNi1D0sT2m9rzwI7UK1g7ToRPn03eqGe41RRvlfrSCgf41tg
+
+
+        # - name: SPOTIFY_EXTRA_ARGS
+        #   value: " --disable-discovery --access-token BQBxGPPPXZTXF7WTBzJItu3KNkeoZu2j2-Rlk1RmtnmXvzPh1fWFpOT2VeXwWxMJXlBYwxSOTo1ZKk3hAr08OhDhbQChi6KDl6qEmK-Y8Wq8g3EoP7M-oRnHt4WFMg1zC1C37t90nQUKZ-F9UdSuL9A6Ny6V6pYsai1bUspOU0q5UHn6-Dv9E8gwEKXOPMlBKEXNi1D0sT2m9rzwI7UK1g7ToRPn03eqGe41RRvlfrSCgf41tg"
+      #   volumeMounts:
+      #   - name: config
+      #     mountPath: /config
+      #   - name: snapserver-config
+      #     mountPath: /root/.config/
+      # volumes:
+      # - name: config
+      #   secret:
+      #     secretName: snapcast-config
+      # - name: snapserver-config
+      #   emptyDir: {}

apps/snapcast/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: snapcast
+
+resources:
+  - namespace.yaml
+  - deployment.yaml
+  - service.yaml
+  - snapcast-config.secret.yaml
+
+images:
+  - name: snapcast
+    newName: ghcr.io/firefrei/snapcast/server
+    newTag: latest
+  - name: librespot
+    newName: giof71/librespot
+    newTag: latest

apps/snapcast/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder

apps/snapcast/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: data
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

apps/snapcast/service.yaml

@@ -0,0 +1,86 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: snapcast
+spec:
+  selector:
+    app: snapcast
+  ports:
+  - name: snapcast
+    port: 1704
+    targetPort: 1704
+    protocol: TCP
+  - name: snapcast-ctl
+    port: 1705
+    targetPort: 1705
+    protocol: TCP
+  - name: web
+    port: 1780
+    targetPort: 1780
+    protocol: TCP
+  - name: web-alt
+    port: 1788
+    targetPort: 1788
+    protocol: TCP
+  # - name: airplay-3689
+  #   port: 3689
+  #   targetPort: 3689
+  #   protocol: TCP
+  # - name: airplay-5000
+  #   port: 5000
+  #   targetPort: 5000
+  #   protocol: TCP
+  # - name: airplay-6000
+  #   port: 6000
+  #   targetPort: 6000
+  #   protocol: TCP
+  # - name: airplay-6001
+  #   port: 6001
+  #   targetPort: 6001
+  #   protocol: TCP
+  # - name: airplay-6002
+  #   port: 6002
+  #   targetPort: 6002
+  #   protocol: TCP
+  # - name: airplay-6003
+  #   port: 6003
+  #   targetPort: 6003
+  #   protocol: TCP
+  # - name: airplay-6004
+  #   port: 6004
+  #   targetPort: 6004
+  #   protocol: TCP
+  # - name: airplay-6005
+  #   port: 6005
+  #   targetPort: 6005
+  #   protocol: TCP
+  # - name: airplay-6006
+  #   port: 6006
+  #   targetPort: 6006
+  #   protocol: TCP
+  # - name: airplay-6007
+  #   port: 6007
+  #   targetPort: 6007
+  #   protocol: TCP
+  # - name: airplay-6008
+  #   port: 6008
+  #   targetPort: 6008
+  #   protocol: TCP
+  # - name: airplay-6009
+  #   port: 6009
+  #   targetPort: 6009
+  #   protocol: TCP
+  # - name: airplay-7000
+  #   port: 7000
+  #   targetPort: 7000
+  #   protocol: TCP
+  # - name: airplay-319
+  #   port: 319
+  #   targetPort: 319
+  #   protocol: UDP
+  # - name: airplay-320
+  #   port: 320
+  #   targetPort: 320
+  #   protocol: UDP
+  type: LoadBalancer
+  loadBalancerIP: 192.168.3.5

infrastructure/external-dns/kustomization.yaml

@@ -11,4 +11,4 @@ resources:
 images:
   - name: dns
     newName: git.kluster.moll.re/remoll/dns
-    newTag: 0.0.2-build.100
+    newTag: 0.0.2-build.113

infrastructure/monitoring/kustomization.yaml

@@ -6,7 +6,7 @@ namespace: monitoring
 resources: 
   - namespace.yaml
   # prometheus-operator crds
-  - https://github.com/prometheus-operator/prometheus-operator?ref=v0.86.1
+  - https://github.com/prometheus-operator/prometheus-operator?ref=v0.86.2
   # single prometheus instance with a thanos sidecar
   - prometheus.yaml
   - thanos-store.statefulset.yaml
@@ -24,10 +24,10 @@ helmCharts:
   - name: loki
     releaseName: loki
     repo: https://grafana.github.io/helm-charts
-    version: 6.45.2
+    version: 6.46.0
     valuesFile: loki.values.yaml
   - name: prometheus-node-exporter
     releaseName: prometheus-node-exporter
     repo: https://prometheus-community.github.io/helm-charts
-    version: 4.49.1
+    version: 4.49.2
     valuesFile: prometheus-node-exporter.values.yaml

infrastructure/renovate/kustomization.yaml

@@ -11,4 +11,4 @@ resources:
 images:
   - name: renovate/renovate
     newName: renovate/renovate
-    newTag: "41"
+    newTag: "42"

infrastructure/sealedsecrets/kustomization.yaml

@@ -9,4 +9,4 @@ resources:
 images:
   - name: controller
     newName: docker.io/bitnami/sealed-secrets-controller
-    newTag: 0.32.2
+    newTag: 0.33.1

infrastructure/traefik-system/configmap.yaml

@@ -66,6 +66,11 @@ data:
         [entryPoints.websecure.forwardedHeaders]
           insecure = true
           # forward ip headers no matter where they come from
+        [entryPoints.websecure.transport.respondingTimeouts]
+          readTimeout  = "0"
+          # writeTimeout = "300s"
+          # idleTimeout  = "180s"
+
 
       [entryPoints.metrics]
         address = ":9100"

infrastructure/traefik-system/kustomization.yaml

@@ -13,6 +13,6 @@ namespace: traefik-system
 helmCharts:
   - name: traefik
     releaseName: traefik
-    version: 37.2.0
+    version: 37.3.0
     valuesFile: values.yaml
     repo: https://traefik.github.io/charts